1.3 FHIR Authentication and Authorisation
- Dragos Dobre
FHIR Authentication
The objective is to manage User authentication directly from the FHIR module. The JWT authentication mechanism is used. FHIR module is using the authentication services so the token can be used in both FHIR REST API and GraphQL queries.
FHIR REST API Login endpoint
The /login endpoint has been added to the FHIR R4 module to allow the generation of the JWT token through the FHIR R4 module’s REST API.
POST /api_fhir_r4/login
Request body:
{
"username": [username],
"password": [password]
}
HTTP 200 Response body:
{
"token": [token]
"exp": [expire_date]
}
HTTP 401 Response if credentials are not valid FHIR REST API Authorization header
All other FHIR R4 requests should contain the Authorization header with the Bearer token.
Authorization: Bearer [token]
HTTP 200 Response when token validated (the actual resource payload is returned)
HTTP 401 Response when:
if Authorization header is missing
if Bearer prefix is missing
if error on decoding Authorization header
if token is expiredFHIR Authorisation
In openIMIS, authorisation is based on User’s role and location. A role is a group of authorities or permissions which are well defined and constant (see openIMIS Authorities for an up-to-date list of authorities). During the migrations, some of authorities were not added in the new created modules. Moreover, the query set used to obtain the data related to a resource was fetching all the objects from the DB.
Based on the openIMIS Authorities, used in the legacy openIMIS, we have added the missing permission to the modular openIMIS. Also, we have updated the query sets and retrieved them from the business module (e.g. Claim module) which limits the access based on the Users The following modules have been updated:
Did you encounter a problem or do you have a suggestion?
Please contact our Service Desk
This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License. https://creativecommons.org/licenses/by-sa/4.0/