Hi all, we have a use case where we need to login to our Medplum app from an Epic SMART on FHIR launch - so our Medplum front end needs to end up with 2 access tokens: 1. Epic access token for FHIR queries 2. Medplum access token for backend APIs Configuring Epic as an IdP and calling

exchangeExternalAccessToken()

seems like the way to go but the only problem is the

/userinfo

endpoint is not required as part of the spec, and Epic does not support it (neither does the official

smarthealthit.org

test harness). The only thing I can think of is to create a reverse proxy for that URL that introspects the token to provide the response (the introspection endpoint is more widely supported). Has anyone else launched Medplum from an EHR and logged-in the user? Or any other ideas on how to implement this? Any help would be great! Thanks -Simon

Hi @simonj , I have not seen this exact use case before, launching Medplum from another EHR where the user is logged in. That being said, it is not that different from a standard pattern where you want to maintain your medplum token and external idp's token. I think that in the longer term, we hope to add a workaround to allow `exchangeExternalAccessToken()`to work with IDPs that don't support

/userinfo

, but for now your proxy approach seems like a viable workaround

Thanks @finnbergquist good to know! We were testing today and running a little auth service to go from

userinfo

to the introspection endpoint looks like a good option - also allows us to provision a new user if they don't already exist.