FHIR: Add support for SMART & UDAP authentication #575

fhcarter · 2025-02-28T21:02:26Z

Fixes #569
...and it's minions:
Fixes #570
Fixes #571
Fixes #572
Fixes #573
Fixes #574

Adds support, albeit indirect, for SMART & UDAP authentication. Both of these are layered atop the OAuth authorization flow grant type/flow that is intended to allow for direct user interaction to authorized the connection. As such, it is improper for the server to attempt to bypass this interaction. I looked at some sort of call back, but that was more confusing than it seemed worth.

So, what we provide is a mechanism by which our caller can tell use to user a certain access token (and, optionally, a token type). This is known as an application managed authentication mechanism. We expect this to be used for handling SMART and UDAP situations, but our callers can, indeed, use this whenever they wish.

Enhanced assembly configuration appropriately. While, fixed a couple of inadvertent omissions -- the ability to supply an access token & realm for Basic authentication.

Added documentation & tests for these changes as well.

While doing some unrelated work, found formatting bugs in the Camel Assemblies README that hid some important information. Fixed those whilst nearby.

… server

Refactor base test to enable usage of various install bits from other, non-subclassed tests,

…perties. Enhance parameter validation to take these into account. Added `ApplicationManaged` to values for authenticationMechanism. This indicates that the user expects (generally) to call the useAccessToken() entry point. It is intended to be used with SMART & UDAP-based server authorization.

This is used for various authentication settings.

…ation

Seen in passing...

fhcarter · 2025-02-28T21:12:07Z

Reopened -- was prematurely submitted...

fhcarter · 2025-02-28T21:12:47Z

camelAssemblies/README.md

@@ -233,8 +233,8 @@ However, if importing many projects, use `../gradlew importAssemblies -PcamelAss
 where `<profileName>` is the name of a Vantiq CLI profile that will connect to your publishing namespace.  Other 
 gradle properties that are used are based on that profile name, and are as follows.



Formatting typos that hid important information

fhcarter · 2025-02-28T21:13:41Z

fhirAssembly/README.md

@@ -132,16 +132,38 @@ outline those defined below. These are all found in the package `com.vantiq.fhir
      * `id` -- (String, Required) The id of the resource instance to be read
      * `versionId` -- (String) The version id to be read.  If missing, this operates the same as a `read` procedure.
      * `modifiers` -- (Modifiers) Any modifiers to the interaction


Minor reorganization to divide things into categories.

fhcarter · 2025-02-28T21:16:25Z

...tiq.fhir.fhirConnection/procedures/com/vantiq/fhir/fhirService_checkAuthenticationSetup.vail

        exception("com.vantiq.fhir.basicauth.required",
-            "A username and password are required for Basic authentication: {0}", [theConfig])


Tweak auth info validation with new items.

Added AHA for the ability to check some of these more dynamic things via rules or conditionals for configuration parameters. By the time we check here it's really too late, but it's the only chance we get.

fhcarter · 2025-02-28T21:17:45Z

...ntiq.fhir.fhirConnection/procedures/com/vantiq/fhir/fhirService_fetchSMARTConfiguration.vail

@@ -0,0 +1,17 @@
+/**


FHIR servers define some well-known places to pick up configuration information. Provide built-in means to fetch these.

fhcarter · 2025-02-28T21:18:47Z

...bly/com.vantiq.fhir.fhirConnection/procedures/com/vantiq/fhir/fhirService_performRestOp.vail

-    if (modifiers.headers) {
-        headers = modifiers.headers
-    }
+var headers


Add ability to send our application managed access token if present.

fhcarter · 2025-02-28T21:20:20Z

fhirAssembly/src/test/java/io/vantiq/extsrc/fhirAssembly/TestFhirAssembly.java

@@ -163,18 +163,36 @@ public static void performSetup(Map<String, ?> assemblyConfig) {
                                 ((JsonElement) targetAssembly.get("name")).getAsString(),
                         ((JsonElement) targetAssembly.get("name")).getAsString(),
                         FHIR_ASSY_NAME);


Refactor a bit to allow us to reuse part of the set up in another test.

fhcarter · 2025-02-28T21:22:30Z

fhirAssembly/src/test/java/io/vantiq/extsrc/fhirAssembly/TestFhirUseAccessToken.java

+import java.util.Map;
+import java.util.concurrent.TimeUnit;
+
+@Slf4j


Makes use of an apache test framework that sets up an http server for each test. Using that, we can make our calls & return the headers supplied, which we can then validate.

fhcarter · 2025-02-28T21:24:15Z

fhirAssembly/src/test/java/io/vantiq/extsrc/fhirAssembly/TestFhirUseAccessToken.java

+    void doOperations(String tType, String tValue, Map<String, ?> assyConfig) {
+        doOperations(tType, tValue, assyConfig, false);
+    }
+


Make a series of so-called FHIR calls that span the different underlying call mechanisms we use. Our code doesn't interpret the FHIR Json coming back, so just passing back the map of the headers is fine here. And we use those to check that we send what was expected.

