Skip to content

Commit b78e163

Browse files
mpgxviimpgxvii
authored
Merge pull request #1078 from RADAR-base/minor-fixes
Minor updates
2 parents c13bb44 + 3a4c8b7 commit b78e163

File tree

9 files changed

+116
-129
lines changed

9 files changed

+116
-129
lines changed

‎README.md‎

Lines changed: 64 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,22 @@ docker-compose files.
5757
```shell
5858
keytool -genkeypair -alias radarbase-managementportal-ec -keyalg EC -validity 3650 -keysize 256 -sigalg SHA256withECDSA -storetype PKCS12 -keystore src/main/docker/etc/config/keystore.p12 -storepass radarbase -keypass radarbase
5959
```
60-
3. Now, we can start the stack with `docker-compose -f src/main/docker/management-portal.yml up -d`.
60+
3. Now, we can start ManagementPortal and its database with `docker-compose -f src/main/docker/managementportal.yml up -d`.
6161

62-
This will start a Postgres database, ManagementPortal and
63-
the [kratos identity provider stack](https://www.ory.sh/docs/kratos/ory-kratos-intro). The default password for the
64-
`admin`
65-
account is `admin`. An angular live development server to access the managementportal can be started using the
62+
This will start a Postgres database and ManagementPortal. The default password for the `admin`
63+
account is `admin`. An Angular live development server to access the managementportal can be started using the
6664
`yarn start` command (see [Development](#development)).
65+
4. (Optional, recommended) Start the external identity and authentication stack based on
66+
[Ory Kratos](https://www.ory.sh/docs/kratos/ory-kratos-intro) and
67+
[Ory Hydra](https://www.ory.sh/docs/hydra/):
68+
69+
```bash
70+
docker-compose -f src/main/docker/ory_stack.yml up -d
71+
```
72+
73+
This will start Kratos, Hydra and the `radar-self-enrolment-ui` service that provides the login/registration pages.
74+
**Ensure that `radar-self-enrolment-ui` is running**: ManagementPortal’s login flow redirects the browser to this UI
75+
(via Hydra), so if it is not available the login page will not work.
6776

6877
### Build from source
6978

@@ -90,8 +99,15 @@ You must install and configure the following dependencies on your machine to run
9099
started using the `yarn start` command (see [Development](#development)).
91100
6. You can log in to the application using `admin:admin`. Please don't forgot to change the password of `admin`, if you
92101
are using the application on production environment.
93-
7. The identity server stack can be started in docker by using the docker compose command
94-
`docker-compose -f .\src\main\docker\app.yml up -d kratos kratos-selfservice-ui-node kratos-migrate postgresd-kratos mailslurper`
102+
7. The identity and authentication server stack (Kratos, Hydra and self-enrolment UI) can be started in Docker by using
103+
the docker compose command:
104+
105+
```bash
106+
docker-compose -f src/main/docker/ory_stack.yml up -d
107+
```
108+
109+
Make sure that the `radar-self-enrolment-ui` service from this stack is running for the login and self-service pages
110+
to be available.
95111

