Security

The Open Immunize IMS may operate a series of services spread across multiple load-balanced servers. In order to communicate authentication information (known as a Security Principal) between requests and servers, Open Immunize leverages claims based tokens.

In this architecture an access control service (ACS) receives token requests from a client application. Such token requests contain information for which the client is requesting authorization. This can include:

 

After validating this information the ACS will issue a new token (SAML, SWT, JWT, etc.) which it signs with a private key. The ACS may attach other claims to the token such as expiry time, issue time, policies for which the principal is allowed access.

The client interface then uses this bearer token to communicate with other IMS services such as FHIR, etc. The token may is validated using the ACS’ public key. The IMS can then perform further operations including restricting access to full or partial resources.

image