Partners are vendors or solution providers who offer their products/services to ensure the effective implementation and operation of MOSIP-based identity systems.

Partner Management Portal (PMP) is a web based application that is designed to facilitate the collaboration and integration of external partners with the MOSIP ecosystem. This portal serves as a platform to onboard all types of MOSIP partners, manage their details and build partner specific functionalities for seamless interaction.

We are undertaking a comprehensive overhaul of our existing Partner Management Portal (PMP). This revamp includes introducing a suite of new features and significantly enhancing the current ones. Our aim is to improve usability and elevate the overall user experience (UX). Also incorporating tech stack upgrade and realigning our focus to bring user centered design to PMP, we are committed to making the PMP more intuitive, efficient, and aligned with our partners' evolving needs.

You can refer to the comprehensive documentation as below:

• PMS - Revamp : Documentation that includes the features in new UI

• PMS - Legacy: Existing documentation (Old UI)

Who are the partners in MOSIP?

Policy group

Common policies group examples include 'Telecom', 'Banking', 'Insurance' among others.

What are the policies used in MOSIP?

• Data Share Policy

• Authentication Policy

Refer to the default policies loaded while installing MOSIP.

Partner Policies

Partner policies control the data that needs to be shared with a partner. The policies reside in auth_policy table of mosip_pms DB..

Partner roles

Documentation

PMS Revamp

PMS Legacy

The key features of Authentication Partner and the Partner Management System are here below.

Ease of Use and Usability Enhancements

Self-registration

A Partner can self-register with much of the process as automated with least manual intervention.

Policy Group Selection and Choosing a Policy

Partner has to select the Policy Group and then choose an applicable Policy which is based on the Partner Type the organization belongs to. Policy selection gets easier as there is description provided against each policy helping a Partner carefully select an applicable policy.

Interface / User Experience:

The new interface of PMP, for its user part, has undergone a complete revamp not only on UI but the UX been worked upon ground up. The select few points from the UX enhancements are as below:

• Card view presentation – You now get ‘Partner User Dashboard’ and this offers Card view presentation for each functionality with brief / one liner description to help you understand the services offered in:

• User Profile - User can view his organisation name and username on the top right , the user dropdown on the top right- has two options: User Profile and Logout.

User Access

• Login: Existing Partner who has already registered can login to the portal with email / username and password.

• Retrieve Password / Forgot Password: Partner will have option to reset password using the Forget Password option.

Partner Certificate

• Upload and Re-upload: Easily upload or re-upload Certificate Authority (CA) signed Partner Certificate.

• Download: Download CA signed Partner Certificate and corresponding MOSIP Signed Certificate.

Policies

• Request Policies: Request policies within selected policy group.

• Policy List: View a tabular list of requested policies along with Partner Admin approval status.

• View Policy Details: Access detailed views of individual policies, including status of Partner Admin approval/rejection.

Authentication Services:

• OIDC Client:

  • Create OIDC Client: Create OIDC Clients for approved policies.

  • View OIDC Details: Access a tabular list and individual views of submitted OIDC Client details, including OIDC Client IDs.

  • Edit: Edit existing OIDC Client details.

  • Deactivate: Deactivate OIDC Client whenever needed.

• API Key:

  • Generate API Key: Create API Keys for approved policies.

  • View API Key Details: View a tabular list and individual details of submitted API Keys.

  • Deactivate: Deactivate API Keys when necessary.

Browser Support:

• Complete support on Chrome, Firefox, Edge and Safari ensures a seamless user experience across these popular browsers.

Language Support:

• Currently supports English, French and Arabic with plans to incorporate additional languages in future releases.

Compatibility:

• Optimized for standard browser sizes (laptop/desktop) with responsive UI design for laptop/desktop views.

Partner Management Service

Partner Management Service provides various partner services like onboarding partners and providing partner data to other modules.

The diagram below illustrates the relationship of this service to other MOSIP services.

2. Registration processor fetches ABIS datashare policy from PMS.

3. PMS sends notification messages to partners via notification service (of Kernel).

4. Audit logs are logged into Auditmanager.

6. All PMS data is stored in mosip_pms DB.

8. PMS invokes the client management endpoint of eSignet to register OIDC client

Partner Management System (PMS) is undergoing a major revamp and as our first step, we have introduced a brand new web application - Partner Management Portal. This brings:

• Technology stack upgrade

• Introduce new partner types.

• Introduce new features.

• Enhancement of existing features.

• Improved usability and user experience.

This release marks the developer's preview release (1.3.0-dp.1) of Partner Management System which focuses on implementation of workflow in the new UI. This version of PMS is designed to run on 1.2.0.1 version of MOSIP platform.

The key features of Authentication Partner incorporated in this release are:

• Partner Certificate:

  • Upload and Re-upload: Easily upload or re-upload Certificate Authority (CA) signed Partner Certificate.

  • Download: Download CA signed Partner Certificate and corresponding MOSIP Signed Certificate.

• Policies:

  • Request Policies: Request policies within selected policy group.

  • Policy List: View a tabular list of requested policies along with approval status from 'Partner Admin'.

  • View Policy Details: Access detailed views of individual policies, including status of Partner Admin approval/rejection.

• Authentication Services:

  • OIDC Client:

    • Create OIDC Client: Create OIDC Clients for approved policies.

    • View OIDC Details: Access a tabular list and individual views of submitted OIDC Client details, including OIDC Client IDs.

    • Edit: Edit existing OIDC Client details.

    • Deactivate: Deactivate OIDC Client whenever needed.

  • API Key:

    • Generate API Key: Create API Keys for approved policies.

    • View API Key Details: View a tabular list and individual details of submitted API Keys.

    • Deactivate: Deactivate API Keys when necessary.

We are reconstructing the entire PMS ground up and our upcoming releases is going to keep the best of current system and rebuild everything else from scratch.

The 'Legacy PMS' will be available during the overhaul and new system is to gradually take over in phase wise releases of the system, ensuring thereby a smooth and seamless transition. This means existing system will continue to work and be available during the course of undergoing the rebuilding process.

This guide contains all the information required for successful deployment and running of Partner Management Portal. It includes information about the Database and roles.

DB scripts

Partner Management Service DB Scripts to be run: DB scripts

Keycloak Roles

mosip-pms-client needs to have below roles in keycloak:

• CREATE_SHARE`

• DEVICE_PROVIDER

• PARTNER

• PARTNER_ADMIN

• PMS_ADMIN

• PMS_USER

• PUBLISH_APIKEY_APPROVED_GENERAL

• PUBLISH_APIKEY_UPDATED_GENERAL

• PUBLISH_CA_CERTIFICATE_UPLOADED_GENERAL

• PUBLISH_MISP_LICENSE_GENERATED_GENERAL

• PUBLISH_MISP_LICENSE_UPDATED_GENERAL

• PUBLISH_OIDC_CLIENT_CREATED_GENERAL

• PUBLISH_OIDC_CLIENT_UPDATED_GENERAL

• PUBLISH_PARTNER_UPDATED_GENERAL

• PUBLISH_POLICY_UPDATED_GENERAL

• REGISTRATION_PROCESSOR

• SUBSCRIBE_CA_CERTIFICATE_UPLOADED_GENERAL

• ZONAL_ADMIN

Config Changes:

Add below property to partner-management-default.properties file in mosip-config repository to Deploy PMS Revamp 1.3.0-DP.1 release in your env.

## This property is used by kernel-authcodeflowproxy-api to check request is coming from allowed urls not.
auth.allowed.urls=https://${mosip.pmp.host}/,https://${mosip.pmp.reactjs.ui.host}/

Overview

The following guide outlines some important properties that can be customized for a given installation. Please note that this list is not exhaustive but serves as a checklist for reviewing properties that are likely to differ from the default settings. For a complete list of properties, refer to the files listed below.

Configuration files

Partner Management Services uses the following configuration files:

Copy

application-default.properties
partner-management-default.properties

Auth allowed urls

This property is used by kernel-authcodeflowproxy-api to check request is coming from allowed urls not.

auth.allowed.urls=https://${mosip.pmp.host}/,https://${mosip.pmp.reactjs.ui.host}/

Key manager API calls

These properties are used to specify the keymanager API to upload certificates and get original partner uploaded certificates.

mosip.kernel.sign-url=${mosip.kernel.keymanager.url}/v1/keymanager/jwtSign
pms.cert.service.token.request.clientId=${mosip.pmp.auth.clientId}
pms.cert.service.token.request.issuerUrl=${mosip.kernel.authmanager.url}/v1/authmanager/authenticate/clientidsecretkey
pmp.ca.certificaticate.upload.rest.uri=${mosip.kernel.keymanager.url}/v1/keymanager/uploadCACertificate
pmp.partner.certificaticate.upload.rest.uri=${mosip.kernel.keymanager.url}/v1/keymanager/uploadPartnerCertificate
pmp.partner.certificaticate.get.rest.uri=${mosip.kernel.keymanager.url}/v1/keymanager/getPartnerCertificate/{partnerCertId}
pmp.partner.original.certificate.get.rest.uri=${mosip.kernel.keymanager.url}/v1/keymanager/getPartnerSignedCertificate/{partnerCertId}
pmp-keymanager.upload.other.domain.cert.rest.uri=${mosip.kernel.keymanager.url}/v1/keymanager/uploadOtherDomainCertificate

Auth Adapter rest template authentication configs

These properties are used to set attributes for partner management services.

• app id : ApplicationId for partner

• client id : Kernel auth client ID for partner management services

• client secret : Kernel auth secret key for partner management services

mosip.iam.adapter.clientid=${mosip.pmp.auth.clientId}
mosip.iam.adapter.clientsecret=${mosip.pmp.auth.secretKey}
mosip.iam.adapter.appid=${mosip.pmp.auth.appId}

Keycloak Configurations

These configurations are used to create user in keycloak and map to a role.

Note : All partner types should be created as roles in keycloak.

mosip.iam.realm.operations.base-url = ${keycloak.internal.url}/auth/admin/realms/{realmId}
mosip.iam.admin-url =${keycloak.internal.url}/auth/admin/
mosip.iam.admin-realm-id =admin
mosip.iam.roles-extn-url =realms/mosip/roles
mosip.iam.users-extn-url = realms/mosip/users
mosip.iam.role-user-mapping-url =/{userId}/role-mappings/realm
mosip.iam.open-id-url =${keycloak.internal.url}/auth/realms/{realmId}/protocol/openid-connect/
mosip.iam.master.realm-id=master
mosip.iam.default.realm-id=mosip
mosip.keycloak.admin.client.id=admin-cli
mosip.keycloak.admin.user.id=admin
mosip.keycloak.admin.secret.key=${keycloak.admin.password}

Auth Services API calls

These properties are used to specify the auth manager API to validate the token.

auth.server.validate.url=${mosip.kernel.authmanager.url}/v1/authmanager/authorize/admin/validateToken
auth.server.admin.validate.url=${mosip.kernel.authmanager.url}/v1/authmanager/authorize/admin/validateToken
auth.server.admin.allowed.audience=mosip-creser-client,mosip-datsha-client,mosip-ida-client,mosip-regproc-client,mosip-admin-client,mosip-reg-client,mosip-pms-client,mosip-resident-client,mosip-idrepo-client,mosip-deployment-client
auth.jwt.secret=authjwtsecret
auth.jwt.base=Mosip-Token

mosip.iam.adapter.issuerURL=${keycloak.internal.url}/auth/realms/mosip
mosip.authmanager.client-token-endpoint=${mosip.kernel.authmanager.url}/v1/authmanager/authenticate/clientidsecretkey

UI allowed roles

This property is used to populate required roles which should be allowed in UI.(Roles are nothing but partner types)

mosip.pms.ui.required.roles=AUTH_PARTNER,DEVICE_PROVIDER,CREDENTIAL_PARTNER,FTM_PROVIDER,MISP_PARTNER,POLICYMANAGER,PARTNER_ADMIN

URL to redirect after logout

These properties specify the url to redirect after logout and the end session endpoint in OIDC.

