diff --git a/v/v1.10.0/404.html b/v/v1.10.0/404.html
index dd1815a70..ad8c27188 100644
--- a/v/v1.10.0/404.html
+++ b/v/v1.10.0/404.html
@@ -86,7 +86,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/index.html b/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/index.html
index 3c3934b7b..3131b77aa 100644
--- a/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/index.html
+++ b/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2021/09/07/new-iam-website/index.html b/v/v1.10.0/blog/2021/09/07/new-iam-website/index.html
index cd087a436..d224072e8 100644
--- a/v/v1.10.0/blog/2021/09/07/new-iam-website/index.html
+++ b/v/v1.10.0/blog/2021/09/07/new-iam-website/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2021/09/13/iam-v1.7.1/index.html b/v/v1.10.0/blog/2021/09/13/iam-v1.7.1/index.html
index a0ad1ad69..75bc0869c 100644
--- a/v/v1.10.0/blog/2021/09/13/iam-v1.7.1/index.html
+++ b/v/v1.10.0/blog/2021/09/13/iam-v1.7.1/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2021/12/03/iam-v1.7.2/index.html b/v/v1.10.0/blog/2021/12/03/iam-v1.7.2/index.html
index dd0800ac6..8ed4da638 100644
--- a/v/v1.10.0/blog/2021/12/03/iam-v1.7.2/index.html
+++ b/v/v1.10.0/blog/2021/12/03/iam-v1.7.2/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2022/09/09/iam-v1.8.0/index.html b/v/v1.10.0/blog/2022/09/09/iam-v1.8.0/index.html
index 2ebff131b..8b4a26654 100644
--- a/v/v1.10.0/blog/2022/09/09/iam-v1.8.0/index.html
+++ b/v/v1.10.0/blog/2022/09/09/iam-v1.8.0/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2023/02/28/iam-v1.8.1/index.html b/v/v1.10.0/blog/2023/02/28/iam-v1.8.1/index.html
index 903219fae..0199479ac 100644
--- a/v/v1.10.0/blog/2023/02/28/iam-v1.8.1/index.html
+++ b/v/v1.10.0/blog/2023/02/28/iam-v1.8.1/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2023/06/05/iam-v1.8.2/index.html b/v/v1.10.0/blog/2023/06/05/iam-v1.8.2/index.html
index fe3cf931d..753ceb754 100644
--- a/v/v1.10.0/blog/2023/06/05/iam-v1.8.2/index.html
+++ b/v/v1.10.0/blog/2023/06/05/iam-v1.8.2/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2023/10/30/iam-v1.8.3/index.html b/v/v1.10.0/blog/2023/10/30/iam-v1.8.3/index.html
index 10f8589ad..a5294b4e2 100644
--- a/v/v1.10.0/blog/2023/10/30/iam-v1.8.3/index.html
+++ b/v/v1.10.0/blog/2023/10/30/iam-v1.8.3/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/index.html b/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/index.html
index 0232f4abd..63a9e5057 100644
--- a/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/index.html
+++ b/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child active-path" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 active td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="td-sidebar-nav-active-item">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/index.html b/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/index.html
index e7feae962..ff0af4eaa 100644
--- a/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/index.html
+++ b/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -141,7 +141,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child active-path" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child active-path" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 active td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="td-sidebar-nav-active-item">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
@@ -212,7 +214,7 @@ <h1>IAM v1.9.0</h1>
     <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" aria-label="Previous - IAM v1.8.4" class="btn btn-primary"><span class="me-1">←</span>Previous</a>
   </li>
   <li>
-    <a class="btn btn-primary disabled">Next<span class="ms-1">→</span></a>
+    <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" aria-label="Next - IAM v1.10.0" class="btn btn-primary">Next<span class="ms-1">→</span></a>
   </li>
 </ul>
 
diff --git a/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/index.html b/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/index.html
new file mode 100644
index 000000000..290252274
--- /dev/null
+++ b/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/index.html
@@ -0,0 +1,268 @@
+<!doctype html>
+<html itemscope itemtype="http://schema.org/WebPage" lang="en" class="no-js">
+  <head>
+    <meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+<meta name="robots" content="index, follow">
+
+
+<link rel="shortcut icon" href="/v/v1.10.0/favicons/favicon.ico" >
+<link rel="apple-touch-icon" href="/v/v1.10.0/favicons/apple-touch-icon-180x180.png" sizes="180x180">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/favicon-16x16.png" sizes="16x16">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/favicon-32x32.png" sizes="32x32">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-36x36.png" sizes="36x36">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-48x48.png" sizes="48x48">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-72x72.png" sizes="72x72">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-96x96.png" sizes="96x96">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-144x144.png" sizes="144x144">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-192x192.png" sizes="192x192">
+
+<title>IAM v1.10.0 | INDIGO IAM</title>
+<meta name="description" content="The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)">
+<meta property="og:title" content="IAM v1.10.0" />
+<meta property="og:description" content="The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)" />
+<meta property="og:type" content="article" />
+<meta property="og:url" content="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" /><meta property="article:section" content="blog" />
+<meta property="article:published_time" content="2024-08-07T00:00:00+00:00" />
+<meta property="article:modified_time" content="2024-08-12T18:50:44+02:00" />
+
+<meta itemprop="name" content="IAM v1.10.0">
+<meta itemprop="description" content="The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)"><meta itemprop="datePublished" content="2024-08-07T00:00:00+00:00" />
+<meta itemprop="dateModified" content="2024-08-12T18:50:44+02:00" />
+<meta itemprop="wordCount" content="107">
+<meta itemprop="keywords" content="" /><meta name="twitter:card" content="summary"/><meta name="twitter:title" content="IAM v1.10.0"/>
+<meta name="twitter:description" content="The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)"/>
+
+
+
+
+<link rel="preload" href="/v/v1.10.0/scss/main.min.8b15a284065632327b8c02a701e1c2297b5d1c084085e061cb33bbd46e6313e8.css" as="style">
+<link href="/v/v1.10.0/scss/main.min.8b15a284065632327b8c02a701e1c2297b5d1c084085e061cb33bbd46e6313e8.css" rel="stylesheet" integrity="">
+
+<script
+  src="https://code.jquery.com/jquery-3.7.1.min.js"
+  integrity="sha512-v2CJ7UaYy4JwqLDIrZUI/4hqeoQieOmAZNXBeQyjo21dadnwR+8ZaIJVT8EE2iyI61OV8e6M8PP2/4hpQINQ/g=="
+  crossorigin="anonymous"></script>
+<script defer
+  src="https://unpkg.com/lunr@2.3.9/lunr.min.js"
+  integrity="sha384-203J0SNzyqHby3iU6hzvzltrWi/M41wOP5Gu+BiJMz5nwKykbkUx8Kp7iti0Lpli"
+  crossorigin="anonymous"></script>
+
+  </head>
+  <body class="td-page td-blog">
+    <header>
+      <nav class="td-navbar js-navbar-scroll" data-bs-theme="dark">
+<div class="container-fluid flex-column flex-md-row">
+  <a class="navbar-brand" href="/v/v1.10.0/"><span class="navbar-brand__logo navbar-logo"></span><span class="navbar-brand__name">INDIGO IAM</span></a>
+  <div class="td-navbar-nav-scroll ms-md-auto" id="main_navbar">
+    <ul class="navbar-nav">
+      <li class="nav-item">
+        <a class="nav-link" href="/v/v1.10.0/docs/"><span>Documentation</span></a>
+      </li>
+      <li class="nav-item">
+        <a class="nav-link active" href="/v/v1.10.0/blog/"><span>Blog</span></a>
+      </li>
+      <li class="nav-item dropdown d-none d-lg-block">
+        <div class="dropdown">
+  <a class="nav-link dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">Releases</a>
+  <ul class="dropdown-menu">
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/current">v1.10.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/current">v1.9.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.4">v1.8.4</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.3">v1.8.3</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.2">v1.8.2</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.1">v1.8.1</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.0">v1.8.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.7.2">v1.7.2</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.7.1">v1.7.1</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.7.0">v1.7.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/docs/v/current/">older releases</a></li>
+    </ul>
+</div></li>
+      </ul>
+  </div>
+  <div class="d-none d-lg-block">
+    <div class="td-search td-search--offline">
+  <div class="td-search__icon"></div>
+  <input
+    type="search"
+    class="td-search__input form-control"
+    placeholder="Search this site…"
+    aria-label="Search this site…"
+    autocomplete="off"
+    
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
+    data-offline-search-base-href="/"
+    data-offline-search-max-results="10"
+  >
+</div>
+  </div>
+</div>
+</nav>
+    </header>
+    <div class="container-fluid td-outer">
+      <div class="td-main">
+        <div class="row flex-xl-nowrap">
+          <aside class="col-12 col-md-3 col-xl-2 td-sidebar d-print-none">
+            <div id="td-sidebar-menu" class="td-sidebar__inner">
+  <div id="content-mobile">
+  <form class="td-sidebar__search d-flex align-items-center">
+    <div class="td-search td-search--offline">
+  <div class="td-search__icon"></div>
+  <input
+    type="search"
+    class="td-search__input form-control"
+    placeholder="Search this site…"
+    aria-label="Search this site…"
+    autocomplete="off"
+    
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
+    data-offline-search-base-href="/"
+    data-offline-search-max-results="10"
+  >
+</div>
+    <button class="btn btn-link td-sidebar__toggle d-md-none p-0 ms-3 fas fa-bars" type="button" data-bs-toggle="collapse" data-bs-target="#td-section-nav" aria-controls="td-section-nav" aria-expanded="false" aria-label="Toggle section navigation">
+    </button>
+  </form>
+  </div>
+  <div id="content-desktop"></div>
+  <nav class="td-sidebar-nav collapse td-sidebar-nav--search-disabled" id="td-section-nav">
+    <ul class="td-sidebar-nav__section pe-md-3 ul-0">
+      <li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blog-li">
+  <a href="/v/v1.10.0/blog/" title="INDIGO IAM Blog" class="align-left ps-0 td-sidebar-link td-sidebar-link__section tree-root" id="m-vv1100blog"><span class="">Blog</span></a>
+  <ul class="ul-1">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child" id="m-vv1100blognews-li">
+  <a href="/v/v1.10.0/blog/news/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blognews"><span class="">News</span></a>
+  <ul class="ul-2 foldable">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20210907new-iam-website-li">
+  <a href="/v/v1.10.0/blog/2021/09/07/new-iam-website/" title="New IAM website!" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20210907new-iam-website"><span class="">Announcing the new IAM website</span></a>
+</li>
+  </ul>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
+  <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
+  <ul class="ul-2 foldable">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child active-path" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 active td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="td-sidebar-nav-active-item">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+  <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
+  <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20231030iam-v183-li">
+  <a href="/v/v1.10.0/blog/2023/10/30/iam-v1.8.3/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20231030iam-v183"><span class="">IAM v1.8.3</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20230605iam-v182-li">
+  <a href="/v/v1.10.0/blog/2023/06/05/iam-v1.8.2/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20230605iam-v182"><span class="">IAM v1.8.2</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20230228iam-v181-li">
+  <a href="/v/v1.10.0/blog/2023/02/28/iam-v1.8.1/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20230228iam-v181"><span class="">IAM v1.8.1</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20220909iam-v180-li">
+  <a href="/v/v1.10.0/blog/2022/09/09/iam-v1.8.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20220909iam-v180"><span class="">IAM v1.8.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20211203iam-v172-li">
+  <a href="/v/v1.10.0/blog/2021/12/03/iam-v1.7.2/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20211203iam-v172"><span class="">IAM v1.7.2</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20210913iam-v171-li">
+  <a href="/v/v1.10.0/blog/2021/09/13/iam-v1.7.1/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20210913iam-v171"><span class="">IAM v1.7.1</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20210907iam-v170-li">
+  <a href="/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20210907iam-v170"><span class="">IAM v1.7.0</span></a>
+</li>
+  </ul>
+</li>
+  </ul>
+</li>
+    </ul>
+  </nav>
+</div>
+
+          </aside>
+          <aside class="d-none d-xl-block col-xl-2 td-sidebar-toc d-print-none">
+            <div class="td-page-meta ms-2 pb-1 pt-2 mb-0">
+<a href="https://github.com/indigo-iam/iam-website/tree/v1.10.0/content/en/blog/releases/iam-1_10_0.md" class="td-page-meta--view td-page-meta__view" target="_blank" rel="noopener"><i class="fa-solid fa-file-lines fa-fw"></i> View page source</a>
+  <a href="https://github.com/indigo-iam/iam-website/edit/v1.10.0/content/en/blog/releases/iam-1_10_0.md" class="td-page-meta--edit td-page-meta__edit" target="_blank" rel="noopener"><i class="fa-solid fa-pen-to-square fa-fw"></i> Edit this page</a>
+  <a href="https://github.com/indigo-iam/iam-website/new/v1.10.0/content/en/blog/releases?filename=change-me.md&amp;value=---%0Atitle%3A&#43;%22Long&#43;Page&#43;Title%22%0AlinkTitle%3A&#43;%22Short&#43;Nav&#43;Title%22%0Aweight%3A&#43;100%0Adescription%3A&#43;%3E-%0A&#43;&#43;&#43;&#43;&#43;Page&#43;description&#43;for&#43;heading&#43;and&#43;indexes.%0A---%0A%0A%23%23&#43;Heading%0A%0AEdit&#43;this&#43;template&#43;to&#43;create&#43;your&#43;new&#43;page.%0A%0A%2A&#43;Give&#43;it&#43;a&#43;good&#43;name%2C&#43;ending&#43;in&#43;%60.md%60&#43;-&#43;e.g.&#43;%60getting-started.md%60%0A%2A&#43;Edit&#43;the&#43;%22front&#43;matter%22&#43;section&#43;at&#43;the&#43;top&#43;of&#43;the&#43;page&#43;%28weight&#43;controls&#43;how&#43;its&#43;ordered&#43;amongst&#43;other&#43;pages&#43;in&#43;the&#43;same&#43;directory%3B&#43;lowest&#43;number&#43;first%29.%0A%2A&#43;Add&#43;a&#43;good&#43;commit&#43;message&#43;at&#43;the&#43;bottom&#43;of&#43;the&#43;page&#43;%28%3C80&#43;characters%3B&#43;use&#43;the&#43;extended&#43;description&#43;field&#43;for&#43;more&#43;detail%29.%0A%2A&#43;Create&#43;a&#43;new&#43;branch&#43;so&#43;you&#43;can&#43;preview&#43;your&#43;new&#43;file&#43;and&#43;request&#43;a&#43;review&#43;via&#43;Pull&#43;Request.%0A" class="td-page-meta--child td-page-meta__child" target="_blank" rel="noopener"><i class="fa-solid fa-pen-to-square fa-fw"></i> Create child page</a>
+  <a href="https://github.com/indigo-iam/iam-website/issues/new?title=IAM%20v1.10.0" class="td-page-meta--issue td-page-meta__issue" target="_blank" rel="noopener"><i class="fa-solid fa-list-check fa-fw"></i> Create documentation issue</a>
+  <a href="https://github.com/indigo-iam/iam/issues/new" class="td-page-meta--project td-page-meta__project-issue" target="_blank" rel="noopener"><i class="fa-solid fa-list-check fa-fw"></i> Create project issue</a>
+  <a id="print" href="/v/v1.10.0/blog/releases/_print/"><i class="fa-solid fa-print fa-fw"></i> Print entire section</a>
+
+</div>
+
+            
+            
+
+          </aside>
+          <main class="col-12 col-md-9 col-xl-8 ps-md-5 pe-md-4" role="main">
+            
+<div class="td-content">
+	<h1>IAM v1.10.0</h1>
+	<div class="lead">The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)</div>
+	<div class="td-byline mb-4">
+		By <b>IAM development team</b> |
+		<time datetime="2024-08-07" class="text-body-secondary">Wednesday, August 07, 2024</time>
+	</div>
+	<header class="article-meta">
+		
+</header>
+	<p>The IAM development team is pleased to announce the release of INDIGO IAM v1.10.0.</p>
+<p>This release provides bug fixes and enhancements, as can be seen in the <a href="https://github.com/indigo-iam/iam/releases/tag/v1.10.0">release notes</a>.</p>
+<p>The major highlights include:</p>
+<ul>
+<li>E-mail notification for AUP reminder/expiration, account suspension/restoration and client disabled/enabled events</li>
+<li>Add a statistical endpoint which shows the number of IAM users</li>
+<li>Allow for a definition of a set of default groups, automatically linked to newly registered users</li>
+<li>Mandate the usage of a stronger user password (during the password reset step)</li>
+<li>Allow to set a property which disables any kind of IAM cache</li>
+</ul>
+<p>As usual, the IAM docker image can be obtained from <a href="https://hub.docker.com/r/indigoiam/iam-login-service/tags">DockerHub</a>.</p>
+
+	<ul class="list-unstyled d-flex justify-content-between align-items-center mb-0 pt-5">
+  <li>
+    <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" aria-label="Previous - IAM v1.9.0" class="btn btn-primary"><span class="me-1">←</span>Previous</a>
+  </li>
+  <li>
+    <a class="btn btn-primary disabled">Next<span class="ms-1">→</span></a>
+  </li>
+</ul>
+
+	<div class="td-page-meta__lastmod">
+  Last modified August 12, 2024: <a href="https://github.com/indigo-iam/iam-website/commit/84265ac53e7ac88b72dc6c1aaa5fa509fb4add99">Add blog for IAM v1.10.0 (84265ac)</a>
+</div>
+</div>
+
+
+          </main>
+        </div>
+      </div>
+      <footer class="td-footer row d-print-none">
+  <div class="container-fluid">
+    <div class="row mx-md-2">
+      <div class="td-footer__left col-6 col-sm-4 order-sm-1">
+        
+      </div><div class="td-footer__right col-6 col-sm-4 order-sm-3">
+        <ul class="td-footer__links-list">
+  
+  <li class="td-footer__links-item" data-bs-toggle="tooltip" title="GitHub" aria-label="GitHub">
+    <a target="_blank" rel="noopener" href="https://github.com/indigo-iam/iam" aria-label="GitHub">
+      <i class="fab fa-github"></i>
+    </a>
+  </li>
+  
+  <li class="td-footer__links-item" data-bs-toggle="tooltip" title="Slack" aria-label="Slack">
+    <a target="_blank" rel="noopener" href="https://indigo-iam.slack.com" aria-label="Slack">
+      <i class="fab fa-slack"></i>
+    </a>
+  </li>
+  
+</ul>
+
+      </div><div class="td-footer__center col-12 col-sm-4 py-2 order-sm-2">
+        <span class="td-footer__copyright">&copy;
+    2024
+    <span class="td-footer__authors">INFN</span></span><span class="td-footer__all_rights_reserved">All Rights Reserved</span>
+      </div>
+    </div>
+  </div>
+</footer>
+
+    </div>
+    <script src="/v/v1.10.0/js/main.min.dc2c0119076a0df855e55a8044ce0de74b7b9033c20e853e22d7ec7e9bdde965.js" integrity="sha256-3CwBGQdqDfhV5VqARM4N50t7kDPCDoU&#43;Itfsfpvd6WU=" crossorigin="anonymous"></script>
+<script defer src="/v/v1.10.0/js/click-to-copy.min.73478a7d4807698aed7e355eb23f9890ca18fea3158604c8471746d046702bad.js" integrity="sha256-c0eKfUgHaYrtfjVesj&#43;YkMoY/qMVhgTIRxdG0EZwK60=" crossorigin="anonymous"></script>
+<script src='/v/v1.10.0/js/tabpane-persist.js'></script>
+
+  </body>
+</html>
\ No newline at end of file
diff --git a/v/v1.10.0/blog/_print/index.html b/v/v1.10.0/blog/_print/index.html
index ad2af7329..893d4dd19 100644
--- a/v/v1.10.0/blog/_print/index.html
+++ b/v/v1.10.0/blog/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -187,6 +187,16 @@ <h1 class="title">INDIGO IAM Blog</h1>
     
 	
 
+    <li><a href="#pg-3022441b6e4975a0373f6e0856cd8298">IAM v1.10.0</a></li>
+
+
+
+    
+  
+    
+    
+	
+
     <li><a href="#pg-cad55f2d7afb4905608559c78f7ce89e">IAM v1.9.0</a></li>
 
 
@@ -411,6 +421,44 @@ <h1 id="pg-fbc771f2981eed29c0bc016b2d68a41a">Releases</h1>
   
 
 <div class="td-content" style="">
+    <h1 id="pg-3022441b6e4975a0373f6e0856cd8298">IAM v1.10.0</h1>
+	<div class="lead">The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)</div>
+	<div class="td-byline mb-4">
+		By <b>IAM development team</b> |
+        
+		<time datetime="2024-08-07" class="text-body-secondary">Wednesday, August 07, 2024</time>
+        
+	</div>
+	<p>The IAM development team is pleased to announce the release of INDIGO IAM v1.10.0.</p>
+<p>This release provides bug fixes and enhancements, as can be seen in the <a href="https://github.com/indigo-iam/iam/releases/tag/v1.10.0">release notes</a>.</p>
+<p>The major highlights include:</p>
+<ul>
+<li>E-mail notification for AUP reminder/expiration, account suspension/restoration and client disabled/enabled events</li>
+<li>Add a statistical endpoint which shows the number of IAM users</li>
+<li>Allow for a definition of a set of default groups, automatically linked to newly registered users</li>
+<li>Mandate the usage of a stronger user password (during the password reset step)</li>
+<li>Allow to set a property which disables any kind of IAM cache</li>
+</ul>
+<p>As usual, the IAM docker image can be obtained from <a href="https://hub.docker.com/r/indigoiam/iam-login-service/tags">DockerHub</a>.</p>
+
+</div>
+
+
+
+
+
+    
+	
+  
+    
+    
+	
+    
+
+
+  
+
+<div class="td-content" style="page-break-before: always">
     <h1 id="pg-cad55f2d7afb4905608559c78f7ce89e">IAM v1.9.0</h1>
 	<div class="lead">The v1.9.0 release focuses on better management of the Virtual Organization (VO)</div>
 	<div class="td-byline mb-4">
diff --git a/v/v1.10.0/blog/index.html b/v/v1.10.0/blog/index.html
index fbf33978b..0b4188568 100644
--- a/v/v1.10.0/blog/index.html
+++ b/v/v1.10.0/blog/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -137,7 +137,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
@@ -185,6 +187,25 @@
 <div class="td-blog-posts">
   <div class="h2">Posts in 2024</div>
     <ul class="td-blog-posts-list">
+      <li class="td-blog-posts-list__item">
+        <div class="td-blog-posts-list__body">
+          <h5 class="mt-0 mb-1"><a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/">IAM v1.10.0</a></h5>
+          <p class="mb-2 mb-md-3"><small class="text-body-secondary">Wednesday, August 07, 2024 in Releases</small></p>
+          <header class="article-meta">
+            
+</header>
+          
+
+
+
+
+<p class="pt-0 mt-0">The IAM development team is pleased to announce the release of INDIGO IAM v1.10.0.
