Smile CDR v2022.08.PRE
On this page:
   37.90    Security Inbound Script
  • Configuration Categories
  • 37.0 Web Admin Console Settings
  • 37.1 appSphere
  • 37.2 Payer Config
  • 37.3 Initial appSphere Seeding
  • 37.4 Authentication Callback Scripts
  • 37.5 Auth: General for APIs
  • 37.6 User Authentication
  • 37.7 Auth: HTTP Basic
  • 37.8 Auth: OpenID Connect
  • 37.9 Browser Syntax Highlighting
  • 37.10 Capability Statement (metadata)
  • 37.11 CDA Generation
  • 37.12 CDA Import
  • 37.13 CDS Hooks Definitions
  • 37.14 Channel Import
  • 37.15 Channel Retry
  • 37.16 Kafka
  • 37.17 Cluster Manager Maintenance
  • 37.18 Message Broker
  • 37.19 Cluster Level Security
  • 37.20 Credentials
  • 37.21 Cross-Origin Resource Sharing (CORS)
  • 37.22 Database
  • 37.23 Email Configuration
  • 37.24 ETL Import: CSV Properties
  • 37.25 ETL Import: Source
  • 37.26 FHIR Binary Storage
  • 37.27 FHIR Bulk Operations
  • 37.28 Capability Statement
  • 37.29 FHIR Configuration
  • 37.30 Consent Service
  • 37.31 FHIR Endpoint Conversion
  • 37.32 Interceptors
  • 37.33 FHIR Endpoint Partitioning
  • 37.34 Custom Resource Providers
  • 37.35 FHIR Endpoint Security
  • 37.36 Endpoint Terminology
  • 37.37 FHIR Gateway Configuration
  • 37.38 FHIR Interceptors
  • 37.39 LiveBundle Service
  • 37.40 FHIR MDM Server
  • 37.41 FHIR Performance
  • 37.42 FHIR Performance Tracing
  • 37.43 FHIR Realtime Export
  • 37.44 Repository Validation
  • 37.45 FHIR Resource Types
  • 37.46 FHIR REST Endpoint
  • 37.47 FHIR Search
  • 37.48 FHIR Storage Module Scheduled Tasks
  • 37.49 FHIR Validation Services
  • 37.50 FHIR Storage Package Registry
  • 37.51 FHIR Storage Partitioning
  • 37.52 Versioned References
  • 37.53 FHIR Subscription Delivery
  • 37.54 FHIR Subscription Persistence
  • 37.55 Amazon HealthLake REST Endpoint
  • 37.56 HL7 v2.x Mapper - Contained Resource
  • 37.57 HL7 v2.x Mapper - DG1
  • 37.58 HL7 v2.x Mapper - Forced Namespace Mode
  • 37.59 HL7 v2.x Mapper - General
  • 37.60 HL7 v2.x Mapper - Medications
  • 37.61 HL7 v2.x Mapper - OBR
  • 37.62 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 37.63 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 37.64 HL7 v2.x Mapper - PID
  • 37.65 HL7 v2.x Mapper - PV1
  • 37.66 HL7 v2.x Listener Script
  • 37.67 HL7 v2.x MLLP Listener
  • 37.68 HL7 v2.x MLLP Sender
  • 37.69 FHIR to HL7 v2.x Mapper Script
  • 37.70 HL7 v2.x Outbound Mapping
  • 37.71 HTTP Access Log
  • 37.72 HTTP Listener
  • 37.73 HTTP Request Pool
  • 37.74 HTTP Security
  • 37.75 Hybrid Providers Definitions
  • 37.76 Initial User Seeding
  • 37.77 JavaScript Execution Environment
  • 37.78 JSON Web KeySet (JWKS)
  • 37.79 LDAP Authentication
  • 37.80 Lucene FullText Indexing
  • 37.81 MDM
  • 37.82 Narrative Generator
  • 37.83 OpenID Connect Token Validation
  • 37.84 OpenID Connect (OIDC)
  • 37.85 Provenance Injection
  • 37.86 Realtime Export
  • 37.87 Endpoint Validation: Request Validating
  • 37.88 Search Parameter Seeding
  • 37.89 SAML Provider
  • 37.90 Security Inbound Script
  • 37.91 Inbound SMART on FHIR Authentication
  • 37.92 Inbound SMART on FHIR Endpoints
  • 37.93 OAuth2/OIDC Federation
  • 37.94 SMART Callback Script
  • 37.95 Cross-Organizational Data Access Profile
  • 37.96 SMART Login Skin
  • 37.97 SMART Login Terms of Service
  • 37.98 SMART Authorization
  • 37.99 SMART Definitions Seeding
  • 37.100 Sessions
  • 37.101 Two Factor Authentication
  • 37.102 TLS / SSL (Encryption)
  • 37.103 Transaction Log
  • 37.104 Trusted Client
  • 37.105 User Self Registration
    • 37.92    Inbound SMART on FHIR Endpoints   
       Table of Contents

    Inbound SMART on FHIR Authentication

    37.91Inbound SMART on FHIR Authentication

     

    The Inbound SMART on FHIR Authentication configuration category includes the following configurable options:

    • Authentication Cache Timeout (Seconds)

    • Prevent Token KeyID Reuse

    • Require Key Expiry

    • Scopes Supported

    • Trust Intra-Cluster SMART Tokens from Module(s)

    37.91.1Property: Authentication Cache Timeout (Seconds)

     
    Property Name Authentication Cache Timeout (Seconds)
    Property Key
    Property Type NON_NEGATIVE_INTEGER
    Description If set to a non-zero, non-negative value, successfully validated authentication tokens will be cached for the given number of seconds. This cache has a positive impact on performance since validating a token is a non-trivial operation and may involve lookups and crypto operations. However, setting this timeout to a value that is high means that invalidated tokens will be trusted for longer than they should be.
    Applies to Modules
    • SMART Inbound Security
    Default Value 300
    Example Property 
    module.[MODULE_ID].config.cache_authentication.seconds = 300

    37.91.2Property: Prevent Token KeyID Reuse

     
    Property Name Prevent Token KeyID Reuse
    Property Key
    Property Type BOOLEAN
    Description If enabled, the server will block tokens with a signed key from being reused. In other words, when the key is decoded as a JWT, the kid (KeyID) claim is verified to ensure that the same key has not been reused.
    Applies to Modules
    • SMART Inbound Security
    Default Value false
    Example Property 
    module.[MODULE_ID].config.key_validation.prevent_token_key_reuse = false

    37.91.3Property: Require Key Expiry

     
    Property Name Require Key Expiry
    Property Key
    Property Type BOOLEAN
    Description If enabled, the server will block tokens that do not have an expiry.
    Applies to Modules
    • SMART Inbound Security
    Default Value false
    Example Property 
    module.[MODULE_ID].config.key_validation.require_key_expiry = false

    37.91.4Property: Scopes Supported

     
    Property Name Scopes Supported
    Property Key
    Property Type STRING
    Description A space separated list of scopes to advertise as supported in the .well-known/smart-configuration
    Applies to Modules
    • SMART Inbound Security
    Default Value openid fhirUser
    Example Property 
    module.[MODULE_ID].config.smart_configuration.scopes_supported = openid fhirUser

    37.91.5Property: Trust Intra-Cluster SMART Tokens from Module(s)

     
    Property Name Trust Intra-Cluster SMART Tokens from Module(s)
    Property Key
    Property Type STRING
    Description This property provides a comma-separated list of Smile CDR SMART Outbound Security modules from which tokens will be accepted. See Accepting Internal Access Tokens for information on how to use this setting. Values for this setting should be in the form node_id/module_id, where this refers to a SMART Outbound Security module. If no value is supplied, only tokens issued by external OpenID Connect providers will be trusted, and these providers must be registered as OpenID Connect servers in the Smile CDR configuration.
    Applies to Modules
    • SMART Inbound Security
    Default Value (no default)
    Example Property 
    module.[MODULE_ID].config.trust_intra_cluster_tokens.modules =
       37.90    Security Inbound Script
  • Configuration Categories
  • 37.0 Web Admin Console Settings
  • 37.1 appSphere
  • 37.2 Payer Config
  • 37.3 Initial appSphere Seeding
  • 37.4 Authentication Callback Scripts
  • 37.5 Auth: General for APIs
  • 37.6 User Authentication
  • 37.7 Auth: HTTP Basic
  • 37.8 Auth: OpenID Connect
  • 37.9 Browser Syntax Highlighting
  • 37.10 Capability Statement (metadata)
  • 37.11 CDA Generation
  • 37.12 CDA Import
  • 37.13 CDS Hooks Definitions
  • 37.14 Channel Import
  • 37.15 Channel Retry
  • 37.16 Kafka
  • 37.17 Cluster Manager Maintenance
  • 37.18 Message Broker
  • 37.19 Cluster Level Security
  • 37.20 Credentials
  • 37.21 Cross-Origin Resource Sharing (CORS)
  • 37.22 Database
  • 37.23 Email Configuration
  • 37.24 ETL Import: CSV Properties
  • 37.25 ETL Import: Source
  • 37.26 FHIR Binary Storage
  • 37.27 FHIR Bulk Operations
  • 37.28 Capability Statement
  • 37.29 FHIR Configuration
  • 37.30 Consent Service
  • 37.31 FHIR Endpoint Conversion
  • 37.32 Interceptors
  • 37.33 FHIR Endpoint Partitioning
  • 37.34 Custom Resource Providers
  • 37.35 FHIR Endpoint Security
  • 37.36 Endpoint Terminology
  • 37.37 FHIR Gateway Configuration
  • 37.38 FHIR Interceptors
  • 37.39 LiveBundle Service
  • 37.40 FHIR MDM Server
  • 37.41 FHIR Performance
  • 37.42 FHIR Performance Tracing
  • 37.43 FHIR Realtime Export
  • 37.44 Repository Validation
  • 37.45 FHIR Resource Types
  • 37.46 FHIR REST Endpoint
  • 37.47 FHIR Search
  • 37.48 FHIR Storage Module Scheduled Tasks
  • 37.49 FHIR Validation Services
  • 37.50 FHIR Storage Package Registry
  • 37.51 FHIR Storage Partitioning
  • 37.52 Versioned References
  • 37.53 FHIR Subscription Delivery
  • 37.54 FHIR Subscription Persistence
  • 37.55 Amazon HealthLake REST Endpoint
  • 37.56 HL7 v2.x Mapper - Contained Resource
  • 37.57 HL7 v2.x Mapper - DG1
  • 37.58 HL7 v2.x Mapper - Forced Namespace Mode
  • 37.59 HL7 v2.x Mapper - General
  • 37.60 HL7 v2.x Mapper - Medications
  • 37.61 HL7 v2.x Mapper - OBR
  • 37.62 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 37.63 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 37.64 HL7 v2.x Mapper - PID
  • 37.65 HL7 v2.x Mapper - PV1
  • 37.66 HL7 v2.x Listener Script
  • 37.67 HL7 v2.x MLLP Listener
  • 37.68 HL7 v2.x MLLP Sender
  • 37.69 FHIR to HL7 v2.x Mapper Script
  • 37.70 HL7 v2.x Outbound Mapping
  • 37.71 HTTP Access Log
  • 37.72 HTTP Listener
  • 37.73 HTTP Request Pool
  • 37.74 HTTP Security
  • 37.75 Hybrid Providers Definitions
  • 37.76 Initial User Seeding
  • 37.77 JavaScript Execution Environment
  • 37.78 JSON Web KeySet (JWKS)
  • 37.79 LDAP Authentication
  • 37.80 Lucene FullText Indexing
  • 37.81 MDM
  • 37.82 Narrative Generator
  • 37.83 OpenID Connect Token Validation
  • 37.84 OpenID Connect (OIDC)
  • 37.85 Provenance Injection
  • 37.86 Realtime Export
  • 37.87 Endpoint Validation: Request Validating
  • 37.88 Search Parameter Seeding
  • 37.89 SAML Provider
  • 37.90 Security Inbound Script
  • 37.91 Inbound SMART on FHIR Authentication
  • 37.92 Inbound SMART on FHIR Endpoints
  • 37.93 OAuth2/OIDC Federation
  • 37.94 SMART Callback Script
  • 37.95 Cross-Organizational Data Access Profile
  • 37.96 SMART Login Skin
  • 37.97 SMART Login Terms of Service
  • 37.98 SMART Authorization
  • 37.99 SMART Definitions Seeding
  • 37.100 Sessions
  • 37.101 Two Factor Authentication
  • 37.102 TLS / SSL (Encryption)
  • 37.103 Transaction Log
  • 37.104 Trusted Client
  • 37.105 User Self Registration
    • 37.92    Inbound SMART on FHIR Endpoints