Feature/aps 4674 self issue cred - #1527
Conversation
…nsumer credentials
… regenerate certificate updates
…reated applications
ikethecoder
left a comment
ikethecoder
left a comment
There was a problem hiding this comment.
Perhaps a bit of decoration on this - maybe adding the Application description (?) or for "Application Owner" have some gray-italic content around: "Application administered by this gateway" (?)
| }); | ||
|
|
||
| this.setStatus(201); | ||
| return credential; |
There was a problem hiding this comment.
There is a removeEmpty() function that we use in other controllers to remove any null values. Perhaps could do for this, otherwise the result provides irrelevant data. For example:
{
"flow": "client-credentials",
"clientId": "EA7F0EF6-F3FBBBC03FF",
"clientSecret": "***",
"issuer": null,
"tokenEndpoint": "http://keycloak.localtest.me:9081/auth/realms/master/protocol/openid-connect/token",
"clientPublicKey": null,
"clientPrivateKey": null
}
ikethecoder
left a comment
ikethecoder
left a comment
There was a problem hiding this comment.
The "Edit" button that brings up the dialog seems to be unhappy:
ikethecoder
left a comment
ikethecoder
left a comment
There was a problem hiding this comment.
Deleting a consumer leaves the application as an orphan. May need to clean up the application when deleting the consumer.
|
Was able to get a credential - few suggestions above. As far as places that require the most help, it wasn't clear where to find the |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| }); | ||
| // WARNING: This file was auto-generated with tsoa. Please do not modify it. Re-run tsoa to re-generate this file: https://github.com/lukeautry/tsoa | ||
| app.post('/ds/api/v3/gateways/:gatewayId/consumers', | ||
| authenticateMiddleware([{"jwt":["CredentialIssuer.Generate"]}]), |
| }); | ||
| // WARNING: This file was auto-generated with tsoa. Please do not modify it. Re-run tsoa to re-generate this file: https://github.com/lukeautry/tsoa | ||
| app.put('/ds/api/v3/gateways/:gatewayId/consumers/:clientId', | ||
| authenticateMiddleware([{"jwt":["CredentialIssuer.Generate"]}]), |
Cypress E2E tests failed (5)Branch: StatsFailed tests (5)
|
…er on Consumer Details
Cypress E2E tests failed (5)Branch: StatsFailed tests (5)
|
…ation and Join Group flakiness
3 participants
Summary
/ds/api/v3for API Providers to issue and regenerate consumer credentials with UMA scopeCredentialIssuer.Generate(no Access Request / approval queue).kong-api-key-only,kong-api-key-acl, andclient-credentials(client-secret, client-jwt, JWKS URL/cert), including application reuse across environments, optional labels, and ownerless issuer-created Applications excluded from My Access.24-self-issuing-credentialscovering issue/reuse/duplicate/regenerate/authz/upstream use, Consumers UI label filter and revoke, and My Access exclusion for ownerless apps; fixes JWT regenerate to update certificates via the same path as issue.Test plan
CredentialIssuer.Generatescope-role testsnpx cypress run --config-file cypress.config.ts --spec 'cypress/tests/24-self-issuing-credentials/*.cy.ts'CredentialIssuer.Generate→ POST issue → Consumers UI + labels → reuse app on second env → duplicate fails → PUT regenerate → 403 without scope → UI revoke04-my-access-exclusion.cy.ts)🚀 Feature branch deployment: https://api-services-portal-feature-aps-4674-self-issue-cred.apps.silver.devops.gov.bc.ca