sevenhill/QSfera
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Apply suggestions from code review

Browse Source 
language review
This commit is contained in:
Edith Parzefall
2023-03-29 12:02:55 +02:00
committed by GitHub
parent 052cd0f273
commit d9bccac3ae
1 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/invitations/README.md
+8 -8
View File
@@ -1,6 +1,6 @@
# Invitations Service
The invitations service provides an [Invitation Manager](https://learn.microsoft.com/en-us/graph/api/invitation-post?view=graph-rest-1.0&tabs=http) that can be used to invite external users, aka Guests to an organization.
The invitations service provides an [Invitation Manager](https://learn.microsoft.com/en-us/graph/api/invitation-post?view=graph-rest-1.0&tabs=http) that can be used to invite external users, aka guests, to an organization.
* Users invited via the Invitation Manager (via the libre graph API) will have the `userType="Guest"`.
* Users belonging to the organization have the `userType="Member"`.
@@ -9,21 +9,21 @@ The corresponding CS3 API [user types](https://cs3org.github.io/cs3apis/#cs3.ide
## Provisioning Backends
When ocis is used via the IDM service for the user management, users are created using the `/graph/v1.0/users` endpoint via the libre graph API. For larger deployments, the Keycloak admin API can be used to provision users. In a future step, the endpoint, credentials and body might be made configurable using templates.
When Infinite Scale is used via the IDM service for the user management, users are created using the `/graph/v1.0/users` endpoint via the libre graph API. For larger deployments, the Keycloak admin API can be used to provision users. In a future step, the endpoint, credentials and body might be made configurable using templates.
### Keycloak
The default and currently only available backend used to handle Invitations is [Keycloak](https://www.keycloak.org/). Keycloak is an open source identity and access management (IAM) system which is also integrated by other OCIS services as an authentication and authorization backend.
The default and currently only available backend used to handle invitations is [Keycloak](https://www.keycloak.org/). Keycloak is an open source identity and access management (IAM) system which is also integrated by other Infinite Scale services as an authentication and authorization backend.
#### Keycloak Realm Configuration
<!--- Note that the link below must be an absolute URL and not a relative file path --->
See the [example configuration json file](https://github.com/owncloud/ocis/blob/master/services/invitations/md-sources/example-realm.md) of a Keycloak realm that the backend will work with. This file includes the `invitations` client, which is relevant for this service.
See the [example configuration json file](https://github.com/owncloud/ocis/blob/master/services/invitations/md-sources/example-realm.md) of a Keycloak realm the backend will work with. This file includes the `invitations` client, which is relevant for this service.
Note to use the example json, set the `INVITATIONS_KEYCLOAK_CLIENT_ID` setting to `invitations`, though any other client ID can be configured.
To use the example json, set the `INVITATIONS_KEYCLOAK_CLIENT_ID` setting to `invitations`, though any other client ID can be configured.
Importing this example into keycloak will give you a realm that federates with an LDAP server, has the right
Importing this example into Keycloak will give you a realm that federates with an LDAP server, has the right
clients configured and all mappers correctly set. Be sure to set all the credentials after the import,
as they will be disabled.
@@ -38,8 +38,8 @@ After Keycloak has been configured, the invitation service needs to be configure
* `INVITATIONS_KEYCLOAK_CLIENT_SECRET`: The client secret used to authenticate. This can be found in the Keycloak UI.
* `INVITATIONS_KEYCLOAK_CLIENT_REALM`: The realm where the client was added. In the example above, `ocis` is used.
* `INVITATIONS_KEYCLOAK_USER_REALM`: The realm where to add the users. In the example above, `ocis` is used.
* `INVITATIONS_KEYCLOAK_INSECURE_SKIP_VERIFY`: If set to true, the verification of the Keycloak https certificate is skipped. This is not recommended in production enviroments.
* `INVITATIONS_KEYCLOAK_INSECURE_SKIP_VERIFY`: If set to true, the verification of the Keycloak HTTPS certificate is skipped. This is not recommended in production environments.
## Bridging Provisioning Delay
Consider that when a guest account has to be provisioned in an external user management, there might be a delay between creating the user and being available in the local ocis system.
Consider that when a guest account has to be provisioned in an external user management, there might be a delay between creating the user and the user being available in the local Infinite Scale system.