401 error while accessing DICOM API about dicom-server HOT 12 CLOSED

Hello,
If the Security is enabled then you need to pass the Auth token header to validate the request. More information on Authentication here https://github.com/microsoft/dicom-server/blob/main/docs/how-to-guides/enable-authentication-with-tokens.md.

from dicom-server.

@smithago Thanks for your response. I have followed the above article and able to generate token using postman but when I try to invoke get/post methods for this API then I am getting 401 unauthorised error.
Please let me know if you need any further details.

from dicom-server.

Can you confirm the security settings?
{
"DicomServer" : {
"Security": {
"Enabled": true,
"Authentication": {
"Audience": "",
"Authority": ""
}
}
}
}
What is set in Audience and Authority above or in the App service settings? Can you use jwt.io and decode the token and validate the "aud:" in the token matches the Audience in settings?.

from dicom-server.

@smithago Thanks much for helping me to identify audience which is incorrect but after passing correct audience and trying to invoke GET method with below API, I am getting 403 - Authorization failed in Postman. Can you please help me with this issue.

https://test-dicomserver.azurewebsites.net/studies

https://github.com/microsoft/dicom-server/blob/main/docs/how-to-guides/enable-authorization.md

I have followed the above article and updated values in app service as below.
DicomServer:Security:Authorization:Enabled - True
DicomServer:Security:Authorization:RolesClaim - "role"
DicomServer:Security:Authorization:Roles - "globalReader"

{
"DicomServer" : {
"Security": {
"Authorization": {
"Enabled": true,
"RolesClaim": "role",
"Roles": [

]
}
}
}
}

from dicom-server.

@smithago I wanted to update you after deploying template with below link and using audience- "00000002-0000-0000-c000-000000000000" which is tracked from token with JWT decoder in configuration of DICOM app service, I am able to Get/Post data using Postman.

https://github.com/microsoft/dicom-server/blob/main/docs/quickstarts/deploy-dicom-cast.md

I have followed same steps for FHIR server deployed using above template in URL but I am facing 403 error while accessing from Postman. I have already added globalAdmin and globalReader roles for app id of FHIR server but still issue exists.
I have deployed Azure API for FHIR which is working fine but DICOM cast is compatible only with FHIR server R4 version.

Can you please guide me to resolve 403 error with FHIR server.

Thanks in advance.

from dicom-server.

@smithago I am finally able to deploy DICOM Imaging server and FHIR server along with DICOM CAST. I have uploaded few dcm files to Imaging server through postman and able to see 200 status. Now, I want to check if same data has been synced to FHIR Server. Can you please help me how to retrieve data from FHIR API in Postman as below URL is not giving me correct data.

https://fhirtegsrvr.azurewebsites.net/ImagingStudy?uid="2.25.250849867305193796630300506298189987318"

Error:- The search parameter 'uid' is not supported for resource type 'ImagingStudy'.

from dicom-server.

@venkateshtarra could you try https://fhirservicedemo.azurewebsites.net/ImagingStudy?identifier=urn:oid:1.2.276.0.50.192168001099.7810872.14547392.270 ?

BTW, you can also put FHIR related issue in FHIR Github repository

from dicom-server.

@pengchen0692 Thanks alot for your quick update. I am able to fetch data using above URL but I wanted to know how can we check if the data which I have uploaded in DICOM Imaging server has been synced to FHIR server. I have checked the tables in Storage account which doesn't have any logs if DICOM cast is working or not.

from dicom-server.

@venkateshtarra
If you are able to query out the data, would that mean DICOM cast has synced data to FHIR server.

Dicom cast use the storage account to record synchronization state (like how far the synchronization has been done), also exceptions occurred during synchronization (please refer to https://github.com/microsoft/dicom-server/blob/main/docs/concepts/dicom-cast.md)

You can also take a look at log of the DicomCast container instance.

For FHIR related questions, highly recommend to check with FHIR.

from dicom-server.

@pengchen0692 I can query data with your test FHIR URL(https://fhirservicedemo.azurewebsites.net/ImagingStudy?identifier=urn:oid:1.2.276.0.50.192168001099.7810872.14547392.270 ) but not with my FHIR URL.

Just to clarify my issue - I have deployed Dicom Imaging server, FHIR server and Dicom cast by using template provided in github link and I am able to access Dicom Imaging server API & FHIR server API individually from Postman. But the issue is with Dicom cast which is not syncing data from Imaging server to FHIR server. I have checked tables in storage account which is empty and container logs are as below.

[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Creating TableClient instance
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Initializing Table Storage and tables
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Table SyncStateTable already exists
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Table FhirFailToStoreExceptionTable already exists
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Table DicomFailToStoreExceptionTable already exists
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Table TransientFailureExceptionTable already exists
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Table InvalidDicomTagExceptionTable already exists
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Table TransientRetryExceptionTable already exists
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Health.DicomCast.TableStorage.Features.Storage.TableClientInitializer[0]
Table Storage and tables successfully initialized
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Hosting.Lifetime[0]
Application started. Press Ctrl+C to shut down.
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Hosting.Lifetime[0]
Hosting environment: Production
�[40m�[32minfo�[39m�[22m�[49m: Microsoft.Hosting.Lifetime[0]
Content root path: /app

from dicom-server.

Hi @venkateshtarra,
The tables in the storage account for dicom cast actually only store errors when processing data from Dicom server to Fhir server. Dicom-Cast doesn't store the actual images themselves. If you would like to see if all of the imaging studies are in Fhir, you can query all of the imaging studies in Fhir via postman by just doing

https://<service_url>/ImagingStudy

This should return to you all of the imaging studies that are in Fhir.

from dicom-server.

@pengchen0692 @abdullah248 Thanks to both of you for providing some insight about Dicom cast. I found that root cause of issue was authentication as I am trying to use managed identity and docker is not able to authenticate FHIR server. Now data is syncing between Dicom Imaging server and FHIR server after updating authentication to OauthCredentials in keyvault of Dicomcast.

I am closing the issue now. Happy weekend.

from dicom-server.