+This release provides bug fixes and enhancements, as can be seen in the release notes.
+The major highlights include:
+E-mail notification for AUP reminder/expiration, …</p>
+          <p class="pt-0"><a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" aria-label="Read more - IAM v1.10.0">Read more</a></p>
+        </div>
+      </li>
       <li class="td-blog-posts-list__item">
         <div class="td-blog-posts-list__body">
           <h5 class="mt-0 mb-1"><a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/">IAM v1.9.0</a></h5>
@@ -359,28 +380,31 @@ <h5 class="mt-0 mb-1"><a href="/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/">IAM v1.7.
           <p class="pt-0"><a href="/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/" aria-label="Read more - IAM v1.7.0">Read more</a></p>
         </div>
       </li>
-      <li class="td-blog-posts-list__item">
-        <div class="td-blog-posts-list__body">
-          <h5 class="mt-0 mb-1"><a href="/v/v1.10.0/blog/2021/09/07/new-iam-website/">New IAM website!</a></h5>
-          <p class="mb-2 mb-md-3"><small class="text-body-secondary">Tuesday, September 07, 2021 in News</small></p>
-          <header class="article-meta">
-            
-</header>
-          
-
-
-
-
-<p class="pt-0 mt-0">The IAM website and documentation has moved, and if you&rsquo;re reading this you already know.
-The new IAM website is powered by Docsy, a Hugo theme for creating technical documentation sites, which is increasingly popular in Open Source projects. …</p>
-          <p class="pt-0"><a href="/v/v1.10.0/blog/2021/09/07/new-iam-website/" aria-label="Read more - Announcing the new IAM website">Read more</a></p>
-        </div>
-      </li>
       </ul>
     
 </div>
 <div class="td-blog-posts__pagination">
-  </div>
+  
+    <ul class="pagination pagination-default">
+      <li class="page-item disabled">
+        <a aria-disabled="true" aria-label="First" class="page-link" role="button" tabindex="-1"><span aria-hidden="true">&laquo;&laquo;</span></a>
+      </li>
+      <li class="page-item disabled">
+        <a aria-disabled="true" aria-label="Previous" class="page-link" role="button" tabindex="-1"><span aria-hidden="true">&laquo;</span></a>
+      </li>
+      <li class="page-item active">
+        <a aria-current="page" aria-label="Page 1" class="page-link" role="button">1</a>
+      </li>
+      <li class="page-item">
+        <a href="/v/v1.10.0/blog/page/2/" aria-label="Page 2" class="page-link" role="button">2</a>
+      </li>
+      <li class="page-item">
+        <a href="/v/v1.10.0/blog/page/2/" aria-label="Next" class="page-link" role="button"><span aria-hidden="true">&raquo;</span></a>
+      </li>
+      <li class="page-item">
+        <a href="/v/v1.10.0/blog/page/2/" aria-label="Last" class="page-link" role="button"><span aria-hidden="true">&raquo;&raquo;</span></a>
+      </li>
+    </ul></div>
 
           </main>
         </div>
diff --git a/v/v1.10.0/blog/news/_print/index.html b/v/v1.10.0/blog/news/_print/index.html
index 4b8f0de20..fd7b7757c 100644
--- a/v/v1.10.0/blog/news/_print/index.html
+++ b/v/v1.10.0/blog/news/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/blog/news/index.html b/v/v1.10.0/blog/news/index.html
index 96110ef17..0b18ee12b 100644
--- a/v/v1.10.0/blog/news/index.html
+++ b/v/v1.10.0/blog/news/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -137,7 +137,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
diff --git a/v/v1.10.0/blog/page/2/index.html b/v/v1.10.0/blog/page/2/index.html
new file mode 100644
index 000000000..372d95d46
--- /dev/null
+++ b/v/v1.10.0/blog/page/2/index.html
@@ -0,0 +1,273 @@
+<!doctype html>
+<html itemscope itemtype="http://schema.org/WebPage" lang="en" class="no-js">
+  <head>
+    <meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
+<link rel="alternate" type="text/html" href="/v/v1.10.0/blog/_print/">
+<meta name="robots" content="index, follow">
+
+
+<link rel="shortcut icon" href="/v/v1.10.0/favicons/favicon.ico" >
+<link rel="apple-touch-icon" href="/v/v1.10.0/favicons/apple-touch-icon-180x180.png" sizes="180x180">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/favicon-16x16.png" sizes="16x16">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/favicon-32x32.png" sizes="32x32">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-36x36.png" sizes="36x36">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-48x48.png" sizes="48x48">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-72x72.png" sizes="72x72">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-96x96.png" sizes="96x96">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-144x144.png" sizes="144x144">
+<link rel="icon" type="image/png" href="/v/v1.10.0/favicons/android-192x192.png" sizes="192x192">
+
+<title>INDIGO IAM Blog | INDIGO IAM</title>
+<meta name="description" content="The INDIGO Identity and Access Management (IAM) Service">
+<meta property="og:title" content="INDIGO IAM Blog" />
+<meta property="og:description" content="The INDIGO Identity and Access Management (IAM) Service" />
+<meta property="og:type" content="website" />
+<meta property="og:url" content="/v/v1.10.0/blog/" />
+
+<meta itemprop="name" content="INDIGO IAM Blog">
+<meta itemprop="description" content="The INDIGO Identity and Access Management (IAM) Service"><meta name="twitter:card" content="summary"/><meta name="twitter:title" content="INDIGO IAM Blog"/>
+<meta name="twitter:description" content="The INDIGO Identity and Access Management (IAM) Service"/>
+
+
+
+
+<link rel="preload" href="/v/v1.10.0/scss/main.min.8b15a284065632327b8c02a701e1c2297b5d1c084085e061cb33bbd46e6313e8.css" as="style">
+<link href="/v/v1.10.0/scss/main.min.8b15a284065632327b8c02a701e1c2297b5d1c084085e061cb33bbd46e6313e8.css" rel="stylesheet" integrity="">
+
+<script
+  src="https://code.jquery.com/jquery-3.7.1.min.js"
+  integrity="sha512-v2CJ7UaYy4JwqLDIrZUI/4hqeoQieOmAZNXBeQyjo21dadnwR+8ZaIJVT8EE2iyI61OV8e6M8PP2/4hpQINQ/g=="
+  crossorigin="anonymous"></script>
+<script defer
+  src="https://unpkg.com/lunr@2.3.9/lunr.min.js"
+  integrity="sha384-203J0SNzyqHby3iU6hzvzltrWi/M41wOP5Gu+BiJMz5nwKykbkUx8Kp7iti0Lpli"
+  crossorigin="anonymous"></script>
+
+  </head>
+  <body class="td-section td-blog">
+    <header>
+      <nav class="td-navbar js-navbar-scroll" data-bs-theme="dark">
+<div class="container-fluid flex-column flex-md-row">
+  <a class="navbar-brand" href="/v/v1.10.0/"><span class="navbar-brand__logo navbar-logo"></span><span class="navbar-brand__name">INDIGO IAM</span></a>
+  <div class="td-navbar-nav-scroll ms-md-auto" id="main_navbar">
+    <ul class="navbar-nav">
+      <li class="nav-item">
+        <a class="nav-link" href="/v/v1.10.0/docs/"><span>Documentation</span></a>
+      </li>
+      <li class="nav-item">
+        <a class="nav-link active" href="/v/v1.10.0/blog/"><span>Blog</span></a>
+      </li>
+      <li class="nav-item dropdown d-none d-lg-block">
+        <div class="dropdown">
+  <a class="nav-link dropdown-toggle" href="#" role="button" data-bs-toggle="dropdown" aria-haspopup="true" aria-expanded="false">Releases</a>
+  <ul class="dropdown-menu">
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/current">v1.10.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/current">v1.9.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.4">v1.8.4</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.3">v1.8.3</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.2">v1.8.2</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.1">v1.8.1</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.8.0">v1.8.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.7.2">v1.7.2</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.7.1">v1.7.1</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/v/v1.7.0">v1.7.0</a></li>
+    <li><a class="dropdown-item" href="https://indigo-iam.github.io/docs/v/current/">older releases</a></li>
+    </ul>
+</div></li>
+      </ul>
+  </div>
+  <div class="d-none d-lg-block">
+    <div class="td-search td-search--offline">
+  <div class="td-search__icon"></div>
+  <input
+    type="search"
+    class="td-search__input form-control"
+    placeholder="Search this site…"
+    aria-label="Search this site…"
+    autocomplete="off"
+    
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
+    data-offline-search-base-href="/"
+    data-offline-search-max-results="10"
+  >
+</div>
+  </div>
+</div>
+</nav>
+    </header>
+    <div class="container-fluid td-outer">
+      <div class="td-main">
+        <div class="row flex-xl-nowrap">
+          <aside class="col-12 col-md-3 col-xl-2 td-sidebar d-print-none">
+            <div id="td-sidebar-menu" class="td-sidebar__inner">
+  <div id="content-mobile">
+  <form class="td-sidebar__search d-flex align-items-center">
+    <div class="td-search td-search--offline">
+  <div class="td-search__icon"></div>
+  <input
+    type="search"
+    class="td-search__input form-control"
+    placeholder="Search this site…"
+    aria-label="Search this site…"
+    autocomplete="off"
+    
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
+    data-offline-search-base-href="/"
+    data-offline-search-max-results="10"
+  >
+</div>
+    <button class="btn btn-link td-sidebar__toggle d-md-none p-0 ms-3 fas fa-bars" type="button" data-bs-toggle="collapse" data-bs-target="#td-section-nav" aria-controls="td-section-nav" aria-expanded="false" aria-label="Toggle section navigation">
+    </button>
+  </form>
+  </div>
+  <div id="content-desktop"></div>
+  <nav class="td-sidebar-nav collapse td-sidebar-nav--search-disabled" id="td-section-nav">
+    <ul class="td-sidebar-nav__section pe-md-3 ul-0">
+      <li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blog-li">
+  <a href="/v/v1.10.0/blog/" title="INDIGO IAM Blog" class="align-left ps-0 active td-sidebar-link td-sidebar-link__section tree-root" id="m-vv1100blog"><span class="td-sidebar-nav-active-item">Blog</span></a>
+  <ul class="ul-1">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child" id="m-vv1100blognews-li">
+  <a href="/v/v1.10.0/blog/news/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blognews"><span class="">News</span></a>
+  <ul class="ul-2 foldable">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20210907new-iam-website-li">
+  <a href="/v/v1.10.0/blog/2021/09/07/new-iam-website/" title="New IAM website!" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20210907new-iam-website"><span class="">Announcing the new IAM website</span></a>
+</li>
+  </ul>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child" id="m-vv1100blogreleases-li">
+  <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="">Releases</span></a>
+  <ul class="ul-2 foldable">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+  <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
+  <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20231030iam-v183-li">
+  <a href="/v/v1.10.0/blog/2023/10/30/iam-v1.8.3/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20231030iam-v183"><span class="">IAM v1.8.3</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20230605iam-v182-li">
+  <a href="/v/v1.10.0/blog/2023/06/05/iam-v1.8.2/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20230605iam-v182"><span class="">IAM v1.8.2</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20230228iam-v181-li">
+  <a href="/v/v1.10.0/blog/2023/02/28/iam-v1.8.1/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20230228iam-v181"><span class="">IAM v1.8.1</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20220909iam-v180-li">
+  <a href="/v/v1.10.0/blog/2022/09/09/iam-v1.8.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20220909iam-v180"><span class="">IAM v1.8.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20211203iam-v172-li">
+  <a href="/v/v1.10.0/blog/2021/12/03/iam-v1.7.2/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20211203iam-v172"><span class="">IAM v1.7.2</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20210913iam-v171-li">
+  <a href="/v/v1.10.0/blog/2021/09/13/iam-v1.7.1/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20210913iam-v171"><span class="">IAM v1.7.1</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20210907iam-v170-li">
+  <a href="/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20210907iam-v170"><span class="">IAM v1.7.0</span></a>
+</li>
+  </ul>
+</li>
+  </ul>
+</li>
+    </ul>
+  </nav>
+</div>
+
+          </aside>
+          <aside class="d-none d-xl-block col-xl-2 td-sidebar-toc d-print-none">
+            <div class="td-page-meta ms-2 pb-1 pt-2 mb-0">
+<a href="https://github.com/indigo-iam/iam-website/tree/v1.10.0/content/en/blog/_index.md" class="td-page-meta--view td-page-meta__view" target="_blank" rel="noopener"><i class="fa-solid fa-file-lines fa-fw"></i> View page source</a>
+  <a href="https://github.com/indigo-iam/iam-website/edit/v1.10.0/content/en/blog/_index.md" class="td-page-meta--edit td-page-meta__edit" target="_blank" rel="noopener"><i class="fa-solid fa-pen-to-square fa-fw"></i> Edit this page</a>
+  <a href="https://github.com/indigo-iam/iam-website/new/v1.10.0/content/en/blog?filename=change-me.md&amp;value=---%0Atitle%3A&#43;%22Long&#43;Page&#43;Title%22%0AlinkTitle%3A&#43;%22Short&#43;Nav&#43;Title%22%0Aweight%3A&#43;100%0Adescription%3A&#43;%3E-%0A&#43;&#43;&#43;&#43;&#43;Page&#43;description&#43;for&#43;heading&#43;and&#43;indexes.%0A---%0A%0A%23%23&#43;Heading%0A%0AEdit&#43;this&#43;template&#43;to&#43;create&#43;your&#43;new&#43;page.%0A%0A%2A&#43;Give&#43;it&#43;a&#43;good&#43;name%2C&#43;ending&#43;in&#43;%60.md%60&#43;-&#43;e.g.&#43;%60getting-started.md%60%0A%2A&#43;Edit&#43;the&#43;%22front&#43;matter%22&#43;section&#43;at&#43;the&#43;top&#43;of&#43;the&#43;page&#43;%28weight&#43;controls&#43;how&#43;its&#43;ordered&#43;amongst&#43;other&#43;pages&#43;in&#43;the&#43;same&#43;directory%3B&#43;lowest&#43;number&#43;first%29.%0A%2A&#43;Add&#43;a&#43;good&#43;commit&#43;message&#43;at&#43;the&#43;bottom&#43;of&#43;the&#43;page&#43;%28%3C80&#43;characters%3B&#43;use&#43;the&#43;extended&#43;description&#43;field&#43;for&#43;more&#43;detail%29.%0A%2A&#43;Create&#43;a&#43;new&#43;branch&#43;so&#43;you&#43;can&#43;preview&#43;your&#43;new&#43;file&#43;and&#43;request&#43;a&#43;review&#43;via&#43;Pull&#43;Request.%0A" class="td-page-meta--child td-page-meta__child" target="_blank" rel="noopener"><i class="fa-solid fa-pen-to-square fa-fw"></i> Create child page</a>
+  <a href="https://github.com/indigo-iam/iam-website/issues/new?title=INDIGO%20IAM%20Blog" class="td-page-meta--issue td-page-meta__issue" target="_blank" rel="noopener"><i class="fa-solid fa-list-check fa-fw"></i> Create documentation issue</a>
+  <a href="https://github.com/indigo-iam/iam/issues/new" class="td-page-meta--project td-page-meta__project-issue" target="_blank" rel="noopener"><i class="fa-solid fa-list-check fa-fw"></i> Create project issue</a>
+  <a id="print" href="/v/v1.10.0/blog/_print/"><i class="fa-solid fa-print fa-fw"></i> Print entire section</a>
+
+</div>
+
+            
+            
+
+          </aside>
+          <main class="col-12 col-md-9 col-xl-8 ps-md-5 pe-md-4" role="main">
+            
+<div class="td-blog-posts">
+  <div class="h2">Posts in 2021</div>
+    <ul class="td-blog-posts-list">
+      <li class="td-blog-posts-list__item">
+        <div class="td-blog-posts-list__body">
+          <h5 class="mt-0 mb-1"><a href="/v/v1.10.0/blog/2021/09/07/new-iam-website/">New IAM website!</a></h5>
+          <p class="mb-2 mb-md-3"><small class="text-body-secondary">Tuesday, September 07, 2021 in News</small></p>
+          <header class="article-meta">
+            
+</header>
+          
+
+
+
+
+<p class="pt-0 mt-0">The IAM website and documentation has moved, and if you&rsquo;re reading this you already know.
+The new IAM website is powered by Docsy, a Hugo theme for creating technical documentation sites, which is increasingly popular in Open Source projects. …</p>
+          <p class="pt-0"><a href="/v/v1.10.0/blog/2021/09/07/new-iam-website/" aria-label="Read more - Announcing the new IAM website">Read more</a></p>
+        </div>
+      </li>
+      </ul>
+    
+</div>
+<div class="td-blog-posts__pagination">
+  
+    <ul class="pagination pagination-default">
+      <li class="page-item">
+        <a href="/v/v1.10.0/blog/" aria-label="First" class="page-link" role="button"><span aria-hidden="true">&laquo;&laquo;</span></a>
+      </li>
+      <li class="page-item">
+        <a href="/v/v1.10.0/blog/" aria-label="Previous" class="page-link" role="button"><span aria-hidden="true">&laquo;</span></a>
+      </li>
+      <li class="page-item">
+        <a href="/v/v1.10.0/blog/" aria-label="Page 1" class="page-link" role="button">1</a>
+      </li>
+      <li class="page-item active">
+        <a aria-current="page" aria-label="Page 2" class="page-link" role="button">2</a>
+      </li>
+      <li class="page-item disabled">
+        <a aria-disabled="true" aria-label="Next" class="page-link" role="button" tabindex="-1"><span aria-hidden="true">&raquo;</span></a>
+      </li>
+      <li class="page-item disabled">
+        <a aria-disabled="true" aria-label="Last" class="page-link" role="button" tabindex="-1"><span aria-hidden="true">&raquo;&raquo;</span></a>
+      </li>
+    </ul></div>
+
+          </main>
+        </div>
+      </div>
+      <footer class="td-footer row d-print-none">
+  <div class="container-fluid">
+    <div class="row mx-md-2">
+      <div class="td-footer__left col-6 col-sm-4 order-sm-1">
+        
+      </div><div class="td-footer__right col-6 col-sm-4 order-sm-3">
+        <ul class="td-footer__links-list">
+  
+  <li class="td-footer__links-item" data-bs-toggle="tooltip" title="GitHub" aria-label="GitHub">
+    <a target="_blank" rel="noopener" href="https://github.com/indigo-iam/iam" aria-label="GitHub">
+      <i class="fab fa-github"></i>
+    </a>
+  </li>
+  
+  <li class="td-footer__links-item" data-bs-toggle="tooltip" title="Slack" aria-label="Slack">
+    <a target="_blank" rel="noopener" href="https://indigo-iam.slack.com" aria-label="Slack">
+      <i class="fab fa-slack"></i>
+    </a>
+  </li>
+  
+</ul>
+
+      </div><div class="td-footer__center col-12 col-sm-4 py-2 order-sm-2">
+        <span class="td-footer__copyright">&copy;
+    2024
+    <span class="td-footer__authors">INFN</span></span><span class="td-footer__all_rights_reserved">All Rights Reserved</span>
+      </div>
+    </div>
+  </div>
+</footer>
+
+    </div>
+    <script src="/v/v1.10.0/js/main.min.dc2c0119076a0df855e55a8044ce0de74b7b9033c20e853e22d7ec7e9bdde965.js" integrity="sha256-3CwBGQdqDfhV5VqARM4N50t7kDPCDoU&#43;Itfsfpvd6WU=" crossorigin="anonymous"></script>
+<script defer src="/v/v1.10.0/js/click-to-copy.min.73478a7d4807698aed7e355eb23f9890ca18fea3158604c8471746d046702bad.js" integrity="sha256-c0eKfUgHaYrtfjVesj&#43;YkMoY/qMVhgTIRxdG0EZwK60=" crossorigin="anonymous"></script>
+<script src='/v/v1.10.0/js/tabpane-persist.js'></script>
+
+  </body>
+</html>
\ No newline at end of file
diff --git a/v/v1.10.0/blog/releases/_print/index.html b/v/v1.10.0/blog/releases/_print/index.html
index ebe2e6ac0..149318c80 100644
--- a/v/v1.10.0/blog/releases/_print/index.html
+++ b/v/v1.10.0/blog/releases/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -139,6 +139,16 @@ <h1 class="title">Releases</h1>
     
 	
 
+    <li><a href="#pg-3022441b6e4975a0373f6e0856cd8298">IAM v1.10.0</a></li>
+
+
+
+    
+  
+    
+    
+	
+
     <li><a href="#pg-cad55f2d7afb4905608559c78f7ce89e">IAM v1.9.0</a></li>
 
 
@@ -253,6 +263,44 @@ <h1 class="title">Releases</h1>
   
 
 <div class="td-content" style="">
+    <h1 id="pg-3022441b6e4975a0373f6e0856cd8298">IAM v1.10.0</h1>
+	<div class="lead">The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)</div>
+	<div class="td-byline mb-4">
+		By <b>IAM development team</b> |
+        
+		<time datetime="2024-08-07" class="text-body-secondary">Wednesday, August 07, 2024</time>
+        
+	</div>
+	<p>The IAM development team is pleased to announce the release of INDIGO IAM v1.10.0.</p>
+<p>This release provides bug fixes and enhancements, as can be seen in the <a href="https://github.com/indigo-iam/iam/releases/tag/v1.10.0">release notes</a>.</p>
+<p>The major highlights include:</p>
+<ul>
+<li>E-mail notification for AUP reminder/expiration, account suspension/restoration and client disabled/enabled events</li>
+<li>Add a statistical endpoint which shows the number of IAM users</li>
+<li>Allow for a definition of a set of default groups, automatically linked to newly registered users</li>
+<li>Mandate the usage of a stronger user password (during the password reset step)</li>
+<li>Allow to set a property which disables any kind of IAM cache</li>
+</ul>
+<p>As usual, the IAM docker image can be obtained from <a href="https://hub.docker.com/r/indigoiam/iam-login-service/tags">DockerHub</a>.</p>
+
+</div>
+
+
+
+
+
+    
+	
+  
+    
+    
+	
+    
+
+
+  
+
+<div class="td-content" style="page-break-before: always">
     <h1 id="pg-cad55f2d7afb4905608559c78f7ce89e">IAM v1.9.0</h1>
 	<div class="lead">The v1.9.0 release focuses on better management of the Virtual Organization (VO)</div>
 	<div class="td-byline mb-4">
diff --git a/v/v1.10.0/blog/releases/index.html b/v/v1.10.0/blog/releases/index.html
index 3ec0800cb..626c8f6fb 100644
--- a/v/v1.10.0/blog/releases/index.html
+++ b/v/v1.10.0/blog/releases/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -137,7 +137,9 @@
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section with-child active-path" id="m-vv1100blogreleases-li">
   <a href="/v/v1.10.0/blog/releases/" class="align-left ps-0 active td-sidebar-link td-sidebar-link__section" id="m-vv1100blogreleases"><span class="td-sidebar-nav-active-item">Releases</span></a>
   <ul class="ul-2 foldable">
-    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
+    <li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240807iam-v1100-li">
+  <a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240807iam-v1100"><span class="">IAM v1.10.0</span></a>
+</li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240619iam-v190-li">
   <a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240619iam-v190"><span class="">IAM v1.9.0</span></a>
 </li><li class="td-sidebar-nav__section-title td-sidebar-nav__section without-child" id="m-vv1100blog20240325iam-v184-li">
   <a href="/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/" class="align-left ps-0 td-sidebar-link td-sidebar-link__page" id="m-vv1100blog20240325iam-v184"><span class="">IAM v1.8.4</span></a>
@@ -185,6 +187,25 @@
 <div class="td-blog-posts">
   <div class="h2">Posts in 2024</div>
     <ul class="td-blog-posts-list">
+      <li class="td-blog-posts-list__item">
+        <div class="td-blog-posts-list__body">
+          <h5 class="mt-0 mb-1"><a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/">IAM v1.10.0</a></h5>
+          <p class="mb-2 mb-md-3"><small class="text-body-secondary">Wednesday, August 07, 2024 in Releases</small></p>
+          <header class="article-meta">
+            
+</header>
+          
+
+
+
+
+<p class="pt-0 mt-0">The IAM development team is pleased to announce the release of INDIGO IAM v1.10.0.
+This release provides bug fixes and enhancements, as can be seen in the release notes.
+The major highlights include:
+E-mail notification for AUP reminder/expiration, …</p>
+          <p class="pt-0"><a href="/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/" aria-label="Read more - IAM v1.10.0">Read more</a></p>
+        </div>
+      </li>
       <li class="td-blog-posts-list__item">
         <div class="td-blog-posts-list__body">
           <h5 class="mt-0 mb-1"><a href="/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/">IAM v1.9.0</a></h5>
diff --git a/v/v1.10.0/docs/_print/index.html b/v/v1.10.0/docs/_print/index.html
index 5707617f0..d969cdcb2 100644
--- a/v/v1.10.0/docs/_print/index.html
+++ b/v/v1.10.0/docs/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/developer-guide/_print/index.html b/v/v1.10.0/docs/developer-guide/_print/index.html
index 00679ab27..2c009505c 100644
--- a/v/v1.10.0/docs/developer-guide/_print/index.html
+++ b/v/v1.10.0/docs/developer-guide/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/developer-guide/index.html b/v/v1.10.0/docs/developer-guide/index.html
index e605d5742..cbe3f00d8 100644
--- a/v/v1.10.0/docs/developer-guide/index.html
+++ b/v/v1.10.0/docs/developer-guide/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/developer-guide/specs/_print/index.html b/v/v1.10.0/docs/developer-guide/specs/_print/index.html
index 7ea56f6d6..30a47cf98 100644
--- a/v/v1.10.0/docs/developer-guide/specs/_print/index.html
+++ b/v/v1.10.0/docs/developer-guide/specs/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/developer-guide/specs/index.html b/v/v1.10.0/docs/developer-guide/specs/index.html
index 25b9955d7..c8d33e528 100644
--- a/v/v1.10.0/docs/developer-guide/specs/index.html
+++ b/v/v1.10.0/docs/developer-guide/specs/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/_print/index.html b/v/v1.10.0/docs/getting-started/_print/index.html
index 49bd10b91..f00e52b2c 100644
--- a/v/v1.10.0/docs/getting-started/_print/index.html
+++ b/v/v1.10.0/docs/getting-started/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/basic_setup/_print/index.html b/v/v1.10.0/docs/getting-started/basic_setup/_print/index.html
index 5212cc3e1..34c965c70 100644
--- a/v/v1.10.0/docs/getting-started/basic_setup/_print/index.html
+++ b/v/v1.10.0/docs/getting-started/basic_setup/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/basic_setup/index.html b/v/v1.10.0/docs/getting-started/basic_setup/index.html
index dfeb1023e..a63bbc21d 100644
--- a/v/v1.10.0/docs/getting-started/basic_setup/index.html
+++ b/v/v1.10.0/docs/getting-started/basic_setup/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/docker/_print/index.html b/v/v1.10.0/docs/getting-started/docker/_print/index.html
index 61f0a914f..2112d8aae 100644
--- a/v/v1.10.0/docs/getting-started/docker/_print/index.html
+++ b/v/v1.10.0/docs/getting-started/docker/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/docker/index.html b/v/v1.10.0/docs/getting-started/docker/index.html
index 68f0fb89d..3d63197ac 100644
--- a/v/v1.10.0/docs/getting-started/docker/index.html
+++ b/v/v1.10.0/docs/getting-started/docker/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/index.html b/v/v1.10.0/docs/getting-started/index.html
index 2454cf46a..d04bd3826 100644
--- a/v/v1.10.0/docs/getting-started/index.html
+++ b/v/v1.10.0/docs/getting-started/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/jwk/_print/index.html b/v/v1.10.0/docs/getting-started/jwk/_print/index.html
index c5f5dbc76..053a42dd6 100644
--- a/v/v1.10.0/docs/getting-started/jwk/_print/index.html
+++ b/v/v1.10.0/docs/getting-started/jwk/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/jwk/index.html b/v/v1.10.0/docs/getting-started/jwk/index.html
index 0f189331c..36f4ac9e3 100644
--- a/v/v1.10.0/docs/getting-started/jwk/index.html
+++ b/v/v1.10.0/docs/getting-started/jwk/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/mariadb/_print/index.html b/v/v1.10.0/docs/getting-started/mariadb/_print/index.html
index 663a63ad9..9a765603e 100644
--- a/v/v1.10.0/docs/getting-started/mariadb/_print/index.html
+++ b/v/v1.10.0/docs/getting-started/mariadb/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/mariadb/index.html b/v/v1.10.0/docs/getting-started/mariadb/index.html
index 91df31ca3..3532b5a8a 100644
--- a/v/v1.10.0/docs/getting-started/mariadb/index.html
+++ b/v/v1.10.0/docs/getting-started/mariadb/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/nginx/_print/index.html b/v/v1.10.0/docs/getting-started/nginx/_print/index.html
index 0e5c74850..e04b5e390 100644
--- a/v/v1.10.0/docs/getting-started/nginx/_print/index.html
+++ b/v/v1.10.0/docs/getting-started/nginx/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/nginx/index.html b/v/v1.10.0/docs/getting-started/nginx/index.html
index 1ff41df67..d1f9172f0 100644
--- a/v/v1.10.0/docs/getting-started/nginx/index.html
+++ b/v/v1.10.0/docs/getting-started/nginx/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/packages/_print/index.html b/v/v1.10.0/docs/getting-started/packages/_print/index.html
index 011f7c66b..0c720fcc0 100644
--- a/v/v1.10.0/docs/getting-started/packages/_print/index.html
+++ b/v/v1.10.0/docs/getting-started/packages/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/getting-started/packages/index.html b/v/v1.10.0/docs/getting-started/packages/index.html
index 0e27d79af..b25a9ae5d 100644
--- a/v/v1.10.0/docs/getting-started/packages/index.html
+++ b/v/v1.10.0/docs/getting-started/packages/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/index.html b/v/v1.10.0/docs/index.html
index cf098df25..76a95a2b2 100644
--- a/v/v1.10.0/docs/index.html
+++ b/v/v1.10.0/docs/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/overview/_print/index.html b/v/v1.10.0/docs/overview/_print/index.html
index 0735ecbd1..79a4d812c 100644
--- a/v/v1.10.0/docs/overview/_print/index.html
+++ b/v/v1.10.0/docs/overview/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/overview/index.html b/v/v1.10.0/docs/overview/index.html
index 583b8c436..d614cf9f2 100644
--- a/v/v1.10.0/docs/overview/index.html
+++ b/v/v1.10.0/docs/overview/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/_print/index.html b/v/v1.10.0/docs/reference/_print/index.html
index dd05e66d7..0433626bb 100644
--- a/v/v1.10.0/docs/reference/_print/index.html
+++ b/v/v1.10.0/docs/reference/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/_print/index.html b/v/v1.10.0/docs/reference/api/_print/index.html
index 21264b3a8..c33423dad 100644
--- a/v/v1.10.0/docs/reference/api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/account-api/_print/index.html b/v/v1.10.0/docs/reference/api/account-api/_print/index.html
index 3e51d5cda..10805ebbd 100644
--- a/v/v1.10.0/docs/reference/api/account-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/account-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/account-api/index.html b/v/v1.10.0/docs/reference/api/account-api/index.html
index 581770033..e26745f31 100644
--- a/v/v1.10.0/docs/reference/api/account-api/index.html
+++ b/v/v1.10.0/docs/reference/api/account-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/aup-api/_print/index.html b/v/v1.10.0/docs/reference/api/aup-api/_print/index.html
index ff1c9f09e..695e6aa3f 100644
--- a/v/v1.10.0/docs/reference/api/aup-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/aup-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/aup-api/index.html b/v/v1.10.0/docs/reference/api/aup-api/index.html
index 8ad74bb1f..04f19ee9b 100644
--- a/v/v1.10.0/docs/reference/api/aup-api/index.html
+++ b/v/v1.10.0/docs/reference/api/aup-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/aup-sign-api/_print/index.html b/v/v1.10.0/docs/reference/api/aup-sign-api/_print/index.html
index e7e229b9e..864e39b32 100644
--- a/v/v1.10.0/docs/reference/api/aup-sign-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/aup-sign-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/aup-sign-api/index.html b/v/v1.10.0/docs/reference/api/aup-sign-api/index.html
index e29cf3204..52426e05c 100644
--- a/v/v1.10.0/docs/reference/api/aup-sign-api/index.html
+++ b/v/v1.10.0/docs/reference/api/aup-sign-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/group-requests/_print/index.html b/v/v1.10.0/docs/reference/api/group-requests/_print/index.html
index b5872007c..151101705 100644
--- a/v/v1.10.0/docs/reference/api/group-requests/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/group-requests/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/group-requests/index.html b/v/v1.10.0/docs/reference/api/group-requests/index.html
index fbc1e7267..08331e981 100644
--- a/v/v1.10.0/docs/reference/api/group-requests/index.html
+++ b/v/v1.10.0/docs/reference/api/group-requests/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/health_endpoints/_print/index.html b/v/v1.10.0/docs/reference/api/health_endpoints/_print/index.html
index b31d3dbdc..0c169054c 100644
--- a/v/v1.10.0/docs/reference/api/health_endpoints/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/health_endpoints/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/health_endpoints/index.html b/v/v1.10.0/docs/reference/api/health_endpoints/index.html
index e50e4242a..ed54b8469 100644
--- a/v/v1.10.0/docs/reference/api/health_endpoints/index.html
+++ b/v/v1.10.0/docs/reference/api/health_endpoints/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/index.html b/v/v1.10.0/docs/reference/api/index.html
index 13f9244b6..1b43c99ad 100644
--- a/v/v1.10.0/docs/reference/api/index.html
+++ b/v/v1.10.0/docs/reference/api/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oauth-token-exchange/_print/index.html b/v/v1.10.0/docs/reference/api/oauth-token-exchange/_print/index.html
index 656f90dfd..5943d261a 100644
--- a/v/v1.10.0/docs/reference/api/oauth-token-exchange/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/oauth-token-exchange/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oauth-token-exchange/index.html b/v/v1.10.0/docs/reference/api/oauth-token-exchange/index.html
index a7c9f7cd4..d6ee4ab64 100644
--- a/v/v1.10.0/docs/reference/api/oauth-token-exchange/index.html
+++ b/v/v1.10.0/docs/reference/api/oauth-token-exchange/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oauth-token-introspection/_print/index.html b/v/v1.10.0/docs/reference/api/oauth-token-introspection/_print/index.html
index 0bc873f02..3f0036a5e 100644
--- a/v/v1.10.0/docs/reference/api/oauth-token-introspection/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/oauth-token-introspection/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oauth-token-introspection/index.html b/v/v1.10.0/docs/reference/api/oauth-token-introspection/index.html
index 66f0dfb7c..6864a32cb 100644
--- a/v/v1.10.0/docs/reference/api/oauth-token-introspection/index.html
+++ b/v/v1.10.0/docs/reference/api/oauth-token-introspection/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oidc-client-management/_print/index.html b/v/v1.10.0/docs/reference/api/oidc-client-management/_print/index.html
index 1483af1ab..238e58b38 100644
--- a/v/v1.10.0/docs/reference/api/oidc-client-management/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/oidc-client-management/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oidc-client-management/index.html b/v/v1.10.0/docs/reference/api/oidc-client-management/index.html
index 4343fbc2d..10ece37fe 100644
--- a/v/v1.10.0/docs/reference/api/oidc-client-management/index.html
+++ b/v/v1.10.0/docs/reference/api/oidc-client-management/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oidc-client-registration/_print/index.html b/v/v1.10.0/docs/reference/api/oidc-client-registration/_print/index.html
index ff2fc3bab..f3e0acf3f 100644
--- a/v/v1.10.0/docs/reference/api/oidc-client-registration/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/oidc-client-registration/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/oidc-client-registration/index.html b/v/v1.10.0/docs/reference/api/oidc-client-registration/index.html
index 92d700c22..e299c0961 100644
--- a/v/v1.10.0/docs/reference/api/oidc-client-registration/index.html
+++ b/v/v1.10.0/docs/reference/api/oidc-client-registration/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/proxycert-api/_print/index.html b/v/v1.10.0/docs/reference/api/proxycert-api/_print/index.html