mosip.iam.post-logout-uri-param-key=post_logout_redirect_uri
mosip.iam.end-session-endpoint-path=/protocol/openid-connect/logout

MOSIP E-Signet config

These configurations specify the E-Signet claims mapping file url, amr-acr mapping file url and the service apis for create and update OIDC and OAuth Client.

mosip.pms.esignet.claims-mapping-file-url=https://raw.githubusercontent.com/mosip/mosip-config/develop/identity-mapping.json
mosip.pms.esignet.amr-acr-mapping-file-url=https://raw.githubusercontent.com/mosip/mosip-config/develop/amr-acr-mapping.json
mosip.pms.esignet.config-url=${mosip.esignet.service.url}/v1/esignet/oidc/.well-known/openid-configuration

mosip.pms.esignet.oidc-client-create-url=${mosip.esignet.service.url}/v1/esignet/client-mgmt/oidc-client
mosip.pms.esignet.oidc-client-update-url=${mosip.esignet.service.url}/v1/esignet/client-mgmt/oidc-client

mosip.pms.esignet.oauth-client-create-url=${mosip.esignet.service.url}/v1/esignet/client-mgmt/oauth-client
mosip.pms.esignet.oauth-client-update-url=${mosip.esignet.service.url}/v1/esignet/client-mgmt/oauth-client

User Session Idle Timeout

These properties are used to set the user inactivity idle time.

• Inactivity Timer : Specifies the duration (in minutes) before the session is timed out due to inactivity.

• Prompt Timer : Specifies the duration (in minutes) before the user is prompted about the impending session timeout.

Copy

mosip.pms.session.inactivity.timer=25
mosip.pms.session.inactivity.prompt.timer=5

Axios Timeout

This property is used to set the server request and response time(in minutes) for Axios.

Copy

mosip.pms.axios.timeout=3

OIDC Client Attributes

These properties are used to set attributes for OIDC client creation and update.

• Grant Types : Specifies the grant types used by the OIDC client.

• Client Authentication Methods : Specifies the client authentication methods.

Copy

mosip.pms.oidc.clients.grantTypes=authorization_code 
mosip.pms.oidc.clients.clientAuthMethods=private_key_jwt

Partner Type Roles

These properties specify partner type roles that are used to grant access to various APIs in partner management service.

Copy

mosip.role.pms.getallcertificatedetails=AUTH_PARTNER,ABIS_PARTNER,SDK_PARTNER,DEVICE_PROVIDER,FTM_PROVIDER,CREDENTIAL_PARTNER,PARTNER_ADMIN,ONLINE_VERIFICATION_PARTNER
mosip.role.pms.getallrequestedpolicies=AUTH_PARTNER,ABIS_PARTNER,SDK_PARTNER,CREDENTIAL_PARTNER,PARTNER_ADMIN,ONLINE_VERIFICATION_PARTNER
mosip.role.pms.getallapprovedauthpartnerpolicies=AUTH_PARTNER,PARTNER_ADMIN
mosip.role.pms.getallapprovedpartneridswithpolicygroups=AUTH_PARTNER,ABIS_PARTNER,SDK_PARTNER,CREDENTIAL_PARTNER,PARTNER_ADMIN,ONLINE_VERIFICATION_PARTNER
mosip.role.pms.getallapikeysforauthpartners=AUTH_PARTNER,PARTNER_ADMIN
mosip.role.pms.getalloidcclients=AUTH_PARTNER,PARTNER_ADMIN
mosip.role.pms.userconsent=AUTH_PARTNER,ABIS_PARTNER,SDK_PARTNER,DEVICE_PROVIDER,FTM_PROVIDER,CREDENTIAL_PARTNER,PARTNER_ADMIN,ONLINE_VERIFICATION_PARTNER
mosip.role.pms.getallpolicygroups=AUTH_PARTNER,CREDENTIAL_PARTNER,ONLINE_VERIFICATION_PARTNER,ABIS_PARTNER,MANUAL_ADJUDICATION,PARTNER_ADMIN,POLICYMANAGER

This repository contains the UI code for Partner Management portal. To know more about the features and functions present on the portal, refer here.

Build and Deployment

Note: The code is written in React JS.

• Install node.js- To build the react JS code that runs on node, recommended Node: 21.7.3, Package Manager: npm 5.2+

• Check out the source code from GIT – To download the source code from git, follow the steps below to download source code on your local system.

  • git clone https://github.com/mosip/partner-management-portal (to clone the source code repository from git)

For Production build

• Build the code

  Follow the steps below to build the source code on your system.

  • Navigate to the pmp-reactjs-ui directory inside the cloned repository.

  • Run the command npm run build in that directory to build the code.

• Build Docker image

  Follow the steps below to build the docker image on your system.

  • docker build -t name . (replace name with the name of the image you want, "." signifies the current directory from where the docker file has to be read.)

  • Example: docker build -t pmp-reactjs-ui .

• Run the Docker image

  Follow the steps to build docker image on your system.

  • docker run –d –p 80:80 --name container-name image-name (to run the docker image created with the previous step,-d signifies to run the container in detached mode, -p signifies the port mapping left side of the":" is the external port that will be exposed to the outside world and right side is the internal port of the container that is mapped with the external port. Replace container-name with the name of your choice for the container, replace image-name with the name of the image specified in the previous step)

  • Example: docker run -d -p 3000:3000--name nginx pmp-reactjs-ui

• Now you can access the user interface over the internet via browser.

  • Example: http://localhost:3000

For Local build

• Build & deploy the code locally

  Follow the steps below to build the source code on your system.

  • Navigate to the pmp-reactjs-ui directory inside the cloned repository. Then, run the following command in that directory:

    • npm install

    • npm start

• Now, you can access the user interface via browser.

  • Example: http://localhost:3000

PMS Admin (Partner Admin)

Partner Management Portal (PMP) is used by both; PMS Admin and Partner User.

• Partner Administrator: Partner Admin

• Partners: Partner User

What all activities does a 'Partner Admin' perform for Authentication Partner?

