Skip to main content

Technical Design Specifications

Milestone scopes​

👍 Milestone 1

  • API
    • Services affected
      • Frontdoor
      • Core API
      • User?
    • Endpoints to...
      • list users by access level id
      • list roles by access level id
      • assign role to user
      • remove user from role
  • UI
    • Update IAM page for user assignment and lookup
  • DevOps
    • Automate Keycloak deployments using Terraform and Gitops

📘 Milestone 2

  • API
    • Services affected
      • Data API
      • Core API
    • Endpoints
      • Import AD groups into KC
      • Assign roles and view groups
  • UI
    • Update IAM page for group assignment and lookup
  • DevOps
    • Update link to keycloak realm, service account client and secret for ADF authentication

Architecture​

No new components or services are to be introduced for this feature. All existing APIs and UI will be extended to support new auth structure

Infrastructure​

  • Azure
    • Each newly created realm has 2 Identity providers whose redirect urls must be set to Application Registration
  • GitOps
    • Populate missing global_id and name values in empower-tenant repo
    • Refactor enterprisechat-tenant repo to match empower-tenant repo
  • Kubernetes (AKS)
    • Configure new terraform scripts for TF Controller
  • Keycloak
    • Create admin-client in master realm with admin priveleges
    • Old realm are kept untouched till later notice
    • All provisioning is executed by terraform:
      • Create new realms
      • Create new roles in new oidc clients
      • Create new groups with attributes
      • Create new identity provider with mapper

Role and Enterprise structures:​

Deployment​

UI​

Design​

API​

Sequence diagrams​

Endpoint definitions​

v1.user.roles

v1.user.principals