Skip to content

Commit 01ef0f5

Browse files
paul-forrester-bjsspaul-forrester-bjss
authored
Merge pull request #1516 from NHSDigital/feature/ERSSUP-75192
ERSSUP-75192 - RM65b: Apigee validates Professional user's Identity Assurance Level (IAL) before allowing access to e-RS
2 parents ba68a55 + f67b3c7 commit 01ef0f5

File tree

47 files changed

+596
-123
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+596
-123
lines changed

‎.editorconfig‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ end_of_line = lf
1111
[Makefile]
1212
indent_style = tab
1313

14-
[*.{xml,js,json,yaml}]
14+
[*.{js,json,yaml}]
1515
indent_size = 2
1616

1717
[*.postman_collection.json]

proxies/live/apiproxy/policies/AssignMessage.OAuthPolicyOperationOutcomeErrorResponse.xml renamed to proxies/live/apiproxy/policies/AssignMessage.AuthenticationOperationOutcomeErrorResponse.xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
<AssignMessage async="false" continueOnError="false" enabled="true" name="AssignMessage.OAuthPolicyOperationOutcomeErrorResponse">
1+
<AssignMessage async="false" continueOnError="false" enabled="true" name="AssignMessage.AuthenticationOperationOutcomeErrorResponse">
22
<Set>
33
<StatusCode>401</StatusCode>
4-
<Payload contentType="application/fhir+json" variablePrefix="%" variableSuffix="#">{ "resourceType": "OperationOutcome", "meta": { "lastUpdated": "%current_timestamp#", "profile" : [ "https://www.hl7.org/fhir/R4/operationoutcome.html" ] }, "issue": [ { "severity": "error", "code": "login", "details": { "coding": [ { "system": "https://fhir.nhs.uk/CodeSystem/NHSD-API-ErrorOrWarningCode", "code": "ACCESS_DENIED" } ] }, "diagnostics": "%faultstring#" } ] }</Payload>
4+
<Payload contentType="application/fhir+json" variablePrefix="%" variableSuffix="#">{ "resourceType": "OperationOutcome", "meta": { "lastUpdated": "%current_timestamp#", "profile" : [ "%op_outcome_fhir_profile#" ] }, "issue": [ { "severity": "error", "code": "%op_outcome_issue_code#", "details": { "coding": [ { "system": "%op_outcome_issue_details_coding_system#", "code": "%op_outcome_issue_details_coding_code#" } ] }, "diagnostics": "%faultstring#" } ] }</Payload>
55
</Set>
66
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
77
<AssignTo createNew="false" transport="http" type="response"/>

‎proxies/live/apiproxy/policies/AssignMessage.Set.x-ers-acr-header.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<AssignMessage continueOnError="true" name="AssignMessage.Set.x-ers-acr-header">
22
<Set>
33
<Headers>
4-
<Header name="x-ers-acr">{jwt.DecodeJWT-id-token.decoded.claim.acr}</Header>
4+
<Header name="x-ers-acr">{accesstoken.id_token-acr}</Header>
55
</Headers>
66
</Set>
77
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>

‎proxies/live/apiproxy/policies/AssignMessage.Set.x-ers-id-assurance-level-header.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
<AssignMessage continueOnError="true" name="AssignMessage.Set.x-ers-id-assurance-level-header">
22
<Set>
33
<Headers>
4-
<Header name="x-ers-id-assurance-level">{jwt.DecodeJWT-id-token.decoded.claim.id_assurance_level}</Header>
4+
<Header name="x-ers-id-assurance-level">{accesstoken.id_token-id-assurance-level}</Header>
55
</Headers>
66
</Set>
77
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>

‎proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeIssueCodeLogin.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<AssignMessage enabled="true" name="AssignMessage.SetOperationOutcomeIssueCodeLogin">
2+
<AssignVariable>
3+
<Name>op_outcome_issue_code</Name>
4+
<Value>login</Value>
5+
</AssignVariable>
6+
</AssignMessage>

‎proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeIssueIal.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
<AssignMessage enabled="true" name="AssignMessage.SetOperationOutcomeIssueIal">
2+
<AssignVariable>
3+
<Name>op_outcome_issue_code</Name>
4+
<Value>forbidden</Value>
5+
</AssignVariable>
6+
<AssignVariable>
7+
<Name>faultstring</Name>
8+
<Value>We couldn't verify your identity. Contact your local Registration Authority or IT department for help.</Value>
9+
</AssignVariable>
10+
</AssignMessage>

‎proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeVariablesPreR4.xml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<AssignMessage enabled="true" name="AssignMessage.SetOperationOutcomeVariablesPreR4">
2+
<AssignVariable>
3+
<Name>op_outcome_fhir_profile</Name>
4+
<Value>https://fhir.nhs.uk/STU3/StructureDefinition/eRS-OperationOutcome-1</Value>
5+
</AssignVariable>
6+
<AssignVariable>
7+
<Name>op_outcome_issue_details_coding_system</Name>
8+
<Value>https://fhir.nhs.uk/STU3/CodeSystem/eRS-APIErrorCode-1</Value>
9+
</AssignVariable>
10+
<AssignVariable>
11+
<Name>op_outcome_issue_details_coding_code</Name>
12+
<Value>NO_ACCESS</Value>
13+
</AssignVariable>
14+
</AssignMessage>

‎proxies/live/apiproxy/policies/AssignMessage.SetOperationOutcomeVariablesR4.xml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
<AssignMessage enabled="true" name="AssignMessage.SetOperationOutcomeVariablesR4">
2+
<AssignVariable>
3+
<Name>op_outcome_fhir_profile</Name>
4+
<Value>https://www.hl7.org/fhir/R4/operationoutcome.html</Value>
5+
</AssignVariable>
6+
<AssignVariable>
7+
<Name>op_outcome_issue_details_coding_system</Name>
8+
<Value>https://fhir.nhs.uk/CodeSystem/NHSD-API-ErrorOrWarningCode</Value>
9+
</AssignVariable>
10+
<AssignVariable>
11+
<Name>op_outcome_issue_details_coding_code</Name>
12+
<Value>ACCESS_DENIED</Value>
13+
</AssignVariable>
14+
</AssignMessage>

‎proxies/live/apiproxy/policies/DecodeJWT-id-token.xml‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎proxies/live/apiproxy/policies/RaiseFault.401InsufficientIal.xml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<RaiseFault async="false" continueOnError="false" enabled="true" name="RaiseFault.401InsufficientIal">
2+
<FaultResponse>
3+
<Set>
4+
<StatusCode>401</StatusCode>
5+
<ReasonPhrase>Unauthorized</ReasonPhrase>
6+
</Set>
7+
</FaultResponse>
8+
<IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
9+
</RaiseFault>

0 commit comments

Comments
 (0)