fhcarter · 2025-02-28T21:26:18Z

fhirAssembly/src/test/java/io/vantiq/extsrc/fhirAssembly/TestFhirUseAccessToken.java

+            params.put("type", "Patient");
+            resp = v.execute("com.vantiq.fhir.fhirService.read", params);
+            assertTrue("Could not read resource: " + resp.getErrors(), resp.isSuccess());
+            //noinspection unchecked


The call above just returns whatever object is at that address. the other calls are a bit different.

fhcarter · 2025-02-28T21:27:50Z

fhirAssembly/src/test/java/io/vantiq/extsrc/fhirAssembly/TestFhirUseAccessToken.java

+                                    "resource", ourHeroMap,
+                                    "modifiers", modifiers));
+            assertTrue("Could not create our hero: " + resp.getErrors(), resp.isSuccess());
+            //noinspection unchecked


The call above returns an Object that contains the status code, body, and any response headers. So we need to get the body part of that.

The remaining FHIR calls in this method operate the same way.

fhcarter · 2025-02-28T21:31:04Z

Jenkins run

fhcarter · 2025-02-28T21:35:26Z

No rush no this -- I can merge it next week some time.

AlexBlumer

LGTM

rblumer4

saw a couple typos

rblumer4 · 2025-03-03T05:19:10Z

fhirAssembly/README.md

    or `previous` links), but this procedure is agnostic with respect to the purpose of the _link_.
    * `link` -- (String, Required) The link to be returned

+In addition to the _interaction_-related procedures above, there are a number of procedures that can be used to 
+fetch about the FHIR server.


something missing?
"used to fetch WHAT about the FHIR server"

rblumer4 · 2025-03-03T05:30:36Z

fhirAssembly/src/test/java/io/vantiq/extsrc/fhirAssembly/TestFhirUseAccessToken.java

+            Map<String, ?> modifiers = Map.of("headers",
+                                              Map.of("If-None-Exist", "name=" + "Man"));
+
+            // Now, create our here again, but conditional on it's not being already there.


typo: here -> hero

fhcarter added 12 commits February 25, 2025 13:50

Add support & basic tests for fetching UDAP & SMART configurations

cb894e2

Add (inadvertently omitted) support for accessToken for Basic auth.

be1038c

Add documentation for fetching SMART & UDAP configurations

3366305

Encourage @Secrets() for basicAccessToken in prompt

416f7f3

Add apache http client & server test framework to hokey up a fauxFhir…

79f4f4a

… server

Add support for setting access token for use dynamically.

04072d2

Refactor base test to enable usage of various install bits from other, non-subclassed tests,

Add a suite of tests to validate the Authorization header.

de536ad

This is used for various authentication settings.

Add tests to validate use of realm & access token for basic Authentic…

840c123

…ation

Convert test to return headers rather than hiding them under a rock.

7e988ea

Add documentation & updated images based on changes

542367c

Fix some formatting issues that hid interesting bits.

3fa3288

Seen in passing...

fhcarter requested a review from a team as a code owner February 28, 2025 21:02

fhcarter closed this Feb 28, 2025

fhcarter changed the title ~~Fhc fhir auth #569~~ FHIR: Add support for SMART & UDAP authentication Feb 28, 2025

fhcarter self-assigned this Feb 28, 2025

fhcarter reopened this Feb 28, 2025

fhcarter commented Feb 28, 2025

View reviewed changes

AlexBlumer approved these changes Mar 1, 2025

View reviewed changes

rblumer4 reviewed Mar 3, 2025

View reviewed changes

Review comments

ba6ff68

fhcarter merged commit d00e77b into master Mar 4, 2025

fhcarter deleted the fhc-fhir-auth-#569 branch March 4, 2025 20:53

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

FHIR: Add support for SMART & UDAP authentication #575

FHIR: Add support for SMART & UDAP authentication #575

fhcarter commented Feb 28, 2025 •

edited

Loading

fhcarter commented Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter Feb 28, 2025

fhcarter commented Feb 28, 2025

fhcarter commented Feb 28, 2025

AlexBlumer left a comment

rblumer4 left a comment

rblumer4 Mar 3, 2025

rblumer4 Mar 3, 2025

		@@ -233,8 +233,8 @@ However, if importing many projects, use `../gradlew importAssemblies -PcamelAss
		where `<profileName>` is the name of a Vantiq CLI profile that will connect to your publishing namespace. Other
		gradle properties that are used are based on that profile name, and are as follows.

		exception("com.vantiq.fhir.basicauth.required",
		"A username and password are required for Basic authentication: {0}", [theConfig])

FHIR: Add support for SMART & UDAP authentication #575

FHIR: Add support for SMART & UDAP authentication #575

Conversation

fhcarter commented Feb 28, 2025 • edited Loading

fhcarter commented Feb 28, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fhcarter commented Feb 28, 2025

fhcarter commented Feb 28, 2025

AlexBlumer left a comment

Choose a reason for hiding this comment

rblumer4 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

fhcarter commented Feb 28, 2025 •

edited

Loading