Skip to content

Commit 9255a2d

Browse files
guillaumelamirandguillaumelamirand
committed
Update initialization process for IDM
1 parent 05bdb19 commit 9255a2d

File tree

10 files changed

+625
-75
lines changed

10 files changed

+625
-75
lines changed

‎README.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -172,14 +172,14 @@ There are a variables used before load the configuration file and these variable
172172

173173
| Environment variable | default | description |
174174
|------------------------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
175-
| `IG.IG_CLIENT_ID` | ig-client | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this id |
176-
| `IG.IG_CLIENT_SECRET` | add-here-the-password | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this password |
177-
| `IG.IG_RCS_SECRET` | add-here-the-secret | IG rcs secret for remote consent service |
178-
| `IG.IG_SSA_SECRET` | add-here-the-secret | IG ssa secret for software publisher agent |
179-
| `IG.IG_IDM_USER` | service_account.ig | IG service user account |
180-
| `IG.IG_IDM_PASSWORD` | add-here-the-password | IG service user account password |
181-
| `IG.IG_AGENT_ID` | ig-agent | IG agent id for IG policy agent |
182-
| `IG.IG_AGENT_PASSWORD` | add-here-the-password | Ig agent password for IG policy agent |
175+
| `IG.IG_CLIENT_ID` | ig-client | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this id |
176+
| `IG.IG_CLIENT_SECRET` | add-here-the-password | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this password |
177+
| `IG.IG_RCS_SECRET` | add-here-the-secret | IG rcs secret for remote consent service |
178+
| `IG.IG_SSA_SECRET` | add-here-the-secret | IG ssa secret for software publisher agent |
179+
| `IG.IG_AS_IDM_CLIENT_SECRET` | add-here-the-secret | IG secret for IDM Client used on AS |
180+
| `IG.IG_RS_IDM_CLIENT_SECRET` | add-here-the-secret | IG secret for IDM Client used on RS |
181+
| `IG.IG_AGENT_ID` | ig-agent | IG agent id for IG policy agent |
182+
| `IG.IG_AGENT_PASSWORD` | add-here-the-password | Ig agent password for IG policy agent |
183183
</details>
184184

185185
**Identity variables**

‎_infra/helm/securebanking-openbanking-uk-iam-initializer/readme.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -134,16 +134,16 @@ spec:
134134
secretKeyRef:
135135
name: as-sapig-secrets
136136
key: IG_CLIENT_SECRET
137-
- name: IG.IG_IDM_USER
137+
- name: IG.IG_AS_IDM_CLIENT_SECRET
138138
valueFrom:
139139
secretKeyRef:
140140
name: as-sapig-secrets
141-
key: IG_IDM_USER
142-
- name: IG.IG_IDM_PASSWORD
141+
key: IG_AS_IDM_CLIENT_SECRET
142+
- name: IG.IG_RS_IDM_CLIENT_SECRET
143143
valueFrom:
144144
secretKeyRef:
145145
name: as-sapig-secrets
146-
key: IG_IDM_PASSWORD
146+
key: IG_RS_IDM_CLIENT_SECRET
147147
- name: IG.IG_AGENT_ID
148148
valueFrom:
149149
secretKeyRef:
@@ -190,8 +190,8 @@ These are the environment variables declared in the `cronjob.yaml`;
190190
IDENTITY.REMOTE_CONSENT_ID | secure-open-banking-rcs | | as-sapig-deployment-config/RCS_CONSENT_RESPONSE_JWT_SIGNINGKEYID |
191191
| IG.IG_CLIENT_ID | | | as-sapig-secrets |
192192
| IG.IG_CLIENT_SECRET | | | as-sapig-secrets |
193-
| IG.IG_IDM_USER | | | as-sapig-secrets |
194-
| IG.IG_IDM_PASSWORD | | | as-sapig-secrets |
193+
| IG.IG_AS_IDM_CLIENT_SECRET | | | as-sapig-secrets |
194+
| IG.IG_RS_IDM_CLIENT_SECRET | | | as-sapig-secrets |
195195
| IG.IG_AGENT_ID | | | as-sapig-secrets |
196196
| IG.IG_AGENT_PASSWORD | | | as-sapig-secrets |
197197

‎_infra/helm/securebanking-openbanking-uk-iam-initializer/templates/job.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -153,17 +153,17 @@ spec:
153153
valueFrom:
154154
secretKeyRef:
155155
name: as-sapig-secrets
156-
key: IG_CLIENT_SECRET
157-
- name: IG.IG_IDM_USER
156+
key: IG_CLIENT_SECRET
157+
- name: IG.IG_AS_IDM_CLIENT_SECRET
158158
valueFrom:
159159
secretKeyRef:
160160
name: as-sapig-secrets
161-
key: IG_IDM_USER
162-
- name: IG.IG_IDM_PASSWORD
161+
key: IG_AS_IDM_CLIENT_SECRET
162+
- name: IG.IG_RS_IDM_CLIENT_SECRET
163163
valueFrom:
164164
secretKeyRef:
165165
name: as-sapig-secrets
166-
key: IG_IDM_PASSWORD
166+
key: IG_RS_IDM_CLIENT_SECRET
167167
- name: IG.IG_AGENT_ID
168168
valueFrom:
169169
secretKeyRef:

‎config/defaults/identity-platform/fapi-as-ig-oauth2-client.json‎

Lines changed: 286 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,286 @@
1+
{
2+
"coreOAuth2ClientConfig": {
3+
"agentgroup": "",
4+
"status": {
5+
"inherited": false,
6+
"value": "Active"
7+
},
8+
"userpassword": "{{.Ig.IgAsIdmClientSecret}}",
9+
"clientType": {
10+
"inherited": false,
11+
"value": "Confidential"
12+
},
13+
"loopbackInterfaceRedirection": {
14+
"inherited": true,
15+
"value": true
16+
},
17+
"redirectionUris": {
18+
"inherited": false,
19+
"value": [
20+
"https://httpbin.org/anything"
21+
]
22+
},
23+
"scopes": {
24+
"inherited": false,
25+
"value": [
26+
"fr:idm:*",
27+
"trusted_gateway"
28+
]
29+
},
30+
"defaultScopes": {
31+
"inherited": true,
32+
"value": [
33+
"Unknown Type: any"
34+
]
35+
},
36+
"clientName": {
37+
"inherited": true,
38+
"value": [
39+
"Unknown Type: any"
40+
]
41+
},
42+
"authorizationCodeLifetime": {
43+
"inherited": true,
44+
"value": 0
45+
},
46+
"refreshTokenLifetime": {
47+
"inherited": true,
48+
"value": 0
49+
},
50+
"accessTokenLifetime": {
51+
"inherited": true,
52+
"value": 0
53+
}
54+
},
55+
"advancedOAuth2ClientConfig": {
56+
"name": {
57+
"inherited": true,
58+
"value": [
59+
"Unknown Type: any"
60+
]
61+
},
62+
"descriptions": {
63+
"inherited": true,
64+
"value": [
65+
"Unknown Type: any"
66+
]
67+
},
68+
"requestUris": {
69+
"inherited": true,
70+
"value": [
71+
"Unknown Type: any"
72+
]
73+
},
74+
"responseTypes": {
75+
"inherited": true,
76+
"value": [
77+
"Unknown Type: any"
78+
]
79+
},
80+
"grantTypes": {
81+
"inherited": false,
82+
"value": [
83+
"client_credentials",
84+
"password"
85+
]
86+
},
87+
"contacts": {
88+
"inherited": true,
89+
"value": [
90+
"Unknown Type: any"
91+
]
92+
},
93+
"tokenEndpointAuthMethod": {
94+
"inherited": true,
95+
"value": "string"
96+
},
97+
"sectorIdentifierUri": {
98+
"inherited": true,
99+
"value": "string"
100+
},
101+
"subjectType": {
102+
"inherited": true,
103+
"value": "string"
104+
},
105+
"updateAccessToken": {
106+
"inherited": true,
107+
"value": "string"
108+
},
109+
"clientUri": {
110+
"inherited": true,
111+
"value": [
112+
"Unknown Type: any"
113+
]
114+
},
115+
"logoUri": {
116+
"inherited": true,
117+
"value": [
118+
"Unknown Type: any"
119+
]
120+
},
121+
"policyUri": {
122+
"inherited": true,
123+
"value": [
124+
"Unknown Type: any"
125+
]
126+
},
127+
"isConsentImplied": {
128+
"inherited": true,
129+
"value": true
130+
},
131+
"mixUpMitigation": {
132+
"inherited": true,
133+
"value": true
134+
}
135+
},
