This is the Admin UI for the Canonical Identity Platform.
OTEL_GRPC_ENDPOINT: address of the open telemetry grpc endpoint, used for tracingOTEL_HTTP_ENDPOINT: address of the open telemetry http endpoint, used for tracing (grpc endpoint takes precedence)TRACING_ENABLED: flag enabling tracingLOG_LEVEL: log level, one ofinfo,warn,error,debug, defaults toerrorLOG_FILE: file where to dump logs, defaults tolog.txtPORT: http server port, defaults to8080CONTEXT_PATH: the context path that the application will be served on, needed to perform redirection correctlyDEBUG: debugging flag for hydra and kratos clientsKUBECONFIG_FILE: optional path of kube config file, default to empty stringKRATOS_PUBLIC_URL: Kratos public endpoints addressKRATOS_ADMIN_URL: Kratos admin endpoints addressHYDRA_ADMIN_URL: Hydra admin endpoints addressIDP_CONFIGMAP_NAME: name of the k8s config map containing Identity ProvidersIDP_CONFIGMAP_NAMESPACE: namespace of the k8s config map containing Identity ProvidersSCHEMAS_CONFIGMAP_NAME: name of the k8s config map containing Identity SchemasSCHEMAS_CONFIGMAP_NAMESPACE: namespace of the k8s config map containing Identity SchemasOPENFGA_API_SCHEME: scheme for the OpenFGA host variable, eitherhttporhttpsOPENFGA_API_HOST: host of the OpenFGA serverOPENFGA_API_TOKEN: token used to interact with OpenFGA server, dictated by OpenFGA serverOPENFGA_STORE_ID: ID of the OpenFGA store the application will talk toOPENFGA_AUTHORIZATION_MODEL_ID: ID of the OpenFGA authorization model the application will talk toAUTHORIZATION_ENABLED: flag defining if the OpenFGA authorization middleware is enabled default tofalsePAYLOAD_VALIDATION_ENABLED: flag defining if the Payload Validation middleware is enabled default totrueAUTHENTICATION_ENABLED: flag defining if the OAuth authentication middleware is enabled, default tofalseOIDC_ISSUER: URL of the OIDC providerOAUTH2_CLIENT_ID: OAuth2 client ID used for authentication purposesOAUTH2_CLIENT_SECRET: OAuth2 client secret used for authentication purposesOAUTH2_REDIRECT_URI: URI used by the Oauth2 provider for the redirecting callbackOAUTH2_CODEGRANT_SCOPES: OAuth2 scopes, defaults toopenid,offline_accessOAUTH2_AUTH_COOKIES_ENCRYPTION_KEY: 32 bytes string used for encrypting cookiesACCESS_TOKEN_VERIFICATION_STRATEGY: OAuth2 verification startegy, one ofjwksor `userinfo``
As a requirement, please make sure to:
- have
rockcraft,yq, andmakeinstalled
snap install rockcraft
snap install yq
apt install make
# Ensure skopeo is in the path
sudo ln -s /snap/rockcraft/current/bin/skopeo /usr/local/bin/skopeo- Microk8s is installed with the
registryaddon operating atlocalhost:32000and kubectl configured to use it
snap install microk8s --classic
microk8s status --wait-ready
microk8s enable registry
# ensure kubectl is configured to use microk8s
microk8s.kubectl config view --raw > $HOME/.kube/config
# Alias kubectl so that it can be used by Skaffold
snap alias microk8s.kubectl kubectl-
ensure
skaffold,container-structure-test,dockerand helm are installed according to their documentation -
initialise LXD so that it has a default profile when used by
rockcraftduringskaffold build
sudo lxd init --autoRun make dev to get a working environment in k8s.
To stop any running containers and wipe the container state,
run skaffold delete from the top of the repository.
To avoid a continuos redeployment of the whole setup, there is always the manual
process of building
the admin-ui image
$ SKAFFOLD_DEFAULT_REPO=localhost:32000 skaffold build --push=true --cache-artifacts=false
Generating tags...
- identity-platform-admin-ui -> localhost:32000/identity-platform-admin-ui:v1.5.0-181-g1107165-dirty
Starting build...
Building [identity-platform-admin-ui]...
Target platforms: [linux/amd64]
Starting rockcraft, version 1.2.3
Logging execution to '/home/shipperizer/.local/state/rockcraft/log/rockcraft-20240424-135944.672894.log'
Launching managed ubuntu 22.04 instance...
.
.
v1.5.0-181-g1107165-dirty: digest: sha256:027745f048faddda78b4cd7b9c7dbb59bec8b446941b163006da32f29b9eb377 size: 943and then substituting the final artifact in the deployment via kubectl with
kubectl edit deployments.apps identity-platform-admin-ui
where you will swap whatever is in spec.template.spec.containers.0.image with
the new image tag (with sha)
The Admin Service comes up with authorization disabled (
see AUTHORIZATION_ENABLED env var), The env
vars OPENFGA_AUTHORIZATION_MODEL_ID and OPENFGA_STORE_ID which are needed
for the correct functioning of the RBAC APIs get set by the
job admin-ui-openfga-setup, after this has completed a developer is supposed
to bounce the deployment to get the application to source the new env vars
If AUTHORIZATION_ENABLED is set to false, the user context passed to OpenFGA
will default to user:anonymous, which will make every call to roles and groups
API return an empty response (unless model is populated with relationship linked
to user:anonymous)
# Wait for the openfga setup job to complete
kubectl wait --for=condition=complete job/admin-ui-openfga-setup
# Edit the configmap to enable authorization by setting AUTHORIZATION_ENABLED=true
kubectl edit configmap identity-platform-admin-ui
# Restart the admin UI apply the changes
kubectl rollout restart deployment identity-platform-admin-uiK8s jobs don't get deleted on their own so if you wish to make changes to the openfga model, you need to make sure that the job for setting up openfga is deleted before redeploying the admin UI:
kubectl delete job admin-ui-openfga-setup
make devensure environment variables in the identity-platform-admin-ui configmap
reflect the status you want.
$ http :8000/api/v0/identities
HTTP/1.1 200 OK
Content-Length: 86
Content-Type: application/json
Date: Wed, 11 Oct 2023 10:05:37 GMT
Vary: Origin
{
"_meta": {
"page": 1,
"size": 100
},
"data": [],
"message": "List of identities",
"status": 200
}$ http :8000/api/v0/idps
HTTP/1.1 200 OK
Content-Length: 1520
Content-Type: application/json
Date: Wed, 11 Oct 2023 10:05:43 GMT
Vary: Origin
{
"_meta": null,
"data": [
{
"apple_private_key": "",
"apple_private_key_id": "",
"apple_team_id": "",
"auth_url": "",
"client_id": "af675f35-3bd7-4515-88e2-b8032e315f6f",
"client_secret": "3y38Q~aslkdhaskjhd~W0xWDB.123u98asd",
"id": "microsoft_af675f353bd7451588e2b8032e315f6f",
"issuer_url": "",
"label": "",
"mapper_url": "file:///etc/config/kratos/microsoft_schema.jsonnet",
"microsoft_tenant": "e1574293-28de-4e94-87d5-b61c76fc14e1",
"provider": "microsoft",
"requested_claims": null,
"scope": [
"profile",
"email",
"address",
"phone"
],
"subject_source": "",
"token_url": ""
},
{
"apple_private_key": "",
"apple_private_key_id": "",
"apple_team_id": "",
"auth_url": "",
"client_id": "18fa2999-e6c9-475a-a495-15d933d8e8ce",
"client_secret": "3y38Q~aslkdhaskjhd~W0xWDB.123u98asd",
"id": "google_18fa2999e6c9475aa49515d933d8e8ce",
"issuer_url": "",
"label": "",
"mapper_url": "file:///etc/config/kratos/google_schema.jsonnet",
"microsoft_tenant": "",
"provider": "google",
"requested_claims": null,
"scope": [
"profile",
"email",
"address",
"phone"
],
"subject_source": "",
"token_url": ""
},
{
"apple_private_key": "",
"apple_private_key_id": "",
"apple_team_id": "",
"auth_url": "",
"client_id": "18fa2999-e6c9-475a-a495-89d941d8e1zy",
"client_secret": "3y38Q~aslkdhaskjhd~W0xWDB.123u98asd",
"id": "aws_18fa2999e6c9475aa49589d941d8e1zy",
"issuer_url": "",
"label": "",
"mapper_url": "file:///etc/config/kratos/google_schema.jsonnet",
"microsoft_tenant": "",
"provider": "aws",
"requested_claims": null,
"scope": [
"profile",
"email",
"address",
"phone"
],
"subject_source": "",
"token_url": ""
}
],
"message": "List of IDPs",
"status": 200
}$ http :8000/api/v0/clients
HTTP/1.1 200 OK
Content-Length: 316
Content-Type: application/json
Date: Wed, 11 Oct 2023 10:05:47 GMT
Vary: Origin
{
"_links": {
"first": "/api/v0/clients?page=eyJvZmZzZXQiOiIwIiwidiI6Mn0&size=200",
"next": "/api/v0/clients?page=eyJvZmZzZXQiOiIyMDAiLCJ2IjoyfQ&size=200",
"prev": "/api/v0/clients?page=eyJvZmZzZXQiOiItMjAwIiwidiI6Mn0&size=200"
},
"_meta": {
"total_count": "0"
},
"data": [],
"message": "List of clients",
"status": 200
}
![renovate[bot] avatar](https://avatars.githubusercontent.com/in/2740?v=4 "renovate[bot]")
React
Typescript
Django
Laravel
Facebook
Microsoft
Google
Alibaba
D3
Tencent