Configure Citizen Access

This topic describes how to configure the applications that are required to run WorkZone Citizen Access.

To run WorkZone Citizen Access, you need the following applications:

See also the Architecture diagram.

Configure the test client

The test client is an app that can be used for testing that citizens can log in with their digital ID. It's a web application that can be hosted in any Windows-based environment.

Fetching the artifacts

1. Get the latest build files from the pipeline [Citizen Access Client App](https://dev.azure.com/workzone-kmddk/WorkZone/_build?definitionId=3147).

   Artifact name: ClientBuild

   File name: Source.zip

2. Extract files from Source.zip

3. Remove the appsettings.Development.json, and appsettings.Production.json` files.

Setting up the app

Replace the appsettings.json content with following snippet. The configuration gets data from WorkZone Citizen Access that is hosted on Dev-AKS.

		insert{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft": "Warning",
      "Microsoft.Hosting.Lifetime": "Information"
    }
  },
  "AllowedHosts": "*",
  "Urls": "https://localhost:44375", // url on which application is running, must be configured with KMD Identity
  "Security": {
    "IdPMetadataUrl": "https://identity.kmd.dk/adfs/.well-known/openid-configuration",
    "ClientId": "", // ClientId for KMD Identity
    "ClientSecret": "", //Client Secret for KMD Identity
    "ApiScope": "allatclaims user_impersonation",
    "RequestDetailsApiUrl": https://<domain>/appproxyservice/api // Application Proxy API URL
  }
}
 

Running the test client

Open shell in folder containing sources and run KMD.Workzone.CA.IdentityClient.exe.

Configure Azure Key Vault

The key value configuration is required to store the keys so that the key will be sent as a header and validated in IDS.

1. In the Azure portal, select Key vaults.

   

2. Create a new key vault by choosing a resource group, and fill in information in the Instance details section.

    

3. Click Review + create.

4. Select the key vault that you just created to create secrets.

   

5. Select Generate/Import to create a new secret. In this example, create a secret named IdsKey and enter a secret value, and then click Create.

   .

Create an Azure AKS instance

1. In the Azure portal menu, select Create a resource.

2. In the Search box, enter Kubernetes Services, and then select Kubernetes Services.

3. On the Basics tab, fill in the following fields on :

   Under Project details:

• Select the subscription.

• Select a resource group in the Resource group field. If the resource group does not exist, click Create new and enter a resource group name.

Under Cluster details:

• In the Cluster preset configuration field, select Dev/Test for development, testing, or demo purposes.

• Enter a name for the Kubernetes cluster

• In the Region field, select a region for the AKS cluster.

• In the Select Availability zones, select Zone 1, Zone 2 and Zone 3.

• In the AKS pricing tier field, select Free for development, testing, or demo purposes.



4. On the Node pool tab, click Add new node pool.

5. Enter a name for the node pool and fill in the settings as shown below:

   

   Note: Select the 3 in the Maximum node count field for for development, testing, or demo purposes.

6. Click Add.

7. Click Review + create tab.

8. Client Create.

Create a multitenant Microsoft Entra application

You need to create a service principal to get access to pulling images from WorkZone ACR.

Follow below steps below to configure a service principal in Azure Entra ID.

1. In the Azure Portal menu, select Create a resource.

2. In the Search box, enter Microsoft Entra ID, and then select Microsoft Entra ID.

3. Under Manage in the menu, click App registrations > New registration.

4. Enter the name of the application (the service principal name).

5. Under Supported account types, select Accounts in any organizational directory (Any Microsoft Entra ID tenant - Multitenant).

6. Under Redirect URI (optional), select Web, and enter any URL. If you have an authentication endpoint for your organization that you want to use, enter it here. Otherwise, you can enter https://example.com/auth.

7. Click Register.

   .

8. Copy the Application (client) ID.

   

9. Under Manage in the menu, click Certificates & secrets.

10. Go to the Client secrets tab and click New client secret.

    

11. Enter a description, for example Secret for service principal, and select when the client secret should expire as per your standards. Click Add.

    

12. Copy the client secret value by clicking on copy icon. You will need it to update the AKS cluster's service principal.

    

    Note: You cannot copy the secret later.

Provision the service principal in the ACR tenant

Follow the below steps to provision the service pincipal in ACR tenant. If you do not have access to provision, you can please send a request to WZ DevOps team by sharing the APP/Client ID, App (Display) Name, and the redirect URL.

1. Open the following link using an admin account in the ACR tenant. Where indicated, insert the ID of the ACR tenant and the application ID (client ID) of the multitenant app which was created in Service Principal Configuration.

   https://login.microsoftonline.com/<ACR Tenant ID>/oauth2/authorize?client_id=<Multitenant application ID>&response_type=code&redirect_uri=<redirect url>

   See Create a multitenant Microsoft Entra application.

2. In the Permissions requested window, select the Consent on behalf of your organization check, and click Accept.

   

Grant the service principal permission to pull from Registry

Follow the below steps to grant the service principal in the ACR tenant with AcrPull role.

1. Log in into the Azure Portal.

2. Go to Container Registry, and click Access control (IAM).

3. Click Role assignments, select the service principal, and assign the AcrPull role.

Update AKS with the Azure Microsoft Entra ID application secret

In the tenant where you created the service principal, run the command to update the AKS cluster with the service principal credentials:

az aks update-credentials --resource-group <resource group name> --name myAKSCluster --reset-service-principal --service-principal "$SP_ID" --client-secret "${SP_SECRET}"

Configure Azure API Management

Follow the below steps to configure the Azure API Management.

1. In the Azure Portal menu, select Create a resource to create a new resource group by providing a name and the location.

2. Add administrator rights to key vault for a specific (logged-in) user.

   

   

   

3. Go to Key vaults, and create a new key vault with the secret name IdsKey and the value: <secret value>. The value must be the same as ApiSettings.Key in IDS.

   

4. Copy files below from the CitizenAccess Repo under the folder Source/ApiManagement.

   • Deploy.ps1

   • Parameters.json

   • Template.json

   In the parameters.json file, the names for the API-Management deployment are predefined. You can change the names if needed.

   The name of Api-Management service must match the parameter while executing the deploy.ps1 file.

5. Execute the Deploy.ps1 file to create an API-Management deployment.

   a. ./deploy.ps1 <resource group name> <api-management service name>

6. When completed, validate it through Postman.

   

Configure application proxy

Follow the below steps to configure the Application Proxy Application.

1. Log into Azure Portal where the service principal is created.

2. Click Show Portal Menu > All resources.

3. Click the Kubernetes services that were created earlier.

4. Click Connect, and copy the commands from the right-side window.

5. Once the pod is deployed, update the application proxy url in the client application in appSettings.json file.

   

   

6. Execute the commands that you just copied in PowerShell in administrative mode.

7. Run the command:

   
   kubectl run appproxyservice --image=wzcommonweuacr.azurecr.io/workzone/wzcitizenaccess/appproxyservice:latest
   				

   

Configure IDS

1. Log into Azure Portal where the service principal is created.

2. Click Show Portal Menu > All resources.

3. Click the Kubernetes services that were created earlier.

4. Click Connect, and copy the commands from the right-side window.

   

5. Execute the commands that you just copied in PowerShell in administrative mode.

6. Run the command:

   
   kubectl run ids --image=wzcommonweuacr.azurecr.io/workzone/wzcitizenaccess/ids:latest
   				

   

Helm chart changes

In Power Shell, run the command: