Skip to content

Commit 9825ba5

Browse files
guillaumelamirandguillaumelamirand
committed
OPENIG-9596 Update initialization process for IDM
1 parent 77dbb10 commit 9825ba5

File tree

14 files changed

+619
-551
lines changed

14 files changed

+619
-551
lines changed

‎README.md‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -172,14 +172,14 @@ There are a variables used before load the configuration file and these variable
172172

173173
| Environment variable | default | description |
174174
|------------------------|-----------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
175-
| `IG.IG_CLIENT_ID` | ig-client | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this id |
176-
| `IG.IG_CLIENT_SECRET` | add-here-the-password | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this password |
177-
| `IG.IG_RCS_SECRET` | add-here-the-secret | IG rcs secret for remote consent service |
178-
| `IG.IG_SSA_SECRET` | add-here-the-secret | IG ssa secret for software publisher agent |
179-
| `IG.IG_IDM_USER` | service_account.ig | IG service user account |
180-
| `IG.IG_IDM_PASSWORD` | add-here-the-password | IG service user account password |
181-
| `IG.IG_AGENT_ID` | ig-agent | IG agent id for IG policy agent |
182-
| `IG.IG_AGENT_PASSWORD` | add-here-the-password | Ig agent password for IG policy agent |
175+
| `IG.IG_CLIENT_ID` | ig-client | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this id |
176+
| `IG.IG_CLIENT_SECRET` | add-here-the-password | The initializer creates an OAuth2 Client that the SBAT IG will use to authenticate to the FR Platform to ensure that Api Client's can't bypass IG and use the FR Identity Platform APIs directly. The OAuth2 client will be created with this password |
177+
| `IG.IG_RCS_SECRET` | add-here-the-secret | IG rcs secret for remote consent service |
178+
| `IG.IG_SSA_SECRET` | add-here-the-secret | IG ssa secret for software publisher agent |
179+
| `IG.IG_AS_IDM_CLIENT_SECRET` | add-here-the-secret | IG secret for IDM Client used on AS |
180+
| `IG.IG_RS_IDM_CLIENT_SECRET` | add-here-the-secret | IG secret for IDM Client used on RS |
181+
| `IG.IG_AGENT_ID` | ig-agent | IG agent id for IG policy agent |
182+
| `IG.IG_AGENT_PASSWORD` | add-here-the-password | Ig agent password for IG policy agent |
183183
</details>
184184

185185
**Identity variables**

‎_infra/helm/securebanking-openbanking-uk-iam-initializer/readme.md‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -134,16 +134,16 @@ spec:
134134
secretKeyRef:
135135
name: as-sapig-secrets
136136
key: IG_CLIENT_SECRET
137-
- name: IG.IG_IDM_USER
137+
- name: IG.IG_AS_IDM_CLIENT_SECRET
138138
valueFrom:
139139
secretKeyRef:
140140
name: as-sapig-secrets
141-
key: IG_IDM_USER
142-
- name: IG.IG_IDM_PASSWORD
141+
key: IG_AS_IDM_CLIENT_SECRET
142+
- name: IG.IG_RS_IDM_CLIENT_SECRET
143143
valueFrom:
144144
secretKeyRef:
145145
name: as-sapig-secrets
146-
key: IG_IDM_PASSWORD
146+
key: IG_RS_IDM_CLIENT_SECRET
147147
- name: IG.IG_AGENT_ID
148148
valueFrom:
149149
secretKeyRef:
@@ -190,8 +190,8 @@ These are the environment variables declared in the `cronjob.yaml`;
190190
IDENTITY.REMOTE_CONSENT_ID | secure-open-banking-rcs | | as-sapig-deployment-config/RCS_CONSENT_RESPONSE_JWT_SIGNINGKEYID |
191191
| IG.IG_CLIENT_ID | | | as-sapig-secrets |
192192
| IG.IG_CLIENT_SECRET | | | as-sapig-secrets |
193-
| IG.IG_IDM_USER | | | as-sapig-secrets |
194-
| IG.IG_IDM_PASSWORD | | | as-sapig-secrets |
193+
| IG.IG_AS_IDM_CLIENT_SECRET | | | as-sapig-secrets |
194+
| IG.IG_RS_IDM_CLIENT_SECRET | | | as-sapig-secrets |
195195
| IG.IG_AGENT_ID | | | as-sapig-secrets |
196196
| IG.IG_AGENT_PASSWORD | | | as-sapig-secrets |
197197

