Orbital Lite STS Documentation - User contributions [en]

Main Page

2026-10-19T15:14:50Z

Theluis-admin: Restore original main page

'''Welcome to the Orbital Lite Security Token Service Wiki.'''

The Orbital Lite Security Token Service (STS) is a high-performance SAML token generator for legacy applications.  Its primary focus is to provide identity federation capabilities with various healthcare solutions and as such it is focused to support clinical workflows and ensure that both user and patient context are relayed to integrated Service Providers.

The primary objective of Orbital Lite STS is to leverage current processes and data repositories in order to minimize implementation efforts to integrate with external Service Providers.  This is usually accomplished by using data elements from (in order of preference):

*The EMR/HIS
*Global attributes configured in Orbital Lite STS
*Windows authentication credentials
*Active Directory or LDAP
*Databases
*Active Directory Federations Services (in development)
*Single-Sign On (SSO) tokens (in development)

Here you will find information that will allow you and your organization to maintain your instance of STS. 

<span style="font-size:larger">[[Orbital_Lite_STS_Product_Roadmap|Orbital Lite STS Product Roadmap]]</span>

 

[[Installation_and_Deployment|Installation and Deployment]]

[[Configuration_Settings|Configuration Settings]]

[[Release_Notes_v1.94|Release Notes v1.94]]

[[Upgrading_v1.93_to_v1.94|Upgrading v1.93 to v1.94]]

[[Orbital_Lite_STS_v1.95_Notes|Orbital Lite STS v1.95 Notes]]

<br/>  

 

Windows Server Configuration

2026-10-19T14:55:47Z

Theluis-admin: 1 revision imported

== Technical Requirements ==

Orbital Lite STS is built on .NET technology, and runs on Internet Information Services (IIS) 7 or higher.  The server which hosts the service may be a virtual machine on any platform that supports the appropriate Windows installation (Hyper-V, VMWare, etc.).

Minimum requirements include the following: 

*Microsoft Windows Server 2016
*Microsoft .NET Framework 4.51 or later
*Microsoft Internet Information Services 7.5
*Dual-core server instance (2.5 GHz+)
*8 GB of RAM
*100 GB of hard-drive space (including system)
**20 GB separate partition suggested for the Orbital Lite STS
*100 MB Ethernet full-duplex connection

 

For Windows Integrated Authentication, the server must be a member of the user (or relevant resource) domain

=== Supported Windows versions ===

*Windows Server 2016
*Windows Server 2019

Deprecated

*Windows 2008 R2 (supported for v1.7)
*Windows Server 2012 (supported for v1.8)

 

== Windows Server features ==

Standard Microsoft technologies and features are used to run Orbital Lite STS.  The application is hosted under Internet Information Services.

All steps described in the server configuration require local administrative privileges.
<div class="heading-anchor-wrapper"><div class="sc-sdtwF elpZib"><div> </div> </div> </div>
=== .NET Framework ===

Its core requirement is .NET Framework 4.51 or later. 

Windows 2016 will have .NET Framework 4.51 or later available as part of its core feature set.

Windows 2012 will have to have .NET Framework 4.51 or later installed.  This is available from Microsoft directly at [https://www.microsoft.com/en-ca/download/details.aspx?id=40779 https://www.microsoft.com/en-ca/download/details.aspx?id=40779] .

 

----

 

=== WEB Server Role and Features ===

The Web Server (Internet Information Services) is not enabled by default and will have to be configured. 

 

'''<span style="color: rgb(255, 86, 48)">Note:</span>'''<span style="color: rgb(255, 86, 48)">You can perform all the steps listed on this manually page or just run this</span>[https://radiusworks.com/projects/IIS-feature-installation.txt '''Powershell script''']'''<span style="color: rgb(255, 86, 48)">.</span>'''

 

On the Windows Server launch the Server Manager application.   Click on “Manage” and then select/click on “Add Roles and Features”.

 

The selection screen will display all the available roles for the server.  Scroll down the list and select “Web Server” and Click “Next”

Server Manager will confirm that you wish to add “Web Server”; click on “Add Features”. The next screen will confirm the selection of the “Web Server” role.  Click on “Next”. At the next screen ensure that the “Windows Identity Foundation 3.5” is selected. The next screen will initiate the detailed features that need to be enabled as part of the IIS configuration.  Click on “Next” to continue.  

For most Orbital Lite STS configurations, Windows Integrated Authentications (UserContextMode 4) will be required to have a seamless user experience.  Ensure that “Windows Authentication” is enabled.

As well, in some cases “IIS Client Certificate Mapping Authentication” is required to support client-side certificate authentication (UserContextMode 5).    Scrolling down the list expand on the “Application Development” group and select “[http://ASP.NET ASP.NET] 4.6”.  It should automatically also select “.NET Extensibility 4.6”, “ISAPI Extenstions”, and “ISAPI Filters”.  This is required to support the [https://dotnet.microsoft.com/apps/aspnet/mvc MVC ASP.NET framework] that Orbital Lite STS uses.<br/> Click on “Next” and the installation process should be completed in moments.  When you see the “Installation succeeded” message click on “Close”.

UserGlobalSettings

2026-10-19T14:55:47Z

Theluis-admin: 1 revision imported

The following parameters will provide the necessary data for all SAML tokens where the HIS and/or the LDAP directory does not have the necessary information.  This helpful when there are key attributes that would be challenging to manage for all users, but are globally the same for the organization or a set of users (as defined by the NameQualifier.

It is possible to have different entries to match different NameQualifier values (or UserContextDomain) in order to accommodate environments where more than one organization, entity, or unique groups have to be supported. 

 

*Name: This value is merely a label and should be unique if there is more than one entry.
*NameQualifier: this is the NameQualifier value that users will be matched against. For all users with the specified NameQualifier these values will be used (unless provided by the source system):
**UAO
**UAOType
**grantByDelegateMeritOnly
**IdentityProvider
**IdentityVerificationSchemeRef
**UAOIdentityVerificationSchemeRef
**DelegationVerificationSchemeRef
**CredentialVerificationSchemeRef
**ProtectedNetwork
**PrimaryFactor
**GlobalRole: This value represents a set of comma-delimited roles that will be asserted in the SAML token
**GlobalServiceEntitlement; <span style="color: rgb(255, 86, 48)">available since version 1.8</span>
**AuthenticationLevel; <span style="color: rgb(255, 86, 48)">available since version 1.8</span>
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== Example Configuration ==
<div class="code-block right-shadow"><span style="font-size: 12px; background: rgb(244, 245, 247) none repeat scroll 0% 0%; color: rgb(23, 43, 77); border-radius: 3px; display: flex; line-height: 1.66667; overflow-x: auto; white-space: pre"><code style="font-size: 12px; line-height: 1.66667; padding: 8px"><UserGlobalSettings> <UserConfig Name="PrimaryUserPopulation" NameQualifier="corporate.hospital.on.ca" UAO="2.16.840.1.113883.3.239.22" UAOType="org" grantByDelegateMeritOnly="false" IdentityProvider="2.16.840.1.113883.3.239.22.13" IdentityVerificationSchemeRef="AL2" UAOIdentityVerificationSchemeRef="AL2" DelegationManagementSchemeRef="AL2" CredentialManagementSchemeRef="AL2" ProtectedNetwork="true" PrimaryFactor="Password" CompensatingFactors="" GlobalRole="" GlobalServiceEntitlement="MyService" AuthenticationLevel="AL2" Domain=""/> <UserConfig Name="SecondaryUserPopulation" NameQualifier="rehab.hospital.on.ca" UAO="2.16.840.1.113883.3.239.22" UAOType="org" grantByDelegateMeritOnly="false" IdentityProvider="2.16.840.1.113883.3.239.22.13" IdentityVerificationSchemeRef="AL2" UAOIdentityVerificationSchemeRef="AL2" DelegationManagementSchemeRef="AL2" CredentialManagementSchemeRef="AL2" ProtectedNetwork="true" PrimaryFactor="Password" CompensatingFactors="" GlobalRole="ConnectingGTA" GlobalServiceEntitlement="MyService" AuthenticationLevel="AL2" Domain=""/> <UserConfig Name="OncologyDepartment" NameQualifier="oncology.hospital.on.ca" UAO="2.16.840.1.113883.3.239.22" UAOType="org" grantByDelegateMeritOnly="false" IdentityProvider="2.16.840.1.113883.3.239.22.13" IdentityVerificationSchemeRef="AL2" UAOIdentityVerificationSchemeRef="AL2" DelegationManagementSchemeRef="AL2" CredentialManagementSchemeRef="AL2" ProtectedNetwork="true" PrimaryFactor="Password" CompensatingFactors="" GlobalRole="ConnectingGTA,Oncology" GlobalServiceEntitlement="MyService" AuthenticationLevel="AL2" Domain=""/> </UserGlobalSettings></code></span></div>

UserContextModes

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

In order to provide a certain level of security in order to assert the identity of a user between the HIS<br/> and the receiving STS, there are certain requirements that need to be fulfilled.

In a standard SAML 2.0 token exchange, the confidence (or “trust”) level is provided by the use of<br/> digital certificates in order to encrypt and/or sign the message so that the information cannot be<br/> easily disseminated or intercepted.

All user context exchanges should be conducted via a HTTP-POST to a specific processing web form<br/> (or service) on the STS. To ensure the security of the transmission, this communication should<br/> always occur over HTTPS.

 

The STS supports 5 context modes:

#UserContextMode 1 - SHA-256 hash with User-Specific Secret Key
#UserContextMode 2 - SHA-256 hash with System-Specific Secret Key
#UserContextMode 3 - User-Specific '''''Plaintext''''' Key
#UserContextMode 4 - User Windows Credentials
#UserContextMode 5 - Client Certificates

 

v1.95 has two additional modes planned for implementation; ADFS and SSO tokens.

== What is the right UserContextMode for my STS integration? ==

Our experience is that most organizations are split between UserContextMode 2 and 4.

If the HIS/EMR/EHR or legacy application vendor has the ability to generate cryptographic hashes, the UserContextMode 2 is recommended as it makes the integration effort a lot simpler.

For environments where the Windows credentials are available (workstation, RDP/Citrix session, or a SSO client), then UserContextMode 4 is used.

[[File:]]

 

== UserContextMode 1 - SHA-256 hash with User-Specific Secret Key ==

 

In this mode the source system provides six attributes

*NameID – source system username
*NameQualifier - optional
*UserContextTimeDate - in “YYYY-MM-DD hh-mm-ss” format
*UserContextID - also set to the source system username
*UserContextMode - set to “1”
*UserContextHash - [[UserContextHash|generated using a user-specific secret key]]

 

== UserContextMode 2 - SHA-256 hash with System-Specific Secret Key ==

 

The system-specific key is set in the STS web.config.

