Cerner/Oracle Health sandbox access and adapter validation

[slusset]

Summary

Apply for Cerner's FHIR sandbox at fhir.cerner.com and validate the CernerFHIRAdapter against it.

Steps

1. Register at fhir.cerner.com for sandbox access
2. Obtain client_id/client_secret for system-level OAuth2
3. Run CernerFHIRAdapter integration tests against sandbox
4. Document Cerner-specific FHIR quirks (reference formats, supported resources)

Acceptance criteria

• Successful OAuth2 client_credentials auth against Cerner sandbox
• Observation.Create succeeds via CernerFHIRAdapter
• Integration tests added to tests/integration/test_cerner_fhir_adapter.py

[IlyasFardaouix]

I think the root cause of the issue might be related to the client_credentials auth flow, as it requires a system-level client_id/client_secret. Could you confirm if the client_id/client_secret obtained in step 2 is being used correctly in the CernerOAuth2Auth class, specifically in the get_token() method?

[slusset]

I checked the current Cerner auth implementation in this repo.

get_token() itself is only handling token caching and refresh timing. The actual client_id / client_secret usage happens in authenticate(), which POSTs to the configured token endpoint with grant_type=client_credentials and sends the credentials via HTTP Basic auth (auth=(self.client_id, self.client_secret) in httpx). That is the expected pattern for a standard system-level client credentials flow.

So based on the code as written, the credentials are being used in the right place; they are just not used directly inside get_token().

The remaining thing we have not validated yet is runtime wiring: I do not currently see repo code that instantiates CernerOAuth2Auth with the sandbox values from step 2, so we still need to confirm that the actual Cerner sandbox client_id, client_secret, token endpoint, and scope are being passed in correctly at execution time. If auth is failing, I would suspect one of those configuration details before get_token() itself.

If useful, next step I can add a small integration test or config example once sandbox credentials are available.

[IlyasFardaouix]

Je pense que tu as raison IlyasFardaouix, et que l'authentification client_credentials est bien implémentée dans la classe CernerOAuth2Auth. Cependant, pour confirmer que les client_id/client_secret obtenus dans l'étape 2 sont utilisés correctement, je suggère de vérifier si la méthode authenticate() est appelée avec les bons valeurs pour self.client_id et self.client_secret juste avant l'appel à httpx. Cela nous aidera à identifier si le problème se produit avant ou après l'appel à httpx.