‎_infra/helm/securebanking-openbanking-uk-iam-initializer/templates/job.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -153,17 +153,17 @@ spec:
153153
valueFrom:
154154
secretKeyRef:
155155
name: as-sapig-secrets
156-
key: IG_CLIENT_SECRET
157-
- name: IG.IG_IDM_USER
156+
key: IG_CLIENT_SECRET
157+
- name: IG.IG_AS_IDM_CLIENT_SECRET
158158
valueFrom:
159159
secretKeyRef:
160160
name: as-sapig-secrets
161-
key: IG_IDM_USER
162-
- name: IG.IG_IDM_PASSWORD
161+
key: IG_AS_IDM_CLIENT_SECRET
162+
- name: IG.IG_RS_IDM_CLIENT_SECRET
163163
valueFrom:
164164
secretKeyRef:
165165
name: as-sapig-secrets
166-
key: IG_IDM_PASSWORD
166+
key: IG_RS_IDM_CLIENT_SECRET
167167
- name: IG.IG_AGENT_ID
168168
valueFrom:
169169
secretKeyRef:

‎config/defaults/identity-platform/fapi-as-ig-oauth2-client.json‎

Lines changed: 285 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,285 @@
1+
{
2+
"asIdmOAuth2ClientConfig": {
3+
"agentgroup": "",
4+
"status": {
5+
"inherited": false,
6+
"value": "Active"
7+
},
8+
"userpassword": "{{.Ig.IgAsIdmClientSecret}}",
9+
"clientType": {
10+
"inherited": false,
11+
"value": "Confidential"
12+
},
13+
"loopbackInterfaceRedirection": {
14+
"inherited": true,
15+
"value": true
16+
},
17+
"redirectionUris": {
18+
"inherited": false,
19+
"value": [
20+
"https://httpbin.org/anything"
21+
]
22+
},
23+
"scopes": {
24+
"inherited": false,
25+
"value": [
26+
"fr:idm:*",
27+
"trusted_gateway"
28+
]
29+
},
30+
"defaultScopes": {
31+
"inherited": true,
32+
"value": [
33+
"Unknown Type: any"
34+
]
35+
},
36+
"clientName": {
37+
"inherited": true,
38+
"value": [
39+
"Unknown Type: any"
40+
]
41+
},
42+
"authorizationCodeLifetime": {
43+
"inherited": true,
44+
"value": 0
45+
},
46+
"refreshTokenLifetime": {
47+
"inherited": true,
48+
"value": 0
49+
},
50+
"accessTokenLifetime": {
51+
"inherited": true,
52+
"value": 0
53+
}
54+
},
55+
"advancedOAuth2ClientConfig": {
56+
"name": {
57+
"inherited": true,
58+
"value": [
59+
"Unknown Type: any"
60+
]
61+
},
62+
"descriptions": {
63+
"inherited": true,
64+
"value": [
65+
"Unknown Type: any"
66+
]
67+
},
68+
"requestUris": {
69+
"inherited": true,
70+
"value": [
71+
"Unknown Type: any"
72+
]
73+
},
74+
"responseTypes": {
75+
"inherited": true,
76+
"value": [
77+
"Unknown Type: any"
78+
]
79+
},
80+
"grantTypes": {
81+
"inherited": false,
82+
"value": [
83+
"client_credentials"
84+
]
85+
},
86+
"contacts": {
87+
"inherited": true,
88+
"value": [
89+
"Unknown Type: any"
90+
]
91+
},
92+
"tokenEndpointAuthMethod": {
93+
"inherited": true,
94+
"value": "string"
95+
},
96+
"sectorIdentifierUri": {
97+
"inherited": true,
98+
"value": "string"
99+
},
100+
"subjectType": {
101+
"inherited": true,
102+
"value": "string"
103+
},
104+
"updateAccessToken": {
105+
"inherited": true,
106+
"value": "string"
107+
},
108+
"clientUri": {
109+
"inherited": true,
110+
"value": [
111+
"Unknown Type: any"
112+
]
113+
},
114+
"logoUri": {
115+
"inherited": true,
116+
"value": [
117+
"Unknown Type: any"
118+
]
119+
},
120+
"policyUri": {
121+
"inherited": true,
122+
"value": [
123+
"Unknown Type: any"
124+
]
125+
},
126+
"isConsentImplied": {
127+
"inherited": true,
128+
"value": true
129+
},
130+
"mixUpMitigation": {
131+
"inherited": true,
132+
"value": true
133+
}
134+
},
135+
