Smile CDR v2023.05.PRE

On this page:

41.37 Resource Providers 41.39 Endpoint Terminology

41.38FHIR Endpoint Security

The FHIR Endpoint Security configuration category includes the following configurable options:

Allow Searches With Compartment Access
Automatically Narrow Search Scope
Reject Insufficient Permissions with HTTP 401
Watermark Responses Enabled
Scopes Supported

41.38.1Property: Allow Searches With Compartment Access

Property Name	Allow Searches With Compartment Access
Property Key
Property Type	BOOLEAN
Description	When disabled, the server will proactively reject searches on resource types, even though a resource in the compartment could possibly be in the results. When enabled, the searches will be accepted, but the server will filter the results to only include resources that are in the compartment. Enabling this flag is less secure, as the interceptor may leak the existence of resources that are not in the compartment.
Applies to Modules	FHIR Gateway REST Endpoint FHIR REST Endpoint (DSTU2) FHIR REST Endpoint (R3) FHIR REST Endpoint (R4) Hybrid Providers REST Endpoint
Default Value	`false`
Example Property	`module.[MODULE_ID].config.fhir_endpoint_security.allow_compartment_searches = false`

41.38.2Property: Automatically Narrow Search Scope

Property Name	Automatically Narrow Search Scope
Property Key
Property Type	BOOLEAN
Description	When enabled, the server will automatically try to narrow the scope of searches when the user only has permission to access specific instances or compartments. For example, when a user only has the `FHIR_READ_ALL_IN_COMPARTMENT/Patient/123` permission and tries to perform a search for `Observation?code=foo`, this search will be performed automatically as `Observation?subject=Patient/123&code=foo`. See Block Unless Code in ValueSet for more information. Note that in order to avoid accidental disclosure of non-narrowed resource counts, search total counts will be unavailable if this feature is enabled.
Applies to Modules	FHIR Gateway REST Endpoint FHIR REST Endpoint (DSTU2) FHIR REST Endpoint (R3) FHIR REST Endpoint (R4) Hybrid Providers REST Endpoint
Default Value	`false`
Example Property	`module.[MODULE_ID].config.fhir_endpoint_security.automatically_narrow_search_scope = false`

41.38.3Property: Reject Insufficient Permissions with HTTP 401

Property Name	Reject Insufficient Permissions with HTTP 401
Property Key
Property Type	BOOLEAN
Description	If enabled, an HTTP 401 will be used instead of an HTTP 403 response for unauthorized operations. See Rejecting Unauthorized FHIR Calls for more information.
Applies to Modules	FHIR Gateway REST Endpoint FHIR REST Endpoint (DSTU2) FHIR REST Endpoint (R3) FHIR REST Endpoint (R4) Hybrid Providers REST Endpoint
Default Value	`false`
Example Property	`module.[MODULE_ID].config.fhir_endpoint_security.reject_insufficient_permissions_with_401 = false`

41.38.4Property: Watermark Responses Enabled

Property Name	Watermark Responses Enabled
Property Key
Property Type	BOOLEAN
Description	This setting enables Response Watermarking, which injects an extension into returned resources containing the Transaction GUID associated with the request. Note that because Response Watermarking uses a Transaction GUID, the Transaction Log must be enabled using the Transaction Log Database Storage Enabled property. See Response Watermarking for more information.
Applies to Modules	FHIR Gateway REST Endpoint FHIR REST Endpoint (DSTU2) FHIR REST Endpoint (R3) FHIR REST Endpoint (R4) Hybrid Providers REST Endpoint
Default Value	`false`
Example Property	`module.[MODULE_ID].config.fhir_endpoint_security.watermark_responses.enabled = false`

41.38.5Property: Scopes Supported

Property Name	Scopes Supported
Property Key
Property Type	STRING
Description	A space separated list of scopes to advertise as supported in the .well-known/smart-configuration
Applies to Modules	FHIR Gateway REST Endpoint FHIR REST Endpoint (DSTU2) FHIR REST Endpoint (R3) FHIR REST Endpoint (R4) Hybrid Providers REST Endpoint SMART Inbound Security SMART Outbound Security
Default Value	`openid fhirUser`
Example Property	`module.[MODULE_ID].config.smart_configuration.scopes_supported = openid fhirUser`

41.37 Resource Providers 41.39 Endpoint Terminology