index 8ddbd7cfa..a7f71dd65 100644
--- a/v/v1.10.0/docs/reference/api/proxycert-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/proxycert-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/proxycert-api/index.html b/v/v1.10.0/docs/reference/api/proxycert-api/index.html
index 13c637ac6..34169e19e 100644
--- a/v/v1.10.0/docs/reference/api/proxycert-api/index.html
+++ b/v/v1.10.0/docs/reference/api/proxycert-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/scim-api/_print/index.html b/v/v1.10.0/docs/reference/api/scim-api/_print/index.html
index 7795c1775..60959cdc9 100644
--- a/v/v1.10.0/docs/reference/api/scim-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/scim-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/scim-api/index.html b/v/v1.10.0/docs/reference/api/scim-api/index.html
index 0418e8b15..090d21562 100644
--- a/v/v1.10.0/docs/reference/api/scim-api/index.html
+++ b/v/v1.10.0/docs/reference/api/scim-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/scope-policy-api/_print/index.html b/v/v1.10.0/docs/reference/api/scope-policy-api/_print/index.html
index 82fc75849..331501d06 100644
--- a/v/v1.10.0/docs/reference/api/scope-policy-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/scope-policy-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/scope-policy-api/index.html b/v/v1.10.0/docs/reference/api/scope-policy-api/index.html
index f3c572101..729320b07 100644
--- a/v/v1.10.0/docs/reference/api/scope-policy-api/index.html
+++ b/v/v1.10.0/docs/reference/api/scope-policy-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/token-exchange-policy-api/_print/index.html b/v/v1.10.0/docs/reference/api/token-exchange-policy-api/_print/index.html
index 0c652470b..2e40687cd 100644
--- a/v/v1.10.0/docs/reference/api/token-exchange-policy-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/token-exchange-policy-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/token-exchange-policy-api/index.html b/v/v1.10.0/docs/reference/api/token-exchange-policy-api/index.html
index 00255d983..431240e56 100644
--- a/v/v1.10.0/docs/reference/api/token-exchange-policy-api/index.html
+++ b/v/v1.10.0/docs/reference/api/token-exchange-policy-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/tokens-api/_print/index.html b/v/v1.10.0/docs/reference/api/tokens-api/_print/index.html
index 950df1000..73b5b3391 100644
--- a/v/v1.10.0/docs/reference/api/tokens-api/_print/index.html
+++ b/v/v1.10.0/docs/reference/api/tokens-api/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/api/tokens-api/index.html b/v/v1.10.0/docs/reference/api/tokens-api/index.html
index 981ddbacc..49c0f181d 100644
--- a/v/v1.10.0/docs/reference/api/tokens-api/index.html
+++ b/v/v1.10.0/docs/reference/api/tokens-api/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/_print/index.html b/v/v1.10.0/docs/reference/configuration/_print/index.html
index fe1c8a7ce..99cfeff2d 100644
--- a/v/v1.10.0/docs/reference/configuration/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/client-registration/_print/index.html b/v/v1.10.0/docs/reference/configuration/client-registration/_print/index.html
index 67539e83e..2de221ca8 100644
--- a/v/v1.10.0/docs/reference/configuration/client-registration/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/client-registration/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/client-registration/index.html b/v/v1.10.0/docs/reference/configuration/client-registration/index.html
index 319087513..74f27e13b 100644
--- a/v/v1.10.0/docs/reference/configuration/client-registration/index.html
+++ b/v/v1.10.0/docs/reference/configuration/client-registration/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/_print/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/_print/index.html
index 427d812b4..f64e46b33 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/index.html
index 1ea528e32..57e54e5f3 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/_print/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/_print/index.html
index 2224b6756..d98d942e9 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/index.html
index 6cda00c6d..b3364a8c4 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/saml/_print/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/saml/_print/index.html
index 1ea3b8eb1..f533b3884 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/saml/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/saml/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/saml/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/saml/index.html
index b0cc26ba9..3305eb6ca 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/saml/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/saml/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/x509/_print/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/x509/_print/index.html
index 1a9d30d7f..a7e582fa8 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/x509/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/x509/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/external-authentication/x509/index.html b/v/v1.10.0/docs/reference/configuration/external-authentication/x509/index.html
index ee5652eca..e07e23eec 100644
--- a/v/v1.10.0/docs/reference/configuration/external-authentication/x509/index.html
+++ b/v/v1.10.0/docs/reference/configuration/external-authentication/x509/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/index.html b/v/v1.10.0/docs/reference/configuration/index.html
index eae75e8fa..7bdaa3680 100644
--- a/v/v1.10.0/docs/reference/configuration/index.html
+++ b/v/v1.10.0/docs/reference/configuration/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/jwk/_print/index.html b/v/v1.10.0/docs/reference/configuration/jwk/_print/index.html
index b2c64bb56..69725b17c 100644
--- a/v/v1.10.0/docs/reference/configuration/jwk/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/jwk/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/jwk/index.html b/v/v1.10.0/docs/reference/configuration/jwk/index.html
index 37b3db066..067123935 100644
--- a/v/v1.10.0/docs/reference/configuration/jwk/index.html
+++ b/v/v1.10.0/docs/reference/configuration/jwk/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/jwt-profiles/_print/index.html b/v/v1.10.0/docs/reference/configuration/jwt-profiles/_print/index.html
index 018fc4b02..14cdf8eee 100644
--- a/v/v1.10.0/docs/reference/configuration/jwt-profiles/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/jwt-profiles/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/jwt-profiles/index.html b/v/v1.10.0/docs/reference/configuration/jwt-profiles/index.html
index 26cd5fadc..c90ec9380 100644
--- a/v/v1.10.0/docs/reference/configuration/jwt-profiles/index.html
+++ b/v/v1.10.0/docs/reference/configuration/jwt-profiles/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/lifecycle/_print/index.html b/v/v1.10.0/docs/reference/configuration/lifecycle/_print/index.html
index 1222e0187..29f1484f0 100644
--- a/v/v1.10.0/docs/reference/configuration/lifecycle/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/lifecycle/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/lifecycle/index.html b/v/v1.10.0/docs/reference/configuration/lifecycle/index.html
index 448b6a3c7..911886148 100644
--- a/v/v1.10.0/docs/reference/configuration/lifecycle/index.html
+++ b/v/v1.10.0/docs/reference/configuration/lifecycle/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/local_authn/_print/index.html b/v/v1.10.0/docs/reference/configuration/local_authn/_print/index.html
index 40b2a397a..8ed91f996 100644
--- a/v/v1.10.0/docs/reference/configuration/local_authn/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/local_authn/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/local_authn/index.html b/v/v1.10.0/docs/reference/configuration/local_authn/index.html
index d1d41ef3e..4b0416e81 100644
--- a/v/v1.10.0/docs/reference/configuration/local_authn/index.html
+++ b/v/v1.10.0/docs/reference/configuration/local_authn/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/rcauth/_print/index.html b/v/v1.10.0/docs/reference/configuration/rcauth/_print/index.html
index 40052ff48..4953379cf 100644
--- a/v/v1.10.0/docs/reference/configuration/rcauth/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/rcauth/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/rcauth/index.html b/v/v1.10.0/docs/reference/configuration/rcauth/index.html
index 30200fe9a..dea8bb72c 100644
--- a/v/v1.10.0/docs/reference/configuration/rcauth/index.html
+++ b/v/v1.10.0/docs/reference/configuration/rcauth/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/registration/_print/index.html b/v/v1.10.0/docs/reference/configuration/registration/_print/index.html
index 99c52cd15..537417162 100644
--- a/v/v1.10.0/docs/reference/configuration/registration/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/registration/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/registration/index.html b/v/v1.10.0/docs/reference/configuration/registration/index.html
index 9a31d9289..03903d64f 100644
--- a/v/v1.10.0/docs/reference/configuration/registration/index.html
+++ b/v/v1.10.0/docs/reference/configuration/registration/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/scim-response/_print/index.html b/v/v1.10.0/docs/reference/configuration/scim-response/_print/index.html
index 85e431fa7..b83cba216 100644
--- a/v/v1.10.0/docs/reference/configuration/scim-response/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/scim-response/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/scim-response/index.html b/v/v1.10.0/docs/reference/configuration/scim-response/index.html
index 0f66ceb34..f643283ba 100644
--- a/v/v1.10.0/docs/reference/configuration/scim-response/index.html
+++ b/v/v1.10.0/docs/reference/configuration/scim-response/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/system-scopes/_print/index.html b/v/v1.10.0/docs/reference/configuration/system-scopes/_print/index.html
index 3cba8d53f..5b0aa9ba6 100644
--- a/v/v1.10.0/docs/reference/configuration/system-scopes/_print/index.html
+++ b/v/v1.10.0/docs/reference/configuration/system-scopes/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/configuration/system-scopes/index.html b/v/v1.10.0/docs/reference/configuration/system-scopes/index.html
index bbe84d458..ae9796a33 100644
--- a/v/v1.10.0/docs/reference/configuration/system-scopes/index.html
+++ b/v/v1.10.0/docs/reference/configuration/system-scopes/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/reference/index.html b/v/v1.10.0/docs/reference/index.html
index 347144c68..acef8b41b 100644
--- a/v/v1.10.0/docs/reference/index.html
+++ b/v/v1.10.0/docs/reference/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/_print/index.html b/v/v1.10.0/docs/tasks/_print/index.html
index 6ae537bbb..6c46c05e1 100644
--- a/v/v1.10.0/docs/tasks/_print/index.html
+++ b/v/v1.10.0/docs/tasks/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/_print/index.html b/v/v1.10.0/docs/tasks/administration/_print/index.html
index 5b122180b..96ba2ea7d 100644
--- a/v/v1.10.0/docs/tasks/administration/_print/index.html
+++ b/v/v1.10.0/docs/tasks/administration/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/aup-management/_print/index.html b/v/v1.10.0/docs/tasks/administration/aup-management/_print/index.html
index 58708737b..7806182c9 100644
--- a/v/v1.10.0/docs/tasks/administration/aup-management/_print/index.html
+++ b/v/v1.10.0/docs/tasks/administration/aup-management/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/aup-management/index.html b/v/v1.10.0/docs/tasks/administration/aup-management/index.html
index 435cbe38c..8ab991968 100644
--- a/v/v1.10.0/docs/tasks/administration/aup-management/index.html
+++ b/v/v1.10.0/docs/tasks/administration/aup-management/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/client-status-change/_print/index.html b/v/v1.10.0/docs/tasks/administration/client-status-change/_print/index.html
index 062cf0570..91a0e5d80 100644
--- a/v/v1.10.0/docs/tasks/administration/client-status-change/_print/index.html
+++ b/v/v1.10.0/docs/tasks/administration/client-status-change/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/client-status-change/index.html b/v/v1.10.0/docs/tasks/administration/client-status-change/index.html
index 519634071..d330d5cc0 100644
--- a/v/v1.10.0/docs/tasks/administration/client-status-change/index.html
+++ b/v/v1.10.0/docs/tasks/administration/client-status-change/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/group-management/_print/index.html b/v/v1.10.0/docs/tasks/administration/group-management/_print/index.html
index f9ca98ade..ad4320b70 100644
--- a/v/v1.10.0/docs/tasks/administration/group-management/_print/index.html
+++ b/v/v1.10.0/docs/tasks/administration/group-management/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/group-management/index.html b/v/v1.10.0/docs/tasks/administration/group-management/index.html
index 3a387bb42..150d40141 100644
--- a/v/v1.10.0/docs/tasks/administration/group-management/index.html
+++ b/v/v1.10.0/docs/tasks/administration/group-management/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/index.html b/v/v1.10.0/docs/tasks/administration/index.html
index 7887ba217..8588ea3f5 100644
--- a/v/v1.10.0/docs/tasks/administration/index.html
+++ b/v/v1.10.0/docs/tasks/administration/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/user-management/_print/index.html b/v/v1.10.0/docs/tasks/administration/user-management/_print/index.html
index acf5f28a6..2c5805967 100644
--- a/v/v1.10.0/docs/tasks/administration/user-management/_print/index.html
+++ b/v/v1.10.0/docs/tasks/administration/user-management/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/administration/user-management/index.html b/v/v1.10.0/docs/tasks/administration/user-management/index.html
index 79db35a04..6b836a647 100644
--- a/v/v1.10.0/docs/tasks/administration/user-management/index.html
+++ b/v/v1.10.0/docs/tasks/administration/user-management/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/clientapp/_print/index.html b/v/v1.10.0/docs/tasks/clientapp/_print/index.html
index 1e8fe553a..011572e0d 100644
--- a/v/v1.10.0/docs/tasks/clientapp/_print/index.html
+++ b/v/v1.10.0/docs/tasks/clientapp/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/clientapp/index.html b/v/v1.10.0/docs/tasks/clientapp/index.html
index 9380d4b7b..3f1b2a068 100644
--- a/v/v1.10.0/docs/tasks/clientapp/index.html
+++ b/v/v1.10.0/docs/tasks/clientapp/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/_print/index.html b/v/v1.10.0/docs/tasks/deployment/_print/index.html
index 01e52be85..ab9f29fb6 100644
--- a/v/v1.10.0/docs/tasks/deployment/_print/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/audit-log/_print/index.html b/v/v1.10.0/docs/tasks/deployment/audit-log/_print/index.html
index e65e98b15..752c68440 100644
--- a/v/v1.10.0/docs/tasks/deployment/audit-log/_print/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/audit-log/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/audit-log/index.html b/v/v1.10.0/docs/tasks/deployment/audit-log/index.html
index f891ccde7..b7b599426 100644
--- a/v/v1.10.0/docs/tasks/deployment/audit-log/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/audit-log/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/backup_restore/_print/index.html b/v/v1.10.0/docs/tasks/deployment/backup_restore/_print/index.html
index 33ecc431e..7562c7cff 100644
--- a/v/v1.10.0/docs/tasks/deployment/backup_restore/_print/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/backup_restore/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/backup_restore/index.html b/v/v1.10.0/docs/tasks/deployment/backup_restore/index.html
index 45f16c13b..ba598334a 100644
--- a/v/v1.10.0/docs/tasks/deployment/backup_restore/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/backup_restore/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/ha/_print/index.html b/v/v1.10.0/docs/tasks/deployment/ha/_print/index.html
index c22b3acca..00397f10e 100644
--- a/v/v1.10.0/docs/tasks/deployment/ha/_print/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/ha/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/ha/index.html b/v/v1.10.0/docs/tasks/deployment/ha/index.html
index c5f981a71..19b79158c 100644
--- a/v/v1.10.0/docs/tasks/deployment/ha/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/ha/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/index.html b/v/v1.10.0/docs/tasks/deployment/index.html
index 547bc10c2..533ef8bed 100644
--- a/v/v1.10.0/docs/tasks/deployment/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/upgrade/_print/index.html b/v/v1.10.0/docs/tasks/deployment/upgrade/_print/index.html
index 56aec0d15..24b70efdc 100644
--- a/v/v1.10.0/docs/tasks/deployment/upgrade/_print/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/upgrade/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/upgrade/index.html b/v/v1.10.0/docs/tasks/deployment/upgrade/index.html
index 84f6e1880..c4a194ce2 100644
--- a/v/v1.10.0/docs/tasks/deployment/upgrade/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/upgrade/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/voms/_print/index.html b/v/v1.10.0/docs/tasks/deployment/voms/_print/index.html
index 29d678417..beeaa2485 100644
--- a/v/v1.10.0/docs/tasks/deployment/voms/_print/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/voms/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/voms/index.html b/v/v1.10.0/docs/tasks/deployment/voms/index.html
index 19d018a51..07eafb7be 100644
--- a/v/v1.10.0/docs/tasks/deployment/voms/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/voms/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/voms_importer/_print/index.html b/v/v1.10.0/docs/tasks/deployment/voms_importer/_print/index.html
index b446b7b4a..3648237bf 100644
--- a/v/v1.10.0/docs/tasks/deployment/voms_importer/_print/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/voms_importer/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/deployment/voms_importer/index.html b/v/v1.10.0/docs/tasks/deployment/voms_importer/index.html
index 03ac961f4..21ba4390d 100644
--- a/v/v1.10.0/docs/tasks/deployment/voms_importer/index.html
+++ b/v/v1.10.0/docs/tasks/deployment/voms_importer/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/index.html b/v/v1.10.0/docs/tasks/index.html
index 71a523d93..e2c30030c 100644
--- a/v/v1.10.0/docs/tasks/index.html
+++ b/v/v1.10.0/docs/tasks/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/_print/index.html b/v/v1.10.0/docs/tasks/user/_print/index.html
index 18645742e..7a46f415f 100644
--- a/v/v1.10.0/docs/tasks/user/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/_print/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/change-details/_print/index.html b/v/v1.10.0/docs/tasks/user/change-details/_print/index.html
index edb7100ae..a0d743742 100644
--- a/v/v1.10.0/docs/tasks/user/change-details/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/change-details/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/change-details/index.html b/v/v1.10.0/docs/tasks/user/change-details/index.html
index 027e85e5b..4ce579f91 100644
--- a/v/v1.10.0/docs/tasks/user/change-details/index.html
+++ b/v/v1.10.0/docs/tasks/user/change-details/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/change-password/_print/index.html b/v/v1.10.0/docs/tasks/user/change-password/_print/index.html
index 753896749..7b9f02c2d 100644
--- a/v/v1.10.0/docs/tasks/user/change-password/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/change-password/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/change-password/index.html b/v/v1.10.0/docs/tasks/user/change-password/index.html
index 32c584000..4f3526364 100644
--- a/v/v1.10.0/docs/tasks/user/change-password/index.html
+++ b/v/v1.10.0/docs/tasks/user/change-password/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/client-registration/_print/index.html b/v/v1.10.0/docs/tasks/user/client-registration/_print/index.html
index d9d4e7ce3..726b31b48 100644
--- a/v/v1.10.0/docs/tasks/user/client-registration/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/client-registration/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/client-registration/index.html b/v/v1.10.0/docs/tasks/user/client-registration/index.html
index 3a5011a86..98664431b 100644
--- a/v/v1.10.0/docs/tasks/user/client-registration/index.html
+++ b/v/v1.10.0/docs/tasks/user/client-registration/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/external-account-linking/_print/index.html b/v/v1.10.0/docs/tasks/user/external-account-linking/_print/index.html
index ddb737d11..3f70b37bb 100644
--- a/v/v1.10.0/docs/tasks/user/external-account-linking/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/external-account-linking/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/external-account-linking/index.html b/v/v1.10.0/docs/tasks/user/external-account-linking/index.html
index 01fd142f7..9e111b08f 100644
--- a/v/v1.10.0/docs/tasks/user/external-account-linking/index.html
+++ b/v/v1.10.0/docs/tasks/user/external-account-linking/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/getting-a-token/_print/index.html b/v/v1.10.0/docs/tasks/user/getting-a-token/_print/index.html
index 1febfff52..18733f0ea 100644
--- a/v/v1.10.0/docs/tasks/user/getting-a-token/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/getting-a-token/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/getting-a-token/index.html b/v/v1.10.0/docs/tasks/user/getting-a-token/index.html
index b0cd84608..d6d6eaf06 100644
--- a/v/v1.10.0/docs/tasks/user/getting-a-token/index.html
+++ b/v/v1.10.0/docs/tasks/user/getting-a-token/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/index.html b/v/v1.10.0/docs/tasks/user/index.html
index 9bb2341fd..6067c1c6e 100644
--- a/v/v1.10.0/docs/tasks/user/index.html
+++ b/v/v1.10.0/docs/tasks/user/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -116,7 +116,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/joining-a-collaboration/_print/index.html b/v/v1.10.0/docs/tasks/user/joining-a-collaboration/_print/index.html
index 3b69aeb98..ac26ec99b 100644
--- a/v/v1.10.0/docs/tasks/user/joining-a-collaboration/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/joining-a-collaboration/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/joining-a-collaboration/index.html b/v/v1.10.0/docs/tasks/user/joining-a-collaboration/index.html
index 069015f54..3f85677a3 100644
--- a/v/v1.10.0/docs/tasks/user/joining-a-collaboration/index.html
+++ b/v/v1.10.0/docs/tasks/user/joining-a-collaboration/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/jwt-authn/_print/index.html b/v/v1.10.0/docs/tasks/user/jwt-authn/_print/index.html
index e4d529ed6..2cbab1ec9 100644
--- a/v/v1.10.0/docs/tasks/user/jwt-authn/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/jwt-authn/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/jwt-authn/index.html b/v/v1.10.0/docs/tasks/user/jwt-authn/index.html
index 893e6c889..6fe5243d0 100644
--- a/v/v1.10.0/docs/tasks/user/jwt-authn/index.html
+++ b/v/v1.10.0/docs/tasks/user/jwt-authn/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/manage-active-tokens/_print/index.html b/v/v1.10.0/docs/tasks/user/manage-active-tokens/_print/index.html
index 1c88fd26a..bd463c49f 100644
--- a/v/v1.10.0/docs/tasks/user/manage-active-tokens/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/manage-active-tokens/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/manage-active-tokens/index.html b/v/v1.10.0/docs/tasks/user/manage-active-tokens/index.html
index a2770c9b2..bad79666b 100644
--- a/v/v1.10.0/docs/tasks/user/manage-active-tokens/index.html
+++ b/v/v1.10.0/docs/tasks/user/manage-active-tokens/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/manage-approved-sites/_print/index.html b/v/v1.10.0/docs/tasks/user/manage-approved-sites/_print/index.html
index 26db4b71c..fa85e7f8c 100644
--- a/v/v1.10.0/docs/tasks/user/manage-approved-sites/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/manage-approved-sites/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/manage-approved-sites/index.html b/v/v1.10.0/docs/tasks/user/manage-approved-sites/index.html
index 425283480..6932e81d0 100644
--- a/v/v1.10.0/docs/tasks/user/manage-approved-sites/index.html
+++ b/v/v1.10.0/docs/tasks/user/manage-approved-sites/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/manage-ssh-keys/_print/index.html b/v/v1.10.0/docs/tasks/user/manage-ssh-keys/_print/index.html
index 14e8fef94..d39a1c064 100644
--- a/v/v1.10.0/docs/tasks/user/manage-ssh-keys/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/manage-ssh-keys/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/manage-ssh-keys/index.html b/v/v1.10.0/docs/tasks/user/manage-ssh-keys/index.html
index b4429a530..ede976b62 100644
--- a/v/v1.10.0/docs/tasks/user/manage-ssh-keys/index.html
+++ b/v/v1.10.0/docs/tasks/user/manage-ssh-keys/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/reset-password/_print/index.html b/v/v1.10.0/docs/tasks/user/reset-password/_print/index.html
index 77259b469..f29caac24 100644
--- a/v/v1.10.0/docs/tasks/user/reset-password/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/reset-password/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/reset-password/index.html b/v/v1.10.0/docs/tasks/user/reset-password/index.html
index 2a9aae2f4..210e90ca9 100644
--- a/v/v1.10.0/docs/tasks/user/reset-password/index.html
+++ b/v/v1.10.0/docs/tasks/user/reset-password/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/resign-aup/_print/index.html b/v/v1.10.0/docs/tasks/user/resign-aup/_print/index.html
index cb69749a3..3ab53460d 100644
--- a/v/v1.10.0/docs/tasks/user/resign-aup/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/resign-aup/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/resign-aup/index.html b/v/v1.10.0/docs/tasks/user/resign-aup/index.html
index f71d39792..b00f48071 100644
--- a/v/v1.10.0/docs/tasks/user/resign-aup/index.html
+++ b/v/v1.10.0/docs/tasks/user/resign-aup/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/x509-linking/_print/index.html b/v/v1.10.0/docs/tasks/user/x509-linking/_print/index.html
index 250169f75..d63fcf14c 100644
--- a/v/v1.10.0/docs/tasks/user/x509-linking/_print/index.html
+++ b/v/v1.10.0/docs/tasks/user/x509-linking/_print/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/docs/tasks/user/x509-linking/index.html b/v/v1.10.0/docs/tasks/user/x509-linking/index.html
index 2f484d0d0..1b422981a 100644
--- a/v/v1.10.0/docs/tasks/user/x509-linking/index.html
+++ b/v/v1.10.0/docs/tasks/user/x509-linking/index.html
@@ -87,7 +87,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
@@ -112,7 +112,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/index.html b/v/v1.10.0/index.html
index 4ba350196..c845d62ee 100644
--- a/v/v1.10.0/index.html
+++ b/v/v1.10.0/index.html
@@ -88,7 +88,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/index.xml b/v/v1.10.0/index.xml
index 3c8d20c5c..09b18d9d1 100644
--- a/v/v1.10.0/index.xml
+++ b/v/v1.10.0/index.xml
@@ -7,6 +7,13 @@
     <generator>Hugo -- gohugo.io</generator>
     <language>en</language>
     <atom:link href="/v/v1.10.0/index.xml" rel="self" type="application/rss+xml" />
+    <item>
+      <title>IAM v1.10.0</title>
+      <link>/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/</link>
+      <pubDate>Wed, 07 Aug 2024 00:00:00 +0000</pubDate>
+      <guid>/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/</guid>
+      <description>The IAM development team is pleased to announce the release of INDIGO IAM v1.10.0.&#xA;This release provides bug fixes and enhancements, as can be seen in the release notes.&#xA;The major highlights include:&#xA;E-mail notification for AUP reminder/expiration, account suspension/restoration and client disabled/enabled events Add a statistical endpoint which shows the number of IAM users Allow for a definition of a set of default groups, automatically linked to newly registered users Mandate the usage of a stronger user password (during the password reset step) Allow to set a property which disables any kind of IAM cache As usual, the IAM docker image can be obtained from DockerHub.</description>
+    </item>
     <item>
       <title>IAM v1.9.0</title>
       <link>/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/</link>
diff --git a/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json b/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json
new file mode 100644
index 000000000..2a7643df3
--- /dev/null
+++ b/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json
@@ -0,0 +1 @@
+[{"body":"IAM provides a set of APIs that can be used for authentication, authorization and IAM administration purposes.\n","categories":"","description":"IAM APIs\n","excerpt":"IAM APIs\n","ref":"/v/v1.10.0/docs/reference/api/","tags":"","title":"APIs"},{"body":"IAM provides a RESTful API that can be used to manage the IAM Acceptable Usage Policy (AUP) configuration.\nGET /iam/aup Returns a JSON representation of the Acceptable Usage Policy (AUP) for the organization.\nAuthentication required: no\nSuccess response Condition: The AUP is defined for the organization\nCode: 200 OK\nContent: A JSON representation of the AUP\n{ \"url\": \"http://somehost.example.org/aup\", \"text\": \"This is my AUP text\", \"description\": null, \"signatureValidityInDays\": 365, \"creationTime\": \"2018-02-27T07:26:21.000+01:00\", \"lastUpdateTime\": \"2018-02-27T07:26:21.000+01:00\" } Note: text is returned for backward compatible calls.\nError response Condition: The AUP is not defined for the organization\nCode: 404 NOT FOUND\nContent:\n{ \"error\":\"AUP is not defined for this organization\" } POST /iam/aup Creates the AUP for the organization\nAuthentication required: yes\nAuthorization required: ROLE_ADMIN\nData constraints\nProvide a representation of the AUP to be created\n{ \"url\": [url, not blank], \"description\": [text, optional, at most 128 chars], \"signatureValidityInDays\": [integer, \u003e= 0] } Data example\n{ \"url\": \"http://somehost.example.org/aup\", \"signatureValidityInDays\": 365 } Success response Condition: The AUP is created for the organization\nCode: 201 CREATED\nError responses Condition: The AUP already exists\nCode: 409 CONFLICT\nContent:\n{ \"error\": \"AUP already exists\" } Or\nCondition: Missing or invalid fields in the AUP representation\nCode: 400 BAD REQUEST\nOr\nCondition: Unauthenticated access\nCode: 401 UNAUTHORIZED\nContent:\n{ \"error\": \"unauthorized\", \"error_description\": \"Full authentication is required to access this resource\" } Or\nCondition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\": \"Access is denied\" } PATCH /iam/aup Updates the AUP for the organization\nAuthentication required: yes\nAuthorization required: ROLE_ADMIN\nData constraints\nProvide a representation of the AUP to be patched\n{ \"url\": [url, not blank], \"description\": [text, optional, at most 128 chars], \"signatureValidityInDays\": [integer, \u003e= 0] } Data example\n{ \"url\": \"http://somehost.example.org/aup\", \"signatureValidityInDays\": 365 } Success response Condition: The AUP is modified for the organization\nCode: 200 OK\nContent example:\n{ \"creationTime\": \"2018-02-27T19:51:39.083+01:00\", \"description\": null, \"lastUpdateTime\": \"2018-02-27T19:53:49.557+01:00\", \"signatureValidityInDays\": 0, \"url\": \"http://somehost.example.org/aup\" } Error responses Condition: Missing or invalid fields in the AUP representation\nCode: 400 BAD REQUEST\nOr\nCondition: Unauthenticated access\nCode: 401 UNAUTHORIZED\nContent:\n{ \"error\": \"unauthorized\", \"error_description\": \"Full authentication is required to access this resource\" } Or\nCondition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\": \"Access is denied\" } DELETE /iam/aup Deletes the AUP for the organization.\nAuthentication required: yes\nAuthorization required: ROLE_ADMIN\nSuccess response Condition: The AUP is defined for the organization\nCode: 204 NO CONTENT\nError responses Condition: The AUP is not defined for the organization\nCode: 404 NOT FOUND\nContent:\n{ \"error\": \"AUP is not defined for this organization\" } Or\nCondition: Unauthenticated access\nCode: 401 UNAUTHORIZED\nContent:\n{ \"error\": \"unauthorized\", \"error_description\": \"Full authentication is required to access this resource\" } Or\nCondition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\": \"Access is denied\" } ","categories":"","description":"","excerpt":"IAM provides a RESTful API that can be used to manage the IAM …","ref":"/v/v1.10.0/docs/reference/api/aup-api/","tags":"","title":"AUP management API"},{"body":"IAM provides a RESTful API that can be used to manage the IAM Acceptable Usage Policy (AUP) signature time.\nGET /iam/aup/signature/{accountId} Returns a JSON representation of the Acceptable Usage Policy (AUP) for the organization, some account info (uuid, username, name) and the signature time.\ncurl -X GET -H \"Authorization: Bearer $AT\" \\ http://localhost:8080/iam/aup/signature/{accountId} Authentication required: yes\nAuthorization required: iam:admin.read scope\nNote that access to this API via the dashboard is role-based (ROLE_ADMIN or ROLE_GM) or possible via authenticated user with uuid equal to accountId.\nSuccess response Condition: The AUP is defined for the organization and the user signed it\nCode: 200 OK\nContent: A JSON representation of the AUP, some account info and the AUP signature time\n{ \"aup\":{ \"url\": \"http://somehost.example.org/aup\", \"text\": \"This is my AUP text\", \"description\": null, \"signatureValidityInDays\": 0, \"creationTime\": \"2022-03-14T17:47:48.000+01:00\", \"lastUpdateTime\": \"2022-03-14T17:48:03.000+01:00\" }, \"account\":{ \"uuid\": \"8b7b42fd-0e42-43c5-8254-729aa8f6a12d\", \"username\": \"test\", \"name\": \"Test User\" }, \"signatureTime\":\"2023-04-27T11:35:20.000+02:00\" } The /iam/aup/signature endpoint gives the same result and can be accessed via the dashboard by any authenticated user.\nError response Condition: The user did not sign the AUP\nCode: 404 NOT FOUND\nContent:\n{ \"error\":\"AUP signature not found for user 'test'\" } Or\nCondition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\":\"insufficient_scope\", \"error_description\":\"Insufficient scope for this resource\", \"scope\":\"iam:admin.read\" } Or\nCondition: Unauthenticated access\nCode: 401 UNAUTHORIZED\nContent:\n{ \"error\": \"unauthorized\", \"error_description\": \"Full authentication is required to access this resource\" } PATCH /iam/aup/signature/{accountId} Creates or updates the AUP signature time for the account.\ncurl -X PATCH -H \"Authorization: Bearer $AT\" \\ -H \"Content-Type: application/json\" -d '{\"signatureTime\":\"2023-08-22T12:28:01.627+02:00\"}' \\ http://localhost:8080/iam/aup/signature/{accountId} Authentication required: yes\nAuthorization required: iam:admin.write scope\nData constraints\nProvide a signature time in UTC format\n{ \"signatureTime\": \"2023-04-27T11:35:20.000+02:00\" } Success response Condition: The AUP is defined for the organization\nCode: 200 OK\nContent: A JSON representation of the AUP, some account info and the AUP signature time\n{ \"aup\":{ \"url\": \"http://somehost.example.org/aup\", \"text\": \"This is my AUP text\", \"description\": null, \"signatureValidityInDays\": 0, \"creationTime\": \"2022-03-14T17:47:48.000+01:00\", \"lastUpdateTime\": \"2022-03-14T17:48:03.000+01:00\" }, \"account\":{ \"uuid\": \"8b7b42fd-0e42-43c5-8254-729aa8f6a12d\", \"username\": \"test\", \"name\": \"Test User\" }, \"signatureTime\":\"2023-04-27T11:35:20.000+02:00\" } Error response Condition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\":\"insufficient_scope\", \"error_description\":\"Insufficient scope for this resource\", \"scope\":\"iam:admin.write\" } Or\nCondition: Missing or invalid AUP signature time\nCode: 400 BAD REQUEST\n","categories":"","description":"","excerpt":"IAM provides a RESTful API that can be used to manage the IAM …","ref":"/v/v1.10.0/docs/reference/api/aup-sign-api/","tags":"","title":"AUP signature API"},{"body":"","categories":"","description":"IAM administration tasks \u0026 useful information\n","excerpt":"IAM administration tasks \u0026 useful information\n","ref":"/v/v1.10.0/docs/tasks/administration/","tags":"","title":"IAM organization administration"},{"body":"IAM provides a registration service that allows to have managed enrollment for the organization under control. This mean that access to the organization is only granted after explicit approval by a IAM administrator for the organization.\nSubmitting a registration request Users can submit a registration request from the IAM login page in two ways:\nBy clicking the Register a new account button: By attempting a login with an external authentication provider such as Google or a configured SAML IdP: in this case if the external authentication succeeds and the authenticated user is not registered in the IAM the user is taken to the registration form to confirm the registration requests. All the fields in the registration form are mandatory. The notes field can used to include extra information targeted at IAM administrators to clarify the reasons behind a registration request.\nConfirming a registration request If the submission ends successfully, an email verification link is sent to the user email address with a request to confirm his registration request.\nOnce the request is confirmed, IAM administrators are notified with an email.\nChoosing a password Once the submitteed request is approved by an IAM administrator, an email is sent to the user with a reset password link. This URL points to page where the user can choose a password for the IAM account.\nOnce the password is set, users can login to the IAM using the username chosen at registration time and the password.\n","categories":"","description":"","excerpt":"IAM provides a registration service that allows to have managed …","ref":"/v/v1.10.0/docs/tasks/user/joining-a-collaboration/","tags":"","title":"Joining an IAM-managed organization"},{"body":"Starting with version 1.6.0, IAM introduces support for JWT profiles.\nA JWT profile is a named set of rules that defines which information is included in access tokens, id tokens, userinfo and introspection responses issued by IAM in an OAuth/OIDC message exchanges.\nIAM allows to define a default profile that is used for all clients that are not explicitly bound to one. This allows to use the same profile across all clients in an organization.\nIt’s also possible to define the profile to be used at client level, using scopes, i.e. adding among the scope allowed for the client the name of the profile the client should use. The scope, in this context, does not identify a set of permissions but an encoding of authentication/authorization informations in tokens and responses issued by IAM.\nThis mechanism enables integration of the same IAM instance with resources relying on different profiles.\nIAM currently supports three JWT profiles:\nthe iam profile the wlcg WLCG profile the aarc profile the kc profile Setting the default profile The IAM JWT default profile is set using the IAM_JWT_DEFAULT_PROFILE environment variable, e.g.:\nIAM_JWT_DEFAULT_PROFILE=iam The default profile will be used for all clients that do not explicitly and correctly request the use of a profile using scopes.\nUsing scopes to select the JWT profile for a client To select the profile used by a client, include one of the following scopes in the list of scopes authorized for a client:\niam, for the IAM profile wlcg, for the WLCG profile aarc, for the AARC profile kc, for the Keycloak profile Clients should only link to one profile. When multiple profiles are linked to a client, IAM falls back to the default profile configured for the IAM instance.\nUsing system scopes to control profile selection MitreID System Scopes can be used to control access to profile selection.\nThe scopes iam, wlcg and aarc used to select the JWT profile are not available in IAM by default; an administrator has to add all of them manually, as described in the in System Scopes documentation.\nSupported JWT profiles The IAM profile This is the default profile for IAM.\nWith this profile:\ngroups are encoded in the groups claim; all the groups the user is member of are included in the groups claim;\nauthentication information (username, email, groups) is not by default included in access tokens; this behaviour can be changed by setting the IAM_ACCESS_TOKEN_INCLUDE_AUTHN_INFO=true environment variable;\nscope information is not by default included in access tokens; this behaviour can be changed by setting the IAM_ACCESS_TOKEN_INCLUDE_SCOPE=true environment variable;\nthe nbf (not before) claim is not set in access tokens; this behaviour can be changed by setting the IAM_ACCESS_TOKEN_INCLUDE_NBF=true environment variable.\nThis profile is assigned to clients using the iam scope.\nThe WLCG profile This profile implements the Common JWT Token profile.\nIn particular:\nthe scope claim is always included in access tokens; groups are not included by default in access and ID tokens. This profile is assigned to clients using the wlcg scope.\nWith this profile:\ngroups are encoded in the wlcg.groups claim; all the non-optional groups the user is member of are included in the wlcg.groups claim;\nauthentication information (name, preferred username and email) is not by default included in access tokens; this behaviour can be changed by setting the IAM_ACCESS_TOKEN_INCLUDE_AUTHN_INFO=true environment variable and by requesting\nemail scope to include the email claim in access tokens; profile scope to include the name and preferred_username claims in access tokens; the nbf (not before) claim is not set in access tokens; this behaviour can be changed by setting the IAM_ACCESS_TOKEN_INCLUDE_NBF=true environment variable.\nRequesting groups with the WLCG profile When the WLCG profile is used, groups are not automatically included in access tokens and ID tokens, but can be requested using the wlcg.groups scope (which has to be added among the System Scopes), following the rules described in the WLCG profile.\nOptional groups Optional groups are groups whose membership is only asserted in tokens on explicit request coming from a user.\nIn order to configure a IAM group as an optional group, add the wlcg.optional-group label to the group.\nThe AARC profile This profile encodes group membership information following the rules defined by the AARC G002 profile document.\nIn particular:\ngroups and organisation name are not included by default in access and ID tokens; organisation name can be requested using the eduperson_scoped_affiliation scope and it’s encoded in the eduperson_scoped_affiliation claim; groups can be requested using the eduperson_entitlement scope and they’re encoded as URN in the eduperson_entitlement claim. All the mapping rules are described in the White Paper for implementation mappings between SAML 2.0 and OpenID Connect in Research and Education.\nThis profile is assigned to clients using the aarc scope.\nThe Keycloak profile This profile allows the integration with a Keycloak environment.\nWith this profile:\nthe scope claim is always included in access tokens; groups are always included in access and ID tokens; they are encoded in the roles claim. Having roles claim instead of groups allows integration with the OIDC client - a conteinerised MISP deployment - which requires them to map IAM users.\nThis profile is assigned to clients using the kc scope.\n","categories":"","description":"","excerpt":"Starting with version 1.6.0, IAM introduces support for JWT profiles. …","ref":"/v/v1.10.0/docs/reference/configuration/jwt-profiles/","tags":"","title":"JWT profiles support"},{"body":"IAM relies on NGINX for TLS termination and load balancing.\nThe example configuration below provides the minimal configuration needed to have NGINX working as a reverse proxy for the IAM web application:\nserver { listen 80; listen [::]:80; server_name _; return 301 https://$host$request_uri; } server { listen 443 ssl; server_name YOUR_HOSTNAME_HERE; access_log /var/log/nginx/iam.access.log combined; ssl on; ssl_protocols TLSv1 TLSv1.1 TLSv1.2; ssl_certificate /path/to/your/ssl/cert.pem; ssl_certificate_key /path/to/your/ssl/key.pem; location / { proxy_pass http://THE_IAM_APP_HOSTNAME_HERE:8080; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto https; proxy_set_header Host $http_host; } } X.509 client authentication IAM supports X.509 client certificate authentication. To enable X.509 client certificate authentication use a configuration similar to the one used in the IAM development environment.\nIn particular, set the ssl_verify_client=Optional option and configure the proxy_set_header directory as follows:\nproxy_set_header X-SSL-Client-Cert $ssl_client_cert; proxy_set_header X-SSL-Client-I-Dn $ssl_client_i_dn; proxy_set_header X-SSL-Client-S-Dn $ssl_client_s_dn; proxy_set_header X-SSL-Client-Serial $ssl_client_serial; proxy_set_header X-SSL-Client-V-Start $ssl_client_v_start; proxy_set_header X-SSL-Client-V-End $ssl_client_v_end; proxy_set_header X-SSL-Client-Verify $ssl_client_verify; proxy_set_header X-SSL-Protocol $ssl_protocol; proxy_set_header X-SSL-Server-Name $ssl_server_name; ","categories":"","description":"","excerpt":"IAM relies on NGINX for TLS termination and load balancing.\nThe …","ref":"/v/v1.10.0/docs/getting-started/nginx/","tags":"","title":"NGINX configuration"},{"body":"A token can be obtained from a command-line interface (CLI) in two ways:\nusing oidc-agent using scripts linked to this page, using the resource-owner password credentials flow or the OAuth device flow In this section we recommend the installations of a set of tools that can help in managing tokens.\nObtaining a token using oidc-agent oidc-agent is a useful tool to easily get and manage access tokens for command-line applications.\nInstalling oidc-agent See oidc-agent installation instructions.\nQuick CENTOS7 installation instructions This recipe shows how to quickly install oidc-agent on CENTOS 7.\n$ yum -y install epel-release $ yum -y install https://github.com/indigo-dc/oidc-agent/releases/download/v3.3.1/oidc-agent-3.3.1-1.el7.x86_64.rpm Bootstrapping oidc-agent The first thing to do is to start oidc-agent. This can be done issuing the following command:\n$ eval $(oidc-agent) Agent pid 62088 Registering a client In order to obtain a token out of IAM, a user needs a client registered. oidc-agent can automate this step and store client credentials securely on the user machine. This is a one-time operation, you do not need a new client every time you need a token.\nA new client can be registered using the oidc-gen command, as follows:\n$ oidc-gen -w device wlcg The -w device instructs oidc-agent to use the device code flow for the authentication, which is the recommended way with IAM.\noidc-agent will display a list of different providers that can be used for registration:\n[1] https://wlcg.cloud.cnaf.infn.it/ [2] https://iam-test.indigo-datacloud.eu/ ... [20] https://oidc.scc.kit.edu/auth/realms/kit/ Select one of the registered providers, or type a custom issuer (for IAM, the last character of the issuer string is always a /, e.g. https://wlcg.cloud.cnaf.infn.it/).\nThen oidc-agent asks for the scopes, typing max (without quotes) allows to get all the allowed scopes.\noidc-agent will register a new client and store the client credentials and a refresh token locally in encrypted form (the agent will ask for a password from the user).\nAs mentioned, oidc-gen is meant to be used only once, when you need a client registered.\nManaging oidc-agent account configurations To see the list of locally configured accounts use the following command:\n\u003e oidc-add -l The following account configurations are usable: DEEP-ac XDC atlas ... cms-voms-importer escape escape-monitoring iam-test infn-cloud wlcg You can then load an account in the agent again with the oidc-add command, as follows:\noidc-add wlcg Once you’ve loaded the account, you can use oidc-token to get tokens for that account.\nGetting tokens with oidc-token Tokens can be obtained using the oidc-token command, as follows:\noidc-token wlcg This will request a token with all the scopes requested at client registration time. To limit the scopes included in the token, the -s flag can be used, as follows:\noidc-token -s storage.read:/ wlcg The token audience can be limited using the --aud flag,\noidc-token --aud example.audience -s storage.read:/ wlcg Accessing oidc-agent client configuration Often is useful to get details about the client configuration generated by oidc-agent. This can be done with the oidc-gen -p command, that is used to print a client configuration, as in the following example:\n❯ oidc-gen -p wlcg Enter decryption password for account config 'wlcg':****** { \"name\":\t\"wlcg\", \"client_name\":\t\"oidc-agent:wlcg\", \"issuer_url\":\t\"https://wlcg.cloud.cnaf.infn.it/\", \"device_authorization_endpoint\":\t\"https://wlcg.cloud.cnaf.infn.it/devicecode\", \"daeSetByUser\":\t0, \"client_id\":\t\"*****\", \"client_secret\":\t\"*****\", \"refresh_token\":\t\"****.*****.\", \"cert_path\":\t\"\", \"scope\":\t\"storage.create:/ openid offline_access storage.read:/ eduperson_scoped_affiliation storage.modify:/ wlcg wlcg.groups eduperson_entitlement\", \"audience\":\t\"\", \"redirect_uris\":\t[\"edu.kit.data.oidc-agent:/redirect\", \"http://localhost:8080\", \"http://localhost:47947\", \"http://localhost:4242\"], \"username\":\t\"\", \"password\":\t\"\", \"client_id_issued_at\":\t1600444894, \"registration_access_token\":\t\"****\", \"registration_client_uri\":\t\"https://wlcg.cloud.cnaf.infn.it/register/****\", \"token_endpoint_auth_method\":\t\"client_secret_basic\", \"grant_types\":\t[\"urn:ietf:params:oauth:grant-type:device_code\", \"refresh_token\"], \"response_types\":\t[\"token\"], \"application_type\":\t\"web\", \"cert_path\":\t\"\", \"audience\":\t\"\" } Obtaining a token with the password flow The password flow allows a user to get a token from the IAM by using the IAM local credentials (i.e. the username/password credentials setup at IAM registration time).\nIn order to use the password flow, a non-privileged user has to:\nregister a client following the instructions given in [the client registration][client-registration] section Note down the client_id of the generated client and ask an IAM administrator to enable the password flow for such client Wait until the client as the password flow enabled Use a script similar to the one given here (or write your own following the recommendations of the RFC) to obtain a token out of the IAM Warning While this approach is viable, it is deprecated since:\nit forces the user to request the activation of the password flow for the client (it is disabled by default for dynamically registered clients) it forces the user to authenticate with the local IAM credentials (external authentication mechanisms such as Google or SAML cannot be used) it exposes the user credentials to the client application The device code flow, described in the next section, does not have these limitations and should be preferred over the password flow.\nObtaining a token with the device code flow The device code flow allows a user to get a token from the IAM from a CLI interface while using an external browser for the authentication step. This is convenient since:\nit does not require any authorization from administrators (the device code flow can be requested by the user at client registration time) it allows the user to authenticate with any of the authentication mechanisms supported by the IAM it does not expose the user credentials to the client application For nitty and gritty details on how the flow works, see the RFC.\nAfter having registered a client with the device flow enabled (see client registration section), the device code flow can be used to obtain a token using a script like the one here which does the following:\ncontacts the device flow endpoint to start a device flow authentication and authorization prints code information on the terminal waits for user input to proceed and obtain the token(s) ","categories":"","description":"","excerpt":"A token can be obtained from a command-line interface (CLI) in two …","ref":"/v/v1.10.0/docs/tasks/user/getting-a-token/","tags":"","title":"Obtaining an IAM access token from a CLI"},{"body":"IAM supports brokered OpenID Connect authentication to external identity providers (e.g., Google).\nWhen brokered OpenID Connect authentication is turned on a IAM instance, users can log into the service delegating authentication to one of the supported OpenID Connect providers (OP).\nTo enable brokered OpenID Connect authentication on your IAM instance you have to:\nObtain client credentials and other configuration details for each of the external OpenID Connect providers; Provide the OIDC configuration file defining the configuration of the supported OPs; Enable the oidc profile. Obtain OP configuration and client credentials In order to act as a relying party (RP) for an external OpenID Connect provider (OP), IAM will need at least:\nclient credentials (a clientId and clientSecret); an OpenID Connect provider discovery endpoint URL; As an example, see the the Google identity platform OpenID Connect guide for help on this.\nProvide the OIDC configuration Google configuration If Google is the only OpenID Connect provider you want to support, the configuration embedded in the IAM war file already provides what you need, and you just need to:\nEnable the oidc profile;\nPass the google client credentials to IAM via the following environment variables:\nIAM_GOOGLE_CLIENT_ID IAM_GOOGLE_CLIENT_SECRET Multiple providers configuration To configure multiple providers, or to override the default configuration, you must provide an application-oidc.yaml configuration file and make it available to IAM.\nTrusted OPs are configured for IAM via the application-oidc.yaml configuration file.\nThis is a Spring Boot configuration file that is activated when the oidc profile is turned on.\nThe default configuration file, embedded in the IAM war file, supports the configuration of a single provider, Google, for backward compatibility, and looks like this:\noidc: providers: - name: google issuer: https://accounts.google.com client: clientId: ${IAM_GOOGLE_CLIENT_ID} clientSecret: ${IAM_GOOGLE_CLIENT_SECRET} redirectUris: ${iam.baseUrl}/openid_connect_login scope: openid,profile,email,address,phone loginButton: text: Google style: btn-social btn-google image: fa-icon: google This configuration allows to configure support for Google by:\nactivating the oidc profile; Setting the IAM_GOOGLE_CLIENT_ID and IAM_GOOGLE_CLIENT_SECRET environment variables to provide the Google client credentials; To enable multiple providers, you need to override the default oidc configuration.\noidc: providers: - name: google issuer: https://accounts.google.com client: clientId: ${IAM_GOOGLE_CLIENT_ID} clientSecret: ${IAM_GOOGLE_CLIENT_SECRET} redirectUris: ${iam.baseUrl}/openid_connect_login scope: openid,profile,email,address,phone loginButton: text: Google style: btn-social btn-google image: fa-icon: google - name: egi-checkin issuer: ${IAM_CHECKIN_ISSUER} client: clientId: ${IAM_CHECKIN_CLIENT_ID} clientSecret: ${IAM_CHECKIN_CLIENT_SECRET} redirectUris: ${iam.baseUrl}/openid_connect_login scope: ${IAM_CHECKIN_CLIENT_SCOPE:openid,profile,email} loginButton: text: EGI CheckIn title: Sign in with EGI CheckIn image: url: https://egi.eu/wp-content/uploads/2016/05/cropped-logo_site-1-300x300.png size: medium The example configuration above shows how to configure support for Google and the EGI CheckIn provider, with a custom button configuration for the CheckIn provider.\nSee the configuration reference for instructions on how to override the default IAM configuration.\nRegistration form: filling information from IdP See registration configuration.\n","categories":"","description":"","excerpt":"IAM supports brokered OpenID Connect authentication to external …","ref":"/v/v1.10.0/docs/reference/configuration/external-authentication/oidc/","tags":"","title":"OpenID-Connect authentication"},{"body":"The INDIGO Identity and Access Management (IAM) Service provides a layer where identities, enrollment, group membership and other attributes and authorization policies on distributed resources can be managed in an homogeneous way, supporting identity federations and other authentication mechanisms (X.509 certificates and social logins).\nIAM implements the Virtual Organization (VO) concept, and is the developed by the same team behind VOMS.\nIAM is the AAI solution chosen to power the next generation WLCG Authentication and Authorization infrastructure.\nFunctions Flexible authentication: The IAM supports user authentication via local username and password credentials as well as SAML Identity Federations, OpenID Connect providers and X.509. Enrollment: The IAM provides VO enrollment and registration functionalities, so that users can join groups/collaborations according to well-defined flows. Attribute and identity management: The IAM provides services to manage group membership, attributes assignment and account linking functionality. User provisioning: the IAM provides endpoints to provision information about users identities to other services, so that consistent local account provisioning, for example, can be implemented. Integrations The IAM service has been succesfully integrated with many off-the-shelf components like Openstack, Kubernetes, Atlassian JIRA and Confluence, Grafana and with key Grid computing middleware services (e.g., RUCIO, FTS, dCache, StoRM, XRootD, HTCondor).\nService access options On-premise deployment IAM is an Apache-licensed identity solution, for which we provide a Docker image on dockerhub and RPM packages.\nIAM can be deployed on-premises following the advice in the Deployment guide.\n","categories":"","description":"A brief overview of the INDIGO IAM service\n","excerpt":"A brief overview of the INDIGO IAM service\n","ref":"/v/v1.10.0/docs/overview/","tags":"","title":"Overview"},{"body":"IAM provides a RESTful API that can be used to download the X.509 proxy certificate previously uploaded in IAM dashboard by the user. This is a plain proxy obtained by running voms-proxy-init command.\nThe API has been added mainly for the integration of IAM with the RCAuth.eu online certificate authority. The X.509 proxy certificate can be uploaded using the IAM Account Proxy Certificate API.\nThe proxy:generate OAuth scope is required to access this API. Note that this scope is restricted in the default IAM configuration, i.e. can be assigned to clients only by IAM administrators.\nPOST /iam/proxycert Returns a JSON representation of the proxy certificate of the user.\ncurl -s -X POST -H \"Authorization: Bearer ${BT}\" \\ -d client_id=${CLIENT_ID} \\ -d client_secret=${CLIENT_SECRET} \\ -d lifetimeSecs=${PROXY_CERT_LIFETIME_SECS} \\ http://localhost:8080/iam/proxycert The user can request a specific lifetime of the proxy that is less than or equal to the maximum lifetime of the proxy itself and also limited by IAM configuration options max-ac-lifetime-in-seconds (as shown in VOMS AA configuration).\nIAM response:\n{ \"subject\": \"CN=2050153474,CN=813462308,CN=John Doe jdoe@infn.it,O=Istituto Nazionale di Fisica Nucleare,C=IT,DC=tcs,DC=terena,DC=org\", \"issuer\": \"CN=813462308,CN=John Doe jdoe@infn.it,O=Istituto Nazionale di Fisica Nucleare,C=IT,DC=tcs,DC=terena,DC=org\", \"identity\": \"CN=John Doe jdoe@infn.it,O=Istituto Nazionale di Fisica Nucleare,C=IT,DC=tcs,DC=terena,DC=org\", \"not_after\": \"1663991299000\", \"certificate_chain\": \"-----BEGIN CERTIFICATE-----\\nMI...lCU=\\n-----END CERTIFICATE-----\\n\" } N.B. The first proxy certificate found is downloaded.\nIf one account has two or more associated proxy certificates, the issuerDn (e.g. CN=Test CA,O=IGI,C=IT) should be specified in the request to download a specific one:\ncurl -s -X POST -H \"Authorization: Bearer ${BT}\" \\ -d client_id=${CLIENT_ID} \\ -d client_secret=${CLIENT_SECRET} \\ -d lifetimeSecs=${PROXY_CERT_LIFETIME_SECS} \\ -d issuerDn=${ISSUER_DN} \\ http://localhost:8080/iam/proxycert ","categories":"","description":"","excerpt":"IAM provides a RESTful API that can be used to download the X.509 …","ref":"/v/v1.10.0/docs/reference/api/proxycert-api/","tags":"","title":"Proxy certificate API"},{"body":"During the client registration, a user can assign any scope to the client, but IAM will grant only the list of scopes available among the MitreID System Scopes.\nIn order to include a new scope into the System Scopes, an IAM administrator has to add it manually from the System Scopes tab on the left side of the MitreID dashboard:\nif the box default scope is checked, the scope will be assigned to any newly regirested client, even if it is not explicitly requested; if the box restricted is checked, the scope will not be available to dynamically registered clients and can only be assigned to clients by IAM administrators; if no one box is checked, any dynamically registered client has to explicitly request for this scope at the registration time, and it will be granted without intervention of IAM administrators. ","categories":"","description":"","excerpt":"During the client registration, a user can assign any scope to the …","ref":"/v/v1.10.0/docs/reference/configuration/system-scopes/","tags":"","title":"MitreID System Scopes"},{"body":"IAM provides tools to manage users in an organization. All the actions described below require administrator privileges.\nCreating a user account A new user account in the organization can be created from the “Users” management panel by clicking on the “Add user” button at the bottom of the page:\nA dialog is shown that allows to set basic user information:\nDeleting a user account User accounts can be deleted from the “Users management” section of the dashboard by clicking on the delete button for the users that should be deleted:\nDisabling a user account User accounts can be disabled from the user home page by clicking on the “Disable user” button. Disabled users are not allowed to login in the IAM and, as such, cannot authenticate at any services that rely on the IAM for authentication and authorization.\nManaging user account privileges Administrator privileges can be assigned to a user from the user home page by clickin on the “Assign administrator privileges” button:\nManaging external user account identities Administrators can manually add and remove external accounts and certificates for a local user account from the user home page:\n","categories":"","description":"","excerpt":"IAM provides tools to manage users in an organization. All the actions …","ref":"/v/v1.10.0/docs/tasks/administration/user-management/","tags":"","title":"User management"},{"body":"Most IAM configurable aspects are configured via environment variables and Spring profile directives.\nSpring profiles Spring profiles are used to enable/disable group of IAM functionalities. Currently the following profiles are defined:\nProfile name Active by default Description prod no Sets up the environment for IAM in production h2-test yes Enables h2 in-memory database, useful for development and testing mysql-test no Like h2-test, but used to develop against a MySQL database oidc no Enables OIDC authentication (e.g. Google) saml no Enables SAML authentication registration yes Enables user registration and reset password functionalities wlcg-scopes no Enables WLCG token encoding Profiles are enabled by setting the spring.profiles.active Java system property when starting the IAM service. This can be done, using the official IAM docker image, by setting the IAM_JAVA_OPTS environment variable as follows:\nIAM_JAVA_OPTS=\"-Dspring.profiles.active=prod,oidc,saml\" Overriding default configuration templates Fine-grained control over configuration can be obtained following the rules for spring boot externalized configuration. This basically means defining one or more YAML files to override the default configuration files embedded in the IAM Web Archive (war) package for the Spring profiles activated for your instance. The files must be placed in the IAM configuration directory, which depends on how you deployed IAM:\nDeployment type Configuration directory Docker /indigo-iam/config/ Package (RPM) /etc/indigo-iam/config IMPORTANT: the default configuration should solve most use cases, override default configuration only if you know what you are doing, and for those scenarios not served by the default templates.\nBasic service configuration # The IAM service will list for requests on this host IAM_HOST=localhost # The IAM service webapp will bind on this port IAM_PORT=8080 # The IAM web application base URL IAM_BASE_URL=http://${IAM_HOST}:8080 # The OpenID Connect issuer configured for this IAM instance. # This must be equal to IAM_BASE_URL IAM_ISSUER=http://${IAM_HOST}:8080 # The path to the JSON keystore that holds the keys IAM will use to sign and # verify token signatures IAM_KEY_STORE_LOCATION= # HTTP caching header setting public key lifetime (in seconds). # The recommended lifetime according to the WLCG profile* is 6 hours IAM_JWK_CACHE_LIFETIME=21600 # IAM will look for trust anchors in this directory. These trust anchors are # needed for TLS operations where the IAM acts as a client (i.e., to # authenticate to remote SAML Identity providers) IAM_X509_TRUST_ANCHORS_DIR=/etc/grid-security/certificates # How frequently (in seconds) should trust anchors be refreshed IAM_X509_TRUST_ANCHORS_REFRESH=14400 # Use forwarded headers from reverse proxy. Set this to native when deploying the # service behind a reverse proxy IAM_FORWARD_HEADERS_STRATEGY=none ## Tomcat embedded container settings # Enables the tomcat access log IAM_TOMCAT_ACCESS_LOG_ENABLED=false # Directory where the tomcat access log will be written (when enabled) IAM_TOMCAT_ACCESS_LOG_DIRECTORY=/tmp ## Actuator endpoint settings # Sets the username of the user allowed to have privileged access to actuator # endpoints IAM_ACTUATOR_USER_USERNAME=user # Sets the password of the user allowed to have privileged access to actuator # endpoints IAM_ACTUATOR_USER_PASSWORD=secret ## Local resources configuration # Enables the serving of resources from the local file system IAM_LOCAL_RESOURCES_ENABLE=false # Sets the directory that contains the local resources that should be exposed IAM_LOCAL_RESOURCES_LOCATION=file:/indigo-iam/local-resources (*) More information here.\nOrganization configuration # The name of the organization managed by this IAM instance IAM_ORGANISATION_NAME=indigo-dc # URL of logo image used in the IAM dashboard (by default the INDIGO-Datacloud # project logo image is used) IAM_LOGO_URL=resources/images/indigo-logo.png # Size of the logo image (in pixels) IAM_LOGO_DIMENSION=200 # Height of the logo image (in pixels) IAM_LOGO_HEIGTH=150 # Width of the logo image (in pixels) IAM_LOGO_WIDTH=200 # String displayed into the brower top bar when accessing the IAM dashboard IAM_TOPBAR_TITLE=\"INDIGO IAM for ${IAM_ORGANISATION_NAME}\" Access token contents configuration ## Token content settings # Include authentication claims in issued access tokens IAM_ACCESS_TOKEN_INCLUDE_AUTHN_INFO=false # Includes the scope in issued access tokens IAM_ACCESS_TOKEN_INCLUDE_SCOPE=false # Includes the nbf claim in issued access tokens IAM_ACCESS_TOKEN_INCLUDE_NBF=false Database configuration # The host where the MariaDB/MySQL daemon is running IAM_DB_HOST= # The database port IAM_DB_PORT=3306 # The database name IAM_DB_NAME=iam # The database username IAM_DB_USERNAME=iam # The database password IAM_DB_PASSWORD=pwd ## Database connection pool options # Maximum number of active connections to the database IAM_DB_MAX_ACTIVE=50 # Maximum number of idle connections in the pool IAM_DB_MAX_IDLE=5 # Initial size of the database connection pool IAM_DB_INITIAL_SIZE=8 # Should idle connections in the pool be tested? IAM_DB_TEST_WHILE_IDLE=true # Should connections in the pool be tested when borrowed? IAM_DB_TEST_ON_BORROW=true # Which SQL query should be used to test connections? IAM_DB_VALIDATION_QUERY=SELECT 1 # Time between database connection pool eviction runs (in msec) IAM_DB_TIME_BETWEEN_EVICTION_RUNS_MILLIS=5000 # The minimum amount of time a connection may be idle in the pool # before it is considered for eviction (in msec) IAM_DB_MIN_EVICTABLE_IDLE_TIME_MILLIS=60000 Test Client configuration # Public identifier for client application IAM_CLIENT_ID=client # Client application's own password IAM_CLIENT_SECRET=secret # Default scopes allowed to the client application (optional) IAM_CLIENT_SCOPES=openid profile email # Use forwarded headers from reverse proxy. Set this to native when deploying the # service behind a reverse proxy IAM_CLIENT_FORWARD_HEADERS_STRATEGY=none Redis configuration Starting with version 1.8.0, IAM supports storing HTTP session information in an external redis server.\nThis can be useful when deploying multiple replicas of the IAM service.\n## Redis server settings # Redis server hostname IAM_SPRING_REDIS_HOST=localhost # Redis server port IAM_SPRING_REDIS_PORT=6397 # Redis server password. # Leave it empty in case the server does not require any password IAM_SPRING_REDIS_PASSWORD=secret # Duration of an HTTP session IAM_SESSION_TIMEOUT_SECS=1800 # Set to 'redis' in order to handle HTTP session # with an external Redis service IAM_SPRING_SESSION_STORE_TYPE=none # If set to 'true' the status of the Redis service # will appear in the IAM Health check endpoint IAM_HEALTH_REDIS_PROBE_ENABLED=false Local authentication settings It allows a user to log in with local credentials (username/password).\nFor more information, see the Local Authentication section.\n# Set to 'hidden' if you want to hide the local login form IAM_LOCAL_AUTHN_LOGIN_PAGE_VISIBILITY=visible # Enables local login form to all users. # It can be restricted, changing the value to 'vo-admins' or 'none' IAM_LOCAL_AUTHN_ENABLED_FOR=all Google authentication settings # The Google OAuth client id IAM_GOOGLE_CLIENT_ID= # The OAuth client secret IAM_GOOGLE_CLIENT_SECRET= For more information and examples, see the OpenID Connect Authentication section.\nSAML authentication settings # The SAML entity ID for this IAM instance IAM_SAML_ENTITY_ID= # Text shown in the SAML login button on the IAM login page IAM_SAML_LOGIN_BUTTON_TEXT=Sign in with SAML ## SAML keystore settings # The keystore holding certificates and keys used for SAML crypto IAM_SAML_KEYSTORE= # The SAML keystore password IAM_SAML_KEYSTORE_PASSWORD= # The identifier of the key that should be used to sign requests/assertions IAM_SAML_KEY_ID= # The password of the SAML key that will be used to sign requests/assertions IAM_SAML_KEY_PASSWORD= ## Metadata settings # a URL pointing to the SAML federation or IdP metadata IAM_SAML_IDP_METADATA= # Metadata refresh period (in seconds) IAM_SAML_METADATA_LOOKUP_SERVICE_REFRESH_PERIOD_SEC=600 # Should signature validity checks be enforced on metadata? IAM_SAML_METADATA_REQUIRE_VALID_SIGNATURE=false # Trust only IdPs that have SIRTFI compliance IAM_SAML_METADATA_REQUIRE_SIRTFI=false # Comma-separated IDP entity ID whitelist. When empty # all IdPs included in the metadata are whitelisted IAM_SAML_IDP_ENTITY_ID_WHITELIST= ## Assertion validity settings # Maxixum allowed assertion time (in seconds) IAM_SAML_MAX_ASSERTION_TIME=3000 # Maximum authentication age (in seconds) IAM_SAML_MAX_AUTHENTICATION_AGE=86400 ## Other settings # List of attribute aliases that are looked up in assertion to identify the # user authenticated with SAML IAM_SAML_ID_RESOLVERS=eduPersonUniqueId,eduPersonTargetedId,eduPersonPrincipalName For more information and examples, see the SAML Authentication section.\nNotification service settings ## SMTP mail server settings # SMTP server hostname IAM_MAIL_HOST=localhost # SMTP server port IAM_MAIL_PORT=25 # SMTP server username IAM_MAIL_USERNAME= # SMTP server password IAM_MAIL_PASSWORD= ## IAM notification settings # Should the notification server be disabled? # When set to true, notifications are not sent to the mail server (but # printed to the logs) IAM_NOTIFICATION_DISABLE=false # The email address used as the sender in IAM email notifications IAM_NOTIFICATION_FROM=indigo@localhost # The email address used as the recipient in IAM email notifications IAM_NOTIFICATION_ADMIN_ADDRESS=indigo-alerts@localhost # Notification policy for account requests. The default value is notify-address # meaning that notifications just arrive to the email address # specified above. Set to notify-admins if you want to notify # all IAM admins or to notify-address-and-admins to combine the two behaviors IAM_NOTIFICATION_ADMIN_NOTIFICATION_POLICY=notify-address # Notification policy for group requests. Default value notifies both # admins and group managers. Set to notify-gms if you want to notify only group managers IAM_NOTIFICATION_GROUP_MANAGER_NOTIFICATION_POLICY=notify-gms-and-admins # Time interval, in milliseconds, between two consecutive runs of IAM notification # dispatch task IAM_NOTIFICATION_TASK_DELAY=30000 # Retention of delivered messages, in days IAM_NOTIFICATION_CLEANUP_AGE=30 Account linking settings # Should account linking be disabled? When set to true users cannot # link external accounts (Google, SAML) to their local IAM account IAM_ACCOUNT_LINKING_DISABLE=false Client registration Those variables allow to configure how to register a new client and the related default settings.\nFor more information see the Client registration section.\n# Specifies who can register a client. Default is anyone, so also not registered users. # Other possible values are: REGISTERED_USERS and ADMINISTRATORS IAM_CLIENT_REGISTRATION_ALLOW_FOR=ANYONE # Set to false if you do not want to enable client registration (default is true) IAM_CLIENT_REGISTRATION_ENABLE=true # Set the default validity in seconds of an AT requested by any newly registered client. # Default is 1 hour, but it can be changed per client IAM_DEFAULT_ACCESS_TOKEN_VALIDITY_SECONDS=3600 # Set the default validity in seconds of a device code requested by any newly registered client. # Default is 10 minutes, but it can be changed per client IAM_DEFAULT_DEVICE_CODE_VALIDITY_SECONDS=600 # Set the default validity in seconds of an ID token requested by any newly registered client. # Default is 10 minutes, but it can be changed per client IAM_DEFAULT_ID_TOKEN_VALIDITY_SECONDS=600 # Set the default validity in seconds of an RT requested by any newly registered client. # Default is 30 days, but it can be changed per client IAM_DEFAULT_REFRESH_TOKEN_VALIDITY_SECONDS=2592000 Client lifecycle # Record the last date when each client was used to create or refresh a token # This is used to determine which clients are considered active/inactive IAM_CLIENT_TRACK_LAST_USED=false Privacy policy settings # An URL pointing to a privacy policy document which applies # to this IAM instance. When left blank, no privacy policy link # is displayed in the login page IAM_PRIVACY_POLICY_URL= # The text displayed in the login page for the privacy policy URL specified # above IAM_PRIVACY_POLICY_TEXT=Privacy policy ","categories":"","description":"IAM service configuration reference\n","excerpt":"IAM service configuration reference\n","ref":"/v/v1.10.0/docs/reference/configuration/","tags":"","title":"Configuration"},{"body":"IAM keeps state in a MariaDB/MySQL database, and will need its own schema and a user that has read/write/schema change privileges on such database.\nIAM has been tested successfully against:\nMySQL v. 5.5.5 MariaDB v. 10.1.22 For more instructions on how to create a database schema and a user with administrator privileges on it, see the MariaDB documentation.\nAssuming the organization that IAM will manage is called test, the following commands can be used to create a database and a user for the IAM application:\nCREATE DATABASE iam_test_db CHARACTER SET latin1 COLLATE latin1_swedish_ci; CREATE USER 'iam_test'@'%' identified by 'some_super_secure_password'; GRANT ALL PRIVILEGES on iam_test_db.* to 'iam_test'@'%'; You may want to restrict the set of hosts from which a mysql client can connect to the database with the above credentials according to your deployment needs.\n","categories":"","description":"","excerpt":"IAM keeps state in a MariaDB/MySQL database, and will need its own …","ref":"/v/v1.10.0/docs/getting-started/mariadb/","tags":"","title":"Database configuration"},{"body":"Existing clients can be disabled or enabled by Administrator from dashboard.\nDisabling a client using the dashboard Log into the service using admin credentials and click on the Clients link on the left navigation bar:\nFrom the Clients link, select Any client you want to disable, for example Test Client:\nTo disable the client click on Disable Client button on the bottom of the page:\nTo confirm your choice click on Disable Client button on the modal window:\nOn success you will get a confirmation message and the Disable Client button will change to Restore Client:\nUsing Restore Client button client status can be changed back to Active.\n","categories":"","description":"","excerpt":"Existing clients can be disabled or enabled by Administrator from …","ref":"/v/v1.10.0/docs/tasks/administration/client-status-change/","tags":"","title":"Disable or Enable a client"},{"body":"This section provides insight on how to deploy and configure an IAM service instance.\nIAM is a spring boot application designed to run behind an NGINX reverse proxy, which is used for TLS termination and possibly load balancing. The IAM service instances keep all state in a MariaDB/MySQL database, as shown in the following picture:\nPrerequisites At the bare minimum, to run a production instance of the instance of the IAM you will need:\nAn X.509 certificate, used for SSL termination at the NGINX reverse proxy; you can get one for free from Let’s Encrypt; An NGINX server configured to act as a reverse proxy for the IAM web application; more details on this in the NGINX section; A MariaDB/MySQL database instance; more on this in the database configuration section; A JSON keystore holding the keys used to sign JSON Web Tokens; more on this in the JWK section; You will also need to choose whether you want to deploy you service as a docker container (recommended) or install from packages.\nAnd finally, you will have to setup a minimal IAM configuration and change the administrator password for the newly configured IAM service; more on this in the basic configuration section.