 

In this mode the source system provides six attributes

*NameID – source system username
*NameQualifier - optional
*UserContextTimeDate - in “YYYY-MM-DD hh-mm-ss” format
*UserContextID - also set to the source system username
*UserContextMode - set to “1”
*UserContextHash - [[UserContextHash|generated using a system-specific secret key]]

 

== UserContextMode 3 - User-Specific '''''Plaintext'''''Key ==

*NameID – source system username
*NameQualifier - optional
*UserContextTimeDate - in “YYYY-MM-DD hh-mm-ss” format
*UserContextID - also set to the source system username
*UserContextPassword - user specific password that will allow STS to validate the user
*UserContextWorkstation -

 

== UserContextMode 4 - User Windows Credentials ==

Additional user and security context will be obtained from the Windows credentials

*NameID – source system username
*NameQualifier - optional
*UserContextID - also set to the source system username

 

== UserContextMode 5 - Client Certificates ==

Additional user and security context will be obtained from the client certificate

*NameID – source system username
*NameQualifier - optional
*UserContextID - also set to the source system username

UserContextHash

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

The UserContextHash is used to validate the identity of a user or a source system in order to provide STS with secure validation.

It’s a SHA256 hash that is generated in the following manner by concatenating three strings:

Hash = UserContextTimeDate + UserContextID + secret key

The secret key being a value that is specific for the user (stored in a directory) or specific to the STS (defined in the web.config).

 

private bool ValidateHash(string strUsername, string strTimeDate, string strSecret, string strHash)

{ // deal with base64 encoded hashes -> this is what we expect from the HIS submissions

// byte array conversions add "-" to the string

strHash = strHash.Replace("-", "");

strHash = strHash.Replace(" ", "");

string compareHash = generate_sha256hash(strTimeDate + strUsername + strSecret);

compareHash = compareHash.Replace("-", "");

strHash = strHash.Replace("-", "");

if (strHash.ToLower() == compareHash.ToLower())

{ Log("Hash value confirmed for user " + strUsername + ".", Log.LogLevel.Info);

return true; }

return false; }

Upgrading v1.93 to v1.94

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

<div>This process should take 10 minutes.</div>
 

#Make a backup of the existing installation, especially the web.config file.
#You can maintain the existing IIS application and configuration; no changes in .NET framework or any other IIS configuration needs to be altered.
#The upgrade package includes the following:
<pre style="margin-left: 80px">2020-02-18 04:39 PM <DIR> bin
2020-02-18 04:39 PM <DIR> Content
2020-02-18 04:39 PM <DIR> CSS
2020-02-18 04:39 PM <DIR> Images
2020-02-18 04:39 PM <DIR> Views
2019-07-30 03:47 PM 495 ContextMode4.aspx
2019-01-13 08:02 PM 1,279 ContextMode5.aspx
2018-02-24 02:04 PM 32,038 favicon.ico
2019-01-13 08:02 PM 1,717 FormLogin.aspx
2019-01-13 08:02 PM 1,704 FormLogout.aspx
2019-01-13 08:02 PM 1,253 generate_license.txt
2018-01-09 07:17 AM 868 LICENSE.txt
2019-01-13 08:02 PM 119 metadata.aspx
2020-02-17 03:05 PM 1,601 packages.config
2020-02-18 04:39 PM 49 PrecompiledApp.config
2020-02-18 08:02 PM 1,778 upgrade.txt</pre>

 
<ol start="4">
<li>You should delete the corresponding folders and files in the current installation.  It is recommended that a delete is performed first instead of an overwrite.  This is due the dependencies that may exist with the DLL files in the /bin folder.  Keeping old versions of DLLs may cause version conflicts.</li>
<li>Make sure you do not remove the following:</li>
</ol>
<ul style="margin-left: 40px;">
<li>    /certificates folder (or alternate location)</li>
<li>    /logs folder (or alternate location)</li>
<li>    /start folder</li>
<li>    /app_data folder (if exists)</li>
<li>    /web.config file</li>
</ul>
<ol start="6">
<li>Stop the IIS site temporarily as there may be file locks in place.</li>
<li>Wait a few seconds.</li>
<li>Copy the contents of the ZIP package into the folder where STS was located.</li>
<li>Update the web.config with the following elements: <ol start="1" style="list-style-type: lower-alpha;">
<li>Update the version:</li>
</ol> </li>
</ol>
<pre>
<STSSettings Version="v1.93" ...
change to:
<STSSettings Version="v1.94" ...</pre>
<ol start="2" style="list-style-type: lower-alpha;">
<li>   Add the new parameters "ClearSession" and "PrimaryADGroupCheck""</li>
</ol>
<pre> <STSSettings Version="v1.93" ConfigurationDatabase="~/App_Data/Orbital.sqlite" ...
update to:
<STSSettings Version="v1.94" ConfigurationDatabase="~/App_Data/Orbital.sqlite" ClearSession="false" PrimaryADGroupCheck="false" ...</pre>
<ol start="3" style="list-style-type: lower-alpha;">
<li>    Add the new parameter "TokenTimeSpan" in each SAMLConfiguration element:</li>
</ol>
<pre>
<SAMLConfigurationElement Service="MyService" AssertingParty="sts.hospital.org" ...
update each SAMLConfigurationElement to:
<SAMLConfigurationElement Service="MyService" AssertingParty="sts.hospital.org" TokenTimeSpan="2" ...</pre>
<ol start="4" style="list-style-type: lower-alpha;">
<li>      Update the entire Runtime section:</li>
</ol>
<pre> <runtime>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35"/>
<bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35"/>
<bindingRedirect oldVersion="1.0.0.0-2.0.0.0" newVersion="2.0.0.0"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" culture="neutral"/>
<bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234"/>
</dependentAssembly>
</assemblyBinding>
</runtime></pre>

  replace with the following:
<pre> <runtime>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="Antlr3.Runtime" publicKeyToken="EB42632606E9261F" culture="neutral"/>
<bindingRedirect oldVersion="0.0.0.0-3.5.0.2" newVersion="3.5.0.2"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35"/>
<bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" culture="neutral"/>
<bindingRedirect oldVersion="0.0.0.0-1.5.2.14234" newVersion="1.5.2.14234"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35"/>
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35"/>
<bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35"/>
<bindingRedirect oldVersion="1.0.0.0-5.2.7.0" newVersion="5.2.7.0"/>
</dependentAssembly>
<dependentAssembly>
<assemblyIdentity name="System" publicKeyToken="b77a5c561934e089" culture="neutral"/>
<bindingRedirect oldVersion="0.0.0.0-4.0.0.0" newVersion="4.0.0.0"/>
</dependentAssembly>
</assemblyBinding>
</runtime></pre>

 
<ol start="10">
<li>Start the IIS site</li>
<li>Launch the web application to test and verify that the log files display no errors.</li>
</ol>

 

 

Upgrading v1.8x to v1.8.2.3

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

1. Make a backup of the existing installation!!!<br/> <br/> 2. You can maintain the existing IIS application and configuration; no changes in .NET framework or any other IIS configuration needs to be altered.<br/> <br/> 3. The upgrade package includes the following:<br/> <br/> 13/01/2019 03:43 PM <DIR> bin<br/> 13/01/2019 03:43 PM <DIR> Content<br/> 13/01/2019 03:43 PM <DIR> CSS<br/> 13/01/2019 03:43 PM <DIR> Views<br/> 13/01/2019 03:43 PM <DIR> license<br/> 13/01/2019 03:43 PM <DIR> Images<br/> 24/02/2018 02:04 PM 1,701 FormLogout.aspx<br/> 12/01/2019 03:41 PM 1,714 FormLogin.aspx<br/> 09/01/2018 07:17 AM 868 LICENSE.txt<br/> 24/02/2018 02:04 PM 116 metadata.aspx<br/> 03/11/2017 08:10 AM 1,707 packages.config<br/> 13/01/2019 03:43 PM 49 PrecompiledApp.config<br/> 24/02/2018 02:04 PM 32,038 favicon.ico<br/> <br/> <br/> 4. You should delete the corresponding folders and files in the current installation. It is recommended that a delete is performed first instead of an overwrite. This is due the dependencies that may exist with the DLL files in the /bin folder. Keeping old versions of DLLs may cause version conflicts.<br/> <br/> 5. Make sure you do not remove the following:<br/> /start folder<br/> /certificates folder<br/> /logs folder<br/> /start folder<br/> /app_data folder (if exists)<br/> /web.config file<br/> <br/> 6. Stop the IIS site temporarily as there may be file locks in place.<br/> <br/> 7. Wait a few seconds.<br/> <br/> 8. Copy the contents of the ZIP package into the folder where STS was located.<br/> <br/> 9. Start the IIS site<br/> <br/> 10. Launch the web application to test.

Technical Requirements

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

• Microsoft Windows Server 2012<br>
• Microsoft .NET Framework 4.51 or later<br>
• Microsoft Internet Information Services 7.5<br>
• Dual-core server instance (2.5 GHz+)<br>
• 8 GB of RAM<br>
• 100 GB of hard-drive space (including operating system); a 20 GB separate partition suggested for the Orbital Lite STS<br>
• 100 MB Ethernet full-duplex connection<br>
• For Windows Integrated Authentication, the server must be a member of the user (or relevant resource) domain<br>

STS Configuration via Web.Config

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

[[STSSettings|STSSettings]]

[[UserGlobalSettings|UserGlobalSettings]]

STSSettings

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

These parameters will be used to configure the behaviour of the STS application or provide global parameters that can complete the SAML token in scenarios where the source application or a directory cannot provide the required parameters.

Where operation or settings differ from v1.7 it will be clearly stated.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== Version ==

This value indicates the version of the STS solution.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== ConfigurationDatabase ==

Provides the location for the configuration database for Orbital STS Lite <span style="color: rgb(255, 86, 48)">(STS Version 1.9 and greater)</span>.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SAMLSpecificationVersion ==

This value indicates which SAML Specification is used when generating the SAML assertion.  Accepted values are:

*For ConnectingOntario/ConnectingGTA:
**connectinggtav1 – original specification (default), generates SAML in ConnectingGTA SAML v0.1 format
**connectinggtav1.1 - generates SAML in ConnectingGTA SAML v0.2 format
**connectinggtav1.2 - generates SAML in ConnectingGTA SAML v0.2 format with mandatory RID attributes
**connectinggtav1.3 – ConnectingGTA SAML v0.2 format original specification with multi-UAO value modifier
**ehealthontario141 - generates eHealth Ontario SAML 1.4 format <span style="color: rgb(255, 86, 48)">(STS Version 1.8 and greater)</span>
** ehealthontario15 - generates eHealth Ontario SAML 1.5 format <span style="color: rgb(255, 86, 48)">(STS Version 1.9 and greater)</span>
**telus14 - parses comma-delimited UAO values from input, and generates eHealth Ontario SAML 1.4 format <span style="color: rgb(255, 86, 48)">(STS Version 1.8 and greater)</span>
*salesforcev1 - general OAuth/SAML SalesForce SAML specifications <span style="color: rgb(255, 86, 48)">(STS Version 1.91 and greater)</span>
*adfs - standard default Active Directory Federation Services SAML assertions <span style="color: rgb(255, 86, 48)">(STS Version 1.92 and greater)</span>
*qhn - Quality Health Network <span style="color: rgb(255, 86, 48)">(STS Version 1.93 and greater)</span>
*<span style="color:#000000;">cchie - Clinical Connect HIE </span><span style="color: rgb(255, 86, 48)">(STS Version 1.93 and greater)</span>
*<span style="color:#000000;">crisp - State Designated</span> Health Information Exchange (HIE) for Maryland <span style="color: rgb(255, 86, 48)">(STS Version 1.94 and greater)</span>
*ethin -  East Tennessee Health Information Network <span style="color: rgb(255, 86, 48)">(STS Version 1.94 and greater)</span>
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SessionExpiry ==

This parameter sets the time limit (in minutes) under which the HIS-generated request is valid.  This should be set to a reasonable amount (e.g. 60 minutes) to ensure that an unauthorized party cannot replay an old request.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== TokenTimeSpan ==

This parameter sets the SAML Token parameters NotBefore (Current Time – TokenTimeSpan) and NotOnOrAfter (Current Time + TokenTimeSpan).  It is recommended that this time be set to 10 minutes or less.  Consideration should be given to any potential discrepancy in system clocks or response times between systems.

 
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV">
== ClearSession ==
<div> </div> <div><span style="color: rgb(255, 86, 48)">STS Version 1.94 and greater. </span>This parameter indicates if the STS should purge the session object (and expire the associated cookie) once the user is re-directed to the Service Provider.  This impacts primarily users that are authenticated with UserContextModes 4 and 5 as the authentication process is a two-step process and the session is used to store user information temporarily.</div> <div> </div> </div> </div>
== Key ==

This parameter sets the global secret that will be used for UserContextMode 2.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== Debug ==

This parameter will activate the debug mode in STS.  It will provide extended auditing in the Audit file.  Please note that this should not be enabled on the Production server as the file size will increase very quickly.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== PrimaryADGroupCheck ==

<span style="color: rgb(255, 86, 48)">STS Version 1.94 and greater. </span>This parameter will enable checking for the "Domain Users" primary group nested within a group that has been assigned permission in STS. Note that this is an expensive recursive check that does not use the default .NET directory searcher or identity principal objects which do not return members of a primary group. 

 

== SanitizeLog ==

<span style="color: rgb(255, 86, 48)">STS Version 1.9 and greater</span>. Specifies if the STS should sanitize patient context attributes in the audit and operation logs.

The values are:

*0 - don’t log any patient attributes
*1 - store patient attributes hashed with a salt as set in SanitizeSalt; hash(attribute +salt)
*2 - store only last two characters of the attributes; note that for Gender the single character will be captured in its entirety
*3 - store all patient attributes unchanged ('''not recommended for PHI''')

 

== SanitizeSalt ==

<span style="color: rgb(255, 86, 48)">STS Version 1.9 and greater</span>. String to be used to hash patient attributes in logs (if SantizeLog value is set to “1”)
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== EnableFriendlyUserError ==

This attribute specifies if the user will see a customized error page (specified in “FriendlyErrorURL”). It is recommended that the user not see the extended debugging messages as this may expose information that can be manipulated to gain unauthorized access.  Enabling customized errors will not have an impact on the ability to log errors or debug so the administrator can still refer to the log files to obtain detailed error information.  For environments that provide access to PHI, this should be disabled.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FriendlyErrorURL ==

The URL that will display an error message.  This can be the provided HTML page (“NiceError.html”) or any alternate URL.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== EnableHashDisplay ==

When debugging (i.e. Debug is set to “true”) the SHA256 hash used in UserContextModes 1 and 2 that should be used is displayed for troubleshooting and convenience purposes.  This can potentially grant an unauthorized party access.  It is recommended that this is set to “false” once the integration and testing efforts have been completed.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== IncludeBlankSAMLAttributes ==

This attribute will determine if SAML attributes that are blank or null will be omitted when the SAML Assertion is generated.  This is implemented for systems that require all attributes to be provided regardless of their validity or content.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== QueryStringRequestsAllowed ==

This parameter will enable/disable the ability of the STS solution to process GET requests.  In this scenario, all values are submitted as a QueryString as part of the URL that the application will parse.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== EncryptSAMLAttributes ==

This parameter will specify if the SAML attributes sent to Service Providers will be encrypted using the their provided public key. The certificate to be used will be specified in the “SAMLConfiguration” section.

<span style="color: rgb(255, 86, 48)">Since STS Version 1.8 and greater</span> this flag cannot be overriden in the “SAMLConfiguration” section.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== NameIDCase ==

Indicates which string modification will be applied to the NameID value provided by the HIS before being used in the SAML token.  Accepted values are:

*none – value will not be modified (default)
*lower – value will be converted to lower-case
*upper – value will be converted to upper-case

 
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== EnablePatientContextNames ==

<span style="color: rgb(255, 86, 48)">STS Version 1.71 and greater</span>. This parameter will specify if the PatientContextLastNames must and that the PatientContextFirstName be included as part of the values to validate the healthcard number.   This value should be set to “true”.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== CertificateValidationEnabled ==

This defines if the STS solution will check the validity of the certificate as per the period defined in “CertificateValidationFrequency”.  It is recommended, for the Production Environment, that this check is enabled.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== CertificateValidationFrequency ==

Specifies the time (in minutes) after which the certificate verification is skipped.  This is only applicable to the certificate used to sign the SAML token.  Due to potential performance impacts in accessing external systems, it is recommended that this value is not set too low (i.e. less than 5 minutes).
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== CertificateValidationCRLEnabled ==

This defines if the STS solution will validate that the certificate is still valid with the external service that provides the Certificate Revocation List (CRL).  It is recommended, for the Production Environment, that this check is enabled.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== CertificateValidationCRLTimeOut ==

The maximum duration (in seconds) of CRL check until time out.  Note that this value may need to be increased if a third party with a significant CRL does not respond fast enough with necessary information.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== EnableFormsAuthentication ==

This parameter specifies if the Forms-based authentication is used when the Windows Integrated Authentication option fails. 
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormAuthentication ==

This parameter specifies the URL of the login page that will be used to authenticate users in UserMode4.   This value should not be altered.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormLoginPageTitle ==

The title of the HTML title page that should appear on the Forms Login Page.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormLoginPageImage ==

The image URL that should appear on the page.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormLoginPageMessage ==

The message that should appear at the top of the page.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormLoginPageUsername ==

The label that should preface the field where the username is entered.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormLoginPagePassword ==

The label that should preface the field where the password is entered.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormLoginPageButton ==

The text that should appear on the form submit button.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== FormLoginPageMessage2 ==

An additional message that should appear at the bottom of the page. This can be left blank.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== AssertingParty ==

This parameter identifies the originating STS server and should be a fully qualified domain. It is preferred that individual STS servers, rather than clusters, be identified.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== AudienceRestriction ==

This parameter identifies the default domain that will consume the SAML token.  This should be set to the FQD of the organization.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== URL ==

The SAML token will provide this URL in order when identifying the STS Solution.  This should be the URL that the HIS/EMR application links to.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== Service ==

This parameter identifies the default service that will receive SAML assertions from the STS Solution (it should matche a value in SAMLConfiguration section of the STS Solution). 
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== OrganizationName ==

This value is used to generate the metadata file and should provide the name of the organization for which the STS Solution is generating SAML assertions.  This can be the organization’s legal name. <span style="color: rgb(255, 86, 48)">Note that version 1.7 has a typo in this attribute; OrganizatioName! This was corrected in v1.71 onwards.</span>
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== OrganizationContactName ==

This value is used to generate the metadata file and should provide the name of the individual (or role) that is the primary owner of, or operational support for, the STS Solution.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== OrganizationContactEmail ==

This value is used to generate the metadata file and should provide the e-mail address of the individual (or role) that is the primary owner of, or operational support for, the STS Solution.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== UserNameSpace ==

This is the Uniform Resource Namespace (URN) that all SAML user attributes should use.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== PatientNameSpace ==

This is the Uniform Resource Namespace (URN) that all SAML patient context attributes should use.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== ClinicalNameSpace ==

Specifies the namespace that will be prefixed to all clinical context attributes.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== ServerAvailabilityCheck ==

Specifies if the STS application should check for the availability of a directory server used in “RoundRobin” and “Random” modes.  If the server is unavailable, it will attempt to obtain an alternate value.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== ServerAvailabilityRetries ==

Specifies the number of attempts to retrieve an alternate server set in “RoundRobin” or “Random” modes before returning a value (which may be unavailable and cause an error).
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPHost ==

The IP address or DNS name of the SMTP gateway that will be used to send e-mail alerts.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPPort ==

The TCP port that should be used to send SMTP e-mails.  This is typically TCP port 25.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPAvailable ==

A value of “true” or “false” indicating if STS should use the server to send e-mail alerts.  Setting it to “false” will disable the e-mail functionality for alerts.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPTimeout ==

The amount of time (in seconds) that the STS solution will wait before it times out and indicates an error, resulting in an SMTP e-mail message.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPUseSSL ==

Attribute set to “true” or “false” indicating if the SMTP expects the transmission and authentication to use SSL or TLS.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPUsername ==

The username that should be used for SMTP gateways that require authentication. If none is required, then the username should be blank.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPPassword ==

The password that should be used for SMTP gateways that require authentication. This is ignored if the username is blank.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPRecipient ==

The e-mail address of the intended recipient of the e-mail message.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SMTPFrom ==

The e-mail address of the sender of the message.  Please note that some SMTP servers will not relay a message unless the “From” address is from an accepted domain name.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SPMLTracking ==

This will control the SPML functionality in the STS solution and allow the service to trigger ConnectingGTA Provider Registry changes when user info changes.  This value can be set as “false” to simplify the deployment.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SPMLModifiers ==

Allows the administrator to disable AddRequest or ModifyRequests in the SPML component.  Accepted values are:

*“disableAddRequest” – the SPML component will not trigger SPML requests for new users
*“disableModifyRequest” – the SPML component will not trigger SPML requests for users who have had their information modified
*“disableAddRequest,disableModifyRequest” – this disabled both types of requests

