Use Keycloak common realm in the Gold cluster

matthieu-foucault commented 2 years ago

Description of the Tech Debt

https://bcgov.github.io/sso-requests

This has to be done before the end of the year as the silver cluster keycloak will be decommissioned

Tech Debt Triage

The purpose of our technical debt triage process is to analyze technical debt to determine risk level of the technical debt and the value in tackling that technical debt.

Developer Checklist:

[x] Create a CIF app in the CSS registry https://bcgov.github.io/sso-requests
[x] Add our custom roles to that app
[x] in CIF, configure the sso-express middleware to use that CSS client
[ ] reconciliation mechanism to not break traceability and record ownership when switching identity provider
[ ] run the provision script to make sure the KC secrets are in the right places - and update the shared values file in 1password
[ ] make sure -dev, -test and -prod use the respective gold instances

LindsayMacfarlane commented 2 years ago

@pbastia @Dianadec @rdromey - we should look at prioritizing this work in the sprint starting October 17. This should give us time to do the migration for CIF then implement for CIIP & GGIRCS before our deadline of end of year.

pbastia commented 2 years ago

Back to development, we were missing an environment variable

pbastia commented 2 years ago

Before a prod release, we need to figure out the migration path of the existing user records, ie making sure the new IDIR logins are associated with the existing users in the system. That strategy is TBD

bcgov / cas-cif