Replies: 3 comments 2 replies
-
|
Thanks for this write-up @tonylee80 . Would love suggestions and thoughts on this, as I write out the steps I’m taking towards completing this, which will turn into incremental tasks to completing the feature of multiple FHIR server connections on the CLI. @codyebberson we spoke briefly on this today, will like to start creating the tasks associated with each step towards completion.
|
Beta Was this translation helpful? Give feedback.
-
|
Original recommendations: Alternate recommendation: |
Beta Was this translation helpful? Give feedback.
-
|
Following up on this, when a user runs This feature should streamline the process and improve user experience, reducing the extra step for manual logins every time a profile is created. Also, it keeps the process aligned with the principle of maintaining an active and valid authentication token per profile in the CLI context. Looking forward to hearing thoughts about this |
Beta Was this translation helpful? Give feedback.
-
Hmmmm.... I'm unsure on this. I think this has risk of surprising the user, and that's not great. If we want to combine "setup profile" and "login" into a single command, then I propose that we just use the "login" command. |
Beta Was this translation helpful? Give feedback.
-
|
Got it, just so we're aligned here, if we have "login" command, if the --profile flag is used should we use that as the profileName being set? e.g |
Beta Was this translation helpful? Give feedback.
-
RFC: Auth SDK/CLI -
Status: Draft
Problem
The usage of Medplum CLI commands with options to specify auth flows can often become verbose and challenging to read.
medplum bulk export -e Group/all --base-url https://sandbox.bcda.cms.gov --fhir-url-path api/v2/ --token-url https://sandbox.bcda.cms.gov/auth/token --client-id {{BCDA Client ID}} --client-secret {{BCDA Client Secret}}To support different authentication types, it is necessary to add additional options such as grant type, client assertion type, scopes, redirect URI, and code.
The authentication types are:
Goals
The following goals should be achieved with the proposed changes:
Proposed Changes
Medplum SDK
The MedplumClient has become large and complex, with approximately 3,000 lines of code. To improve maintainability and readability, break down the client into logical components.
/adminand/auth.@medplum/client- ExtractMedplumClientand directly related utilities fromcoreMedplum CLI
CLI: Add a global option
--auth-typeto explicitly specify the type of authorization used.authTypeas an option.Profiles (config options?)
Replaces the need to enter several command line options
Stores command line options.
Manage multiple client accounts and FHIR servers.
medplum profile set <profileName> <property> <value>: Sets the specified profile with associated options.medplum profile unset <profileName> <property>: Unset the specified profile property.medplum profile delete <profileName>: Deletes the specified profile and logs out profile if it’s being usemedplum profile list: Lists all available profiles.medplum profile describe <profileName>: Describes the details of a specific profile.medplum login --profile <profileName>: Logs in using the specified profile.medplum whoami: Displays the details of the current logged-in and optional profile.medplum login with profiles
Storage: Modify the
~/.medplum/credentialsfile to include a new property called "profiles."{ "logins": [ { "accessToken": "e........", "project": { "reference": "Project/d2c65e1e-793b-4faa-b3a3-b0b2e8b1f847", "display": "Massachusetts Sample Data" }, "profile": { "reference": "Practitioner/2fdb088d-5080-4237-a118-fdeeb1e84f1a", "display": "Tony Lee", "name": "medplum-prod" } }, { "accessToken": "e........", "project": { "reference": "Project/d2c65e1e-793b-4faa-b3a3-b0b2e8b1f847", "display": "Massachusetts Sample Data" }, "profile": { "reference": "Practitioner/2fdb088d-5080-4237-a118-fdeeb1e84f1a", "display": "Tony Lee", "name": "medplum-staging" } }, { "accessToken": "e........", "project": { "reference": "Project/d2c65e1e-793b-4faa-b3a3-b0b2e8b1f847", "display": "Massachusetts Sample Data" }, "profile": { "reference": "Practitioner/2fdb088d-5080-4237-a118-fdeeb1e84f1a", "display": "Tony Lee" } }, { "profile": { "name": "bcda" } "accessToken": "e.......", }, { "profile": { "name": "example" } "accessToken": "*accesstoken*", } ], "activeLogins":{ "profile": { "name": "example" } "accessToken": "*accesstoken*", }, "profiles":{ "bcda": { "baseUrl": "https://sandbox.bcda.cms.gov", "fhirPath": "api/v2", "tokenUrl": "https://sandbox.bcda.cms.gov/auth/token", "clientId": "*clientId*", "clientSecret": "*clientSecret*", "authType": "basic" }, "example": { "baseUrl": "https://example.com", "fhirPath": "r4", "tokenUrl": "https://example.com/oauth2/token", "clientId": "*clientId*", "privateKey": "*localfile.pem*", "authType": "jwt-assertion" }, "medplum-staging": { "baseUrl": "https://staging.api.medplum.com", "clientId": "*clientId*", "clientSecret": "*clientSecret*", "authType": "basic" }, "medplum-prod": { "baseUrl": "http://api.medplum.com", "clientId": "*clientId*", "clientSecret": "*clientSecret*", }, } }Questions
Should profile be required?
What happens if the profile is not specified?
Is there a default profile?
Benefits of a default profile
No default
-Encourage users to create profiles.
Would an interactive CLI tool be helpful?
Create a profile
Login (inspired by Github CLI)
Should profiles considered to be only used for auth/global options? Could profiles be flexible enough for non auth use cases?
References
Medplum SDK enhancements to determine Auth and Client types #2191
CLI Profiles: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html#cli-configure-files-using-profiles
Beta Was this translation helpful? Give feedback.
All reactions