136+
"coreOpenIDClientConfig": {
137+
"claims": {
138+
"inherited": true,
139+
"value": [
140+
"Unknown Type: any"
141+
]
142+
},
143+
"postLogoutRedirectUri": {
144+
"inherited": true,
145+
"value": [
146+
"Unknown Type: any"
147+
]
148+
},
149+
"clientSessionUri": {
150+
"inherited": true,
151+
"value": "string"
152+
},
153+
"defaultMaxAge": {
154+
"inherited": true,
155+
"value": 0
156+
},
157+
"defaultMaxAgeEnabled": {
158+
"inherited": true,
159+
"value": true
160+
},
161+
"defaultAcrValues": {
162+
"inherited": true,
163+
"value": [
164+
"Unknown Type: any"
165+
]
166+
},
167+
"jwtTokenLifetime": {
168+
"inherited": true,
169+
"value": 0
170+
}
171+
},
172+
"signEncOAuth2ClientConfig": {
173+
"jwksUri": {
174+
"inherited": true,
175+
"value": "string"
176+
},
177+
"jwksCacheTimeout": {
178+
"inherited": true,
179+
"value": 0
180+
},
181+
"jwkStoreCacheMissCacheTime": {
182+
"inherited": true,
183+
"value": 0
184+
},
185+
"tokenEndpointAuthSigningAlgorithm": {
186+
"inherited": true,
187+
"value": "string"
188+
},
189+
"jwkSet": {
190+
"inherited": true,
191+
"value": "string"
192+
},
193+
"idTokenSignedResponseAlg": {
194+
"inherited": true,
195+
"value": "string"
196+
},
197+
"idTokenEncryptionEnabled": {
198+
"inherited": true,
199+
"value": true
200+
},
201+
"idTokenEncryptionAlgorithm": {
202+
"inherited": true,
203+
"value": "string"
204+
},
205+
"idTokenEncryptionMethod": {
206+
"inherited": true,
207+
"value": "string"
208+
},
209+
"idTokenPublicEncryptionKey": {
210+
"inherited": true,
211+
"value": "string"
212+
},
213+
"clientJwtPublicKey": {
214+
"inherited": true,
215+
"value": "string"
216+
},
217+
"mTLSTrustedCert": {
218+
"inherited": true,
219+
"value": "string"
220+
},
221+
"mTLSSubjectDN": {
222+
"inherited": true,
223+
"value": "string"
224+
},
225+
"mTLSCertificateBoundAccessTokens": {
226+
"inherited": true,
227+
"value": true
228+
},
229+
"publicKeyLocation": {
230+
"inherited": true,
231+
"value": "string"
232+
},
233+
"userinfoResponseFormat": {
234+
"inherited": true,
235+
"value": "string"
236+
},
237+
"userinfoSignedResponseAlg": {
238+
"inherited": true,
239+
"value": "string"
240+
},
241+
"userinfoEncryptedResponseAlg": {
242+
"inherited": true,
243+
"value": "string"
244+
},
245+
"userinfoEncryptedResponseEncryptionAlgorithm": {
246+
"inherited": true,
247+
"value": "string"
248+
},
249+
"requestParameterSignedAlg": {
250+
"inherited": true,
251+
"value": "string"
252+
},
253+
"requestParameterEncryptedAlg": {
254+
"inherited": true,
255+
"value": "string"
256+
},
257+
"requestParameterEncryptedEncryptionAlgorithm": {
258+
"inherited": true,
259+
"value": "string"
260+
},
261+
"tokenIntrospectionResponseFormat": {
262+
"inherited": true,
263+
"value": "string"
264+
},
265+
"tokenIntrospectionSignedResponseAlg": {
266+
"inherited": true,
267+
"value": "string"
268+
},
269+
"tokenIntrospectionEncryptedResponseAlg": {
270+
"inherited": true,
271+
"value": "string"
272+
},
273+
"tokenIntrospectionEncryptedResponseEncryptionAlgorithm": {
274+
"inherited": true,
275+
"value": "string"
276+
}
277+
},
278+
"coreUmaClientConfig": {
279+
"claimsRedirectionUris": {
280+
"inherited": true,
281+
"value": [
282+
"Unknown Type: any"
283+
]
284+
}
285+
}
286+
}

0 commit comments

Comments
 (0)