Ignore bearer token in unauthenticated web application
Hi All,
Hopefully someone can help me with this question.
I've got a FHIR adapter service defined as described here:
The web application is running:
.png)
.png)
This works well when asking the FHIR metadata I get a nice 200 response:
.png)
But when I want to request patient data I need to send the Access Token in the Request:
.png)
This gives a 401 error and I don't see any message at the InteropService (HS.FHIRServer.Interop.Service).
It looks like that the webapplication doesn't like the Authorization header:
.png)
How can I make sure that the webapplication just ignores the Autorization header?
I only need the token on a later moment when interacting with the FHIR server.
Comments
You have Security Settings > Allowed Authentication Methods > Password unchecked in your Web Application definition.
Have you tried No Auth in Postman?
Hi All,
The problem is in HS.FHIRServer.RestHandler
Class HS.FHIRServer.HC.FHIRInteropAdapter Extends HS.FHIRServer.RestHandler{Parameter isInteropAdapter As %Boolean = 1;Parameter ServiceConfigName As %String = "InteropService";}For some reason its not allowed to send the bearer token with the unauthenticated application:
// Access token present on unsecure CSP request is invalid. Otherwise, if access// token found on secure CSP request then add to FHIR request AdditionalInfo for// later evaluation by the FHIR service.If '%request.Secure {If ($ZConvert($Piece(%request.GetCgiEnv("HTTP_AUTHORIZATION")," ",1),"U") = "BEARER") || ($Get(%request.Data("access_token",1)) '= "") {Set %response.Status = ..#HTTP401UNAUTHORIZEDReturn $$$OK}Set accessToken = ""} Else {// InterSystems FHIRServer policy is to NOT allow passing access token in the// request URL or form encoded body (either can be found in %request.Data).If $Get(%request.Data("access_token",1)) '= "" {Set %response.Status = ..#HTTP401UNAUTHORIZEDReturn $$$OK}Set accessToken = ##class(%SYS.OAuth2.AccessToken).GetAccessTokenFromRequest(.tSC)$$$ThrowOnError(tSC)If accessToken '= "" {Do tRequest.AdditionalInfo.SetAt(accessToken, "USER:OAuthToken")Do tRequest.AdditionalInfo.SetAt(hsrestconfig.OAuthClientName, "USER:OAuthClient")}}We're gonna discuss the issue with intersystems but it looks like we need custom programming to make this situation work in the new HC version.