Smile CDR v2022.08.PRE
On this page:
   37.83    OpenID Connect Token Validation
  • Configuration Categories
  • 37.0 Web Admin Console Settings
  • 37.1 appSphere
  • 37.2 Payer Config
  • 37.3 Initial appSphere Seeding
  • 37.4 Authentication Callback Scripts
  • 37.5 Auth: General for APIs
  • 37.6 User Authentication
  • 37.7 Auth: HTTP Basic
  • 37.8 Auth: OpenID Connect
  • 37.9 Browser Syntax Highlighting
  • 37.10 Capability Statement (metadata)
  • 37.11 CDA Generation
  • 37.12 CDA Import
  • 37.13 CDS Hooks Definitions
  • 37.14 Channel Import
  • 37.15 Channel Retry
  • 37.16 Kafka
  • 37.17 Cluster Manager Maintenance
  • 37.18 Message Broker
  • 37.19 Cluster Level Security
  • 37.20 Credentials
  • 37.21 Cross-Origin Resource Sharing (CORS)
  • 37.22 Database
  • 37.23 Email Configuration
  • 37.24 ETL Import: CSV Properties
  • 37.25 ETL Import: Source
  • 37.26 FHIR Binary Storage
  • 37.27 FHIR Bulk Operations
  • 37.28 Capability Statement
  • 37.29 FHIR Configuration
  • 37.30 Consent Service
  • 37.31 FHIR Endpoint Conversion
  • 37.32 Interceptors
  • 37.33 FHIR Endpoint Partitioning
  • 37.34 Custom Resource Providers
  • 37.35 FHIR Endpoint Security
  • 37.36 Endpoint Terminology
  • 37.37 FHIR Gateway Configuration
  • 37.38 FHIR Interceptors
  • 37.39 LiveBundle Service
  • 37.40 FHIR MDM Server
  • 37.41 FHIR Performance
  • 37.42 FHIR Performance Tracing
  • 37.43 FHIR Realtime Export
  • 37.44 Repository Validation
  • 37.45 FHIR Resource Types
  • 37.46 FHIR REST Endpoint
  • 37.47 FHIR Search
  • 37.48 FHIR Storage Module Scheduled Tasks
  • 37.49 FHIR Validation Services
  • 37.50 FHIR Storage Package Registry
  • 37.51 FHIR Storage Partitioning
  • 37.52 Versioned References
  • 37.53 FHIR Subscription Delivery
  • 37.54 FHIR Subscription Persistence
  • 37.55 Amazon HealthLake REST Endpoint
  • 37.56 HL7 v2.x Mapper - Contained Resource
  • 37.57 HL7 v2.x Mapper - DG1
  • 37.58 HL7 v2.x Mapper - Forced Namespace Mode
  • 37.59 HL7 v2.x Mapper - General
  • 37.60 HL7 v2.x Mapper - Medications
  • 37.61 HL7 v2.x Mapper - OBR
  • 37.62 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 37.63 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 37.64 HL7 v2.x Mapper - PID
  • 37.65 HL7 v2.x Mapper - PV1
  • 37.66 HL7 v2.x Listener Script
  • 37.67 HL7 v2.x MLLP Listener
  • 37.68 HL7 v2.x MLLP Sender
  • 37.69 FHIR to HL7 v2.x Mapper Script
  • 37.70 HL7 v2.x Outbound Mapping
  • 37.71 HTTP Access Log
  • 37.72 HTTP Listener
  • 37.73 HTTP Request Pool
  • 37.74 HTTP Security
  • 37.75 Hybrid Providers Definitions
  • 37.76 Initial User Seeding
  • 37.77 JavaScript Execution Environment
  • 37.78 JSON Web KeySet (JWKS)
  • 37.79 LDAP Authentication
  • 37.80 Lucene FullText Indexing
  • 37.81 MDM
  • 37.82 Narrative Generator
  • 37.83 OpenID Connect Token Validation
  • 37.84 OpenID Connect (OIDC)
  • 37.85 Provenance Injection
  • 37.86 Realtime Export
  • 37.87 Endpoint Validation: Request Validating
  • 37.88 Search Parameter Seeding
  • 37.89 SAML Provider
  • 37.90 Security Inbound Script
  • 37.91 Inbound SMART on FHIR Authentication
  • 37.92 Inbound SMART on FHIR Endpoints
  • 37.93 OAuth2/OIDC Federation
  • 37.94 SMART Callback Script
  • 37.95 Cross-Organizational Data Access Profile
  • 37.96 SMART Login Skin
  • 37.97 SMART Login Terms of Service
  • 37.98 SMART Authorization
  • 37.99 SMART Definitions Seeding
  • 37.100 Sessions
  • 37.101 Two Factor Authentication
  • 37.102 TLS / SSL (Encryption)
  • 37.103 Transaction Log
  • 37.104 Trusted Client
  • 37.105 User Self Registration
    • 37.85    Provenance Injection   
       Table of Contents

