-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'wiki' of https://github.com/bcgov/sso-keycloak into wiki
- Loading branch information
Showing
26 changed files
with
61 additions
and
102 deletions.
There are no files selected for viewing
This file was deleted.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,14 +2,8 @@ Many development teams have gone through similar processes in exploring Pathfind | |
| - FAQ's - The Pathfinder SSO team tracks some frequently asked questions and with answers are made available through the following link: [FAQ's](https://github.com/bcgov/sso-keycloak/discussions/categories/gold-q-a). | ||
| - We encourage you to join the Pathfinder SSO community on [RocketChat](https://chat.developer.gov.bc.ca/channel/sso) and post questions there. Be specific and clear when raising questions or issues and include your user case and expected results. | ||
| - If you find a problem, issue or a bug, please create a GitHub issue [here](https://github.com/bcgov/sso-keycloak/discussions/new?category=q-a) first, and let the team know by posting in RocketChat. | ||
| - The team prefers the channels described above, but if you need to send a message to the team, please email the [Product Owner](mailto:[email protected]). | ||
| - The team prefers the channels described above, but if you need to send a message to the team, please email the <a href="mailto:[email protected]">Product Owner</a>. | ||
|
|
||
| Within RocketChat if you see someone asking questions or have issues for which you may have a solution, please feel free to help out and contribute in RocketChat. We very much appreciate your contributions. | ||
|
|
||
| </details> | ||
|
|
||
| </details> | ||
| <!-- <p align="Center"> | ||
| <img width="800" height="350" src="blobs-in-forest.png"> | ||
| </p> --> | ||
|  | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,17 +1,17 @@ | ||
|
|
||
|
|
||
| ## Navigation | ||
| - [What are identity providers, and which are available to BC Government?](#What-are-identity-providers) | ||
| - [Azure IDIR and IDIR - What's the difference?](#Azure-IDIR-and-IDIR) | ||
| - [What are identity providers, and which are available to BC Government?](#what-are-identity-providers) | ||
| - [Azure IDIR and IDIR - What's the difference?](#azure-idir-and-idir) | ||
| - [Common Login Errors](#common-login-errors) | ||
| - [BC Service Card Integration](#BC-service-card-integration) | ||
| - [Identity Provider Attribute Mapping](https://github.com/bcgov/sso-keycloak/wiki/Identity-Provider-Attribute-Mapping) | ||
| - [BC Service Card Integration](#bc-service-card-integration) | ||
| - [Identity Provider Attribute Mapping](Identity-Provider-Attribute-Mapping) | ||
| - [BC Government Identity Standards aka IM/IT Identity Standards](https://www2.gov.bc.ca/gov/content/governments/services-for-government/policies-procedures/im-it-standards/find-a-standard#id_mgt) | ||
|
|
||
|
|
||
| ## What are identity providers? | ||
| ## What are Identity Providers? | ||
|
|
||
| [Identity providers](https://github.com/bcgov/sso-keycloak/wiki/Useful-References#identity-provider) are directories of user accounts with details about those users, called attributes. The ones available to Pathfinder SSO Clients are: | ||
| [Identity providers](Useful-References#identity-provider) are directories of user accounts with details about those users, called attributes. The ones available to Pathfinder SSO Clients are: | ||
| - **IDIR** IDIR accounts are given to individuals who work for the B.C. government. Each account has an IDIR username and password for logging in. [reference](https://www2.gov.bc.ca/gov/content/governments/services-for-government/information-management-technology/identity-and-authentication-services/login-best-practices/language-consistency) | ||
|
|
||
| - **Azure IDIR** IDIR accounts with the added the benefit of MFA (multi-factor authentication). This is a step up security-wise from regular IDIR. [reference](https://intranet.gov.bc.ca/thehub/ocio/ocio-enterprise-services/information-security-branch/information-security-mfa/mfa-registration) | ||
|
|
@@ -26,15 +26,16 @@ | |
| - **GitHub associated with BC Gov Org** Allows login of GitHub BC Gov Org member. At the time of writing, production approval for this requires you to obtain an exemption to the IM/IT standards. [IM/IT Standards Frequently Asked Questions](https://www2.gov.bc.ca/gov/content/governments/services-for-government/policies-procedures/im-it-standards/im-it-standards-faqs) | ||
|
|
||
|
|
||
| ## Azure IDIR and IDIR? | ||
| ## Azure IDIR and IDIR | ||
| Using Azure IDIR adds the benefit of MFA (multi-factor authentication). This is a step up security-wise from regular IDIR. | ||