Being a ‘Partner Admin’ you can perform following 3 activities to complete the end to end functionality pertaining to Authentication partner.

It should be noted that all these activities that you can perform as an admin you will still have to use the older 'Partner Admin Interface' as of now untill we complete its revamp which is already underway on a war footing.

• Upload Root CA and Sub CA Certificates

• Create Policy Group and Policy

• Approve/Reject Policy

Upload Root CA and Sub CA

Only after you 'Upload Root CA and Sub CA Certificates (From Older PMP Interface)' that a Partner will then be able to 'Upload CA signed Partner Certificate.

As a process of Partner onboarding onto PMP after successful registration, Partner is required to Upload CA signed Partner Certificate on behalf of their organisation which would be used to build a trust store in MOSIP to cryptographically validate that they are from a trusted organisation to perform authentication of citizens. Also this certificate is used to encrypt the response shared in e-KYC.

To Upload Root CA and Sub CA Certificates

1. Go to Older PMP Interface and click on Upload CA Certificate option on the left navigation pane.

2. Select the Partner Domain.

3. Choose the Root CA Certificate to upload (only files with extensions as .cer or .pem).

4. Click Upload.

5. Similarly, sub/intermediate CA certificate should be uploaded by following the above steps (1-4).

Creating Policy Group and Policy

As Partner Admin you are required to ‘Create Policy Group’ and ‘Create Policy(s)’ which a ‘Partner’ will be able to select while self-registering on PMP.

As an admin you will also have privilege to ‘Approve Policy Request’ when a Partner selects a Policy and it comes to you for approval, You can read more about this here.

Create Policy group

• Login as Partner Admin into the PMS portal (Older PMP Interface).

• Click on Policy > Policy Group. The existing policy groups are listed on the screen and the new ones can be created.

• Click on Create Policy Group (+).

• Enter the ‘Policy Group Name’ and ‘Description’.

• Click Save.

Create an Auth Policy

On successful creation of Policy Group(s), Polices can be created under a respective group.

1. Click on Policy > Policy Group on the left navigation pane, The existing policy groups are listed on the screen and the new ones can be created. You can also search or filter any data pertaining to policy groups, use the filter menu.

1. Click Auth Policy > Create Policy.

2. Add the Name and Description.

3. Select the Policy Group from the dropdown, (Select the Policy Group - Auth Policy) here under which this Policy you are creating will be added.

4. Add the Policies Data.

5. Click Save.

Activate/Edit Auth policy

Once you 'Create Policy' you will also be required to activate it and then it will reflect when a Partner wants to select a policy. You can also change the status of Policy Group ( Deactivate) or edit it using the Action menu as shown below.

1. Select the Policy you want to activate or edit.

2. From the Actions menu, select Activate/Edit.

Approve Policy Request

When a Partner have chosen a 'Policy Group' and the 'Policy', an approval request will come to you and you can approve or reject a ‘Policy Request’ using ‘Request Policy’ screen.

When a Partner have chosen a 'Policy Group' and the 'Policy' an approval request will come to you and you can approve or reject a ‘Policy Request’ using ‘Request Policy’ screen.

• Click on Partner Policy Mapping in the left navigation pane.

• Select the policy mapping that needs an approval.

• Click on Manage Policy on the ‘Action Menu’ appearing against a Policy.

• Click on Approve.

Authentication Partner Workflow

To be able to access the services by PMP and to validate that the partner is from a trusted organisation, undergoing self registration on PMP and uploading CA signed certificate is necessary'.

• Self Register on PMS Interface

• Upload CA signed Certificate

Self-Register on PMP as Authentication Partner

1. The Authentication Partner can register themselves on MOSIP PMS portal by clicking Register on the Login Page, a form comes up.

2. Enter the Authentication Partner details:

   1. Partner type (Authentication Partner)

   2. First and Last name

   3. Organization Name

   4. Address, Phone number

   5. e-mail, Username and password

1. Click on Register, a popup comes up which asks you to 'Choose a Policy Group' and seeks you to 'Agree to Terms and Conditions' before you can be considered as 'Authentication Partner.

2. Select the relevant/applicable Policy Group on Select Policy Group popup using Policy Group dropdown by reading through policy group description in dropdown.

1. On Submit it will ask you to read through ‘Terms and Condition’ and having carefully read through it you can agree and accept it.

CA Signed Partner Certificate Upload / Download or Re-Upload

User is now in Home Page/Dashboard where the following features are provided to Authentication Partner: 1) Partner Certificate, 2) Policies and 3) Authentication Services: OIDC Client and API Key generation.

Once registered, as a process of Partner onboarding onto PMP after successful registration, user is required to perform upload CA signed Partner Certificate on behalf of their organisation which would be used to build a trust store in MOSIP to cryptographically validate that they are from a trusted organisation to perform authentication of citizens. Also this certificate is used to encrypt the response shared in e-KYC.

To Upload CA signed Certificate

1. Go to Authentication Partner (New UI) -> Dashboard.

1. Click on Partner Certificate option, Click on the Upload button to upload the partner certificate signed by CA.

1. Select the CA signed partner certificate from local system by tapping on the upload section (blue area).

1. Certificate is successfully fetched from local system.

1. Click on Submit, Partner Certificate is uploaded successfully.

1. On closing the popup, The user can view the uploaded certificate details in the form of a list view.

Download Certificate

There is also an option to download initially uploaded CA signed certificate and also the MOSIP Signed Certificate.

Re-Upload Certificate

Reuploading certifacte is required in cases when MOSIP Signed Certificate gets expired after one year.

You must ensure that you re-upload the partner certificate again so that new MOSIP signed certificate can be generated and other functionalities such as Request Policy, Authentication Policies can function.

Request Policy

Pre-Requisite: Policy Manager (in our case 'Admin') must have created a Policy Group and then created a Policy within it for the Partner to be able to ‘Request a Policy’.

To Request a Policy

1. Click on the 'Request Policy' option in User homepage/dashboard.

   1. Each policy name is provided with policy description, You can make a suitable policy selection. You can provide appropriate request comments and submit the policy request details. A message conveying Policy request submitted successfully to admin is displayed.

