Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update docs to remove idir and update alerts #427

Merged
merged 2 commits into from
Feb 7, 2025
Merged

chore: update docs to remove idir and update alerts #427

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
b034446
chore: update docs to remove idir and update alerts
thegentlemanphysicist Jan 30, 2025
ed601b4
chore: update docs from feedback
thegentlemanphysicist Jan 30, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
116 changes: 108 additions & 8 deletions wiki/Alerts-and-Us.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,6 +151,22 @@ Uptime will calculate the total downtime for the alert


### Gold Keycloak SSO Prod End User Access Uptime

| Month | Downtime |
| -------------- | ------- |
| **January 2025** | **0s** |
| February 2025 | |
| March 2025 | |
| April 2025 | |
| May 2025 | |
| June 2025 | |
| July 2025 | |
| August 2025 | |
| September 2025 | |
| October 2025 | |
| November 2025 | |
| December 2025 | |

| Month | Downtime |
| -------------- | ------- |
| January 2024 | 0s |
Expand All @@ -163,8 +179,8 @@ Uptime will calculate the total downtime for the alert
| August 2024 | 0s |
| September 2024 | 0s |
| October 2024 | 0s |
| **November 2024** | **0s** |
| December 2024 | |
| November 2024 | 0s |
| December 2024 | 0s |

**Note**: April 2024 alerts look like they were due to an uptime false alarm.

Expand All @@ -185,6 +201,23 @@ Uptime will calculate the total downtime for the alert

### Gold KeyCloak SSO Prod and IDIR siteminder Uptime

| Month | Downtime |
| -------------- | ------- |
| **January 2025** | **9m 28s** |
| February 2025 | |
| March 2025 | |
| April 2025 | |
| May 2025 | |
| June 2025 | |
| July 2025 | |
| August 2025 | |
| September 2025 | |
| October 2025 | |
| November 2025 | |
| December 2025 | |

Note: January outage was due to a testing password renewal and did not effect clients

| Month | Downtime |
| -------------- | --------- |
| January 2024 | 1h 3m 19s |
Expand All @@ -196,8 +229,8 @@ Uptime will calculate the total downtime for the alert
| August 2024 | 0s |
| September 2024 | 0s |
| October 2024 | 0s |
| **November 2024** | **0s** |
| December 2024 | |
| November 2024 | 0s |
| December 2024 | 0s |

**Note**: April 2024 alerts look like they were due to an uptime false alarm.

Expand All @@ -216,6 +249,73 @@ Uptime will calculate the total downtime for the alert
| November 2023 | 0h25m28s |
| December 2023 | 0h06m18s |

## 2025


##### P1 Stats
| Month | Number of Alerts | Acknowledge Time | Resolve Time | Notes |
| :--- | :----: | :----: | ---: |---: |
| January | 1 | 40s | 9m 26s | No actual outage, uptime test acount password had been updated |
| February | | | | |
| March | | | | |
| April | | | | |
| May | | | | |
| June | | | | |
| July | | | | |
| August | | | | |
| September | | | | |
| October | | | | |
| November | | | | |
| December | | | | |

##### P2 Stats
| Month | Number of Alerts | Acknowledge Time | Resolve Time | Notes |
| :--- | :----: | :----: | ---: |---: |
| January | 0 | NA | NA | NA |
| February | | | | |
| March | | | | |
| April | | | | |
| May | | | | |
| June | | | | |
| July | | | | |
| August | | | | |
| September | | | | |
| October | | | | |
| November | | | | |
| December | | | | |

##### P3 Stats
| Month | Number of Alerts | Acknowledge Time | Resolve Time | Notes |
| :--- | :----: | :----: | ---: |---: |
| January | 1 | 26s | 5m 5s | dev or test uptime test account password update caused a false alert |
| February | | | | |
| March | | | | |
| April | | | | |
| May | | | | |
| June | | | | |
| July | | | | |
| August | | | | |
| September | | | | |
| October | | | | |
| November | | | | |
| December | | | | |

##### P4 Stats
| Month | Number of Alerts | Acknowledge Time | Resolve Time | Notes |
| :--- | :----: | :----: | ---: |---: |
| January | 0 | NA | NA | NA |
| February | | | | |
| March | | | | |
| April | | | | |
| May | | | | |
| June | | | | |
| July | | | | |
| August | | | | |
| September | | | | |
| October | | | | |
| November | | | | |
| December | | | | |

