You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
How Azure API for FHIR validates the access token will depend on implementation and configuration. In this article, we'll walk through the validation steps, which can be helpful when troubleshooting access issues.
16
+
How Azure API for FHIR® validates the access token will depend on implementation and configuration. In this article, we'll walk through the validation steps, which can be helpful when troubleshooting access issues.
17
17
18
-
## Validate token has no issues with identity provider
18
+
## Validate the token has no issues with identity provider
19
19
20
20
The first step in the token validation is to verify that the token was issued by the correct identity provider and that it hasn't been modified. The FHIR server will be configured to use a specific identity provider known as the authority `Authority`. The FHIR server will retrieve information about the identity provider from the `/.well-known/openid-configuration` endpoint. When you use Microsoft Entra ID, the full URL is:
21
21
@@ -25,7 +25,7 @@ GET https://login.microsoftonline.com/<TENANT-ID>/.well-known/openid-configurati
25
25
26
26
where `<TENANT-ID>` is the specific Microsoft Entra tenant (either a tenant ID or a domain name).
27
27
28
-
Microsoft Entra ID will return a document like this one to the FHIR server.
28
+
Microsoft Entra ID will return a document like the following to the FHIR server.
29
29
30
30
```json
31
31
{
@@ -90,8 +90,9 @@ Microsoft Entra ID will return a document like this one to the FHIR server.
90
90
"msgraph_host": "graph.microsoft.com",
91
91
"rbac_url": "https://pas.windows.net"
92
92
}
93
-
```
94
-
The important properties for the FHIR server are `jwks_uri`, which tells the server where to fetch the encryption keys needed to validate the token signature and `issuer`, which tells the server what will be in the issuer claim (`iss`) of tokens issued by this server. The FHIR server can use this to validate that it's receiving an authentic token.
93
+
```
94
+
95
+
The important properties for the FHIR server are `jwks_uri`, which tells the server where to fetch the encryption keys needed to validate the token signature, and `issuer`, which tells the server what will be in the issuer claim (`iss`) of tokens issued by this server. The FHIR server can use this to validate it's receiving an authentic token.
95
96
96
97
## Validate claims of the token
97
98
@@ -109,14 +110,14 @@ When you use the OSS Microsoft FHIR server for Azure, the server will validate:
109
110
1. The token has the right `Audience` (`aud` claim).
110
111
1. The token has a role in the `roles` claim, which is allowed access to the FHIR server.
111
112
112
-
Consult details on how to [define roles on the FHIR server](https://github.com/microsoft/fhir-server/blob/master/docs/Roles.md).
113
+
For details on how to [define roles on the FHIR server](https://github.com/microsoft/fhir-server/blob/master/docs/Roles.md).
113
114
114
115
A FHIR server may also validate that an access token has the scopes (in token claim `scp`) to access the part of the FHIR API that a client is trying to access. Currently, Azure API for FHIR and the FHIR server for Azure don't validate token scopes.
115
116
116
117
## Next steps
117
-
Now that you know how to walk through token validation, you can complete the tutorial to create a JavaScript application and read Fast Healthcare Interoperability Resources (FHIR®) data.
118
+
Now that you know how to validate tokens, you can complete the tutorial to create a JavaScript application and read Fast Healthcare Interoperability Resources (FHIR®) data.
In this quickstart, you'll learn how to use an Azure Resource Manager template (ARM template) to deploy Azure API for Fast Healthcare Interoperability Resources (FHIR®). You can deploy Azure API for FHIR through the Azure portal, PowerShell, or CLI.
17
+
In this quickstart, you learn how to use an Azure Resource Manager template (ARM template) to deploy Azure API for Fast Healthcare Interoperability Resources (FHIR®). You can deploy Azure API for FHIR through the Azure portal, PowerShell, or CLI.
If your environment meets the prerequisites and you're familiar with using ARM templates, select the **Deploy to Azure** button. The template will open in the Azure portal once you sign in.
21
+
If your environment meets the prerequisites and you're familiar with using ARM templates, select the **Deploy to Azure** button. The template opens in the Azure portal once you sign in.
22
22
23
23
:::image type="content" source="~/reusable-content/ce-skilling/azure/media/template-deployments/deploy-to-azure-button.svg" alt-text="Button to deploy the Resource Manager template to Azure." border="false" link="https://portal.azure.com/#create/Microsoft.Template/uri/https%3a%2f%2fraw.githubusercontent.com%2fAzure%2fazure-quickstart-templates%2fmaster%2fquickstarts%2fmicrosoft.healthcareapis%2fazure-api-for-fhir%2fazuredeploy.json":::
> The deployment takes a few minutes to complete. Note the names for the Azure API for FHIR service and the resource group, which you use to review the deployed resources later.
142
+
> The deployment takes a few minutes to complete. Note the names for the Azure API for FHIR service and the resource group, for use in reviewing deployed resources.
143
143
144
144
## Review deployed resources
145
145
@@ -151,11 +151,11 @@ Follow these steps to see an overview of your new Azure API for FHIR service:
151
151
152
152
2. In the FHIR list, select your new service. The **Overview** page for the new Azure API for FHIR service appears.
153
153
154
-
3. To validate that the new FHIR API account is provisioned, select the link next to **FHIR metadata endpoint** to fetch the FHIR API capability statement. The link has a format of `https://<service-name>.azurehealthcareapis.com/metadata`. If the account is provisioned, a large JSON file is displayed.
154
+
3. To validate that the new FHIR API account is provisioned, select the link next to **FHIR metadata endpoint** to fetch the FHIR API capability statement. The link has a format of `https://<service-name>.azurehealthcareapis.com/metadata`. If the account is provisioned, a JSON file is displayed.
155
155
156
156
# [PowerShell](#tab/PowerShell)
157
157
158
-
Run the following interactive code to view details about your Azure API for FHIR service. You'll have to enter the name of the new service and the resource group.
158
+
Run the following interactive code to view details about your Azure API for FHIR service. You have to enter the name and resource group of the new service.
159
159
160
160
```azurepowershell-interactive
161
161
$serviceName = Read-Host -Prompt "Enter the name of your Azure API for FHIR service"
@@ -172,7 +172,7 @@ Read-Host "Press [ENTER] to continue"
172
172
173
173
# [CLI](#tab/CLI)
174
174
175
-
Run the following interactive code to view details about your Azure API for FHIR service. You'll have to enter the name of the new service and the resource group.
175
+
Run the following interactive code to view details about your Azure API for FHIR service. You have to enter the name of the new service and the resource group.
176
176
177
177
```azurecli-interactive
178
178
read -p "Enter the name of your Azure API for FHIR service: " serviceName &&
When it's no longer needed, delete the resource group, which deletes the resources in the resource group.
192
+
When no longer needed, delete the resource group. This deletes the resources in the resource group.
193
193
194
194
# [Portal](#tab/azure-portal)
195
195
@@ -225,7 +225,7 @@ For a step-by-step tutorial that guides you through the process of creating an A
225
225
226
226
## Next steps
227
227
228
-
In this quickstart guide, you've deployed the Azure API for FHIR into your subscription. For information about how to register applications and the Azure API for FHIR configuration settings, see
228
+
In this quickstart guide, you've deployed the Azure API for FHIR into your subscription. For information about how to register applications and the Azure API for FHIR configuration settings, see the following.
229
229
230
230
231
231
>[!div class="nextstepaction"]
@@ -249,4 +249,4 @@ In this quickstart guide, you've deployed the Azure API for FHIR into your subsc
0 commit comments