Unknown application error when requesting token

[Simon Woodworth]

Hi,

I have a system account created at https://sandboxcernercentral.com/system-accounts/

I used this account ID to create a system app at https://code.cerner.com/developer/smart-on-fhir/apps. This Client ID in this app corresponds to the account ID in my systm account.

Next I do authorisation endpoint discovery at https://fhir-ehr-code.cerner.com/r4/ec2458f2-1e24-41c8-b71b-0e701af7583d/metadata and determine that the correct endpoint for system authorization is https://authorization.cerner.com/tenants/ec2458f2-1e24-41c8-b71b-0e701af7583d/protocols/oauth2/profiles/smart-v1/token.

In Postman, I build a POST token request as follows

URL: https://authorization.cerner.com/tenants/ec2458f2-1e24-41c8-b71b-0e701af7583d/protocols/oauth2/profiles/smart-v1/token

Accept: application/json

Authorization: Basic {Base 64 of ClientID:Secret per OAuth2 spec}

Content-Type: application/x-www-form-urlencoded

Cache-Control: no-cache

with a body of

grant_type=client_credentials&scope=system%2FObservation.read%20system%2FPatient.read

In return I get the following:

{

    "error": "invalid_client",

    "error_uri": "https://authorization.cerner.com/errors/urn%3Acerner%3Aerror%3Aauthorization-server%3Aoauth2%3Atoken%3Ainvalid-client-credentials/instances/e4156d71-a70f-4aa5-91b0-581c4f5f7634?client=unknown&tenant=ec2458f2-1e24-41c8-b71b-0e701af7583d"

}

which points to an error message as below, including Correlation ID 

"Unknown Application" was attempting to request access to healthcare data with Abilities Center; unfortunately, the application doesn't appear to be compatible. If you require further assistance, please contact support.

Information to provide to Technical Support

Correlation ID:

e4156d71-a70f-4aa5-91b0-581c4f5f7634

Information to provide to Unknown Application

The credentials used in the client_credentials grant were invalid.

Error Code:

urn:cerner:error:authorization-server:oauth2:token:invalid-client-credentials

Have I got the correct authorization endpoint? Is my app registered correctly? I am a little lost, sorry.

Thanks.

Simon.

[Aaron McGinn (Cerner)]

You will need to use your system account in the production CernerCentral portal [1].

[1] https://cernercentral.com/system-accounts/

-Aaron (Cerner)

[Simon Woodworth]

Hi Aaron,

Thanks. But I don't have a system account in the production portal because I was trying to do this with a sandbox system account first before going near any production system.

Is it not possible to do this with a sandbox system account? I have one set up at https://sandboxcernercentral.com/system-accounts/

Thanks.

Simon.

[Aaron McGinn (Cerner)]

While misleading, the new "public sandbox" domain is in our production cloud region, so you will need to use the production CernerCentral portal and won't access any client production domains until they are allowlisted (typically through the code program validation/implementation effort). The sandbox CernerCentral (that you linked) will be used for client non-production domains. If you do not have an account in the link I gave, you will need to request one and create an app with that account ID.

-Aaron (Cerner)

[Simon Woodworth]

Hi Aaron,

OK, I understand now. I have gone ahead and requested a system account on that link.

Thanks.

Simon.

[Simon Woodworth]

Any chance someone can review my system account request dated January 21st? Thanks! Simon.

[Aaron McGinn (Cerner)]

I reached out to our escalation team and you should get more information on this today.

-Aaron (Cerner)

[Simon Woodworth]

Hi Aaron,

Thank you very much. I subsequently got the system account, created a new system app and am now able to get an auth token for system/Patient.read. This will get me going again!

Thank again for your help.

Cheers,

Simon.

[Aditya Agarwal]

Hey Aaron, 

I have the exact same problem. Followed all the steps that were listed in this forum. Been waiting on that service account for 2 weeks now. Hoping you can have your team look into it. Let me know if you need any information from me. The account should be linked to j...@cozeva.com and since we were waiting for a long time I made another request from adag...@cozeva.com.

Thanks, 

Aditya Agarwal (Cozeva)

[Aaron McGinn (Cerner)]

Aditya, we emailed you about your account it looks like on Feb 10. Were you ever able to get those questions resolved?

-Aaron (Cerner)

[Aditya Agarwal]

Hey Aaron, 

Thanks for getting back to me, As we replied to that email: that request was for a sandbox service account, we have since removed that request and wanted to get a service account for the production portal as mentioned in this thread. If you could help me get that approved, that would be great. 

Thanks, 
Aditya (Cozeva) 

[Aaron McGinn (Cerner)]

Figured out the confusion and got this taken care of offline.

-Aaron (Cerner)