# User Identity Provider

`IIdentityProviderService` in assembly SanteDB.Core.Api version 3.0.1980.0

## Summary

Identity provider service

## Events

| Event          | Type                                   | Description                                       |
| -------------- | -------------------------------------- | ------------------------------------------------- |
| Authenticating | EventHandler\<AuthenticatingEventArgs> | Fired prior to an authentication event            |
| Authenticated  | EventHandler\<AuthenticatedEventArgs>  | Fired after an authentication decision being made |

## Operations

| Operation                | Response/Return      | Input/Parameter                                                                                                                                                                                                                                                                      | Description                                                                                                 |
| ------------------------ | -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------------------------------------------------------------------------------------------------------- |
| GetIdentity              | IIdentity            | *String* **userName**                                                                                                                                                                                                                                                                | Retrieves an identity from the object                                                                       |
| GetIdentity              | IIdentity            | *Guid* **sid**                                                                                                                                                                                                                                                                       | Retrieves an identity from the object                                                                       |
| CreateIdentity           | IIdentity            | <p><em>String</em> <strong>userName</strong><br><em>String</em> <strong>password</strong><br><em>IPrincipal</em> <strong>principal</strong><br><em>Nullable\<Guid></em> <strong>withSid</strong></p>                                                                                 | Create a basic identity in the provider                                                                     |
| Authenticate             | IPrincipal           | <p><em>String</em> <strong>userName</strong><br><em>String</em> <strong>password</strong><br><em>IEnumerable\<IClaim></em> <strong>clientClaimAssertions</strong><br><em>IEnumerable\<String></em> <strong>demandedScopes</strong></p>                                               | Authenticate the user creating an identity                                                                  |
| Authenticate             | IPrincipal           | <p><em>String</em> <strong>userName</strong><br><em>String</em> <strong>password</strong><br><em>String</em> <strong>tfaSecret</strong><br><em>IEnumerable\<IClaim></em> <strong>clientClaimAssertions</strong><br><em>IEnumerable\<String></em> <strong>demandedScopes</strong></p> | Authenticate the user creating an identity                                                                  |
| ReAuthenticate           | IPrincipal           | *IPrincipal* **principal**                                                                                                                                                                                                                                                           | Recheck the authentication of an already authenticated .                                                    |
| ChangePassword           | void                 | <p><em>String</em> <strong>userName</strong><br><em>String</em> <strong>newPassword</strong><br><em>IPrincipal</em> <strong>principal</strong><br><em>Boolean</em> <strong>isSynchronizationOperation</strong></p>                                                                   | Change user password                                                                                        |
| DeleteIdentity           | void                 | <p><em>String</em> <strong>userName</strong><br><em>IPrincipal</em> <strong>principal</strong></p>                                                                                                                                                                                   | Delete an identity                                                                                          |
| SetLockout               | void                 | <p><em>String</em> <strong>userName</strong><br><em>Boolean</em> <strong>lockout</strong><br><em>IPrincipal</em> <strong>principal</strong></p>                                                                                                                                      | Set lockout                                                                                                 |
| AddClaim                 | void                 | <p><em>String</em> <strong>userName</strong><br><em>IClaim</em> <strong>claim</strong><br><em>IPrincipal</em> <strong>principal</strong><br><em>Nullable\<TimeSpan></em> <strong>expiry</strong></p>                                                                                 | Adds a claim to the specified user account                                                                  |
| RemoveClaim              | void                 | <p><em>String</em> <strong>userName</strong><br><em>String</em> <strong>claimType</strong><br><em>IPrincipal</em> <strong>principal</strong></p>                                                                                                                                     | Removes a claim from the specified user account                                                             |
| GetClaims                | IEnumerable\<IClaim> | *String* **userName**                                                                                                                                                                                                                                                                | Get all active claims for the specified user                                                                |
| GetSid                   | Guid                 | *String* **userName**                                                                                                                                                                                                                                                                | Get the SID for the named user                                                                              |
| GetAuthenticationMethods | AuthenticationMethod | *String* **userName**                                                                                                                                                                                                                                                                | Gets the applicable authentication methods from the identity provider for                                   |
| ExpirePassword           | void                 | <p><em>String</em> <strong>userName</strong><br><em>IPrincipal</em> <strong>principal</strong></p>                                                                                                                                                                                   | Indicates that the password for the should be immediately expired (user must change password at next login) |

## Implementations

### BridgedIdentityProvider - (SanteDB.Client)

Represents an identity provider which bridges local and upstream

#### Service Registration

```markup
...
<section xsi:type="ApplicationServiceContextConfigurationSection" threadPoolSize="4">
	<serviceProviders>
		...
		<add type="SanteDB.Client.Upstream.Security.BridgedIdentityProvider, SanteDB.Client, Version=3.0.1980.0, Culture=neutral, PublicKeyToken=null" />
		...
	</serviceProviders>
```