 
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SPMLTrackingSalt ==

Instead of storing user attributes in a database, the SPML component stores hashes.  In order to complicate the potential use of rainbow tables to determine the actual values, an additional values is hashed with each attribute.  This can be any random sequence of characters and/or numbers.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SPMLTrackingDatabase ==

This specifies the local SQLite database that the SPML component should use to store the hashes.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== SPMLDatabaseConnection ==

For environments that wish to use a central MSSQL database (especially where multiple STS instances exist), the connection string can be provided here.  Note that the SPMLTrackingDatabase value should be null (“”) for this value to be in effect.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== DoSClientThreshold ==

This parameter is used to prevent Denial of Service attacks on both the STS and the Service Provider.  This sets the threshold of how many requests one single system (on an unique IP address) can generate within a certain amount of time (see DoSClientPeriod).
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== DoSClientPeriod ==

This parameter is used to prevent Denial of Service attacks on both the STS and the Service Provider. This sets the length of time until the STS counter for a client system is reset.  This value is expressed in minutes.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== DoSUserThreshold ==

This parameter is used to prevent Denial of Service attacks on both the STS and the Service Provider.  This sets the threshold of how many requests one single user (determined by the NameID) can generate within a certain amount of time (see DoSUserPeriod).
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== DoSUserPeriod ==

This parameter is used to prevent Denial of Service attacks on both the STS and the Service Provider. This sets the length of time until the STS counter for a specific user is reset.  This value is expressed in minutes.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== ValidateEachPerson ==

<span style="color: rgb(255, 86, 48)">STS Version 1.8 and greater</span>. In scenarios where the users provides their own UAO (single clinical practice) setting this value to false will bypass the UAO validation.
<div class="heading-anchor-wrapper"><div class="sc-fnwBNb qtHFV"><div> </div> </div> </div>
== Example STSSettings Section ==
<div class="code-block right-shadow"><span style="font-size: 12px; background: rgb(244, 245, 247) none repeat scroll 0% 0%; color: rgb(23, 43, 77); border-radius: 3px; display: flex; line-height: 1.66667; overflow-x: auto; white-space: pre"><code style="font-size: 12px; line-height: 1.66667; padding: 8px"><span class="token" style="color: rgb(0, 141, 166)"><span class="token" style="color: rgb(0, 141, 166)"><span class="token punctuation"><</span>STSSettings</span> <span class="token" style="color: rgb(0, 184, 217)">Version</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>v1.93<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">ConfigurationDatabase</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>~/App_Data/Orbital.sqlite<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SAMLSpecificationVersion</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>qhn1<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SessionExpiry</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>60<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">TokenTimeSpan</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>10<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">Key</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>UATSTSSecret<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">Debug</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SanitizeLog</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SanitizeSalt</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>6377836388<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">EnableFriendlyUserError</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>false<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FriendlyErrorURL</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>~/NiceError.html<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">EnableHashDisplay</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">IncludeBlankSAMLAttributes</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">AssertingParty</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>sts.grhd.org<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">AudienceRestriction</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>grhd.org<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">Service</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>QHNTest<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">URL</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>[https://oursts.internal.hospital.on.ca https://oursts.internal.hospital.on.ca]<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">OrganizationName</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Participating Hospital in ConnectingGTA<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">OrganizationContactName</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Emmanuel Goldstein<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">OrganizationContactEmail</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Emmanuel.Goldstein@hospital.on.ca<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">EnableFormAuthentication</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormAuthentication</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>~/FormLogin.aspx<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormLoginPageTitle</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>QHN Login Page<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormLoginPageImage</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>~/images/sts_banner.jpg<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormsLoginPageMessage</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Please enter your username and password.<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormsLoginPageUsername</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Username:<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormsLoginPagePassword</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Password:<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormsLoginPageButton</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Log In to ConnectingGTA<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">FormsLoginPageMessage2</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>Please contact the Service Desk for support.<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">QueryStringRequestsAllowed</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">EncryptSAMLAttributes</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>false<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">NameIDCase</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>none<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">EnablePatientContextNames</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">CertificateValidationEnabled</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>false<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">CertificateValidationFrequency</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>120<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">CertificateValidationCRLEnabled</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>false<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">CertificateValidationCRLTimeOut</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>10<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">CertificateOverride</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>encryption<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">UserNamespace</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">PatientNamespace</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">ClinicalNamespace</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">ServerAvailabilityCheck</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">ServerAvailabilityRetries</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>2<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPAvailable</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>false<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPHost</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>mail.hospital.on.ca<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPPort</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>25<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPTimeout</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>5<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPUseSSL</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>false<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPUsername</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPPassword</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPRecipient</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>monitoring@hospital.on.ca<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SMTPFrom</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>qhn-sts@hospital.on.ca<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SPMLTracking</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>true<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SPMLModifiers</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>disableAddRequest<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SPMLTrackingSalt</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>ThisIsAVeryComplexString73527352<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SPMLTrackingDatabase</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>~/App_Data/CGTA_STS.sqlite<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">SPMLDBConnection</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span><span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">DoSClientThreshold</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>1001<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">DoSClientPeriod</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>61<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">DoSUserThreshold</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>101<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">DoSUserPeriod</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>61<span class="token punctuation">"</span></span> <span class="token" style="color: rgb(0, 184, 217)">ValidateEachPerson</span><span class="token attr-value"><span class="token punctuation">=</span><span class="token punctuation">"</span>false<span class="token punctuation">"</span></span><span class="token punctuation">></span></span></code></span></div>
 

SAMLSpecificationVersion

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

By using the SAMLSpecificationVersion, the integrator has the ability to have more fine-grained control of which SAML Specification to use. Each specification corresponds to configured profile that will generate the necessary information in the SAML assertions so that downstream service provided will have the information in the format it requires.    

== Hierarchy ==

The SAMLSpecificationVersion value will be processed in the following order:

#Form Submission
#Service Configuration
#Global Value

 

== Form Submision ==

As part of the POST (or GET) request to the STS, the attribute "SAMLSpecificationVersion" allows the administrator to select a specific SAML profile.

 

== Service Configuration ==

If the respective [https://sts.radiusworks.com/wiki/index.php?title=SAMLConfiguration#SAMLSpecificationVersion service entry] contains a value for SAMLSpecificationVersion then it will be used.

 

== Global Value ==

Each STS instance should have have a [https://sts.radiusworks.com/wiki/index.php?title=STSSettings#SAMLSpecificationVersion global SAML profile] configured.  If no SAMLSpecificationVersion value is provided either in the form submission to the STS, or specified in the respective service, then the global default value.

SAMLConfiguration

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

This configuration section permits the administrator to set up a varierty of service providers from within the same instance of Orbital Lite STS. In a Production instance, the STS could re-direct the authorized users based on the target "Service" parameter submitted.   Each configuration can differ in these major elements:

*Service and IdP Endpoints
*Signing and Encryption Certificates
*SAML Specification Version

 

== Service ==

This is the label assigned to the entry.  When specifying a target service from the legacy application, the "Service" label must match the entry (not case-sensitive).  

== AssertingParty ==

This is the string that will be inclused as part of the SAML payload.  This allows the receiving Service Provider to perform a quick check if this is coming from an authorized Identity Provider before typically checking for other aspects of the SAML such as expiry, digital signature, etc. Typically, this value would be a FQD that represents the STS server.  

== EncryptSAML ==

This is set to "true" or "false".  If set to true, a public key certificate from your Service Provided must be configured and the SAML attributes will all be encrypted.  The recommended setting is to always encrypt, especially is patient health information is being transmitted. Note that the [https://sts.radiusworks.com/wiki/index.php?title=STSSettings#EncryptSAMLAttributes global setting EncryptSAMLAttributes] will override this value if it's set to true.  If you wish to actually disable encryption, you need to set the global value to "false" as well.

== TokenTimeSpan ==

Represents the time interval (in minutes) that the SAML payload will indicate to the Service Provider that the token is valid.  This a good way to control the potential risk in replay attacks with SAML.  The value should reflect any network latency and potential clock synchronization issues.  This value should not be higher than 2 minutes.  

== appURL ==

This is a mandatory parameter. appURL is the entry endpoint for the Service Provider.  This is in most cases another Identity Provider that will do an authentication/authorization check on the user and the Orbital Lite STS.  This value will also be placed in the RelayState for the SAML POST.  

== destinationURL ==

This is a mandatory parameter.  After the initial successful authentication/authorization, the Service Provider will re-direct the user to the actual destination.  

== StaticRelayStateParameters ==

This optional string appends some additional attributes to the RelayState.  This is useful for profiles that require additional customization.  

== SAMLSpecificationVersion ==

This optional parameter allows the administrator to control which SAML specification/profile to use.  If the value is left blank, then the [https://sts.radiusworks.com/wiki/index.php?title=STSSettings#SAMLSpecificationVersion global SAMLSpecificationVersion value] will be used.  

== AudienceRestriction ==

This optional parameter allows the administrator to state the AudienceRestriction value in the SAML subject header.  This permits the IdP to perform additional authorization checks.              

== CertificateThumbprint ==

This value represents a unique signature that identifies the certificate in the Windows Server certificate store which will be used to sign the certificate. The administrator should make sure that the IIS (network) account has read access to the key, and that the key is marked as exportable, otherwise the application cannot get the private key.

To obtain the thumbprint of a certificate, please follow these steps:

*Open Windows Server certificate store using the management console
*Double-click on the certificate. A new window will appear with additional information for the certificate, at which point click on “Details”. You should find an element labeled “Thumbprint”.
*Click on the item and select the data displayed in the window. The data can be imported with or without spaces, and is case insensitive.

== CertificatePath and CertificatePassword  ==

If the Windows Server certificate store cannot be used, then a physical location may be used and a PFX file may be invoked.  The IIS (network) account would need read permissions to the certifcate.

=== <br/> CertificatePath ===

This would describe the physical path where the certificate (including the private key) is stored.

=== <br/> CertificatePassword ===

This is the password that the application will be using to access the private key.

== EncryptionCertificateThumbprint ==

The target Service Provider should be providing a certificate that contains the public key in order to encrypt the SAML attributes. The thumbprint as stored in the Windows Certificate Store should be specified here. 

== EncryptionCertificatePath ==

As an alternative to EncryptionCertificateThumbprint, the file location of the CER file can be provided in this attribute.

== SPML ==

SPML Service Attributes provide the STS solution information about the SPML endpoint that can be used to update an external user registry:

=== SPMLService ===

this provides the target URL of the SPML Service.� SPMLAction: this is the SOAP request parameter used to invoke the SPML service.

