Populate the .env file with the security labels ENVs.
.env
# if true, security label feature is enabledBOX_FEATURES_SECURITY__LABELS_ENABLE=true# if true, removes security labels from the resourceBOX_FEATURES_SECURITY__LABELS_STRIP__LABELS=true# Defines the FHIR versionAIDBOX_FHIR_VERSION="4.0.1"...
Define the FHIR version
Populate the .env file with the AIDBOX_FHIR_VERSION ENV variable.
.env
# In this guide we are going to use FHIR 4.0.1 AIDBOX_FHIR_VERSION="4.0.1"...
Start Aidbox with Docker Compose
To start Aidbox run the command in the aidbox-project directory.
dockercomposeup--force-recreate
When Aidbox starts, navigate to the http://localhost:8888 and sign in to the Aidbox UI using the credentials admin / password.
Ensure the security labels access control works
Create TokenIntrospector
To make Aidbox trust JWT issued by external server token introspection is used, run the following request in the REST Console.
PUT /TokenIntrospector/security-labels-demo-clientcontent-type:text/yamlresourceType:TokenIntrospectorid:security-labels-demo-clienttype:jwtjwt:iss:https://auth.example.comsecret:secret
Currently we use a common secret to make the introspector works. In production installations it's better to switch to jwks_uri instead.
Create AccessPolicy
This access policy allows FhirRead and FhirSearch operations for requesters having JWT with iss claim value https://auth.example.com.
To create the access policy, run the following request in the REST Console.
PUT /AccessPolicy/as-security-labels-demo-client-do-read-searchcontent-type:text/yamlresourceType:AccessPolicyid:as-security-labels-demo-client-do-read-searchlink:- resourceType:Operationid:FhirRead- resourceType:Operationid:FhirSearchengine:matchomatcho:jwt:iss:https://auth.example.com
Populate data samples
Create Patient resource
To create the Patient, run the following request in the REST Console.
PUT /fhir/Patient/pt-1content-type:text/yamlmeta:security: - code:PROCESSINLINELABELsystem:http://terminology.hl7.org/CodeSystem/v3-ActCode - code:Msystem:http://terminology.hl7.org/CodeSystem/v3-Confidentialityname: - use:officialgiven: - Peter - Jamesfamily:Chalmersextension: - url:http://hl7.org/fhir/uv/security-label-ds4p/StructureDefinition/extension-inline-sec-labelvalueCoding:code:CTCOMPTsystem:http://terminology.hl7.org/CodeSystem/v3-ActCodedisplay:care team compartmentgender:male_gender:extension: - url:http://hl7.org/fhir/uv/security-label-ds4p/StructureDefinition/extension-inline-sec-labelvalueCoding:code:RESCOMPTsystem:http://terminology.hl7.org/CodeSystem/v3-ActCodedisplay:research project compartment - url:http://hl7.org/fhir/uv/security-label-ds4p/StructureDefinition/extension-inline-sec-labelvalueCoding:code:CTCOMPTsystem:http://terminology.hl7.org/CodeSystem/v3-ActCodedisplay:care team compartmentidentifier: - use:usualtype:coding: - code:MRsystem:http://terminology.hl7.org/CodeSystem/v2-0203value:Z12345system:urn:oid:1.2.36.146.595.217.0.1extension: - url:http://hl7.org/fhir/uv/security-label-ds4p/StructureDefinition/extension-inline-sec-labelvalueCoding:code:FMCOMPTsystem:http://terminology.hl7.org/CodeSystem/v3-ActCodedisplay:financial management compartmentid:pt-1resourceType:Patient
Create Encounter resource
To create the Encounter, run the following request in the REST Console.
PUT /fhir/Encounter/enc-1content-type:text/yamlresourceType:Encounterid:enc-1meta:security: - code:PROCESSINLINELABELsystem:http://terminology.hl7.org/CodeSystem/v3-ActCode - code:Lsystem:http://terminology.hl7.org/CodeSystem/v3-Confidentialitystatus:finishedclass:system:http://terminology.hl7.org/CodeSystem/v3-ActCodecode:IMPsubject:reference:"Patient/pt-1"extension: - url:http://hl7.org/fhir/uv/security-label-ds4p/StructureDefinition/extension-inline-sec-labelvalueCoding:code:CTCOMPTsystem:http://terminology.hl7.org/CodeSystem/v3-ActCodedisplay:care team compartment
Create Observation resource
To create the Observation, run the following request in the REST Console.