    OpenID Connect (OIDC)

    37.84OpenID Connect (OIDC)

     

    The OpenID Connect (OIDC) configuration category includes the following configurable options:

    • Cache Authorizations (millis)

    • Client Secret Encoding

    • Smile CDR generated Client Secret expiry duration in days

    • Issuer URL

    • PKCE Plain Challenge Supported

    • PKCE Required

    • Rotate Refresh Token After Use

    • Smart Capabilities List

    37.84.1Property: Cache Authorizations (millis)

     
    Property Name Cache Authorizations (millis)
    Property Key
    Property Type NON_NEGATIVE_INTEGER
    Description If a non-zero value is supplied, the authorization server will cache successful authorizations for up to this amount of time. This means that if an Access Token is received as authentication with a request (e.g. in an Authorization header during a FHIR call) multiple times within the cache timespan, only one attempt to validate the token will be made. Using the cache can greatly improve performance on heavily loaded systems. However, manually invalidated tokens may be accepted as still being valid during the cache period so it is important to not use a value that is unnecessarily long.
    Applies to Modules
    • SMART Outbound Security
    Default Value 3000
    Example Property 
    module.[MODULE_ID].config.cache.authorized_tokens.millis = 3000

    37.84.2Property: Client Secret Encoding

     
    Property Name Client Secret Encoding
    Property Key
    Property Type ENUM
    Values
    • SHA256_1000_ROUND
    • SHA256_10000_ROUND
    • SHA256_100000_ROUND
    • PBKDF2_256_1000_RND
    • PBKDF2_256_10000_RND
    • PBKDF2_256_100000_RND
    • BCRYPT_10_ROUND
    • BCRYPT_12_ROUND
    • BCRYPT_14_ROUND
    • BCRYPT_16_ROUND
    Description Select the hashing algorithm to use when storing client secrets. Note that the value selected here will apply only to newly created secrets, and this may be changed at any time without affecting existing secrets. See Password Hashing Algorithms for more information.
    Applies to Modules
    • SMART Outbound Security
    Default Value BCRYPT_12_ROUND
    Example Property 
    module.[MODULE_ID].config.client_secret.encoding = BCRYPT_12_ROUND

    37.84.3Property: Smile CDR generated Client Secret expiry duration in days

     
    Property Name Smile CDR generated Client Secret expiry duration in days
    Property Key
    Property Type STRING
    Description Select the expiry duration in days for Smile CDR generated client secrets. Note this value will be added to the activation date of the secret to calculate the expiration date for the secret during the client creation process via the REST path register-client-and-generate-secret.
    Applies to Modules
    • SMART Outbound Security
    Default Value 365
    Example Property 
    module.[MODULE_ID].config.client_secret.expiry_duration_days = 365

    37.84.4Property: Issuer URL

     
    Property Name Issuer URL
    Property Key
    Property Type STRING
    Description This is the URL that will be placed in OpenID Connect tokens as the iss (issuer) token. The value should be the URL to the identity server.
    Applies to Modules
    • SMART Outbound Security
    Default Value (no default)
    Example Property 
    module.[MODULE_ID].config.issuer.url =

    37.84.5Property: PKCE Plain Challenge Supported

     
    Property Name PKCE Plain Challenge Supported
    Property Key
    Property Type BOOLEAN
    Description If disabled, the PKCE challenge type PLAIN will not be allowed on this server.
    Applies to Modules
    • SMART Outbound Security
    Default Value true
    Example Property 
    module.[MODULE_ID].config.pkce.plain_challenge_supported = true

    37.84.6Property: PKCE Required

     
    Property Name PKCE Required
    Property Key
    Property Type BOOLEAN
    Description If this setting is enabled, the server will require the use of PKCE for all Authorization Code SMART Auth flows. Enabling this setting also disallows the use of the OAuth2 Implicit Grant type, since this flow does not support PKCE.
    Applies to Modules
    • SMART Outbound Security
    Default Value false
    Example Property 
    module.[MODULE_ID].config.pkce.required = false

    37.84.7Property: Rotate Refresh Token After Use

     
    Property Name Rotate Refresh Token After Use
    Property Key
    Property Type BOOLEAN
    Description If enabled, each time a refresh token is used to obtain a new access token, the refresh token will be invalidated and a new one automatically issued with the new access token.
    Applies to Modules
    • SMART Outbound Security
    Default Value false
    Example Property 
    module.[MODULE_ID].config.rotate_refresh_token_after_use = false