96112
| | Development | Production |
97113
|------------------|-------------|------------|
@@ -133,11 +149,16 @@ for other options on overriding the default configuration.
133149
| `MANAGEMENTPORTAL_OAUTH_ENABLE_PUBLIC_KEY_VERIFIERS` | `false` | Whether to use additional verifiers using public-keys and deprecated verifier implementation. If you set this to `true`, also set `RADAR_IS_CONFIG_LOCATION` and provide yaml file with public keys. Read more at radar-auth documentation. |
134150
| `MANAGEMENTPORTAL_CATALOGUE_SERVER_ENABLE_AUTO_IMPORT` | `false` | Whether to enable or disable auto import of sources from the catalogue server |
135151
| `MANAGEMENTPORTAL_CATALOGUE_SERVER_SERVER_URL` | None | URL to the catalogue server |
136-
| `MANAGEMENTPORTAL_IDENTITYSERVER_SERVERURL` | None | URL to the identity server. |
137-
| `MANAGEMENTPORTAL_IDENTITYSERVER_SERVERADMINURL` | None | Admin URL to the identity server. |
152+
| `MANAGEMENTPORTAL_IDENTITYSERVER_INTERNAL` | `true` | Whether to use ManagementPortal’s internal identity management (`true`) or an external identity server such as Ory Kratos (`false`). |
153+
| `MANAGEMENTPORTAL_IDENTITYSERVER_SERVERURL` | None | URL to the identity server. When using Ory Kratos externally, set this to the Kratos public URL as seen from ManagementPortal (for example `http://kratos:4433` when using Docker). |
154+
| `MANAGEMENTPORTAL_IDENTITYSERVER_SERVERADMINURL` | None | Admin URL to the identity server. When using Ory Kratos externally, set this to the Kratos admin URL as seen from ManagementPortal (for example `http://kratos:4434`). |
138155
| `MANAGEMENTPORTAL_IDENTITYSERVER_ADMINEMAIL` | None | Email-address to be linked to the admin account. |
139-
| `MANAGEMENTPORTAL_IDENTITYSERVER_USER_ACTIVATION_FLOW_TYPE` | `verification` | Kratos self-service flow used to send activation emails. Allowed: `verification` or `recovery`. |
140-
| `MANAGEMENTPORTAL_IDENTITYSERVER_USER_ACTIVATION_METHOD` | `code` | Kratos method used in the activation flow request payload. Allowed: `code` or `link` (depending on flow and Kratos configuration). |
156+
| `MANAGEMENTPORTAL_IDENTITYSERVER_USER_ACTIVATION_FLOW_TYPE` | `verification` | Kratos self-service flow used to send activation emails. Allowed: `verification` or `recovery`. |
157+
| `MANAGEMENTPORTAL_IDENTITYSERVER_USER_ACTIVATION_METHOD` | `code` | Kratos method used in the activation flow request payload. Allowed: `code` or `link` (depending on flow and Kratos configuration). |
158+
| `MANAGEMENTPORTAL_AUTHSERVER_INTERNAL` | `true` | Whether to use ManagementPortal’s internal OAuth2 authorization server (`true`) or an external server such as Ory Hydra (`false`). |
159+
| `MANAGEMENTPORTAL_AUTHSERVER_SERVERURL` | None | Base URL of the external auth server’s public endpoints, used for the token endpoint. When using Ory Hydra in Docker, this is typically `http://hydra:4444`. |
160+
| `MANAGEMENTPORTAL_AUTHSERVER_LOGINURL` | None | Base URL of the external auth server as seen from the browser, used to construct the `/oauth2/auth` redirect URL (for example `http://localhost:4444` for Hydra’s public endpoint). |
161+
| `MANAGEMENTPORTAL_AUTHSERVER_SERVERADMINURL` | None | Admin URL of the external auth server (for example `http://hydra:4445` for the Hydra admin API), used for managing OAuth clients. |
141162
