# Using auth plugin with just "WebServiceUserProfileUrl" doesn't show DICOM in viewer

**URL:** https://discourse.orthanc-server.org/t/using-auth-plugin-with-just-webserviceuserprofileurl-doesnt-show-dicom-in-viewer/5580
**Category:** General
**Created:** [March 5, 2025, 12:02pm UTC](https://discourse.orthanc-server.org/t/using-auth-plugin-with-just-webserviceuserprofileurl-doesnt-show-dicom-in-viewer/5580 "2025-03-05T12:02:38Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![GioBlank](https://discourse.orthanc-server.org/letter_avatar_proxy/v4/letter/g/b19c9b/32.png) [@GioBlank](https://discourse.orthanc-server.org/u/GioBlank)
#### Post date: [March 5, 2025, 12:02pm UTC](https://discourse.orthanc-server.org/t/using-auth-plugin-with-just-webserviceuserprofileurl-doesnt-show-dicom-in-viewer/5580/1 "2025-03-05T12:02:39Z")

</div>

Hi everybody,  
I found out that if I follow the keycloak minimal setup example and I choose to implement only the user/get-profile web service method and not the others, I can explore my DICOM images, but If I want to open them in a viewer or If I want to download a DICOM, that’s not happening? Why? Is it mandatory to implement the other WebService routes?  
Tks everybody,  
Gio

---

<div class="post-metadata">

### Author: ![alainmazy](https://discourse.orthanc-server.org/user_avatar/discourse.orthanc-server.org/alainmazy/32/1576_2.png) [@alainmazy](https://discourse.orthanc-server.org/u/alainmazy)
#### Post date: [March 7, 2025, 8:15am UTC](https://discourse.orthanc-server.org/t/using-auth-plugin-with-just-webserviceuserprofileurl-doesnt-show-dicom-in-viewer/5580/2 "2025-03-07T08:15:47Z")

</div>

Hi,

> [@GioBlank](#):
>
> Is it mandatory to implement the other WebService routes?

No, have a look to [this sample](https://github.com/orthanc-server/orthanc-setup-samples/tree/master/docker/access-control-user-profiles).

Alain

---

<div class="post-metadata">

### Author: ![GioBlank](https://discourse.orthanc-server.org/letter_avatar_proxy/v4/letter/g/b19c9b/32.png) [@GioBlank](https://discourse.orthanc-server.org/u/GioBlank)
#### Post date: [March 11, 2025, 11:52am UTC](https://discourse.orthanc-server.org/t/using-auth-plugin-with-just-webserviceuserprofileurl-doesnt-show-dicom-in-viewer/5580/3 "2025-03-11T11:52:42Z")

</div>

Hi,  
I tried the sample and it worked as you described. If I change a bit the configuration (in order to not use anymore the registered users) and use a configuration like the following:

```auto
services:

  orthanc:
    image: orthancteam/orthanc:25.2.0
    volumes: 
      - "orthanc-storage:/var/lib/orthanc/db"
      - "./orthanc/plugin.py:/scripts/plugin.py"
    ports: ["8042:8042"]
    depends_on: [auth-service]
    restart: unless-stopped
    environment:
      VERBOSE_STARTUP: "true"
      VERBOSE_ENABLED: "true"

      AUTHORIZATION_PLUGIN_ENABLED: "false"
      STONE_WEB_VIEWER_PLUGIN_ENABLED: "true"
      DICOM_WEB_PLUGIN_ENABLED: "true"
      PYTHON_PLUGIN_ENABLED: "true"
      OHIF_PLUGIN_ENABLED: "true"

      ORTHANC_JSON: |
        {
          "Name": "Orthanc auth test",
          "AuthenticationEnabled": false,
          "UiOptions": {
            "EnableOpenInOhifViewer3": true,
            "OhifViewer3PublicRoot": "http://localhost:8042/ohif/"
          },
          "Authorization": {
            "WebServiceUserProfileUrl": "http://auth-service:8000/user/get-profile",
            "TokenHttpHeaders": [
              "Authorization"
            ],

            "StandardConfigurations": [
              "orthanc-explorer-2",
              "ohif"
            ],
            "CheckedLevel" : "studies"
          },
          "OrthancExplorer2": {
            "Tokens": {
              // experimental, set it to false when using basic-auth together with the auth-plugin (https://discourse.orthanc-server.org/t/user-based-access-control-with-label-based-resource-access/5454)
              "RequiredForLinks": true  
            }
          },          
          "PythonScript": "/scripts/plugin.py",
          "DicomWeb": {
            "Enable": true,
            "PublicRoot": "/dicom-web/"
          },
          "OHIF": {
            "DataSource": "dicom-web",
            "RouterBasename": "/ohif/"
          }

        }

  # this web-service implements authorization checks (it is called by the authorization plugin)
  auth-service:
    build: auth-service
    restart: unless-stopped

volumes:
  orthanc-storage:

```

I can open the explorer but I cannot view or download the images anymore (the same thing happened with the keycloak/minimal-setup example if I define just the “WebServiceUserProfileUrl”). Why is that?  
Tks  
Gio

---

<div class="post-metadata">

### Author: ![Lorenzo](https://discourse.orthanc-server.org/letter_avatar_proxy/v4/letter/l/4da419/32.png) [@Lorenzo](https://discourse.orthanc-server.org/u/Lorenzo)
#### Post date: [October 16, 2026, 11:44am UTC](https://discourse.orthanc-server.org/t/using-auth-plugin-with-just-webserviceuserprofileurl-doesnt-show-dicom-in-viewer/5580/4 "2026-10-16T11:44:12Z")

</div>

Hi everybody,

I’m trying to **use the Authorization Plugin in the same way described by Gio**.

I only want my backend service to handle requests to the `user/get-profile` API, without providing any links to view or download images. Therefore, I don’t need to implement the `tokens/viewer-instant-link` or `tokens/download-instant-link` APIs, nor the `encode` and `decode` APIs. In my configuration I’m using keycloak as identity provider.

The problem is that when I configure only `WebServiceUserProfileUrl`, it doesn’t seem to work. From the configuration linked by @alainmazy I saw that there is the “experimental” parameter RequiredForLinks set to false, but I’m not using the basic authentication. Does it work the same?

**Is there any specific configuration required to use OE2 with the Authorization Plugin relying only on the User Profile API?**

Thanks in advance,  
Lorenzo