    37.84.8Property: Smart Capabilities List

     
    Property Name Smart Capabilities List
    Property Key
    Property Type STRING_MULTILINE
    Description List of Smart Capabilities to enable (See http://hl7.org/fhir/smart-app-launch/conformance/index.html#smart-on-fhir-core-capabilities-and-capability-sets); one capability per line.
    Applies to Modules
    • SMART Outbound Security
    Default Value (no default)
    Example Property 
    module.[MODULE_ID].config.smart_capabilities_list =
       37.83    OpenID Connect Token Validation
  • Configuration Categories
  • 37.0 Web Admin Console Settings
  • 37.1 appSphere
  • 37.2 Payer Config
  • 37.3 Initial appSphere Seeding
  • 37.4 Authentication Callback Scripts
  • 37.5 Auth: General for APIs
  • 37.6 User Authentication
  • 37.7 Auth: HTTP Basic
  • 37.8 Auth: OpenID Connect
  • 37.9 Browser Syntax Highlighting
  • 37.10 Capability Statement (metadata)
  • 37.11 CDA Generation
  • 37.12 CDA Import
  • 37.13 CDS Hooks Definitions
  • 37.14 Channel Import
  • 37.15 Channel Retry
  • 37.16 Kafka
  • 37.17 Cluster Manager Maintenance
  • 37.18 Message Broker
  • 37.19 Cluster Level Security
  • 37.20 Credentials
  • 37.21 Cross-Origin Resource Sharing (CORS)
  • 37.22 Database
  • 37.23 Email Configuration
  • 37.24 ETL Import: CSV Properties
  • 37.25 ETL Import: Source
  • 37.26 FHIR Binary Storage
  • 37.27 FHIR Bulk Operations
  • 37.28 Capability Statement
  • 37.29 FHIR Configuration
  • 37.30 Consent Service
  • 37.31 FHIR Endpoint Conversion
  • 37.32 Interceptors
  • 37.33 FHIR Endpoint Partitioning
  • 37.34 Custom Resource Providers
  • 37.35 FHIR Endpoint Security
  • 37.36 Endpoint Terminology
  • 37.37 FHIR Gateway Configuration
  • 37.38 FHIR Interceptors
  • 37.39 LiveBundle Service
  • 37.40 FHIR MDM Server
  • 37.41 FHIR Performance
  • 37.42 FHIR Performance Tracing
  • 37.43 FHIR Realtime Export
  • 37.44 Repository Validation
  • 37.45 FHIR Resource Types
  • 37.46 FHIR REST Endpoint
  • 37.47 FHIR Search
  • 37.48 FHIR Storage Module Scheduled Tasks
  • 37.49 FHIR Validation Services
  • 37.50 FHIR Storage Package Registry
  • 37.51 FHIR Storage Partitioning
  • 37.52 Versioned References
  • 37.53 FHIR Subscription Delivery
  • 37.54 FHIR Subscription Persistence
  • 37.55 Amazon HealthLake REST Endpoint
  • 37.56 HL7 v2.x Mapper - Contained Resource
  • 37.57 HL7 v2.x Mapper - DG1
  • 37.58 HL7 v2.x Mapper - Forced Namespace Mode
  • 37.59 HL7 v2.x Mapper - General
  • 37.60 HL7 v2.x Mapper - Medications
  • 37.61 HL7 v2.x Mapper - OBR
  • 37.62 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 37.63 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 37.64 HL7 v2.x Mapper - PID
  • 37.65 HL7 v2.x Mapper - PV1
  • 37.66 HL7 v2.x Listener Script
  • 37.67 HL7 v2.x MLLP Listener
  • 37.68 HL7 v2.x MLLP Sender
  • 37.69 FHIR to HL7 v2.x Mapper Script
  • 37.70 HL7 v2.x Outbound Mapping
  • 37.71 HTTP Access Log
  • 37.72 HTTP Listener
  • 37.73 HTTP Request Pool
  • 37.74 HTTP Security
  • 37.75 Hybrid Providers Definitions
  • 37.76 Initial User Seeding
  • 37.77 JavaScript Execution Environment
  • 37.78 JSON Web KeySet (JWKS)
  • 37.79 LDAP Authentication
  • 37.80 Lucene FullText Indexing
  • 37.81 MDM
  • 37.82 Narrative Generator
  • 37.83 OpenID Connect Token Validation
  • 37.84 OpenID Connect (OIDC)
  • 37.85 Provenance Injection
  • 37.86 Realtime Export
  • 37.87 Endpoint Validation: Request Validating
  • 37.88 Search Parameter Seeding
  • 37.89 SAML Provider
  • 37.90 Security Inbound Script
  • 37.91 Inbound SMART on FHIR Authentication
  • 37.92 Inbound SMART on FHIR Endpoints
  • 37.93 OAuth2/OIDC Federation
  • 37.94 SMART Callback Script
  • 37.95 Cross-Organizational Data Access Profile
  • 37.96 SMART Login Skin
  • 37.97 SMART Login Terms of Service
  • 37.98 SMART Authorization
  • 37.99 SMART Definitions Seeding
  • 37.100 Sessions
  • 37.101 Two Factor Authentication
  • 37.102 TLS / SSL (Encryption)
  • 37.103 Transaction Log
  • 37.104 Trusted Client
  • 37.105 User Self Registration
    • 37.85    Provenance Injection