=== SPMLAuthentication ===

The type of authentication used by the SPML service; it can be set to “none”, “username” or “certificate”.

=== SPMLCertificateThumbprint  ===

Used when the SPMLAuthentication is set to “certificate”, this will provide the certificate of the private key stored in the Windows Certificate tore that will be used to authenticate.

=== SPMLCertificatePath ===

used when the SPMLAuthentication is set to “certificate”, this will provide the file location of the PFX certificate file which contains the private key.

=== SPMLCertificatePassword ===

used to unlock the PFX file specified in SPMLCertificatePath.

=== SPMLUsername ===

the username send to the SPML service when the SPMLAuthentication is set to “username”.

=== SPMLPassword ===

the associated password with SPMLUsername.

=== SPMLDomain ===

the associated domain for the username specified in SPMLUsername.

 

Release Notes v1.94

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

There were several feature requests and enhancements made in version 1.94 that needed to be addressed.  Some of the underlying .NET libraries were updated as well.    

== Technology Updates ==

The following updates were made and have no impact in functionality.  The [[Upgrading_v1.93_to_v1.94|web.config]] does have to be updated in existing entries to ensure that the new versions are used.  

=== Maintenance Item 2020-01-09-A<br/> Upgrade to MVC 5.2.7 ===

=== Maintenance Item 2020-01-09-B<br/> Clean build folders ===

=== Maintenance Item 2020-01-09-D<br/> Upgrade to EntityFramework 6.3 ===

=== Maintenance Item 2020-01-09-F<br/> SQLite upgrade 1.0.112 ===

 

== Enhancements and Feature Requests ==

=== Problem Ticket 2019-12-17-A ===
<div><br/> Support for special case of having an AD group that includes "Domain Users" as a member. </div> <div>This is a unique scenario and something that the .NET directory objects don't handle all that well since "Domain Users" is the primary group of 99.99% of the users in AD (except when admins make changes).  As such it does not exist as a group member that can be enumerated recursively when placed in group.  Technically adding "domain users" to any groups tends to superfluous since that means that (typically) all users will be a member of the group and may as well be better server by assigning the "Domain Users" group.  Nonetheless, the scenario does exist and now the code will look for that special condition.</div>
Note: this is an expensive operation since that group will be looked specifically and adds additional overhead.  You need to enable this (new) parameter:
<pre>PrimaryADGroupCheck="true"</pre>

 

=== Feature Request 2019-07-22-A ===
<div><br/> Feature request for permissions if the GroupName is "*" then it will apply to all users and will not actually check against directory server; good for global rules.</div> <div>In some scenarios where UserContextMode 4 (and 5) is used, the administrator may wish to grant (or deny) users access.  Using the "*" (asterisk) in the group permission elements will assign the Allow/Deny rule automatically without invoking the directory server which speeds up performance.</div> <pre> <Domains Description="Everyone" DomainName="corporate" GroupName="*" Action="Allow"/>
</pre>

 

=== Feature Request 2019-08-20-A ===
<div><br/> Force purge STS session cookie after redirect to Service Provider.</div> <div>Although the .NET session by default is set to 2 minutes, there is no need to maintain the session if the users has been redirected to the Service Provider.  At that point, there is no need to have the session maintained and good security hygiene would suggest that the session be terminated.  While no confidential information is stored in the session cookie, having a valid cookie leaves the exploit of replay attacks and impersonation a feasibility.</div>
Organizations using UserContextMode 4 (and 5) are potentially impacted since the session cookie is used to store the source parameters while the user is authenticated, and as such should be tested before enabling in Production.
<pre>ClearSession="true"
</pre>

 

=== Feature Request 2020-01-20-B ===
<div><br/> More granular token time out per service.</div>
Each SAMLConfigurationElements now allows the administrator to specify a token timeout value specifically per service provider.  This is useful when the service provider needs a higher tolerance (e.g. due to network latency or other processing delays).
<pre> <SAMLConfigurationElement Service="ConnectingGTA" AssertingParty="sts.federation.uat.hospital.on.ca" EncryptSAML="false" <span style="color:#c0392b">TokenTimeSpan="2"</span></pre>

 

=== Feature Request 2020-01-20-C ===
<div><br/> Update telus14, ehealthontario141 and ehealthontario15 profile logic for UAO assignment. </div> <div> </div> <div>A a specific condition in a multi-UAO value provided by Cerner systems due to technical limitations has been handled differently ("|" will be used instead of "," as delimiters).</div>
 

=== Problem Ticket 2019-09-19-A ===
<div><br/> Add event of INFO type in Logs to capture username and usercontext mode.</div>
When Debug mode was turned off there was no adequate logging of the actual user context information in the STSLog file.

 

=== Feature Request 2019-09-19-A ===
<div><br/> Add Service item to audit file. For organizations using the same instance of STS for different Service Providers, an additional field has been included that indicates the service invoked. Note that this field has been added to the end of each line in order to not impact existing audit scripts/process that expect the same fields in the same order.</div> <div> </div>
 

Prerequisites

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

== Orbital Lite STS Software ==

Radius Works Inc. provides the software to client in an archive file.  Contact [mailto:support@radiusworks.com support@radiusworks.com] to obtain it promptly. The current release is v1.923.
<div class="heading-anchor-wrapper"><div class="sc-sdtwF elpZib"><div> </div> </div> </div>
== License File ==

Depending on the scenario a trial or permanent license file may be provided.  Note that the permanent license will have to be generated based on the server deployment, so this is an additional step as part of the installation.
<div class="heading-anchor-wrapper"><div class="sc-sdtwF elpZib"><div> </div> </div> </div>
== Certificate for Web Application ==

As the Orbital Lite STS application processes potentially restricted information (PII and PHI), it is a requirement that the web site is configured to allow HTTPS only.  TLS 1.2 is the recommended protocols while older versions (TLS 1.0/1.1 and SSL 2/3) should be disabled on the web server.

Currently there is '''no '''support for TLS 1.3 in Microsoft servers.

There are no specific requirements on the certificate itself; it can self-signed certificate from IIS, issued by an internal PKI, or provisioned by an external Certificate Authority.
<div class="heading-anchor-wrapper"><div class="sc-sdtwF elpZib"><div> </div> </div> </div>
== Certificate for SAML Signature ==

The Orbital Lite STS requires a signing certificate for the SAML.  This is a general purpose certificate which has the private key available.  As this certificate is used for non-repudiation, it is critical that this certificate be protected. Learn more about generating certificates here.
<div class="heading-anchor-wrapper"><div class="sc-sdtwF elpZib"><div> </div> </div> </div>
== Certificate for SAML Encryption ==

Organization and Service Providers may require that the assertions in the SAML be encrypted.  For that purpose a separate certificate is used to encrypt the data with a public key.  The Service Provider would have the private the key to decrypt. Your Service Provider typically provides you with the public key. Learn more about generating certificates here.

Orbital Lite STS v1.95 Notes

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

Introduction   This is intended to be a preview of the capabilities and functionalities planned for v1.95.  These may change based on feature requests or identified issues that need to be prioritized.   The primary goal with v1.95 will be to prepare the solution for technology growth primarily in the following items:

*transition from the older .NET 4.51 framework to a newer version of .NET Core,
*preparing for SSO and supporting existing IDPs,
*caching more data to improve performance
*moving away from the archaic web.config file that is used for configuration. 

What will be missing in this version will be a large amounts of new functionality as the intention will be to ensure that the codebase remains fairly unchanged to ensure that there are no disruptions with current integrations.   

 

The move to .NET Core is to update the various framework libraries that go as far back as 2013 which have been kept to minimize disruption for existing systems.  The intention since v1.8 is to maintain the same .NET framework version and there hasn't been anything so far that could not be accomplished with it.  Moving to .NET Core also positions the STS for a more light-weight deployment which would lend itself well for containirization so that cloud deployments can be OS agnostic and use resources more efficiently.  It's not that the STS has a large footprint but this will ensure that the solution continues to be very lean.

 

In regards Cloud-deployments it should be kept in mind that Windows Integrated Authentication uses Kerberos behind the scenes which may not be feasible for orgenizations that maintain their domain controllers on-premise.  In the short-term a cloud-deployment is feasible for environments that use UserContextModes 1 and 2 and have well-defined or LDAP dependencies.  Long-term UserContextModes 6 and 7 will extend the federated authentication model whereby the STS solution will effectively become more of a SAML generator.  

 

While the STS is quite well-performing in terms of processing requests, there are additional improvements that can be made in regards caching information.  At the moment the primary candidate is the group membership code.  In some cases these groups can contain thousands of users and can take 100s of milleseconds to retrieve.  This would provide a significant performance benefit although the memory footprint may be increased (albeit a small price to pay).<br/> In addition there are many (too) frequent configuration file checks that can be avoided and moved to memory instead.  

 

Another aspect that needs to be addressed is that STS configuration will be moved away from the web.config to a new dedicated repository.  The web.config formatting is quite rigid and it's apparent that the STS has outgrown its confined structure.  Upgrades have been more complex than they should have been and have required more manual interventon than desired by both the client and RWI.  This may be the time to explore adding a central DB support although the admin interface will need to be introduced.

 

With respect to reporting, more organizations are moving towards central repositories either for SIEM, auditing or business metrics, v1.95 will introduce some basic reporting focused on providing security incident reports (i.e. report on all activity for a user) and dashboard on activity (number of users, errors, performance, etc).  

 

This will also be last version that will have support for UserContextMode 3.  It was an initial implementation that was flawed from a security perspective and was added to support some more limited implementations.  Since 2013/2014 no organization has selected this option since the other options are more secure and simpler to implement.  It will also simplify the QA process for each release and free up some testing cycles to prepare for the SSO integrations. Overall, the vast majority of organizations are using UserContextModes 2 and 4: [https://wiki.radiusworks.com/main/customcontent/usercontextmodes-breakdown.jpg https://wiki.radiusworks.com/main/customcontent/usercontextmodes-breakdown.jpg]

 

Also, v1.95 will be final version where Windows 2012 R2 will be actively supported and tested against.  Few organizations remain on Windows 2012 servers and the ones that still have their STS running on 2012 R2 are planning to migrate to a newer version.  Keep in mind that Active Directory functional level has no direct impact to STS regardless of the UserContextMode and the directory calls.  The main reason for discontinuing support for Windows 2012 R2 is to allow v1.96 to implement a newer version of the .NET 4.6.2 which is included as part of the OS components.

