@@ -129,6 +129,79 @@ The SRM server and SRM client are excluded from the project build and test proce
129129
130130Respond with the `Retry-After` HTTP header when the client hits the rate limit.
131131
132+
133+ ### dCache-view
134+
135+ This release adds **OIDC Authorization Code Flow** support to the dcache-view web interface.
136+
137+ Users can now log in to dcache-view using their institutional identity via for example **Keycloak (Helmholtz AAI)**.
138+
139+ ---
140+
141+
142+ ## Configuration Changes
143+
144+ ### 1. `etc/dcache.conf` — Frontend OIDC Settings
145+
146+ Add or verify the following properties:
147+
148+ ```properties
149+ # OIDC client credentials
150+ frontend.authn.oidc.client-id=1234
151+ frontend.authn.oidc.client-secret=OSwvvbbF26vioqGkeKVXy4IV7QHFbmUv
152+ frontend.authn.oidc.token-url=https://keycloak.desy.de/auth/realms/dcache-dev/protocol/openid-connect/token
153+
154+ # dcache-view UI settings
155+ frontend.static!dcache-view.endpoints.webdav=https://localhost:2881/
156+ frontend.static!dcache-view.oidc-authz-endpoint-list=https://keycloak.desy.de/auth/realms/dcache-dev/protocol/openid-connect/auth
157+ frontend.static!dcache-view.oidc-client-id-list=1234
158+ frontend.static!dcache-view.oidc-provider-name-list=Helmholtz%20AAI(Keycloak)
159+ frontend.static!dcache-view.oidc-authz-redirect-url=https://localhost:3881/api/v1/auth/callback
160+ frontend.static!dcache-view.oidc-authz-endpoint-extra=-
161+
162+ ```
163+
164+ ---
165+
166+ ### 2. `etc/gplazma.conf` — gPlazma Authentication Stack
167+
168+ Ensure the following plugins are configured in the correct stages:
169+
170+ ```
171+ # Auth stage — verify OIDC token
172+ auth optional oidc
173+
174+ # Map stage — resolve identity to local user
175+ map optional multimap gplazma.multimap.file=/pathtodcache/dcache/packages/system-test/target/dcache/etc/multimap-id-to-username.conf
176+
177+ ```
178+
179+
180+ ---
181+
182+ ### 3. `etc/multimap-id-to-username.conf` — Identity Mappings
183+
184+ Map OIDC subject identifiers to local usernames and Unix attributes:
185+
186+ ```
187+ # Keycloak identity
188+ oidc:47055fee-1@keycloak username:usernameoidc uid:1000 gid:1000,true
189+
190+
191+ ---
192+
193+ ### 4. `etc/grid-security/storage-authzdb` — Authorization
194+
195+ Verify the file starts with `version 2.1` and contains the following entries:
196+
197+ ```
198+ version 2.1
199+
200+ authorize username:usernameoidc read-write 1000 1000 / /
201+ ```
202+
203+ ---
204+
132205### Xrootd
133206
134207### Zookeeper
0 commit comments