sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

improve readme

Browse Source 
Co-authored-by: Martin <github@diemattels.at>
This commit is contained in:
Daniël Franke
2023-04-14 15:09:54 +02:00
committed by jkoberg
co-authored by Martin
parent 43cf811db1
commit 2e8b741530
3 changed files with 32 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/graph/README.md
+20 -12
View File
@@ -31,18 +31,26 @@ The `graph` service can use a configured store via `GRAPH_STORE_TYPE`. Possible
3. The graph service can be scaled if not using `in-memory` stores and the stores are configured identically over all instances.
4. When using `redis-sentinel`, the Redis master to use is configured via `GRAPH_CACHE_STORE_NODES` in the form of `<sentinel-host>:<sentinel-port>/<redis-master>` like `10.10.0.200:26379/mymaster`.
## Keycloak configuration for the personal data export
## Keycloak Configuration For The Personal Data Export
If Keycloak is used for authentication, the GDPR requires us to add all the personal identifiable
information that keycloak has about the user to the personal data export. To do this, set the following
environment variables:
If Keycloak is used for authentication, GDPR regulations require to add all personal identifiable information that Keycloak has about the user to the personal data export. To do this, the following environment variables must be set:
* `KEYCLOAK_BASE_PATH` - The URL to the keycloak instance.
* `KEYCLOAK_CLIENT_ID` - The client ID of the client that is used to authenticate with keycloak, this client has to be able to list users and get the credential data.
* `KEYCLOAK_CLIENT_SECRET` - The client secret of the client that is used to authenticate with keycloak.
* `KEYCLOAK_CLIENT_REALM` - The realm the client is defined in.
* `KEYCLOAK_USER_REALM` - The realm the oCIS users are defined in.
* `KEYCLOAK_INSECURE_SKIP_VERIFY` - If set to true, the TLS certificate of the keycloak instance is not verified.
* `OCIS_KEYCLOAK_BASE_PATH` - The URL to the keycloak instance.
* `OCIS_KEYCLOAK_CLIENT_ID` - The client ID of the client that is used to authenticate with keycloak, this client has to be able to list users and get the credential data.
* `OCIS_KEYCLOAK_CLIENT_SECRET` - The client secret of the client that is used to authenticate with keycloak.
* `OCIS_KEYCLOAK_CLIENT_REALM` - The realm the client is defined in.
* `OCIS_KEYCLOAK_USER_REALM` - The realm the oCIS users are defined in.
* `OCIS_KEYCLOAK_INSECURE_SKIP_VERIFY` - If set to true, the TLS certificate of the keycloak instance is not verified.
These variables are the same as the ones used by the invitations service, but can be configured separateley
by prefixing `GRAPH_` to the variable name.
### Keycloak Client Configuration
The client that is used to authenticate with keycloak has to be able to list users and get the credential data. To do this, the following roles have to be assigned to the client and they have to be about the realm that contains the oCIS users:
* `view-users`
* `view-identity-providers`
* `view-realm`
* `view-clients`
* `view-events`
* `view-authorization`
Note that these roles are only available to assign if the client is in the `master` realm.