 

 

             

Orbital Lite STS Product Roadmap

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

{| border="0" cellpadding="1" cellspacing="1" style="width: 800px"
|-
| style="width: 280px" |  
| colspan="2" rowspan="1" style="width: 60px; text-align: center" | '''2019'''
| colspan="2" rowspan="1" style="width: 57px; text-align: center" | '''2020'''
| colspan="2" rowspan="1" style="width: 57px; text-align: center" | '''2021'''
| colspan="2" rowspan="1" style="width: 58px; text-align: center" | '''2022'''
|-
| style="width: 280px" |  
| style="width: 60px; text-align: center" | '''Q2'''
| style="width: 57px; text-align: center" | '''Q4'''
| style="width: 57px; text-align: center" | '''Q2'''
| style="width: 58px; text-align: center" | '''Q4'''
| style="width: 57px; text-align: center" | '''Q2'''
| style="width: 63px; text-align: center" | '''Q4'''
| style="width: 58px; text-align: center" | '''Q2'''
| style="width: 62px; text-align: center" | '''Q4'''
|-
| style="width: 280px" |  
| style="width: 60px; text-align: center" | '''1.92'''
| style="width: 57px; text-align: center" | '''1.93'''
| style="width: 57px; text-align: center" | '''1.94'''
| style="width: 58px; text-align: center" | '''1.95'''
| style="width: 57px; text-align: center" | '''1.96'''
| style="width: 63px; text-align: center" | '''1.97'''
| style="width: 58px; text-align: center" | '''1.98'''
| style="width: 62px; text-align: center" | '''1.99'''
|-
| style="width: 280px" | Windows 2012 R2 Support
| style="width: 60px; background-color: rgb(0, 153, 0)" |  
| style="width: 57px; background-color: rgb(0, 153, 0)" |  
| style="width: 57px; background-color: rgb(0, 153, 0)" |  
| style="width: 58px; background-color: rgb(0, 153, 0)" |  
| style="width: 57px" |  
| style="width: 63px" |  
| style="width: 58px" |  
| style="width: 62px" |  
|-
| style="width: 280px" | Windows 2016 Support
| style="width: 60px; background-color: rgb(0, 204, 204)" |  
| style="width: 57px; background-color: rgb(0, 204, 204)" |  
| style="width: 57px; background-color: rgb(0, 204, 204)" |  
| style="width: 58px; background-color: rgb(0, 204, 204)" |  
| style="width: 57px; background-color: rgb(0, 204, 204)" |  
| style="width: 63px; background-color: rgb(0, 204, 204)" |  
| style="width: 58px; background-color: rgb(0, 204, 204)" |  
| style="width: 62px; background-color: rgb(0, 204, 204)" |  
|-
| style="width: 280px" | Windows 2019 Support
| style="width: 60px; background-color: rgb(153, 0, 204)" |  
| style="width: 57px; background-color: rgb(153, 0, 204)" |  
| style="width: 57px; background-color: rgb(153, 0, 204)" |  
| style="width: 58px; background-color: rgb(153, 0, 204)" |  
| style="width: 57px; background-color: rgb(153, 0, 204)" |  
| style="width: 63px; background-color: rgb(153, 0, 204)" |  
| style="width: 58px; background-color: rgb(153, 0, 204)" |  
| style="width: 62px; background-color: rgb(153, 0, 204)" |  
|-
| style="width: 280px" |  
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px" |  
| style="width: 57px" |  
| style="width: 63px" |  
| style="width: 58px" |  
| style="width: 62px" |  
|-
| style="width: 280px" | UserContextMode 1 and 2
| style="width: 60px; background-color: rgb(255, 153, 0)" |  
| style="width: 57px; background-color: rgb(255, 153, 0)" |  
| style="width: 57px; background-color: rgb(255, 153, 0)" |  
| style="width: 58px; background-color: rgb(255, 153, 0)" |  
| style="width: 57px; background-color: rgb(255, 153, 0)" |  
| style="width: 63px; background-color: rgb(255, 153, 0)" |  
| style="width: 58px; background-color: rgb(255, 153, 0)" |  
| style="width: 62px; background-color: rgb(255, 153, 0)" |  
|-
| style="width: 280px" | UserContextMode 3
| style="width: 60px; background-color: rgb(204, 51, 51)" |  
| style="width: 57px; background-color: rgb(204, 51, 51)" |  
| style="width: 57px; background-color: rgb(204, 51, 51)" |  
| style="width: 58px; background-color: rgb(204, 51, 51)" |  
| style="width: 57px" |  
| style="width: 63px" |  
| style="width: 58px" |  
| style="width: 62px" |  
|-
| style="width: 280px" | UserContextMode 4 and 5
| style="width: 60px; background-color: rgb(51, 51, 255)" |  
| style="width: 57px; background-color: rgb(51, 51, 255)" |  
| style="width: 57px; background-color: rgb(51, 51, 255)" |  
| style="width: 58px; background-color: rgb(51, 51, 255)" |  
| style="width: 57px; background-color: rgb(51, 51, 255)" |  
| style="width: 63px; background-color: rgb(51, 51, 255)" |  
| style="width: 58px; background-color: rgb(51, 51, 255)" |  
| style="width: 62px; background-color: rgb(51, 51, 255)" |  
|-
| style="width: 280px" | UserContextMode 6
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px" |  
| style="width: 57px; background-color: rgb(102, 153, 153)" |  
| style="width: 63px; background-color: rgb(102, 153, 153)" |  
| style="width: 58px; background-color: rgb(102, 153, 153)" |  
| style="width: 62px; background-color: rgb(102, 153, 153)" |  
|-
| style="width: 280px" | UserContextMode 7
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px" |  
| style="width: 57px; background-color: rgb(255, 102, 102)" |  
| style="width: 63px; background-color: rgb(255, 102, 102)" |  
| style="width: 58px; background-color: rgb(255, 102, 102)" |  
| style="width: 62px; background-color: rgb(255, 102, 102)" |  
|-
| style="width: 280px" |  
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px" |  
| style="width: 57px" |  
| style="width: 63px" |  
| style="width: 58px" |  
| style="width: 62px" |  
|-
| style="width: 280px" | .NET Core Support
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px; background-color: rgb(187, 187, 187)" |  
| style="width: 57px; background-color: rgb(187, 187, 187)" |  
| style="width: 63px; background-color: rgb(187, 187, 187)" |  
| style="width: 58px; background-color: rgb(187, 187, 187)" |  
| style="width: 62px; background-color: rgb(187, 187, 187)" |  
|-
| style="width: 280px" | Azure Container Support
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px" |  
| style="width: 57px; background-color: rgb(255, 204, 255)" |  
| style="width: 63px; background-color: rgb(255, 204, 255)" |  
| style="width: 58px; background-color: rgb(255, 204, 255)" |  
| style="width: 62px; background-color: rgb(255, 204, 255)" |  
|-
| style="width: 280px" | AWS Container Support
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px" |  
| style="width: 57px; background-color: rgb(255, 204, 255)" |  
| style="width: 63px; background-color: rgb(255, 204, 255)" |  
| style="width: 58px; background-color: rgb(255, 204, 255)" |  
| style="width: 62px; background-color: rgb(255, 204, 255)" |  
|-
| style="width: 280px" |  
| style="width: 60px" |  
| style="width: 57px" |  
| style="width: 57px" |  
| style="width: 58px" |  
| style="width: 57px" |  
| style="width: 63px" |  
| style="width: 58px" |  
| style="width: 62px" |  
|}

Version 1.95 planned release date: November 23rd, 2020

Version 1.96 planned release date: March 29th, 2021

Orbital Lite STS

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

'''Welcome to the Orbital Lite Security Token Service Wiki.'''

The Orbital Lite Security Token Service (STS) is a high-performance SAML token generator for legacy applications.  Its primary focus is to provide identity federation capabilities with various healthcare solutions and as such it is focused to support clinical workflows and ensure that both user and patient context are relayed to integrated Service Providers.

The primary objective of Orbital Lite STS is to leverage current processes and data repositories in order to minimize implementation efforts to integrate with external Service Providers.  This is usually accomplished by using data elements from (in order of preference):

*The EMR/HIS
*Global attributes configured in Orbital Lite STS
*Windows authentication credentials
*Active Directory or LDAP
*Databases
*Active Directory Federations Services (in development)
*Single-Sign On (SSO) tokens (in development)

Here you will find information that will allow you and your organization to maintain your instance of STS. 

[https://sts.radiusworks.com/wiki/index.php?title=Orbital_Lite_STS_Product_Roadmap Orbital Lite STS Product Roadmap]

 

[https://sts.radiusworks.com/wiki/index.php?title=Installation_and_Deployment Installation and Deployment]

[https://sts.radiusworks.com/wiki/index.php?title=Configuration_Settings Configuration Settings]

[https://sts.radiusworks.com/wiki/index.php?title=Release_Notes_v1.94 Release Notes v1.94]

[https://sts.radiusworks.com/wiki/index.php?title=Upgrading_v1.93_to_v1.94 Upgrading v1.93 to v1.94]

[https://sts.radiusworks.com/wiki/index.php?title=Orbital_Lite_STS_v1.95_Notes Orbital Lite STS v1.95 Notes]

Main Page

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

<strong>MediaWiki has been installed.</strong>

Consult the [https://www.mediawiki.org/wiki/Special:MyLanguage/Help:Contents User's Guide] for information on using the wiki software.

== Getting started ==
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Configuration_settings Configuration settings list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:FAQ MediaWiki FAQ]
* [https://lists.wikimedia.org/postorius/lists/mediawiki-announce.lists.wikimedia.org/ MediaWiki release mailing list]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Localisation#Translation_resources Localise MediaWiki for your language]
* [https://www.mediawiki.org/wiki/Special:MyLanguage/Manual:Combating_spam Learn how to combat spam on your wiki]

Key Concepts for Orbital Lite STS

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

There are a few logical items that the administrator or Service Provider should understand prior to modifying or reviewing the configuration of Orbital Lite STS.

While many examples focus on healthcare settingsdue its origins, STS has been deployed in non-clinical legacy systems. The terminology such as [https://en.wikipedia.org/wiki/Electronic_health_record EHR]/[https://en.wikipedia.org/wiki/Hospital_information_system HIS]/[https://en.wikipedia.org/wiki/Electronic_health_record EMR], clinical or “clinicians” should not be taken as prescriptive and merely reflects the primary client profile of Radius Works.

 

----

 

== UserContextMode ==

There are currently five modes of operation as of version 1.93. These modes allow the STS to establish the trust with the originating system (an EMR, EHR a HIS). The concept is that the STS needs to confirm that the request is coming from a trusted system or processed on behalf of an authorized user (typically a clinician or other staff member).

Find out more here about UserContextModes.

 

== UserContext ==

UserContext is the key attribute that establishes the security context between the source (clinical) system and the STS. It’s typically the username by which the user logged into the source system or by which the workstation (also RDP or Citrix session) has authenticated the user.

