Example Id Token

SMART App Launch
2.2.0-ballot - CI-Build International flag

This page is part of the Smart App Launch Implementation Guide (v2.2.0-ballot: STU 2.2 Ballot 1) based on FHIR (HL7® FHIR® Standard) R4. The current version which supersedes this version is 2.1.0. For a full list of available versions, see the Directory of published versions

Setup
Creating an ID Token (for servers)
Validating and using an ID Token (for clients)

This example demonstrates the creation and validation of an Id Token.

Setup

Python

# !pip3 install python-jose
from Crypto.PublicKey import RSA
import json
import jose.jwk
import jose.jwt
import jose.constants

Create RSA key

To create self-contained example, we’ll generate a new RSA Key for a fake organization called “my-ehr.org”, and we’ll use that for the operations below.

key = RSA.generate(2048)

private = key.exportKey('PEM').decode()
public = key.publickey().exportKey().decode()
print(public, "\n\n", private)

Creating an ID Token (for servers)

Servers will create a signed JWT by following a process like this.

Create a set of claims

These should include:

sub: the user
aud: the app for whom this ID Token is being produced
iss: an identifier for this EHR system)
profile: the absolute URL of the FHIR resource representing the current user

Encode them in a JWT

Signing with the server’s private key

claims = {
  "sub": "alice",
  "aud": "growth-chart-app-123",
  "iss": "https://my-ehr.org/fhir",
  "fhirUser": "https://my-ehr.org/fhir/Practitioner/123"
}


id_token = jose.jwt.encode(
    claims,
    key,
    algorithm='RS384')

print(id_token)

eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzM4NCJ9.eyJzdWIiOiJhbGljZSIsImF1ZCI6Imdyb3d0aC1jaGFydC1hcHAtMTIzIiwiaXNzIjoiaHR0cHM6Ly9teS1laHIub3JnL2ZoaXIiLCJmaGlyVXNlciI6Imh0dHBzOi8vbXktZWhyLm9yZy9maGlyL1ByYWN0aXRpb25lci8xMjMifQ.BuivDG9lOu0mI5ESm2Cl4EoGTW0BFA3N5oPcEX30Q77vxBuMspRd9N6kKLgTj8TsAFAutXKlTztdbbyDsTVcjYRZervUMgfS5gv2ERmTTy6wnWRxcsxA8oCmwJ8nqIz9VztCd73IZ8zvCebnaIwTjqt3r5a1aWNqRftncUa5pA2nN3DezMPrWaQ6U_S-QcyVrS_NznqRzI_2JFXlnLn6xSD6CXAfSHRy-1M2VZA4b6m6K3LXM2Pe_WF8HJ1GCLKLMqvYM0oQGLgy4tpDrDr8T8kxd4nLisIjQoXVjx5kASSaSiEuPYMG5E0h9eeSUZFVG-FvYtkgXF3vKaBJjX40BA

Validating and using an ID Token (for clients)

A client obtains the ID Token as the result of an authorization operation. To validate the token, the client fetches the servers’s public key, and then decodes the token. While decoding the token, the client must verify that the audience (‘aud’) matches its own client_id

jose.jwt.decode(id_token, public, audience='growth-chart-app-123')

{'sub': 'alice',
 'aud': 'growth-chart-app-123',
 'iss': 'https://my-ehr.org/fhir',
 'fhirUser': 'https://my-ehr.org/fhir/Practitioner/123'}

IG © 2020+ HL7 International / FHIR Infrastructure and Boston Children's Hospital Package hl7.fhir.uv.smart-app-launch#2.2.0-ballot based on FHIR 4.0.1. Generated 2023-12-19
Links: Table of Contents | QA Report | Version History | | Propose a change