SMART on FHIR Token Introspection Endpoint

build/jobs/e2e-tests.yml

@@ -60,6 +60,8 @@ steps:
       'app_globalReaderUserApp_secret': $(app_globalReaderUserApp_secret)
       'app_globalWriterUserApp_id': $(app_globalWriterUserApp_id)
       'app_globalWriterUserApp_secret': $(app_globalWriterUserApp_secret)
+      'app_smartUserClient_id': $(app_smartUserClient_id)
+      'app_smartUserClient_secret': $(app_smartUserClient_secret)
       'AZURESUBSCRIPTION_CLIENT_ID': $(AzurePipelinesCredential_ClientId)
       'AZURESUBSCRIPTION_TENANT_ID': $(AZURESUBSCRIPTION_TENANT_ID)
       'AZURESUBSCRIPTION_SERVICE_CONNECTION_ID': $(AZURESUBSCRIPTION_SERVICE_CONNECTION_ID)

build/jobs/provision-deploy.yml

@@ -80,7 +80,7 @@ jobs:
             numberOfInstances = 2
             serviceName = $webAppName
             keyVaultName = "${{ parameters.keyVaultName }}".ToLower()
-            securityAuthenticationAuthority = "https://login.microsoftonline.com/$(tenant-id)"
+            securityAuthenticationAuthority = "https://sts.windows.net/$(tenant-id-guid)"
             securityAuthenticationAudience = "${{ parameters.testEnvironmentUrl }}"
             additionalFhirServerConfigProperties = $additionalProperties
             enableAadSmartOnFhirProxy = $true

src/Microsoft.Health.Fhir.Api.OpenIddict/Extensions/DevelopmentIdentityProviderRegistrationExtensions.cs

@@ -97,6 +97,8 @@ public static IServiceCollection AddDevelopmentIdentityProvider(this IServiceCol
                             "/AadSmartOnFhirProxy/token");
                         options.SetAuthorizationEndpointUris("/AadSmartOnFhirProxy/authorize");
 
+                        // Note: Introspection endpoint is handled by TokenIntrospectionController, not OpenIddict
+
                         // Dev flows:
                         options.AllowAuthorizationCodeFlow();
                         options.AllowClientCredentialsFlow();

src/Microsoft.Health.Fhir.Api/Features/Filters/ValidateFormatParametersAttribute.cs

@@ -38,40 +38,48 @@ public override async Task OnActionExecutionAsync(ActionExecutingContext context
 
             HttpContext httpContext = context.HttpContext;
 
-            _parametersValidator.CheckPrettyParameter(httpContext);
-            _parametersValidator.CheckSummaryParameter(httpContext);
-            _parametersValidator.CheckElementsParameter(httpContext);
-            await _parametersValidator.CheckRequestedContentTypeAsync(httpContext);
-
-            // If the request is a put or post and has a content-type, check that it's supported
-            if (httpContext.Request.Method.Equals(HttpMethod.Post.Method, StringComparison.OrdinalIgnoreCase) ||
-                httpContext.Request.Method.Equals(HttpMethod.Put.Method, StringComparison.OrdinalIgnoreCase))
+            if (!ShouldIgnoreValidation(httpContext))
             {
-                if (httpContext.Request.Headers.TryGetValue(HeaderNames.ContentType, out StringValues headerValue))
+                _parametersValidator.CheckPrettyParameter(httpContext);
+                _parametersValidator.CheckSummaryParameter(httpContext);
+                _parametersValidator.CheckElementsParameter(httpContext);
+                await _parametersValidator.CheckRequestedContentTypeAsync(httpContext);
+
+                // If the request is a put or post and has a content-type, check that it's supported
+                if (httpContext.Request.Method.Equals(HttpMethod.Post.Method, StringComparison.OrdinalIgnoreCase) ||
+                    httpContext.Request.Method.Equals(HttpMethod.Put.Method, StringComparison.OrdinalIgnoreCase))
                 {
-                    if (!await _parametersValidator.IsFormatSupportedAsync(headerValue[0]))
+                    if (httpContext.Request.Headers.TryGetValue(HeaderNames.ContentType, out StringValues headerValue))
+                    {
+                        if (!await _parametersValidator.IsFormatSupportedAsync(headerValue[0]))
+                        {
+                            throw new UnsupportedMediaTypeException(string.Format(Api.Resources.UnsupportedHeaderValue, headerValue.FirstOrDefault(), HeaderNames.ContentType));
+                        }
+                    }
+                    else
                     {
-                        throw new UnsupportedMediaTypeException(string.Format(Api.Resources.UnsupportedHeaderValue, headerValue.FirstOrDefault(), HeaderNames.ContentType));
+                        // If no content type is supplied, then the server should respond with an unsupported media type exception.
+                        throw new UnsupportedMediaTypeException(Api.Resources.ContentTypeHeaderRequired);
                     }
                 }
-                else
+                else if (httpContext.Request.Method.Equals(HttpMethod.Patch.Method, StringComparison.OrdinalIgnoreCase))
                 {
-                    // If no content type is supplied, then the server should respond with an unsupported media type exception.
-                    throw new UnsupportedMediaTypeException(Api.Resources.ContentTypeHeaderRequired);
-                }
-            }
-            else if (httpContext.Request.Method.Equals(HttpMethod.Patch.Method, StringComparison.OrdinalIgnoreCase))
-            {
-                if (httpContext.Request.Headers.TryGetValue(HeaderNames.ContentType, out StringValues headerValue))
-                {
-                    if (!await _parametersValidator.IsPatchFormatSupportedAsync(headerValue[0]))
+                    if (httpContext.Request.Headers.TryGetValue(HeaderNames.ContentType, out StringValues headerValue))
                     {
-                        throw new UnsupportedMediaTypeException(string.Format(Api.Resources.UnsupportedHeaderValue, headerValue.FirstOrDefault(), HeaderNames.ContentType));
+                        if (!await _parametersValidator.IsPatchFormatSupportedAsync(headerValue[0]))
+                        {
+                            throw new UnsupportedMediaTypeException(string.Format(Api.Resources.UnsupportedHeaderValue, headerValue.FirstOrDefault(), HeaderNames.ContentType));
+                        }
                     }
                 }
             }
 
             await base.OnActionExecutionAsync(context, next);
         }
+
+        private static bool ShouldIgnoreValidation(HttpContext httpContext)
+        {
+            return httpContext.Request.Path.StartsWithSegments("/CustomError", StringComparison.OrdinalIgnoreCase);
+        }
     }
 }