Client API Browser

Multi-Factor Authentication User Guide

Client API Integrations

If you have built any custom integrations that use the REST API and require automatic, programmatic access, most likely you will want to exclude the user tied with the integration from MFA. No additional development is needed. See Excluding Users from MFA. If your custom integration still interacts with the user, you can elect to handle the multifactor signatures and codes manually. Because of the nature of multifactor authentication, Basic HTTP Auth is not supported when MFA is enabled. Instead invoke the /users/_login and /users/_logout endpoints to perform session-based auth. Using the TOTP API Integration Using the TOTP API integration. Using the Duo API Integration Using the Duo Universal API Integration Using the Duo Universal API integration Parent topic: Limitations of MFA

Multi-Factor Authentication User Guide

Web Dashboard

Logging into the Web Dashboard with an MFA-enabled user is not yet supported. However, if the user is excluded from MFA, then that user will still be able to login here. Web Dashboard Sign In Panel Parent topic: Limitations of MFA

Multi-Factor Authentication User Guide

Excluding Users from MFA

You may have users that need to be able to authenticate without going through MFA. For example, a custom integration against the REST API. An administrator can exclude users from the MFA settings tab. MFA Required column for users in Multi-Factor Authentication Settings section This is available in both TOTP and Duo modes. Note that in the case of Duo, you can also set a user to "bypass" mode in the Duo Admin Panel. The user will be able to login without using a secondary device. However since communication still needs to be made to Duo even in bypass mode, depending on the integration you may need to exclude the user here on the MFA settings tab instead.

Multi-Factor Authentication User Guide

Limitations of MFA

When multi-factor authentication is enabled, certain features in Mirth® Connect by NextGen Healthcare are currently not supported. In future improvements to this extension, NextGen Healthcare will add this support where applicable. Web Dashboard Client API Browser Client API Integrations

Mirth® Connect by NextGen Healthcare User Guide

Mirth® Connect REST API

The Administrator and Command Line Interface both use a well-defined API to communicate with the Mirth® Connect server. You can also use the same API to create custom integrations of your own. The API is documented at https://localhost:8443/api (change the IP / port as needed), or you can select View Client API in Administrator via Other Tasks: Select the View Client API action to open the API documentation in your default browser. Note: You may see a warning in your browser if your Mirth® Connect instance is still using the auto-generated self-signed certificate. You can select Advanced and allow the browser to continue to the page. To resolve this warning, look at Application Data Directory for instructions on installing your own certificate. Select the arrow button on one of the endpoint group rows to view its operations. This list shows the operation's HTTP method type, request URL, and a description for each endpoint. Select on one of the endpoint rows to view its details. If desi

Mirth® Connect by NextGen Healthcare User Guide

Authentication

Mirth® Connect supports both session-based cookie authentication and basic authentication. Basic Authentication: Simply include an Authorization header on all API requests, with basic credentials. Example (for admin/admin): Authorization: Basic YWRtaW46YWRtaW4= Session-Based Authentication: First, invoke the POST /users/_login endpoint, passing in your login credentials. If successful, the server will respond with a cookie (Set-Cookie header) like the following: Set-Cookie: JSESSIONID=uysqrtx9lle36ernybizstps;Path=/api;Secure Invoke the actual API endpoints of your choice, passing in the same cookie as a header: Cookie: JSESSIONID=uysqrtx9lle36ernybizstps;Path=/api;Secure Once you are done, make sure to call the POST /users/_logout endpoint, making sure to pass in the same cookie. Session-based Authentication is preferred since you only need to transmit your login credentials once. Note that the API documentation page invokes the same endpoint automatically when you login at the top: I

Client API Browser

Recommendations

Client API Integrations

Web Dashboard

Excluding Users from MFA

Limitations of MFA

Mirth® Connect REST API

Authentication

Client API Integrations

Web Dashboard

Excluding Users from MFA

Limitations of MFA

Mirth® Connect REST API

Authentication