On this page:
   28.68    Security Inbound Script 28.70    Inbound SMART on FHIR Endpoints   

28.69Inbound SMART on FHIR Authentication

 

The Inbound SMART on FHIR Authentication configuration category includes the following configurable options:

  • Trust Intra-Cluster SMART Tokens from Module(s)

  • Authentication Cache Timeout (Seconds)

  • Prevent Token KeyID Reuse

  • Require Key Expiry

28.69.1Property: Trust Intra-Cluster SMART Tokens from Module(s)

 
Property Name Trust Intra-Cluster SMART Tokens from Module(s)
Property Key
Property Type STRING
Description This property provides a comma-separated list of Smile CDR SMART Outbound Security modules from which tokens will be accepted. See Accepting Internal Access Tokens for information on how to use this setting. Values for this setting should be in the form node_id/module_id, where node_id refers to a master node, and module_id refers to a SMART Outbound Security module on that node. If no value is supplied, only tokens issued by external OpenID Connect providers will be trusted, and these providers must be registered as OpenID Connect servers in the Smile CDR configuration.
Default Value (no default)
Example Property
module.[MODULE_ID].config.trust_intra_cluster_tokens.modules = 

28.69.2Property: Authentication Cache Timeout (Seconds)

 
Property Name Authentication Cache Timeout (Seconds)
Property Key
Property Type NON_NEGATIVE_INTEGER
Description If set to a non-zero, non-negative value, successfully validated authentication tokens will be cached for the given number of seconds. This cache has a positive impact on performance since validating a token is a non-trivial operation and may involve lookups and crypto operations. However, setting this timeout to a value that is high means that invalidated tokens will be trusted for longer than they should be.
Default Value 300
Example Property
module.[MODULE_ID].config.cache_authentication.seconds = 300

28.69.3Property: Prevent Token KeyID Reuse

 
Property Name Prevent Token KeyID Reuse
Property Key
Property Type BOOLEAN
Description If enabled, the server will block tokens with a signed key from being reused. In other words, when the key is decoded as a JWT, the kid (KeyID) claim is verified to ensure that the same key has not been reused.
Default Value false
Example Property
module.[MODULE_ID].config.key_validation.prevent_token_key_reuse = false

28.69.4Property: Require Key Expiry

 
Property Name Require Key Expiry
Property Key
Property Type BOOLEAN
Description If enabled, the server will block tokens that do not have an expiry.
Default Value false
Example Property
module.[MODULE_ID].config.key_validation.require_key_expiry = false
   28.68    Security Inbound Script 28.70    Inbound SMART on FHIR Endpoints