Patient Facing App invalid request

[Kevin W]

Hi,

I am trying to create a patient facing app. The authentication failed with the following url.

http://localhost:3000/?state=WtXmkgDPSPqXynyU&error=invalid_request&error_uri=https://authorization.cerner.com/errors/urn:cerner:error:authorization-server:smart-v1:grant:launch:mismatched-identity/instances/4615670d-76cb-4358-bdd9-1ec9da78da4f?persona=patient&client=0ae3a2f1-08e9-4c00-a8df-e8d6675e673f&tenant=ec2458f2-1e24-41c8-b71b-0e701af7583d

Can someone help look into this issue? 

Thanks,

[Fenil Desani (Cerner)]

Hello,

Mismatched-identity error pops-up when you login into your App as one user and then try logging in second time as a different user.
Trying using another browser or clear cookies/cache in your current browser.

Thanks,

Fenil

[Kevin W]

Thank you Fenil,

I tried to clear the cache, also use another browser, it still failed but got a different error - code required.

http://localhost:3000/?state=eE3cEBphjwD14mmP&error=invalid_request&error_uri=https://authorization.cerner.com/errors/urn:cerner:error:authorization-server:smart-v1:grant:launch:code-required/instances/83dc9737-4f15-467a-acb3-43b458f97f92%3Fpersona%3Dpatient%26client%3D0ae3a2f1-08e9-4c00-a8df-e8d6675e673f%26tenant%3Dec2458f2-1e24-41c8-b71b-0e701af7583d

Thank you for looking into this issue.

Regards,

[Fenil Desani (Cerner)]

You are providing launch parameter and not launch scopes, hence the error.

Patient App does not require launch param, since you are already using launch/patient. Remove launch param and try again.

[Kevin W]

Thank you Fenil,

I've removed  the launch from scope, cleared the cache. Now I am getting the mismatched-identity error again.

http://localhost:3000/?state=cNemGk1Zd89AOxXB&error=invalid_request&error_uri=https://authorization.cerner.com/errors/urn%253Acerner%253Aerror%253Aauthorization-server%253Asmart-v1%253Agrant%253Alaunch%253Amismatched-identity/instances/44cc6b64-e98d-409b-ba80-4019f5f88697%3Fpersona%3Dpatient%26client%3D0ae3a2f1-08e9-4c00-a8df-e8d6675e673f%26tenant%3Dec2458f2-1e24-41c8-b71b-0e701af7583d

What else should I check?

Thanks,

[Fenil Desani (Cerner)]

Looks like the App is still sending in the launch scope and param.Try this: https://authorization.cerner.com/tenants/ec2458f2-1e24-41c8-b71b-0e701af7583d/protocols/oauth2/profiles/smart-v1/personas/patient/authorize?aud=https://fhir-myrecord.cerner.com/dstu2/ec2458f2-1e24-41c8-b71b-0e701af7583d&scope=patient/Patient.read launch/patient openid fhirUser&response_type=code&redirect_uri=http://localhost:3000/&state=cNemGk1Zd89AOxXB&client_id=0ae3a2f1-08e9-4c00-a8df-e8d6675e673f