Skip to content

Commit b599a55

Browse files
PYLochouPYLochou
authored
Merge branch 'vnext-release' into review-gcp
2 parents 9ea010f + 6622227 commit b599a55

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+1412
-416
lines changed

‎.secrets.baseline

+46-18
Original file line numberDiff line numberDiff line change
@@ -100,23 +100,23 @@
100100
"hashed_secret": "5a2ea68e9ea943ea31948fe51388c798e13346a9",
101101
"is_secret": false,
102102
"is_verified": false,
103-
"line_number": 227,
103+
"line_number": 234,
104104
"type": "Secret Keyword",
105105
"verified_result": null
106106
},
107107
{
108108
"hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
109109
"is_secret": false,
110110
"is_verified": false,
111-
"line_number": 488,
111+
"line_number": 495,
112112
"type": "Secret Keyword",
113113
"verified_result": null
114114
},
115115
{
116116
"hashed_secret": "076a042dcb8e3b7be55cbbe95e1f18f577ef1ba5",
117117
"is_secret": false,
118118
"is_verified": false,
119-
"line_number": 534,
119+
"line_number": 541,
120120
"type": "Secret Keyword",
121121
"verified_result": null
122122
}
@@ -134,15 +134,15 @@
134134
"hashed_secret": "5a2ea68e9ea943ea31948fe51388c798e13346a9",
135135
"is_secret": false,
136136
"is_verified": false,
137-
"line_number": 145,
137+
"line_number": 152,
138138
"type": "Secret Keyword",
139139
"verified_result": null
140140
},
141141
{
142142
"hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
143143
"is_secret": false,
144144
"is_verified": false,
145-
"line_number": 387,
145+
"line_number": 394,
146146
"type": "Secret Keyword",
147147
"verified_result": null
148148
}
@@ -404,23 +404,23 @@
404404
"hashed_secret": "5a2ea68e9ea943ea31948fe51388c798e13346a9",
405405
"is_secret": false,
406406
"is_verified": false,
407-
"line_number": 225,
407+
"line_number": 250,
408408
"type": "Secret Keyword",
409409
"verified_result": null
410410
},
411411
{
412412
"hashed_secret": "fa9beb99e4029ad5a6615399e7bbae21356086b3",
413413
"is_secret": false,
414414
"is_verified": false,
415-
"line_number": 379,
415+
"line_number": 405,
416416
"type": "Secret Keyword",
417417
"verified_result": null
418418
},
419419
{
420420
"hashed_secret": "076a042dcb8e3b7be55cbbe95e1f18f577ef1ba5",
421421
"is_secret": false,
422422
"is_verified": false,
423-
"line_number": 425,
423+
"line_number": 451,
424424
"type": "Secret Keyword",
425425
"verified_result": null
426426
}
@@ -1111,38 +1111,66 @@
11111111
"verified_result": null
11121112
}
11131113
],
1114-
"platform/azure/README-Azure-SQL-MI.md": [
1114+
"platform/azure/README.md": [
11151115
{
1116-
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
1116+
"hashed_secret": "07596f183f5e91b1778d5e47b2752b8d42aa763d",
11171117
"is_secret": false,
11181118
"is_verified": false,
1119-
"line_number": 62,
1119+
"line_number": 174,
11201120
"type": "Secret Keyword",
11211121
"verified_result": null
1122-
}
1123-
],
1124-
"platform/azure/README.md": [
1122+
},
1123+
{
1124+
"hashed_secret": "3ea3f9802accf8817bacd6f3df46a73b93ccddec",
1125+
"is_secret": false,
1126+
"is_verified": false,
1127+
"line_number": 175,
1128+
"type": "Secret Keyword",
1129+
"verified_result": null
1130+
},
11251131
{
11261132
"hashed_secret": "12d57965bd88277e9e9d69dc2b36aae2c0b7e316",
11271133
"is_secret": false,
11281134
"is_verified": false,
1129-
"line_number": 227,
1135+
"line_number": 274,
11301136
"type": "Secret Keyword",
11311137
"verified_result": null
11321138
},
11331139
{
11341140
"hashed_secret": "41b864c967d31ed0bf10562e22faa36324405048",
11351141
"is_secret": false,
11361142
"is_verified": false,
1137-
"line_number": 245,
1143+
"line_number": 292,
11381144
"type": "Secret Keyword",
11391145
"verified_result": null
1140-
},
1146+
}
1147+
],
1148+
"platform/azure/aks-nginx-values.yaml": [
1149+
{
1150+
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
1151+
"is_secret": false,
1152+
"is_verified": false,
1153+
"line_number": 21,
1154+
"type": "Secret Keyword",
1155+
"verified_result": null
1156+
}
1157+
],
1158+
"platform/azure/aks-sqlmi-values.yaml": [
1159+
{
1160+
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
1161+
"is_secret": false,
1162+
"is_verified": false,
1163+
"line_number": 14,
1164+
"type": "Secret Keyword",
1165+
"verified_result": null
1166+
}
1167+
],
1168+
"platform/azure/aks-values.yaml": [
11411169
{
11421170
"hashed_secret": "547ef58bd39c2e3cc6ff7e61ea31e3d23e6382f1",
11431171
"is_secret": false,
11441172
"is_verified": false,
1145-
"line_number": 406,
1173+
"line_number": 14,
11461174
"type": "Secret Keyword",
11471175
"verified_result": null
11481176
}

