Hello Support Team! We’re considering adopting Medplum as our primary authentication solution for our application. During our review of your documentation, we noticed that Medplum supports using external Identity Providers (IdPs) alongside your native authentication flow. We’d like to understand the use cases and potential benefits of this approach. Specifically: 1. What are the key advantages of using an external IdP with Medplum compared to Medplum’s built-in authentication and session management? 2. Does integrating an external IdP affect session management (e.g., cookies or token handling) or impact how Medplum handles MFA and security workflows? 3. Are there scenarios where using an external IdP is recommended, such as for single sign-on (SSO) across other systems or for managing external user accounts? Right now, we are using custom auth but our primary goals are to implement a secure and streamlined authentication experience with support for 2FA and future FHIR-based integrations. Any guidance or best practices you can share would be greatly appreciated.

Hello @jaevin9035 - welcome! Medplum supports both our own authentication solution and bringing in external IdPs - which you noted in your post, and hopefully I can shed some light on the use cases. In many medical apps and health record systems there are four major groups of users, each of which may have good reason to have their own IdP. They are : Practitioners, Referring Providers or partners, Patients and Applications. 1. Medplum IdP is useful in that it is built in and works right away. It's also an implementation of SMART-on-FHIR authentication, which is a requirement for certified EHRs. It also has robust support for Client Applications which are often needed for integration jwt authentication and basic auth which have their own use cases. 2. Using an external IdP means that that IDP manages the password policies, 2FA and the like, Medplum counts on the external IDP to do that when it is used. 3. External IdP is very useful if you have other applications needed by staff and want SSO, for patient identities if you want to segment them, and to enable access by partners - so there are a lot of use cases. It can be useful for compliance reasons as well. If you use Medplum, you can progressively support adding multiple IdPs for different groups.