"coreOpenIDClientConfig": {
136+
"claims": {
137+
"inherited": true,
138+
"value": [
139+
"Unknown Type: any"
140+
]
141+
},
142+
"postLogoutRedirectUri": {
143+
"inherited": true,
144+
"value": [
145+
"Unknown Type: any"
146+
]
147+
},
148+
"clientSessionUri": {
149+
"inherited": true,
150+
"value": "string"
151+
},
152+
"defaultMaxAge": {
153+
"inherited": true,
154+
"value": 0
155+
},
156+
"defaultMaxAgeEnabled": {
157+
"inherited": true,
158+
"value": true
159+
},
160+
"defaultAcrValues": {
161+
"inherited": true,
162+
"value": [
163+
"Unknown Type: any"
164+
]
165+
},
166+
"jwtTokenLifetime": {
167+
"inherited": true,
168+
"value": 0
169+
}
170+
},
171+
"signEncOAuth2ClientConfig": {
172+
"jwksUri": {
173+
"inherited": true,
174+
"value": "string"
175+
},
176+
"jwksCacheTimeout": {
177+
"inherited": true,
178+
"value": 0
179+
},
180+
"jwkStoreCacheMissCacheTime": {
181+
"inherited": true,
182+
"value": 0
183+
},
184+
"tokenEndpointAuthSigningAlgorithm": {
185+
"inherited": true,
186+
"value": "string"
187+
},
188+
"jwkSet": {
189+
"inherited": true,
190+
"value": "string"
191+
},
192+
"idTokenSignedResponseAlg": {
193+
"inherited": true,
194+
"value": "string"
195+
},
196+
"idTokenEncryptionEnabled": {
197+
"inherited": true,
198+
"value": true
199+
},
200+
"idTokenEncryptionAlgorithm": {
201+
"inherited": true,
202+
"value": "string"
203+
},
204+
"idTokenEncryptionMethod": {
205+
"inherited": true,
206+
"value": "string"
207+
},
208+
"idTokenPublicEncryptionKey": {
209+
"inherited": true,
210+
"value": "string"
211+
},
212+
"clientJwtPublicKey": {
213+
"inherited": true,
214+
"value": "string"
215+
},
216+
"mTLSTrustedCert": {
217+
"inherited": true,
218+
"value": "string"
219+
},
220+
"mTLSSubjectDN": {
221+
"inherited": true,
222+
"value": "string"
223+
},
224+
"mTLSCertificateBoundAccessTokens": {
225+
"inherited": true,
226+
"value": true
227+
},
228+
"publicKeyLocation": {
229+
"inherited": true,
230+
"value": "string"
231+
},
232+
"userinfoResponseFormat": {
233+
"inherited": true,
234+
"value": "string"
235+
},
236+
"userinfoSignedResponseAlg": {
237+
"inherited": true,
238+
"value": "string"
239+
},
240+
"userinfoEncryptedResponseAlg": {
241+
"inherited": true,
242+
"value": "string"
243+
},
244+
"userinfoEncryptedResponseEncryptionAlgorithm": {
245+
"inherited": true,
246+
"value": "string"
247+
},
248+
"requestParameterSignedAlg": {
249+
"inherited": true,
250+
"value": "string"
251+
},
252+
"requestParameterEncryptedAlg": {
253+
"inherited": true,
254+
"value": "string"
255+
},
256+
"requestParameterEncryptedEncryptionAlgorithm": {
257+
"inherited": true,
258+
"value": "string"
259+
},
260+
"tokenIntrospectionResponseFormat": {
261+
"inherited": true,
262+
"value": "string"
263+
},
264+
"tokenIntrospectionSignedResponseAlg": {
265+
"inherited": true,
266+
"value": "string"
267+
},
268+
"tokenIntrospectionEncryptedResponseAlg": {
269+
"inherited": true,
270+
"value": "string"
271+
},
272+
"tokenIntrospectionEncryptedResponseEncryptionAlgorithm": {
273+
"inherited": true,
274+
"value": "string"
275+
}
276+
},
277+
"coreUmaClientConfig": {
278+
"claimsRedirectionUris": {
279+
"inherited": true,
280+
"value": [
281+
"Unknown Type: any"
282+
]
283+
}
284+
}
285+
}

0 commit comments

Comments
 (0)