‎README.md

+12
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,22 @@ The ODM Docker material is used here, which is available in the [odm-ondocker](h
1717

1818
![Flow](images/ODMinKubernetes-DeploymentOverview.png)
1919

20+
## Supported Versions
21+
22+
This repository provides materials for the following versions of IBM ODM:
23+
24+
| ODM Version |
25+
|--------------|
26+
| **[9.0.0.1 (Latest)](README.md)** |
27+
| **[8.12.0.1](https://github.com/DecisionsDev/odm-docker-kubernetes/tree/8.12.0.1)** |
28+
| **[8.11.0.1](https://github.com/DecisionsDev/odm-docker-kubernetes/tree/8.11.0.1)** |
29+
30+
Each version has dedicated deployment instructions and materials tailored to its release. Select the version that matches your requirements for compatibility and features.
2031

2132
### Deploying ODM Rules on a specific platform
2233

2334
- [Amazon EKS](platform/eks/README.md)
35+
- [Amazon ECS Fargate](platform/ecs/README.md) (BETA)
2436
- [Azure AKS](platform/azure/README.md)
2537
- [Google Cloud GKE](platform/gcloud/README.md)
2638
- [Redhat OpenShift Kubernetes Service on IBM Cloud (ROKS)](platform/roks/README.md)

‎authentication/AzureAD/README_WITH_CLIENT_SECRET.md

+33-26
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626

2727
1. Create the *ODM application*.
2828

29-
In **Azure Active Directory** / **App registration**, click **New Registration**:
29+
In **Microsoft Entra Id** / **Manage** / **App registration**, click **New Registration**:
3030

3131
* Name: **ODM Application**
3232
* Supported account types / Who can use this application or access this API?: select `Accounts in this organizational directory only (Default Directory only - Single tenant)`
@@ -36,7 +36,7 @@
3636

3737
2. Retrieve Tenant and Client information.
3838

39-
In **Azure Active Directory** / **App Registration**, select **ODM Application** and click **Overview**:
39+
In **Microsoft Entra Id** / **Manage** / **App Registration**, select **ODM Application** and click **Overview**:
4040

4141
* Application (client) ID: **Client ID**. It will be referenced as `CLIENT_ID` in the next steps.
4242
* Directory (tenant) ID: **Your Tenant ID**. It will be referenced as `TENANT_ID` in the next steps.
@@ -45,7 +45,7 @@
4545

4646
3. Generate an OpenID client secret.
4747

48-
In **Azure Active Directory** / **App registrations**, select **ODM Application**:
48+
In **Microsoft Entra Id** / **Manage** / **App registrations**, select **ODM Application**:
4949

5050
* From the Overview page, click on the link Client credentials: **Add a certificate or secret** or on the **Manage / Certificates & secrets** tab
5151
* Click + New Client Secret
@@ -58,24 +58,24 @@
5858
5959
4. Add Claims.
6060

61-
In **Azure Active Directory** / **App registrations**, select **ODM Application**, and in **Manage / Token Configuration**:
61+
In **Microsoft Entra Id** / **Manage** / **App registrations**, select **ODM Application**, and in **Manage / Token Configuration**:
6262

63-
* Add Optional Email ID Claim
63+
* Add Optional **email** ID Claim
6464
* Click +Add optional claim
6565
* Select ID
66-
* Check Email
67-
* Click Add
68-
69-
* Add Optional Email Access Claim
70-
* Click +Add optional claim
71-
* Select Access
72-
* Check Email
66+
* Check **email**
7367
* Click Add
7468

