Uploaded image for project: 'FHIR Specification Feedback'
  1. FHIR Specification Feedback
  2. FHIR-32257

Allow logical references in fhirUser

    XMLWordPrintableJSON

Details

    • Icon: Change Request Change Request
    • Resolution: Persuasive with Modification
    • Icon: Highest Highest
    • SMART on FHIR (FHIR)
    • 2.0.0
    • FHIR Infrastructure
    • App Launch: Scopes and Launch Context
    • 2.4
    • Hide

      We can clarify that the fhirUser value inside an id_token may be an absolute URL or a relative URL (relative to the FHIR Server base – note that the FHIR Server base is not necessarily the same as the "iss" of the id_token, and note that use of relative URLs requires the authorization server to know/remember the FHIR server that this app launch is using).

      —

      Update: "the app should treat the fhirUser claim as the URL of a FHIR resource representing the current user."

       

      To say: "the app should treat the fhirUser claim as the URL of a FHIR resource representing the current user. This URL MAY be absolute (e.g., `https://ehr.example.org/Practitioner/123`, or MAY be relative to the FHIR server base URL associated with the current authorization request (e.g., `Practitioner/123`). Note that this FHIR server base URL is the same as the URL represented in the 'aud' parameter passed in to the authorization request)."

      Show
      We can clarify that the fhirUser value inside an id_token may be an absolute URL or a relative URL (relative to the FHIR Server base – note that the FHIR Server base is not necessarily the same as the "iss" of the id_token, and note that use of relative URLs requires the authorization server to know/remember the FHIR server that this app launch is using). — Update : "the app should treat the  fhirUser  claim as the URL of a FHIR resource representing the current user."   To say : "the app should treat the  fhirUser  claim as the URL of a FHIR resource representing the current user. This URL MAY be absolute (e.g., ` https://ehr.example.org/Practitioner/123 `, or MAY be relative to the FHIR server base URL associated with the current authorization request (e.g., `Practitioner/123`). Note that this FHIR server base URL is the same as the URL represented in the 'aud' parameter passed in to the authorization request)."
    • Bas van den Heuvel / Alexander Zautke: 11-0-0
    • Clarification
    • Non-substantive

    Description

      This token must be validated according to the OIDC specification. To learn more about the user, the app should treat the fhirUser claim as the URL of a FHIR resource representing the current user. This will be a resource of type Patient, Practitioner, RelatedPerson, or Person. Note that Person is only used if the other resource type do not apply to the current user, for example, the "authorized representative" for >1 patients.

      Why only a URL and disallow logical references?

      Attachments

        Activity

          People

            carl-anderson-msft Carl Anderson (Inactive)
            bvdh Bas van den Heuvel
            Bas van den Heuvel
            Watchers:
            3 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: