New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

backend service capabilities not reflected in .well-known/smart-configuration #63

Open

mzbik opened this issue Feb 1, 2022 · 0 comments

mzbik commented Feb 1, 2022

Notably, for backend service auth, the HL7 spec states (http://hl7.org/fhir/smart-app-launch/client-confidential-asymmetric.html#discovery-requirements) that backend services must advertise support for asymmetric keys in .well-known/smart-configuration by:

Including "client-confidential-asymmetric"
token_endpoint_auth_methods_supported that include private_key_jwt
token_endpoint_auth_signing_alg_values_supported include at least one of RS384 and ES384

Retrieving the smart-configuration:

Does not include (1), above
Does not include (2), above
Does not include (3), above.

And, yet, the flow from the DSTU2 example javascript seems to work fine...

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment