[Question] How to configure fine-grained authentication and authorization?

[medlab001]

I've set up the PaaS FHIR server on Azure and integrated B2C for user account registration and logins. My app includes self-help portals for patients and portals for Physicians. This means that only physicians that are assigned to patients (with say, an admin account), can read that patient's data. How do I accomplish this?

I tried to setup an API Gateway and inspect URL and body parameters to check Physician and Patient mapping, and conditionally forward requests, but this isn't scaling well. What alternatives do I have? How do I enable this fine grained access controls to each resource on the FHIR server?

Thanks!

[CaitlinV39]

@medlab001 - I realize this question is really old, but right now we don't support this on the FHIR server directly. We recommend using the FHIR proxy available here: https://aka.ms/fhirproxy

[EXPEkesheth]

@medlab001 - Azure B2C integration is supported with FHIR service, please refer to the documentation for more details.
Note this support is available only on Azure Health Data Services.

Fine grained access control, can we achieved using SMART support in AHDS. Please refer to documentation for more details .

[EXPEkesheth]

@medlab001 closing the issue as B2C support is available in FHIR service