Introduction
This page is intended for institution IT Administrators to understand how to set up federation with the Medtronic Customer Identity and Access Management (CIAM) broker. It outlines the high-level steps for establishing a direct link between the institution’s identity provider (IdP) and the Medtronic CIAM broker, enabling single sign-on (SSO) to other services.
Prerequisites
You are a registered Touch Surgery™ user.
You are an Administrator of your institution account.
You have confirmed with your Customer Success representative that you would like to enable SSO.
You have a Medtronic account with login credentials that are not part of your intended federation domains, such as one ending @gmail.com or @outlook.com. A non-domain account is recommended to manage and troubleshoot the federation.
Getting started
To get started federating your IdP with Medtronic, you need prepare the following:
1. Federation protocol
Decide on the federation protocol your institution wishes to use. Medtronic supports OIDC core 1.0 (recommended) or SAML 2.0.
If you wish to use another protocol, please contact your Customer Support representative.
2. Required assertions/claims
The following assertions/claims from your IdP are required.
firstName
lastName
email
3. Optional assertions/claims
These assertions/claims are optional.
countryCode
PersonID (If not provided, email is used.)
4. Domain verification
Verify that you own the domains to be associated with the federation by updating the DNS records. Domain locking is established for your requested domains when the federation is complete.
5. Non-production testing
You must first set up the federation in a non-production environment to test the following:
Service provider-initiated user flows, the only flows supported by Medtronic CIAM IdP brokering service.
User-specific flows, such as logout, password reset, account lockout, and support triages.
Impact on domain lock.
If you do not have a non-production environment, please contact your Customer Support representative for help.
Capabilities
Federation allows you to set up a direct link from your IdP to Medtronic CIAM to enable SSO. Once established, your users can:
Login from the IdP dashboard to Medtronic.
Login to Medtronic applications using the same credentials as for the IdP.
Additionally, you have the option to automatically create new accounts for users on their first login, if they have never logged into Medtronic before. This is also called “just in time” provisioning. To enable this option, please contact your Customer Support representative.
Cautions and notices
Some Medtronic applications may need additional setup to access.
For the Touch Surgery™ app, user access and authorizations are handled within the app itself, not your IdP access groups.
The federation uses a "shared responsibility model" for security. You are responsible for managing your account and authentication lifecycles, as well as general IdP security.