Skip to main content

Install the use case's configuration files

A use case writer supplementsgives you withtwo a numberkinds of artifacts,configuration thatfiles. need to be configured:

    Service Discovery definitions Policy definitions

    This page details how to configure each artifact.

    Warning: do not alter these artifacts after receiving them, as they supply theYour Nuts node withneeds theboth, trustfor anchorsevery asuse definedcase byyou join.

    File What it tells your node Directory setting Discovery Service definition Where the use case.case's ChangesDiscovery mightService leadis, and which credentials a care organization must present to unsaferegister configuration.on

    Serviceit

    Discovery Definitions

    These JSON files instruct your Nuts node where to publish use case participation, and where to find other participants. They need to be provided in the Nuts node's discovery definitions directory (

    discovery.definitions.directory). The filenamePolicy maydefinition beWhich changed;credentials itanother doesparty notmust influence the definition. It's recommendedpresent to mountget thean files/access token from you, per scope policy.directory in read-only mode if

    Do Dockerthis isonce used.per use case, per environment.

    RegistrationDon't change these files.: afterThey configuringcontain the definitions,use case's trust rules, such as which certificate authorities are trusted. A changed file can make your node accept parties it shouldn't.

    Install the files

      Download the Discovery Service definition and the policy definition for your environment from the use case's IG. Put them in the directories set in discovery.definitions.directory and policy.directory. File names don't matter. If you use Docker, mount the directories read-only. Restart the node. It reads the files at startup. If it can't read a Discovery Service definition, it doesn't start; the log says which file.

      Each environment has its own files. Only install the files for the applicable subjects throughenvironment the Nutsnode node'sruns VDRin: (v2)a API,use tocase maketypically themuses discoverable.the same service ID in all environments, so the node can only load one of them.

      360-graden-clientbeeld

      EndpointsThe canfiles alsoare be discovered this way; definitions can specify additional parameters (in the formnl-360-ig ofrepository:

      Environment Discovery Service definition Policy definition Discovery Server Development discovery_360_dev.json policy_360_dev.json http://localhost:9091 (a local Discovery Server) Test discovery_360_test.json policy_360_test.json https://development.nedap-nuts.nl Acceptance discovery_360_acc.json policy_360_acc.json https://staging.nedap-nuts.nl Production discovery_360_prod.json policy_360_prod.json https://nedap-nuts.nl

      All environments use the service ID 360-graden.

      What's in a Discovery Service definition

      Part What it means DiscoveryRegistrationCredentialid), forThe instanceservice ID. You use it in the Discovery Service API endpoints,calls. or OAuth2Authorizationendpoint The Discovery Server URLs.where Note:registrations existingare usestored cases useDIDpresentation_max_validity documentHow serviceslong instead.a

      Policyregistration Definitions

      is

      Thesevalid, JSONin filesseconds. instruct your NutsYour node whichrefreshes it before then.

      input_descriptors The credentials a participantcare needsorganization must present to presentregister Fields with a filter Requirements on a credential, e.g. which certificate authorities are trusted. This is why each environment has its own file. Fields with an id Values the node takes from the credentials. They show up as fields in search results. A pattern with a capture group, like (to\d+), yourreturns Nutsonly node)the captured part.

      360-graden-clientbeeld

      The test definition, shortened. It requires an X509Credential from a trusted certificate authority, and a DiscoveryRegistrationCredential with the endpoints. The organization_ura pattern returns only the URA.

      {
  "id": "360-graden",
  "endpoint": "https://development.nedap-nuts.nl/discovery/360-graden",
  "presentation_max_validity": 259200,
  "presentation_definition": {
    "input_descriptors": [
      {
        "id": "id_uzicert_x509credential",
        "constraints": {
          "fields": [
            { "path": ["$.type"], "filter": { "const": "X509Credential" } },
            { "path": ["$.issuer"], "filter": { "pattern": "^did:x509:0:sha256:(GwlhBZ...|szqMaT...|svKzNx...)..." } },
            { "id": "organization_ura", "path": ["$.credentialSubject.san.otherName"], "filter": { "pattern": "^[0-9.]+-\\d+-\\d+-S-(\\d+)-00\\.000-\\d+$" } },
            { "id": "organization_name", "path": ["$.credentialSubject.subject.O"] }
          ]
        }
      },
      {
        "id": "id_registration_parameters_credential",
        "constraints": {
          "fields": [
            { "path": ["$.type"], "filter": { "const": "DiscoveryRegistrationCredential" } },
            { "id": "authorization_server_url", "path": ["$.credentialSubject.authServerURL"] },
            { "id": "fhir_base_url_r4", "path": ["$.credentialSubject.fhirR4BaseURL"], "optional": true }
          ]
        }
      }
    ]
  }
}

      What's in a policy definition

      A policy definition maps a scope to acquirethe credentials another party must present to get an access token withfor ait.

      certain
        The top-level key is the scope. TheyAnother needparty toasks befor providedit in its token request. The fields with an id show up in the Nutstoken node'sintrospection policy directoryresult (see "Validate the access token").

        360-graden-clientbeeld

        The policy, shortened. The scope is policy.directory360-graden). The filerequester namemust maypresent bean changed;X509Credential itand doesa notNutsEmployeeCredential.

        influence
        {
  "360-graden": {
    "organization": {
      "input_descriptors": [
        { "id": "id_uzicert_uracredential", "...": "X509Credential from a trusted CA, as in the definition.Discovery It'sService recommendeddefinition" to},
        mount{ the"id": files/directory"id_employee", in"...": read-only"NutsEmployeeCredential modewith ifemployee_name, Dockeremployee_role isand used.employee_identifier" }
      ]
    }
  }
}