Have you implemented OpenMRS? Please participate in the Implementation Site Survey. If you already have, thank you!
Page tree
Skip to end of metadata
Go to start of metadata

OpenMRS has the privilege based access control implementations. Like that one, we implemented a Location based Access control system. It will manage the access to the services based on the locations. Some implementations want to register the users and patients (the persons also) in certain selected locations. Then access them based on the location that someone has logged in. That way, if someone is logged in a certain location, they should see only those encounters, observations, and patients registered in that location. This project was initiated into the Google Summer of Code 2018.

Module Code Repository : https://github.com/openmrs/openmrs-module-locationbasedaccess

Initially, the Location Based Access Control module provides feature to track the patients based on the given locations. Other features will be extended and will be added into this module soon. Read the following Deployment Steps to install and run the location based access control module in your OpenMRS distribution.

Required Modules

  1. OpenMRS Core - v2.0.5 or later 

    The minimum required version of the OpenMRS Core is version 1.9. If you haven't updated version of OpenMRS Core, you should update the OpenMRS Core before using Location based access control module.

  2. App UI Module - v1.9 or later (Required)

    The minimum required version of the App UI module is version 1.9. If you haven't updated version of App UI module, you should update the App UI module before using Location based access control module.

  3. UI Framework Module - v3.9 or later (Required)

    The minimum required version of the UI Framework module is version 3.9. If you haven't updated version of UI Framework module, you should update the UI Framework module before using Location based access control module.

  4. Admin UI Module - v1.2.4 or later (Optional)

    The minimum required version of the Admin UI module is version 1.2.4. If you haven't updated version of Admin UI module, you should update the Admin UI module before using Location based access control module.

  5. Reference Application Module - v2.9.0 or later (Optional)

    The minimum required version of the Reference Application module is version 2.9.0. If you haven't updated version of Reference Application module, you should update the Reference Application module before using Location based access control module.

Deployment Steps


1. Person Attribute to store the location information

Location based access control module uses person attribute to store the location information of the patients. So you should configure a person attribute type to create person attributes before starting this module. Please follow these steps to create a person attribute type if not you created before for this module.

  1. Go to System Administration → Advanced Administration → Persons → Manage Person Attribute Types
  2. You can see some other person attribute types in that list. Just click the "Add New Person Attribute Type". 
  3. Give a name to the person attribute type (like "LocationAttribute")
  4. Select format as "java.lang.String" 
  5. Finally click "Save Person Attribute Type" to save the person attribute
  6. Once you saved a new person Attribute Type, it will be added to the "Person Attribute Management → Person Attribute Type" List. 
  7. Just click on the person attribute type which was created by you just before.
  8. You can find the UUID of this person attribute type. Just copy that UUID to use in the following steps

If you have any issues on creating person attribute type, please read this detailed documentation about Managing Person Attribute Types.

2. Create Global Property with Person Attribute Type information

Location based Access control module designed to get the person attribute type to store the location information from global property. Please follow these steps to create the global property,

  1. Go to System Administration → Advanced Administration → Manage Global Properties
  2. Click "Add New Global Property"
  3. Add global property name as "locationbasedaccess.locationAttributeUuid" (Don't change this name, the name must be like that)
  4. Add the created person attribute type UUID to the global property value.
  5. Save the global property.

3. Configure Patient Registration App with Location Fragment

Patients should be allocated with the locations when they are registering in to the OpenMRS to track them by Location Based Access Control module. OpenMRS Administrator or privileged user should do some changes in the Patient Registration Dashboard to allow the locations allocations for the patient registrations. Location Based Access control module provides a fragment for this requirement, and It should be added through the App definition for the Patient Registration Dashboard. 

Please follow these steps to change the App definition of the Patient Registration Dashboard, 

  1. Navigate to System Administration-->Manage Apps
  2. Click the square disable button beside "referenceapplication.registrationapp.registerPatient" to disable the integrated Registration App configuration.
  3. Add a new App Definition by clicking "Add App Definition".
  4. Give App ID(required) as "referenceapplication.registrationapp.myRegWithLoc"
  5. Then copy the following custom definition for Location Selection, and paste it to the Definition (required) fieldThis will be used for adding location selection fragment into the registration dashboard with some other required fragments.
  6. Find your person Attribute Type UUID for location (Go to System Administration → Advanced Administration → Persons → Manage Person Attribute Types)  and replace that UUID into 
    "uuid": "8b5c95ef-103c-41bc-9f24-368b8f77e070" section.
  7. Save the new App configuration.

If you have any issues on Registration App Configuration, please read this detail documentation.

Custom Registration App Configuration with Location Selection App Definition

You can use this following custom fragment section to add the Location Selection Fragment for the Location Based Access Control Module

