Stop Writing Authorization Code for Your FHIR-based App: A Solution Using SMART Scopes and Keycloak

Details

Developing healthcare applications often faces significant challenges in implementing authorization logic for multiple user types and varying access levels. Traditionally, this required building custom middleware, complex query filters, and separate API endpoints—a process that resulted in a time-consuming 'nightmare' of maintenance and testing whenever requirements changed (e.g., 100+ unit tests). The proposed solution combines two standards: SMART on FHIR V2 scopes and Keycloak composite roles. Developers can define specific access ranges using query parameters, such as `user/Observation.rs?category=laboratory&status=final` (e.g., only finalized lab results). In this setup, Keycloak resolves the user's role (e.g., Physician or Lab Technician) into an access token, and the Aidbox FHIR server enforces these rules. This allows a single API endpoint (e.g., GET /fhir/Observation) to automatically and dynamically control the dataset returned based on the caller's permissions. This approach eliminates the need for maintaining custom authorization code, achieving both high security and flexibility while drastically reducing development effort. It represents an advanced implementation example of data access control built upon established standards (SMART on FHIR V2).