Skip to main content

How we compare

Why not Keycloak?​

Keycloak is a mature, widely-deployed identity platform. However, adapting it for SMART on FHIR requires maintaining custom Service Provider Interface (SPI) extensions that:

  • Break on every Keycloak major version upgrade
  • Only support SMART App Launch v1.0 — not the current v2.2
  • Do not natively support EHR launch tokens (patient context bound to a session)
  • Cannot issue patient, encounter, and need_patient_banner as top-level token response fields (a SMART spec requirement most implementations get wrong)
  • Require Keycloak operational expertise on top of SMART expertise — two separate knowledge domains to maintain

The AJ FHIR Platform implements SMART natively in Spring Authorization Server 1.3 with zero third-party extensions. The entire SMART flow is plain Spring Boot code — readable, auditable, and upgradeable without breaking changes.

Why not Smile CDR?​

Smile CDR is excellent. It is the most complete SMART on FHIR commercial platform available. It is also closed source and costs in the range of $150,000–$500,000+ per year for enterprise deployments — beyond the budget of most national health programmes in low and middle income countries.

The AJ FHIR Platform delivers the same core infrastructure — SMART auth, HAPI FHIR JPA, consent management, audit — under MIT licence. Commercial support is priced for government scale, not Silicon Valley enterprise contracts.

Why not Medplum?​

Medplum is a strong option for US healthtech startups. However:

  • It is TypeScript/Node.js — not suitable for JVM environments that most national health platforms run
  • It is a monolith — FHIR server, auth, and UI are one codebase, not independently deployable
  • It is designed for the US market — no alignment with WHO digital health guidelines or South/Southeast Asian national health frameworks
  • It does not use HAPI FHIR — the reference FHIR implementation used by most government health systems

Why not the original smart-on-fhir/auth-server?​

The original reference implementation by the SMART Health IT team was built in 2014–2016 on Spring Security OAuth2 (now deprecated). It has not been maintained since 2018, targets SMART App Launch v1.0, has no PKCE, and uses a deprecated dependency stack. It should not be used for new deployments.

Feature comparison​

FeatureAJ FHIR PlatformKeycloak + extensionsSmile CDRMedplum
SMART App Launch v2.2✅⚠️ v1.0 only✅⚠️ v1.0
EHR launch tokens✅ Atomic DB⚠️ External service✅✅
PKCE S256 enforced✅✅✅✅
fhirUser in id_token✅⚠️ Extension needed✅✅
SMART token extras (patient, encounter)✅ Top-level JSON⚠️ Manual config✅✅
IdP federation✅ Native Spring✅ Native✅✅
Consent Manager (FHIR Consent)⚡ v1.1.0❌✅❌
ATNA Audit (IHE)⚡ v1.1.0❌✅❌
HAPI FHIR upstream tracking✅N/A✅ (is Smile)❌
Java / JVM✅✅✅❌ TypeScript
Open source (MIT)✅✅ Apache❌ Closed✅ Apache
Commercial support✅✅ Red Hat✅✅
National health alignment✅ 6 countries❌US-focusedUS-focused

✅ Supported · ⚡ In progress · ⚠️ Partial/workaround · ❌ Not supported