App Definition
          {
        "id": "referenceapplication.registrationapp.myRegWithLoc",
        "instanceOf": "registrationapp.registerPatient",
        "label": "Register Patient",
        "description": "Create a new Patient Record",
        "extensions": [
            {
                "id": "referenceapplication.registrationapp.registerPatient.homepageLink",
                "extensionPointId": "org.openmrs.referenceapplication.homepageLink",
                "type": "link",
                "label": "referenceapplication.app.registerPatient.label",
                "url": "registrationapp/registerPatient.page?appId=referenceapplication.registrationapp.myRegWithLoc",
                "icon": "icon-user",
                "order": 1,
                "requiredPrivilege": "App: registrationapp.registerPatient"
            }
        ],
        "config": {
            "afterCreatedUrl": "/coreapps/clinicianfacing/patient.page?patientId={{patientId}}",
            "sections": [
                {
                    "id": "contactInfo",
                    "label": "registrationapp.patient.contactInfo.label",
                    "questions": [
                        {
                            "legend": "Person.address",
                            "fields": [
                                {
                                    "type": "personAddress",
                                    "label": "registrationapp.patient.address.question",
                                    "widget": {
                                        "providerName": "uicommons",
                                        "fragmentId": "field/personAddress"
                                    }
                                }
                            ]
                        },
                        {
                            "legend": "registrationapp.patient.phone.label",
                            "id": "phoneNumberLabel",
                            "fields": [
                                {
                                    "type": "personAttribute",
                                    "label": "registrationapp.patient.phone.question",
                                    "formFieldName": "phoneNumber",
                                    "uuid": "14d4f066-15f5-102d-96e4-000c29c2a5d7",
                                    "widget": {
                                        "providerName": "uicommons",
                                        "fragmentId": "field/text"
                                    },
                                    "cssClasses": ["phone"]
                                }
                            ]
                        }
                    ]
                },
                {
                    "id": "relationships-info",
                    "label": "registrationapp.person.relationship",
                    "questions": [
                        {
                            "legend": "registrationapp.person.relationship.label",
                            "header": "registrationapp.person.relationship.question",
                            "fields": [
                                {
                                    "type": "personRelationships",
                                    "widget": {
                                        "providerName": "registrationapp",
                                        "fragmentId": "field/personRelationship"
                                    }
                                }
                            ]
                        }
                    ]
                },
                {
                    "id": "accesslocation-info",
                    "label": "Access Location",
                    "questions": [
                                  {
                                      "legend": "Patient Location ",
                                      "id": "patientLocationLabel",
                                      "fields": [
                                        {
                                         "type": "personAttribute",
                                         "label": "Select Location",
                                         "formFieldName": "locationId",
                                         "uuid": "8b5c95ef-103c-41bc-9f24-368b8f77e070",
                                         "widget": {
                                                    "providerName": "locationbasedaccess",
                                                    "fragmentId": "field/locations"
                                                   }
                                         }
                                        ]
                                  }
                    ]
                }
            ]
        }
    }


Assign the locations to the Users

Requirments

If you want to get this feature, then you need to update your Admin UI Module to v1.2.4 or later, You can get Admin UI Module from this link to get the OMOD of the v1.2.4-SNAPSHOT for your testing purposes (clone this repository and type mvn clean install to get the OMOD of v1.2.4-SNAPSHOT from the project).

You can assign the accessible locations to the users through the Manage Account dashboard.

  1. Goto the System Administration → Manage Accounts
  2. Edit the existing users or Add new users with the accessible locations (Make sure about the assigned privileges for that user while editing)

Login Screen Management

Requirments

If you want to get this feature, then you need to update your Reference Application Module to v2.9.0 or later, You can get Reference Application Module from this link to get the OMOD of the v2.9.0-SNAPSHOT for your testing purposes (clone this repository and type mvn clean install to get the OMOD of v2.9.0-SNAPSHOT from the project).


Location selection in the user login screen will be disabled through the Location based access control module since it can be fetched automatically through the location user property. The location based access control module will create a global property with name as "referenceapplication.locationUserPropertyName" and value as "locationUuid" while module starts (if a global property not exists in this name).

It will follow these steps while a user tries to login,

  1. It will check for the Global property called "referenceapplication.locationUserPropertyName".
  2. If the Global property has the value(shouldn't contains false as the value), then it will hide the location selector from the login screen
  3. When users try to log in, it will fetch the location from the user property
  4. If the respected user doesn't have the required user property, then it will redirect to the usual login screen(with login selector) to select the location

  • How to disable the 'Login without Location' feature to rollback the location selector?

    If you want to disable this feature to get the login screen with location selector, Go to System Administration → Global Properties, and then delete the global property named as "referenceapplication.locationUserPropertyName" or set the value as "false" to that global property.

How to use Location Based Access Control module

Major features from this module are,

  • All Patient, Person, and User objects are restricted by the locations. A user from a location can't get the patient/person/user information from another location.
  • Able to assign/edit the locations to the patient during the registration through the patient dashboard.
    1. Go to Patient Registration Dashboard. You can see a new section as "Patient Location", and there will be a selection box with all active locations in your distribution. 
    2. Select a location for the patient and complete the patient registration.
    3. Go to Find Patient Dashboard, and search for the patient. You can see that person only when you logged in with the same location of that patient location which was assigned during the registration.

  • Able to assign/edit the accessible location to the users through the Manage Account Page (In User section).
    • Go to Manage Account Dashboard. You can see a new field as "Location" in user section, and there will be a selection box with all active locations in your distribution. 
    • Select a location for the user and save it (Make sure about the user privileges).

  • Users can login with only their credentials (username and password). There will be no need to select the locations from the login.
  • Encounters and Observations are restricted by the locations to see only the information which are belongs to the user logged in location.

Notice

Location Based Access control module will not restrict the ADMIN user to access the data from different locations. It will only add the restrictions to the users who have the less privileges from the Admin (Eg : Doctors, Nurses, Data Entry Operators).

How to safety remove the Location based access control module

Please follow these steps to remove the Location based access control module from your system ,

  1. Go to  System Administration-->Manage Apps, and Click the Edit button of the app definition(named as "referenceapplication.registrationapp.myRegWithLoc"). Then remove the "accesslocation-info" section from the app definition. Or you can just delete this App Definition, and then press the start button of the app definition which is named as "referenceapplication.registrationapp.registerPatient"
  2. Uninstall the module from the system.
  • No labels