Sunbird RC (Registry & Credential)
  • Learn
    • Introduction
    • Sunbird RC Overview
      • Why do we need Sunbird RC?
      • Core Capabilities
      • Core Registry Verbs
      • Workflows
      • What Sunbird RC is and what it's not? (WIP)
      • Possibilities
      • Demo Links
    • Technical Overview
      • High level architecture
      • Technical Specification Draft
      • Tech Stack and Requirements
    • Adopters
    • Roadmap
  • Use
    • Getting started
      • Pre-requisites
      • Installation Guide
        • Registry CLI
          • Setup A Registry Instance
        • Manual installation through docker-compose
        • Production setup through Helm
    • Developer's Guide
      • Configurations
        • Frontend Configurations
        • Frontend - Proxy configuration
        • Audit Configuration
        • Notifications Configuration
        • View Templates Configuration
      • Schema Setup
        • Introduction To Schemas
        • Creating Your Own Schemas
        • Schema Configuration
        • Create Schemas With Custom Password
      • Setup the Backend
      • Setup the Frontend
      • Backup and Restore
        • PostgreSQL
          • SQL Dump
          • File System Level Backup
          • Continuous Archiving and Point-in-Time Recovery (PITR)
        • Cassandra
          • Snapshot-based backup method
          • Incremental backup method
          • Data Restore
      • Generic Identity And Access Management
      • Metrics
      • Custom Keycloak Build
      • Custom QR Code design
      • VC Verification Module
    • Integrations
      • SSO with existing systems
      • Digilocker Meripehchaan SSO
      • Digilocker Integration
    • Release Notes
      • Latest Release - v1.0.0
    • Admin Portal
      • Login
      • Get Started
        • Create Schema
        • Attestation Workflows (WIP)
        • VC Template
          • Custom VC Template (WIP)
        • Ownership (WIP)
        • Publish (WIP)
      • Dashboard
  • API Reference
    • Registry
      • Using The APIs
      • Create An Entity
      • Invite An Entity
      • Generate token
      • Generate admin token
      • Get An Entity
      • Get An Entity By Id
      • Update An Entity
      • Create A Property Of An Entity
      • Update A Property Of An Entity
      • Revoke a Credential
      • Delete An Entity
    • Schema
      • Create Schema
      • Get Schema
      • Update Schema
      • Delete Schema
      • Publish A Schema
    • Attestation API
      • Raise An Attestation
      • Get Attestation Certificate
    • Claims API
      • Get All Claims
      • Get Claim by ID
      • Attest A Claim
    • Discovery API
      • Search An Entity
    • File Storage API
      • Upload A File
      • Get Uploaded File
      • Delete A File/ Multiple Files
    • Bulk Issuance API
      • Get Sample Template
      • Upload CSV
      • Get all uploaded Files
      • Download a Report File
    • Metrics APIs
      • Get Count
      • Get Aggregates
    • Other APIs
      • Sign API
      • Verify API
      • Swagger JSON API
      • Health API
  • Reference Solutions for Functional Registries
    • Education
      • Education Ecosystem
        • Installation
      • Education Registries
        • Installation
    • Health Registries
      • Organ Registries
        • Frontend Setup
        • Backend Setup
        • User Guide
      • Health Facility Registry
    • Govt to Person (G2P)
  • Reference Solution for Digital Credentials
    • Certificate Issuance
      • Installation(WIP)
      • User Guide
    • Vaccination Platform
    • Unified Learners Passport (ULP)
      • ULP Capabilities
      • Example Scenario
      • Technical Components (WIP)
      • Demo/Sandbox Links (WIP)
      • Installation Guide (WIP)
        • Frontend Setup
        • Installation through docker-compose
        • Dummy records setup for refrence
    • eLocker
      • High Level Diagram
      • Installation (WIP)
        • Frontend Setup E-locker
      • User Guide
    • Skills & Work Credentials
  • Links
    • Source Code
    • Releases & Changelogs
    • Website
    • Roadmap
    • Reference links
    • Design
  • Community
    • Discussion Forum
    • Contributors
    • Contributing
    • Contribution Guidebook
    • Code of Conduct
    • Community Events
    • Status By Track
  • HELP
    • Roadmap
    • FAQs
    • Glossary
    • Guide to Electronic Registries and Verifiable Credentials
      • Verifiable Credentials
        • What issues will Verifiable Credentials address?
        • What are the key roles in Verifiable Credentials?
        • What are the components of Verifiable Credentials?
        • What are the benefits of Verifiable Credentials?
        • Digital Credentials vs Verifiable Credentials
        • QR code vs Verifiable QR code
        • Use Cases
      • Electronic Registries
        • Evolution of Electronic Registries
        • What issues will Electronic Registries address?
        • Benefits of Electronic Registries
        • Registry vs Database
        • Design Principles
        • Use Cases
      • Leveraging Existing data stores
    • External Open Source Software Attributions
Powered by GitBook
On this page
  • Pre-requisites
  • Request
  • Generate token API
  • Usage
  • cURL
  • HTTPie
  • Generate token api

Was this helpful?

Edit on GitHub
  1. API Reference
  2. Registry

Generate admin token

PreviousGenerate tokenNextGet An Entity

Last updated 2 years ago

Was this helpful?

Pre-requisites

Steps to create an admin role

  • Goto keycloak admin page, Ex: <domain>/auth/

  • The default admin credentials will be (admin / admin). Update the default admin password for security reasons.

  • Goto roles section and add a admin role if not present

You can create a new user or update the existing user with the above role. A can also be used if you have a backend service that will call the registry APIs.

Steps to create a user and attach an admin role

  • Goto keycloak admin page, Ex: <domain>/auth/

  • Goto users section and click on Add user button.

  • Fill in the required information and click on Save button

  • Goto Credential section and provide the password for the user

  • Once the user is created goto Role Mappings section

  • Select admin role from the Available Roles and click on Add selected

Use the below API to generate the token for the above user

Request

To authenticate as an entity, we need to make the following request:

Generate token API

POST http:/keycloak-url/auth/realms/{realm}/protocol/openid-connect/token

Headers

Name
Type
Description

content-type*

String

Set to application/x-www-form-urlencoded

Request Body

Name
Type
Description

grant_type*

String

Set to password

client_id*

String

Set to registry-frontend

username*

String

The _osConfig.ownershipAttributes.userId of the entity according to the schema

password*

String

Set to abcd@123 (default password, specified in registry's application.yml/docker compose file)

{
	"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lk...2cSSaBKuB58I2OYDGw",
	"expires_in": 300,
	"not-before-policy": 0,
	"refresh_expires_in": 1800,
	"refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lk...9HulwVv12bBDUdU_nidZXo",
	"scope": "email profile",
	"session_state": "300f8a46-e430-4fd6-92aa-a2d337d7343e",
	"token_type": "Bearer"
}

Important variables in the response body:

Field
In
Type
Description

access_token

body

string

Access token used to retrieve/update entity

expires_in

body

number

Number of seconds before the access token will be declared invalid

token_type

body

string

Should be Bearer, else we have gotten the wrong token

scope

body

string

Using this token, what information we can access about the entity

Usage

cURL

curl --location \
	--request POST \
	--header 'content-type: application/x-www-form-urlencoded' \
	--data 'client_id=registry-frontend' \
	--data 'username={username}' \
	--data 'password=test' \
	--data 'grant_type=password' \
	'{keycloak-url}/auth/realms/{realm}/protocol/openid-connect/token'

HTTPie

http --form post \
	'{keycloak-url}/auth/realms/{realm}/protocol/openid-connect/token' \
	'content-type: application/x-www-form-urlencoded' \
	'client_id=registry-frontend' \
	'username={username}' \
	'password=test' \
	'grant_type=password'

{keycloak-url} is usually http://localhost:8080, and {realm} is usually sunbird-rc.

The {keycloak-url} is usually localhost:{port}. The port can be found under the keycloak section in the docker-compose.yml file. The {realm} can be found at the top of the realm-export.json file used to configure keycloak.

Steps to create a client with an admin role

  • Goto keycloak admin page

  • Goto clients section and click on Add button

  • Give a new client id and click on the save button

  • Update the access type to confidential.

  • Turn on Service Accounts Enabled button.

  • And click on the save button

  • Goto Service Account Roles tab

  • Select admin role from the Available Roles and click on Add selected

  • Goto Credentials section and click on Regenerate secret and copy the value

Use the below API to get the token for the above client created

Generate token api

POST http:/keycloak-url/auth/realms/{realm}/protocol/openid-connect/token

Headers

Name
Type
Description

Content-Type*

String

application/x-www-form-urlencoded

Request Body

Name
Type
Description

grant_type*

client_credentials

client_id*

String

Use the client name that was used above

client_secret*

String

Use the client secret that was generated in the above steps

{
	"access_token": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lk...2cSSaBKuB58I2OYDGw",
	"expires_in": 300,
	"not-before-policy": 0,
	"refresh_expires_in": 1800,
	"refresh_token": "eyJhbGciOiJIUzI1NiIsInR5cCIgOiAiSldUIiwia2lk...9HulwVv12bBDUdU_nidZXo",
	"scope": "email profile",
	"session_state": "300f8a46-e430-4fd6-92aa-a2d337d7343e",
	"token_type": "Bearer"
}

Add a Valid Redirect Url Ex:

http://localhost:8081/auth
client