Configuration of Back-End Credentials

Mindbreeze InSpire

Introduction

This instruction manual applies to G7 appliances.

Mindbreeze InSpire uses the Keycloak software component to manage sign-on credentials. This section describes the most important use cases (such as changing passwords or creating users). You can also find additional documentation here: Keycloak 11.0 Server Administration

Change password

The first time you log in to the Management Center, you will be asked to change your password. If you want to change a user’s password at a later time, proceed as follows: In the Management Center, navigate to the menu item “Setup”, “Credentials” and then “Users” under “Manage”. Search for the user in question using the search function or click on “View all users” to view a list of users. Click on “Edit” for the relevant user. In the “Credential” tab you can set a new password. You can use the “Temporary” setting to determine whether the user has to change the password the next time he or she logs on. Confirm your entries with “Reset Password”.

Create a user

You can create multiple users. In the Management Center, navigate to the menu item “Setup”, “Credentials” and then “Users” under “Manage”. Click on “Add user” on the right, then enter the user name “Username” and click on “Save”. Then switch to the “Credentials” tab to set a password. This is described in the previous section “Change password”. After you have set a password, you must assign roles to the user, otherwise the new user cannot be used properly. To do this, see the following section entitled “Managing roles”. To use the “Forgot/reset password” function, we recommend that you enter a valid e-mail address for each user.

Managing roles

Access to the various areas of the Management Center (e.g. “Reporting”, “Configuration”) is regulated by roles. For example, a user has to be assigned the role “InSpire Config Administrator” to be able to use the “Configuration” item in the Management Center. Several “InSpire” roles have already been defined by default. You can call up the list of all available roles as follows: In the Management Center, navigate to the menu item “Setup”, “Credentials” and then “Roles” under “Configure”. The user “admin” is assigned all roles by default. You can assign roles to or remove roles from users as follows: In the Management Center, navigate to the menu item “Setup”, “Credentials” and then “Users” under “Manage”. Search for the user in question using the search function or click on “View all users” to view a list of users. Click on “Edit” for the relevant user. Switch to the “Role Mappings” tab. You can assign roles here.

Standard roles

Several roles that are required for operation are preconfigured in the as-delivered settings. This section describes which roles that includes and their significance.

The roles can be divided into 3 categories:

• Mindbreeze InSpire roles (name starts with “InSpire”)
• app.telemetry roles (name starts with „Fabasoft app.telemetry“)
• Keycloak administration roles

In the following section, the Mindbreeze "InSpire Management Center" is abbreviated as MMC.

Description of the Mindbreeze InSpire roles

The following Mindbreeze InSpire roles are predefined by default:

Description of the Keycloak administration roles

The following Keycloak administration roles are predefined by default:

You can also find additional documentation here: Keycloak 11.0 Server Administration

Description of the app.telemetry roles

The following app.telemetry roles are predefined by default:

Further documentation can be found at: Fabasoft app.telemetry Installation Guide.

Cookies

For security reasons, all cookies issued by the Management Center or Keycloak Service have the SameSite option set to Strict. See RFC6265.

In some rare cases it may be necessary to reduce the security level. For this purpose, SameSiteValue=Lax or SameSiteValue=None can be set in the file /var/data/env/reverse-proxy.env. The setting will become active after a restart of the reverse-proxy container.

TLS

For security reasons, TLS versions before TLSv1.2 as well as SSL (all versions) are disabled.
Those versions are no longer supported by most browsers as well.

In some rare cases it may be necessary to enable TLSv1.1 again (not recommended).
For this purpose TLSVersions='TLSv1.2 TLSv1.1' can be set in the file /var/data/env/reverse-proxy.env. The setting will become active after a restart of the reverse-proxy container.

Reset configuration to Mindbreeze standards

If the credentials management is no longer working properly, the credentials management can be reset to Mindbreeze standards. A malfunction can have the following causes:

• The password for the administrator has been lost
• A configuration required for the operation of Mindbreeze InSpire has been changed, including the following parts of the configuration
  • Roles with names beginning with "InSpire"
  • The client "mindbreeze-inspire".
  • The realm theme "mindbreeze".

Resetting to Mindbreeze standards resets the password of the administrator and resets the configuration of the parts of the configuration necessary for operation. Other parts of the configuration will not be changed. We recommend making a backup before resetting.

Resetting to Mindbreeze standards is done as follows:

• Log on to the appliance terminal with the root user.
• Navigate to the directory /var/data/upload/image/keycloak/scripts
• Run the script reset_to_mindbreeze_defaults.sh and read the warnings carefully. Finally, run the script again with a parameter that you have taken from the warnings.
• The reset takes a few minutes; the Mindbreeze services are not available during this time.

Backup and recovery of credentials

Automatic backup

The database and associated configuration files are backed up locally on a daily basis. The backup target in the keycloak container is as follows:

/data/backup/curr

This directory is also available on the host at

/var/data/keycloak/data/backup/curr

This directory must be included in an external backup.

Manual backup

The local backup can also be triggered manually. The backup is always stored in the same directory as described above. The backup does not affect the running operation. Access to the command line is necessary. Execute the following commands:

# open a shell inside the keycloak container

docker exec -it keycloak bash

# within the keycloak container, impersonate the jboss user

su jboss –

# as jboss user, execute the backup script

./backup.sh

# this can take a few minutes

Restoring a backup

A backup can be restored manually using the command line. Since the containers have to be restarted several times, the services are not available during this time. A prerequisite for recovery is an intact backup directory that has been stored or copied in /var/data/keycloak/data/. In this example, the copied backup directory is located in /var/data/keycloak/data/restore. Execute the following commands:

# stop the keycloak container

docker stop keycloak

# remove the keycloak container

docker rm keycloak

# locate the restore script (docker_export_import_db.sh),

# it is /var/data/upload/image/keycloak/scripts/docker_export_import_db.sh, if the appliance has never been updated, it is /var/data/upload/image/keycloak/scripts/ docker_export_import_db.sh

# run the restore script with the current version number of Mindbreeze, the restore directory path relative to the keycloak container and in import mode

/var/data/upload/image/keycloak/scripts/docker_export_import_db.sh 19.1.2.345 /data/restore import

# this can take a few minutes

# watch the console output for the message “import finished successfully”, then actively exit the script

# the restore process creates a temporary container that must be removed

# stop the temporary keycloak container

docker stop keycloak

# remove the temporary keycloak container

docker rm keycloak

# now create the real keycloak container

# locate the create script

# it is  /var/data/upload/image/keycloak/create.sh, if the appliance has never been updated, it is /var/data/upload/image/keycloak/create.sh

# run the create.sh script

/var/data/upload/image/keycloak/create.sh

# restart all container to apply the restored data

systemctl restart docker

# this can take a few minutes

Error diagnosis/troubleshooting

Log Files

The following log files can be helpful for troubleshooting:

# in-progress backups

/var/data/keycloak/data/temp/backup.log

# finished backups

/var/data/keycloak/data/curr/backup.log

# keycloak server logs within the keycloak container:

/opt/jboss/keycloak/standalone/log/server.log

# security logs within the inspire container:

/var/log/secure

Error when updating to version 20.4

If you receive the following error message when updating to version 20.4:

• verify.sh: ERROR: keycloak update script failed

Follow please this instruction.

Error when downgrading to version 19.0 - 20.3 / 20.4 / 20.5 / 21.2

When downgrading to versions 19.0 to 20.3, 20.4, 20.5 and 21.2, it is not possible to retain all Keycloak data. This applies to data such as additionally created clients (synchronized users, customized user role mappings).

However, to keep this data, please follow this instruction.

Error when downgrading from version 21.3 to 21.2 or older

After a downgrade from version 21.3 to 21.2, credentials can no longer be loaded, corresponding error messages are displayed in the log and affected services no longer start.

To fix this problem, please follow these instructions.