East Coast R1 Public University

This R1 university simplified access to services shared with the affiliated hospital system.

This university has two separate Identity Providers of accounts/passwords - one for campus and one for the affiliated hospital system.  Keeping accounts separate helps maintain strict HIPAA compliance requirements for the hospital system and reduces the number of accounts that the campus needs to manage. Not having to create campus accounts for everyone in the hospital system saved on licensing for the campus. However, the outcome of having separate Identity Providers is that teaching faculty, students in residency and others at the hospital, have two accounts. For these users, the university and hospital system wanted to maintain a unique identifier linked to their credentials, and configure access for services to the unique identifier for a streamlined  login experience.

The essential applications/services that are shared with the affiliated hospital system include: Library services, a customer relationship management system, classroom scheduling, automated malware analysis, a financial system and study abroad applications.  More applications are continuing to be added including a contact tracing system for COVID-19 safety. 

The primary objective was to easily provision access to essential campus services to the affiliated hospital system users while making the login process intuitive.

Cirrus Identity partnered with this university to implement Cirrus Identity Account Linking.  Users that have both a hospital system account and campus account are linked and associated with a unique identifier.  All the matching work to assign a unique identifier was pre-populated and tested before cutover for a smooth rollout.  

When a hospital system user logs into one of the essential shared campus services that have been configured in the Cirrus Proxy, their unique identifier is passed to the service for authorization.  It doesn’t matter if they have an active hospital system session or campus session because the same unique identifier is passed to the campus service for single sign-on.   

Some of the essential campus services that needed to be shared with hospital system users were setup with the CAS protocol for authentication.  Cirrus helped configure a CAS Bridge to the Proxy to make this seamless for the users.

For a smooth transition, passwords were synced for those that had both a hospital system and university account.  Hospital system and university users have an intuitive and consistent login discovery screen to authenticate.