Facing issues while Implementing the SMART ON FHIR via Cerner

[Rajesh Kumar]

Hi Team,

Facing the below issues while implementing the SMART ON FHIR using Cerner in my  Rest Controllers:

• After a successful /launch of my app, still I'm not able to find or generate the 'state' params.
  
  
• Can we hard-code the aud value as below in order to generate the authCode or token?? If yes, will this result into a security issues ??
  
  'aud':'https://fhir-ehr-code.cerner.com/dstu2/ec2458f2-1e24-41c8-b71b-0e701af7583d'
  

• How can we access the input params (patid, etc...)  which we are passing while launching the app?
  
  http://localhost:8000/emrwidget/public/launch?cerner_patid=123&....
  
  Please find the below details of my Sample App:
  App Info
  

  Client Id: da07c3a2-8c58-46a2-872a-3feac76fdcf7

  App Id: aca344ab-b59d-4cbb-ab0f-e3e3ac44b729

  SMART Launch URI: http://localhost:8000/emrwidget/public/launch?cerner_patid=123

  Redirect URI: http://localhost:8000/emrwidget/public/ready

  App Type: provider

  Client Type: public

  FHIR Spec: dstu2 - "https://fhir-ehr-code.cerner.com/dstu2/ec2458f2-1e24-41c8-b71b-0e701af7583d"

  Authorized: true

So any help in this regard will be highly appreciable.

Regards,

Rajesh Kumar

[Fenil Desani (Cerner)]

Hello,

Why would you be passing context params for a provider App? Would your App be standalone or embedded with Cerner?

State param needs to be provided by the App during launch and will be returned after successful auth.

Aud param generally should be discovered from iss param returned from the launch.

http://fhir.cerner.com/authorization/#requesting-authorization-on-behalf-of-a-user

http://fhir.cerner.com/authorization/authorization-specification/

http://www.hl7.org/fhir/smart-app-launch/

Thanks,

Fenil

[Rajesh Kumar]

Hi Fenil,

Thank you so much for your response.

Our App is  EHR launch sequence http://hl7.org/fhir/smart-app-launch/1.0.0/#ehr-launch-sequence & we are implementing it at the Backend level.

1. Queries on aud params:

For constructing the URL for redirect, previously I was not able to get the authorize code i.e. 'code' params whie redirecting it to /ready as a result I was getting the below error:

http://localhost:8000/emrwidget/public/ready?state=abcxyz123&error=invalid_request&error_uri=https%3A%2F%2Fauthorization.cerner.com%2Ferrors%2Furn%253Acerner%253Aerror%253Aauthorization-server%253Aoauth2%253Agrant%253Aaudience-required%2Finstances%2F442d9aeb-3cbb-46c9-8eb3-b854c2687f3b%3Fpersona%3Dprovider%26client%3Dda07c3a2-8c58-46a2-872a-3feac76fdcf7%26tenant%3Dec2458f2-1e24-41c8-b71b-0e701af7583d 

Post adding the 'aud':'https://fhir-ehr-code.cerner.com/dstu2/ec2458f2-1e24-41c8-b71b-0e701af7583d' to the redirect-url resolves our issue & now I'm able to generate the token as below:
{access_token=eyJraWQiOiIyMDIxLTA5LTE3VDA0OjM0OjQ2Ljc.........,

 patient=12724066, 

scope=launch, 

need_patient_banner=true,

 smart_style_url=https://smart.cerner.com/styles/smart-v1.json, 

encounter=97953477, 

token_type=Bearer, 

expires_in=570, 

user=12742069, 

tenant=ec2458f2-1e24-41c8-b71b-0e701af7583d, 

username=portal}

Can we hard-code the 'aud' param while constructing it in the redirect-url based on the below documentation? Is this a expected behavior?
https://fhir.cerner.com/authorization/#construct-the-authorization-request-url 

2. Queries on 'state' param:

• Currently My App is working fine with 'state' params as empty or with some hardcoded string value for example:
  
  state=abcxyz123 
  state=''"

•  In case if I want to restore the original 'state' param value, currently my function is not able to generate the 'state' params.
  As per the http://www.hl7.org/fhir/smart-app-launch/   doc the authorization server includes this 'state' value when redirecting the user-agent back to the client in my case 'state' is not getting included by the authorization server.
  
  
• Is this fine to have a state params as empty or hardcode with some string value??
  
  

Can you please provide your comments on my above queries.

Please feel free to ask further questions.

Regards,

Rajesh Kumar

[Fenil Desani (Cerner)]

If the App is launched from within Cerner's chart, on your launch URL you would get back launch code and iss param. The iss param would be the aud param and we hope you fetch it dynamically.

In case your App is not launched from within Cerner or you don't get the iss value, yes you can hardcode the value.

state - An opaque value used by the client to maintain state between the request and callback. The authorization server includes this value when redirecting the user-agent back to the client. The parameter SHALL be used for preventing cross-site request forgery or session fixation attacks. The app SHALL use an unpredictable value for the state parameter with at least 122 bits of entropy (e.g., a properly configured random uuid is suitable). The app SHALL validate the value of the state parameter upon return to the redirect URL and SHALL ensure that the state value is securely tied to the user’s current session (e.g., by relating the state value to a session identifier issued by the app). The value of state param will be returned by the Auth Server on callback