Invitations Service Configuration

Introduction

The Infinite Scale invitations service provides an invitation manager that can be used to invite external users, aka guests, to an organization. See the Invitation Manager for more details.

  • Users invited via the Invitation Manager (via the LibreGraph API) will have the userType="Guest".

  • Users belonging to the organization have the userType="Member".

  • The invitations service does not start automatically and must be started manually. For more details see the Start Infinite Scale section.

  • The reason for excluding the invitations service from autostart is, that you need upfront a business decision if your organisation will allow inviting external users.

Provisioning Backends

When Infinite Scale is used via the IDM service for the user management, users are created using the /graph/v1.0/users endpoint via the LibreGraph API. For larger deployments, the Keycloak admin API can be used to provision users. In a future step, the endpoint, credentials and body might be made configurable using templates.

Keycloak

The default and currently only available backend used to handle invitations is Keycloak. Keycloak is an open source identity and access management (IAM) system which is also integrated by other Infinite Scale services as an authentication and authorization backend.

Keycloak Realm Configuration

See the example configuration json file of a Keycloak realm the backend will work with. This file includes the invitations client, which is relevant for this service.

To use the example json, set the INVITATIONS_KEYCLOAK_CLIENT_ID setting to invitations, though any other client ID can be configured.

Importing this example into Keycloak will give you a realm that federates with an LDAP server, has the right clients configured and all mappers correctly set. Be sure to set all the credentials after the import, as they will be disabled.

The most relevant bits are the mappers for the OWNCLOUD_ID and OWNCLOUD_USER_TYPE user properties.

Backend Configuration

After Keycloak has been configured, the invitation service needs to be configured with the following environment variables:

Environment Variable Description

INVITATIONS_KEYCLOAK_BASE_PATH

The URL to access Keycloak.

INVITATIONS_KEYCLOAK_CLIENT_ID

The client ID of the client to use. In the above example, invitations is used.

INVITATIONS_KEYCLOAK_CLIENT_SECRET

The client secret used to authenticate. This can be found in the Keycloak UI.

INVITATIONS_KEYCLOAK_CLIENT_REALM

The realm where the client was added. In the example above, ocis is used.

INVITATIONS_KEYCLOAK_USER_REALM

The realm where to add the users. In the example above, ocis is used.

INVITATIONS_KEYCLOAK_INSECURE_SKIP_VERIFY

If set to true, the verification of the Keycloak HTTPS certificate is skipped. This is not recommended in production environments.

Bridging Provisioning Delay

Consider that when a guest account has to be provisioned in an external user management, there might be a delay between creating the user and the user being available in the local Infinite Scale system.

Configuration

Environment Variables

The invitations service is configured via the following environment variables. Read the Environment Variable Types documentation for important details. Column IV shows with which release the environment variable has been introduced.

404: Not Found

  • 8.1.0

404: Not Found

YAML Example

  • 8.1.0

404: Not Found