The component should be added to both the Web backend, and the to any APIs of your own that the backend uses,a dn which you want to protect with an access token.

The user authenticates using one of the HelseId providers, it can be Bank-Id, BankAccess or any of the providers they have made available. See here for more details.

The component also can access the HPR register, using the Hpr number for a user, and then check if the person is within any given HPR category. The component can be configured to allow for a set of HPR categories.

The component is set up with comprehensive logging, based on the Microsoft logging abstractions. We recommend using Serilog as the application logging framework, which can be set up to retreive the Microsoft logging.

The verbosity of the logging can be adjusted in the configuration.

The component is fully configurable, and uses a set of feature flags to turn things on and off. This is useful for both different environments, test, qa and prod, but also for different usages of the component. E.g. if you don't need the HPR check, then just turn it off.

For details, see here

There are three build-in policies:

1. You must be authenticated
2. You must have a HPR number
3. You must be in a HPR approved category

Policy 2) and 3) can be turned off. You can also turn off 1) but that means your application will run with no authentication at all. That can come in handy for development, but in production you would always run with this on.

You can also add your own extra policies if you like.

The component have an allowed-list, called Whitelist, where you can add people who do not fulfill policy 2 and 3, but should still be allowed in. This list uses the pid_pseudonyms from HelseId. It is meant for maintanance people to get access to the solution.

When using the NHN Test environment, you can find your PID-pseudonyms by logging in here. For production in NHN you can log in here. In both cases you get a list of all your properties, and one of them is the pid-pseudonym.

The system has default protection for endpoints and files on the webserver. There is some filenames that are default excluded, and you can of course change these if you like. The names are: Forbidden, Error, LoggedOut and StatusCode.