25.20.1Machine to Machine Authentication

Smile provides the ClientAuthInterceptor to create interceptors to handle SMART on FHIR authentication through OAuth2/OIDC client_credentials flow. The ClientAuthInterceptor can handle Client Secret and JWT request authentication, and automatically handles authentication token requests including configuration discovery, as well as token renewal upon expiration.

Note: token refresh functionality is not in scope, as this interceptor is to be used for M2M requests.

The interceptor will use JWT authentication or Client Secret flow depending on the received ClientAuthState parameter as follows:

1. When the ClientAuthState.keyStore property is present, the JWT flow will be performed.
2. When the ClientAuthState.keyStore property is empty and ClientAuthState.clientSecret property is present, the Client Secret flow will be performed.

25.20.1.1Client Secret Authentication

The simplest form of client authentication uses a client ID and client secret pair. This method is suitable for confidential clients that can securely store credentials.

25.20.1.2Private Key JWT Authentication

For enhanced security, clients can authenticate using asymmetric cryptography with a private key JWT assertion. This method follows the SMART Backend Services specification.

25.20.1.3ClientAuthInterceptor Usage

ClientAuthInterceptor interceptors must be instantiated using the fromState() static method with a ClientAuthState parameter, as shown in example below:

  ClientAuthState authState = new ClientAuthState(JWT_FLOW_CLIENT_ID)
	.withKeystore(myServerJson.getClientAuthenticationKeystoreId())
	.withScope(PATIENT_READ_SCOPE)
	.withAdditionalParameters(List.of(new BasicNameValuePair("test-additional-param-name", "test-additional-param-value")));
  ClientAuthInterceptor clientAuthInterceptor = ClientAuthInterceptor.fromState(theAuthState);