Powered by Smile CDR v2025.02.PRE-05 (build 65540092cb)

On this page:

49.109 OpenID Connect Token Validation 49.111 Payer to Payer

49.110.1OpenID Connect (OIDC)

The OpenID Connect (OIDC) configuration category includes the following configurable options:

Cache Authorizations (millis)
Client Secret Encoding
Smile CDR generated Client Secret expiry duration in days
Issuer URL
New Session for Each Flow
PKCE Plain Challenge Supported
PKCE Required
Rotate Refresh Token After Use
Smart Capabilities List

49.110.2Property: Cache Authorizations (millis)

Property Name	Cache Authorizations (millis)
Property Key
Property Type	NON_NEGATIVE_INTEGER
Description	If a non-zero value is supplied, the authorization server will cache successful authorizations for up to this amount of time. This means that if an Access Token is received as authentication with a request (e.g. in an Authorization header during a FHIR call) multiple times within the cache timespan, only one attempt to validate the token will be made. Using the cache can greatly improve performance on heavily loaded systems. However, manually invalidated tokens may be accepted as still being valid during the cache period so it is important to not use a value that is unnecessarily long.
Applies to Modules	SMART Outbound Security
Default Value	`3000`
Example Property	`module.[MODULE_ID].config.cache.authorized_tokens.millis = 3000`

49.110.3Property: Client Secret Encoding

Property Name	Client Secret Encoding
Property Key
Property Type	ENUM
Values	`SHA256_1000_ROUND` `SHA256_10000_ROUND` `SHA256_100000_ROUND` `PBKDF2_256_1000_RND` `PBKDF2_256_10000_RND` `PBKDF2_256_100000_RND` `BCRYPT_10_ROUND` `BCRYPT_12_ROUND` `BCRYPT_14_ROUND` `BCRYPT_16_ROUND`
Description	Select the hashing algorithm to use when storing client secrets. Note that the value selected here will apply only to newly created secrets, and this may be changed at any time without affecting existing secrets. See Password Hashing Algorithms for more information.
Applies to Modules	SMART Outbound Security
Default Value	`BCRYPT_12_ROUND`
Example Property	`module.[MODULE_ID].config.client_secret.encoding = BCRYPT_12_ROUND`

49.110.4Property: Smile CDR generated Client Secret expiry duration in days

Property Name	Smile CDR generated Client Secret expiry duration in days
Property Key
Property Type	NON_NEGATIVE_INTEGER
Description	Select the expiry duration in days for Smile CDR generated client secrets. Note this value will be added to the activation date of the secret to calculate the expiration date for the secret during the client creation process via the REST path register-client-and-generate-secret.
Applies to Modules	SMART Outbound Security
Default Value	`365`
Example Property	`module.[MODULE_ID].config.client_secret.expiry_duration_days = 365`

49.110.5Property: Issuer URL

Property Name	Issuer URL
Property Key
Property Type	STRING
Description	This is the URL that will be placed in OpenID Connect tokens as the `iss` (issuer) token. The value should be the URL to the identity server.
Applies to Modules	SMART Outbound Security
Default Value	(no default)
Example Property	`module.[MODULE_ID].config.issuer.url =`

49.110.6Property: New Session for Each Flow

Property Name	New Session for Each Flow
Property Key
Property Type	BOOLEAN
Description	If enabled, every time an interactive flow is initiated the user session will be cleared. This should be set in cases where different users might access the module using the same browser, so previous authentication should not be remembered.
Applies to Modules	SMART Outbound Security
Default Value	`false`
Example Property	`module.[MODULE_ID].config.new_session_for_each_flow.always = false`

49.110.7Property: PKCE Plain Challenge Supported

Property Name	PKCE Plain Challenge Supported
Property Key
Property Type	BOOLEAN
Description	If disabled, the PKCE challenge type `PLAIN` will not be allowed on this server.
Applies to Modules	SMART Outbound Security
Default Value	`true`
Example Property	`module.[MODULE_ID].config.pkce.plain_challenge_supported = true`

49.110.8Property: PKCE Required

Property Name	PKCE Required
Property Key
Property Type	BOOLEAN
Description	If this setting is enabled, the server will require the use of PKCE for all Authorization Code SMART Auth flows. Enabling this setting also disallows the use of the OAuth2 Implicit Grant type, since this flow does not support PKCE.
Applies to Modules	SMART Outbound Security
Default Value	`false`
Example Property	`module.[MODULE_ID].config.pkce.required = false`

49.110.9Property: Rotate Refresh Token After Use

Property Name	Rotate Refresh Token After Use
Property Key
Property Type	BOOLEAN
Description	If enabled, each time a refresh token is used to obtain a new access token, the refresh token will be invalidated and a new one automatically issued with the new access token.
Applies to Modules	SMART Outbound Security
Default Value	`false`
Example Property	`module.[MODULE_ID].config.rotate_refresh_token_after_use = false`

49.110.10Property: Smart Capabilities List

Property Name	Smart Capabilities List
Property Key
Property Type	STRING_MULTILINE
Description	List of Smart Capabilities to enable (See http://hl7.org/fhir/smart-app-launch/conformance.html#capability-sets); one capability per line.
Applies to Modules	SMART Inbound Security SMART Outbound Security
Default Value	(no default)
Example Property	`module.[MODULE_ID].config.smart_capabilities_list =`

49.109 OpenID Connect Token Validation 49.111 Payer to Payer