Smile CDR v2022.08.PRE
On this page:
   37.97    SMART Login Terms of Service
  • Configuration Categories
  • 37.0 Web Admin Console Settings
  • 37.1 appSphere
  • 37.2 Payer Config
  • 37.3 Initial appSphere Seeding
  • 37.4 Authentication Callback Scripts
  • 37.5 Auth: General for APIs
  • 37.6 User Authentication
  • 37.7 Auth: HTTP Basic
  • 37.8 Auth: OpenID Connect
  • 37.9 Browser Syntax Highlighting
  • 37.10 Capability Statement (metadata)
  • 37.11 CDA Generation
  • 37.12 CDA Import
  • 37.13 CDS Hooks Definitions
  • 37.14 Channel Import
  • 37.15 Channel Retry
  • 37.16 Kafka
  • 37.17 Cluster Manager Maintenance
  • 37.18 Message Broker
  • 37.19 Cluster Level Security
  • 37.20 Credentials
  • 37.21 Cross-Origin Resource Sharing (CORS)
  • 37.22 Database
  • 37.23 Email Configuration
  • 37.24 ETL Import: CSV Properties
  • 37.25 ETL Import: Source
  • 37.26 FHIR Binary Storage
  • 37.27 FHIR Bulk Operations
  • 37.28 Capability Statement
  • 37.29 FHIR Configuration
  • 37.30 Consent Service
  • 37.31 FHIR Endpoint Conversion
  • 37.32 Interceptors
  • 37.33 FHIR Endpoint Partitioning
  • 37.34 Custom Resource Providers
  • 37.35 FHIR Endpoint Security
  • 37.36 Endpoint Terminology
  • 37.37 FHIR Gateway Configuration
  • 37.38 FHIR Interceptors
  • 37.39 LiveBundle Service
  • 37.40 FHIR MDM Server
  • 37.41 FHIR Performance
  • 37.42 FHIR Performance Tracing
  • 37.43 FHIR Realtime Export
  • 37.44 Repository Validation
  • 37.45 FHIR Resource Types
  • 37.46 FHIR REST Endpoint
  • 37.47 FHIR Search
  • 37.48 FHIR Storage Module Scheduled Tasks
  • 37.49 FHIR Validation Services
  • 37.50 FHIR Storage Package Registry
  • 37.51 FHIR Storage Partitioning
  • 37.52 Versioned References
  • 37.53 FHIR Subscription Delivery
  • 37.54 FHIR Subscription Persistence
  • 37.55 Amazon HealthLake REST Endpoint
  • 37.56 HL7 v2.x Mapper - Contained Resource
  • 37.57 HL7 v2.x Mapper - DG1
  • 37.58 HL7 v2.x Mapper - Forced Namespace Mode
  • 37.59 HL7 v2.x Mapper - General
  • 37.60 HL7 v2.x Mapper - Medications
  • 37.61 HL7 v2.x Mapper - OBR
  • 37.62 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 37.63 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 37.64 HL7 v2.x Mapper - PID
  • 37.65 HL7 v2.x Mapper - PV1
  • 37.66 HL7 v2.x Listener Script
  • 37.67 HL7 v2.x MLLP Listener
  • 37.68 HL7 v2.x MLLP Sender
  • 37.69 FHIR to HL7 v2.x Mapper Script
  • 37.70 HL7 v2.x Outbound Mapping
  • 37.71 HTTP Access Log
  • 37.72 HTTP Listener
  • 37.73 HTTP Request Pool
  • 37.74 HTTP Security
  • 37.75 Hybrid Providers Definitions
  • 37.76 Initial User Seeding
  • 37.77 JavaScript Execution Environment
  • 37.78 JSON Web KeySet (JWKS)
  • 37.79 LDAP Authentication
  • 37.80 Lucene FullText Indexing
  • 37.81 MDM
  • 37.82 Narrative Generator
  • 37.83 OpenID Connect Token Validation
  • 37.84 OpenID Connect (OIDC)
  • 37.85 Provenance Injection
  • 37.86 Realtime Export
  • 37.87 Endpoint Validation: Request Validating
  • 37.88 Search Parameter Seeding
  • 37.89 SAML Provider
  • 37.90 Security Inbound Script
  • 37.91 Inbound SMART on FHIR Authentication
  • 37.92 Inbound SMART on FHIR Endpoints
  • 37.93 OAuth2/OIDC Federation
  • 37.94 SMART Callback Script
  • 37.95 Cross-Organizational Data Access Profile
  • 37.96 SMART Login Skin
  • 37.97 SMART Login Terms of Service
  • 37.98 SMART Authorization
  • 37.99 SMART Definitions Seeding
  • 37.100 Sessions
  • 37.101 Two Factor Authentication
  • 37.102 TLS / SSL (Encryption)
  • 37.103 Transaction Log
  • 37.104 Trusted Client
  • 37.105 User Self Registration
    • 37.99    SMART Definitions Seeding   
       Table of Contents

