Our plan was to have our own db and just use medplum for the hipaa data, but it seems that this dual setup is causing more issues (we cant use the components, for example, because the components assume a direct connectiong to medplum, whereas our current setup connects to our OWN backend which then does the medplum CRUD. We like having our own db because we can then we can model user objects the way we want to add any functionality we want. For example, we can control the login methods if we do auth ourselves. We can add "patient has joined video session" "patient has left video session" etc to track statuses for their video meetings, to automate some actions based on that. Does someone have a recommendation for how to move things so that the client is connected to medplum directly, but we still have our own db users tied to medplum users? For example, is there a way to manually auth a client using our own auth? Some way to let the users log in as they currently do, but our backend returns a token that we can use to auth the medplum provider as a given patient or provider? That could be one solution to keeping our db, but letting the react components work

Our usecases are not 1:1 but a similar approach could work. When users are created in your database, you could also invite them to your medplum project and store the returned

ProjectMembership.id

in your database. Subsequent requests to medplum are proxied through your application server, where auth is validated, then sent to medplum via a

ClientApplication

with the [On-Behalf-Of](https://www.medplum.com/docs/auth/methods/on-behalf-of#:~:text=The%20Medplum%20API%20supports%20an,that%20interacts%20with%20Medplum%20Server.) header of the project membership id. In your react components, the MedplumClient base url is the backend route that proxies to medplum.

Hi @oscadev ! If your existing auth is based on Oauth standard, you could look into using our Token Exchange framework: https://www.medplum.com/docs/auth/methods/token-exchange

in our current setup, we already are programmatically creating medplum users when they sign up to our system, and so already have patient and provider medplumIds, and are already using on-behalf of for CRUD to medplum. Are you saying there is a way with this setup to medplum-auth a user in client so they can query medplum directly as needed? Some sections, we will still want the user to query our server, but in some cases, such as a "questionnaire" page, we could benefit from direct connection in the medplum provider / config, so that we use the questionnaire form react component from medplum

Essentially you have a route in your api

/api/medplum

that [proxies](https://www.npmjs.com/package/http-proxy-middleware) to medplum after validating auth how you normally would. After authenticating through your existing auth mechanism, attach the

x-on-behalf-of header

and client application's

Authorization

token. Your medplum client

baseUrl

would be your own api

https://your-existing-api.com/api/medplum

We are still in the early stages but are using token exchange and it's working nicely. We're doing similar where we're programatically setting up medplum users/patients/practitioners/project memberships when users are created in our db. Then after a user logs via our auth system, we pass the token to the medplum client's token exchange and the medplum server then makes a request to our API to validate the token and then logs the user in. This way we can directly use the medplum client in our UI and don't have to proxy anything. All I had to build on the API side was the token exchange endpoint

Token exchange makes sense for most usecases. We have a technical requirement to send all requests through an identity proxy, meaning we have to use an api gateway model anyway.

On-behalf-of

works well for this.