feat: wire MCM to Ory IAM stack - #804
Open
kirgene wants to merge 18 commits into
Open
Conversation
kirgene
force-pushed
the
feat/iam-zanzibar
branch
from
May 20, 2026 03:25
77a4c20 to
bd3b1ce
Compare
kirgene
marked this pull request as ready for review
May 20, 2026 03:31
kirgene
requested review from
bushjames,
elnyry-sam-k,
gibaros,
kalinkrustev,
kleyow,
oderayi,
shashi165 and
vijayg10
as code owners
May 20, 2026 03:31
kirgene
force-pushed
the
feat/iam-zanzibar
branch
from
May 20, 2026 05:17
bd3b1ce to
663645c
Compare
- Oathkeeper rules route MCM requests with Keto-backed authorization - Keto loads OPL namespaces from /etc/keto-namespaces, populated by per-service OCI ImageVolumes - MCM API env wired with Hydra/Kratos/Keto admin URLs - global.iam.* shared values in umbrella chart Closes #4398, #4404, #4399.
kirgene
force-pushed
the
feat/iam-zanzibar
branch
from
May 27, 2026 14:44
663645c to
f9a795c
Compare
|
- connection-manager passes IAM_ENABLED, IAM_AUTO_CREATE_ACCOUNTS, HYDRA_AUDIENCE, KRATOS_IDENTITY_SCHEMA_ID, KRATOS_INVITE_RETURN_TO_URL to the MCM API container - mojaloop-iam ships an opt-in post-install Job that creates the initial hub-admin Kratos identity and writes the Hub admins Keto tuple. Admin password is auto-generated and persisted on first install, or externally referenced via Secret
- Add ory/kratos-selfservice-ui-node as a conditional dep (kratosUI.enabled) for the browser-based admin login/recovery/error UI - Add jouve/mailpit as a conditional dep (mailpit.enabled) as a dev SMTP catcher feeding the Kratos courier - Enable Kratos password, code, and link self-service methods - Add password credential identifier and recovery/verification annotations to the default identity schema - Wire Kratos courier SMTP to mailpit by default
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
…lates - Hydra: strategies.access_token=jwt, oidc subject types, TTLs, CORS, enable secret auto-generation - Oathkeeper jwt authenticator points at Hydra in-cluster JWKS with target_audience=connection-manager-api and 5s cold-keygen tolerance - Oathkeeper cookie_session subject_from=identity.id - Kratos recovery email templates rendered from chart files via ConfigMap and mounted at /conf/courier-templates - iam-bootstrap Job: resource requests/limits and non-root securityContext
- Rewrite connection-manager Oathkeeper rules to match the updated MCM API endpoints in mojaloop/connection-manager-api#202: states-status, external jwscerts upload, /api/health (noop), dfsps list and monetaryzones use authorizer=allow with API-side row scoping by X-Roles - Both authenticators (cookie_session + jwt) on every rule, dropping the separate PM4ML rule in favour of OPL inheritance via Dfsp.parent - Global Oathkeeper header mutator now emits X-DFSP-ID from identity.metadata_public.dfspId and X-Roles as a JSON array combining role and dfsp:<id> entries - Add INTERNAL_CA_TTL env to the MCM API container (default 8760h)
…re keto-secret existed)
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Companion MCM API PR (ships the OPL file in the Docker image): mojaloop/connection-manager-api#193
Closes #4398, #4404, #4399.