With Postman

[vikram002]

1. What value should the client Id and Scope be while calling the graphir from Postman.
2. Even after receiving the token with the user details from Azure AD; there is still Msal exception being thrown while triggering the request from the Banana POP Ui with valid token values.

[nirzaf]

Client Id should be the App Registration's client Id [Not registered for Client app] and the scope should be {Your FHIR Base URL}/user_impersonation, you can define your own scope instead of user_impersonation.

Make sure you have defined the audience properly

[vikram002]

App Registration complete.
Client App Registration complete.

Postman setup done accordingly; which is mentioned here. Added client id(App registration) .
I get the token now ; however when I pass the same from the Banana Pop UI settings and hit run ; it throws MSAL exception.

IDW10502: An MsalUiRequiredException was thrown due to a challenge for the user. See https://aka.ms/ms-id-web/ca_incremental-consent. ",

The token that I receive has user info but scope of only "scp": "User.Read",. It should have additional values in here right? Where is the miss?

[nirzaf]

Make sure you have defined your scope properly in your API permission under app registration to access the Azure Healthcare API

Is it working if you try to send a query directly from Postman instead of Bananacake Pop?

[vikram002]

Yes , I can do that via postman but not using the banana pop ui.

…

On Thu, 17 Nov 2022 at 2:06 PM, M.F.M Fazrin ***@***.***> wrote: Make sure you have defined your scope properly in your API permission under app registration to access the Azure Healthcare API [image: image] <https://user-images.githubusercontent.com/18024930/202396394-c5339fdc-a9d1-4056-a16a-2328c60f3d23.png> Is it working if you try to send a query directly from Postman instead of Bananacake Pop? — Reply to this email directly, view it on GitHub <#96 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADEOIVTCXI5XR3ETQZA4JLLWIXVB5ANCNFSM6AAAAAASAUPKLI> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[vikram002]

The token which is generated does not have the scope of the GraphAPI - user_impersonation. It only pulls the Microsoft.Graph scopes even after following all the steps mentioned in this repo.

[pjirsa]

@vikram002 double check appsettings.json and make sure the FhirConnection section has the correct scope

"FhirConnection": {
    "BaseUrl": "https://chestist-fhir-api.azurehealthcareapis.com",
    "Scopes": "https://chestist-fhir-api.azurehealthcareapis.com/user_impersonation",
    "UseAuthentication": true,
    "ResultsLimit": "100"
  },

The scope MUST have the same root URL as your FHIR API.
Then, make sure that the app registration used in the AzureAD section includes permissions to "Azure Healthcare Apis" in the API permissions section.