We are implementing CIS2 using the User-restricted RESTful APIs - CIS2 combined authentication and authorisation security pattern as this is recommended for accessing user-restricted API’s. This is to authorise requests for integrations with the PDS, NCRS and Patient Flags APIs.
I understand that for non-smartcard users we would need to provide a custom interface to enable them to select a role as the CIS2 authorisation prompting the user to select a role isn’t supported by the combined integration.
We are looking at a possible smartcard-only solution though so want to confirm if the response to a userinfo request will always include the selected_roleid for a smartcard user? The tests we have carried out using the integration endpoint includes the selected_roleid but we want to make sure this would be consistent in production.
To note when making the initial authorisation request we are supplying the following values:
response_type - code
client_id - API key
redirect_uri - callback URI
state - unique value
acr_values - AAL2_OR_AAL3_ANY
Hi Duncan,
We’ve just updated our guidance around this (just yesterday) - see https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/user-restricted-restful-apis-cis2-combined-authentication-and-authorisation#step-7-determine-the-healthcare-worker-s-role.
We no longer recommend a smartcard-only option for combined auth because it only works if users have the legacy Identity Agent installed on their device, which is due to be retired in February 2027.
If you want to use combined auth, you’ll need to write your own role selection mechanism as described at the above link. If you use separate auth, you’ll be able to use our role selection mechanism. There is more assurance work with separate auth but less coding and I’d recommend going down that route.
Thanks Tony.
With the retirement of the Identity Agent would this mean the smartcard users would no longer be prompted to select a role? So if we were to stick with the combined auth pattern and provide our own interface for role selection they would only be selecting a role once?
Hi Duncan,
That’s right. Double role selection will disappear as end user organisations migrate from Identity Agent to Smartcard Connect.
I would still strongly encourage you to use separate auth - that way you are protected against any changes in the way role selection works - no need to maintain your own code for something that we can do for you.