search

bcgov / foi-flow

Freedom of Information modernization
Apache License 2.0
5 stars 3 forks source link

KC Migration from Silver to Gold [#3002] #3227

Closed sumathi-thirumani closed 1 year ago

sumathi-thirumani commented 1 year ago

Migration of KC (Gold-Dev)

NOTE: forms-flow-bpm needs its dependencies to be upgraded for supporting the new KC.

forms-flow-bpm

foi-web

forms-flow-ai-web

request-management-api

Migration of Users

Supported Authentication mechanism - Dev

Supported Authentication mechanism - Test

Supported Authentication mechanism - Prod

Unit Testing

Integration Testing - Dev Marshal

Integration Testing - Test Marshal

Integration Testing - Dev

Integration Testing - Test

sumathi-thirumani commented 1 year ago

Migration Entities (In order to approach)

  1. IDP
  2. Clients
  3. Groups
  4. Users
  5. User – Group mapping
sumathi-thirumani commented 1 year ago

How is it Done ?

  1. Step-1 : Got admin access to realms: dev, test, prof : Completed
  2. Step-2: Submitted request to get IDPs (IDIR & BCGov github) using link https://bcgov.github.io/sso-requests/my-dashboard/integrations : Completed
  3. Step-3: Setup IDP & send email to get setup completed for BC Services Card a. Reference to reach team to have a new redirect URI setup https://stackoverflow.developer.gov.bc.ca/questions/512/515#515
  4. Import Clients - Leverage admin privilege to export and import [Ensure to remove all IDs with are random generated]
  5. Import Groups - Leverage admin privilege to export and import [Ensure to remove all IDs with are random generated]
  6. Import Users a. IDIR : Leverage the script given by the sso -> reference : https://github.com/bcgov/sso-keycloak/tree/dev/scripts/custom-realm-users b. Local Accounts : Leverage postman API c. BCSC : Not required
  7. User-Group Mapping : Leveraged custom plugin (.jmx) to do it
sumathi-thirumani commented 1 year ago

Issues Faced:

  1. Unable to logout from the session (Tested in browsers – Edge, Chrome and FF) -> Resolved Root cause – SSO request to have logout URI configured
  2. Variation in the value format of preferred_username -> Resolved Resolution - Custom mapper in IDP & client
  3. Migration of users with script -> Resolved Observations: a. ##Script enforces to give PAT; even though the silver has only IDIR and BASIC users. Note: Giving PAT is mandatory (The script is driven by IDP and not .env) b. ##Script did not run with user ID with admin privileges whereas; it requires a service account with realm administration c. ##Script creates the user with “Provider User ID” in upper case. [ Blocker -> New user gets created every time with the additional setting of “Duplicate emails” enabled]. Resolution: Deleted all users and re-ran the modified script.
sumathi-thirumani commented 1 year ago

Realm Settings

Not advisable to have "Duplicate emails" at the realm level. Turned it off !!!! Logically, it does not make sense to authenticate and create a duplicate with no permissions. -Sumathi

sumathi-thirumani commented 1 year ago

MANUAL

For BPM: The client service account is to be manually provided with realm user and group related permissions.

sumathi-thirumani commented 1 year ago

MANUAL

For client "forms-flow-web". Manually add the mapper "Preffered_username".

sumathi-thirumani commented 1 year ago

MANUAL

Setup session management properties

sumathi-thirumani commented 1 year ago

MANUAL

Set password for local accounts.

m-prodan commented 1 year ago

QA Testing Notes:

sumathi-thirumani commented 1 year ago

Migration Activity - Test