SMART on FHIR
WORK IN PROGRESS - DO NOT REFER TO THIS PAGE - DOCUMENTATION BOUND FOR ES 1.8
This page describes the usage of the SMART on FHIR stack provided by ES. A correctly set-up ES is required.
The SMART-on-FHIR API, available at the /fhir location of the server, requires authentication to be accessed.
The authentication system being used is OAuth2, as specified by the SMART on FHIR stack.
Accessing the API requires an Elexis user with the proper rights, and an OAuth2 client with the proper scopes.
To configure a user for ES SMART-on-FHIR web access, he has to own the fhir role. This role is currently
not part of the default Elexis installation, and hence has to be manually created, and subsequently assigned
to the respective user.
Please refer to the Elexis documentation on roles and rights for resp. details.
An OAuth2 client can be either dynamically registered, or manually added via the /openid web interface.
In order to use the SMART-on-FHIR api the OAuth2 client has to have the fhir scope being set.
See elexis-server-apps for available apps.
Only the administrator user is capable of specifically defining a clientId. If a normal user registers a client, the clientId will be assigned by the server and hence has to be replaced in the resp. app for proper authentication.
2-Factor-Authentication is mandatory for remote logins. We currently support TOTP as a means for the second token.
The default demo db users token secret for the Administrator user (with password admin) is 5JFB6PABMNHTSKFX
and 67BKANUG7EZAUS4A for the test user.
The QR codes are to be used in applications like Google Authenticator (for IOS and Android) (please search for them).
It is possible to de-activate the web security layer altogether. This can be done by providing the -Ddisable.web.security=true parameter to ES.
To use this flag in docker, append -e DISABLE_WEB_SECURITY='true' to the run arguments.
⚠️ Enabling this "feature" leaves your system completely open to any access. Perform due diligence enabling it.