Inbound SMART on FHIR Authentication
The Inbound SMART on FHIR Authentication configuration category includes the following configurable options:
Trust Intra-Cluster SMART Tokens from Module(s)
Authentication Cache Timeout (Seconds)
Prevent Token KeyID Reuse
Require Key Expiry
|
|
Trust Intra-Cluster SMART Tokens from Module(s) |
|
|
|
| STRING | |
This property provides a comma-separated list of Smile CDR SMART Outbound Security modules from which tokens will be accepted. See Accepting Internal Access Tokens for information on how to use this setting. Values for this setting should be in the form node_id/module_id, where node_id refers to a master node, and module_id refers to a SMART Outbound Security module on that node. If no value is supplied, only tokens issued by external OpenID Connect providers will be trusted, and these providers must be registered as OpenID Connect servers in the Smile CDR configuration.
|
|
| (no default) | |
|
|
|
Authentication Cache Timeout (Seconds) |
|
|
|
| NON_NEGATIVE_INTEGER | |
| If set, this URL specifies the OAuth2 token endpoint associated with this server. This setting has no effect on the operation of the security module but will be provided to FHIR endpoints that are secured using this module in order for them to expose this endpoint in their conformance statement. | |
300
|
|
|
|
|
Prevent Token KeyID Reuse |
|
|
|
| BOOLEAN | |
If enabled, the server will block tokens with a signed key from being reused. In other words, when the key is decoded as a JWT, the kid (KeyID) claim is verified to ensure that the same key has not been reused.
|
|
false
|
|
|
|
|
Require Key Expiry |
|
|
|
| BOOLEAN | |
| If enabled, the server will block tokens that do not have an expiry. | |
false
|
|
|