4.4SMART on FHIR Apps
Smile CDR can be used as a host for deploying SMART on FHIR Apps.
On this page, we will be using Smile CDR to launch a SMART on FHIR App (or SMART App). To accomplish this, we will be using Smile CDR to perform in three primary roles:
- As a SMART App Host: The demonstration app we are using is a static web app that obtains data using AJAX requests. Smile CDR will simply act as a basic web server, serving static content in this role.
- As a SMART IdP (OAuth2/OpenID Connect server): In this role, users attempting to sign into a SMART App will be presented with an app login screen provided by Smile CDR. This login screen will ask for credentials then verify that the user wishes to authorize the app to access data on their behalf, and that the user has appropriate permission to actually access the FHIR data that the app claims to need.
- As a FHIR Endpoint: In this role, Smile CDR will respond to requests for FHIR data from the app. When the user signs in through the OAuth2 server, they receive a bearer token. This token is checked with each request to ensure that the user has appropriate permissions for the data they are trying to access. In addition, all access to data is logged in the audit log.
4.4.1Accessing the Web Admin Console
First we need to sign into the Web Admin Console. This console can be used by administrators to configure almost all aspects of the system. Access the console using the appropriate URL:
To log into the console, enter your admin credentials.
4.4.2Creating a Client Definition
To support launching and authorizing a SMART App, we will need to create a client definition.
In the Web Admin Console, click on Config -> OpenID Connect Client. You should now see a window like the following:
If you do not see the growth_chart client in the list, you will need to create it.
Creating a Client Definition in Web Admin Console
Note: Alternatively, you may choose to create a client definition with Smile CDR's JSON Admin API.
Create a new client definition by clicking on Create Client. Set the following details:
| Client ID |
|
| Client Name |
|
| Client Secret | (none) |
| Authorized Grant Types |
Implicit Authorization Code |
| Access Token Validity |
|
| Refresh Token Validity |
|
– Authorized Redirect URLs |
|
– Authorized Redirect URLs |
|
| SMART Scopes: Scopes |
|
| SMART Scopes: Auto-Approve Scopes | (none) |
Creating a Client Definition with JSON Admin API
Instead of manually creating the client definition, you can also use the JSON Admin API to create a client definition with the following cURL command:
curl -X PUT \
--header 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
"clientId": "growth_chart",
"clientName": "Growth Chart",
"allowedGrantTypes": [ "AUTHORIZATION_CODE" ],
"accessTokenValiditySeconds": 3600,
"refreshTokenValiditySeconds": 86400,
"registeredRedirectUris": [ "http://localhost:9201/resources/cdr-smart-apps-growth-chart-app/" ],
"scopes": [ "openid", "launch", "patient/*.read" ]
}' http://localhost:9000/openid-connect-clients/Master/smart_auth/growth_chart
curl -X PUT \
--header 'Authorization: Basic YWRtaW46cGFzc3dvcmQ=' \
--header 'Content-Type: application/json' \
--header 'Accept: application/json' \
--data '{
"clientId": "growth_chart",
"clientName": "Growth Chart",
"allowedGrantTypes": [ "AUTHORIZATION_CODE" ],
"accessTokenValiditySeconds": 3600,
"refreshTokenValiditySeconds": 86400,
"registeredRedirectUris": [ "https://example.smilecdr.com:9201/resources/cdr-smart-apps-growth-chart-app/" ],
"scopes": [ "openid", "launch", "patient/*.read" ]
}' https://example.smilecdr.com:9000/openid-connect-clients/Master/smart_auth/growth_chart
4.4.3Enabling SMART on FHIR Requests
To enable the SMART on FHIR App to submit FHIR requests to Smile CDR, we will need to make a few additional configuration changes as described below.
Enable Anonymous Access to Capability Statement
If access has not already been granted to the FHIR Endpoint for the anonymous user, you can either enable full read-access using the instructions here, or simply enable the FHIR_CAPABILITIES permission for user anonymous.
Enable CORS for SMART Authentication Module
- In the Web Admin Console, click on
Config->Module Configand select the SMART on FHIR Outbound Security Module that will be used to authorize users (the sample configuration includes one named smart_auth that can be used here). - In the configuration window, scroll down to the
Cross-Origin Resource Sharing (CORS)section and set CORS Enabled toYes. - Click
Saveand thenRestart.
Enable SMART Authentication for FHIR Endpoint Module
- In the Web Admin Console, click on
Config->Module Configand select a FHIR Endpoint Module (the sample configuration includes one named fhir_endpoint that can be used here). - In the configuration window, scroll down to the
Dependenciessection and for theOpenID Connect Authenticationdependency, select the SMART on FHIR Outbound Security Module configured above (e.g. smart_auth if using the sample configuration). - Click
Saveand thenRestart.
NOTE: The OpenID Connect Authentication dependency above can be either a SMART on FHIR Outbound module or SMART on FHIR Inbound module, depending on how the authentication server was defined. See Accepting Internal Access Tokens for more information.
4.4.4Launch SMART on FHIR Growth Chart App
Now that we've created a client definition and updated the appropriate module configurations, we're ready to launch a SMART on FHIR App.
The following URL is a SMART Launch URL. Note the following parameters:
iss– The base URL for the FHIR endpoint. The app will load the server capability statement from this endpoint, which allows it to figure out where to authorize.launch– This is intended to be a one-time nonce. In a real scenario this would be randomly generated.patientId– The ID of the patient whose data is being accessed.
You may open the following URL in a browser:
This URL will immediately redirect you to a Smile CDR login screen. The user whose credentials you use to log in must have the appropriate permission to read clinical data from the repository.
Use your admin credentials to sign in. You will be presented with a screen asking you to confirm that you wish to grant permission to the app.
Grant the app permission by clicking Authorize. The SMART on FHIR Growth Chart App will then launch. Neat!
