Rob Ferguson

Add AuthZ to HAPI FHIR - Part 1

Rob Ferguson -

Introduction

In previous posts, I wrote about adding support for Authentication (AuthN) to HAPI FHIR.

In this post, we will take a look at some options to enable (fine grained) Authorization (AuthZ) in HAPI FHIR.

Option 1

There are three components to this solution: an Identity Provider that authenticates the user; an Authorization Server that decides what a given user can access; and an Access Gateway which enforces those permissions.

Authorization Server

The HAPI FHIR AU with Auth Starter Project already uses Keycloak for Authentication (AuthN).

We will need to extend Keycloak and add support for SMART on FHIR.

See:

Also see:

Access Gateway

The FHIR Information Gateway sits in front of a FHIR store (e.g., a HAPI FHIR server) and controls access to FHIR resources.

See:

Option 2

Three components as per option 1.

AuthN and AuthZ: Keycloak

Access Gateway

A severless implementation of an Access Gateway.

Knative and OpenFaaS are open-source environments for creating and hosting serverless functions.

See:

Option 3

Three components as per option 1.

AuthN and AuthZ: Keycloak

Access Gateway

An Access Gateway implementation with support for Relationship-Based
Access Control (ReBAC).

See:

Option 4

Three components as per option 1.

AuthN and AuthZ: Keycloak

Access Gateway

An Access Gateway implementation based on Spring Cloud Gateway.

See:

References
OAuth 2.0
SMART on FHIR
Keycloak
FHIR Info Gateway