Test
ehdsi_AuthnContextE - 1
Location
/Assertion
Description
The Reference to the HCP authentication method element AuthnContextClassRef of the element 'AuthnContext' is required and shall be set to 'urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession'.
Test
ehdsi_NextOfKin_IdentifiersE - 2
Location
/Assertion
Description
eHDSI Next of Kin Identifiers attributes is mandatory in a Next of Kin Identity Assertion
Test
consNPII - 1
Location
/Assertion/AttributeStatement[0]
Description
The SAML assertion sent by the X-Service User may contain an <AttributeStatement> element with a National Provider Identifier (NPI) attribute (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
consSubjectOrganizationI - 2
Location
/Assertion/AttributeStatement[0]
Description
The SAML assertion sent by the X-Service User may contain an <AttributeStatement> element with an Subject Organization attribute (ITI TF Vol2b, 3.40.4.1.2).[ Assertion... ]
Test
ehdsi_PurposeOfUseR - 1
Location
/Assertion
Description
The XSPA Purpose Of Use element Attribute/@FriendlyName=XSPA Purpose Of Use is optional. Element Code shall be set to one of those values : “TREATMENT”, “EMERGENCY”. Element CodeSystem must be 3bc18518-d305-46c2-a8d6-94bd59856e9e and codeSystemName must be eHDSI PurposeofUse”.
Test
ehdsi_AudienceRestrictionR - 2
Location
/Assertion
Description
The Audience role element shall be set to 'urn:ehdsi:assertions.audience:x-border'
Test
ehdsi_ConditionsR - 3
Location
/Assertion
Description
Assertion Conditions element is required.
Test
ehdsi_IssuerR - 4
Location
/Assertion
Description
Issuer format shall conform to URI
Test
ehdsi_NameIDR - 5
Location
/Assertion
Description
The Identifier of the HCP NameID element is required. It shall be encoded as an X.509 subject name if the 'Format' is 'urn:oasis:names:tc:SAML:1.1:nameid-format:X509SubjectName', or as an e-Mail address if the 'Format' is 'urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress', or as a string value (unspecified format) if 'Format' is 'urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified'.
Test
ehdsi_NotOnOrAfterR - 6
Location
/Assertion
Description
The attribute '@NotOnOrAfter' of the element 'Conditions' is required
Test
ehdsi_SignatureR - 7
Location
/Assertion
Description
Assertion Signature element is required.
Test
ehdsi_Signature_CanonicalizationMethodR - 8
Location
/Assertion
Description
The element SignedInfo/CanonicalizationMethod is required and his attribute '@Algorithm' shall be set to 'http://www.w3.org/2001/10/xml-exc-c14n#' or 'http://www.w3.org/2001/10/xml-exc-c14n#WithComments'.
Test
ehdsi_Signature_DigestMethodR - 9
Location
/Assertion
Description
The hash algorithm MUST comply with the eHDSI recommendations on algorithms and key lengths. For signing assertions the digest methodmethod http://www.w3.org/2000/09/xmldsig#sha1 or http://www.w3.org/2001/04/xmlenc#sha256 shall be used. A country MAY reject SHA-1 digests.
Test
ehdsi_Signature_KeyInfoR - 10
Location
/Assertion
Description
The element KeyInfo is required and shall either contain a wsse:SecurityTokenReference element which references the X.509 certificate of the assertion’s issuer by using a subject key identifier OR contain a ds:X509Data element which contains the X.509 certificate of the assertion issuer.
Test
ehdsi_Signature_SignatureMethodR - 11
Location
/Assertion
Description
The signature method MUST comply with the eHDSI recommendations on algorithms and key lengths. For signing assertions the signature method http://www.w3.org/2001/04/xmldsig-more#rsa-sha256” or http://www.w3.org/2000/09/xmldsig#rsa-sha1 shall be used. A country MAY reject signatures that use SHA-1 for digesting.
Test
ehdsi_Signature_TransformR - 12
Location
/Assertion
Description
Enveloped signature transform acc. to section 6.6.4 of [W3C XMLDSig] SHOULD be used (“http://www.w3.org/2000/09/xmldsig#enveloped-signature”). In addition, exclusive canonicalization SHOULD be defined as transformation (('http://www.w3.org/2001/10/xml-exc-c14n#' or 'http://www.w3.org/2001/10/xml-exc-c14n#WithComments')
Test
ehdsi_SubjectConfirmationR - 13
Location
/Assertion
Description
The attribute 'Format' of the element SubjectConfirmation shall be set to the value 'urn:oasis:names:tc:SAML:2.0:cm:sender-vouches'.
Test
ehdsi_VersionR - 14
Location
/Assertion
Description
Assertion 'Version' attribute is required and need to be set to the value '2.0'.
Test
ehdsi_XSPA_SubjectR - 15
Location
/Assertion
Description
The XSPA subject element Attribute/@FriendlyName=XSPA subject is required and it shall contain the full name of the HCP, and the attribute '@Name' shall be set to 'urn:oasis:names:tc:xspa:1.0:subject:subject-id'.
Test
consAttrStatementR - 16
Location
/Assertion
Description
The Assertion may contain other statements (e.g. Attributes) (ITI TF 3.40.4.1.2)[ Assertion... ]
Test
consAuthnStatementR - 17
Location
/Assertion
Description
Assertion SHALL contain AuthnStatement with AuthnContextClassRef or AuthnContextDeclRef (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
conssubjectR - 18
Location
/Assertion
Description
Assertion SHALL have a Subject (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
conssubjconfR - 19
Location
/Assertion/Subject
Description
Subject SHALL have SubjectConfirmation element (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
consAudienceRestR - 20
Location
/Assertion/Conditions
Description
Conditions SHALL contain an AudienceRestriction containing an Audience (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
consOneTimeUseR - 21
Location
/Assertion/Conditions
Description
An X-Service User may ignore a OneTimeUse condition. (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
consProxyRestrictionR - 22
Location
/Assertion/Conditions
Description
An X-Service User may ignore a ProxyRestriction condition. (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
consnotbeforeR - 23
Location
/Assertion/Conditions
Description
NotBefore attribute SHALL be populated (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
consHomeCommunityIdR - 24
Location
/Assertion/AttributeStatement[0]
Description
The SAML assertion sent by the X-Service User may contain an <AttributeStatement> element with a Home Community ID attribute (ITI TF Vol2b, 3.40.4.1.2).[ Assertion... ]
Test
consOrganizationIDR - 25
Location
/Assertion/AttributeStatement[0]
Description
The SAML assertion sent by the X-Service User may contain an <AttributeStatement> element with a Organization ID attribute (ITI TF Vol2b, 3.40.4.1.2).[ Assertion... ]
Test
consSubjectIdR - 26
Location
/Assertion/AttributeStatement[0]
Description
The SAML assertion sent by the X-Service User may contain an <AttributeStatement> element with a Subject ID attribute. (ITI TF Vol2b, 3.40.4.1.2)[ Assertion... ]
Test
consValueOIDR - 27
Location
/Assertion/AttributeStatement[0]/Attribute[2]
Description
The value shall be the Home Community ID (an Object Identifier) assigned to the Community that is initiating the request, using the urn format (that is, urn:oid appended with the OID). (ITI TF Vol2b,, 3.40.4.1.2) (ITI TF Vol2b,[ Assertion... ]