| `MANAGEMENTPORTAL_COMMON_BASE_URL` | None | Resolvable baseUrl of the hosted platform |
142163
| `MANAGEMENTPORTAL_COMMON_MANAGEMENT_PORTAL_BASE_URL` | None | Resolvable baseUrl of this managementportal instance |
143164
| `MANAGEMENTPORTAL_COMMON_PRIVACY_POLICY_URL` | None | Resolvable URL to the common privacy policy url |
@@ -258,10 +279,33 @@ The code grant flow for OAuth2 clients can also be the following:
258279
```
259280
Now the app can use the access token flow.
260281
282+
### Identity and authentication configuration
283+
284+
ManagementPortal can be run either with its **internal identity and auth server** or with **external Ory services**:
285+
286+
- **Internal identity and auth server (legacy mode)**:
287+
- Enabled by default when `MANAGEMENTPORTAL_IDENTITYSERVER_INTERNAL=true` and `MANAGEMENTPORTAL_AUTHSERVER_INTERNAL=true`
288+
(or when these variables are not set).
289+
- ManagementPortal handles user accounts and OAuth2 tokens itself; no external Kratos or Hydra stack is required.
290+
- **External Ory identity and auth (Kratos + Hydra)**:
291+
- Set `MANAGEMENTPORTAL_IDENTITYSERVER_INTERNAL=false` and `MANAGEMENTPORTAL_AUTHSERVER_INTERNAL=false`.
292+
- Configure the external identity server (typically Ory Kratos):
293+
- `MANAGEMENTPORTAL_IDENTITYSERVER_SERVERURL` (e.g. `http://kratos:4433`)
294+
- `MANAGEMENTPORTAL_IDENTITYSERVER_SERVERADMINURL` (e.g. `http://kratos:4434`)
295+
- `MANAGEMENTPORTAL_IDENTITYSERVER_ADMINEMAIL`
296+
- Configure the external auth server (typically Ory Hydra):
297+
- `MANAGEMENTPORTAL_AUTHSERVER_SERVERURL` (e.g. `http://hydra:4444`, reachable from ManagementPortal)
298+
- `MANAGEMENTPORTAL_AUTHSERVER_LOGINURL` (e.g. `http://localhost:4444`, reachable from the browser)
299+
- `MANAGEMENTPORTAL_AUTHSERVER_SERVERADMINURL` (e.g. `http://hydra:4445`)
300+
- Start the Ory stack using `docker-compose -f src/main/docker/ory_stack.yml up -d` and ensure the
301+
`radar-self-enrolment-ui` service is running. The ManagementPortal login flow redirects the user to Hydra, which in
302+
turn uses the self-enrolment UI for login and consent screens.
303+
261304
### User management
262305
263-
Organizational user management and authorization for the managementportal is performed
264-
by [Ory Kratos](https://www.ory.sh/docs/kratos/ory-kratos-intro). The flow for adding users to the portal is as follows:
306+
When `MANAGEMENTPORTAL_IDENTITYSERVER_INTERNAL=false`, organizational user management and authentication for the
307+
managementportal is performed by [Ory Kratos](https://www.ory.sh/docs/kratos/ory-kratos-intro). The flow for adding
308+
users to the portal is as follows:
265309
266310
1. Navigate to the [User management view](http://127.0.0.1:8081/#/user-management) and create a user.
267311
2. The new user then [resets their password](http://127.0.0.1:3000/recovery) at the kratos self-service node using the
@@ -271,23 +315,22 @@ by [Ory Kratos](https://www.ory.sh/docs/kratos/ory-kratos-intro). The flow for a
271315
272316
```mermaid
273317
sequenceDiagram
274-
participant kratosUi as Kratos self-service node
318+
participant selfEnrolUi as Self-enrolment UI (Hydra/Kratos)
275319
actor user as User
276320
actor researcher as Admin
277321
participant managementPortal as ManagementPortal
278322
participant kratos as Kratos
279323
280-
281324
#== User Registration ==
282325
user -->> researcher: Request account (email required)
283326
researcher -->> managementPortal: Create user
284327
managementPortal -->> kratos: Create kratos identity
285-
kratos -->> user: Send password reset email
286-
user -->> kratosUi: Reset password
287-
kratosUi -->> kratos:
288-
user -->> kratosUi: Activate 2-FA
289-
kratosUi -->> kratos:
290-
user -->> managementPortal: Login (2-FA required)
328+
kratos -->> user: Send activation / recovery email
329+
user -->> selfEnrolUi: Set password
330+
selfEnrolUi -->> kratos: Update identity
331+
user -->> selfEnrolUi: Configure 2-FA
332+
selfEnrolUi -->> kratos: Update identity
333+
user -->> managementPortal: Login (2-FA enforced via Hydra)
291334
```
292335

293336
### UI Customization
@@ -378,9 +421,6 @@ To optimize the ManagementPortal application for production, run:
378421

379422
./gradlew -Pprod clean bootWar
380423

381-
### Hosting in production
382-
383-
The latest Meta-QR code implementation requires REST resources on `api/meta-token/*` should definitely be rate-limited by upstream servers.
384424

385425
### Hosting in production
386426

‎src/main/docker/app.yml‎

Lines changed: 14 additions & 77 deletions
Original file line numberDiff line numberDiff line change
@@ -4,107 +4,44 @@ services:
44
## MP
55

66
managementportal-app:
7-
image: managementportal
8-
# image: radarbase/management-portal
7+
image: ghcr.io/radar-base/managementportal/management-portal:dev
98
environment:
109
- SPRING_PROFILES_ACTIVE=prod,api-docs
1110
- SPRING_DATASOURCE_URL=jdbc:postgresql://managementportal-postgresql:5432/managementportal
1211
- SPRING_DATASOURCE_USERNAME=radarbase
1312
- SPRING_DATASOURCE_PASSWORD=radarbase
14-
- SPRING_LIQUIBASE_CONTEXTS=dev #includes testing_data, remove for production builds
13+
- MANAGEMENTPORTAL_COMMON_ADMINPASSWORD=admin
1514
- MANAGEMENTPORTAL_FRONTEND_CLIENT_SECRET=secret
16-
- MANAGEMENTPORTAL_IDENTITYSERVER_SERVERURL=http://kratos
15+
- MANAGEMENTPORTAL_IDENTITYSERVER_INTERNAL=false # IF using external identity like ORY Kratos
16+
- MANAGEMENTPORTAL_IDENTITYSERVER_ADMINEMAIL=admin-email-here@radar-base.net
17+
- MANAGEMENTPORTAL_IDENTITYSERVER_SERVERURL=http://kratos:4433
18+
- MANAGEMENTPORTAL_IDENTITYSERVER_LOGINURL=http://localhost:3000
19+
- MANAGEMENTPORTAL_IDENTITYSERVER_SERVERADMINURL=http://kratos:4434
20+
- MANAGEMENTPORTAL_AUTHSERVER_INTERNAL=false # IF using external auth server like ORY Hydra
21+
- MANAGEMENTPORTAL_AUTHSERVER_SERVERURL=http://hydra:4444
22+
- MANAGEMENTPORTAL_AUTHSERVER_LOGINURL=http://localhost:4444
23+
- MANAGEMENTPORTAL_AUTHSERVER_SERVERADMINURL=http://hydra:4445
1724
- MANAGEMENTPORTAL_OAUTH_CLIENTS_FILE=/mp-includes/config/oauth_client_details.csv
25+
- MANAGEMENTPORTAL_CATALOGUESERVER_SERVERURL=http://catalogue-server:8080
1826
- JHIPSTER_SLEEP=10 # gives time for the database to boot before the application
1927
- JAVA_OPTS=-Xmx512m # maximum heap size for the JVM running ManagementPortal, increase this as necessary
2028
ports:
2129
- "8080:8080"
2230
networks:
2331
- all-net
2432
- mp-net
33+
- default
2534
volumes:
2635
- ./etc:/mp-includes
2736

2837

2938
managementportal-postgresql:
3039
extends:
31-
file: postgresql.yml
40+
file: postgres.yml
3241
service: managementportal-postgresql
3342
networks:
3443
- mp-net
3544

36-
## ORY
37-
38-
# Kratos
39-
kratos-selfservice-ui-node:
