Postman gets 403 using the service account to access resources about fhir-server-samples HOT 11 CLOSED

Typically, a 403 means that your identity object id (claim oid in the token) is not in the list of allowed object ids.

https://docs.microsoft.com/en-us/azure/healthcare-apis/find-identity-object-ids

from fhir-server-samples.

Right, I'm using the open source FHIR Server (https://github.com/microsoft/fhir-server-samples). Since the deployment script doesn't allow me enter the object ID, where do I enter it after install. The link you shared is for FHIR API for Azure.

In addition, FHIR server scope is set to user_impersonation instead of "Patient", "Encounter" etc. I'm a little unclear on this.

Thanks
Ahsan

from fhir-server-samples.

For the OSS server, we use app roles. So you have to make sure that the user (or service principal) has the appropriate app roles.

from fhir-server-samples.

I followed the deployment script
.\Create-FhirServerSamplesEnvironment.ps1 -EnvironmentName fhirapi006 -EnvironmentLocation eastus -UsePaaS $false -PersistenceProvider sql -SqlAdminPassword $(ConvertTo-SecureString -AsPlainText -Force "FhirOSDemo1")

Everything got created properly. I can access the dashboard app, execute function. But Postman gets forbidden error using the service account.

from fhir-server-samples.

Which service account? Are you using the service principal credentials created with the environment?

How are you getting the token in Postman?

from fhir-server-samples.

I'm following the instruction from here https://github.com/microsoft/fhir-server/blob/master/docs/PostmanTesting.md.

The deployment scripts outputs something like this...

aadServiceClientId String
21e1fa87-10ac-4e53-9460-691b895b6fb8
aadServiceClientSecret String
mV0RGo9nVXQsRFvJnlPIGCjmA7GMU0F7chcItERY7a0=

from fhir-server-samples.

The Postman example you are referring to uses authorization code flow to obtain a token. If you want to do that, you should use the confidential client details. Otherwise, you have to use client credentials flow (https://docs.microsoft.com/en-us/azure/active-directory/develop/v1-oauth2-client-creds-grant-flow) to obtain a token directly from the token endpoint.

Also, note that if you spin up the fhir-server-samples environment, you can use the "About me" on the dashboard to get access to a token, which you can use directly in Postman.

from fhir-server-samples.

Thanks... This allows me to setup Postman. How is the Importer Function configured? I'm not familiar with Function. I'm trying to locate the configuration.

from fhir-server-samples.

Not sure I get the question. It is a bit broad.

But the function is deployed with this template:

https://github.com/microsoft/fhir-server-samples/blob/master/deploy/templates/azuredeploy-importer.json

Can't give an Azure Functions 101 here, but there is plenty of documentation out there:
https://docs.microsoft.com/en-us/azure/azure-functions/

from fhir-server-samples.

I'm planning to not deploy Function App for now but use a windows client instead. I was just trying to see what the Function app was using to connect to the API.

Thanks for your help. I can sort out the windows app.

from fhir-server-samples.

The code for the importer is here:

https://github.com/microsoft/fhir-server-samples/tree/master/src/FhirImporter

Closing this issue now.

from fhir-server-samples.