Stream: finnish PHR
Topic: Available scopes
Mikael Rinnetmäki (Sep 22 2018 at 11:40):
The authorization guide at https://www.kanta.fi/documents/20143/91486/PHR+authorization.pdf/9fdb48d0-a6c8-0bc6-10ab-35495ca030b4 lists the available scopes, including patient/Patient.read - Reading the patientresource.
However, that scope is not available in the list of scopes presented by the server. You can add it when registering a client, but it will not get listed in the client configuration. Can someone clarify the status of that scope?
Mikael Rinnetmäki (Sep 22 2018 at 13:26):
My main use case is to verify that the token for a user is valid. I also tried calling https://fhirsandbox2-auth.kanta.fi/phr-authserver-sandbox/userinfo (with the access token in Authorization header, but that did not work either and returned {"error":"No access rights","error_description":"Insufficient access rights for the resource"}.
Mikael Rinnetmäki (Sep 22 2018 at 13:28):
(Yet another option would be to call https://fhirsandbox2-auth.kanta.fi/phr-authserver-sandbox/introspect, but what should I use in Authorization header in this case?)
Mikael Rinnetmäki (Sep 22 2018 at 13:31):
Being able to query information on the current user would have other benefits too. It would enable a client to verify that the name matches an expectation, or to present the name in it's user interface to prevent possible confusion. A client could also check the preferred language, etc., perhaps also communication info.
Last updated: Apr 12 2022 at 19:14 UTC