PUT /fhir/Observation/obs-1content-type:text/yamlresourceType:Observationid:obs-1meta:security: - code:PROCESSINLINELABELsystem:http://terminology.hl7.org/CodeSystem/v3-ActCode - code:PSYsystem:http://terminology.hl7.org/CodeSystem/v3-ActCodestatus:finalcode:coding: - system:http://loinc.orgcode:15074-8subject:reference:"Patient/pt-1"
JWT for requests
There are two users and two JWTs that we will use:
To view the content of a JWT, copy and paste it to jwt.io
Check resource-level access control works
Provider's access to the Patient
status: 200 OK
GET /fhir/Patient/pt-1Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzY29wZSI6Imh0dHA6Ly90ZXJtaW5vbG9neS5obDcub3JnL0NvZGVTeXN0ZW0vdjMtQ29uZmlkZW50aWFsaXR5fFIgaHR0cDovL3Rlcm1pbm9sb2d5LmhsNy5vcmcvQ29kZVN5c3RlbS92My1BY3RDb2RlfFBTWSBodHRwOi8vdGVybWlub2xvZ3kuaGw3Lm9yZy9Db2RlU3lzdGVtL3YzLUFjdENvZGV8Q1RDT01QVCJ9.7QZ65gtJPjiWVYjtvtuatvhq6262Sth3z4un_8rDdQg
Provider has access to the Patient because there is overlap between the Patient labels and the Provider labels.
GET /fhir/Encounter/enc-1Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzY29wZSI6Imh0dHA6Ly90ZXJtaW5vbG9neS5obDcub3JnL0NvZGVTeXN0ZW0vdjMtQ29uZmlkZW50aWFsaXR5fFIgaHR0cDovL3Rlcm1pbm9sb2d5LmhsNy5vcmcvQ29kZVN5c3RlbS92My1BY3RDb2RlfFBTWSBodHRwOi8vdGVybWlub2xvZ3kuaGw3Lm9yZy9Db2RlU3lzdGVtL3YzLUFjdENvZGV8Q1RDT01QVCJ9.7QZ65gtJPjiWVYjtvtuatvhq6262Sth3z4un_8rDdQg
Provider has access to the Encounter because there is overlap between the Encounter labels and the Provider labels.
GET /fhir/Observation/obs-1Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzY29wZSI6Imh0dHA6Ly90ZXJtaW5vbG9neS5obDcub3JnL0NvZGVTeXN0ZW0vdjMtQ29uZmlkZW50aWFsaXR5fFIgaHR0cDovL3Rlcm1pbm9sb2d5LmhsNy5vcmcvQ29kZVN5c3RlbS92My1BY3RDb2RlfFBTWSBodHRwOi8vdGVybWlub2xvZ3kuaGw3Lm9yZy9Db2RlU3lzdGVtL3YzLUFjdENvZGV8Q1RDT01QVCJ9.7QZ65gtJPjiWVYjtvtuatvhq6262Sth3z4un_8rDdQg
Provider has access to the Observation because there is overlap between the Observation labels and the Provider labels.
GET /fhir/Patient/pt-1Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzY29wZSI6Imh0dHA6Ly90ZXJtaW5vbG9neS5obDcub3JnL0NvZGVTeXN0ZW0vdjMtQ29uZmlkZW50aWFsaXR5fE0gaHR0cDovL3Rlcm1pbm9sb2d5LmhsNy5vcmcvQ29kZVN5c3RlbS92My1BY3RDb2RlfFJFU0NPTVBUIn0.j7WY0I0s2rl6T2Bje1gadRKquuSf-_K9JH1T3T0vvcE
Finance has access to the Patient because there is overlap between the Patient labels and the Finance labels.
GET /fhir/Encounter/enc-1Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzY29wZSI6Imh0dHA6Ly90ZXJtaW5vbG9neS5obDcub3JnL0NvZGVTeXN0ZW0vdjMtQ29uZmlkZW50aWFsaXR5fE0gaHR0cDovL3Rlcm1pbm9sb2d5LmhsNy5vcmcvQ29kZVN5c3RlbS92My1BY3RDb2RlfFJFU0NPTVBUIn0.j7WY0I0s2rl6T2Bje1gadRKquuSf-_K9JH1T3T0vvcE
Finance has access to the Encounter because there is overlap between the Encounter labels and the Finance labels.
GET /fhir/Observation/obs-1Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJodHRwczovL2F1dGguZXhhbXBsZS5jb20iLCJzY29wZSI6Imh0dHA6Ly90ZXJtaW5vbG9neS5obDcub3JnL0NvZGVTeXN0ZW0vdjMtQ29uZmlkZW50aWFsaXR5fE0gaHR0cDovL3Rlcm1pbm9sb2d5LmhsNy5vcmcvQ29kZVN5c3RlbS92My1BY3RDb2RlfFJFU0NPTVBUIn0.j7WY0I0s2rl6T2Bje1gadRKquuSf-_K9JH1T3T0vvcE
Finance does not have access to the Observation because there is no overlap between the Observation labels and the Finance labels.