Loading JSON bundles to Azure API for Fhir using FhirLoader: Request Failed with Forbidden Error

Suhan, Mohammed 1

Hello,

I am new to Azure API for Fhir. Need some information on loading Synthea bundles to Fhir Server. I used JSON template azuredeploy-importer.json which is available in github and deployed the template. Now when copy the JSON bundles to the container (fhirimport), it does not load. The function is able to read the file but not able to load. It gives an error after the file is read : "Request Failed with Forbidden" as below image. Can you please help.

Anurag Sharma 17,591 Reputation points

2021-01-18T07:47:24.247+00:00

Hi @Suhan, Mohammed , welcome to Microsoft Q&A forum.

Are you following any document/article to achieve the requirement. If yes could you please share it?
Suhan, Mohammed 1 Reputation point

2021-01-18T07:53:16.83+00:00

Hi @AnuragSharma-MSFT , thanks for responding.

I am following https://github.com/microsoft/fhir-server-samples/tree/master/src/FhirImporter
Anurag Sharma 17,591 Reputation points

2021-01-19T04:15:41.633+00:00

Thanks @Suhan, Mohammed for providing the link.

I have reached out to internal product team and escalated the issue, will be reverting back at the earliest they respond back.
Suhan, Mohammed 1 Reputation point

2021-01-19T14:08:53.13+00:00

Thanks @AnuragSharma-MSFT. Please let me know, if you get any response.

Regards,
Suhan
Anurag Sharma 17,591 Reputation points

2021-02-08T05:17:36.053+00:00

@Suhan, Mohammed , just wanted to follow up on this thread. Could you please mark the answer as accepted if it helped.

1 answer

Benjamin Xue 1 Reputation point

2021-01-19T16:37:05.707+00:00

The data importer in the sample is an Azure Function. It uses an application client (service principal) to access the FHIR service and write data to it. Because the importer was able to read json files in Storage as shown in the error msg, it is likely that the error was resulted from lack of access permission.

Find the application client first from the deployment out, or from the Azure portal, Azure Active Directory. Check if the importer Azure function has been granted with the globalAdmin role through the Azure AD and Application Registration user interface, or the FHIR Data Contributor role through the FHIR service interface in Azure. Note that if the application client is in a different tenant than the tenant for the FHIR service, you can use the first option to grant the globalAdmin role.
Please sign in to rate this answer.
Jipping, Michael 1 Reputation point

2021-01-23T01:18:04.207+00:00

@Suhan, Mohammed how did you resolve this issue? We are experiencing this exact problem.

@Benjamin Xue global admin isn’t an option for us. So are you saying on the functionapp to enable “identity” and assign the “fhir contributor” role to
It. ? Or do you mean something else. Any and all help is greatly appreciated. We are working on this for our upcoming demo to leadership.

Thank you all.

Benjamin Xue 1 Reputation point

2021-01-23T19:04:25.797+00:00

@Jipping, Michael If you are using the importer Azure Function with Azure API for FHIR service (managed service), make sure that the client application has been assigned access permission such as globalAdmin role.

https://github.com/microsoft/fhir-server/blob/main/docs/Register-Client-Application.md

The sample apps use the globalAdmin role, which is an application specific role, not an Azure subscription role. The FHIR service also supports Azure RBAC roles such as FHIR Data Contributor, which you can use instead in your own app.

https://learn.microsoft.com/en-us/azure/healthcare-apis/register-confidential-azure-ad-client-app
https://learn.microsoft.com/en-us/azure/healthcare-apis/configure-azure-rbac

Note: The easy way to deploy the sample apps is to follow the steps at https://github.com/microsoft/fhir-server-samples. Install the latest PowerShell version (e.g. 4.7.0 or higher). To find your installed version, run this command: Get-InstalledModule -Name Az -AllVersions

Jipping, Michael 1 Reputation point

2021-01-24T04:02:44.89+00:00

@Benjamin Xue Thank You for the information, this is helpful. I see your reference to the global admin role in the app registration. Does this need to be a service or confidential client registration? We currently have a Public Client Registration for postman and an iOS app.

Is a global admin role the only option for the function app to work. We limit the users with global admin rights in general. Does Assigning glbadmin in the app registration differ from assigning glbadmin to say a user ? Sorry for the questions, I know our directory services will be concerned with the global admin role I just hope assigning it in an app registration is different than assigning it to a person from a security aspect.

Thanks again. I’m also available via email. If so I can write you a message.

Mike

Benjamin Xue 1 Reputation point

2021-01-24T18:10:23.597+00:00

@Jipping, Michael Public client application is the right choice for your iOS app, where specify the client id, authority, and the FHIR service url. As documented, you can grant the client app with FHIR Data Contributor role or other role from the Portal, and don't have to use globalAdmin (assuming the Azure API for FHIR service is used). When a user logs in to the iOS mobile app, the mobile app is authenticated with Azure Active Directory under the login user credential (based on the user_impersonation permission granted to the client app) but it uses the assigned role to access the FHIR service (authorization). However, your app still needs to manage what data the end user can (or cannot) access.

For Postman, you use a confidential client app, and specify the reply url in the client app registration, https://www.getpostman.com/oauth2/callback.

I will see if we can get connected via LinkedIn and follow up with email as you suggested.

Jipping, Michael 1 Reputation point

2021-01-24T18:26:37.477+00:00

@Benjamin Xue Thank You
Sign in to comment

Share via

Loading JSON bundles to Azure API for Fhir using FhirLoader: Request Failed with Forbidden Error

1 answer