Business User Workflow

The business user uses the user ID and password configured in the Identity service to generate the OAuth access token.

In the business user workflow, during creation of a role, you configure the attributes by providing the GroupPolicy URL and latest version with the piped operator in the grouppolicy attribute. The GroupPolicy is checked if any RolePermisson is associated with the GroupPolicy URL and version provided in the grouppolicy attribute. Then the GroupPolicy allows the user to access the FHIR resources and perform the RESTful interactions defined by the RolePermission referenced in the GroupPolicy.

To configure the authorization to enable the business user workflow, you must perform the following steps:

Define a role collection. For more information, see Define a Role Collection.

Note

To create a new role collection, you must have a subaccount admin role.
Create a role using the HealthData_Authorization_BusinessUser_DesignTime role template. For more information, see SAP Health Data Services for FHIR Preshipped SAP BTP Role Templates.
Assign role collection to users or user groups. For more information, see Assigning Role Collections to Users or User Groups.
Generate a valid OAuth access token using the password grant. For more information, see Generating a Valid OAuth Access Token.
Note

If you are using a custom identity provider, you must establish trust between the subaccount and the Identity Authentication service.

While generating an OAuth token using the password grant flow, you must perform any one of the following:
- Pass the parameter login_hint={"origin":"sap.custom"} (URL encoded) in the token request where origin is the Key the Trust Configuration of the subaccount.
- Change the default identity provider to custom identity provider.
For more information, see Establish Trust for Custom Identity Provider.
Configure the granular level authorization by performing the following:
1. Create a RolePermission resource. For more information, see Create a RolePermission.
2. Create a GroupPolicy resource. For more information, see Create a GroupPolicy.
3. Define a new role collection to assign the granular level authorization. For more information, see Define a Role Collection.
4. You must create a role using the Application_User role template. For more information, see Create Roles for Applications Using Existing Role Templates.
  During the creation of a role, in the Configure Attributes tab, perform the following:
  - For the grouppolicy attribute, choose Static from the Source field and enter the GroupPolicy URL and latest version with the piped operator in the Values field.
    
    Example
    
    For the grouppolicy attribute, enter the GroupPolicy URL and version with the piped operator http://sap.com/healthcare/fhir/GroupPolicy/Patient-Group-Policy|1.0.0 in the Values field.
    Note
    
    SAP Health Data Services for FHIR supports the usage of the GroupPolicy name for the grouppolicy attribute. But the recommended approach is to provide the GroupPolicy URL and latest version with the piped operator as the usage of the GroupPolicy name will be deprecated soon.
    
    You can use either GroupPolicy name or GroupPolicy URL and version with the piped operator for the grouppolicy attribute, but not a combination of both.
  - For the institution attribute, choose Unrestricted from the Source field and leave the Values field blank.
5. Assign the new role collection to users or user groups. For more information, see Assigning Role Collections to Users or User Groups.