Place2Book Developers
api@place2book.com

Fælleskommunal Adgangsstyring

Danish municipalities can give employees access to Place2Book through Fælleskommunal Adgangsstyring. Employees sign in with their municipal login through KOMBIT’s Context Handler. Their access is managed centrally (rollestyring): the municipality maps its job function roles or AD groups to Place2Book’s user system roles, and Place2Book updates each employee’s roles every time they sign in.

Requirements

  • An agreement with Place2Book on an SSO integration or a complete package.
  • A service agreement on the Serviceplatformen for Organisation (SF1500), approved by the municipality. See Onboarding.
  • A SAML::Provider account at Place2Book. Contact support@place2book.com to get one.

Onboarding

  1. Agree on a new connection. Place2Book and a municipal unit (library, cultural centre, citizen service or similar) sign an agreement for an SSO integration or a complete package.

    The customer then tells their IT department and opens an internal case, so the team responsible for the support systems / Serviceplatformen can set aside time to configure their side.

  2. Create the service agreement. Place2Book requests a service agreement for Organisation 5 and Organisation 6, without the Se-CPR role, and refers to the case number or contact person.

    The IT department, or whoever approves service agreements, must approve it. A case number makes it much easier for the approver to find the case.

    The service agreement is only used to retrieve the employee’s name and email address, so a Place2Book user can be created for them.

  3. Map roles. The IT department maps job function roles or AD groups to the Place2Book user system roles and adds the data constraints that decide which organisers each role applies to.

  4. Sign in. Employees sign in on place2book.com with their work email and are sent to the Context Handler. On the Context Handler, they must choose the municipality’s regular login (for example “Kommune IDP”), not an NSIS login.

User system roles

Place2Book has five user system roles (brugersystemroller):

Role Entity ID API action
Manage …/usersystemrole/manage/:v manage
Manage (without bank account) …/usersystemrole/manage_without_bank/:v manage_restricted
Ticket Agent …/usersystemrole/ticket_agent/:v sell_tickets
Ticket Scanner …/usersystemrole/ticket_scan/:v scan_tickets
SAML Administrator …/usersystemrole/saml_admin/:v manage_saml_provider

Entity IDs start with http://place2book.com/roles/usersystemrole/. Versions 1, 2 and 3 (:v) of each role are accepted and give the same access.

Manage and Manage (without bank account) are the same base role and should not be given to the same person. Ticket Agent and Ticket Scanner are separate roles that only give access to cash sales and ticket scanning.

Manage

The standard administrator role for users who need full access. Users with this role can create events, find sales links, change prices, create gift card types, set up bank accounts and much more.

Manage (without bank account)

A reduced administrator role for users who need almost full access. Users can create events, find sales links, change prices and create gift card types, but cannot manage bank accounts for payouts from Place2Book. Use it for employees who need broad access but shouldn’t be able to change payout details.

Ticket Agent

Lets users sell tickets as cash sales. Place2Book registers the ticket, generates a PDF ticket and emails it to the buyer. Place2Book does not handle the payment.

Ticket Scanner

Lets users scan tickets with the Place2Book app, for example at the entrance, and see statistics for scanned tickets.

SAML Administrator

A meta-administrative role for the IT department. It gives:

  • An overview of the municipality’s (or cross-municipal) organiser accounts and the employees who have access to them
  • The organiser UUIDs to use in data constraints
  • The ability to create new municipal organiser accounts

Create organiser accounts as SAML Administrator New municipal organiser accounts must be created with the SAML Administrator role. Otherwise employees lose their roles on the new organiser at their next Context Handler login, because their job function role doesn’t recognise it.

Data constraints

Every role applies to specific organisers or to the municipality. This is set with data constraints (databegrænsninger).

Organiser UUID

Entity ID: http://place2book.com/constraints/event_maker/2 (versions /1 and /3 are also accepted)

Used with Manage, Manage (without bank account), Ticket Agent and Ticket Scanner.

  • Place2Book issues the UUIDs. You can also find them on the SAML Administrator page.
  • You can give a role one or more UUIDs, separated by commas in the same constraint.

This lets you cover several organisers with one role mapping instead of many.

Example. Korsbæk Municipality has two libraries in different towns:

Unit Job function role / AD group Place2Book role Data constraint
Library A Shared group for Library A Manage uuid_a
Library B Shared group for Library B Manage uuid_b
Library administration Administration group Manage uuid_a,uuid_b

Organisation

Entity ID: http://sts.kombit.dk/constraints/orgenhed/1

Used with SAML Administrator. The value is the UUID of the organisational unit that Organisation v6 returns for the municipality’s CVR number. Place2Book links this UUID to the municipality and can change it once a SAML agreement is in place.

How roles are synced

Every time an employee signs in, Place2Book reads the roles and constraints from the login and updates the employee’s access:

  • New roles are added.
  • Roles that were removed in the municipality’s role administration are deactivated, if they came from the Context Handler.
  • Roles granted manually in Place2Book are kept, unless the organiser enforces Context Handler roles. Place2Book can enable this per organiser, so access is controlled only by the municipality.
  • Unknown roles and constraints with UUIDs that don’t match an organiser are ignored.

Changes take effect at the employee’s next login.

Recommendation

Give the SAML Administrator role, with the Organisation constraint, to the IT department, central IT or another unit responsible for:

  • Serviceplatformen
  • SAML / AD
  • User and access management

That way future employees can handle IT support cases for libraries and other municipal units that use, or plan to use, Place2Book.

Technical details

   
Protocol OIOSAML 3 (OIOSAML 2 privileges are also accepted) with HTTP-POST binding
Service provider metadata https://www.place2book.com/saml/:provider/metadata. Place2Book gives you the exact URL.
Signing and encryption OCES3 certificate. Assertions can be encrypted with AES-256-GCM.
Roles https://data.gov.dk/model/core/eid/privilegesIntermediate (Base64-encoded privilege XML)
Email https://data.gov.dk/model/core/eid/email. If missing, the name and email are looked up in Organisation (SF1500).
Technical contact development@place2book.com

Troubleshooting

“Noget gik galt. Prøv igen.” after login usually means the employee chose the wrong login on the Context Handler, for example “Kommune NSIS” instead of “Kommune IDP”. Ask them to try again and pick the municipality’s regular login.

The employee can sign in but sees no organisers. Check that their job function role is mapped to a Place2Book role, and that the constraint contains the right organiser UUIDs.