Group membership lookups are driven by the UserContext attribute so it’s important that the user identity being retrieved from Active Directory, LDAP or a database matches this value.

 

== NameQualifier ==

 

The NameQualifier is very much a [https://docs.oasis-open.org/security/saml/v2.0/saml-core-2.0-os.pdf SAML ]term that is used by STS to define sets of users that will be processed in the same manner.

Typically NameQualifiers align with (AD) domains in the organization. In the SAML sense a NameQualifiers allows an organization to ensure that the identity attributes can be used to uniquely identify a users (<NameQualifier>+<NameID>). Specifically this refer to the situation where an organization has two domains and may not be able to enforce uniqueness in usernames (e.g. samAccountName). For example you have two users called jsmith; one in the “corporate” domains and one in the “research” domain. In Windows/NetBIOS terms this would be “corporate/jsmith” and “research/jsmith”.

STS uses the NameQualifier to determine how to process the user identity information. It may go to Active Directory to obtain additional user attributes for “corporate/jsmith” and may go to a MSSQL data to retrieve information about “research/jsmith”.

 

== Service ==

 

Since version v1.7, the STS supports multiple Service Provider profiles. One instance of STS can be used to integrate with different external Service Providers simplifying maintenance. This can be an attribute that the source system can submit to the STS, providing flexibility and reducing complexity for integrating vendors.

Installing Orbital Lite STS

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

'''WINDOWS SERVER FEATURES'''

Standard Microsoft technologies and features are used to run Orbital Lite STS. The application is hosted under Internet Information Services.<br>
All steps described in the server configuration require local administrative privileges.<br>

'''
.NET FRAMEWORK'''
Its core requirement is .NET Framework 4.51 or later.<br>
Windows 2016 will have .NET Framework 4.51 or later available as part of its core feature set.<br>
Windows 2012 will have to have .NET Framework 4.51 or later installed. This is available from Microsoft directly at https://www.microsoft.com/en-ca/download/details.aspx?id=40779 .<br>

Installation and Deployment

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

Installing and deploying Orbital Lite STS is fairly straight-forward and requires a few steps.

Your Radius Works partners should have provided you with the <span class="sc-iNhVCk eLcdjG">prerequisites </span>including the binary files and initial license file to allow you to test it the solution.

 

[[Prerequisites|Prerequisites]]

[[Windows_Server_Configuration|Windows Server Configuration]]

[[Generating_a_License_Key|Generating a License Key]]

[[High_Availability|High Availability]]

[[Authorization_Principles|Authorization Principles]]

High Availability

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

In most environments there is requirement to have web-services running in an Active-Active or Active-Standby configuration.

This is easily accomplished by load-balancing or configuring fail-over between two or more instances of the Orbital Lite STS.
<div class="heading-anchor-wrapper"><div class="sc-sdtwF elpZib"><div> </div> </div> </div>
== Considerations ==

A working STS installation can be copied to one or more servers. This reduces the required configuration on each instance.

External load-balancing via network load-balancer or similar device is recommended.

Keep in mind that each new instance will require a new license file. You can follow [https://sts-orbital.atlassian.net/wiki/spaces/OLS/pages/229787/Generating+a+License+Key this process] to generate the request so that Radius Works can provide you the file.

As part of the request processing a user’s information may be temporarily cached on the server when requesting authentication or obtaining a fetch. This means that to generate a SAML token, the client browser may actually process one or more requests to the STS in order to complete the process. Hence it is important the user’s request return to the same server.

If load-balancing, ensure that the affinity (“stickiness”) is set to the client IP. Keep in mind that in some environments behind a proxy or a NAT this may cause undue load. It should be noted that Orbital STS Lite uses SessionIDs that are available in the request header and stored via client-side cookie.

 

== Load-Balancing ==

Using load-balancing ensures that users are provided a resilient and potentially better-performing STS deployment.  For purposes of simplification, the clustering configuration will be based on server pairs; it is feasible that a cluster can have a larger set of servers.

There are two common configurations:

*Active-Passive
*Active-Active

=== Active-Passive ===

In this configuration, both servers have the same configuration and only one server processes requests at any given time.  The load-balancer will verify that the active node is available and will re-direct traffic to the passive node if a certain condition or threshold is (e.g. the web service cannot be reached, requests exceed a certain response time, etc).  

This configuration will work for all scenarios without any specific modifications.  It is possible that a user request may be lost during the transition from the active node to the passive one (or vice-versa).

=== Active-Active ===

In this configuration, both servers have the same configuration and both can process requests at any given time.  The load-balancer will distribute the traffic based on a specific parameter (e.g. number of connections, response time, etc).  

This configuration will work for all scenarios although for services that use [[UserContextModes|UserContextMode ]]4, 5 or 6, the load-balancer must configure affinity ("stickiness") based on source IP address (or similar).  This is due to session handling as the information from the HIS will stored in memory while the user's browser is challenged for authentication.  In this case, the same server must process the same request.  

== URLs and Virtual IP (VIP) ==

The VIP associated with the load-balanced configuration must have a corresponding DNS entry.  This DNS will be used for the URL that can be specified in the web.config so that the metadata.xml provided to Service Providers is meaningful.  The URL must be resolved by the client workstations accessing the Orbital Lite STS web service.  The VIP and DNS '''does not''' need to be routable (or resolvable) on the servers hosting the service itself.

We recommend that the URL is meaningful to the service provider (for convenience in case they need to troubleshoot access) and that there is an appropriate web certificate that matches the DNS entry.

 

 

Generating a License Key

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

Your upgrade or trial package should come with a temporary license. Orbital STS generates a unique key that identifies the IIS instance and web site that you installed it.

A trial or upgrade package usually comes with a temporary/trial license key for a set number of days. After the license expires, the web application will stop working.

Licenses are specific to the server and the IIS instance. Re-deploying the application into a new IIS site or new server will cause the license to become invalid.

 

#
Open the STS Application and click on "About"

#
You should see a "New License Key Request" and a textbox with encrypted data. This data includes only a GUID and IIS instance ID. This information would not typically be deemed confidential as it is not an IP address, server name, or MAC address

#
Copy that text in the textbox and e-mail it to [mailto:support@radiusworks.com support@radiusworks.com] requesting the purchased license key.

#
The support contact will send you a license.xml file.

#
Stop the IIS site hosting STS.

#
Copy the license.xml file into the /license. You may overwrite the existing file, or rename it.

#
Start the IIS site hosting STS.

#
Open the STS Application and click on "About"

#
Verify that you now have a "Perpetual" or "Subscription" license

Encrypting the web.config

2026-10-19T14:55:46Z

Theluis-admin: 1 revision imported

== Overview ==

<br/> As the web.config contains sensitive information, it is important that it is encrypted.

The encryption should only occur once the validation of the application has been completed, as the encryption process is not easily reversible.

The process below describes the process to encrypt with a machine-specific key where each server instance will have its own encrypted copy of the configuration file.

== Make a backup of the web.config ==

Copy the web.config into a secure location.  You must ensure that the password and any other information that is sensitive be extracted.  This allows the administrator to make configuration changes in the future and provides a starting point.

== <br/> Prepare the Web.Config ==

One line in the web.config has to be temporarily commented.
<pre><section name="STSSettings" type="LiteSTS.Common.Configuration.STSConfig"/></pre>

should be changed to
<pre></pre>

 

== Encrypt the web.config ==

<br/> Open the command prompt as an administrator.

Navigate to "C:\Windows\Microsoft.NET\Framework\v4.0.30319";  e.g. "cd C:\Windows\Microsoft.NET\Framework\v4.0.30319"

Run the following command and change it to reflect the actual location of the web application:

aspnet_regiis.exe -pef STSSettings "D:\orbital-lite"

== <br/> Verify the encryption of the web.config ==

Confirm that no sensitive data remains in the web.config

== Finalize the Web.Config ==

We need to change back the line that was previously commented.
<pre></pre>

should be changed back to
<pre><section name="STSSettings" type="LiteSTS.Common.Configuration.STSConfig"/></pre>

== Test the application ==

== Ensure that the application is operating as expected. ==

Creating Certificates

2026-10-19T14:55:45Z

Theluis-admin: 1 revision imported

= <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Creating Certificates</span></span></span> =

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">There are several ways to create the certificates needed by the STS. The biggest distinction in the certificates for the purposes of deployment is '''self-signed''' and issued by '''Certificate Authority''' (CA).</span></span></span>

 

== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Certificate Authority</span></span></span> ==

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">This is a trusted entity between two or more parties.  Organizations may have an internal CA (e.g. Microsoft Certificate Services) for which all internal workstations and servers will accept certificates from.  In some cases, external CAs may be used due to the application being public and used by systems that cannot be remotely configured.</span></span></span>

 

 

== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Self-Signed</span></span></span> ==

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Self-signed certificates are more appropriate for non-production environments. These can be generated by the administrator locally on the server or using tools (e.g. OpenSSL).</span></span></span>

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">The main issue with self-signed certificates is that may not be trusted by the systems using them.  For example, in a development environment a self-signed web server certificate may generate warning on the workstations testing the service.  Or a service provider may have their login process report errors. </span></span></span>

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">For the intents of encryption or digital signatures a self-signed certificate is technically valid; i.e. it will protect the data in the expected manner.  The primary thing missing is assurance provided by a trusted entity (i.e. the Certificate Authority).</span></span></span>

 

== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Basic Requirements for Certificates</span></span></span> ==

 

*<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">The private key should be at least 2048 bits in length; ideally 4096 bits or higher should be used.  The longer the key, the more likely it is able to withstand cryptographic attacks.</span></span></span>
*<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">A current hash such as SHA256 or SHA512 should be used.  MD5/SHA1 have been deprecated in most implementations.</span></span></span>
*<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">The common name for the certificate should be something valid and representative of the service being used.  E.g. if the STS development is located at [https://stsdev.hospital.org https://stsdev.hospital.org], then the common name should be “stsdev.hospital.org”.  This ensures alignment in the overall configuration of the environment and prevents potential browser errors with mismatched names.</span></span></span>

 

== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Corporate Encryption Polices</span></span></span> ==

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Administrators will typically adhere to certificate management practices as set by internal policies or procedures.  These may indicate how certificates can be deployed</span></span></span>

 

== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Private Keys</span></span></span> ==

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">A private key should never be shared outside of the internal system.  Your service provided should never require for you to send them their private key and vice-versa.  Once that private key is in the hands of an untrusted party, the security (self-repudiation) of that encryption or signing key is void.</span></span></span>

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Click here what to provide your Service Provider.</span></span></span>

 

== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Generating a Self-Signed Certificate for SAML Signatures</span></span></span> ==

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">For the STS installation, a certificate must be used to digitally sign the SAML assertions.  The STS requires access to the private key in order to perform that action. </span></span></span>

 

<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">OpenSSL is a great tool to generate certificates, but a quicker way to generate a test or development certificate is to use [https://www.samltool.com/self_signed_certs.php Onelogin’s SAML Tool] .</span></span></span>

 

=== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Using OneLogin</span></span></span> ===

 

#<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Use the OneLogin tool making sure you fill out the common name to match your STS instance, the bit key length of 2048 bits and a SHA256/SHA512 digest.  Enter a good password (8-12 characters) and make note of it as it will be required again.</span></span></span>
#<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Copy the generated contents of the “X.509 cert” textbox in a text editor (e.g. Notepad).  Save the file with a name of your choice but with a CER extension; e.g. “hospital.cer”.</span></span></span>
#<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Copy the generated contents of the “Private Key” textbox in a text editor (e.g. Notepad).  Save the file with a name of your choice but with a KEY extension; e.g. “hospital.key” in the same location as the CER file in the previous step.</span></span></span>
#<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">You now need to generate a PFX (PKCS #12) that Windows server and the STS can process.  Download and install.</span></span></span>
#<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">From the OpenSSL command prompt navigate to the folder where you stored your CER and KEY files.</span></span></span>
#<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Enter the following command:</span></span></span>
<pre>openssl pkcs12 -export -out hospital.pfx -inkey hospital.key -in hospital.cer</pre>

#<span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">You will be prompted for the password from step 1 as well requested to enter a new password to protect the PFX file.</span></span></span>

 

== <span style="line-height:normal"><span style="font-size:12.0pt"><span style="font-family:">Using OpenSSL</span></span></span> ==

#<span style="line-height:normal"><span style="font-size: 12pt;">Launch the OpenSSL command prompt and navigate to the folder where you wish to store your certificate files</span></span>
#<span style="font-size: 16px;">In this example we will create a certificate with 4096 bit private key for a web server names "stsproduction.hospital.org".  This certificate will be valid for 365 days.</span>
#<span style="font-size: 16px;">Enter the following command:</span>
#<pre>openssl req -x509 -newkey rsa:4096 -sha256 -keyout ourcertificate.key -out ourcertificate.crt -subj "/CN=stsproduction.hospital.org" -days 365</pre>

#<span style="font-size: 16px;">Your will be prompted for a password for key store.</span>
#<span style="font-size: 16px;">After enter the following command to generate a PFX that can be used on a Windows Server or with Orbital Lite STS directly:</span>
#<pre>openssl pkcs12 -export -name “stsproduction.hospital.org” -out ourcertificate.pfx -inkey ourcertificate.key -in ourcertificate.crt</pre>

#<span style="font-size: 16px;">You will be first asked for the password in the key store, and then for a password that you will use to protect the exported PFX file.</span>

 

 

 

Configuration Settings

2026-10-19T14:55:45Z

Theluis-admin: 1 revision imported

This section describes the configuration elements in the web.config that allow the administrator to control the behaviour and features in Orbital Lite STS.

 

[[Key_Concepts_for_Orbital_Lite_STS|Key Concepts for Orbital Lite STS]]

[[UserContextModes|UserContextModes]]

[[UserContextHash|UserContextHash]]

[[STS_Configuration_via_Web.Config|STS Configuration via Web.Config]]

[[Encrypting_the_web.config|Encrypting the web.config]]

[[Audit_File|Audit File]]

 

Authorization Principles

2026-10-19T14:55:45Z

Theluis-admin: 1 revision imported

Organizations who integrate the STS with their legacy applications always adequate precautions in ensuring that the security controls are in place.  While authentication (e.g. [[UserContextModes|UserContextModes]]) is the primary method by which unauthorized access is managed, the other aspect that needs to be considered is authorization.  Authorization takes the additional step to verify or make the decisions if a user should have access to the external application.   There are three tiers in managing access to external service providers:

#'''At the legacy application level''': in this case the application itself determines if the user is authorized (typically via roles) to access the external service providers.  Most implementations will have the logic in the application decide if the link to the external service provider should be displayed or rendered.
#'''Leveraging Orbital Lite STS''': using it's Allow/Deny rules and leveraging group memberships on directory services.  Here the STS will check if the users is a member of a specific group and grant access to the external provider accordingly
#'''Using Service Provider access controls''': some service providers control the provisioning based on an approved user list or designated roles.  In federated identifies with authenticated identity providers (based on contractual stipulations), the role assignment and its managements may be delegated to the source system; e.g. a hospital has 3 roles defined with the SP and will assign them accordingly in the source application.

Ideally all three tiers should be implemented to ensure a highly-controlled access model.  Realistically, there may be undue operational overhead and complexity.  In additional performing unnecessary access control validation may add latency and impact performance. Here we present the recommended minimum access controls per UserContext Mode.

== Recommended Access Control Tiers ==

{| width="1096" cellspacing="1" cellpadding="1" border="1"
|-
! scope="col" | UserContextMode
! scope="col" | Tier 1: Source Application
! scope="col" | Tier 2: Orbital Lite STS
! scope="col" | Tier 3: Service Provider
|-
| 1: Individual Hash
| style="text-align: center" | <span style="color:#c0392b">Yes, display link for authorized users</span>
| style="text-align: center" | Optional
| style="text-align: center" | Optional
|-
| 2: Organizational Hash
| style="text-align: center" | <span style="color:#c0392b">Yes, display link for authorized users</span>
| style="text-align: center" | Optional
| style="text-align: center" | Optional
|-
| 3: Individual Plaintext Password
| style="text-align: center" | <span style="color:#c0392b">Yes, display link for authorized users</span>
| style="text-align: center" | <span style="color:#c0392b">Yes, check for authorization</span>
| style="text-align: center" | Optional
|-
| 4: Windows Authentication
| style="text-align: center" | Optional, display link for authorized users
| style="text-align: center" | <span style="color:#c0392b">Yes, check for authorization</span>
| style="text-align: center" | Optional
|-
| 5: Client-side Certificates
| style="text-align: center" | Optional, display link for authorized users
| style="text-align: center" | <span style="color:#c0392b">Yes, check for authorization</span>
| style="text-align: center" | Optional
|-
| 6: SSO Cookie
| style="text-align: center" | Optional, display link for authorized users
| style="text-align: center" | <span style="color:#c0392b">Yes, check for authorization</span>
| style="text-align: center" | Optional
|-
| 7: ADFS Integration
| style="text-align: center" | Optional, display link for authorized users
| style="text-align: center" | <span style="color:#e67e22">Optional, leverage ADFS to assign assertions</span>
| style="text-align: center" | Optional
|}

 

=== Additional Compensating Controls ===

Organizations are strongly encouraged to review logs and audit user activity at least monthly.  If possible, the activity at the Service Provider level should be reviewed and authorized access validated.  This should be done in collaboration with both parties, as the SP typically has no visibility into the userbase at the organization, and the organization may not have the knowledge to interpret the activity generated by the SP logs/reports.

 

 

Audit File

2026-10-19T14:55:45Z

Theluis-admin: 1 revision imported

The STS Audit file provides the business (i.e. Privacy, Clinical Informatics, etc) with information on the activity related to the Service Providers.

Using these files the following key data measurements can be obtained:

*User activity audits
*Service volumes
*STS performance metrics

Each server has it own audit file, so in an environment where more than one server processes requests, then all audit files should be reviewed.

== Audit File Format ==

Every user interaction when executing properly will have two events in the audit event:

*the beginning of the request when the source system re-directs the user to the STS
*the completion of the request when the STS re-directs the user to the Service Provider; this can be successful or a failure (if there is an error in STS processing the request)

== Fields ==

Each user interaction will have an event its separate row and are pipe-delimitted “|”.

The fields below are in order as stored in the audit file.

=== Audit Time Stamp ===

This segment is actually set in the web.config under the web.config. This will provide the local time as defined in the Windows system format to the millisecond.

=== Remote Address ===

This is the client IP address of the user’s browser that is interacting with the STS.

=== Session ID ===

This is the unique session ID for the user’s interaction. Keep in mind that the session will remain active, so it is possible that the users can have more than one pair of interaction events.

The session ID is the main correlating factor that allows analysts to perform measurements for transaction times or abandoned requests.

=== NameID ===

This is the NameID that was either provided by the source system, or obtained by the STS. This will be provided as part of the SAML request that the Service Provider will be able to audit against.

=== NameQualifier ===

This is the NameQualifierthat was either provided by the source system, or obtained by the STS. This will be provided as part of the SAML request that the Service Provider will be able to audit against.

=== UserContextTimeDate ===

This the time/date in the supported format that the source system submitted to the STS. This is helpful to determine any significant network latency (to the second) and allows the analyst to correlate the request from the source system if necessary.

=== UserContextMode ===

This is a value indicating with UserContextMode is being used. This would be a value from 1 to 5 (as of v1.93).

=== UserContextID ===

This is the UserContextID submitted by the source system or the username that was authenticated by the STS (in case of UserContextMode 4 or 5).

=== UserContextDomain ===

This is the AD domain of the authenticated UserContextID if UserContextMode 4 was used.

=== UserContextWorkstation ===

This UserContextWorkstation value would be the hostname or IP address provided if the source system is using UserContextMode 3.

=== PatientContextIDType ===

This is the type of Patient ID being provided by the source system. Values can be “MRN” or “JHN”.

=== Sanitized PatientContextID ===

This is the Patient ID provided for Privacy or Security incident audit. Note that this value will not be stored in full and will be processed and sanitized in three modes. See

[https://radiusworks.atlassian.net/wiki/spaces/OLS/pages/295496/Configuration+Settings Configuration Settings] for more information.

=== Sanitized PatientContextLastName ===

This is the Patient’s Last Name sanitized to protect the PHI.

=== UAO ===

This is the UAO value (if applicable) associated with the request.

=== Status ===

This provides the status of the request.

*Unknown - this is the start of the interaction; at this point, the user identity has not been validated or established.
*Success - all processing has been completed and the user has been re-directed to the Service Provider
*Failure - there was an error in processing the request and the administrator should review the operational STS log for additional information.

== Example ==

<code>2019-04-04 15:54:17,401 56437|10.105.1.221|dmv5zj1mfvb2ze5x5vz5pali|mark|corporate.hospital.on.ca|2019-04-04 16:00:00|2||JHN|635353|Unknown</code>

<code>2019-04-04 15:54:17,439 56475|10.105.1.221|dmv5zj1mfvb2ze5x5vz5pali|mark|corporate.hospital.on.ca|2019-04-04 16:00:00|2||JHN|635353|Success</code>

== Performance Metrics ==

In the example below one can calculate the difference in the two time stamps to establish that this STS took 38ms to process the request.