FHIR Chat · Clarification of requiring nonce in id_token if provided

Stream: smart

Topic: Clarification of requiring nonce in id_token if provided

David Teirney (Aug 14 2019 at 20:23):

I feel that some clarity is required regarding support for use of a nonce by a SMART on FHIR app.

We've just started testing integration with our solution being launched via SMART on FHIR. We're a confidential app that requires the identity of the user as we present content from our system and the EHR at the same time. We're using a standard OIDC Relying Party as part of our solution, which applies all security best practices - including the use of a nonce. We've had a 0 hit rate for that working so far.

One major EHR vendor has this to say. "The authorization code flow technically doesn't require it to be secure, and the SMART on FHIR specification didn't require it [use of the nonce]".

So, I'm seeking clarification here regarding whether complying with OIDC specification should be considered "par for the course" or whether the HL7 SMART on FHIR specification does need to call out some more things, like support for a nonce. And, as part of that, perhaps have examples that follow security best practices within the specification flow diagrams?

Josh Mandel (Aug 14 2019 at 20:50):

In general we try to point to OIDC rather that re-stating content from OIDC; we only try to specify extra details. But 1) showing best practices in examples, 2) ensuring test suites like Inferno test support, and 3) making any spot edits to content at http://hl7.org/fhir/smart-app-launch/scopes-and-launch-context/index.html#scopes-for-requesting-identity-data all seem worthwhile.

Josh Mandel (Aug 14 2019 at 20:51):

At the very least it'd be good to capture issues at https://github.com/hl7/smart-app-launch and/or https://gforge.hl7.org/gf/project/fhir/tracker/?action=TrackerItemAdd&tracker_id=677 so that when work begins for a v-next, we don't lose track.

Michele Mottini (Aug 14 2019 at 20:59):

Is support for OIDC (or at least openid profile scopes) now required? It used to be optional...

David Teirney (Aug 14 2019 at 21:24):

As a start I've created https://github.com/HL7/smart-app-launch/issues/295

David Teirney (Aug 14 2019 at 21:27):

@Michele Mottini that's a good question as well. My read of the spec wasn't that it was optional, but rather a SMART on FHIR app could optionally request the openid scope. However, Epic doesn't support OIDC...