Invitations Service Configuration
Introduction
The Infinite Scale invitations service provides an invitation manager that can be used to invite external users, aka guests, to an organization. See the Invitation Manager for more details.
-
Users invited via the Invitation Manager (via the LibreGraph API) will have the
userType="Guest"
. -
Users belonging to the organization have the
userType="Member"
.
Provisioning Backends
When Infinite Scale is used via the IDM service for the user management, users are created using the /graph/v1.0/users
endpoint via the LibreGraph API. For larger deployments, the Keycloak admin API can be used to provision users. In a future step, the endpoint, credentials and body might be made configurable using templates.
Keycloak
The default and currently only available backend used to handle invitations is Keycloak. Keycloak is an open source identity and access management (IAM) system which is also integrated by other Infinite Scale services as an authentication and authorization backend.
Keycloak Realm Configuration
See the example configuration json file of a Keycloak realm the backend will work with. This file includes the invitations
client, which is relevant for this service.
To use the example json, set the INVITATIONS_KEYCLOAK_CLIENT_ID
setting to invitations
, though any other client ID can be configured.
Importing this example into Keycloak will give you a realm that federates with an LDAP server, has the right clients configured and all mappers correctly set. Be sure to set all the credentials after the import, as they will be disabled.
The most relevant bits are the mappers for the OWNCLOUD_ID
and OWNCLOUD_USER_TYPE
user properties.
Backend Configuration
After Keycloak has been configured, the invitation service needs to be configured with the following environment variables:
Environment Variable | Description |
---|---|
|
The URL to access Keycloak. |
|
The client ID of the client to use. In the above example, |
|
The client secret used to authenticate. This can be found in the Keycloak UI. |
|
The realm where the client was added. In the example above, |
|
The realm where to add the users. In the example above, |
|
If set to true, the verification of the Keycloak HTTPS certificate is skipped. This is not recommended in production environments. |
Bridging Provisioning Delay
Consider that when a guest account has to be provisioned in an external user management, there might be a delay between creating the user and the user being available in the local Infinite Scale system.
Configuration
Environment Variables
The invitations
service is configured via the following environment variables. Read the Environment Variable Types documentation for important details.
Name | Type | Default Value | Description |
---|---|---|---|
|
bool |
false |
Activates tracing. |
|
string |
|
The type of tracing. Defaults to '', which is the same as 'jaeger'. Allowed tracing types are 'jaeger' and '' as of now. |
|
string |
|
The endpoint of the tracing agent. |
|
string |
|
The HTTP endpoint for sending spans directly to a collector, i.e. http://jaeger-collector:14268/api/traces. Only used if the tracing endpoint is unset. |
|
string |
|
The log level. Valid values are: 'panic', 'fatal', 'error', 'warn', 'info', 'debug', 'trace'. |
|
bool |
false |
Activates pretty log output. |
|
bool |
false |
Activates colorized log output. |
|
string |
|
The path to the log file. Activates logging to this file if set. |
|
string |
127.0.0.1:0 |
Bind address of the debug server, where metrics, health, config and debug endpoints will be exposed. |
|
string |
|
Token to secure the metrics endpoint. |
|
bool |
false |
Enables pprof, which can be used for profiling. |
|
bool |
false |
Enables zpages, which can be used for collecting and viewing in-memory traces. |
|
string |
127.0.0.1:0 |
The bind address of the HTTP service. |
|
string |
/graph/v1.0 |
Subdirectory that serves as the root for this HTTP service. |
|
[]string |
[*] |
A comma-separated list of allowed CORS origins. See following chapter for more details: Access-Control-Allow-Origin at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Origin |
|
[]string |
[] |
A comma-separated list of allowed CORS methods. See following chapter for more details: Access-Control-Request-Method at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Method |
|
[]string |
[] |
A blank or comma-separated list of allowed CORS headers. See following chapter for more details: Access-Control-Request-Headers at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Request-Headers. |
|
bool |
false |
Allow credentials for CORS.See following chapter for more details: Access-Control-Allow-Credentials at https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Access-Control-Allow-Credentials. |
|
bool |
false |
Activates TLS for the http based services using the server certifcate and key configured via OCIS_HTTP_TLS_CERTIFICATE and OCIS_HTTP_TLS_KEY. If OCIS_HTTP_TLS_CERTIFICATE is not set a temporary server certificate is generated - to be used with PROXY_INSECURE_BACKEND=true. |
|
string |
|
Path/File name of the TLS server certificate (in PEM format) for the http services. |
|
string |
|
Path/File name for the TLS certificate key (in PEM format) for the server certificate to use for the http services. |
|
string |
|
The URL to access keycloak. |
|
string |
|
The client ID to authenticate with keycloak. |
|
string |
|
The client secret to use in authentication. |
|
string |
|
The realm the client is defined in. |
|
string |
|
The realm users are defined. |
|
bool |
false |
Disable TLS certificate validation for Keycloak connections. Do not set this in production environments. |
|
string |
|
The secret to mint and validate jwt tokens. |
YAML Example
Note that the filename shown below has been chosen on purpose.
See the Configuration File Naming for details when setting up your own configuration.
# Autogenerated
# Filename: invitations-config-example.yaml
tracing:
enabled: false
type: ""
endpoint: ""
collector: ""
log:
level: ""
pretty: false
color: false
file: ""
debug:
addr: 127.0.0.1:0
token: ""
pprof: false
zpages: false
http:
addr: 127.0.0.1:0
root: /graph/v1.0
cors:
allow_origins:
- '*'
allow_methods: []
allow_headers: []
allow_credentials: false
tls:
enabled: false
cert: ""
key: ""
keycloak:
base_path: ""
client_id: ""
client_secret: ""
client_realm: ""
user_realm: ""
insecure_skip_verify: false
token_manager:
jwt_secret: ""