This is great! How are current clients handling custom schema requirements? For basic stuff I can see extensions working. Are current clients adding tables to the medplum db?

Thank you! Right now, clients are mostly sticking to the FHIR specification, and adding extensions as necessary. We view our DB schemas as an implementation detail to power the API based workflows, but not something directly exposed to client applications

Ok, let’s say I had some AI features that required very specific db schemas. What’s the “medplum” way of handling that? In other words, what’s the best way to handle data that won’t conform to fhir?

Most often, customers customers will use a separate data warehouse for training / testing AI models. We describe this briefly in our analytics docs. https://www.medplum.com/docs/analytics#machine-learning--predictive-modeling In their pipelines, they often flatten the FHIR data and use the Bulk export API

Sorry... Pivoting back to the multi-tenant concept... I've setup a self hosted medplum in aws and I've been messing around with the super admin... Is there a way to list all projects? If I wanted to use my own IDP It would be associated to a clientapplication which is associated to a single project... What would be the best way to handle creating new projects when someone logs in with my IDP?

Yup https://$baseurl/Project on the medplum app will show all the projects

What does registering and creating a new project look like in the context of a 3rd party IDP?

Really depends on your use case. If you have partnerships or referral patterns - compartments + access policies might be a good idea https://www.medplum.com/docs/auth/access-control#healthcare-partnerships

Thanks for all your help so far, sorry to keep bombarding you with questions... I want to utilize an IDP that supports multiple tenants (frontegg.com). With medplum it seems that external auth is only associated to a single project... It seems like I may need to setup my auth provider hooks to create the project and user, but at that point how would I authenticate the user in medplum?

We do support global external auth at a domain level. For example everyone at the medplum.com domain must use Okta - that's a common Enterprise configuration. This is across all projects. Is that what you want to do?

correct... The flow would be... redirect to external idp, authorize -> return to medplum -> create user and project if they don't exist.

Got it. This is might be the documentation that you want to look at https://www.medplum.com/docs/auth/custom-welcome-emails - and I'm assuming here that end users are on some kind of custom app like "alansapp.com" which is distinct from your self-hosted medplum app - am I right?

Thanks. I’m not sure how this would work for an existing user and project though. (Again using frontegg)

Here's a sample repo, at a high level: 1) Configure frontegg along lines of https://github.com/medplum/medplum-client-external-idp-demo#setup 2) Setup your Medplum account and client app in a project 3) Attempt "Login" https://github.com/medplum/medplum-client-external-idp-demo/blob/main/src/main.ts#L69

This goes back to only being at the client level (single project). Frontegg returns a tenant for each user. I imagine that I couldn’t create a new project from the client of another project, right?

If the client had super admin credentials you could ... though it seems unconventional

Just the initial user for each company

Ahh, I see - so you are looking for "Register" via external auth

Could I use a super admin api token to create the resources via a hook of sorts from the frontegg side?

in theory yes - but it does not have a lot of mileage or testing for that use case

Oooohhh… I like that idea

Stripe bot has relevant webhook related pattern for reference https://github.com/medplum/medplum-demo-bots/tree/main/src/examples/stripe-bots

Awesome thank you

sorry about that - likely that bot is too sandboxed to be able to do that. This is possible from API - as customers do clone projects as part of their CI/CD for example.