## 2024

##### P1 Stats
Expand All @@ -232,7 +332,7 @@ Uptime will calculate the total downtime for the alert
| September | 1 | 27m 9s | 29m 44s | The prod uptime DNS check was triggered during the database upgrade. Preemptive failover in effect so no downt time. Sept 18 2024 |
| October | 1 | 3m 17s | 3m 17s | Prod service uptime failed a check Oct 23. Short network outage that did not trigger a failover to GoldDR |
| November | 0 | NA | NA | NA |
| December | | | | |
| December | 0 | NA | NA | NA |


##### P2 Stats
Expand All @@ -250,7 +350,7 @@ Uptime will calculate the total downtime for the alert
| September | 0 | NA | NA | NA |
| October | 7 | 2m 10s | 2m 10s | All CPU spikes due to a pod roll over, no service disruption |
| November | 0 | NA | NA | NA |
| December | | | | |
| December | 0 | NA | NA | NA |

#### Priority 3 aka Moderate Impact to Service --
Pathfinder Team commits to acknowledging issue within 15 -30 mins and resolving as quickly as possible
Expand All @@ -268,7 +368,7 @@ Pathfinder Team commits to acknowledging issue within 15 -30 mins and resolving
| September | 2 | 1m 36s | 1m 47s | Dev uptime alerts triggered during the Quarkus upgrade Sept 4. Not a real outage, alerts needed to be upgraded to work with Quarkus |
| October | 0 | NA | NA | NA |
| November | 0 | NA | NA | NA |
| December | | | | |
| December | 3 | 5m 11s | 5m 20s | Pod roll over warnings, not client impact |

#### Priority 4 aka Low Impact to Service --
Pathfinder Team commits to acknowledging issue within 15 -30 mins and resolving as quickly as possible
Expand All @@ -286,7 +386,7 @@ Pathfinder Team commits to acknowledging issue within 15 -30 mins and resolving
| September | 4 | 3m 26s | 3m 59s | Sysdig storrage warning alerts on Sept 4 and 6. No outgage or client impact. |
| October | 19 | 2m 45s | 3m 37s | No service impact. All storage warnings and CPU spikes |
| November | 6 | 2m 4s | 4m 19s | No service impact. All storage warnings and CPU spikes |
| December | | | | |
| December | 6 | 2m 15s | 3m 9s | Pod rolovers and elevated CPU warnings associated with them, not client impace. |


## 2023
Expand Down
12 changes: 4 additions & 8 deletions wiki/Our-Partners-the-Identity-Providers.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,13 +8,9 @@ Your technical team may need to know the identity provider attributes provided,
## What are Identity Providers?

[Identity providers](Useful-References#identity-provider) are directories of user accounts with details about those users, called attributes. The ones available to Pathfinder SSO Clients are:
- **IDIR:** IDIR accounts are given to individuals who work for the B.C. government. Please note, your end users must have an IDIR account which can make use of one of the two ways to login based on your application needs:
- **IDIR**
* User Experience: use an IDIR username and password for logging in.
* Architecture/Developer note: The authentication mechanisim via siteminder.
- **IDIR with MFA**
- **IDIR:** IDIR accounts are given to individuals who work for the B.C. government.
* User Experience: IDIR account with the added the benefit of MFA (multi-factor authentication). i.e use an IDIR username, password and mfa for logging in.
* Architecture/Developer note: It is a step up security-wise from regular IDIR. The authentication mechanism is azure cloud [More on MFA registration](https://intranet.gov.bc.ca/thehub/ocio/ocio-enterprise-services/information-security-branch/information-security-mfa/mfa-registration)
* Architecture/Developer note: The authentication mechanism is azure cloud [More on MFA registration](https://intranet.gov.bc.ca/thehub/ocio/ocio-enterprise-services/information-security-branch/information-security-mfa/mfa-registration)

- **BCeID** BCeID Accounts enable people to access government services using a single identifier and password.[More on BCeID ](https://www2.gov.bc.ca/gov/content/governments/services-for-government/information-management-technology/identity-and-authentication-services/bceid-authentication-service)

Expand Down Expand Up @@ -45,9 +41,9 @@ Also note if you get an error message similar to the one below, please ensure th

## Common Login Errors

### IDIR and BCeID in the same browser
### On prem IDIR and BCeID in the same browser

As we partner with the BC Gov Identity Partners of IDIR and BCeID please note in the same browser, you cannot have one tab logged in with IDIR and another with BCeID.
If an application is using the on premise IDIR (not IDIR MFA) there will be some conflicts. As we partner with the BC Gov Identity Partners of IDIR and BCeID please note in the same browser, you cannot have one tab logged in with IDIR and another with BCeID.

Please use a private browser by either using incognito or clearing your cache.

Expand Down
2 changes: 1 addition & 1 deletion wiki/Using-Your-SSO-Client.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ You can get started by making a request in our Common Hosted Single Sign On appl
<ol>
<li>The names of your product owner and technical contact.</li>
<li>Someone on your team who knows about OpenID connect. You can learn here too <a href="https://www.youtube.com/playlist?list=PL9CV_8JBQHirMRjBk62jeYUE_MpE4unU8">OIDC Explained by Pathfinder SSO</a>.</li>
<li>A rough idea on the identity provider (IDIR or BCeID) that you want to use. Learn more here <a href="../Our-Partners-the-Identity-Providers#what-are-identity-providers">Our Partners</a>.
<li>A rough idea on the identity providers that you want to use. Learn more here <a href="../Our-Partners-the-Identity-Providers#what-are-identity-providers">Our Partners</a>.
<li>There are some parts of the request where you may need to work with your developer/technical contact:
<ul>
<li>Which usecase/scenario do you need a request for?</li>
Expand Down
7 changes: 3 additions & 4 deletions wiki/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# SSO Pathfinder Knowledge Base

Welcome to our wiki for our Single Sign On Service. You are in the right spot if you need to configure/develop a login component (IDIR or BCeID) for your digital product/project. You can learn about [Common Hosted Single Sign On App on The Exchange Youtube channel](https://www.youtube.com/watch?v=JBaGxqykXJQ&list=PL9CV_8JBQHirMRjBk62jeYUE_MpE4unU8&index=3) or continue to read below.
Welcome to our wiki for our Single Sign On Service. You are in the right spot if you need to configure/develop a login component for your digital product/project. You can learn about [Common Hosted Single Sign On App on The Exchange Youtube channel](https://www.youtube.com/watch?v=JBaGxqykXJQ&list=PL9CV_8JBQHirMRjBk62jeYUE_MpE4unU8&index=3) or continue to read below.

**Get started now for your self serve experience to our [common hosted single sign on app](https://bcgov.github.io/sso-requests).**

Expand All @@ -25,8 +25,7 @@ Here’s some reasons as to why this might work for your digital product:

We've made this the #1 feature of this service. You can get your DEV, TEST, and PROD instances running against most of the available identity providers right away. The Pathfinder SSO service already has integrations to the following identity providers

- IDIR (BC Common Logon Page)
- [Learn about Azure IDIR ](Our-Partners-the-Identity-Providers#azure-idir-and-idir)
- [ IDIR MFA ](Our-Partners-the-Identity-Providers#azure-idir-and-idir)
- BCeID Basic (BC Common Logon Page) -- Allows login only with BCeID _Basic_
- BCeID Business (BC Common Logon Page) -- Allows login only with BCeID _Business_
- BCeID Basic & Business(BC Common Logon Page) -- Allows login with BCeID _Basic_ or BCeID _Business_
Expand Down Expand Up @@ -60,7 +59,7 @@ New customers no longer receive a dedicated realm where they can experiment and

### BC Services Card

The Pathfinder SSO Service provides the BC Services Card as a login option for both OpenID and SAML clients within the common realm. However, due to the high-security nature of the BC Services Card and the sensitive personal information involved in its authentication process, user personal information (PI) is not stored in the Keycloak database. As a result, we are unable to offer the **Role Management** feature, which is available with other identity providers such as IDIR and BCeID.
The Pathfinder SSO Service provides the BC Services Card as a login option for both OpenID and SAML clients within the common realm. However, due to the high-security nature of the BC Services Card and the sensitive personal information involved in its authentication process, user personal information (PI) is not stored in the Keycloak database. As a result, we are unable to offer the **Role Management** feature, which is available with other identity providers such as IDIR MFA and BCeID.

Each application requires separate user consent for authentication. Therefore, even if a user has an active BC Services Card session with one application, they must go through the authentication process again when logging into a different application, as **Single Sign-On (SSO)** is not supported in this case.

Expand Down