Smile CDR v2023.08.PRE

On this page:

41.107 Security Inbound Script 41.109 Inbound SMART on FHIR Endpoints

41.108Inbound SMART on FHIR Authentication

The Inbound SMART on FHIR Authentication configuration category includes the following configurable options:

Authentication Cache Timeout (Seconds)
Prevent Token KeyID Reuse
Require Key Expiry
Scopes Supported
Trust Intra-Cluster SMART Tokens from Module(s)

41.108.1Property: Authentication Cache Timeout (Seconds)

Property Name	Authentication Cache Timeout (Seconds)
Property Key
Property Type	NON_NEGATIVE_INTEGER
Description	If set to a non-zero, non-negative value, successfully validated authentication tokens will be cached for the given number of seconds. This cache has a positive impact on performance since validating a token is a non-trivial operation and may involve lookups and crypto operations. However, setting this timeout to a value that is high means that invalidated tokens will be trusted for longer than they should be.
Applies to Modules	SMART Inbound Security
Default Value	`300`
Example Property	`module.[MODULE_ID].config.cache_authentication.seconds = 300`

41.108.2Property: Prevent Token KeyID Reuse

Property Name	Prevent Token KeyID Reuse
Property Key
Property Type	BOOLEAN
Description	If enabled, the server will block tokens with a signed key from being reused. In other words, when the key is decoded as a JWT, the `kid` (KeyID) claim is verified to ensure that the same key has not been reused.
Applies to Modules	SMART Inbound Security
Default Value	`false`
Example Property	`module.[MODULE_ID].config.key_validation.prevent_token_key_reuse = false`

41.108.3Property: Require Key Expiry

Property Name	Require Key Expiry
Property Key
Property Type	BOOLEAN
Description	If enabled, the server will block tokens that do not have an expiry.
Applies to Modules	SMART Inbound Security
Default Value	`false`
Example Property	`module.[MODULE_ID].config.key_validation.require_key_expiry = false`

41.108.4Property: Scopes Supported

Property Name	Scopes Supported
Property Key
Property Type	STRING
Description	A space separated list of scopes to advertise as supported in the .well-known/smart-configuration
Applies to Modules	FHIR Gateway REST Endpoint FHIR REST Endpoint (All FHIR Versions) FHIR REST Endpoint (DSTU2 - Deprecated) FHIR REST Endpoint (R3 - Deprecated) FHIR REST Endpoint (R4 - Deprecated) Hybrid Providers REST Endpoint SMART Inbound Security SMART Outbound Security
Default Value	`openid fhirUser`
Example Property	`module.[MODULE_ID].config.smart_configuration.scopes_supported = openid fhirUser`

41.108.5Property: Trust Intra-Cluster SMART Tokens from Module(s)

Property Name	Trust Intra-Cluster SMART Tokens from Module(s)
Property Key
Property Type	STRING
Description	This property provides a comma-separated list of Smile CDR SMART Outbound Security modules from which tokens will be accepted. See Accepting Internal Access Tokens for information on how to use this setting. Values for this setting should be in the form `node_id/module_id`, where this refers to a SMART Outbound Security module. If no value is supplied, only tokens issued by external OpenID Connect providers will be trusted, and these providers must be registered as OpenID Connect servers in the Smile CDR configuration.
Applies to Modules	SMART Inbound Security
Default Value	(no default)
Example Property	`module.[MODULE_ID].config.trust_intra_cluster_tokens.modules =`

41.107 Security Inbound Script 41.109 Inbound SMART on FHIR Endpoints