Uploaded image for project: 'FHIR Specification Feedback'
  1. FHIR Specification Feedback
  2. FHIR-28788

Clarify ambiguity in token creation

    XMLWordPrintableJSON

Details

    • Icon: Change Request Change Request
    • Resolution: Persuasive with Modification
    • Icon: Highest Highest
    • CDS Hooks (FHIR)
    • 1.0
    • Clinical Decision Support
    • (NA)
    • Hide

      Proposed wording to denote that the CDS Client may not do the "creating" of a token when there is a separate authorization server.  Updated the first instance from "the CDS Client creates" to "the CDS Client creates or obtains".  Updated the second instance from "remains in control of creating an access token" to "remains in control of providing an access token".

      Over all, update wording from:

      With CDS Hooks, if the CDS Client wants to provide the CDS Service direct access to FHIR resources, the CDS Client creates an access token prior to invoking the CDS Service, passing this token to the CDS Service as part of the service call. This approach remains compatible with OAuth 2.0's bearer token protocol while minimizing the number of HTTPS round-trips and the service invocation latency. The CDS Client remains in control of creating an access token that is associated with the specific CDS Service, user, and context of the invocation.

      to:

      With CDS Hooks, if the CDS Client wants to provide the CDS Service direct access to FHIR resources, the CDS Client creates or obtains an access token prior to invoking the CDS Service, passing this token to the CDS Service as part of the service call. This approach remains compatible with OAuth 2.0's bearer token protocol while minimizing the number of HTTPS round-trips and the service invocation latency. The CDS Client remains in control of providing an access token that is associated with the specific CDS Service, user, and context of the invocation.

      Show
      Proposed wording to denote that the CDS Client may not do the "creating" of a token when there is a separate authorization server.  Updated the first instance from "the CDS Client creates " to "the CDS Client creates or obtains ".  Updated the second instance from "remains in control of creating an access token" to "remains in control of providing an access token". Over all, update wording from: With CDS Hooks, if the CDS Client wants to provide the CDS Service direct access to FHIR resources, the CDS Client creates an access token prior to invoking the CDS Service, passing this token to the CDS Service as part of the service call. This approach remains compatible with  OAuth 2.0's  bearer token protocol while minimizing the number of HTTPS round-trips and the service invocation latency. The CDS Client remains in control of creating an access token that is associated with the specific CDS Service, user, and context of the invocation. to: With CDS Hooks, if the CDS Client wants to provide the CDS Service direct access to FHIR resources, the CDS Client creates or obtains an access token prior to invoking the CDS Service, passing this token to the CDS Service as part of the service call. This approach remains compatible with  OAuth 2.0's  bearer token protocol while minimizing the number of HTTPS round-trips and the service invocation latency. The CDS Client remains in control of providing an access token that is associated with the specific CDS Service, user, and context of the invocation.
    • Dennis Patterson/Peter Muir: 23-0-0
    • Clarification
    • Non-substantive

    Description

      again there seems to be ambiguity here between the CDS Service client and the Oauth server. Creating a token is exclusively done by the Oauth server which is a separate entity from the CDS client --and if there is an assumption that the client and the OAuth server are the same entity it should be explicily clarified earlier on.

      Existing Wording:

      The CDS Client remains in control of creating an access token that is associated with the specific CDS Service, user, and context of the invocation.

      Proposed Wording:

      The CDS Client remains in control of obtaining an access token that is associated with the specific CDS Service, user, and context of the invocation\.

      Attachments

        Activity

          People

            Isaac.Vetter Isaac Vetter
            jafarim Mohammad Jafari
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: