SMART on FHIR with Okta - Implementation Template

You must first create an Okta Account and then perform the following steps.

Step one: Create the authorization server in Okta

In Okta, create a custom authorization server (in the Security > API menu) that you'll be using to authorize users in the demo. You can name the server whatever you like:

Step two: Setting up Scopes

Set up the valid SMART authorization scopes in Okta as valid scopes. The following are a few example scopes that can be configured manually:

Step three: Setting up Claims

Given that the bulk of the SMART specification relies on OAuth2 (and supports opaque tokens), there are minimal requirements for setting up claims in Okta.

Only two claims are required for this reference implementation:

• Patient Launch Response Claim Name: launch_response_patient Claim Value: user.patient_id Include with Scope: launch/patient Include in: Access Token
• FHIR User (OpenID Connect Claim) Claim Name: fhirUser Claim Value: 'Patient/' + user.patient_id Include with Scope: fhirUser Include in: ID Token.

Step four: Creating an API Token

1. Create an API Token that will be used for the dynamic registration of a client.
2. Save the API Token value, which will be used as a header parameter to register a new client:

Note: Required documentation and sample request/response for client registration can be found here.

Step five: Setting up an Okta Profile Attribute (Patient ID)

A key requirement of a SMART/FHIR deployment is the ability to associate a patient ID with a user record. To satisfy this requirement, you need an Okta profile attribute that contains a patient ID for each patient user within the system.

In the Okta profile editor:

1. Create a string attribute called "patient_id" by clicking Goto Users > ProfileEditor (see the screenshot below).
2. Click the Profile button and then add a new Attribute ‘Patient Id’: