NullPointerException with fhir-smart when patient_id claim is missing in access token
#4083
Comments
|
thank you for the detailed bug report @qing-xia-snkeos what are you using for your auth server? can you confirm what your JWT access token looks like? does it have a If using the 'keycloak extensions for fhir' project, I would have expected the claims you mention to result in a token with a if instead there is no instead its getting to line 1068 for some reason. |
lmsurpre
changed the title
patient_id claim is missing in access token
|
Thank you for the quick reply. You are absolutely right. The I have the following questions:
|
Signed-off-by: Lee Surprenant <lmsurpre@merative.com>
Signed-off-by: Lee Surprenant <lmsurpre@merative.com>
The SMART specs do not concern themselves with the coordination between the auth server and the resource server. I believe we originally got the idea of using a Net:
We actually support two formats:
In either case the actual string value must be the Resource.id of the "in-context" patient (or patients in the case of a list). What little documentation we have on this can be found at https://linuxforhealth.github.io/FHIR/guides/FHIRServerUsersGuide#533-smart-app-launch |
* issue #4083 - handle missing patient_id claim Signed-off-by: Lee Surprenant <lmsurpre@merative.com> * Update fhir-smart/src/test/java/org/linuxforhealth/fhir/smart/test/AuthzPolicyEnforcementTest.java per review feedback Signed-off-by: Lee Surprenant <lmsurpre@merative.com> * Update fhir-smart/src/test/java/org/linuxforhealth/fhir/smart/test/AuthzPolicyEnforcementTest.java per review Signed-off-by: Lee Surprenant <lmsurpre@merative.com> Signed-off-by: Lee Surprenant <lmsurpre@merative.com>
|
We've merged the fix for the NullPointerException into main. You'll still need to figure out how to create that patient_id claim in your access tokens for any |
lmsurpre
changed the title
patient_id claim is missing in access tokenpatient_id claim is missing in access token
Thank you very much! I will find a moment next week to test this change :) |
|
Generated a token with following scopes: "fhirUser", "launch", "launch/patient", "user/Practitioner.read" without the patient_id claim and used it to do GET request for all practitioners. The request is returning the list of Practitioners as expected.
Generated a token with following scopes: "fhirUser", "launch", "launch/patient", "user/Practitioner.read" with the patient_id claim and used it to do GET request for all practitioners. The request is returning the list of Practitioners as expected.
|
Describe the bug
FHIR Server throws
NullPointerException+ 500 Internal Server Error for requests accessing resources in the allowed scopes with fhir-smart enabled.Environment
Which version of LinuxForHealth FHIR Server?
To Reproduce
Steps to reproduce the behavior:
...\fhir-server\userlibdirectory. Content of the pom.xml:"launch", "launch/patient", "openid", "profile", "fhirUser", "profile", "user/*.read", "user/Practitioner.read", "user/Practitioner.write"."fhirUser", "launch", "launch/patient", "user/Practitioner.read"and use this token to do GET request for all practitioners in Postman, the FHIR Server throws 500 Internal Server Error andNullPointerException, see screen shotSee details in the following log
Expected behavior
It should be forbidden to read Patient (which is working as expected as the Postman shows below), but it should be possible to read Practitioner instead of the NullPointerException.
Postman looks like:
Additional context
Tested also the same process with FHIR Server version 4.11.1, where the scope validation works all as expected.
The text was updated successfully, but these errors were encountered: