# Local Inbound Security Module

The Local Inbound Security module stores user accounts locally in Smile CDR's administrative database. When using this module, Smile CDR acts as a completely self-contained CDR and User Management system. This can be useful when deploying Smile CDR in circumstances where no existing user database or identity management platform is present.

By default Smile CDR creates a Local Inbound Security module, and seeds it with a single administrative user named `admin`. You may use the Web Admin Console or the JSON Admin API to create and modify users.

# Configuration: Credentials

When storing **usernames** in the database, the module can optionally normalize them so that checks will be case insensitive. This is **enabled** by default, and it can be disabled by setting _Username Case Sensitive_ to `true`.

When storing **passwords** in the database, the module can optionally normalize them so that checks will be case insensitive. This is **disabled** by default, and it can be enabled by setting _Password Case Sensitive_ to `false`.

Passwords will be stored in the database using a salted hash, and the [salt](https://en.wikipedia.org/wiki/Salt_%28cryptography%29) is randomly generated for each individual password. By default the hashing algorithm used is a 12-round [bcrypt](https://en.wikipedia.org/wiki/Bcrypt). This can be changed by modifying the _Password Encoding Scheme_ value.

# Caching

One important thing to note when updating user accounts is that the system caches user credential hashes for a short period of time in order to improve performance. Any changes to a user account (i.e. changing a password, modifying the user's permissions, etc.) may take a few seconds to propagate across the cluster.

# User Self Registration

This module can optionally be configured to allow users to self-register. Self registration is available via the _SMART Outbound Security module_ when it is paired with the _Local Inbound Security module_.

To enable self registration, the [Self Registration Enabled](/content/docs/configuration_categories/user_self_registration.html#user_self_registration.enabled) setting must be enabled. In addition, a callback script must be supplied using the [User Self Registration Script](/content/docs/configuration_categories/user_self_registration.html#property-user-self-registration-script-text/index.html) properties.

## Hide the SignUp Button

The user can provide a list of comma separated URLs that will hide the SignUp button on the Login page when the referer URL of the Login page is in the list.

A place where this feature can be useful is for App Gallery setup. For example, http://localhost:19300/console/ can be provided in this field to disable user registration for the App Gallery Admin Console.

## Function: onUserSelfRegistrationRequest

This function is called when a user requests a self-registration. It is used to generate an account for the new user.

**Parameters**

- **theInputUser** – This object will be populated with the details as supplied by the user who filled out the self registration form. Object is of type  [UserDetails](/content/docs/javascript_execution_environment/callback_models.html#userdetails/index.html). At this time, the following properties are populated:

- Username
  - Family Name
  - Given Name
  - Email Address
- **theOutputUser** – This object should be populated by the script with the actual details that should be stored in the created user object. Any properties _except for the username and password_ need to be explicitly copied from **theInputUser** to **theOutputUser** by the script. Object is of type [UserDetails](/content/docs/javascript_execution_environment/callback_models.html#userdetails/index.html).

**Example**

```javascript
function onUserSelfRegistrationRequest(theInputUser, theOutputUser) {

// Copy standard demographics
    theOutputUser.familyName = theInputUser.familyName;
    theOutputUser.givenName = theInputUser.givenName;
    theOutputUser.email = theInputUser.email;

// Add any permissions you want the user to have by default
    // in a newly created account. Be very careful not to
    // assign permissions that would be inappropriate for a new
    // user to have!
    theOutputUser.addAuthority('FHIR_CAPABILITIES');

}
```

Copy

## Resetting User Password

The user self registration [landing page](/content/docs/smart/smart_on_fhir_outbound_security_module_skinning.html#login-page/index.html) provides the capability for existing users to reset their password. Upon requesting a password reset, the user will be asked to [provide the username](/content/docs/smart/smart_on_fhir_outbound_security_module_skinning.html#forgotPassword-step1/index.html) that he/she usually log in with. Following successful username validation, a one time use and user specific 6-digit code is sent to the email address linked with the account. [Entering the provided identification code](/content/docs/smart/smart_on_fhir_outbound_security_module_skinning.html#forgotPassword-step2/index.html) will allow the user to [supply a new login password](/content/docs/smart/smart_on_fhir_outbound_security_module_skinning.html#forgotPassword-step3/index.html).

Notes regarding password reset:

- As mentioned above, a user specific 6-digit identification code can only be used once;
- Requesting a new identification code will void any issued and unused user specific identification code;
- At any point during the reset password flow, the user can decide to cancel the operation without affecting their account status.

[Inbound Security Module](/content/docs/security/inbound_security_module.html)

Local Inbound Security Module

Security

[Authentication Protocols](/content/docs/security/authentication_protocols.html)
[Authorization and Consent](/content/docs/security/authorization_and_consent.html)
[Inbound Security Module](/content/docs/security/inbound_security_module.html)
[Local Inbound Security Module](/content/docs/security/local_inbound_security_module.html)
[LDAP Inbound Security Module](/content/docs/security/ldap_inbound_security_module.html)
[Scripted Inbound Security Module](/content/docs/security/script_inbound_security_module.html)
[SAML Inbound Security Module](/content/docs/security/saml_inbound_security_module.html)
[Trusted Client Mode](/content/docs/security/trusted_client_mode.html)
[Roles and Permissions](/content/docs/security/roles_and_permissions.html)
[Callback Scripts](/content/docs/security/callback_scripts.html)
[Anonymous Access](/content/docs/security/anonymous_access.html)
[Consent Service](/content/docs/security/consent_service.html)
[Consent Service: JavaScript API](/content/docs/security/consent_service_javascript.html)
[Consent Service: Java API](/content/docs/security/consent_service_java.html)
[Security Recipes](/content/docs/security/security_recipes.html)
[Two Factor Authentication](/content/docs/security/two_factor_auth.html)
[Password Hashing Algorithms](/content/docs/security/password_hashing_algorithms.html)
[JWT Signature Algorithms](/content/docs/security/jwt_signature_algorithms.html)
[Troubleshooting Security](/content/docs/security/troubleshooting_security.html)

[LDAP Inbound Security Module](/content/docs/security/ldap_inbound_security_module.html)