Setting up self-hosted environment for client testing

[FlixCoder]

Hi!

I am developing a FHIR client library and I wanted to test the client with multiple servers, including Medplum. I have a docker setup to spin up the different servers and get rid of them after testing. However, I am struggling to integrate medplum into the setup:
The medplum server docker container spins up the API only, not the app, and that is great. I cannot find out how to authenticate against it though. I found out there are default credentials for an admin account, but I struggle to find out how to use them.

Also is there even access to FHIR resources without creating a project first? In that case I would need a script to set up the server with a project, a client and their association. After that I could use the token endpoint to get an access token and begin using the FHIR API. For creating the project I need to authenticate too though. So I ended up in circles, how do I get access to a FHIR API to test the easiest? :D

Thank you in advance!

[codyebberson]

Hi @FlixCoder

Note: The easiest way to get started would be to simply run the Medplum app. But this is an interesting question, so here is the long answer!

It is possible to do everything via API. There are a couple of hurdles. The main challenge is that Medplum email/password auth requires PKCE, so we will need to send a couple non-obvious parameters.

To get an access token via email/password entirely by API:

1. POST to /auth/login to get an authorization code:

curl 'http://localhost:8103/auth/login' \
  -X POST \
  -H 'Content-Type: application/json' \
  --data-raw '{"email":"admin@example.com","password":"medplum_admin","codeChallengeMethod":"plain","codeChallenge":"my_challenge"}'

The response will include a login ID and an authorization code:

{"login":"...","code":"123"}

2. POST to /oauth2/token to get an access token:

Make sure the code_verifier param is the same as the codeChallenge param in step 1.

Make sure the code param is the same as the code from the response in step 1.

curl 'http://localhost:8103/oauth2/token' \
  -H 'content-type: application/x-www-form-urlencoded' \
  --data-raw 'grant_type=authorization_code&code=123&code_verifier=my_challenge'

This response will include an access token:

{
  "token_type": "Bearer",
  "expires_in": 3600,
  "scope": "openid",
  "id_token": "...",
  "access_token": "..."
}

That should open everything up.

Caveats:

1. If your server is on the open internet, be sure to change your credentials immediately.
2. That access token is for the "super admin" project, which has access to everything.
3. Super admin can also be used as a FHIR server, so for basic testing you can use it as-is.
4. Or, you can use the super admin credentials to create a new project.

[FlixCoder]

Thanks, this works!
I plan on using this in an automated setup, so the app is not really a viable solution to me. But this is simple enough using the login, it was just difficult to discover the correct second step. The first one I eventually found.
But again, thank you for the elaborate answer! I think this should find its way to the docs somewhere, too. I believe it might be interesting for more people.

[sirewix]

#!/bin/sh

MEDPLUM_URL=${MEDPLUM_URL-http://localhost:8090}

login_code=$( \
  curl -s "${MEDPLUM_URL}/auth/login" \
    -X POST \
    -H 'Content-Type: application/json' \
    --data-raw '{"email":"admin@example.com","password":"medplum_admin","codeChallengeMethod":"plain","codeChallenge":"my_challenge"}' \
    | jq -r .code
)

curl -s "${MEDPLUM_URL}/oauth2/token" \
  -H 'content-type: application/x-www-form-urlencoded' \
  --data-raw "grant_type=authorization_code&code=${login_code}&code_verifier=my_challenge" \
  | jq -r .access_token