SSO/ADFS Customer Integration Steps

SSO/ADFS Setup

Prerequisites

• AD FS 3.0 or later.

• AD FS will need to be set up, working properly, and publicly accessible from the Internet for Apteryx to use it for authentication. See https://docs.microsoft.com/en-us/windowsserver/identity/active-directory-federation-services

• Microsoft Server Manager https://docs.microsoft.com/en-us/windows-server/administration/server-manager/server-manager

Procedures

1. In Server Manager, add a new relying party trust and choose to enter data
   manually. See https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/operations/create-a-relying-party-trust for more details.

2. The display name can be anything. We recommend using “Apteryx” so
   it’s easy to remember.

3. Leave the certificate configuration blank. This will use the default AD FS
   certificates.

4. Enable support for the WS-Federation Passive protocol.
   • The URL will be:
   https://identity.Apteryx.net/{Site_Name}.{Site_Hostname}/
   • For example, https://identity.Apteryx.net/adfstesting.Apteryx.net/

5. The WS-Federation Passive URL should already be listed in the relying
   party identifiers. If it is not, add it.

6. You will also need to add an additional identifier:

   1. urn:{Site_Name}.{Site_Hostname}

   2. For example, urn:adfstesting.Apteryx.net

7. Now you can click next until you reach the claims section.

8. Add a new rule. Select Send LDAP Attributes as Claims. Set up the rule
   as follows:

   

9. Set up claims - these use the “Send Group Membership as a Claim”
   template. Outgoing claim type should be set to “Role”

   

   Valid roles are:

   1. ApteryxAdmins

      1. Create and modify enhancements

      2. Create and modify layouts

      3. Place images in layouts

      4. Modify site settings

         • Default to always show hidden images (view ghosted)

         • Default to always show enhanced images

         • Set Brightness, Contrast and Gamma deltas

         • Set Zoom increment

   2. ApteryxEdit

      1. A User should be able to make changes to patient information, and some image metadata

      2. A User should be able to make changes to the DICOM database using APIs.

   3. ApteryxQuery

      1. User should be able to search Apteryx for patients

      2. User should be able to search using the software APIs

   4. ApteryxExport

      1. Download one or more selected images and/or series of images (including retakes) as JPEG, PNG or DICOM in ISO or zip container

      2. Email one or more selected images and/or series of images (including retakes) as JPEG, PNG or DICOM in a password-protected ISO or ZIP container

      3. Save current view as JPEG or PNG (screenshot)

   5. Apteryx Online Capture

      1. Apteryx will display the Capture button and External Applications links

      2. Import images into a new patient

      3. Import images into an existing patient

   6. ApteryxPrint

      1. Print the current series in the viewer

      2. Print one or more selected images

   7. ApteryxShare (reserved for future development)

      1. Share patients and studies with other users

10. IT will supply the AD FS Metadata URL to their implementations coordinator.