Facing error while deploying OpenCRVS version 1.4

[sharma-rajat-93]

OpenCRVS Core version

1.4.0

OpenCRVS Countryconfig version

1.4.0

Your operating system and version

Ubuntu 22.04

Your node version

v16.13.0

Which of these describes your project best?

• Testing OpenCRVS for business development, educational purposes or for personal interest.
• A research project to evaluate, configure and test OpenCRVS as a possible solution for a government, an active brief or proposal.
• Actively installing and configuring OpenCRVS Core for production use in a country.
• Customising OpenCRVS Core code in production in a country

[sharma-rajat-93]

Hi Team, I am trying to deploy OpenCRVS v1.4 to a qa environment but when running the GitHub action script, I am facing this error:

I have forked the country config to my own repo which is here:

https://github.com/radiantsolutionsorg/opencrvs-bahamas

Any help will be greatly appreciated.

[sharma-rajat-93]

Hi @naftis , can you also please clarify on a few questions:

1. I checked the mosiptokenseeder block and it mentions TOKENSEEDER_CRYPTO_ENCRYPT__ENCRYPT_CERT_PATH and TOKENSEEDER_CRYPTO_SIGNATURE__SIGN_P12_FILE_PATH. These certificates will be provided by MOSIP? If yes, are these the partner certificate related files?
2. Do I also need to deploy the MOSIP Mediator (https://github.com/opencrvs/mosip-mediator) as a separate service or will it be deployed as part of the deployment once I add the token seeder block to my deployment file?

[naftis]

1. Yes, right, they are provided by MOSIP. They are related to the auth partner certificate and key (keystore.p12) and auth partner certificate (ida.partner.crt / .key). These are more MOSIP's expertise, and for further clarification, you should enquire with them.
2. You need to deploy it as a separate service, as being shown under the token seeder block: https://github.com/opencrvs/opencrvs-mosip/blob/2654bf76b5651202141238ed6f4bf0dcb00194b2/infrastructure/docker-compose.development-deploy.yml#L134

[sharma-rajat-93]

Ok thank you @naftis , I see that the docker compose yaml file also references these variables:

  - NATIONAL_ID_OIDP_BASE_URL=${NATIONAL_ID_OIDP_BASE_URL}
  - NATIONAL_ID_OIDP_REST_URL=${NATIONAL_ID_OIDP_REST_URL}
  - NATIONAL_ID_OIDP_CLIENT_PRIVATE_KEY=${NATIONAL_ID_OIDP_CLIENT_PRIVATE_KEY}
  - NATIONAL_ID_OIDP_JWT_AUD_CLAIM=${NATIONAL_ID_OIDP_JWT_AUD_CLAIM}

I didn't find anything in the documentation that speaks to these values. Can you please elaborate on what these values are and where am I supposed to get these?

FYI I got this error while deploying the development environment with MOSIP:

[naftis]

These are the values that connect to a OIDP integration, in MOSIP's case it's E-Signet. The values could be for example:

NATIONAL_ID_OIDP_BASE_URL=https://esignet.test.mosip.net/
NATIONAL_ID_OIDP_REST_URL=https://esignet.test.mosip.net/v1/esignet/
NATIONAL_ID_OIDP_JWT_AUD_CLAIM=https://esignet.test.mosip.net/v1/esignet/oauth/v2/token
NATIONAL_ID_OIDP_CLIENT_ID=<<mosip provided client_id>>
NATIONAL_ID_OIDP_ESSENTIAL_CLAIMS=name,birthdate,address
NATIONAL_ID_OIDP_CLIENT_PRIVATE_KEY=<<base64 encoded private key, provided by MOSIP>>

The mediator client id, client secret and SHA secret are the national ID system integration values created via the national system admin UI in OpenCRVS. MOSIP provides the rest of the values; auth client id and secret being auth partner values, auth URL being similar to https://iam.test.mosip.net/auth/realms/mosip/protocol/openid-connect/token, auth user & pass being the keystore partner user name and password. The death and birth proxy URL and generate AID url are URL's that are running in MOSIP-side mediator.

We're looking into improving the documentation as we speak, and your feedback is valuable :)

[sharma-rajat-93]

Okay I’ll get the MOSIP side values but to get the mediator client id, secret etc. from the openCRVS UI, I’ll need to deploy it first correct? So before deploying successfully, how can I get these values beforehand?

[sharma-rajat-93]

Okay I’ll get the MOSIP side values but to get the mediator client id, secret etc. from the openCRVS UI, I’ll need to deploy it first correct? So while deploying successfully, how can I get these values beforehand?

…

On Mon, 18 Mar 2024 at 7:24 PM, Pyry Rouvila ***@***.***> wrote: These are the values that connect to a OIDP integration, in MOSIP's case it's E-Signet. The values could be for example: NATIONAL_ID_OIDP_BASE_URL=https://esignet.test.mosip.net/ NATIONAL_ID_OIDP_REST_URL=https://esignet.test.mosip.net/v1/esignet/ NATIONAL_ID_OIDP_JWT_AUD_CLAIM=https://esignet.test.mosip.net/v1/esignet/oauth/v2/token <https://esignet.test.mosip.net/NATIONAL_ID_OIDP_REST_URL=https://esignet.test.mosip.net/v1/esignet/NATIONAL_ID_OIDP_JWT_AUD_CLAIM=https://esignet.test.mosip.net/v1/esignet/oauth/v2/token> NATIONAL_ID_OIDP_CLIENT_ID=<<mosip provided client_id>> NATIONAL_ID_OIDP_ESSENTIAL_CLAIMS=name,birthdate,address NATIONAL_ID_OIDP_CLIENT_PRIVATE_KEY=<<base64 encoded private key, provided by MOSIP>> The mediator client id, client secret and SHA secret are the national ID system integration values created via the national system admin UI in OpenCRVS. MOSIP provides the rest of the values; auth client id and secret being auth partner values, auth URL being similar to " https://iam.test.mosip.net/auth/realms/mosip/protocol/openid-connect/token", auth user & pass being the keystore partner user name and password. The death and birth proxy URL and generate AID url are URL's that are running in MOSIP-side mediator. — Reply to this email directly, view it on GitHub <#6605 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BAQKKESKPQYYIUZXOA477KDYY3W2XAVCNFSM6AAAAABETTMFFKVHI2DSMVQWIX3LMV43SRDJONRXK43TNFXW4Q3PNVWWK3TUHM4DQMRYGM3TS> . You are receiving this because you modified the open/close state.Message ID: ***@***.*** com>

[naftis]

You can first deploy OpenCRVS without the mediator, either adding placeholder values for environment variables or not deploying it. The mediator is a separate piece of software that just utilizes the OpenCRVS integrations.

[sharma-rajat-93]

There is a step in the MOSIP side mediator when deploying, which requires some certificate from OpenCRVS. This is the step listed there:
Get certificate from OpenCRVS.

Can you please help me understand what is this certificate and where can I get it?

[naftis]

From the MOSIP's install.sh, would this refer to OpenCRVS public key which can be found from your installation's auth service: https://auth.{{hostname}}/.well-known

[sharma-rajat-93]

ok thank you, I was able to download it.