evernorth / hl7-fhir-udap-server Goto Github PK

Currently there is a single OAuth2 authorization service defined by this repository, even though the repository can be used in both a CSP role and additionally in a data holder authorization server role. There is a minimal level of separation between them, with seperate udap well-known metadata endpoints, but ultimately I'd like to see more separation there.

This split was begun with the last PR. This change will extend that, and will additionally extend that separation back into the OAuth2 service (Okta/auth0 to start).

We'll end up with 2 separate /authorization, /token, etc. endpoints, one for the CSP role, and one for the data holder role.

When serving as a dataholder, I currently have no way to route my upstream IDP /token requests through touchstone. To facilitate full end to end tiered-oauth testing, I can add some config that will allow these requests to be proxied through touchstone.