    SMART Authorization

    37.98SMART Authorization

     

    The SMART Authorization configuration category includes the following configurable options:

    • Allowed Audience List

    • Enforce Approved Scopes to Restrict Permissions

    • Scopes Supported

    37.98.1Property: Allowed Audience List

     
    Property Name Allowed Audience List
    Property Key
    Property Type STRING
    Description Space-separated list of allowed resource URLs as the 'audience' parameter during authentication flow. If left empty, no validation is performed.
    Applies to Modules
    • SMART Inbound Security
    • SMART Outbound Security
    Default Value (no default)
    Example Property 
    module.[MODULE_ID].config.allowed_audience_list =

    37.98.2Property: Enforce Approved Scopes to Restrict Permissions

     
    Property Name Enforce Approved Scopes to Restrict Permissions
    Property Key
    Property Type BOOLEAN
    Description When enabled, permission will be stripped from a user's session if they are not supported by an approved SMART on FHIR scope. For example, any FHIR write permissions will be removed from a session if the user has not approved (or a client is set to auto-approve) a scope such as Patient/*.write.
    Applies to Modules
    • SMART Inbound Security
    • SMART Outbound Security
    Default Value true
    Example Property 
    module.[MODULE_ID].config.enforce_approved_scopes_to_restrict_permissions = true

