From ed27261262578ab6df1a133d010aeff6d761f7cc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Dani=C3=ABl=20Franke?= Date: Wed, 12 Apr 2023 12:21:44 +0200 Subject: [PATCH] Add documentation about keycloak configuration. --- services/graph/README.md | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/services/graph/README.md b/services/graph/README.md index 0bcc40a4d..f65d623b0 100644 --- a/services/graph/README.md +++ b/services/graph/README.md @@ -30,3 +30,20 @@ The `graph` service can use a configured store via `GRAPH_STORE_TYPE`. Possible 2. Though usually not necessary, a database name and a database table can be configured for event stores if the event store supports this. Generally not applicapable for stores of type `in-memory`. These settings are blank by default which means that the standard settings of the configured store applies. 3. The graph service can be scaled if not using `in-memory` stores and the stores are configured identically over all instances. 4. When using `redis-sentinel`, the Redis master to use is configured via `GRAPH_CACHE_STORE_NODES` in the form of `:/` like `10.10.0.200:26379/mymaster`. + + +## Keycloak configuration for the personal data export + +If Keycloak is used for authentication, the GDPR requires us to add all the personal identifiable +information that keycloak has about the user to the personal data export. To do this, set the following +environment variables: + +* `KEYCLOAK_BASE_PATH` - The URL to the keycloak instance. +* `KEYCLOAK_CLIENT_ID` - The client ID of the client that is used to authenticate with keycloak, this client has to be able to list users and get the credential data. +* `KEYCLOAK_CLIENT_SECRET` - The client secret of the client that is used to authenticate with keycloak. +* `KEYCLOAK_CLIENT_REALM` - The realm the client is defined in. +* `KEYCLOAK_USER_REALM` - The realm the oCIS users are defined in. +* `KEYCLOAK_INSECURE_SKIP_VERIFY` - If set to true, the TLS certificate of the keycloak instance is not verified. + +These variables are the same as the ones used by the invitations service, but can be configured separateley +by prefixing `GRAPH_` to the variable name.