Setting up an Epic OIDC Client in 1Kosmos

You must configure an OIDC Client to connect a third party application with 1Kosmos. You can configure this client for Epic and use it for both the MyChart and EpicCareLink applications.

1. After reviewing all the information, click Create.

2. Log in to your tenant as a Community Administrator.

3. Navigate to Applications > Add Application (or click Add an application from the Manage Applications page).

4. Scroll down and click Add Integration under the OIDC tile.

5. In the Create new OIDC Integration page, fill in the following:

   • Application name — Descriptive name, for example: Epic Identity Verification

   • Application Type — Web

   • Grant Type — Authorization Code

   • Sign-In Redirect URI — Sign-In Redirect URI – Provide the sign-in redirect URI for Epic. If you are using this for both MyChart and EpicCare Link, provide both sign-in redirect URIs

   • Scopes — The following scopes are required:

     • profile — Required for user profile claims (enabled by default)

     • openid — Required for OIDC authentication (enabled by default)

     • identity_assurance — Required — enables the identity verification flow

     • idv_flow_{id} — Required — specifies which workflow to trigger. Replace {id} with the workflow access code.

       • Example: if access code is abc123, scope is idv_flow_abc123

       • Example: if access code is verify-user-2024, scope is idv_flow_verify-user-2024

6. Configure the Claims Transformation Script (see below).

7. Click Create. A Client ID and Client Secret are automatically assigned.

Enabling and configuring the claims transformation script

In the OIDC application configuration, navigate to Claims Transformation. This field permits custom JSON that determines what claims need to be returned back to Epic.

This section needs to return the claims you collected from the identity verification process. The JSON below will return these claims: “firstname”, “lastname”, “ssn”, & “birthdate”. These claims need to be collected in your workflow to be returned.

 
function mapClaims({ user = {}, ialData = {}, userDocuments = [], mapping = [], workflowSummary = null, errorContext = null }) {
const claims = {};  
 if (workflowSummary || errorContext) { 
const personInfo = workflowSummary?.summary?.person_info || {}; 
    claims.firstname = personInfo.firstName || null; 
    claims.lastname = personInfo.lastName || null; 
   claims.ssn= personInfo.ssn|| null; 
    claims.birthdate = personInfo.dob || null; 
  } 
  return claims; 
}  

The script editor provides a Run feature that allows you to check your script for errors before saving.