Michael Hansen hansenms

Azure API for FHIR with Service Principal Access

Pre-requisites

Make sure you have the latest version of the Az PowerShell module (>= 4.1)

Provision API and Service Principal

First create a resource group if you do not have one:

First get `/metadata'

GET https://launch.smarthealthit.org/v/r3/sim/eyJrIjoiMSIsImIiOiJiMWYwMzY1ZC1mNDA1LTQ1YzAtOGNiZC1kYTU2NTE4ZTc1MDQifQ/fhir/metadata

eyJrIjoiMSIsImIiOiJiMWYwMzY1ZC1mNDA1LTQ1YzAtOGNiZC1kYTU2NTE4ZTc1MDQifQ is a JWT with the following header:

SMART on FHIR EHR Launch

This document captures the launch sequence from the SMART on FHIR sandbox for en EHR launch.

After retriving the /metadata contents, the client initiates the authorization:

GET https://launch.smarthealthit.org/v/r3/auth/authorize?client_id=whatever&response_type=code&scope=patient%2F*.*%20user%2F*.*%20launch%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Flaunch.smarthealthit.org%2Fsample-app%2F&state=4e279d50-8a8f-be82-2803-c7136fdb4ff3&aud=&launch=eyJhIjoiMSIsImYiOiIxIn0&provider=smart-Practitioner-71482713&login_type=provider&aud_validated=1&login_success=1&patient=b2536dd3-bccd-4d22-8355-ab20acdf240b&select_first=true&encounter=e3ec2d15-4c27-4607-a45c-2f84962b0700

	#!/bin/bash

	set -euo pipefail

	cache_dir="${HOME}/.pim"
	mkdir -p "${cache_dir}"
	eligible_roles_cache="${cache_dir}/eligible_roles.json"
	active_roles_cache="${cache_dir}/active_roles.json"
	principalId=""
	role_numbers=()

	<html>
	<head>
	<script src="https://ajax.aspnetcdn.com/ajax/jQuery/jquery-3.3.1.min.js"></script>
	</head>
	<body>
	<h1>FHIR Client Example</h1>
	<div>
	<p>
	<b>Token:</b>
	<div id="token"></div>

	{
	"openapi": "3.0.0",
	"servers": [
	{
	"url": "myserver.fhir.org"
	}
	],
	"paths": {
	"/Patient/{id}": {
	"get": {

	title FHIR Server AAD Proxy Flow

	EHR->APP: GET /?iss=https://fhir&launch=eyJ0e...
	APP->FHIR: GET /metadata
	FHIR->APP: Capability Statement
	APP->AAD Proxy: Redirect /authorize?launch=eyJ0e...&client_id=app-id&scope=..
	note over AAD Proxy: Decode launch JWT\nStore patient, encounter, etc.
	AAD Proxy->AAD: Redirect /authorize?client_id=app-id
	AAD->AAD Proxy: GET /callback?code=XYZ123&state=...
	note over AAD Proxy: Retrieve patient, etc.\nCreate code JWT with\ncode, patient, encounter, etc.

	<!doctype html>
	<html lang="en">

	<head>
	<!-- Required meta tags -->
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">

	<!-- Bootstrap CSS -->
	<link rel="stylesheet" href="https://stackpath.bootstrapcdn.com/bootstrap/4.1.1/css/bootstrap.min.css" integrity="sha384-WskhaSGFgHYWDcbwN70/dfYBj47jz9qbsMId/iRN3ewGhXQFZCSftd1LZCfmhktB"

	bptest: main.cpp
	g++ -o bptest main.cpp -lpthread