Service ID Keycloak

Location

• Staging: gode
• Production: adaba

License

No license.

Description of the service

Keycloak provides authentication for OpenMRS IDs. A Keycloak docker container built from the keycloak folder of openmrs-contrib-itsm-id is published within Docker Hub as openmrsinfra/openmrs-id-keycloak.

Postfix is used to relay emails from Atlassian to users' actual email addresses. A postfix docker container built from the postfix folder of openmrs-contrib-itsm-id is published within Docker Hub as openmrsinfra/openmrs-id-postfix. Only email from Atlassian email servers to username@id.openmrs.org, where username is a valid OpenMRS ID in LDAP will be forwarded to the corresponding user email within LDAP. This allows account management and self-service password resets for Atlassian services (wiki, issues, etc.).

How to access it

Keycloak is dockerized and is hosted at https://id-new.openmrs.org/ until OpenMRS ID legacy software is retired.

How to restart it

cd /root/docker/id-new
docker-compose down && \
  docker-compose up -d

How to setup

Via ansible/docker compose apps.

Staging realm was copied from production, see details in the README file

Production backups and restores

Backup

Instead of using postgres backups, we are using exporting from production (using the keycloak admin UI) and modifying it for staging.

TBC: how prod realm should be exported

Restore

In staging, just destroy the containers; that will import the realm from the exported file.

TBC: how prod realm should be imported.

Logs

cd /root/docker/id-new
docker-compose logs -f

Troubleshooting

Nothing yet known.