- Ensure that all requirements described in the Requirements section are met.
- Ensure that you have the URLs for the Account Management user interface, the Account Management API, and the identity provider.
- Ensure that your identity provider is configured correctly and:
- The Client ID and Client Secret values are available.
- The Admin Studio public URL is listed as a valid redirect URI in the identity provider if you use Admin Studio. For more information, see the
redirect_uriparameter in OpenID Connect 1.0 -- Section 22.214.171.124.
- Ensure that you have access to the
account-management-2.4.x.zipfile in the Elastic Path Public Nexus repository.
- Ensure that the MySQL compatible RDBMS service is provisioned, the schema is initialized, and the username, password, and other connectivity details are available.
- Ensure that the JMS (Java Message Service) server is running, and you have the URL.
- Extract the files in the
account-management-2.4.x.zip. Ensure that all contents including the
account-management-apifolder are extracted. This folder contains the code to build the Docker image.
- On your computer, build the Docker image using
- Push the Docker image to Amazon ECR (Elastic Container Registry).
- Deploy the Docker image in Amazon ECS (Elastic Container Service) with appropriate settings. For more information about the settings, see the Docker Image Environment Variables section.
Docker image environment variables
Set values for the following parameters to start the Account Management service successfully:
|The username of the administrator account in the MySQL Account Management schema.|
|The password of the administrator account in the MySQL Account Management schema.|
|The username of the administrator account for the Felix OSGi Web Console.|
|The password of the administrator account for the Felix OSGi Web Console.|
|The access token to be used for static API access to Account Management APIs. For more information, see Static API access key|
|A URL that points to an OpenID Provider Configuration Document as defined in the OpenID Connect Discovery 1.0 standard -- Section 4. This URL ends with |
|The OAuth |
|The OAuth 2.0 client secret that is used as part of a |
|A space separated list of additional scopes that clients must request when authenticating against the identity provider. The primary use of this parameter is to set additional scopes that are required so that Account Management can determine the group membership of users. For example when using Okta, this value should be |
|The key to inspect in the |
|The value that exists in the |
|The value that exists in the |
|The JWT private key. For more information, see the Requirements section.|
|Specifies how long the authentication tokens issued to use the Account Management API are valid, in seconds. The recommended value is 3600.|
|The URL of the JMS broker that you want to use. JMS is disabled if this parameter is empty.|
|The JMS queue to which all messages from Account Management messages are sent. The default value is |
You can set values for the following parameters and change the functionality of Account Management:
|Specifies the origins that can make cross origin requests to the Account Management API. This setting corresponds to the cors.allowed.origins setting in the Apache Tomcat CORS Filter. The default value is |
|Specifies the HTTP verbs that can be used in cross origin requests to the Account Management API. This setting corresponds to the cors.allowed.methods setting in the Apache Tomcat CORS Filter. The default value is |
|Specifies the HTTP headers that can be sent in a cross origin request to the Account Management API. This setting corresponds to the cors.allowed.headers setting in the Apache Tomcat CORS Filter. The default value is |
|Specifies the HTTP headers that can be read in the response of a cross origin request to the Account Management API. This setting corresponds to the cors.exposed.headers setting in the Apache Tomcat CORS Filter. The default value is |
|Specifies that all endpoints that Account Management communicates with the identity provider must be HTTPS. You can set this value to |
We recommend not to change the default settings, as they may break Account Management functionality or create a security vulnerability.
Validating API Service Deployment
- In a browser, navigate to
https://(Account Management API URL)/studio.
- Open the Authentication tab and click Authenticate.
- Log in to the identity provider with the seller administrator credentials. The system redirects you to Account Management Studio.
- In the right pane, click Entry Points.
- In the Server Defaults field, click associates.
The system displays a successful Helix response consisting of a pagination element and
results: 0, indicating that:
- The Account Management API setup is complete.
- The identity provider and Account Management API integration is successful.