2

As explained here, you have to register your FHIR API with Azure AD in order to make calls to the API.

Azure AD is free for Single Sign-On for up to 10 apps: https://azure.microsoft.com/en-us/pricing/details/active-directory/

Q: Given a scenario where I have more than 10 FHIR APIs accessed through a single Web platform by multiple users, do I need to assign an account for each actor and pay $6 user/month(Premium P1)?

Or could I have a single account that is used to make calls to the APIs and authenticate the actors through another method? If you have hundreds of users it is pretty expensive to pay 6$ for each just for authentication.

Do I understand Azure AD correctly? Is there any other better method?

Mark Amery
  • 143,130
  • 81
  • 406
  • 459
Chris
  • 6,105
  • 6
  • 38
  • 55
  • 1
    One approach could be, creation of service principal account per each actor (through app registration in AAD) & providing oid to your FHIR API. – Yusubov Oct 17 '19 at 01:07
  • @ELYusubov This sounds interesting. Could you please elaborate it as an Answer and also provide some documentation sources? – Chris Oct 17 '19 at 06:59
  • Cant you use 10 different roles for the app, and then assign each of them to a specific group of users in your tenant ?In that case having a single azure AD app is sufficient I guess – biswpo Oct 21 '19 at 16:19
  • @biswpo I guess this could be a possible solution. – Chris Oct 23 '19 at 07:59

1 Answers1

2

Answer: No. It's very likely you can get away with less than 10 app registrations without losing the ability to authorize each individual user. The only limit you should be worried about is the 500,000 object limit.

Explanation: The concept of App Registration is well explained here, and I won't make an attempt to do a better job.

The key thing in the context of this question is that you can use the same App Registration with as many "applications" as you want. The only consequence is that you won't be able to assign different permissions to each of those applications.

From your question is not very clear what "10 APIs" mean.

In the simplest case, you have 10 different endpoints hosted under the same application, in which case the solution is trivial: use a single app registration with as many "app roles" as necessary to control access as granularly as you need/supported by FHIR.

Worst case, you have 10 applications hosted independently, in which case you can still use the app manifest to create as many app roles as necessary, most likely using some prefixing: app1_admin, app1_readonly, app2_readonly, etc. Then use those app roles to grant permissions to your endpoints.

See this documentation about how to create app roles in your app manifest.

A picture is worth more than a thousand words. This one should illustrate how you can use the same App Registration for as many applications as you wish.

Same App Registration used by multiple applications

Rodolfo Grave
  • 1,148
  • 12
  • 24