We're building a multitenant application (B2B2C). We are grouping each clinic that we work with under their own project within our medplum self-hosted instance. However, we want all practitioners regardless of project to be able to log in from a single frontend website (example.com). A lot of the auth flows from github examples I've seen rely on

clientIds

or

projectIds

in environment variables, however in our case each project would have its own client applications, which I'm not sure how we'd know the ids prior to them logging in 1. Would this be an appropriate use of the

startLogin

call? This would allow us to simply authenticate server-scoped users via email/password. This should be fine for our providers. 2. What about project-scoped users like patients? If we also wanted all of our patients to be able to log in to a single frontend website (a different one than our providers), where they all may belong to different underlying projects, how would we do this without knowing the

projectId

or

clientId

? TLDR, how can we log in all users through a single frontend application (example.com) if they all are organized in different projects within medplum?

This is supported and Provider App (example hosted on provider.medplum.com) shows how to do it https://github.com/medplum/medplum/tree/main/examples/medplum-provider Here's the Signin react component https://github.com/medplum/medplum/blob/main/examples/medplum-provider/src/pages/SignInPage.tsx The user will be prompted to "Choose Profile"

Does this work for patient login though? @reshma Just email/password sign-in with no client id or project id? I got the impression from this thread with @rahul1 that for patients that isn't supported: https://discord.com/channels/905144809105260605/1175914500445192232/1175914500445192232

You mentioned you wanted all Practitioners to log in to a single app - that is supported. Not for patients though.

Is there any work around for retrieving the correct Id for patients? The use case is a home exercise app that providers onboard patients onto. We don't want to have to provide a unique app for each clinic, we'd want all patients to be able to download a single application and log-in.

Hi @Deleted User , since patient users are scoped within projects, you will need to specify a client_id or project_id for their login. If you'd like patients to have a single record across mulitple clinics, I'd suggest you use a single project, with access policies to separate out clinic access

Thanks for the reply @rahul1! If we want to maintain the stricter separation of resources that having separate projects provides, could we actually share a client_id or project_id with patients as part of onboarding? My understanding is that these are safe to expose, so we could use them as a sort of access code, right? Could be totally wrong about the safety there, so let me know

Yep, those are safe to share