|
|
||
| You may have to educate your end users on MFA and please take note if your IDIR is not tied to a gov.bc.ca email address, please use [email protected] when prompted for your email. | ||
|
|
||
| You can **learn** [here from our IDIR Partner](https://intranet.gov.bc.ca/thehub/ocio/ocio-enterprise-services/information-security-branch/information-security-mfa/mfa-registration) | ||
|
|
||
| Also note if you get an error message similar to the one below, please ensure the end user has an BC Gov Azure IDIR account in order to gain access. | ||
| <img width="380" height="300" src="https://user-images.githubusercontent.com/56739669/234470765-f3250a0a-7a62-4c42-b532-682351c0e103.png"> | ||
|
|
||
| {: style="width:320px;height:400px"} | ||
|
|
||
| ## Common Login Errors | ||
|
|
||
|
|
@@ -46,16 +47,15 @@ Please use a private browser by either using incognito or clearing your cache. | |
|
|
||
| ### Other issues | ||
|
|
||
| Please ensure you have tested with an incognito browser as mentioned above. If it is still an issue, reachout to use on [rocketchat](https://chat.developer.gov.bc.ca/channel/sso) | ||
| Please ensure you have tested with an incognito browser as mentioned above. If it is still an issue, reachout to us on [rocketchat](https://chat.developer.gov.bc.ca/channel/sso). | ||
|
|
||
| ## Digital Credential Configuration | ||
|
|
||
| This defines which credential (or combinations of credentials) will be requested at user authentication. | ||
|
|
||
| Please work with the DITP team [email protected] to define whether an existing configuration can be used, or a new one should be created for the specific use-case. Additionally, some best practices that need to be implemented at the application level can be found [here](https://github.com/bcgov/vc-authn-oidc/blob/main/docs/BestPractices.md) | ||
| Please work with the DITP team [email protected] to define whether an existing configuration can be used, or a new one should be created for the specific use-case. Additionally, some best practices that need to be implemented at the application level can be found [here](https://github.com/bcgov/vc-authn-oidc/blob/main/docs/BestPractices.md). | ||
|
|
||
| ## BC Service Card Integration | ||
| <br> | ||
|
|
||
| *BC Services Card provides an Open ID Connect authentication server. Integration to this service is not available in the *standard* realms.* | ||
|
|
||
|
|
@@ -67,8 +67,6 @@ The IDIM team that manages BCSC integration is responsible for safeguarding the | |
|
|
||
| <details> | ||
| <summary><b>Join an Existing Dedicated Custom Realm</b></summary> | ||
| <br> | ||
|
|
||
| With approval from IDIM, it is possible to join an existing realm that shares the same security context as your application and already has BCSC set up. This generally means that the existing clients are all from the same ministry or sector and have the same requirements for personal information through the login process. | ||
|
|
||
| There are very few instances of this pattern at this time, but it is an option that is possible with the help and approval of IDIM. | ||
|
|
@@ -78,7 +76,6 @@ Be that as it may, if there is a closely related project in your ministry or sec | |
|
|
||
| <details> | ||
| <summary><b>Integrate Directly with BCSC</b></summary> | ||
| <br> | ||
|
|
||
| Since IDIM provides an OIDC service for BCSC, your app can integrate directly with that service instead of brokering through Pathfinder SSO. Their security practices usually require a client per application in any case, so your architecture might not require using Pathfinder SSO as a proxy authentication service anyway. In addition, this pattern removes one possible point of failure from the application architecture. | ||
|
|
||
|
|
@@ -89,36 +86,31 @@ Be mindful however that the SSO (Keycloak) product does offer token and session | |
| <details> | ||
| <summary><b>Configure and Manage Your Own Dedicated KeyCloak Server | ||
| </b></summary> | ||
| <br> | ||
|
|
||
|
|
||
| KeyCloak runs on JBoss quite happily in a Docker container with a PostgreSQL backend. If you really need features provided by KeyCloak and you want to integrate with BCSC, it's possible to run your own KeyCloak server and configure your connection to BCSC by setting up your own OIDC IDP. | ||
| </details> | ||
|
|
||
| <details> | ||
| <summary><b>Obtain a Dedicated KeyCloak Realm on the Pathfinder SSO service | ||
| </b></summary> | ||
| <br> | ||
|
|
||
| If the service gets to the point where there are "slots" to create new dedicated realms, a BCSC identity provider can be securely configured within a realm dedicated to your team. For now, we are unable to offer new realms while we work to reduce the number down to a manageable size. | ||