7569
* Turn on Microsoft Graph email permission
7670
* Check Turn on the Microsoft Graph email permission
7771
* Click Add
7872

73+
* Add Optional **email** Access Claim
74+
* Click +Add optional claim
75+
* Select Access
76+
* Check **email**
77+
* Click Add
78+
7979
* Add Group Claim
8080
* Click +Add groups claim
8181
* Check Security Groups
@@ -85,19 +85,19 @@
8585

8686
To allow ODM rest-api to use the password flow with email as user identifier and the client-credentials flow with client_id as user identifier, we need to create a new claim named "identity" that will take the relevant value according to the flow:
8787

88-
In **Azure Active Directory** / **Enterprise applications**, select **ODM Application**, and in **Manage / Single sign-on**:
88+
In **Microsoft Entra Id** / **Manage** / **Enterprise applications**, select **ODM Application**, and in **Manage / Single sign-on**:
8989

9090
* Click Edit in the "Attributes & Claims" section
9191
* Click + Add new claim
92-
* Name: identity
92+
* Name: **identity**
9393
* Fill 2 Claim conditions in the exact following order:
9494
1. User Type: Any / Scoped Groups: 0 / Source: Attribute / Value: <CLIENT_ID>
9595
2. User Type: Members / Scoped Groups: 0 / Source: Attribute / Value: user.mail
9696
* Click Save
9797

9898
6. API Permissions.
9999

100-
In **Azure Active Directory** / **App Registration**, select **ODM Application**, and then click **API Permissions**.
100+
In **Microsoft Entra Id** / **Manage** / **App Registration**, select **ODM Application**, and then click **API Permissions**.
101101

102102
* Click Grant Admin Consent for Default Directory
103103

@@ -109,14 +109,21 @@
109109

110110
7. Manifest change.
111111

112-
In **Azure Active Directory** / **App Registration**, select **ODM Application**, and then click **Manifest**.
112+
In **Microsoft Entra Id** / **Manage** / **App Registration**, select **ODM Application**, and then click **Manifest**.
113+
114+
The Manifest feature (a JSON representation of an app registration) is currently in transition.
115+
[**AAD Graph app manifest**](https://learn.microsoft.com/en-us/entra/identity-platform/azure-active-directory-graph-app-manifest-deprecation) will be deprecated soon and not editable anymore starting 12/2/2024. It will be replaced by the **Microsoft Graph App Manifest**
113116

114117
As explained in [accessTokenAcceptedVersion attribute explanation](https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-app-manifest#accesstokenacceptedversion-attribute), change the value to 2.
115118

116119
ODM OpenID Liberty configuration needs version 2.0 for the issuerIdentifier. See the [openIdWebSecurity.xml](templates/openIdWebSecurity.xml) file.
117120

118121
It is also necessary to set **acceptMappedClaims** to true to manage claims. Without this setting, you get the exception **AADSTS50146: This application is required to be configured with an application-specific signing key. It is either not configured with one, or the key has expired or is not yet valid.** when requesting a token.
119122

123+
With **Microsoft Graph App Manifest**:
124+
* **acceptMappedClaims** is relocated as a property of the **api** attribute
125+
* **accessTokenAcceptedVersion** is relocated as a property of the **api** attribute and renamed **requestedAccessTokenVersion**
126+
120127
Then, click Save.
121128

