Hi all. I'm new to the community and currently evaluating the possibility of integrating medplum with our existing platform. I see that your platform has essentially wrapped a typical FHIR system with a User Authentication and Project based functionality by implementing the additional User, Project and ProjectMembership resources. Would there be any issues with using the FHIR API service/persistence functionality without having to define Users for all ( other than any System Admins )?. For example, I'm still interested in defining projects (like in a multi-tenant scenario ) with FHIR practitioners and patients, but want to manage the User auth on our platform. Any guidance is appreciated.

Yup - you can bring your own Auth provider https://www.medplum.com/docs/auth/methods/oauth-auth-code and/or authenticate on behalf of a user.

No, its not an auth provider thing - because that also results in creating User records from what I have seen from my testing. I am asking specifically about can I safely use the medplum platform without creating any User records for the practitioners and patients. It is a different sceario than simply using my own auth provider - which I have already tested successfully.

You can - if you create a Client Application and just user it in a server-to-server capacity that will work https://www.medplum.com/docs/auth/methods/client-credentials However, you won't get all the identity based change tracking, etc - which is a useful feature.

That is what I figured. I was already starting to look at the server-to-server use case but just wanted to confirm that not having the user records would not be a problem. Unlike most of the example applications in your github, which are great BTW, we would not expect our users to log into directly to a medplim based app, so primarily considering to use medplum more like an API based microservice.

the identity will need to be registered with Medplum - but if so yes - on behalf of will work. You might also consider token exchange, the user would be none the wiser at the app level, but it would allow identities to be used. This is especially useful if you have lab/meds integrations which we support, but have certain identity requirements and are not supported across the board with a service account https://www.medplum.com/docs/auth/methods/token-exchange