Overview :

        Sunbird system is allowing user to login with following ways.

       1. general login :  In this approach user first need to register with sunbird then he/she can use their email/phone/username along with password to login.

       2. Google login : User will have google account and they can use same account to login

       3. State login : Some state can have their user portal, So that state can do integration with sunbird. Once integration is completed their user can be directly logged in using SSO.ticket ref: 

As of now point 1 and 2 is completely done and point 3 is partially.  Some of the state is already using State SSO , to login their user.

Now based on new requirement there are some changes in new request body and state user identity.

Changes in request :

Proposed solution 1:

  New JWT token will have version as well, Based on incoming version it will be identified as old implementation or new implementation. Request body will be mapped as follow.

Current SSO login work flow:

Here loginId is userName@channel value.

Since new structure won't have userName ,it has externalId column and now user need to be search using externalId.

Proposed Solution 1:

  We already have get user by identity api. As of now this api is supported for email, phone and loginId . We can enhance this api to search user by

externalId as well.

In System we have externalId, channel, idType as combine unique key.

 externalId+provider+idType  , So for user search we need to always pass all three combination.

URI: /user/v1/get/externalId/externalId+"#$""channel""#$"+"idType"

– Here we are using "#$" as delimiter.
– idType will be same as channel

Proposed Solution 2:

Instead of separating values using delimiter , we can use as follow:

URI: /user/v1/get/externalId/{externalIdValue}/channel/{"channelValue"}/idType/{"idTypeValue"}

Proposed Solution 3:

As we have getuser by loginid post api , that api is working for loginId only, we can improve it to working for externalId search as well.

{
 "request":
    {
     "loginId": "value of loginId"
   }
}
--- changes
{
 "request": {
       "loginId":"",
       "externalId":"",
       "provider":"",
       "idType":"" 
     }
}

Problem statement :

  Once user found using externalId or userName or phone , caller required it's KeyCloak userName to generate JWT token.

Existing Solution:

 Once user found inside sunbird, system is making keycloak call to get userName stored inside keycloak and appending this userName, inside getUserByIdentifier response.

Caller is using same userName to generate JWT token. But problem with this approach is every time one extra call need to be made to keycloak and during heavy load time it might be single point of failure.

TO Over come with this we can do below apprach:

Approach 1:

    Sunbird will write an ETL job , to collect all userName from keycloak , and then update this userName inside loginId field of user table.  Once this migration completed system will use this loginId and add this key as userName in getUserByIdentifier response. 

Approach 2:

  Once user found in getUserByIdentifier api, system will check loginId attribute , if this value is not null or empty then decrypt it and provide inside userName. Otherwise make call to keycloak and update return userName inside cassandra as well, so that next time we don't need to make keycloak call.

Create user :

 Once user is created using SSO , caller can make another api call to add user to an organisation with provided roles.

URI: /org/v1/member/add

{
  "request": {
    "userId": "",
    "organisationId": "",
    "roles": [
      "CONTENTCREATOR",
      "CONTENTREVIEWER",
      "CONTENTCURATION",
      "FLAGREVIEWER"
    ]
  }
}

Mobile/Portal design for SSO: /wiki/spaces/DPT/pages/894369793