1. This newly created policy request will be in ‘Pending for Approval’ status. You can also click on action menu to see all the submitted policy details irrespective of its status.

1. Once the request is approved (Partner Admin will Approve Policy Request). Once the request is approved you can view the status turns to ‘Approved’ status.

Authentication Service

After the partner has selected a policy group, uploaded partner certificate, requested for policy and also got admin approval - partner can now perform 'Authentication Services':

• OIDC Client: Create OIDC Client for approved policy

• API Key : Generate API Key for approved policy

Prerequisites: Policy requested by the Partner must be already approved by Policy Manager (Read More here).

Creating OIDC Client

• The authentication partner needs to provide the following details to create OIDC Client

  • Select suitable Authentication policy for OIDC Client creation. Only the policies that are APPROVED by admin will be available in dropdown for selection.

  • Enter the public key in JWK format, name or label for OIDC Client, LogoURI and one or more Redirect URI.

  • On successful submission, user can find this record in tabular list of submitted OIDC Client details in ‘Activated’ status. Tabular list and individual view of submitted OIDC Client details along with OIDC Client ID, Edit OIDC Client details and Deactivate OIDC Client can also be seen from here.

• This Client ID can then be consumed in eSignet to perform authentication. Client ID can be accessed by clicking on eye icon.

• User can utilize this OIDC Client ID to perform eSignet based authentication of citizens

• The user can also view every OIDC Client detail individually using the View option

• The user can also edit the OIDC Client details in Activated status (only OIDC Client Name, LogoURI and RedirectURI are editable) by selecting the edit option in Action Menu.

• User can deactivate the OIDC Client ID by clicking on deactivate option . The deactivate popup window appears and on clicking confirm, the OIDC Client record is changed to Deactivated status. Once deactivated, the client ID can not be used anymore for authentication.

API Key Generation

The authentication partner needs to provide the following details to generate API Key

• Select suitable Authentication policy for API Client. Only the policies that are Approved by admin will be available in dropdown for selection.

1. Enter an appropriate name or label for API Key to be generated and submit, On successful submission, a popup window displays API Key along with a copy button.

1. This API Key can be viewed by user in PMS application only once due to security reasons, hence the user is well notified with an appropriate message in the same API Key popup window to avoid closing the window unless user has not copied the API Key.\
2. User can find this record in tabular list of submitted API details in ‘Activated’ status.
3. User can either view individual API Key entries or view the consolidated list in tabular view.

1. You also have an option to deactivate an API Key, which thereafter cannot be used for authentication. On clicking confirm, the API Key record is changed to Deactivated status. Once deactivated, it cannot be activated again. You may need to generate a new API key as per requirement.

Interface Overview

PMP (Partner Management Portal) is going under a comprehensive overhaul. This revamp includes improving usability and elevate the overall user experience (UX). The focus is to bring user centered design to PMP, make the PMP more intuitive, efficient, and aligned with our partners' evolving needs.

Card view presentation is there for each functionality with brief description to help you understand the services offered in Partner User Dashboard.

After successfully registering you can access the Home Page / Dashboard. You will be able to view the features and functionalities on the dashboardand based on your Partner Type.

Note: You can access the partner dashboard only when you are duly registered and have selected the 'Policy Group'.

Each functionality that the user can perform is displayed in each card so that there is independent navigation for each tasks.

• Partner Certificate: Upload or Reupload CA Signed Partner Certificate and Download CA Signed Partner Certificate & corresponding MOSIP Signed Certificate

• Policies: Request for a policy within the selected policy group, tabular list of requested policies along with status of admin approval, view requested policy details along with admin comments/status.

• Authentication Services:

  • OIDC Client : Create OIDC Client for approved policy, tabular list and individual view of submitted OIDC Client details along with OIDC Client ID, Edit OIDC Client details and Deactivate OIDC Client

  • API Key : Generate API Key for approved policy, tabular list and individual view of submitted API Key details and Deactivate API Key.

You can view your organisation name and username on the top right called 'User Profile', logout options is also placed here only.

Reupload a new partner certificate through the following steps

1. Login to PMP and Go to Dashboard.

1. Click on Re-Upload button of Authentication Partner Type.

1. Re-upload certificate pop-up window appears. The time and date of previous certificate upload is also displayed for user reference. Click on the certificate upload section (blue area) to upload a new partner certificate from the local system.

1. After selecting the certificate from local system, the fetched certificate name is displayed.

1. Click on Submit, Partner certificate upload success message is displayed.

1. Click on Close to come back to list view of partner certificate.

Forgot Password

You can retrieve password in case you are unable to recall.

1. Click on Forgot Password link displayed on login page to reset password.

1. Enter registered email address and submit, a message is displayed informing user that further instructions to reset password has been sent on te email address entered.

1. Click on the Reset password link received on his email address, you will be redirected to Change Password screen.

1. Enter a new password that adheres to password policy and re enter to confirm before you save it.

1. After clicking submit, This new password will be further used in subsequent logins

Overview

This guide enables the Foundational Trust providers to use the PMP portal effectively. Below is the workflow:

• Partner self-register through the portal.

• Partner admin and uploads CA certificate.

• Partner admin/ Partner uploads partner certificate.

• Partner admin/ Partner creates FTM.

• Partner admin/ Partner uploads certificate from the menu before approval/ rejection.

• Partner admin approves/ rejects the FTM.

Self-registration

• The partner can register themselves on the MOSIP PMP portal by clicking Register on the landing page.

• They need to fill up a form with the details below:

  • First and Last name

  • Organization Name

  • Partner type (Device Provider)

  • Address, e-mail, phone number

  • Username and password

To view the details entered, click Home to see the dashboard.

Upload of Certificates

CA Certificate upload

The Partner admin needs to upload the CA certificate to enable the partner to use the portal. To do so, the Partner admin:

1. Clicks Upload CA Certificate option on the left navigation pane of the partner portal.

2. Selects the Partner Domain as FTM.

3. Chooses the certificate to upload (only files with extensions such as .cer or .pem).

4. Clicks Upload.

The uploaded certificates can be viewed by clicking on View Certificates-> View.

