25.20.1SMART on FHIR Machine to Machine (M2M) Authentication

Experimental

This functionality is available only for javascript through FhirClientFactory, for the moment.

Smile provides the ClientAuthInterceptorFactory to create interceptors to handle SMART on FHIR authentication through OAuth2/OIDC client_credentials flow.

The ClientAuthInterceptor can handle Client Secret and JWT request authentication, and automatically handles authentication token requests including configuration discovery, as well as token renewal upon expiration.

Note: token refresh functionality is not in scope, as this interceptor is to be used for M2M requests.

The interceptor will use JWT authentication or Client Secret flow depending on the received ClientAuthParams as follows:

1. When the ClientAuthParams.keystoreName property is present, the JWT flow will be performed.
2. When the ClientAuthParams.keystoreName property is empty and ClientAuthParams.clientSecret property is present, the Client Secret flow will be performed.

The ClientAuthInterceptor invokes the CLIENT_AUTH_PRE_TOKEN_REQUEST pointcut which allows implementers to provide their own Bearer authentication token programmatically using a FHIR client interceptor. If the interceptor provides a non-null token it will be used in the Authorization header. See Registering a Client Interceptor for more details.

25.20.1.1Client Secret Authentication

The simplest form of client authentication uses a client ID and client secret pair. This method is suitable for confidential clients that can securely store credentials.

25.20.1.2Private Key JWT Authentication

For enhanced security, clients can authenticate using asymmetric cryptography with a private key JWT assertion. This method follows the SMART Backend Services specification.

25.20.1.3ClientAuthInterceptor Usage

ClientAuthInterceptor interceptors must be instantiated using the ClientAuthInterceptorFactory.create(ClientAuthParams clientAuthParams) static method, as shown in example below:

  ClientAuthParams authParams = new ClientAuthParams("auth-server-defined-client-id")
	.withKeystore("keystore-containing-signing-key")
	.withScope("desired-space-separated-scopes")
	.withAdditionalParameters(List.of(new BasicNameValuePair("test-additional-param-name", "test-additional-param-value")));
  ClientAuthInterceptor clientAuthInterceptor = ClientAuthInterceptorFactory.create(authParams);