From: PatrikBuhr Date: Fri, 16 Dec 2022 11:10:58 +0000 (+0100) Subject: Updated documentation X-Git-Url: https://gerrit.o-ran-sc.org/r/gitweb?a=commitdiff_plain;h=5e217217e43fc6d8a73f5aca0dfcbbf28fdd32c6;p=nonrtric.git Updated documentation Added documentation of authentification support component. Signed-off-by: PatrikBuhr Issue-ID: NONRTRIC-742 Change-Id: Ie5fa95cb638ef7abf16305fa7376afa11e20c52d --- diff --git a/docs/AuthSupport.odp b/docs/AuthSupport.odp new file mode 100644 index 00000000..96fb3d92 Binary files /dev/null and b/docs/AuthSupport.odp differ diff --git a/docs/AuthSupport.png b/docs/AuthSupport.png new file mode 100644 index 00000000..4068c221 Binary files /dev/null and b/docs/AuthSupport.png differ diff --git a/docs/overview.rst b/docs/overview.rst index 9b33c4f3..04ba2248 100644 --- a/docs/overview.rst +++ b/docs/overview.rst @@ -38,7 +38,7 @@ These are the components that make up the Non-RT-RIC: * `DMaaP/Kafka Information Producer Adapters <#dmaap-kafka-information-producer-adapters>`_. :doc:`Documentation site adapter `. :doc:`Documentation site mediator `. * `Initial Non-RT-RIC App Catalogue <#initial-non-rt-ric-app-catalogue>`_. :doc:`Documentation site `. * `Initial K8S Helm Chart LCM Manager <#id5>`_. :doc:`Documentation site `. -* `Auth Token Fetch <#id6>`_. :doc:`Documentation site `. +* `Authentication Support <#id6>`_. :doc:`Documentation site `. * `Service Management & Exposure (SME) <#service-management-and-exposure>`_. :doc:`Documentation site `. * `Test Framework <#id7>`_. * `Use Cases: <#non-rt-ric-use-cases>`_ @@ -239,10 +239,33 @@ Implementation: - Repo: *nonrtric/plt/sme* - Documentation at the :doc:`Service Management & Exposure (SME) documentation site `. -Auth Token Fetch -~~~~~~~~~~~~~~~~ +Authentication Support +~~~~~~~~~~~~~~~~~~~~~~ -Work in progress. +The auth-token-fetch provides support for authentication. +It is intended to be used as a sidecar and does the authentication procedure, gets and saves the access token +in the local file system. This includes refresh of the token before it expires. +This means that the service only needs to read the token from a file. + +It is tested using Keycloak as authentication provider. + +.. image:: ./AuthSupport.png + :width: 500pt + +So, a service just needs to read the token file and for instance insert it in the authorization header when using HTTP. +The file needs to be re-read if it has been updated. + +The auth-token-fetch is configured by the following environment variables. + +* CERT_PATH - the file path of the cert to use for TSL, example: security/tls.crt +* CERT_KEY_PATH - the file path of the private key file for the cert, example: "security/tls.key" +* ROOT_CA_CERTS_PATH - the file path of the trust store. +* CREDS_GRANT_TYPE - the grant_type used for authentication, example: client_credentials +* CREDS_CLIENT_SECRET - the secret/private shared key used for authentication +* CREDS_CLIENT_ID - the client id used for authentication +* OUTPUT_FILE - the path where the fetched authorization token is stored, example: "/tmp/authToken.txt" +* AUTH_SERVICE_URL - the URL to the authentication service (Keycloak) +* REFRESH_MARGIN_SECONDS - how long in advance before the authorization token expires it is refreshed Test Framework ~~~~~~~~~~~~~~