Patient SSO
Patient SSO lets members who are signed in to your web portal open the MD Live patient portal without signing in again. Your SAML 2.0 Identity Provider (IDP) starts the sign-in and sends MD Live a SAML assertion about the member; MD Live checks the member’s eligibility and opens the right page.
At a Glance
Section titled “At a Glance”| Item | Value |
|---|---|
| Initiator | Client’s SAML2 IDP server (IDP-initiated SSO) |
| Protocol | SAML 2.0 |
| SAML Profile | Web Browser |
| SAML Binding | HTTPS POST |
| Assertion Security | SAML2 assertion with Base64 encoding (recommended) |
For the complete requirements and the MD Live SP values, see Configuration.
How It Works
Section titled “How It Works”The SSO flow passes through 4 systems: your website, your IDP server, MD Live SSO and the MD Live website.
- The member starts on your website. The member signs in to your web portal and selects the link to MD Live.
- Your IDP server authenticates the member. Your SAML2 IDP server creates a SAML2 assertion (XML) with the member’s information and sends it to MD Live SSO by HTTPS POST, as an unsolicited SAML Response.
- MD Live SSO validates the request. MD Live SSO validates the SAML assertion and verifies the member’s eligibility, based on your eligibility option.
- MD Live routes the member.
- First visit: the member completes their profile on the SSO registration page, if your registration mode is Including Registration.
- Returning visits: the member goes directly to the MD Live website.
- The member starts using MD Live. The member sees the MD Live patient portal.
Ineligible members are redirected to a landing page instead. For the routing rules and what members see, see User Experience.
Integration Options
Section titled “Integration Options”Each integration combines one eligibility option with one registration mode. Together they decide which SAML attributes your IDP must send. See Find Your Attributes.
Eligibility Options
Section titled “Eligibility Options”| Option | How MD Live Verifies Eligibility |
|---|---|
| Real-Time Eligibility | MD Live verifies the member in real time with a 270/271 eligibility transaction or the Real Time Eligibility API. |
| Preloaded Eligibility | MD Live matches the member against eligibility data you load in advance with an eligibility file (834 or CSV) or the Eligibility API. |
| No Eligibility (DTC) | MD Live skips the eligibility check and grants the member SSO access to the patient portal. The client must have a DTC (Direct-to-Consumer) affiliation configuration. |
| DTC EAP Member | MD Live skips the eligibility check and grants the member SSO access to the patient portal if the member has valid EAP (Employee Assistance Program) information. |
Registration Modes
Section titled “Registration Modes”| Mode | Description |
|---|---|
| Including Registration | Eligible members who do not have an MD Live account fill in the SSO registration page to create one. |
| Seamless SSO | No SSO registration page is displayed. Eligible members go straight to the patient portal, so the SAML assertion must also include their contact and address. |
Supported Browsers
Section titled “Supported Browsers”MD Live supports SAML2 SSO in Google Chrome, Mozilla Firefox, Apple Safari, and Microsoft Edge. For details, see Patients System Requirement.
Responsibilities
Section titled “Responsibilities”| Task | Owner |
|---|---|
| Own and operate a SAML 2.0 IDP | Client |
| Share the IDP Entity ID and signing certificate for Staging and Production | Client |
| Configure the IDP with the MD Live SP values and SAML attributes | Client |
Issue the ou value for each client landing page |
MD Live |
| Configure the MD Live SP for the client IDP in Staging and Production | MD Live |
| Coordinate signing certificate updates with MD Live | Client |
For the setup steps, see Configuration.
Key Terms
Section titled “Key Terms”| Term | Description |
|---|---|
| SSO | Single sign-on. A session and user authentication service that lets a user access multiple applications with one set of login credentials, such as a username and password. |
| Fed-SSO | Federation single sign-on. One of many SSO solutions; it lets users sign in without passwords. |
| SAML 2.0 | Security Assertion Markup Language 2.0. An XML-based standard for exchanging authentication and authorization data between security domains. It uses security tokens containing assertions to pass information about a user from an IDP to an SP. |
| IDP | Identity Provider, also known as Identity Assertion Provider. It provides identifiers for users, asserts to a system that it knows the identifier a user presents, and may provide other information it knows about the user. In this integration, the client’s server is the IDP. |
| SAML2 IDP | An IDP that can generate SAML2 assertions with information about the end user. The client must have a SAML2 IDP for this integration. |
| SAML2 SP | Service Provider. It consumes and processes SAML2 assertions from authorized SAML2 IDPs. In this integration, the MD Live Fed-SSO Service is the SAML2 SP. |
| IDP-initiated | An SSO flow in which the IDP starts the federation process by sending an unsolicited SAML Response to the SP. |