Single sign-on across hospital and government systems

The challenge

An institution that has been digitalizing for a few years runs ten systems and ten separate user lists. Each arrived with its own password rules and its own private meaning for the word role. Staff who transfer accumulate access instead of exchanging it, staff who leave keep whatever nobody remembered to close, and interfaces run on shared passwords sitting in configuration files.

The question an auditor asks - who has access to what, right now - has no single answer, because the answer is scattered across ten databases owned by different vendors. Managing bodies have the same problem one level up: no reliable list of which systems are even in use across the institutions they are responsible for.

What we did

We deploy Keycloak as the institution's identity provider and register each application as a client, so authentication happens in one place and applications receive a signed token instead of a password. Roles, departments and facility assignments are issued as token claims, which means a role is defined once and understood the same way everywhere.

Applications that speak OpenID Connect or SAML connect directly. Older systems that cannot are put behind a small adapter rather than being replaced, so an institution can migrate one system at a time instead of attempting a cutover. OAuth 2.0 covers the machine-to-machine side, so interfaces and scheduled jobs get managed service accounts rather than shared credentials in a file.

The design keeps authentication local to the institution, with federation upward for oversight, because a clinician signing in at three in the morning cannot depend on a link to another city. Beyond the login itself we use the same central point for session termination, step-up authentication on sensitive actions, credential and multi-factor policy, and joiner-mover-leaver automation driven from the HR record.

The outcome

Granting or removing access becomes one action that takes effect everywhere in seconds, and a lost laptop or a suspension can be answered by ending every session at once. Every new application stops needing its own user management, password reset and session handling, which removes weeks from each future procurement.

Because a system has to register with the identity service in order to authenticate anyone, the service also holds a live register of every application in the estate, who operates it, how many people use it and when it was last used - the list a managing body normally cannot assemble at all.