40-
image:
41-
oryd/kratos-selfservice-ui-node
42-
environment:
43-
- LOG_LEAK_SENSITIVE_VALUES=true
44-
- KRATOS_PUBLIC_URL=http://kratos:4433
45-
- KRATOS_ADMIN_URL=http://kratos:4434
46-
- SECURITY_MODE=standalone
47-
- KRATOS_BROWSER_URL=http://127.0.0.1:4433
48-
- COOKIE_SECRET=unsafe_cookie_secret
49-
- CSRF_COOKIE_NAME=radar
50-
- CSRF_COOKIE_SECRET=unsafe_csrf_cookie_secret
51-
ports:
52-
- "3000:3000"
53-
networks:
54-
- all-net
55-
volumes:
56-
- /tmp/ui-node/logs:/root/.npm/_logs
57-
58-
kratos:
59-
depends_on:
60-
- kratos-migrate
61-
image: oryd/kratos:v1.0.0
62-
ports:
63-
- "4433:4433" # public
64-
- "4434:4434" # admin, should be closed in production
65-
restart: unless-stopped
66-
environment:
67-
- DSN=postgres://kratos:secret@postgresd-kratos/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
68-
command: serve -c /etc/config/kratos/kratos.yml --dev --watch-courier
69-
volumes:
70-
- type: bind
71-
source: ./etc/config/kratos
72-
target: /etc/config/kratos
73-
networks:
74-
- all-net
75-
- kratos-net
76-
77-
kratos-migrate:
78-
image:
79-
oryd/kratos:v1.0.0
80-
environment:
81-
- DSN=postgres://kratos:secret@postgresd-kratos/kratos?sslmode=disable&max_conns=20&max_idle_conns=4
82-
volumes:
83-
- type: bind
84-
source: ./etc/config/kratos
85-
target: /etc/config/kratos
86-
command: -c /etc/config/kratos/kratos.yml migrate sql -e --yes
87-
restart: on-failure
88-
networks:
89-
- kratos-net
90-
91-
postgresd-kratos:
92-
image: postgres:11.8
93-
environment:
94-
- POSTGRES_USER=kratos
95-
- POSTGRES_PASSWORD=secret
96-
- POSTGRES_DB=kratos
97-
networks:
98-
- kratos-net
99-
100-
mailslurper:
101-
image: oryd/mailslurper:latest-smtps
102-
ports:
103-
- "4436:4436"
104-
- "4437:4437"
105-
networks:
106-
- kratos-net
107-
10845
networks:
10946
all-net:
11047
mp-net:

‎src/main/docker/managementportal.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,14 +9,18 @@ services:
99
- SPRING_DATASOURCE_URL=jdbc:postgresql://managementportal-postgresql:5432/managementportal
1010
- SPRING_DATASOURCE_USERNAME=radarbase
1111
- SPRING_DATASOURCE_PASSWORD=radarbase
12+
- MANAGEMENTPORTAL_COMMON_ADMINPASSWORD=admin
1213
- MANAGEMENTPORTAL_FRONTEND_CLIENT_SECRET=secret
14+
- MANAGEMENTPORTAL_IDENTITYSERVER_INTERNAL=false # IF using external identity like ORY Kratos
1315
- MANAGEMENTPORTAL_IDENTITYSERVER_ADMINEMAIL=admin-email-here@radar-base.net
1416
- MANAGEMENTPORTAL_IDENTITYSERVER_SERVERURL=http://kratos:4433
1517
- MANAGEMENTPORTAL_IDENTITYSERVER_LOGINURL=http://localhost:3000
1618
- MANAGEMENTPORTAL_IDENTITYSERVER_SERVERADMINURL=http://kratos:4434
19+
- MANAGEMENTPORTAL_AUTHSERVER_INTERNAL=false # IF using external auth server like ORY Hydra
1720
- MANAGEMENTPORTAL_AUTHSERVER_SERVERURL=http://hydra:4444
1821
- MANAGEMENTPORTAL_AUTHSERVER_LOGINURL=http://localhost:4444
1922
- MANAGEMENTPORTAL_AUTHSERVER_SERVERADMINURL=http://hydra:4445
23+
- MANAGEMENTPORTAL_CATALOGUESERVER_SERVERURL=http://catalogue-server:8080
2024
- JHIPSTER_SLEEP=10 # gives time for the database to boot before the application
2125
- JAVA_OPTS=-Xmx512m -agentlib:jdwp=transport=dt_socket,server=y,suspend=n,address=*:5005 #enables remote debugging
2226
ports:

‎src/main/docker/managementportal_dockerhub/docker-compose.yml‎

Lines changed: 0 additions & 18 deletions
This file was deleted.

0 commit comments

Comments
 (0)