{"type":"doc","content":[{"type":"paragraph","content":[{"text":"In production environments it is recommendet to connect Smartfacts directly to your OIDC provider. In this case no Keycloak and no CAMP component is deployed. There will be no pre-provisioning of users. As soon as a user logs in into Smartfacts, he will be provisioned on the fly.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configuration of the OIDC client or application in your OIDC provider","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Add valid Redirect URIs","type":"text"}]},{"type":"paragraph","content":[{"text":"In the client of you OIDC provider, add the following URLs to the list of valid redirect URLs. ","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://smartfacts.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://smartfacts./login","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://genoslc./login/oauth2/code/custom","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://genoslc-jama./login/oauth2/code/custom ","type":"text"},{"type":"hardBreak"},{"text":"(if you use OIDC to Jama Connect)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"https://genoslc-codebeamer./login/oauth2/code/custom ","type":"text"},{"type":"hardBreak"},{"text":"(if you use OIDC to Codebeamer)","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This list uses the default sub domains of Smartfacts. If you changed sub domains in your deployment, please adopt the values accordingly.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Set Grant Type","type":"text"}]},{"type":"paragraph","content":[{"text":"Set the grant type to ","type":"text"},{"text":"authorization_code","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Configure the deployment","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Disable deployment of CAMP and Keycloak components","type":"text"}]},{"type":"paragraph","content":[{"text":"To disable the deployment of the CAMP and the Keycloak, add the following two lines in the values file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"camp:\n enabled: false\nkeycloak:\n enabled: false","type":"text"}]},{"type":"paragraph","content":[{"text":"Make sure, that you do not already have section for camp and Keykloak in your values file. If so, replace them.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configure the connection to the OIDC provider for Smartfacts","type":"text"}]},{"type":"paragraph","content":[{"text":"In the ","type":"text"},{"text":"global","type":"text","marks":[{"type":"strong"}]},{"text":" section of your values file add the information of you OIDC provider:","type":"text"}]},{"type":"codeBlock","content":[{"text":" secrets:\n oauth2:\n wellknown: \"https:///auth/realms//.well-known/openid-configuration\"\n smartfacts:\n clientId: \"\"\n clientSecret: \"\"\n identity:\n OIDC_ISSUER: \"https:///auth/realms/\"\n url:\n spa:\n scopes: \"sf:bpm\" # state the scopes here in a space separated list\n nonce: \"false\"\n state: \"false\" # if true, Smartfacts generates a state parameter while getting the token from the OIDC provider.\n","type":"text"}]},{"type":"paragraph","content":[{"text":"In lines 3 and 8 replace the placeholder ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the adress of you OIDC provider and the placeholder ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the name of the realm in your OIDC provider","type":"text"}]},{"type":"paragraph","content":[{"text":"In line 5 replace the placeholder ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the name of the client in your OIDC provider.","type":"text"}]},{"type":"paragraph","content":[{"text":"In line 6 replace the placeholder ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the client secret of the client.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"With Azure AD as OIDC provider it is necessary to add the path “","type":"text"},{"text":"https://graph.microsoft.com/oidc/userinfo","type":"text","marks":[{"type":"link","attrs":{"href":"https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgraph.microsoft.com%2Foidc%2Fuserinfo&data=05%7C02%7Cr.beckert%40mid.de%7C307cb9cdcfd84e23367808dc28bcad5f%7Cee6e1b0f50fa4c6fadff46e94b3aa120%7C0%7C0%7C638430038145914951%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=v5RaR24bGOpeR9LNDO78c771YjcPSV%2BXcZt9tDp5f70%3D&reserved=0"}}]},{"text":"“ to the property spa.cspConf.externalUrls. This will add the URL to the list of allowed CORS origins.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configure the connection to the OIDC provider for the OSLC Connector for Smartfacts","type":"text"}]},{"type":"paragraph","content":[{"text":"To connect the OSLC Connector for Smartfacts with your OIDC provider, add the following properties in the ","type":"text"},{"text":"genoslc.env","type":"text","marks":[{"type":"strong"}]},{"text":" section of your values file for the Smartfacts deployment, as seen below:","type":"text"}]},{"type":"codeBlock","content":[{"text":" authorizationUri: \"\"\n tokenUri: \"\"\n userInfoUri: \"\"","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Replace the placeholder in ","type":"text"},{"text":"authorizationUri,","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"tokenUri ","type":"text","marks":[{"type":"strong"}]},{"text":"and ","type":"text"},{"text":"userInfoUri ","type":"text","marks":[{"type":"strong"}]},{"text":"with the appropriate URLs of your identity provider instance","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Adopting to custom token claims","type":"text"}]},{"type":"paragraph","content":[{"text":"If necessary, you can adopt the deployment to use custom token claims. To do this, use the following properties in your values file:","type":"text"}]},{"type":"codeBlock","content":[{"text":"global\n secrets:\n oauth2:\n tokenClaims:\n id: \"\"\n email: \"\"\n name: \"\"\n lastName: \"\"\n givenName: \"\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Defaults, if no settings are provided:","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"c1a45a6c-6bfa-41e7-b01c-b1cdd152e70e"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Property","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"AzureAD/EntraId","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"KeyCloak","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"id","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[token]:sub","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:sub","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"email","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:email","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:email","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"name","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:username","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:username","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"lastName","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:familyName,[userInfo]:family_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:familyName,[userInfo]:family_name","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"givenName","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:given_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"[userInfo]:given_name","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Configure access rules","type":"text"}]},{"type":"paragraph","content":[{"text":"In a second step access rules and optional groups must be configured. To do so create a new text file “group-rules.yaml” and paste the following text into it:","type":"text"}]},{"type":"codeBlock","content":[{"text":"global:\n lcam:\n rules:\n - groupName: \"Smartfacts Users\"\n claim: \"email\"\n value:\n - \"@\"\n groupLicence:\n - \"LIC_SMARTFACTS_USER\"\n accountName: \"Smartfacts Account\"\n - groupName: \"Account Administrators\"\n claim: \"email\"\n value:\n - \"account.administrator@your.domain\"\n groupLicence:\n - \"LIC_SMARTFACTS_USER\"\n accountName: \"Smartfacts Account\"","type":"text"}]},{"type":"paragraph","content":[{"text":"To adopt the rules to your environment, configure the necessary information in the file. ","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Claim sources","type":"text"}]},{"type":"paragraph","content":[{"text":"Practical experience has shown that the values of one and the same claim can differ in the token and in the UserInfo. To take this into account and to simplify configuration, Smartfacts allows you to specify the source of a claim.","type":"text"}]},{"type":"paragraph","content":[{"text":"By prefixing the qualifier [token]: or [userinfo]:, you can determine from which source the value of a claim should be determined.","type":"text"},{"type":"hardBreak"},{"text":"If \"[token]:\" is prefixed, the value of the claim is determined directly from the token.","type":"text"},{"type":"hardBreak"},{"text":"If \"[userinfo]:\" is prefixed, the value of the claim is determined from the result of the UserInfo Endpoint of the OIDC provider.","type":"text"}]},{"type":"paragraph","content":[{"text":"If no qualifier is specified, \"[userinfo]:\" is implicitly prefixed.","type":"text"}]},{"type":"paragraph","content":[{"text":"e.g. ","type":"text"},{"text":" ","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"- claim: \"[token]:email\"","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"- claim: \"[userinfo]:email\"","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Configure Allowed email adresses","type":"text"}]},{"type":"paragraph","content":[{"text":"Line 8 is a pattern for all valid email-Adresses of the users. So the value “@” allows all users known by your OIDC provider to login into Smartfacts.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Configure Account administrators","type":"text"}]},{"type":"paragraph","content":[{"text":"Please replace line 13 with the email adress of the person who will be account addministrator. By inserting more lines (all starting with “-”) you can add additional account administrators.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Redeploy Smartfacts","type":"text"}]},{"type":"paragraph","content":[{"text":"For the deployment, additionally state the file “group-rules.yaml“ in the upgrade command.","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo helm upgrade --install --timeout 20m0s smartfacts mid-smartfacts/smartfacts -f values.yaml -f group-rules.yaml --version 4.7.5-genoslcv2 -n smartfacts --create-namespace","type":"text"}]},{"type":"paragraph"}],"version":1}

Browser not supported