    37.98.3Property: Scopes Supported

     
    Property Name Scopes Supported
    Property Key
    Property Type STRING
    Description A space separated list of scopes to advertise as supported in the .well-known/smart-configuration
    Applies to Modules
    • SMART Inbound Security
    • SMART Outbound Security
    Default Value openid fhirUser
    Example Property 
    module.[MODULE_ID].config.smart_configuration.scopes_supported = openid fhirUser
       37.97    SMART Login Terms of Service
  • Configuration Categories
  • 37.0 Web Admin Console Settings
  • 37.1 appSphere
  • 37.2 Payer Config
  • 37.3 Initial appSphere Seeding
  • 37.4 Authentication Callback Scripts
  • 37.5 Auth: General for APIs
  • 37.6 User Authentication
  • 37.7 Auth: HTTP Basic
  • 37.8 Auth: OpenID Connect
  • 37.9 Browser Syntax Highlighting
  • 37.10 Capability Statement (metadata)
  • 37.11 CDA Generation
  • 37.12 CDA Import
  • 37.13 CDS Hooks Definitions
  • 37.14 Channel Import
  • 37.15 Channel Retry
  • 37.16 Kafka
  • 37.17 Cluster Manager Maintenance
  • 37.18 Message Broker
  • 37.19 Cluster Level Security
  • 37.20 Credentials
  • 37.21 Cross-Origin Resource Sharing (CORS)
  • 37.22 Database
  • 37.23 Email Configuration
  • 37.24 ETL Import: CSV Properties
  • 37.25 ETL Import: Source
  • 37.26 FHIR Binary Storage
  • 37.27 FHIR Bulk Operations
  • 37.28 Capability Statement
  • 37.29 FHIR Configuration
  • 37.30 Consent Service
  • 37.31 FHIR Endpoint Conversion
  • 37.32 Interceptors
  • 37.33 FHIR Endpoint Partitioning
  • 37.34 Custom Resource Providers
  • 37.35 FHIR Endpoint Security
  • 37.36 Endpoint Terminology
  • 37.37 FHIR Gateway Configuration
  • 37.38 FHIR Interceptors
  • 37.39 LiveBundle Service
  • 37.40 FHIR MDM Server
  • 37.41 FHIR Performance
  • 37.42 FHIR Performance Tracing
  • 37.43 FHIR Realtime Export
  • 37.44 Repository Validation
  • 37.45 FHIR Resource Types
  • 37.46 FHIR REST Endpoint
  • 37.47 FHIR Search
  • 37.48 FHIR Storage Module Scheduled Tasks
  • 37.49 FHIR Validation Services
  • 37.50 FHIR Storage Package Registry
  • 37.51 FHIR Storage Partitioning
  • 37.52 Versioned References
  • 37.53 FHIR Subscription Delivery
  • 37.54 FHIR Subscription Persistence
  • 37.55 Amazon HealthLake REST Endpoint
  • 37.56 HL7 v2.x Mapper - Contained Resource
  • 37.57 HL7 v2.x Mapper - DG1
  • 37.58 HL7 v2.x Mapper - Forced Namespace Mode
  • 37.59 HL7 v2.x Mapper - General
  • 37.60 HL7 v2.x Mapper - Medications
  • 37.61 HL7 v2.x Mapper - OBR
  • 37.62 HL7 v2.x to FHIR Mapper - OBSERVATION Group
  • 37.63 HL7 v2.x to FHIR Mapper - ORDER_OBSERVATION Group
  • 37.64 HL7 v2.x Mapper - PID
  • 37.65 HL7 v2.x Mapper - PV1
  • 37.66 HL7 v2.x Listener Script
  • 37.67 HL7 v2.x MLLP Listener
  • 37.68 HL7 v2.x MLLP Sender
  • 37.69 FHIR to HL7 v2.x Mapper Script
  • 37.70 HL7 v2.x Outbound Mapping
  • 37.71 HTTP Access Log
  • 37.72 HTTP Listener
  • 37.73 HTTP Request Pool
  • 37.74 HTTP Security
  • 37.75 Hybrid Providers Definitions
  • 37.76 Initial User Seeding
  • 37.77 JavaScript Execution Environment
  • 37.78 JSON Web KeySet (JWKS)
  • 37.79 LDAP Authentication
  • 37.80 Lucene FullText Indexing
  • 37.81 MDM
  • 37.82 Narrative Generator
  • 37.83 OpenID Connect Token Validation
  • 37.84 OpenID Connect (OIDC)
  • 37.85 Provenance Injection
  • 37.86 Realtime Export
  • 37.87 Endpoint Validation: Request Validating
  • 37.88 Search Parameter Seeding
  • 37.89 SAML Provider
  • 37.90 Security Inbound Script
  • 37.91 Inbound SMART on FHIR Authentication
  • 37.92 Inbound SMART on FHIR Endpoints
  • 37.93 OAuth2/OIDC Federation
  • 37.94 SMART Callback Script
  • 37.95 Cross-Organizational Data Access Profile
  • 37.96 SMART Login Skin
  • 37.97 SMART Login Terms of Service
  • 37.98 SMART Authorization
  • 37.99 SMART Definitions Seeding
  • 37.100 Sessions
  • 37.101 Two Factor Authentication
  • 37.102 TLS / SSL (Encryption)
  • 37.103 Transaction Log
  • 37.104 Trusted Client
  • 37.105 User Self Registration
    • 37.99    SMART Definitions Seeding