Uploaded image for project: 'FHIR Specification Feedback'
  1. FHIR Specification Feedback
  2. FHIR-40021

Clarify if backend services must use system scopes

    XMLWordPrintableJSON

Details

    • Icon: Change Request Change Request
    • Resolution: Persuasive with Modification
    • Icon: Highest Highest
    • SMART on FHIR (FHIR)
    • 2.0.0
    • FHIR Infrastructure
    • (NA)
    • Hide

      After "For Backend Services, requested scopes will be system/ scopes (for example system/Observation.rs, which requests an access token capable of reading all Observations that the client has been pre-authorized to access).", add a sentence that says:

      The use of Backend Services with "user/" and "patient/" scopes is not prohibited, but would required out-of-band coordination to establish context (e.g., to establish which user, patient applies).

      Show
      After "For Backend Services, requested scopes will be system/ scopes (for example system/Observation.rs, which requests an access token capable of reading all Observations that the client has been pre-authorized to access).", add a sentence that says: The use of Backend Services with "user/" and "patient/" scopes is not prohibited, but would required out-of-band coordination to establish context (e.g., to establish which user, patient applies).
    • Bas van den Heuvel / Yunwei Wang: 13-0-0
    • Clarification
    • Non-substantive

    Description

      Clarify if it is possible for a back-end service to request user or patient-level scopes. It seems reasonable to me that an app may request authorization for certain activities performed on behalf of a particular user. It may at another time request authorization for activities performed on behalf of another user. When performing those activities, a security conscious app would prefer user scopes rather than system scopes.

      Existing Wording:

      For Backend Services, requested scopes will be system/ scopes (for example system/Observation.rs, which requests an access token capable of reading all Observations that the client has been pre-authorized to access).

      (Comment 37 - imported by: Ron G. Parker)

      Attachments

        Activity

          People

            Unassigned Unassigned
            Rongparker Ron G. Parker
            Watchers:
            2 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: