Capability statement required for non-FHIR Resource Server about it-infrastructure HOT 6 CLOSED

from it-infrastructure.

Why not add to start of sentence, "If the resource server is a FHIR Server, then the..."

from it-infrastructure.

Agree with @slagesse-epic of trying to avoid IUA to become dependent on FHIR as it should be usable for any type of REST endpoint. In commit 50daa2c (to be merged still) I added the clause that this is mandatory behavior for FHIR-based resource servers only. Other servers may do so as well, but it isn't mandatory.

Not the same, but related: Issue #111 contains a proposal that allows Authorization Clients to figure out what type of grants, tokens, endpoints, options are supported by an Authorization Server. This eases configuration at the client side.

A FHIR server's capability statement may point to the authorization server and this meta-data document will tell the client where and how to obtain the access tokens. Not sure though if such a thing would ever be used in practice as clients are most likely preconfigured to work with IUA and a specific Authorization Server. Moreover, clients typically need to be pre-registered at that AS for authorization to work...

from it-infrastructure.

agreed. the capability statement stuff was always intended to be ONLY for when use with a FHIR based use-case. The main reason to have this is to enable automation. A client can see this declaration in a servers metadata endpoint and thus know what they need to do administratively next. It was not intended to fully automate. It is also there as SMART has a code for use when SMART is used, so it is equal feature.

from it-infrastructure.

Was wondering if we need to add something to "IHE Appendix Z on HL7® FHIR" on this topic?

from it-infrastructure.

Was wondering if we need to add something to "IHE Appendix Z on HL7® FHIR" on this topic?

@joostreuzel I looked at the Appendix Z and don't find anything specific to add. This appendix already points at IUA, so I would expect any IUA specifics would not be included in Appendix Z. This said, I am happy to be given a specific suggestion on what to add to Appendix Z.

from it-infrastructure.