Adding Authorization to HAPI FHIR: Options for SMART on FHIR Implementation

Details

The post provides a technical deep dive into adding robust, fine-grained authorization capabilities to a HAPI FHIR server beyond basic authentication (AuthN). The core solution involves a three-tiered structure: an Identity Provider for user authentication, an Authorization Server for policy decision-making, and an Access Gateway for enforcement. Keycloak is identified as the primary tool for both AuthN and AuthZ. Several architectural options are detailed, catering to different needs. These include using the FHIR Info Gateway (Option 1), leveraging serverless environments like Knative or OpenFaaS (Option 2), or implementing advanced controls such as Relationship-Based Access Control (ReBAC) via a dedicated proxy (Option 3). Furthermore, an implementation based on Spring Cloud Gateway is presented (Option 4). These options guide developers in achieving secure and interoperable access to FHIR resources, adhering to standards like SMART on FHIR. The article serves as a comprehensive technical blueprint for enhancing the security posture of HAPI FHIR deployments.