Basic AuditEvent pattern for when an activity was authorized by an SAML access token Minimal

A basic AuditEvent profile for when an activity was authorized by an SAML access token. This profile is expected to be used with some other detail that explains the activity. This profile only covers the SAML access token.

• Given an activity has occurred
• And SAML is used to authorize a transaction
• And the given activity is using the SAML

- XUA - SAML requires ID and Issuer, so this profile of AuditEvent will work with any SAML token. - usually SOAP, but not limited to SOAP

• When an AuditEvent is recorded for the activity
• Presumes that the consent and server have been identified in agent elements, best case with certificate identities
• Then that AuditEvent would follow this profile regarding recording the SAML access token details

The following table uses a short-hand for the SAML fields and FHIR AuditEvent elements to keep the table compact. It is presumed the reader can understand the SAML field and the FHIR AuditEvent element given. Note the `~` character represents attributes under the SAML `AttributeStatement`.

| SAML field | Minimal AuditEvent |-----------------------|----------------------| | ID | agent[user].policy | Issuer | agent[user].who.identifier.system | Subject.NameID | agent[user].who.identifier.value | ~subject:purposeofuse | agent[user].purposeOfUse

note: this profile records minimal information from the SAML access token, which presumes that use of the AuditEvent at a later time will be able to resolve the given information.