https://medplum.com logo
Join Discord
Powered by
🔐 Documentation for External Identity Providers w...
# support
y
Hi, quick question I am wondering if there is any documentation available on how to handle external identity providers when the user has multiple project memberships? https://www.medplum.com/docs/auth/methods/external-identity-providers thanks in advance
trying to achieve somthing similar to ->
Copy code
TypeScript
function handleAuthResponse(response: LoginAuthenticationResponse): void {
    if (response.code) {
      medplum.processCode(response.code).catch(console.error);
    }
    if (response.memberships) {
      // TODO: Handle multiple memberships
      // In a real app, you would present a list of memberships to the user
      // For this example, just use the first membership
      medplum
        .post('auth/profile', {
          login: response.login,
          profile: response.memberships[0].id,
        })
        .then(handleAuthResponse)
        .catch(console.error);
    }
@https://github.com/medplum/medplum/blob/550d4d4745de99ccd22096fa3866a5211d635d1e/examples/medplum-react-native-example/src/Home.tsx but in the context of @https://next-auth.js.org/configuration/providers/oauth#using-a-custom-provider
r
So the IDP follows the Project Membership - and the Client Application will be linked to a specific Project https://www.medplum.com/docs/auth/methods/external-identity-providers Is it possible to specify client application and project ID in the application?
y
Thanks a lot, indeed that works well when my users have only one membership, but if I attach multiple memberships I get redirected to the medplum client application 
/signin
to select the correct membership instead of back to my application. I would like to be able to handle that on my side so I can either attach the first membership or prompt the user to select one. ps: I am using self hosted application
from what i can see the redirection happens in that endpoint -> https://github.com/medplum/medplum/blob/0d07d77eea58c98fbd1d6bb0e9c2b1b56003624e/packages/server/src/auth/external.ts I think because I have multiple membership I do not pass that condition ->
Copy code
TypeScript  
if (login.membership && body.redirectUri && client?.redirectUri) {
And my redirectUrl gets set using 
appBaseUrl
Copy code
TypeScript
  const redirectUrl = new URL(signInPage, getConfig().appBaseUrl);
https://github.com/medplum/medplum/tree/main/examples/medplum-nextauth-demo basically like in that example but with user that have multiple memberships and Auth0
r
Hi @ysael , in general we don't support users with multople memberships to the same project. I can break certain assumptions in our login code paths. I'm very sorry for the inconvenience for this, buit there might be anotehr way to achieve the same authentication goals
y
Thanks for your response, Is there a recommended way to handle this use case: - AccessPolicy is created using Parameterized Policies so it only have access to the resources associated with his organization, but is part of multiple organization and would be able to switch between them without having to create a new user/login.
Copy code
JSON
{
  "resourceType": "AccessPolicy",
  "id": "123",
  "name": "Parameterized Access Policy",
  "resource": [
    {
      "resourceType": "Patient",
      "criteria": "Patient?organization=%provider_organization"
    },
    {
      "resourceType": "DiagnosticReport",
      "criteria": "DiagnosticReport?performer=%provider_organization"
    }
  ]
}
when looking at this code in the medplum app I was under the impression that we would be able to add a form to select the desired membership ->
message
``... to the same project` that is most likely the part where I made the wrong assumption
r
@ysael , does your company operate as an MSO (Managed service organization)? @finnbergquist has an example app coming soon that demonstrates how to use AccessPolicies
You can check out this PR for a sneak prview: https://github.com/medplum/medplum/pull/6148
y
@rahul1 @finnbergquist That is very useful, thanks a lot! 🙏 We have a very similar AccessPolicy using 
_compartment
to restrict access to resources within an organization, and indeed we could call our project a "Managed Service Organization." I just read the code from the PR and have a few questions: - For a non-admin Practitioner who can view and select patients from multiple organizations: - What is the best way to determine the organizations they have access to? (For now, I was thinking of using the 
auth/me
endpoint and deriving those from the AccessPolicy.resource array.) - We are also considering adding 
_compartment
as a search parameter to our request depending on the organization that the user has selected. Is this the best way to do it?
f
Hi @ysael 👋 What is the best way to determine the organizations they have access to? (For now, I was thinking of using the auth/me endpoint and deriving those from the AccessPolicy.resource array.) Yes, that is one way to do it. Or you could get the ProjectMembership for that non-admin Practitioner and look at the Organization references in the access array. We are also considering adding _compartment as a search parameter to our request depending on the organization that the user has selected. Is this the best way to do it? Not sure if I understand. Is this search for Organizations? Can you send what you have for the request now?
y
Copy code
Yes, that is one way to do it. Or you could get the ProjectMembership for that non-admin Practitioner and look at the Organization references in the access array.
Good to hear!
Copy code
Not sure if I understand. Is this search for Organizations? Can you send what you have for the request now?
as a non-admin that have access to multiple organization once the organization is selected I do:
Copy code
bash
curl 'https://api.medplum.com/fhir/R4/Patient?_compartment=Organization/[SelectedOrganization]' \
  -H 'authorization: Bearer $ACCESS_TOKEN' \
  -H 'content-type: application/fhir+json'
Thanks again for the help! That is much appreciated!
f
@ysael Yea that would work, you can see that is exactly what I did in the example app as well to get the Patients enrolled in a selected Organization
183 Views
PreviousNext
Powered by