Partner Certificate upload

Similarly, the Partner certificates can be added by the Partner admin or partner.

The certificate can be uploaded by clicking Home-> Upload Certificate -> Upload.

The certificate can be viewed by clicking Home-> View Certificate ->View.

FTM Details

Creating FTM Details

The partner can create FTM details by,

1. Clicking FTM Details -> Create FTM

2. Fill up the information like Partner Name, Make and Model.

3. Clicking Save.

FTM Certificate Upload

The partner can upload FTM certificates by,

1. Selecting Upload Certificate option from the Actions menu against the FTM created.

2. Entering the Partner Domain as FTM and choosing the certificate file.

3. Clicking Upload.

Approval or rejection of the certificate

The Partner Admin can choose to approve or reject the FTM certificate uploaded. Below illustrates the workflow:

Finally, you can see the FTM activated.

Overview

PMS Portal is used by the Partners to onboard with MOSIP and manage Devices, FTM, Create API Keys and Create OIDC clients etc.

Partner Management module has two services:

• Partner Management service

• Policy Management service

The documentation here will guide you through the prerequisites required for the developer's setup.

Software setup

Below is a list of tools required in Partner Management Services:

1. JDK 11

2. Any IDE (like Eclipse, IntelliJ IDEA)

3. Apache Maven (zip folder)

4. pgAdmin

5. Postman

6. Git

7. Notepad++ (optional)

8. lombok.jar (file)

9. settings.xml (document)

Follow the steps below to set up Partner Management Services on your local system:

2. Install Apache Maven.

3. Copy the settings.xml to ".m2" folder C:\Users\<username>\.m2.

4. Install Eclipse.

5. Open the lombok.jar file and wait for some time until it completes the scan for Eclipse IDE and then click Install/Update. Specify the eclipse installation location if required by clicking the ‘Specify location…’ button. Then, click Install/Update the button to proceed.

1. Check the Eclipse installation folder C:\Users\userName\eclipse\jee-2021-12\eclipse to see if lombok.jar is added. By doing this, you will not have to add the dependency of lombok in your pom.xml file separately as it is auto-configured by Eclipse.

2. Configure the JDK (Standard VM) with your Eclipse by traversing through Preferences → Java → Installed JREs.

Code setup

Importing and building a project

1. Open the project folder partner-management-services\partner where pom.xml is present.

2. Open the command prompt from the same folder.

3. Run the command mvn clean install -Dgpg.skip=true to build the project and wait for the build to complete successfully.

4. After building a project, open Eclipse and select Import Projects → Maven → Existing Maven Projects → Next → Browse to project directory → Finish

5. This will import 5 projects into Eclipse: partner, partner-management-service, pms-common, policy-management-service and policy-validator

1. After successful importing of all the projects, update each project by right-clicking on Project → Maven → Update Project.

Environment setup

• E.g.: You can download kernel-auth-adapter.jar and add to the project Libraries → Classpath → Add External JARs → Select Downloaded JAR → Add → Apply and Close).

• Properties Files - Update application-dev.properties and bootstrap.properties files in below folder partner-management-services\partner\partner-management-service\src\main\resources to run the Partner Management Service locally

• Click the "run" option, the service will start locally on port 9109.

Policy management service also can run by following the above steps.

Partner Management Services API

• The APIs can be tested with the help of Postman or Swagger-UI.

• Swagger is an interface description language for describing restful APIs expressed using JSON. Can access Swagger-UI of partner-management-services for dev-environment from https://dev.mosip.net/v1/partnermanager/swagger-ui/index.html?configUrl=/v1/partnermanager/v3/api-docs/swagger-config and localhost from http://localhost:9109/v1/partnermanager/swagger-ui/index.html?configUrl=/v1/partnermanager/v3/api-docs/swagger-config.

• Can access Swagger-UI of policy-management-services for dev-environment from https://dev.mosip.net/v1/policymanager/swagger-ui/index.html?configUrl=/v1/policymanager/v3/api-docs/swagger-config and localhost from http://localhost:9107/v1/policymanager/swagger-ui/index.html?configUrl=/v1/policymanager/v3/api-docs/swagger-config.

• Postman is an API platform for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster. It is widely used tool for API testing.

PMS Portal UI:

The table below outlines the frameworks, tools, and technologies used in PMS Portal.

Partner Management Services:

The table below outlines the frameworks, tools, and technologies employed by Partner Management Services.

PMS Revamp Portal web application is currently compatible and certified with the following list of browsers:

Scope for Release 1.3.0-dp.1 - Compatible on standard browser size (laptop/desktop) and UI responsiveness in laptop/desktop.

Compatibility on Mobile and also on specific tablet and mobile sizes will be taken up only after Release 1.3.0-dp.1.

Overview

Partner Management System (PMS) module provides the following services:

1. Partner Management Service

2. Policy Management Service

For an overview of role of partners in MOSIP, refer .

Partner Management Service

Provides various partner services like onboarding partners and providing partner data to other modules.

The diagram below illustrates the relationship of this service to other MOSIP services.

2. Registration processor fetches ABIS datashare policy from PMS.

3. PMS sends notification messages to partners via notification service (of Kernel).

4. Audit logs are logged into Auditmanager.

6. All PMS data is stored in mosip_pms DB.

Policy Management Service

This service manages partner policies.

1. Audit logs are logged into Auditmanager.

2. All policies are stored stored in mosip_pms DB.

3. Datashare service fetches partner policies and shares data with partners accordingly.

Partner portal

Developer Guide

API

Source code

Overview

Partner management portal allows the partners to register themselves in MOSIP. With LTS release, the following types of partners can register themselves:

1. Authentication Partners

2. Credential Partners(with limited features)

3. Device Providers

4. FTM Provider

Partner roles

A Partner Admin can create Policies that are required for Authentication and Credential partners. The section below describes the types of policies that are supported by MOSIP.

Home page

Policies

To create policies, policy groups should be defined. Policy groups can be considered as the regulatory bodies in a country, examples could be Telecom, Insurance, Banking, etc.

