SMART App Launch v2.2

The platform implements the full SMART App Launch Framework v2.2.

What's implemented

Requirement	Component	Status
EHR launch	Auth Server + Client	✅
Standalone launch	Auth Server + Client	✅
PKCE S256	Both	✅ requireProofKey(true)
Dynamic discovery (/.well-known/smart-configuration)	Auth Server + HAPI Plugin	✅
jwks_uri in discovery	Auth Server	✅
introspection_endpoint	Auth Server	✅
launch-ehr capability	Auth Server	✅
launch-standalone capability	Auth Server	✅
patient, encounter as top-level token response fields	Auth Server	✅
need_patient_banner	Auth Server	✅
RS256 signed access token	Auth Server	✅
OIDC id_token with fhirUser	Auth Server	✅
Token refresh with rotation	Auth Server	✅
SMART scope enforcement (.rs, .read)	HAPI Plugin	✅
IdP federation	Auth Server	✅ Azure AD, Okta, Epic IdP
Consent directives	Consent Manager	⚡ v1.1.0
Backend Services	—	◇ v2.0.0

PKCE implementation

RFC 7636 S256 in the SMART Client:

// 96-byte verifier (768-bit entropy — exceeds spec minimum of 32 bytes)
byte[] verifierBytes = new byte[96];
new SecureRandom().nextBytes(verifierBytes);
String codeVerifier = Base64.getUrlEncoder().withoutPadding()
        .encodeToString(verifierBytes);

// S256 challenge
byte[] digest = MessageDigest.getInstance("SHA-256")
        .digest(codeVerifier.getBytes(StandardCharsets.US_ASCII));
String codeChallenge = Base64.getUrlEncoder().withoutPadding()
        .encodeToString(digest);

Discovery document

{
  "authorization_endpoint": "https://auth.demo.ajsmart.com/oauth2/authorize",
  "token_endpoint":         "https://auth.demo.ajsmart.com/oauth2/token",
  "introspection_endpoint": "https://auth.demo.ajsmart.com/oauth2/introspect",
  "jwks_uri":               "https://auth.demo.ajsmart.com/oauth2/jwks",
  "issuer":                 "https://auth.demo.ajsmart.com",
  "token_endpoint_auth_methods_supported": ["none", "client_secret_basic", "client_secret_post"],
  "capabilities": ["launch-ehr", "launch-standalone", "client-public",
                   "context-ehr-patient", "context-ehr-encounter",
                   "permission-patient", "permission-user", "sso-openid-connect"],
  "code_challenge_methods_supported": ["S256"]
}