| </details> | ||
|
|
||
| <details> | ||
| <summary><b>Other? | ||
| </b></summary> | ||
| <br> | ||
|
|
||
| Things are always evolving and the BC Government Open Source community is constantly innovating and solving problems together. Don't be afraid to jump into the #SSO RocketChat channel and see what the community recommends if you have an unusual use case or an innovative idea. Thank you for your collaboration! | ||
|
|
||
|
|
||
| </details> | ||
|
|
||
|
|
||
| <p align="right"> | ||
| <img width="400" height="200" src="https://user-images.githubusercontent.com/87393930/133848225-13dfcb95-7a2e-46b4-ace7-edc436473905.png"> | ||
| <p align="right" markdown> | ||
|  | ||
| </p> | ||
|
|
||
| ---------------------------- | ||
| #### *Have any questions? We would love to hear from you.* [][2] <a href="mailto:[email protected]?"><img src="https://user-images.githubusercontent.com/87393930/133690650-b706e658-27bf-4066-92ba-3a7d8a4593ef.png"/></a> | ||
| #### *Have any questions? We would love to hear from you.* [][2] <a href="mailto:[email protected]"></a> | ||
| [2]: https://chat.developer.gov.bc.ca/channel/sso | ||
| [3]: https://[mail](mailto:[email protected])[email](mailto:[email protected]) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,7 +2,7 @@ | |
| * [START USING OIDC CLIENT CONFIGURATION](#start-using-your-OIDC-client-configuration) | ||
|
|
||
|
|
||
|  | ||
|  | ||
|
|
||
| ---------------------------------- | ||
|
|
||
|
|
@@ -24,6 +24,6 @@ Please visit [BCGov Cloud Services](https://digital.gov.bc.ca/cloud/services/) | |
|
|
||
| Once you have your client details, you can configure your application to use the service for your application login. For helpful advice on integration see [Using Your SSO Client](https://bcgov.github.io/sso-docs/category/getting-started) or **if you are eager**, check out our [keycloak example apps](https://github.com/bcgov/keycloak-example-apps) | ||
|
|
||
| #### *Have any questions? We would love to hear from you.* [][2] <a href="mailto:[email protected]?"><img src="https://user-images.githubusercontent.com/87393930/133690650-b706e658-27bf-4066-92ba-3a7d8a4593ef.png"/></a> | ||
| #### *Have any questions? We would love to hear from you.* [][2] <a href="mailto:[email protected]"></a> | ||
| [2]: https://chat.developer.gov.bc.ca/channel/sso | ||
| [3]: https://[mail](mailto:[email protected])[email](mailto:[email protected]) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,10 @@ | ||
| * [Intro to terms](#Intro-to-terms) | ||
| * [Intro to terms](#intro-to-terms) | ||
| * [How we describe Keycloak](#keycloak-how-we-describe-it) | ||
| * [Newbie Guide: Concepts and Terms](#newbie-guide) | ||
| * [Learn about the Open ID connect and OAuth Protocols](#Learn-about-the-Open-ID-connect-and-OAuth-Protocols) | ||
| * [Learn about the Open ID connect and OAuth Protocols](#learn-about-the-open-id-connect-and-oauth-protocols) | ||
| * [Our Youtube videos on OIDC 101](#oidc-101) | ||
| * [Learn about Keycloak and its APIs](#Learn-about-Keycloak-and-its-APIs) | ||
| * [How to set up and use your KeyCloak Client](#How-to-set-up-and-use-your-KeyCloak-Client) | ||
| * [Learn about Keycloak and its APIs](#learn-about-keycloak-and-its-apis) | ||
| * [How to set up and use your KeyCloak Client](#how-to-set-up-and-use-your-keycloak-client) | ||
| * [Q&A with Us](#qa-with-us) | ||
|
|
||
|
|
||
|
|
@@ -26,7 +26,7 @@ An "Identity Provider" is the holder of the identity that is used to log in with | |
|
|
||
| [Visit this FAQ](https://github.com/bcgov/sso-keycloak/discussions/256) on which Identity Provider might be best for you | ||
|
|
||
| ### [Keycloak how we describe it](https://github.com/bcgov/sso-keycloak/wiki/What-is-Keycloak-@-BC-Government%3F#what-is-keycloak) | ||
| ### [Keycloak how we describe it](What-is-Keycloak-at-BC-Government#what-is-keycloak) | ||
|
|
||
| ### Newbie Guide | ||
|
|
||
|
|
@@ -72,8 +72,6 @@ The following links are a good introduction or refresher to the OIDC standard. | |
|
|
||
| [Stackover flow Collection 2 on Custom Realms](https://stackoverflow.developer.gov.bc.ca/search?q=custom+realm) | ||
|
|
||
|
|
||
|
|
||
| #### *Have any questions? We would love to hear from you.* [][2] <a href="mailto:[email protected]?"><img src="https://user-images.githubusercontent.com/87393930/133690650-b706e658-27bf-4066-92ba-3a7d8a4593ef.png"/></a> | ||
| #### *Have any questions? We would love to hear from you.* [][2] <a href="mailto:[email protected]"></a> | ||
| [2]: https://chat.developer.gov.bc.ca/channel/sso | ||
| [3]: https://[mail](mailto:[email protected])[email](mailto:[email protected]) | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.