Authentication & Single Sign-On (SSO)
Medecision supports secure enterprise-grade authentication workflows across all applications in the platform. This includes deep integration with client identity systems using SAML 2.0, OAuth2, and group-attribute-based authorization to enforce least-privilege access. This page outlines the SSO design, flow, configuration, and security policies in detail.
Supported Authentication Models
Method | Description |
SAML 2.0 | Primary enterprise SSO mechanism using client IdP and Medecision as SP |
OAuth 2.0 / OpenID Connect | Supported for some partner-integrated applications |
Basic Auth (internal only) | Reserved for dev/test environments and CI/CD pipelines |
SAML 2.0 SSO Flow (SP-Initiated)
User visits a Medecision application and clicks "Sign in with SSO."
The Medecision platform (Service Provider) creates a SAML authentication request.
The user is redirected to the client’s Identity Provider (IdP), such as PingFederate, Okta, or Azure AD.
The IdP authenticates the user and returns a signed SAML assertion containing attribute claims.
The SAML response is sent to the Medecision Assertion Consumer Service (ACS) URL.
Medecision validates the assertion, maps attributes, and creates or updates the user session.
SAML Configuration Details
Parameter | Value |
ACS URL |
|
Entity ID |
|
Binding | HTTP-POST |
Encryption & Signing | SHA-256, required on assertion |
Clock Skew Tolerance | ±5 minutes supported |
Required SAML Attribute Claims
Attribute | Purpose |
| Internal user ID (used as primary key in CMV and audit records) |
| Display names and audit tagging |
| Optional user profile enrichment |
| Login ID and notifications |
| Role and application group assignment (RBAC mapping) |
These attributes are required to create or update a user via Just-In-Time (JIT) provisioning.
Role & Group Mapping
Upon successful SAML login, Medecision maps the user’s groups attribute to predefined application and functional roles:
Application Groups
Group Name | Description |
| Access to Aerial Core Management platform |
| Access to the Assessments Module |
| Access to Dashboard for Operations Monitoring |
| Access to Clinical Intelligence platform |
| Administrative privileges for Utilization Management workflows |
| Access to Comprehensive Member View |
| Admin rights for managing guided intake rules and configurations |
| Admin rights in Appeals & Grievances module |
| Access to administrative analytics dashboards and rule monitoring |
Functional Groups
Group Name | Permissions Granted |
| Permission to edit member demographic and clinical data |
| View medical records, timeline entries, and clinical metadata |
| Permission to manage provider profiles and affiliations |
| Management rights including task assignment and oversight |
| Access to restricted health data views for mental health, substance use, etc. |
| Access to request intake module for utilization management |
| Permission to review and make clinical determinations on requests |
| Full admin rights within UM module, including configuration, routing, and overrides |
| Access to manage and edit clinical intelligence rule sets |
| Access to rule builder interface and input/output testing tools |
These groups are assigned via SAML attribute claims and enforced across UI, API, and automation layers. They support least-privilege principles and are configurable per client during onboarding.
Security Features
Signed Assertions: Required for all SAML responses
IP Whitelisting: Optional for partner-facing environments
Session Timeout: Configurable; defaults to 30 minutes of inactivity
Multi-Factor Authentication (MFA): Enforced by client IdP
Audit Logging: Every login event logged with timestamp, IP, and group claims
JIT Provisioning and Session Behavior
Users are provisioned automatically during first login using the mapped SAML attributes.
Any attribute changes on subsequent logins will update the internal user profile.
Users removed from the IdP group will lose access on next login attempt.
No local password is stored in Medecision—authentication is fully delegated to the IdP.
Troubleshooting & Logging
Medecision maintains internal logs for all SAML transactions:
Assertion receipt time
Validation results (signature, timestamp, schema)
Group parsing outcome
Mapping decisions and user provisioning audit trail
Errors are returned as UI messages and can be optionally redirected to client support portals.
Client Onboarding Checklist for SAML SSO
Share IdP metadata XML or discovery URL
Define group/attribute structure and naming conventions
Provide test user credentials for staging environment
Validate ACS URL, entity ID, and encryption requirements
Confirm user attribute mappings (acmUserId, name, email, groups)
Execute login test and validate group-to-role mapping
Promote to production
SSO integration ensures that enterprise users can access Medecision's platform securely with minimal friction, enabling seamless provisioning, compliance, and real-time access control across workflows.