Introduction to EpicAuth for Hyperdrive

The following sections of this document detail the Supported Workflows, Prerequisites, and Client/Server Requirements.

Supported Workflows

The following workflows will be supported in this release:

1. Basic Workflow with XA integration
   1. Single sign-on to Epic
   2. Login, logout and secure
   3. User switching (with badge or username and password)
   4. Epic user state synchronization
2. Re-authentication and Co-signing using only a badge (for non-controlled substances and pharmacy workflows)
3. Standalone Narrator workflow
   1. Badge scanning for arrival and departure events in trauma bays
   2. Systems are configured in non-locking Kiosk Mode
4. Integrated Narrator workflow
   1. Badge scanning for arrival and departure events in trauma bays
   2. XA is not restricted to non-locking Kiosk Mode
5. Community Connect

7. EPCS (E-Prescribing Controlled Substances)
   1. This workflow supports re-authentication with push notifications, OTP, or biometric readers
   2. Requires a separate installer and additional configuration.

Prerequisites

Supported Hyperdrive Versions: February 2022 and higher

Supported ExactACCESS (XA) Versions:

1. 4.13.x Client and Server
2. 4.14.x Client and Server

Supported Configurations:

1. Hyperdrive hosted on Citrix, including using Slingshot on the client to launch the Hyperdrive instance (See FAQ #5 for more information about this configuration)
2. Hyperdrive installed on local workstations and virtual desktops
3. Community Connect

Client/Server Requirements

Hyperdrive hosted on Citrix

1. Client
   1. Windows 10, 11
   2. ExactACCESS Client 4.13 or newer
   3. Citrix Client configured to connect to the environment hosting Hyperdrive
   4. EpicAuth version 4.x
      1. While client endpoints may continue to use the 3.x version in Citrix deployments, we strongly encourage upgrading to 4.x. Improvements and fixes will only be included in 4.x versions.
   5. Optional: Epic Slingshot configured to launch the Hyperdrive published application
2. Citrix Server
   1. .NET 4.8
   2. Epic Hyperdrive Feb 2022 or higher
   3. EpicAuth Plugin version 4.x

Hyperdrive installed on local workstations

1. Client
   1. Windows 10
   2. .NET 4.8
   3. Epic Hyperdrive Feb 2022 or higher
   4. EpicAuth Plugin version 4.x or above

Getting Started - Overview

1. Request access to the Epic Auth Plugin
2. Create Client Registration keys used by the EpicAuth plugin and provide the public key to Identity Automation
3. Create SAML key pairs (if needed)
4. (With Epic TS) Configure Epic E0G records with the correct ProgIDs for the Auth Plugin
5. (With Epic TS) Configure the Interconnect Oauth2 back-end service

Request Access to EpicAuth Plugin

If you do not currently have access to the EpicAuth Plugin, you may request access to it using the "Epic on FHIR" website https://fhir.epic.com. Identity Automation will receive a notification of your request.

To find the Auth Plugin on the "Epic on FHIR" website

1. Search for this client ID: cec0f8f1-9621-4ae5-8ddf-98a0601fdee5.
2. If needed, please reach out to your Epic TS for assistance.

Create Client Registration Keys

How to create client registration key pairs

1. Install EpicAuth using the Identity Automation ProxCard Epic Login Device.msi
2. Run the key generation tool
   a. IA.EpicAuth.Key.Generator.exe is located in the installation directory (default C:\Program Files (x86)\Identity Automation\EpicAuth).
3. Set Production and Non-Production passwords
   1. Determine an appropriate Production password and enter it into the Production password fields (Password and Password Validate)
   2. Determine an appropriate Non-Production password (different than your Production password) and enter it into the Non-Production password fields (Password and Password Validate)
      
4. Click the Create Static Keys button
5. This tool will create four files:
   a. A non-prod password-protected .PFX file which contains a private key
   b. A non-prod .cer certificate file that contains a public key
   c. A production password-protected .PFX file which contains a private key
   d. A production .cer certificate file that contains a public key
6. Provide both public key certificate files IA Epic Hyperdrive Static Key Prod.cer and IA Epic Hyperdrive Static Key Non-Prod.cer to Identity Automation. You can create a support ticket and attach these files to the support ticket. Do not provide the private keys to Identity Automation, only the public key certificate files. Identity Automation does not need any keys for the EPCS solution, if you are using that product.

Create SAML key pairs

If using EPCS or SAML for authentication, you will need to generate SAML key pairs.

1. Run the key generation tool
   a. IA.EpicAuth.Key.Generator.exe is located in the installation directory (default C:\Program Files (x86)\Identity Automation\EpicAuth).
2. Set Production and Non-Production passwords
   1. Determine an appropriate Production password and enter it into the Production password fields (Password and Password Validate)
   2. Determine an appropriate Non-Production password (different than your Production password) and enter it into the Non-Production password fields (Password and Password Validate)
3. Select the Create EPCS/SAML Key button.
   
   1. This will open a separate "Create Epic Hyperdrive SAML Key" window. Click the Create SAML key button, and the SAML certificate files will be saved to your local TEMP folder.

4. Four files will be created:
   1. IA Epic Hyperdrive SAML.cer
      1. Public certificate that needs to be uploaded to the Epic operational database by your Epic TS
   2. IA Epic Hyperdrive SAML.pem
      1. No action necessary for this file
   3. IA Epic Hyperdrive SAML.pfx
      1. No action necessary for this file
   4. IA Epic Hyperdrive SAML-cryptoapi.pfx
      1. Private certificate which needs to be deployed to each system that will be using SAML

Configure Epic E0G records with the correct ProgIDs for the Auth Plugin

See Configuration and Installation.

Configure the Interconnect Oauth2 back-end service

See Configuration and Installation.