Creation of Policy group

• Login as Partner Admin into the PMS portal.

• After successful login, on the left navigation pane, click on Policy -> Policy Group.

• The existing policy groups are listed on the screen and the new ones can be created.

To create Policy groups

• Click Policy -> Policy Group -> +Create Policy Group

• Enter the Policy group Name and Description and click Save.

To search or filter any data pertaining to policy groups, use the filter menu.

You can also change the status of policy group(Deactivate/Re-activate) or edit it using the Action menu as shown below.

On successful creation of Policy groups, polices can be created under that group. MOSIP supports two types of policies, i.e., Auth policy and Datashare policy.

Auth Policy

Create an Auth policy

1. Click Auth Policy -> Create Policy.

2. Add the Name and Description.

3. From the dropdown, select the Policy group.

4. Add the Policies Data.

5. Click Save.

Note: Once the policy is created, it will be in Inactive state. You have to activate it before using it for a partner.

Activate/edit Auth policy

1. Select the policy you want to activate or edit.

2. From the Actions menu, select Activate/Edit.

Search or filter data

1. Use the filter menu.

Data Share Policy

Data Share policy can be created/edited in the same way as the steps mentioned in the previous section on Auth policy by using Data Share Policy menu options.

Partner

Self Registration

Partners in MOSIP are created in a self-service mode. The partner visits the MOSIP partner management portal and requests for collaborating with MOSIP by providing basic details such as organization name and email-id, purpose of registration (how they want to collaborate with MOSIP - as a device provider, authentication partner, print partner, etc), basic credentials and performing an OTP based verification. Once these details are filled by the partner and a request is sent to MOSIP, the Partner Admin verifies the details of the partners and allows the partner to integrate with MOSIP.

To know more about each of the partners, click:

Overview

Below is the workflow that includes the registration process for an Auth or Credential partner and the steps that need to be followed for using the partner portal.

• The partner self-registers through the portal.

• Partner selects the relevant Policy Group.

• Partner admin uploads the CA certificate.

• Partner admin or partner uploads the partner certificate.

• Partner admin or Partner maps the Partner Policy.

• Partner admin approves or rejects partner policy mapping.

• Partner logins after the approval and generates the API key for the approved partner policy mapping using an unique label.

Self-registration

• The Auth/ Credential partner can register themselves on MOSIP PMS portal by clicking Register on the landing page.

• They need to fill up a form with the details below:

  • First and Last name

  • Organization Name

  • Partner type (Authentication Partner/ Credential Partner)

  • Address, e-mail, phone number

  • Username and password

To view the details entered, click Home to see the dashboard.

Policy Group mapping

On successful registration, the partner can see their username displayed on the top right corner.

1. Partner selects the relevant Policy Group from Map Policy Group dropdown.

2. Clicks Save.

Upload of Certificates

CA Certificate upload

The Partner admin needs to upload the CA certificate to enable the partner for using the portal. To do so, the Partner admin:

1. Clicks Upload CA Certificate option on the left navigation pane of the partner portal.

2. Selects the Partner Domain.

3. Chooses the certificate to upload (only files with extensions as .cer or .pem).

4. Clicks Upload.

The uploaded certificates can be viewed by clicking on View Certificates-> View.

Partner Certificate upload

Similarly, the Partner certificates can be added by the Partner admin/ partner.

Mapping policy to policy group

Once the certificates are uploaded,

1. Partner maps the policy to the Policy group by clicking on Partner Policy Mapping -> +Map Policy.

2. Partner enters the Partner Name.

3. Selects the Auth Policy Name from the dropdown.

4. Enters a value for the Request Details (unique value) and clicks Save.

• Once this is done, you will see a message saying Policy mapping grequest submitted successfully.

• Also, the status is displayed as "In progress" and this means that the partner cannot generate the API key until the request is approved by the Partner admin.

Approval/ Rejection of partner policy mapping

Once the Partner Policy Mapping request is raised by the partner, the Partner admin has the privilege to approve/ reject the mapping. To do so,

1. Partner admin logs into the PMS portal and clicks on Partner Policy Mapping in the left navigation pane.

2. Selects the policy mapping that needs an approval.

3. From the action menu against the policy mapping, selects Manage Policy.

4. Clicks Approve.

Once the request is approved, the partner can view the status being updated to Approved instead of InProgress.

Generating the API Key

Partner logins after the Partner Policy Mapping is approved by the Partner admin and generates the API key with an unique label. To do so,

1. Partner clicks Partner Policy Mapping on the left navigation pane.

2. From the actions menu, click Generate API Key.

3. Partner enters a unique value for the Label field.

4. Click Generate.

The API key is generated and can be used by the partner.

The partner can also deactivate a particular API Key by clicking on the cross-mark (X) next to it. Please note, once deactivated, it cannot be activated again. You may need to generate a new API key as per requirement.

Overview

This guide enables the Device provider partner to use the partner portal effectively. Below is the workflow:

• The partner self-registers through the portal.

• Partner admin uploads the CA certificate.

• Partner admin or Partner uploads the partner certificate.

• Partner admin or Partner creates device details.

• Partner admin approves or rejects device details.

• Partner admin or Partner creates SBI details.

• Partner admin approves or rejects SBI details.

• Partner admin or Partner maps devices and SBI.

Self-registration

• The Device Provider partner can register themselves on the MOSIP PMS portal by clicking Register on the landing page.

• They need to fill up a form with the details below:

  • First and Last name

  • Organization Name

  • Partner type (Device Provider)

  • Address, e-mail, phone number

  • Username and password

To view the details entered, click Home to see the dashboard.

Upload of Certificates

CA Certificate upload

The Partner admin needs to upload the CA certificate to enable the partner for using the portal. To do so, the Partner admin:

1. Clicks Upload CA Certificate option on the left navigation pane of the partner portal.

2. Selects the Partner Domain.

3. Chooses the certificate to upload (only files with extensions such as .cer or .pem).

4. Clicks Upload.

The uploaded certificates can be viewed by clicking on View Certificates-> View.

