Azure FHIR Proxy using Postman - 401 Authentication failed.

Question

I have created azure API for fhir server and added MS open source smart on fhir proxy on it.
I followed every step of this doc. https://github.com/microsoft/fhir-proxy/blob/v2.0/docs/setup.md

I can successfully retrieve the capability statement for my fhir server using a proxy URL(I don't want to expose my fhir server).

I'm using postman to retrieve the patient resource, but I"m getting 401 error station authetication failed.

I have fhir server named standalonetestingeastus2, a smart client named sfp-proxy3237-smart4-client, and a proxy as sfp-proxy3237.azurewebsites.net.

I'm generating an access token using this information. In auth URL I'm passing the Application ID of my client app sfp-proxy3237-smart4-client.(I also tried with the App ID of my proxy still no luck). I have added roles for my client app in azure fhir server standalonetestingeastus2 (FHIR DATA CONTRIBUTOR). I added it for both user and the app.

When I retrieve the patient resource and use the access token generated by above info I'm getting 401 error(Authetication failed). Note: for this request body is empty

These are my two applications in the enterprise balde.

These are the roles that I assigned in fhir server for my app and user.

API Permissions for my client.(sfp-proxy3237-smart4-client)

Scopes for the client.

These are app roles for the client.

API permission for proxy.

Scopes for proxy

App role for the proxy

I'm trying this since last week and still no luck. I will really appreciate your help. Thanks in advanced!

Answer 1

Hey I think your problem is the wrong client is assigned the FHIR Contributor role on the FHIR Server. So from the IAM blade for standalonetestingus2 fhir server, remove the role assignment for sfp-proxy3237-smart4-client then add the FHIR Data Contributor role to sfp-proxy3237.azurewebsites.net function app principal that should do it....

There have also been several updates to the v2 branch so make sure you pull the latest and follow the instructions in the script deployments and use MSI that should automatically add the data contributor role during installation.

-Steve O.