Keycloak 24.05. Release Candidate

[jjeroch]

Summary

Update the keycloak image for release candidate 24.05.

Details

SD Factory Tech User

• sa-cl5-custodian-1 to be removed - not needed anymore (note: already disabled the user in INT at the 24th of March to be able to test the scenario of not having this user anymore as part of the e2e tests) ✅ removed
• sa-cl5-custodian-2 - for discussion; actually interim (in release 24.05.) the connection will be stopped; afterwards it might get reconnected --> decision: stays in

Impact to portal db seeding to be checked

---

New Client Issuer Component

Basic

• new client for issuer component needed Cl24-CX-SSI-CredentialIssuer ✅
• add the following permissions to the new client ✅
  • request_ssicredential
  • decision_ssicredential
  • view_use_case_participation
  • view_certificates
  • revoke_credentials_issuer
  • revoke_credential
• technical user sa-cl2-04 needed (release image) which has permission to access Cl24-CX-SSI-CredentialIssuer with all its roles ✅
• technical user sa-cl24-01 needed (release image) which has permission to access Cl2-CX-Portal with the roles ✅
  • send_mail
  • create_notifications
  • update_application_bpn_credential
  • update_application_membership_credential

Add portal permissions ✅

• send_mail
• update_application_bpn_credential
• update_application_membership_credential
• store_didDocument

Role Changes

• assign new permission decision_ssicredential to the portal role CX Admin ✅

---

New DIM Client

Within release iam image:

• technical user sa-cl2-05 needed which has permission to access Cl2-CX-Portal with the role store_didDocument ✅

Not within release iam image / only consortia images (because hosted in some SAP IAM):

• new client for issuer component needed DIM-Middle-Layer
  • setup_wallet
  • view_status_list
• technical user sa-dim-middle-layer-01 needed which has permission to access DIM-Middle-Layer with all its roles

---

New technical users for the issuer function ✅ done under "New Client Issuer Component" section

Portal needs a configured technical user to connect portal with SSI-Credential-Issuer

• Tech Role "Credential Issuer" with the following assigned roles from the new client Cl24-CX-SSI-CredentialIssuer
  • request_ssicredential
  • decision_ssicredential
  • view_use_case_participation
  • view_certificates
  • revoke_credentials_issuer
  • revoke_credential

Issuer Component needs a configured technical user to connect back to the portal

• Tech Role "Issuer Communication" with the following assigned roles from the new client Cl2-CX-Portal
  • send_mail (new Cl2-CX-Portal permission)
  • create_notifications (new Cl2-CX-Portal permission)
  • update_application_bpn_credential (new Cl2-CX-Portal permission)
  • update_application_membership_credential (new Cl2-CX-Portal permission)

---

Removal of portal permissions due to the new SSI Solution and Issuer component ✅

• remove decision_ssicredential permission from portal
• remove request_ssicredential permission from portal

---

Removal of portal permissions due to clean-up/matching roles&rights matrix obsolete marked permissions ✅

• remove upload_documents permission from portal
• remove my_user_account permission from portal
• remove view_tech_roles permission from portal
• remove setup_client permission from portal
• remove view_dataspaces permission from portal
• remove filter_apps permission from portal
• remove view_services permission from portal
• remove subscribe_service_offering permission from portal
• remove `` permission from portal

---

BPDM Roles & Right Concept adjustment ✅

• Clean up Cl7-CX-BPDM
  Valid Origin: https://partners-pool.{env}.demo.catena-x.net/*
  Description: BPDM Pool
  Permissions:

  • read_partner
  • write_partner
  • read_partner_member
  • read_changelog
  • read_changelog_member
  • read_metadata
  • write_metadata

• Clean up Cl16-CX-BPDMGate
  Valid Origin: https://partners-gate.{env}.demo.catena-x.net/*
  Description: Portal Gate
  Permissions:

  • read_input_partner
  • write_input_partner
  • read_input_changelog
  • read_output_partner
  • write_output_partner
  • read_output_changelog
  • read_sharing_state
  • write_sharing_state
  • read_stats

• Inside the technical_roles_management remove

  • "BPDM Gate Read"
  • "BPDM Gate Read & Write"
  • "BPDM Partner Gate"
  • "BPDM Management"
  • "BPDM Pool"

• Inside the technical_roles_management newly create

  • BPDM Sharing Admin
    With permissions:
    • read_input_partner
    • write_input_partner
    • read_input_changelog
    • read_output_partner
    • write_output_partner
    • read_output_changelog
    • read_sharing_state
    • write_sharing_state
    • read_stats
  • BPDM Sharing Input Manager
    • read_input_partner
    • write_input_partner
    • read_input_changelog
    • read_sharing_state
    • write_sharing_state
    • read_stats
  • BPDM Sharing Input Consumer
    • read_input_partner
    • read_input_changelog
    • read_sharing_state
    • read_stats
  • BPDM Sharing Output Consumer
    • read_output_partner
    • read_output_changelog
    • read_sharing_state
    • read_stats
  • BPDM Pool Consumer
    • read_changelog
    • read_changelog_member
    • read_metadata
  • BPDM Pool Admin
    • read_partner
    • write_partner
    • read_partner_member
    • read_changelog
    • read_changelog_member
    • read_metadata
    • write_metadata

---

• remove sa-cl7-cx-1 ✅
• remove sa-cl7-cx-2 - we need to inform Fabio - but I want to get rid of the user if possible ✅ (I asked Fabio, it's ok)
• update sa-cl7-cx-3 - assign BPDM Pool Admin ✅
• update sa-cl7-cx-4 - assign BPDM Pool Consumer ✅
• update sa-cl7-cx-5 - assign BPDM Pool Admin & BPDM Sharing Admin ✅
• update sa-cl7-cx-6 - assign BPDM Pool Consumer ✅
• update sa-cl7-cx-7 - assign BPDM Pool Admin & BPDM Sharing Admin ✅

[Phil91]

@jjeroch had a look at the code the we need the following technical users:

portal -> needs SSI Issuer Client + roles:
request_ssicredential
decision_ssicredential
view_use_case_participation
view_certificates
revoke_credentials_issuer
revoke_credential

issuer component -> needs Cl2-CX-Portal Client + roles:
send_mail
create_notifications
update_application_bpn_credential
update_application_membership_credential

@evegufy /cc

[jjeroch]

@Phil91 let us do some cleanups here

request_credential
decision_credential
view_credential_requests
revoke_credentials_issuer
revoke_credentials_requester