Partner Certificate upload

Similarly, the Partner certificates can be added by the Partner admin/ partner.

The certificate can be uploaded by clicking Home-> Upload Certificate -> Upload.

The certificate can be viewed by clicking Home-> View Certificate ->View.

Device make and model

Creating Device details

The partner can add devices to the portal. To do so,

1. Partner clicks Device details-> Create Device.

2. Enters the necessary details to create/add devices like:

   • Partner Name

   • Device Type and Sub Type

   • Make and Model

3. Click Save.

Approval/ Rejection of Device details

The Partner Admin can choose to approve/reject the device details entered by the partner.

SBI (Secure Biometric Interface)

Creating SBI

The Partner can create SBI by filling in the required details.

Approval/Rejection of SBI

The Partner Admin can choose to approve/reject the SBI details entered by the partner.

Mapping Device make and model with SBI

The partner can map the device with an SBI.

Overview

Partner Management Services are the self-services which are used by the partners themselves via a portal. Partner Management Portal is a web based UI application that provides services to various types of partners.

Partner Management module has two services:

• Policy Management service

• Partner Management service

The documentation here will guide you through the prerequisites required for the developer's setup.

Software setup

Below are a list of tools required in Partner Management Services setup:

1. JDK 11

2. Any IDE (like Eclipse, IntelliJ IDEA)

3. Apache Maven (zip folder)

4. pgAdmin

5. Postman

6. Git

7. Notepad++ (optional)

8. lombok.jar (file)

9. settings.xml (document)

Follow the steps below to set up Partner Management Services on your local system:

• Download lombok.jar and settings.xml from here.

• Unzip Apache Maven and move the unzipped folder in C:\Program Files and settings.xml to conf folder C:\Program Files\apache-maven-3.8.4\conf.

• Install Eclipse, open the lombok.jar file and wait for some time until it completes the scan for Eclipse IDE and then click Install/Update.

• Check the Eclipse installation folder C:\Users\userName\eclipse\jee-2021-12\eclipse to see if the lombok.jar is added. By doing this, you don't have to add the dependency of lombok in your pom.xml file separately as it is auto-configured by Eclipse.

• Configure the JDK (Standard VM) with your Eclipse by traversing through Preferences → Java → Installed JREs.

Code setup

For the code setup, clone the repository and follow the guidelines mentioned in the Code Contributions.

Importing and building of a project

1. Open the project folder where pom.xml is present.

2. Open command prompt from the same folder.

3. Run the command mvn clean install -Dgpg.skip=true -DskipTests=true to build the project and wait for the build to complete successfully.

4. After building of a project, open Eclipse and select Import Projects → Maven → Existing Maven Projects → Next → Browse to project directory → Finish.

5. After successful importing of project, update the project by right-click on Project → Maven → Update Project.

Environment setup

• For the environment setup, you need an external JAR that is available here with different versions. (E.g.: You can download kernel-auth-adapter.jar and add to project Libraries → Classpath → Add External JARs → Select Downloaded JAR → Add → Apply and Close).

• Clone mosip-config repository.

• Create an empty folder inside the mosip-config with sandbox-local name and then copy and paste all config files inside sandbox-local folder except .gitignore, README and LICENSE.

• As Partner Management Services is using two properties files, partner-management-default and application-default, you will have to configure them according to your environment. The same files are available here for reference.

• To run the server, two files are required- kernel-config-server.jar and config-server-start.bat.

• Put both the files in the same folder and change the location attribute to sandbox-local folder in config-server-start.bat file and also check the version of kernel-config-server.jar towards the end of the command.

Example:

java -jar -Dspring.profiles.active=native -Dspring.cloud.config.server.native.search-locations=file:C:\Users\myDell\mosipProject\mosip-config\sandbox-local -Dspring.cloud.config.server.accept-empty=true -Dspring.cloud.config.server.git.force-pull=false -Dspring.cloud.config.server.git.cloneOnStart=false -Dspring.cloud.config.server.git.refreshRate=0 kernel-config-server-1.2.0-20201016.134941-57.jar.

As mentioned in the steps above, you may have to make some changes in the two properties files as per your environment.

• Run the server by opening the config-server-start.bat file.

The server should now be up and running.

Below are the configurations to be done in Eclipse:

1. Open Eclipse and run the project for one time as Java application, so that it will create a Java application which you can see in debug configurations and then change its name. (e.g.: project name with environment - "partner-management-dev").

2. Open the arguments and pass this -Ddomain.url=dev.mosip.net -Dapplication.base.url=http://localhost:8090 -Dspring.profiles.active=default -Dspring.cloud.config.uri=http://localhost:51000/config -Dspring.cloud.config.label=master in VM arguments.

3. Here, the domain URL represents the environment on which you are working (eg., it can be dev2.mosip.net or qa3.mosip.net).

4. Click Apply and then debug it (starts running). In the console, you can see a message like "Started PartnerManagementService in 34.078 seconds (JVM running for 38.361)".

Policy management service also can run by following the above steps.

Partner management services API

• For API documentation, refer here.

• The APIs can be tested with the help of Swagger-UI and Postman.

• Swagger is an interface description language for describing restful APIs expressed using JSON. Can access Swagger-UI of partner-management-services for dev-environment from https://dev.mosip.net/v1/partnermanager/swagger-ui/index.html?configUrl=/v1/partnermanager/v3/api-docs/swagger-config and localhost from http://localhost:9109/v1/partnermanager/swagger-ui/index.html?configUrl=/v1/partnermanager/v3/api-docs/swagger-config.

• Can access Swagger-UI of policy-management-services for dev-environment from https://dev.mosip.net/v1/policymanager/swagger-ui/index.html?configUrl=/v1/policymanager/v3/api-docs/swagger-config and localhost from http://localhost:9107/v1/policymanager/swagger-ui/index.html?configUrl=/v1/policymanager/v3/api-docs/swagger-config.

• Postman is an API platform for building and using APIs. Postman simplifies each step of the API lifecycle and streamlines collaboration so you can create better APIs—faster. It is widely used tool for API testing.

• Download the JSON collection and then import it in your postman.