Not being prompted to select roles even with selectedrole scope

Care Identity Service (CIS)
1

I am authenticating against the integration environment via CIS2 and I cannot seem to make the user select a role during login.

I am specifying the ‘selectedrole’ scope, but when logging in, the user only sees these steps:

  • Select your login method (selects authenticator)
  • Log in with your Care Identity (email address/password)
  • Check your authenticator app (enter code)

Once the code is entered and the user submits, the user is redirected back to our app with the code querystring.

We then call https://int.api.service.nhs.uk/oauth2/token to get the access token, then we call https://int.api.service.nhs.uk/oauth2/userinfo to get the user details. In this response, we get multiple nhsid_nrbac_roles, with different values for each (e.g., org_code and person_roleid).

As I understood it, using the selectedrole scope should make the user choose a role before they are redirected back to our app, but that’s not happening.

Are we missing a step somewhere to make this work, or could this be a data issue with the user we’re logging in with?

2

Hi Jamie, the userinfo and token endpoints you have specified are managed by API-M and I am therefore assuming that you are using the combined auth rather than separate auth. Combined auth doesn’t support selectedrole and you would need to switch to separate auth to use that scope. Combined auth is meant to simplify the process and i very restricted in the options you can pass through to CIS2 Auth

3

Guidance on how to select roles with combined auth is at https://digital.nhs.uk/developer/guides-and-documentation/security-and-authorisation/user-restricted-restful-apis-cis2-combined-authentication-and-authorisation#step-7-determine-the-healthcare-worker-s-role.