AllAccepted answers
Enrico Parisi · Dec 14, 2023

Personally I usually prefer to assign permissions to Web Applications and assign to the users only the role necessary to use the application.

Often I don't need/want the user itself to have direct access to resources (i.e. database, tables//classes etc.), what I want is the ability for the user to access/use the Web Application (the FHIR server in this case), then the application itself has the required privilege.

In short, I don't what the user to be authorized to mess with the "internal" stuff...just use the application.

Of course this is a matter of preferences and use case scenario.

Enrico

Enrico Parisi · Dec 13, 2023

My guess is that the user does not have enough privilege (role/resource permissions) to access your FHIR server, maybe the database resource?

If so, you have two options:

1) add to the user the required role(s) with proper access to the required resource(s)
2) add to the Web Application the required role(s) with proper access to the required resource(s)

Personally I would prefer option 2.
Just for testing, try to temporary %All role to the Web Application and see if it works.

Enrico

Enrico Parisi · Dec 12, 2023

Using correct length of 16 characters for IV and 32 characters key.

This Javascript:

var iv = CryptoJS.enc.Hex.parse("00000000000000000000000000000000");
var stringyouWantToEncrypt = "HelloWorld";
var base64Key = "RXJjb2xpbm9zZW1wcmVpbnBpZWRpMDEyMzQ1Nzg5MDE=";
var encrypted = CryptoJS.AES.encrypt(
    stringyouWantToEncrypt,
    CryptoJS.enc.Base64.parse(base64Key),
    {
        iv: iv,
    }
)

And this ObjectScript:

Set text="HelloWorld"
Set IV=$c(0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
Set KEY = "RXJjb2xpbm9zZW1wcmVpbnBpZWRpMDEyMzQ1Nzg5MDE="
Set KEY=$SYSTEM.Encryption.Base64Decode(KEY)
Set text=$ZCONVERT(text,"O","UTF8")
Set sCrypt=$SYSTEM.Encryption.AESCBCEncrypt(text,KEY,IV)
Set sToken=$SYSTEM.Encryption.Base64Encode(sCrypt)
Write !,!, "Encoded -> "_sToken

Both return the same:

Encoded -> 2s4qbUJC6romvsp7TP2L4A==

Enrico

Enrico Parisi · Dec 12, 2023

Ciao Barbara,

In your JS code:

var iv = CryptoJS.enc.Hex.parse("0000000000000000");

Convert the HEX sequence to a string, the resulting string made of 8 characters, all with ascii value of zero.
In AES, IV *must" be 16 characters long, I have no idea how your JS library handle this invalid value, IRIS correctly returns an error if IV is not 16 characters long.
The sample in the page you linked uses an IV made of 16 characters, converted from an HEX sequence.

In addition, you are passing to $SYSTEM.Encryption.AESCBCEncrypt() the KEY encoded in base64, in JS th base 64 KEY is decoded before use, so it should be:
Set sCrypt=$SYSTEM.Encryption.AESCBCEncrypt(text,$SYSTEM.Encryption.Base64Decode(KEY),IV)

Moreover, as Ralf pointed out, make sure the key is 16, 24, or 32 characters long

Ciao,
Enrico

Enrico Parisi · Dec 8, 2023

Outstanding article, congratulations Kurro! 👏

Just one note on base64 conversion.
In fact you don't need to worry about the base64 conversion, all you need is to set ContentTransferEncoding to "base64" and then %Net.MIME* will take care of it, including adding the header "Content-Transfer-Encoding: base64" in the mime part header.

So, all you need is:

set content.ContentTransferEncoding = "base64"
set content.Body = pImage ; pImage is binary stream

Enrico

Enrico Parisi · Dec 7, 2023

I think to remember (I might be wrong) that Service Unavailable error can be caused by a license limit and using csp pages/application can consume license slots quickly due to the sessions not being cleared and license grace period.

Maybe you are using IRIS Community Edition (limited number of connections/license), if so, try to restart and see if it works right after restart.

You may also check in Management Portal in System Operation -> License usage

Again, I'm guessing! I might be wrong.

Enrico

Enrico Parisi · Dec 6, 2023

I would create my "custom" datatype extending %Library.DateTime:

Class Community.dt.CustomDateTime Extends %Library.DateTime
{

ClassMethod LogicalToXSD(%val As %TimeStamp) As %String [ ServerOnly = 1 ]
{
    Set %val=##class(%Library.TimeStamp).LogicalToXSD(%val)
    Quit $translate(%val,"TZ"," ")
}

ClassMethod XSDToLogical(%val As %String) As %TimeStamp [ ServerOnly = 1 ]
{
    Set $e(%val,11)="T"
    Quit ##class(%Library.TimeStamp).XSDToLogical(%val)
}

}

Then in your class define your property as:

Property OPDT As Community.dt.CustomDateTime;

Are you sure you really need %Library.DateTime and not %Library.TimeStamp?
The difference is the JDBC/ODBC format. From the documetation:

%DateTime is the same as %TimeStamp (is a sub-class or %TimeStamp) with extra logic in the DisplayToLogical and OdbcToLogical methods to handle imprecise datetime input T-SQL applications are accustomed to.

If you prefer using %Library.TimeStamp, then change the superclass in my sample code.

After that:

USER>Set reader = ##class(%XML.Reader).%New()
 
USER>Set sc=reader.OpenString("<NewClass2><OPDT>2023-11-30 11:07:02</OPDT></NewClass2>")
 
USER>Do reader.CorrelateRoot("Samples.NewClass2")
 
USER>Do reader.Next(.ReturnObject,.sc)
 
USER>Do ReturnObject.XMLExport(,",indent")
<NewClass2>
  <OPDT>2023-11-30 11:07:02</OPDT>
</NewClass2>
 
USER>Write ReturnObject.OPDT
2023-11-30 11:07:02
USER>

Enrico

Enrico Parisi · Dec 5, 2023

You have setup your REST Web application "Allowed Authentication Method" as "Unauthenticated", therefore your REST code/application runs under the "UnknownUser" account/user.

My guess is that the UnknownUser user does not have enough privilege (Role(s)) to run your code.
If this is just a private, isolated test system, try adding %All role to the UnknownUser user account.

Enrico

Enrico Parisi · Dec 5, 2023

"CALL returns an empty result"

How did you determine that? After that 3 lines, run this:

For  {Set rset=sqlResult.%NextResult() q:rset=""  do rset.%Display() Write !}

I get:

1 Row Affected
1 Row Affected
1 Row Affected
1 Row Affected
name    age     home_city
Jorge   32      Tampa
Enrico  29      Turin
Dan     25      Miami
Alexy   21      London
 
4 Rows(s) Affected

You may want to check the documentation:

Returning Multiple Result Sets

Enrico