Service ID Keycloak

Location

• Staging: gode
• Production: adaba

License

No license.

Description of the service

Keycloak provides authentication for OpenMRS IDs. A Keycloak docker container built from the keycloak folder of openmrs-contrib-itsm-id is published within Docker Hub as openmrsinfra/openmrs-id-keycloak.

Postfix is used to relay emails from Atlassian to users' actual email addresses. A postfix docker container built from the postfix folder of openmrs-contrib-itsm-id is published within Docker Hub as openmrsinfra/openmrs-id-postfix. Only email from Atlassian email servers to username@id.openmrs.org, where username is a valid OpenMRS ID in LDAP will be forwarded to the corresponding user email within LDAP. This allows account management and self-service password resets for Atlassian services (wiki, issues, etc.).

How to access it

Keycloak is dockerized and is hosted at https://id-new.openmrs.org/ until OpenMRS ID legacy software is retired.

Use https://id-new.openmrs.org/admin to access the master realm

How to restart it

cd /root/docker/id-new
docker-compose down && \
  docker-compose up -d

How to setup

Via ansible/docker compose apps.

Staging realm was copied from production, see details in the README file

Production backups and restores

Backup

Instead of using postgres backups, we are using exporting from production (using the keycloak admin UI) and modifying it for staging.

TBC: how prod realm should be exported

Restore

In staging, just destroy the containers; that will import the realm from the exported file.

TBC: how prod realm should be imported.

Logs

cd /root/docker/id-new
docker-compose logs -f

Troubleshooting

After doing LDAP/user federation changes, the connection to LDAP starts failing for about 5 minutes. If you search for a user and it returns a suspicious error on JSON, just wait 5 minutes to see if the problem will go away by itself.