Authentication Docker compose

[ale-calzadilla]

Hello! I am trying to add authentication to a fhir server that runs from a Docker Image. I am having 2 issues that I am not sure how to solve and maybe someone can help me. First I have to expose 2 ports to be able to have authentication (8080 for fhir-server and 44348 for token retrieval). And second I have to declare a user: '0:0' in my docker compose to be able to start IdentityServe if not, I get this error:

Unhandled exception. System.UnauthorizedAccessException: Access to the path '/app/tempkey.jwk' is denied.

can somebody help me? Thank you!

[mikaelweave]

Hi @ale-calzadilla! I'd like to understand more about what you are trying to accomplish.

When adding authentication to your FHIR docker environment, are you trying to integrate with another identity provider that has existing users defined or do you want to use the IdentityServer implementation to manually manage authentication inside the scope of the FHIR container?

We use IdentityServer mainly for development and testing and generally recommended an external identity provider.

Thanks!

[ale-calzadilla]

Hi @mikaelweave , thanks for the reply!

For now, I’m mainly trying to get authentication working in my local dev/test setup using the IdentityServer that comes bundled with the Microsoft FHIR Server Docker image.

The main issues I hit are:

Having to expose both 8080 for the FHIR server and 44348 for IdentityServer.

Needing user: '0:0' in docker-compose to avoid the /app/tempkey.jwk permission error.

Even after getting those pieces working, I still can’t authenticate a token successfully. I just want to confirm if this is expected behaviour when using the built-in IdentityServer inside the Docker container, or if I’m misconfiguring something.

My issue is very similar to this:
#3718

[ale-calzadilla]

@mikaelweave I want to use the IdentityServer implementation to manually manage authentication inside the scope of the FHIR container, to make it simple

[evachen96]

Hi @ale-calzadilla ! IdentityServer is used in the Docker image just for local testing. To host the Docker image, please use a OpenID authentication provider, for example Entra ID.

[ale-calzadilla]

Thank you very much