Skip to content

Commit

Permalink
Merge branch 'main' of https://github.com/IHE/ITI.BasicAudit
Browse files Browse the repository at this point in the history
  • Loading branch information
JohnMoehrke committed Oct 20, 2022
2 parents 94e04a1 + 3032c1b commit 67dfffd
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion input/pagecontent/content.md
Original file line number Diff line number Diff line change
Expand Up @@ -102,7 +102,7 @@ There are three patterns defined: opaque, minimal, and comprehensive.

Given that IHE has the [IUA Profile](https://profiles.ihe.net/ITI/IUA/index.html), and has [Security Audit Considerations](https://profiles.ihe.net/ITI/IUA/index.html#37251-security-audit-considerations), the AuditEvent specification here will focus on IUA interactions. The profiling AuditEvent defined here is the AuditEvent that the Client and Server would record when using [IUA](https://profiles.ihe.net/ITI/IUA/index.html) with the [ITI TF-2: 3.72 Incorporate Access Token \[ITI-72\]](https://profiles.ihe.net/ITI/IUA/index.html#372-incorporate-access-token-iti-72) to secure some RESTful transaction. The RESTful transaction is not defined here, just the additional AuditEvent element details that would be added to the AuditEvent for the RESTful transaction being secured (see [RESTful activities](content.html#3573-restful-activities) for general purpose logging).

The [IUA](https://profiles.ihe.net/ITI/IUA/index.html) Profile is used here as a proxy for all oAuth specifications. [IUA](https://profiles.ihe.net/ITI/IUA/index.html) is used here because IHE has direct access and has defined fields. The Minimal AuditEvent pattern defined here is not the same as the one defined in [IUA](https://profiles.ihe.net/ITI/IUA/index.html), mostly due to the more expressive and coded nature of the FHIR AuditEvent fs the DICOM AuditMessage.
The [IUA](https://profiles.ihe.net/ITI/IUA/index.html) Profile is used here as a proxy for all oAuth specifications. [IUA](https://profiles.ihe.net/ITI/IUA/index.html) is used here because IHE has direct access and has defined fields. The Minimal AuditEvent pattern defined here is not the same as the one defined in [IUA](https://profiles.ihe.net/ITI/IUA/index.html), mostly due to the more expressive and coded nature of the FHIR AuditEvent vs. the DICOM AuditMessage.

The Client and Server are both encouraged to log an AuditEvent covering any security relevant event, and to enhance that AuditEvent with one of the following patterns when an oAuth token is associated with authorizing (or forbidding) the event.

Expand Down

0 comments on commit 67dfffd

Please sign in to comment.