uoa-user-management/README.md

Uoa User Management

Uoa User Management is a service which communicates with Role Management and provides method to invite userDetails to be members or managers of an OpenAIRE entity

Configuration

Check first authorization-library.

You have to set at least one or both spring profile (html, registry)

External URLs

user-management.developers=             # Required (html) - URL of Developers portal (Deprecated)
user-management.developers-api=         # Required (html) - URL of Developers API (Deprecated)
user-management.login-url=              # Required (html) - URL for Login Action
user-management.role-management=        # Required (registry) - URL of Role Management API

Mail

user-management.mail.host               # Required (html, registry) - Mail host name
user-management.mail.port               # Required (html, registry) - Mail port
user-management.mail.from               # Required (html, registry) - From email address
user-management.mail.protocol           # Required (html, registry) - Mail protocol
user-management.mail.defaultEncoding    # Required (html, registry) - Default Encoding - default value: UTF-8
user-management.mail.sslProtocols       # Optional - If ssl Protocols are needed (comma separated)
user-management.mail.auth               # Required (html, registry) (boolean) - If authentication is required for mail account - default value: false
user-management.mail.username           # Required (html, registry) (if auth = true) - Username of mail account
user-management.mail.password           # Required (html, registry) (if auth = true) - Password of mail account

Google

user-management.google.key              # Required (html) - Google site key for Recaptcha
user-management.google.secret           # Required (html) - Google secret key for Recaptcha

Datasource configuration

user-management.datasource.url          # Required (html, registry) - jdbc URL to the database
user-management.datasource.username     # Optional - Database userDetails if needed
user-management.datasource.password     # Optional - Database userDetails password if needed

LDAP Configuration

user-management.ldap.address            # Required (html) - LDAP Host address
user-management.ldap.baseDN             # Required (html) - LDAP base domain
user-management.ldap.adminDN            # Required (html) - LDAP admin domain
user-management.ldap.password           # Required (html) - LDAP admin password
user-management.ldap.port               # Required (html) - LDAP Host port

Tenants

Since uoa-authorization-library 3.3.0 every request is scoped to the tenant given in the X-Tenant header (default: openaire). Role verifications (registry invitations) and saved queries are stored per tenant. Role verifications created before the tenant column existed are set to openaire on startup. The X-Tenant header (and the session header, for portals on another domain) is forwarded to Role Management, which scopes the type to the tenant (e.g. X-Tenant: irish + type funder → irish.funder roles), so clients sending the header must use the plain type. Without the header, types like irish.funder keep working as before. Requires a Role Management version that reads X-Tenant; deploy it first. Invitations created without the header are stored under openaire with the prefixed type; run scripts/updates/2026-10-13.sql for a tenant only when its portal switches to the header.

Database changes are in scripts/updates (rollback in scripts/rollback).

Saved queries (registry)

Saved search queries of the logged-in user, per tenant and portal. All endpoints require an authenticated user and only return/modify the caller's own queries.

GET    /api/saved-queries/{portalType}/{portalId}   # List
POST   /api/saved-queries/{portalType}/{portalId}   # Create - body: {friendlyName, route, queryParams}
GET    /api/saved-queries/{id}                      # Get
PUT    /api/saved-queries/{id}                      # Update - body: {friendlyName, route, queryParams}
POST   /api/saved-queries/{id}/clone                # Clone (name suffixed with " (copy)")
DELETE /api/saved-queries/{id}                      # Delete

route and queryParams are required; queryParams is the raw query string (a leading ? is removed). friendlyName is optional.

Run

Check Spring boot Documentation (need Login)

Docker

mvn clean package
docker build -t eu.dnetlib/uoa-user-management:<version> .

The image runs the war on port 8080. Pass configuration as arguments, e.g.:

--spring.config.additional-location=file:/config/dnet-override.properties
--server.servlet.context-path=/uoa-user-management
--spring.profiles.active=registry            # optional: override the profiles of the properties file

Logs are written to /var/log/dnet/uoa-user-management (mount it as a volume). Inside a container, localhost in user-management.datasource.url / user-management.ldap.address refers to the container itself, so point them to the database container / host instead. When running only the registry profile, also pass --management.health.ldap.enabled=false, otherwise the Spring Boot LDAP health check reports the service as DOWN.

Apply the pending scripts of scripts/updates to the database before deploying a new version.