[HealthSamurai/smartbox#624] document the client-hl7B2b extension - #34
Merged
Conversation
The hl7-b2b organization_id claim is not emitted automatically. Aidbox builds it from a client-hl7B2b extension on the Client plus the referenced Organization's identifier. authentication.md said no configuration was required, and the member-match test datasets still registered Basic-auth clients with Client.details.identifier, which now fail closed with 403. - authentication.md: Organization + Client registration example, sub-extension table with what each part contributes to the token, CARIN BB payerid note, and a "claim missing" checklist. - bulk-member-match, provider-member-match: test datasets split into a /fhir bundle and an Aidbox-endpoint bundle carrying the Clients; examples switched from Basic to Bearer. Auth sections stay at the reference-page size and link to authentication.md for the token request. - payer-to-payer: dropped its copy of the test dataset in favour of a link to the reference page. - provider-access: caller identity comes from the B2B claim, not from Client.details.identifier (interop no longer reads that field). Clients must be written through the Aidbox base endpoint. With BOX_FHIR_CORRECT_AIDBOX_FORMAT enabled, /fhir rewrites the extension's valueReference/valueUri/valueCoding into Aidbox's internal union format, which the token builder does not read, so the token is issued without the claim. Verified against aidboxone:edge with the quickstart settings: the dataset bundles and registration examples were replayed end to end, and the issued JWTs carry the documented claim for client_secret and private_key_jwt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The hl7-b2b organization_id claim is not emitted automatically. Aidbox builds it from a client-hl7B2b extension on the Client plus the referenced Organization's identifier. authentication.md said no configuration was required, and the member-match test datasets still registered Basic-auth clients with Client.details.identifier, which now fail closed with 403.
Clients must be written through the Aidbox base endpoint. With BOX_FHIR_CORRECT_AIDBOX_FORMAT enabled, /fhir rewrites the extension's valueReference/valueUri/valueCoding into Aidbox's internal union format, which the token builder does not read, so the token is issued without the claim. Verified against aidboxone:edge with the quickstart settings: every example on the four pages was replayed end to end, and the issued JWTs carry the documented claim for client_secret and private_key_jwt.