.. SPDX-FileCopyrightText: 2024 Univention GmbH .. .. SPDX-License-Identifier: AGPL-3.0-only .. _component-end-user-self-service: End User Self Service ===================== This section describes the *End User Self Service* in Nubus for Kubernetes. :numref:`component-end-user-self-service-overview-figure` gives an overview about the functions, services, and components of the *End User Self Service*. It provides the following functionalities: * :ref:`component-end-user-self-service-consumer` * :ref:`component-end-user-self-service-user-account-profile` * :ref:`component-end-user-self-service-invitation-registration` * :ref:`component-end-user-self-service-password-reset` .. _component-end-user-self-service-overview-figure: .. figure:: /images/Functional_component_End_User_Self_Service_overview.* :target: ../_images/Functional_component_End_User_Self_Service_overview.svg :alt: Functional components relying on the End User Self Service Overview Functional components relying on the *End User Self Service Overview* .. seealso:: :ref:`interfaces-end-user-self-service` in interfaces and protocols section for information about incoming and outgoing interfaces. :ref:`deployment-end-user-self-service` in the deployment view section for information about Docker images, Kubernetes pods, and Helm Charts used for deployment. :ref:`overview-components-end-user-self-service` in the functional components overview section for information about purpose and tasks. .. _component-end-user-self-service-consumer: Self Service Consumer --------------------- The purpose of the *Self Service Consumer* is to handle the process of informing users that their user account has been created and that it's ready to use after they set their initial password. It acts when the :ref:`component-provisioning-service` reports the creation of, or change to a user account. As shown in :numref:`component-end-user-self-service-consumer-figure`, the *Consumer Message HTTP REST API* sends *Event objects* to the *Self Service Consumer*. *Event objects* from the :ref:`component-provisioning-service` contain information about user account objects. From this information, the *Self Service Consumer* can determine that a user account has been created without a user password, and that the consumer needs to notify the user of the next step. The *Self Service Consumer* then triggers the UMC to send an invitation email. The invitation email provides the user with information to complete the user account setup and set a user password. The *Processes for UMC modules* uses *SMTP to send invitation email*. During user account creation, administrators can flag a user account for the invitation process. They don't need to assign a user password then. .. _component-end-user-self-service-consumer-figure: .. figure:: /images/Functional_component_End_User_Self_Service_Consumer.* :target: ../_images/Functional_component_End_User_Self_Service_Consumer.svg :alt: Self Service Consumer application component relationships and behavior *Self Service Consumer* application component relationships and behavior .. _component-end-user-self-service-user-account-profile: User account profile -------------------- The *End User Self Service* provides functionality to the end user to manage their *User account profile*. The functionality runs as UMC module in the *UMC Server* in the :ref:`component-management-ui`. For example, it uses the processes to present the profile elements to the user and to update these elements. .. _component-end-user-self-service-profile-figure: .. figure:: /images/Functional_component_End_User_Self_Service_profile.* :target: ../_images/Functional_component_End_User_Self_Service_profile.svg :alt: *User account profile* application service and its relationships :width: 400px *User account profile* application service and its relationships .. _component-end-user-self-service-invitation-registration: User self registration ---------------------- The *End User Self Service* provides an application service that allows users to register a user account by themselves, if activated in Nubus. Furthermore, if activated, administrators can invite users to complete their user account setup. Users can, for example, set their user password. At the end of each process, a UMC module in *UMC Server* in the *Management UI* sends an email to the user with information for either completing the invitation, or confirming the account creation. .. _component-end-user-self-service-invitation-registration-figure: .. figure:: /images/Functional_component_End_User_Self_Service_invitation_registration.* :target: ../_images/Functional_component_End_User_Self_Service_invitation_registration.svg :alt: User invitation / User self registration application service and its relationships :width: 400px *User invitation / User self registration* application service and its relationships .. _component-end-user-self-service-password-reset: User password reset ------------------- The *User password reset* is a functionality in the *End User Self Service* component. :numref:`component-end-user-self-service-password-reset-figure` shows that it uses functionality from the *UMC Server*, from the *End User Self Service*, and from the *Portal Fronted*. Users can initiate a password reset process from the *Management UI*. The *UMC Server* sends an email to the user with a link containing a token to reset the password. The user password reset functionality uses *Processes for UMC modules* and runs as a UMC module in the *UMC Server*. The processes of the UMC modules use the following interfaces: * *SMTP to send invitation email* to send the invitation email to the user. * *TCP to SQL database* to store the password reset token. * *TCP to Memcached store* to temporarily store the IP address of the client requesting the password reset to prevent brute force attacks. The Memcached store is an important element for *Brute Force Detection for password reset*. The *Portal Frontend in User Browser* in the :ref:`component-portal-service` provides some UI elements for the *End User Self Service*, for example, for setting the user password after the user clicks the link with the token from their password reset email. .. _component-end-user-self-service-password-reset-figure: .. figure:: /images/Functional_component_End_User_Self_Service_Password_Reset.* :target: ../_images/Functional_component_End_User_Self_Service_Password_Reset.svg :alt: *User password reset* application service and its relationships *User password reset* application service and its relationships .. seealso:: :ref:`component-Authorization-Service-Storage` in the *Authorization Service* section for more information about the interface and storage. :ref:`component-identity-provider-keycloak-extensions-brute-force-protection` in the Identity Provider section for more information about Brute force protection.