HelseID
summary
HelseID is a national OAuth2/OpenID Connect authorization service that now protects most Norwegian eHealth APIs and issues about a million access tokens and 100 000 logins per week, running in production since 2018. It uses Duende/IdentityServer on .NET, integrates national eIDs, requires authorization code and client credentials only, enforces PKCE and asymmetric client auth, issues short-lived, single-audience access tokens (minutes), supports legacy desktop EHRs via embedded or system browsers, and is moving toward automated self service and higher SLAs.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:43The Norwegian Health Sector
- 31:06Integrating with Healthcare
- 45:23The Oauth Security Workshop
- 48:38What's the Hardest Part of Creating Health Theater
- 53:22Changing the Content of the Security Token
related talks
01h 00mHelseID Introducing Modern Web Security in a Geriatric Health Sector
57mDeath by downtime
59mOAuth2 on a national level - how to secure extremely sensitive apis
47mWho's your user? OpenID from the ground-up
28mBringing FIDO2 to National Identity
16mSecure Digital Identification and Signing – Cross-Industry and Europe-Wide
41mDigital Identities: What Is the Key to Digital Healthcare?
38mIdentity Card – the Alternative to Username and Password