Vital is committed to delivering software that is both user-friendly and secure. We believe that technology should be intuitive, elegant, and easy to use, while also providing robust security features to keep our customers' data safe.
SSO is Vital's preferred method of authentication and clinician login, as it provides the easiest and most seamless experience for users.
Key Benefits
Improved user experience. SSO simplifies the login process for clinicians and staff, as they only need to remember a single set of credentials. Once users are signed in to their organization's network using their existing credentials, they won't need to sign in again to access Care Team.
Enhanced productivity. With SSO, clinicians and staff can quickly access Care Team to efficiently address patient needs and proactively offer assistance to patients to prevent service recovery escalations.
Stronger security. SSO enables organizations to enforce stronger security measures. Instead of relying on weak or reused passwords, SSO encourages the use of complex, unique passwords for a single set of credentials. Additionally, centralized authentication allows for better control and monitoring of user access, reducing the risk of unauthorized access.
Cost and time savings. By implementing SSO, organizations can reduce the number of password-related support requests, as users have fewer credentials to manage. This leads to cost and time savings for IT departments, allowing them to focus on other critical tasks.
Integration guide
Below is a high-level overview of the steps required to complete SSO integration with Vital.
1. Information gathering
Vital's implementation resources and your technical resource will schedule a call to discuss the customer checklist and collaboratively develop a deployment plan. This call will provide an opportunity to align expectations, clarify requirements, and ensure a smooth rollout.
2. Exchange technical requirements
Vital's URLs
Type | Address |
Origin URL |
|
Callback URL |
|
Customer configuration
Your organization will need to provide the following:
IdP / Connection Type
Client ID
Client Secret
Domain / URL
Signing Certificate
3. Configure SSO groups
Your IdP must be configured to pass user group membership to Vital via custom claims during SSO login. This allows Vital to authorize user activity, including which roles a user has and which facilities they can access, and keep it in sync each time a user logs in.
All group membership information is transmitted via a single claim, the name of which depends on the protocol used:
Protocol | Claim name |
SAML |
|
OIDC |
|
Design constraints
A user's facility-scoped roles are the same at all facilities they are authorized to work at.
A user's enabled facilities should not exceed 20 locations.
Facility identifiers are provided by Vital and mapped to internal identifiers on the Vital side.
Facility identifiers are short (fewer than 10 characters) and persistent.
All SSO group membership information is transmitted via a single claim.
Facility-scoped roles
Defines which roles a Care Team user has, and consequently what the user is able to do. The assigned role (or roles) is applied to all enabled facilities for the user.
Claim value prefix: each value must be prefixed with vital-role-.
Role | Description | Claim value |
Analytics | Analytics and reporting access. |
|
Clinical | Clinical care team member. |
|
Data Analyst | Data analytics and reporting access. |
|
Incidental Findings | Incidental findings review and follow-up. |
|
Management | Full management access including settings. |
|
Patient Experience | Patient experience and communications. |
|
Registration | Patient registration and check-in. |
|
Support Services | Environmental and support services. |
|
Volunteer | Volunteer with limited task access. |
|
Enabled facilities
Defines which facilities a Care Team user has access to, constraining where the user can perform their facility-scoped roles. A user has access to the app for only the facilities specified in this claim.
Claim value prefix: each value must be prefixed with vital-facility-.
Vital will provide a short facility identifier for each of your facilities. Claim values are this identifier with the prefix applied, for example, vital-facility-acme and vital-facility-glass.
Facility IDs included in SSO groups are validated against the agreed-upon list; any unrecognized facility ID is skipped during login.
Example: OIDC token
The following is an example token issued by an OIDC IdP, showing the custom groups defined above:
{
"email": "jane@customer.org",
"email_verified": true,
"iss": "https://idp.customer.org/",
"sub": "custom|123",
"aud": "my_client_id",
"iat": 1311280970,
"exp": 1311281970,
"groups": [
"vital-role-clinical",
"vital-role-patient-experience",
"vital-facility-acme",
"vital-facility-glass"
]
}
In this case the user would be authorized for:
Clinical role at the Acme and Glass facilities, and;
Patient Experience role at the Acme and Glass facilities
Example: SAML assertion
The source material for this example was incomplete/malformed in the original document (not valid SAML XML) and has been omitted from this draft rather than republished as-is. See DRAFT NOTES below, recommend sourcing a corrected SAML attribute statement example from engineering before publishing this section.
4. Configure connection
Once all the necessary documents and information have been gathered, the connection can be configured by Vital.
5. Develop a communication plan
Determine how you'll inform users that they now have access to Care Team through SSO.
Frequently Asked Questions
What identity providers (IdPs) are we compatible with?
ADFS
Azure Active Directory
Azure Active Directory Native
Google Workspace
Okta
OpenID Connect
PingFederate
SAML
What protocols do we support?
Security Assertion Markup Language (SAML)
OpenID Connect (OIDC)
Open Authorization (OAuth) 2
How long does it take to implement SSO?
The majority of the time taken in SSO implementation is usually spent on gathering the necessary information and configuring the system. Once this has been completed, the actual process of implementing SSO takes a few minutes. The step-by-step process is covered below.
Have a question this article hasn't answered? Send us an email at security@vital.io.