Skip to content

Latest commit

 

History

History
82 lines (64 loc) · 2.67 KB

README.md

File metadata and controls

82 lines (64 loc) · 2.67 KB

OHIF Viewer with OpenID-Protected PACS Server (Orthanc)

This project implements a secure medical imaging viewer setup that protects the PACS Server using OpenID authentication (compatible with corporate SSO). The solution uses OpenResty (nginx + lua) and Keycloak for OpenID authentication, leveraging the lua-resty-openidc library.

Features

  • Single-host deployment eliminating CORS issues
  • Corporate SSO integration via OpenID
  • Streamlined service proxying through OpenResty
  • OHIF Viewer integration with Orthanc PACS

Architecture

CORS Handling

All services are proxied through a single host (viewer container), which combines OpenResty and the OHIF viewer. This approach completely eliminates CORS-related issues by having all services available under one domain.

Authentication Configuration

Session timing can be configured through the nginx configuration:

  • Use session.cookie.renew to set renewal timing
  • Use session.cookie.lifetime to set session duration

To set a custom cookie domain:

local session_opts = { cookie = { domain = ".mydomain.com" } }

Deployment

Quick Start

docker-compose up --build

Note: Initial startup may take a minute while Keycloak initializes its database. If the startup appears to hang, check the logs:

docker-compose logs -f

If needed, restart the stack:

docker-compose restart

Keycloak Configuration

  1. Access the Keycloak admin console at http://localhost:3333 (credentials in docker-compose.yml)
  2. Create a new realm named imagingrealm:
    • Use the realm dropdown (top left)
    • Select "Add realm"
  3. Create a client named imaging with the following settings:
    • Redirect URL: *
    • Access Type: confidential
    • Web Origins: +
  4. Copy the client secret from Keycloak to openid-keycloak-secrets.env:
    • Set as OPENID_CLIENT_SECRET
  5. Create a user account and set their password in the "Credentials" tab
  6. Restart nginx to apply the new configuration: 
    docker-compose stop viewer
docker-compose up -d

Access Points

Security Notes

SSL Configuration

A development SSL key is included in this repository. DO NOT USE IN PRODUCTION.

Generate a new SSL key pair for production:

openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout nginxenv/ssl/nginx.key \
    -out nginxenv/ssl/nginx.crt