122129
8. Check the configuration.
@@ -318,7 +325,7 @@
318325

319326
```shell
320327
kubectl create secret generic users-groups-synchro-secret \
321-
--from-file=sidecar-start.sh \
328+
--from-file=./output/sidecar-start.sh \
322329
--from-file=generate-user-group-mgt.sh
323330
```
324331
> **Note**
@@ -340,7 +347,7 @@
340347
```shell
341348
helm search repo ibm-odm-prod
342349
NAME CHART VERSION APP VERSION DESCRIPTION
343-
ibm-helm/ibm-odm-prod 24.0.0 9.0.0.0 IBM Operational Decision Manager
350+
ibm-helm/ibm-odm-prod 24.1.0 9.0.0.1 IBM Operational Decision Manager
344351
```
345352
346353
### Run the `helm install` command
@@ -352,7 +359,7 @@ You can now install the product. We will use the PostgreSQL internal database an
352359
See the [Preparing to install](https://www.ibm.com/docs/en/odm/9.0.0?topic=production-preparing-install-operational-decision-manager) documentation for additional information.
353360
354361
```shell
355-
helm install my-odm-release ibm-helm/ibm-odm-prod \
362+
helm install my-odm-release ibm-helm/ibm-odm-prod --version 24.1.0 \
356363
--set image.repository=cp.icr.io/cp/cp4a/odm --set image.pullSecrets=icregistry-secret \
357364
--set oidc.enabled=true \
358365
--set license=true \
@@ -377,7 +384,7 @@ You can now install the product. We will use the PostgreSQL internal database an
377384
When the NGINX Ingress Controller is ready, you can install the ODM release with:
378385
379386
```
380-
helm install my-odm-release ibm-helm/ibm-odm-prod \
387+
helm install my-odm-release ibm-helm/ibm-odm-prod --version 24.1.0 \
381388
--set image.repository=cp.icr.io/cp/cp4a/odm --set image.pullSecrets=icregistry-secret \
382389
--set oidc.enabled=true \
383390
--set license=true \
@@ -449,7 +456,7 @@ You can now install the product. We will use the PostgreSQL internal database an
449456
- Decision Server Runtime redirect URI: `https://<INGRESS_ADDRESS>/DecisionService/openid/redirect/odm`
450457
- Rule Designer redirect URI: `https://127.0.0.1:9081/oidcCallback`
451458
452-
From the Azure console, in **Azure Active Directory** / **App Registrations** / **ODM Application**:
459+
From the Microsoft Azure console, in **Microsoft Entra Id** / **Manage** / **App Registrations** / **ODM Application**:
453460
454461
- Click the `Add a Redirect URI` link
455462
- Click `Add Platform`
@@ -507,11 +514,11 @@ To manage ODM runtime call on the next steps, we used the [Loan Validation Decis
507514

508515
Import the **Loan Validation Service** in Decision Center connected using *myodmuser*@YOURDOMAIN created at step 2
509516

510-
![Import project](../Keycloak/images/import_project.png)
517+
![Import project](images/import_project.png)
511518

512519
Deploy the **Loan Validation Service** production_deployment ruleapps using the **production deployment** deployment configuration in the Deployments>Configurations tab.
513520

514-
![Deploy project](../Keycloak/images/deploy_project.png)
521+
![Deploy project](images/deploy_project.png)
515522

516523
You can retrieve the payload.json from the ODM Decision Server Console or use [the provided payload](payload.json).
517524

@@ -520,7 +527,7 @@ As explained in the ODM on Certified Kubernetes documentation [Configuring user
520527
You can realize a basic authentication ODM runtime call the following way:
521528

522529
```shell
523-
$ curl -H "Content-Type: application/json" -k --data @payload.json \
530+
curl -H "Content-Type: application/json" -k --data @payload.json \
524531
-H "Authorization: Basic b2RtQWRtaW46b2RtQWRtaW4=" \
525532
https://<DS_RUNTIME_HOST>/DecisionService/rest/production_deployment/1.0/loan_validation_production/1.0
526533
```
@@ -530,15 +537,15 @@ Where b2RtQWRtaW46b2RtQWRtaW4= is the base64 encoding of the current username:pa
530537
But if you want to execute a bearer authentication ODM runtime call using the Client Credentials flow, you have to get a bearer access token:
531538

532539
```shell
533-
$ curl -k -X POST -H "Content-Type: application/x-www-form-urlencoded" \
540+
curl -k -X POST -H "Content-Type: application/x-www-form-urlencoded" \
534541
-d 'client_id=<CLIENT_ID>&scope=<CLIENT_ID>%2F.default&client_secret=<CLIENT_SECRET>&grant_type=client_credentials' \
535542
'https://login.microsoftonline.com/<TENANT_ID>/oauth2/v2.0/token'
536543
```
537544

538545
And use the retrieved access token in the following way:
539546

540547
```shell
541-
$ curl -H "Content-Type: application/json" -k --data @payload.json \
548+
curl -H "Content-Type: application/json" -k --data @payload.json \
542549
-H "Authorization: Bearer <ACCESS_TOKEN>" \
543550
https://<DS_RUNTIME_HOST>/DecisionService/rest/production_deployment/1.0/loan_validation_production/1.0
544551
```

0 commit comments

Comments
 (0)