On this page:
   35.76    Master Data Management 35.78    Realtime Export   

35.77OpenID Connect (OIDC)

 

The OpenID Connect (OIDC) configuration category includes the following configurable options:

  • Cache Authorizations (millis)

  • Client Secret Encoding

  • Smile CDR generated Client Secret expiry duration in days

  • Issuer URL

  • PKCE Plain Challenge Supported

  • PKCE Required

  • Rotate Refresh Token After Use

  • Smart Capabilities List

35.77.1Property: Cache Authorizations (millis)

 
Property Name Cache Authorizations (millis)
Property Key
Property Type NON_NEGATIVE_INTEGER
Description If a non-zero value is supplied, the authorization server will cache successful authorizations for up to this amount of time. This means that if an Access Token is received as authentication with a request (e.g. in an Authorization header during a FHIR call) multiple times within the cache timespan, only one attempt to validate the token will be made. Using the cache can greatly improve performance on heavily loaded systems. However, manually invalidated tokens may be accepted as still being valid during the cache period so it is important to not use a value that is unnecessarily long.
Applies to Modules
  • SMART Outbound Security
Default Value 3000
Example Property
module.[MODULE_ID].config.cache.authorized_tokens.millis = 3000

35.77.2Property: Client Secret Encoding

 
Property Name Client Secret Encoding
Property Key
Property Type ENUM
Values
  • SHA256_1000_ROUND
  • SHA256_10000_ROUND
  • SHA256_100000_ROUND
  • PBKDF2_256_1000_RND
  • PBKDF2_256_10000_RND
  • PBKDF2_256_100000_RND
  • BCRYPT_10_ROUND
  • BCRYPT_12_ROUND
  • BCRYPT_14_ROUND
  • BCRYPT_16_ROUND
Description Select the hashing algorithm to use when storing client secrets. Note that the value selected here will apply only to newly created secrets, and this may be changed at any time without affecting existing secrets. See Password Hashing Algorithms for more information.
Applies to Modules
  • SMART Outbound Security
Default Value BCRYPT_12_ROUND
Example Property
module.[MODULE_ID].config.client_secret.encoding = BCRYPT_12_ROUND

35.77.3Property: Smile CDR generated Client Secret expiry duration in days

 
Property Name Smile CDR generated Client Secret expiry duration in days
Property Key
Property Type STRING
Description Select the expiry duration in days for Smile CDR generated client secrets. Note this value will be added to secret activation date to calculate secret expiration date during the client creation process via the REST path register-client-and-generate-secret.
Applies to Modules
  • SMART Outbound Security
Default Value 365
Example Property
module.[MODULE_ID].config.client_secret.expiry_duration_days = 365

35.77.4Property: Issuer URL

 
Property Name Issuer URL
Property Key
Property Type STRING
Description This is the URL that will be placed in OpenID Connect tokens as the iss (issuer) token. The value should be the URL to the identity server.
Applies to Modules
  • SMART Outbound Security
Default Value (no default)
Example Property
module.[MODULE_ID].config.issuer.url = 

35.77.5Property: PKCE Plain Challenge Supported

 
Property Name PKCE Plain Challenge Supported
Property Key
Property Type BOOLEAN
Description If disabled, the PKCE challenge type PLAIN will not be allowed on this server.
Applies to Modules
  • SMART Outbound Security
Default Value true
Example Property
module.[MODULE_ID].config.pkce.plain_challenge_supported = true

35.77.6Property: PKCE Required

 
Property Name PKCE Required
Property Key
Property Type BOOLEAN
Description If this setting is enabled, the server will require the use of PKCE for all Authorization Code SMART Auth flows. Enabling this setting also disallows the use of the OAuth2 Implicit Grant type, since this flow does not support PKCE.
Applies to Modules
  • SMART Outbound Security
Default Value false
Example Property
module.[MODULE_ID].config.pkce.required = false

35.77.7Property: Rotate Refresh Token After Use

 
Property Name Rotate Refresh Token After Use
Property Key
Property Type BOOLEAN
Description If enabled, each time a refresh token is used to obtain a new access token, the refresh token will be invalidated and a new one automatically issued with the new access token.
Applies to Modules
  • SMART Outbound Security
Default Value false
Example Property
module.[MODULE_ID].config.rotate_refresh_token_after_use = false

35.77.8Property: Smart Capabilities List

 
Property Name Smart Capabilities List
Property Key
Property Type STRING_MULTILINE
Description List of Smart Capabilities to enable (See http://hl7.org/fhir/smart-app-launch/conformance/index.html#smart-on-fhir-core-capabilities-and-capability-sets); one capability per line.
Applies to Modules
  • SMART Outbound Security
Default Value (no default)
Example Property
module.[MODULE_ID].config.smart_capabilities_list = 
   35.76    Master Data Management 35.78    Realtime Export