Service client application to MS Fhir

Question

im not sure in what end i shall start this question but basically im lost in the jungle of authentication for my MS Fhir server that i setup in Azure.

What i want to achive is to register a client application that can be "trusted" or authorize user to the fhir server. I have been reading all of the documentation but i just cant get the different pieces together. What i have done so far:

*Register a client application according to this documentation: https://learn.microsoft.com/en-us/azure/healthcare-apis/register-service-azure-ad-client-app. I have troubles understanding how the roles work here.

*Tried to use Postman to get a token by this guide:https://learn.microsoft.com/en-us/azure/healthcare-apis/access-fhir-postman-tutorial but i always get "audiance invalid".

*Switched on the 'Status' under 'Identity' for my application to get a Object Id that i then passed in the Fhir server allowed object Id. Then tried to get a token again. Still "audiance invalid".

Right now i just find my self trying all sort of small things to get this to work with no success. Im thinking of deleting my ms fhir server and start from scratch (again).

My hopes is that someone can help me by simple writing what i need to do and in what order to get this to work, since im obviously to much of a rookie to understand that based on the documentation provided by Micrsoft.

Sorry if my "question" is a bit diffuse, but i have spent hours trying to get this to work with zero success.

Answer 1

Since the problem seems to be the audience perhaps see if maybe this comment could assist you

"If you keep the Audience for the FHIR service as https://azurehealthcareapis.com then you do not need to create a separate resource application. That one already exists in your AAD tenant. If you create a new resource application with the URI of the FHIR service (and there are good reasons to do that, e.g. to use SMART on FHIR), then you need to change the Audience of the FHIR service to match the URI of your app registration. They have to match."

also this

I got it to work by keeping the Audience in FHIR and the URI resource application consistent - https://[myservice].azurehealthcareapis.com. Only caveat, the Audience in the FHIR service is read-only. I had to delete the resource group and recreate.

taken from https://github.com/MicrosoftDocs/azure-docs/issues/38285 and also see another thread that seems to also have a similar suggestion, https://github.com/MicrosoftDocs/azure-docs/issues/30483