### UpstreamIdentityProvider - (SanteDB.Client)

Represents an implementation of the [IIdentityProviderService](http://santesuite.org/assets/doc/net/html/T_SanteDB_Core_Security_Services_IIdentityProviderService.htm) which uses an upstream oauth server

#### Service Registration

```markup
...
<section xsi:type="ApplicationServiceContextConfigurationSection" threadPoolSize="4">
	<serviceProviders>
		...
		<add type="SanteDB.Client.Upstream.Security.UpstreamIdentityProvider, SanteDB.Client, Version=3.0.1980.0, Culture=neutral, PublicKeyToken=null" />
		...
	</serviceProviders>
```

### AdoIdentityProvider - (SanteDB.Persistence.Data)

An identity provider implemented for .NET

#### Service Registration

```markup
...
<section xsi:type="ApplicationServiceContextConfigurationSection" threadPoolSize="4">
	<serviceProviders>
		...
		<add type="SanteDB.Persistence.Data.Services.AdoIdentityProvider, SanteDB.Persistence.Data, Version=3.0.1980.0, Culture=neutral, PublicKeyToken=null" />
		...
	</serviceProviders>
```

## Example Implementation

```csharp
/// Example Implementation
using SanteDB.Core.Security.Services;
/// Other usings here
public class MyIdentityProviderService : SanteDB.Core.Security.Services.IIdentityProviderService { 
	public String ServiceName => "My own IIdentityProviderService service";
	/// <summary>
	/// Fired prior to an authentication event
	/// </summary>
	public event EventHandler<AuthenticatingEventArgs> Authenticating;
	/// <summary>
	/// Fired after an authentication decision being made
	/// </summary>
	public event EventHandler<AuthenticatedEventArgs> Authenticated;
	/// <summary>
	/// Retrieves an identity from the object
	/// </summary>
	public IIdentity GetIdentity(String userName){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Retrieves an identity from the object
	/// </summary>
	public IIdentity GetIdentity(Guid sid){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Create a basic identity in the provider
	/// </summary>
	public IIdentity CreateIdentity(String userName,String password,IPrincipal principal,Nullable<Guid> withSid){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Authenticate the user creating an identity
	/// </summary>
	public IPrincipal Authenticate(String userName,String password,IEnumerable<IClaim> clientClaimAssertions,IEnumerable<String> demandedScopes){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Authenticate the user creating an identity
	/// </summary>
	public IPrincipal Authenticate(String userName,String password,String tfaSecret,IEnumerable<IClaim> clientClaimAssertions,IEnumerable<String> demandedScopes){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Recheck the authentication of an already authenticated .
	/// </summary>
	public IPrincipal ReAuthenticate(IPrincipal principal){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Change user password
	/// </summary>
	public void ChangePassword(String userName,String newPassword,IPrincipal principal,Boolean isSynchronizationOperation){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Delete an identity
	/// </summary>
	public void DeleteIdentity(String userName,IPrincipal principal){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Set lockout
	/// </summary>
	public void SetLockout(String userName,Boolean lockout,IPrincipal principal){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Adds a claim to the specified user account
	/// </summary>
	public void AddClaim(String userName,IClaim claim,IPrincipal principal,Nullable<TimeSpan> expiry){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Removes a claim from the specified user account
	/// </summary>
	public void RemoveClaim(String userName,String claimType,IPrincipal principal){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Get all active claims for the specified user
	/// </summary>
	public IEnumerable<IClaim> GetClaims(String userName){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Get the SID for the named user
	/// </summary>
	public Guid GetSid(String userName){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Gets the applicable authentication methods from the identity provider for
	/// </summary>
	public AuthenticationMethod GetAuthenticationMethods(String userName){
		throw new System.NotImplementedException();
	}
	/// <summary>
	/// Indicates that the password for the  should be immediately expired (user must change password at next login)
	/// </summary>
	public void ExpirePassword(String userName,IPrincipal principal){
		throw new System.NotImplementedException();
	}
}
```

## References

* [IIdentityProviderService C# Documentation](http://santesuite.org/assets/doc/net/html/T_SanteDB_Core_Security_Services_IIdentityProviderService.htm)
* [BridgedIdentityProvider C# Documentation](http://santesuite.org/assets/doc/net/html/T_SanteDB_Client_Upstream_Security_BridgedIdentityProvider.htm)
* [UpstreamIdentityProvider C# Documentation](http://santesuite.org/assets/doc/net/html/T_SanteDB_Client_Upstream_Security_UpstreamIdentityProvider.htm)
* [AdoIdentityProvider C# Documentation](http://santesuite.org/assets/doc/net/html/T_SanteDB_Persistence_Data_Services_AdoIdentityProvider.htm)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://help.santesuite.org/developers/server-plugins/implementing-.net-features/service-definitions/user-identity-provider.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
