Last update:
Eligibility/authorization decoupling requirement
Aug 21, 2026
In the past, HSID OIDC contained eligibility / authorization check of the user, for the client application. However, HSID EDA platform does not provide eligibility / authorization in HSID OIDC, therefore it is the client application’s responsibility to perform eligibility / authorization check after it receives OIDC tokens from HSID.
When the client application migrates from Legacy PingFederate OIDC / Aikyam rebuild eligibility-coupled OIDC to EDA platform, these efforts are required on the client application side:
- Build a client-application owned eligibility / authorization check service
- This service uses HSID UUID only as an input, and perform eligibility / authorization check
- This service should not depend on HSID keychain / HSID cache. All user identity information should be retrieved from HCP userservice read.
- Use this service after OIDC ID token retrieval to perform eligibility / authorization check
- If other applications (outside of the target client application) are using the target client application-related identity information in HSID keychain / HSID cache, please inform them that the identity information will not be provided after HSID EDA migration. Their options are:
- Use HCP userservice read to get the necessary identity information.
- Use this target client application owned eligibility / authorization check service, if the authorization result is the only information needed by the other applications (not the identity information).
- Combination of both.
Share additional feedback to help us improve.
0/255
|
Powered by Aikyam @2025 All rights reserved
+1 866 451 2735
+1 866 451 2735
+1 855 819 5909