How to use formsflow.ai with with BC Gov Keycloak standard realm

[vinod-aot]

How di I configure formsflow.ai to use BC Gov Keycloak standard realm

[sumesh-aot]

formsflow.ai from v7.0.1 supports standard realm for BC Government.

How it works ?

• Based on the configuration, if formsflow.ai is configured to use standard realm then the system would interact with CSS API (Common Single SignOn API provided by BC Gov SSO platform team)
• Use the composite roles as a way of representing roles (in default setup it's keycloak groups)
• Use role as the permissions
• Camunda will treat the composite role as the Camunda group
• The API and other layers would use the composite role as the role in RBAC

Configuration

• Work with the BC Gov SSO team, and create a project for formsflow
• Create a client for formsflow web (e.g forms-flow-web-1234)
• Add additional role mapper claim as "groups"
• Import the roles (permissions) needed for formsflow to work with as client role. It needs all the roles mentioned here : https://github.com/AOT-Technologies/forms-flow-ai/blob/develop/forms-flow-idm/realm-exports/Group%20based%20auth.json#L19-L144
• Create a service account to interact with CSS API (service-account-team-1234)
• Request the SSO team to add audience mapper for the service account (service-account-team-1234) to include forms flow web (forms-flow-web-1234) audience.
• Add the following entries to the environment (If using helm chart, add them using extraEnvVars) and add them to forms-flow-api, forms-flow-bpm.
  SHARED_REALM=true
  CSS_API_BASE_URL=https://api.loginproxy.gov.bc.ca/api/v1
  CSS_API_CLIENT_ID=service-account-team-1234
  CSS_API_SECRET=
  CSS_API_LOGIN_URL=https://loginproxy.gov.bc.ca/auth/realms/standard/protocol/openid-connect/token
  CSS_ENV=<css env i.e dev, test or prod>
  CSS_INTEGRATION_ID=
  CSS_IDP_LIST=<comma separated idp list. for e.g github-bcgov,idir>
• If the username displayed on the task and admin pages needs to use a different claim than 'preferred_username' add below env variable to the environment, and add them to forms-flow-api, forms-flow-bpm and forms-flow-web as environment variable
  USER_NAME_DISPLAY_CLAIM=<claim name. eg, idir_userid>