appsettings.json

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  },

  "UdapMetadataOptions": {

    "UdapVersionsSupported": [ "1" ],
    "UdapProfilesSupported": [ "udap_dcr", "udap_authn", "udap_authz", "udap_to" ],
    "UdapAuthorizationExtensionsSupported": [ "hl7-b2b" ],
    "UdapAuthorizationExtensionsRequired": [ "hl7-b2b" ],
    "ScopesSupported": [ "openid", "system/*.read", "user/*.read", "patient/*.read" ],
    "UdapCertificationsSupported": [ "http://MyUdapCertification", "http://MyUdapCertification2" ],
    "UdapCertificationsRequired": [ "http://MyUdapCertification" ],
    "GrantTypesSupported": [ "authorization_code", "refresh_token", "client_credentials" ],

    "UdapMetadataConfigs": [
      {
        "Community": "udap://fhirlabs.net",
        "SignedMetadataConfig": {
          "Issuer": "https://fhirlabs.net/fhir/r4",
          "Subject": "https://fhirlabs.net/fhir/r4",
          "AuthorizationEndPoint": "https://securedcontrols.net:5001/connect/authorize",
          "TokenEndpoint": "https://securedcontrols.net:5001/connect/token",
          "RegistrationEndpoint": "https://securedcontrols.net:5001/connect/register"
        }
      },
      {
        "Community": "udap://expired.fhirlabs.net/",
        "SignedMetadataConfig": {
          "Issuer": "https://fhirlabs.net/fhir/r4",
          "Subject": "https://fhirlabs.net/fhir/r4",
          "AuthorizationEndPoint": "https://securedcontrols.net/connect/authorize",
          "TokenEndpoint": "https://securedcontrols.net/connect/token",
          "RegistrationEndpoint": "https://securedcontrols.net/connect/register"
        }
      },
      {
        "Community": "udap://untrusted.fhirlabs.net/",
        "SignedMetadataConfig": {
          "Issuer": "https://fhirlabs.net/fhir/r4",
          "Subject": "https://fhirlabs.net/fhir/r4",
          "AuthorizationEndPoint": "https://securedcontrols.net/connect/authorize",
          "TokenEndpoint": "https://securedcontrols.net/connect/token",
          "RegistrationEndpoint": "https://securedcontrols.net/connect/register"
        }
      },
      {
        "Community": "udap://Iss.Mismatch.To.SubjAltName/",
        "SignedMetadataConfig": {
          "Issuer": "https://fhirlabs.net/fhir/r4",
          "Subject": "https://fhirlabs.net/fhir/r4",
          "AuthorizationEndPoint": "https://securedcontrols.net/connect/authorize",
          "TokenEndpoint": "https://securedcontrols.net/connect/token",
          "RegistrationEndpoint": "https://securedcontrols.net/connect/register"
        }
      },
      {
        "Community": "udap://Iss.Mismatch.To.BaseUrl/",
        "SignedMetadataConfig": {
          "Issuer": "http://fhirlabs.net/IssMismatchToBaseUrl/r4",
          "Subject": "http://fhirlabs.net/IssMismatchToBaseUrl/r4",
          "AuthorizationEndPoint": "https://securedcontrols.net/connect/authorize",
          "TokenEndpoint": "https://securedcontrols.net/connect/token",
          "RegistrationEndpoint": "https://securedcontrols.net/connect/register"
        }
      },
      {
        "Community": "udap://ECDSA/",
        "SignedMetadataConfig": {
          "RegistrationSigningAlgorithms": [ "ES256", "ES384" ],
          "TokenSigningAlgorithms": [ "ES256", "ES384" ],
          "Issuer": "https://fhirlabs.net/fhir/r4",
          "Subject": "https://fhirlabs.net/fhir/r4",
          "AuthorizationEndPoint": "https://securedcontrols.net/connect/authorize",
          "TokenEndpoint": "https://securedcontrols.net/connect/token",
          "RegistrationEndpoint": "https://securedcontrols.net/connect/register"
        }
      }
    ]
  },


  "UdapFileCertStoreManifest": {
    "Communities": [
      {
        "Name": "udap://fhirlabs.net",
        "Anchors": [
          {
            "FilePath": "CertStore/anchors/SureFhirLabs_CA.cer"
          },
          {
            "FilePath": "CertStore/intermediates/SureFhirLabs_Intermediate.cer"
          }
        ],

        "IssuedCerts": [
          {
            "FilePath": "CertStore/issued/fhirlabs.net.client.pfx",
            "Password": "udap-test"
          }
        ]
      },
      {
        "Name": "udap://expired.fhirlabs.net/",
        "IssuedCerts": [
          {
            "FilePath": "CertStore/issued/fhirlabs.net.expired.client.pfx",
            "Password": "udap-test"
          }
        ]
      },
      {
        "Name": "udap://untrusted.fhirlabs.net/",
        "IssuedCerts": [
          {
            "FilePath": "CertStore/issued/fhirlabs.net.untrusted.client.pfx",
            "Password": "udap-test"
          }
        ]
      },
      {
        "Name": "udap://Iss.Mismatch.To.SubjAltName/",
        "IssuedCerts": [
          {
            "FilePath": "CertStore/issued/fhirlabs.net.mismatchSan.client.pfx",
            "Password": "udap-test"
          }
        ]
      },
      {
        "Name": "udap://Iss.Mismatch.To.BaseUrl/",
        "IssuedCerts": [
          {
            "FilePath": "CertStore/issued/fhirlabs.net.mismatchBaseUrl.client.pfx",
            "Password": "udap-test"
          }
        ]
      },
      {
        "Name": "udap://ECDSA/",
        "IssuedCerts": [
          {
            "FilePath": "CertStore/issued/fhirlabs.net.ecdsa.client.pfx",
            "Password": "udap-test"
          }
        ]
      }
    ]
  },


  "SmartMetadata": {
    "issuer": "https://host.docker.internal:5002",
    "jwks_uri": "https://host.docker.internal:5002/.well-known/openid-configuration/jwks",
    "authorization_endpoint": "https://host.docker.internal:5002/connect/authorize",
    "token_endpoint": "https://host.docker.internal:5002/connect/token",
    "token_endpoint_auth_methods_supported": [
      "udap_pki_jwt", // inform Smart there is a support for UDAP
      "client_secret_basic",
      "private_key_jwt"
    ],
    "grant_types_supported": [
      "authorization_code",
      "client_credentials",
      "refresh_token"
    ],
    // Should be required when token_endpoint_auth_methods_supported contains udap_pki_jwt
    "registration_endpoint": "https://host.docker.internal:5002/connect/register",
    "scopes_supported": [ "openid", "profile", "launch", "launch/patient", "patient/*.rs", "user/*.rs", "offline_access" ],
    "response_types_supported": [ "code" ],
    "management_endpoint": "https://localhost:7074/user/manage", //todo in auth server or EHR?
    "introspection_endpoint": "https://host.docker.internal:5002/connect/introspect",
    "revocation_endpoint": "https://host.docker.internal:5002/connect/revoke",
    "code_challenge_methods_supported": [ "S256" ],
    "capabilities": [
      "launch-ehr",
      "permission-patient",
      "permission-v2",
      "client-public",
      "client-confidential-symmetric",
      "context-ehr-patient",
      "sso-openid-connect"
    ]
  }
}