\n","categories":"","description":"A quick howto on how to deploy IAM\n","excerpt":"A quick howto on how to deploy IAM\n","ref":"/v/v1.10.0/docs/getting-started/","tags":"","title":"Getting Started"},{"body":"IAM provides a group management system, that can be used by IAM Administrators and Group Managers to create groups, remove existing ones and manage membership in the group.\nGroups can be organized in a hierarchical structure, with the following constraints:\na group can have only a parent group; a group can have many childrens. Manage groups as IAM Admin The simplest way to manage groups is using the IAM dashboard.\nCreating a group From the home page, open the Groups section and click the Add Root Group button:\nTo create a group, specify a group name.\nA new children group can be created from the parent group details page, clicking on the Add a subgroup button of the Subgroups upper tab.\nDeleting a group From the groups list page, click on the corresponding X button. A confirmation window will be opened, so you can confirm or abort the the delete operation.\nOnly empty groups can be removed. If you try to remove a group with a child group or with user members, the operation is aborted.\nManaging membership for a group To add a user to a group open the user details page. In the Groups section, click on the Add to group button:\nChoose one or more groups and confirm the operation:\nStarting with version 1.7.0, when a user is added as member of the children group A/B, IAM takes care of adding them also to the parent group A that they are not already a members of. In previous versions this had to be done manually by the IAM administrator. Following the same rationale, when a user is removed from the parent group A, it is also automatically removed from any children groups (e.g. A/B) they are members of.\nTo remove a user from a group, click the Remove button.\nMembers can also be removed from the group details page, clicking on the corresponding X button as shown in the following screenshot:\nAssign Group Manager privileges Group Managers are IAM users with privileges that allow to manage groups.\nIn order to assign Group Manager privileges to a user, you can select the group, click on the Managers tab and then on Assign group manager. A popup window will appear to search for IAM users: after selecting the corresponding user that wants to became Group Manager, click on Add group manager.\nManage groups as Group Manager Starting from IAM version 1.8.1, when a user is a Group Manager a left tab Managed groups that lists the groups they are group managers of appears in the homepage.\nOnce the Group Manager clicks on a group, what they can see in the upper tabs is\ndetailed view of group information (Group information) list of children groups, if any (Subgroups) list of Group Managers (Managers) list of group members, if any (Members) The Group Manager has also the possibility to click on group members, where a limited view of user information (including name, surname, uuid, username, email, status, created, updated, end time and labels) is shown.\nGroup Manager actions A Group Manager in IAM does not have the same privileges as the IAM Admin in managing groups.\nWhat they can do, beside being allowed to browse into the group details, is\napprove/reject membership requests delete users from their managed groups. ","categories":"","description":"","excerpt":"IAM provides a group management system, that can be used by IAM …","ref":"/v/v1.10.0/docs/tasks/administration/group-management/","tags":"","title":"Group Management"},{"body":"","categories":"","description":"IAM service deployment tasks \u0026 information\n","excerpt":"IAM service deployment tasks \u0026 information\n","ref":"/v/v1.10.0/docs/tasks/deployment/","tags":"","title":"IAM service deployment"},{"body":"IAM Test Client is a simple web application that demonstrates the use of the OpenID Connect client code and configuration.\nIt lives at https://your-IAM-instance/iam-test-client.\nSince Test Client uses OAuth Authorization Code Grant Type, after a successfull login you will be redirected to the consent page that the authorization server displays to confirm if the requested scopes can be shared with the client.\nIf you authorize, the following information will be shown:\nIn order to run the Test Client application you need to setup a minimal configuration.\n","categories":"","description":"OpenID Connect client application example\n","excerpt":"OpenID Connect client application example\n","ref":"/v/v1.10.0/docs/tasks/clientapp/","tags":"","title":"IAM Test Client application"},{"body":"Users can re-sign AUP at any time.\nRe-sign AUP using the dashboard Log into the service using user credentials:\nTo re-sign AUP click on Re-sign AUP button:\nTo confirm your choice click on I agree with the AUP terms button on the modal window:\nOn success you will get a confirmation message and AUP expiration will be updated:\n","categories":"","description":"","excerpt":"Users can re-sign AUP at any time.\nRe-sign AUP using the dashboard Log …","ref":"/v/v1.10.0/docs/tasks/user/resign-aup/","tags":"","title":"Re-sign AUP"},{"body":"IAM exposes the OpenID Connect/OAuth dynamic client registration functionality on its own dashboard (it has been migrated by MitreID dashboard).\nIn OAuth terminology, a client is an application or service that can interact with an authorization server for authentication/authorization purposes.\nA new client can be registered in the IAM in two ways:\nusing the dynamic client registration API; via the IAM dashboard (which simply acts as a client to the API mentioned above). Registering a client using the dashboard Log into the service and click on the My Clients link on the left navigation bar:\nFrom the My client link, select New client:\nA form will open that enable you to configure your client:\nThe minimum information you have to provide is:\nClient name: choose a name for your client Redirect URI(s): one or more redirect URIs for your client; these are required if you choose to enable the authorization code flow; Remember to select the offline_access scope from the Scopes tab if you want to request refresh tokens for the client being created:\nYou can then click the Save button at the bottom of the page:\nIAM will then generate client credentials for your client and other information that will be displayed as follows:\n","categories":"","description":"","excerpt":"IAM exposes the OpenID Connect/OAuth dynamic client registration …","ref":"/v/v1.10.0/docs/tasks/user/client-registration/","tags":"","title":"Registering a client"},{"body":"IAM supports brokered SAML authentication. When SAML authentication is turned on for an IAM instance, users can log into the service using the home Identity Provider (IdP) credentials.\nTo enable SAML authentication for your IAM instance you have to:\nChoose an entityId for your IAM instance; see the Shibboleth docs for guidance on this Generate a self-signed certificate for your IAM instance that will be used for SAML cryptographic operations and include it in a Java keystore; Obtain SAML metadata from your IdP or identity federation; If the metadata is signed, import the certificate that must be used to verify the signature in the Java keystore generated above; Enable the saml profile for the IAM and configure SAML support via the appropriate environment variables. Generate a Self-signed certificate To generate a self-signed certificate that lasts 5 years use the following openssl command:\nopenssl req -newkey rsa:2048 -nodes -x509 -days 1825 -keyout self-signed.key.pem \\ -out self-signed.cert.pem The above command will generate a private key and the corresponding certificate in PEM format. You will be asked to provide a subject for the certificate being generated.\nTo import this certificate in a Java keystore we need in in p12 format. Use the following commands to convert the certificate in p12 format and import it in a Java keystore:\nopenssl pkcs12 -export -inkey self-signed.key.pem \\ -name self-signed \\ -in self-signed.cert.pem \\ -out self-signed.p12 keytool -importkeystore -destkeystore self-signed.jks \\ -srckeystore self-signed.p12 \\ -srcstoretype PKCS12 During the above process you will be asked to provide a p12 export password and a keystore password. Use the same password, at least 6 characters long, otherwise it will not work for the java keystore.\nYou can list the contents of the keystore with the following command:\nkeytool -list -keystore self-signed.jks Obtain SAML metadata for your IdP or identity federation You IdP or identity federation will have a SAML metadata document describing, in SAML terms, which authentication flows are enabled and providing access to cryptographic material and other information that make the federated authentication schemes work reliably and securely. For more information on SAML metadata, see the Shibboleth metadata documentation.\nSigned metadata advice Typically identity federations sign the SAML metadata for security reasons, and provide a certificate (and linked public key) that can be used to verify signatures on the metadata at a well-known location (e.g., the federation website).\nTo support metadata signature verification you will need to import this certificate in the Java keystore created above.\nCertificates are typically published in PEM format, while to import a certificate in a Java keystore you will need it in DER format.\nThe following commands show how to import a PEM certificate into a Java keystore:\nopenssl x509 -outform der -in idem_signer_2019.pem -out idem_signer_2019.der keytool -import -alias idem_signer_2019 -keystore self-signed.jks -file idem_signer_2019.der Metadata configuration The IdP or federation metadata to be trusted can be specified with the IAM_SAML_IDP_METADATA environment variable, which contains an URL pointing to the metadata.\nIf the metadata is signed, you can enforce signature validation with the IAM_SAML_METADATA_REQUIRE_VALID_SIGNATURE variable.\nMetadata needs to be periodically refreshed to learn about new entities in the federation or updated key material. The metadata refresh interval can be specified with the IAM_SAML_METADATA_LOOKUP_SERVICE_REFRESH_PERIOD_SEC environment variable, which defines a refresh period in seconds (a reasonable value is typically refresh metadata every hour).\nAn example metadata configuration could be:\nIAM_SAML_IDP_METADATA=http://www.garr.it/idem-metadata/idem-metadata-sha256.xml IAM_SAML_METADATA_REQUIRE_VALID_SIGNATURE=true IAM_SAML_METADATA_LOOKUP_SERVICE_REFRESH_PERIOD_SEC=3600 IAM SAML attribute requirements IAM requires that the IdP used for authentication releases a persistent identifier attribute that can be used to link the external identity to local IAM accounts. If the IdP does not release persistent identifier attributes, it cannot be integrated with the IAM.\nThe attribute used to link the external SAML account is configurable. In the default configuration, IAM uses the following attributes (in the given order):\nEduPersonUniqueId EduPersonTargetedId EduPersonPrincipalName The order of these can be changed with the IAM_SAML_ID_RESOLVERS environment variable, which accepts a list of aliases for the attributes to be searched.\nThe following tables maps attribute names to the aliases currently supported:\nSAML attribute Alias EduPersonUniqueId eduPersonUniqueId EduPersonTargetedId eduPersonTargetedId EduPersonPrincipalName eduPersonPrincipalName EduPersonOrcid eduPersonOrcid spidCode spidCode The default value for IAM_SAML_ID_RESOLVERS is:\nIAM_SAML_ID_RESOLVERS=eduPersonUniqueId,eduPersonTargetedId,eduPersonPrincipalName Checking SAML assertion and authentication freshness IAM provides the ability to set a maximum age for SAML assertion and authentication statements received from IdPs.\nThe IAM_SAML_MAX_ASSERTION_TIME allows to define an upper bound (in seconds) on the SAML assertion lifetime, so that assertions that exceed such limit are considered invalid.\nThe IAM_SAML_MAX_AUTHENTICATION_AGE allows to define an upper bound (in seconds) on the authentication age linked to SAML authentication statements, so that users are forced to reauthenticate when this limit is exceeded.\nLimiting authentication only to selected IdPs IAM provides the ability to define constraints on which IdPs will be allowed for authentication. This is useful when you want to limit which IdPs in a large federation (e.g., EduGAIN) will be trusted for authentication.\nCurrently three types of IdPs limiting are supported:\nentity id whitelist SIRTFI compliance Research and Scholarship compliance Limiting by entity id The IAM_SAML_IDP_ENTITY_ID_WHITELIST environment variable can be used to define a comma-separated whitelist of IdPs entity IDs that will be trusted for authentication.\nThe following example limits trusted IdPs to the INFN IdP:\nIAM_SAML_IDP_ENTITY_ID_WHITELIST=\"https://idp.infn.it/saml2/idp/metadata.php\" Limiting by SIRTFI compliance To limit authentication only to IdPs that are SIRFTI-compliant, set the the IAM_SAML_METADATA_REQUIRE_SIRTFI environment variable to true.\nJoining a SAML federation An Indigo IAM instance can join a SAML federation as a service provider (SP). To join a feaderation you need to follow the following steps:\nConfigure the saml profile in IAM Register the Indigo IAM instance into the federation, following the federation instructions (generally involves connecting to a registration portal to declare the SP) Wait for the federation metadata to be updated at the federation IdPs. This typically involves a 12h delay. Check if login in IAM works successfully through the federation: note that it will not work before the federation IdPs have updated their metadata. If the error persists after the delay, contact your federation or IdP support. When registering the Indigo IAM SP, there are a few critical parameters to supply:\nAssertion Consumer Service (ACS), consisting of 3 parameters: Binding: must be HTTP Post URL: it is the instance URL + /saml/SSO, e.g. https://iam.example.com/saml/SSO Index: should be set to 0 X509 SAML certificate: the generated self-signed certificate Other, generally optional, parameters include the requested attribute. It is a good practice to declare as mandatory one of the attribute listed in IAM_SAML_ID_RESOLVERS.\nCustomizing SAML login button text You can customize the SAML login button text shown in the IAM login page with the IAM_SAML_LOGIN_BUTTON_TEXT environment variable.\nMinimal SAML configuration example IAM_SAML_ENTITY_ID=urn:example:iam-saml-example IAM_SAML_KEYSTORE=file:///self-signed.jks IAM_SAML_KEYSTORE_PASSWORD=xxxxxx IAM_SAML_KEY_ID=self-signed IAM_SAML_KEY_PASSWORD=xxxxxx IAM_SAML_IDP_METADATA=http://www.garr.it/idem-metadata/idem-metadata-sha256.xml IAM_SAML_METADATA_REQUIRE_VALID_SIGNATURE=true IAM_SAML_METADATA_LOOKUP_SERVICE_REFRESH_PERIOD_SEC=3600 IAM_SAML_LOGIN_BUTTON_TEXT=\"Sign in with IDEM\" Custom SAML configuration The configuration based on environment variables relies on a configuration template that fits most use cases embedded in the IAM war file.\nTo have full control on the SAML configuration, provide a custom application-saml.yml file in the IAM configuration directory.\nSee the configuration reference for more SAML metadata options and instructions on how to override the default IAM configuration.\nRegistration form: filling information from IdP See registration configuration.\n","categories":"","description":"","excerpt":"IAM supports brokered SAML authentication. When SAML authentication is …","ref":"/v/v1.10.0/docs/reference/configuration/external-authentication/saml/","tags":"","title":"SAML authentication"},{"body":"","categories":"","description":"Common user tasks\n","excerpt":"Common user tasks\n","ref":"/v/v1.10.0/docs/tasks/user/","tags":"","title":"User"},{"body":"JSON web keys are used by the IAM to sign and verify token signatures.\nTo generate a JSON web key for your IAM deployment, you can use the json-web-key-generator tool provided by MitreID connect.\nThe following command clones the json-web-key-generator Git repository to a local directory:\ngit clone https://github.com/mitreid-connect/json-web-key-generator Build the code with:\nmvn package Maven 3.6.x or greater supporting Java 11 is required.\nYou can then generate a key with the following command:\njava -jar target/json-web-key-generator-0.9-SNAPSHOT-jar-with-dependencies.jar \\ -t RSA -s 1024 -S -i rsa1 Full key: { \"keys\": [ { \"p\": \"3oh7ex6zgdmJh5NBD0IplmBDDGC2ECu2A1vcp8e8DqE7OSSpAc1T9tTjJioCGqkNM51JK_MtgCJz1CiysVDOQQ\", \"kty\": \"RSA\", \"q\": \"nRmBm5tQ2wmOtd1XUYDRH2qWai6eElt-1cvO5tnTdWZkFaAeaHQ3_xf_PFOjyAv5Y5rNLgf_Xbu9UCo_mSrDMQ\", \"d\": \"BGHRhQP6ADqqSrM8_mI0YhjGStj1aW9rLi7wXQMJ122kegPxIT7dfP-5UScxykD_BrCCHQVPxdJl5wXy-giZnhaL9wtDkOXb8D8RCi1n02cs3Z1T23xONi_AG47QPBZjM5GcX-oOGCENByuEIdkU_Bn6vvqM3oyVlj5sio7tNAE\", \"e\": \"AQAB\", \"kid\": \"rsa1\", \"qi\": \"RarXtTFCE3hk5ZanLWEapDnn7SLSxAvDcBTmG5SpCI9Eix7cfTigaK6N7OQIN0uGO1GJ-KVWL2v8dyI1jMoU6g\", \"dp\": \"MtBtieavzMXUzr2ETKyp_GmMxeXLjRO-IzQ1xaYpPhn5AQprATtWofVozQ0on9fcaN3QmJWV3T2Av4BvlWfDQQ\", \"dq\": \"CWJ7rpsBooQYpV6al8DVPUY1xBQS10_l7MmnC31Zt3qtYelVx7GhoriBQ85PS2UDueKGfUh3BddwQLi1YeX_EQ\", \"n\": \"iI_fuJq4z_9VQY5EH41sQWOAYUsjtxAFjRnAc1P5-GPOx3Izg9V7yKNmudLUt-jIkv6D5h-AzrhEV6DOdBRoiN4el1mCZ95jiJkjU2kpVOmutDysZkrn667zPd43w7E6IqHnahmMrVUjUyx6pie1SqJHLUXghz8Gle-1yi08_XE\" } ] } Save the output of the above command (minus the Full key: initial text) in a file, e.g. keystore.jwks.\nSee JSON Web Keys (JWK) reference page for more details about configuration of JSON web keys.\n","categories":"","description":"","excerpt":"JSON web keys are used by the IAM to sign and verify token signatures. …","ref":"/v/v1.10.0/docs/getting-started/jwk/","tags":"","title":"JSON Web Keys configuration"},{"body":"Starting with version 1.2.0, IAM supports defining an Acceptable Usage Policy Document (AUP) for a managed organization. The AUP is presented to applicants at registration time or periodically.\nManaging the AUP The AUP can be managed from the “AUP” section in the IAM dashboard, or via the AUP management API.\nAdministrator privileges are required.\nCreating the AUP By default, the AUP is not defined for an organization, i.e. it must be explicitly defined by an IAM administrator.\nThe AUP can be created by clicking on the “Create AUP” button in the AUP management page (that can be reached clicking the “AUP” link in the organization Management navigation bar):\nA dialog is shown:\nwhere the administrator can enter the AUP URL and define how frequently the AUP should be accepted by users.\nIf the AUP signature validity is set to 0, a signature on the AUP will be requested only once (either at registration time or at the first IAM login after the AUP creation). A zero value means basically that the AUP signature does not expire.\nA positive value in the AUP signature validity means, on the other hand, that the signature will expire after that number of days. As an example, an administrator that wants the AUP to signed each year by users should put 365 in the “AUP signature validity” field.\nEditing and deleting the AUP The AUP can be edited and deleted from the AUP management page:\nSince version 1.6.0, the AUP has been converted from text to a URL. If you have just upgraded to 1.6.0 and you have already defined a text AUP, you should see the following red message below your AUP:\nBy clicking on “Edit AUP”, admins are prompted to insert a valid URL.\nAs shown in the picture above, editing the AUP will not trigger an AUP signature request.\nRequest a signature from users If you want to request a signature from users for the updated AUP, use the “Request AUP signature” button in the AUP management page.\nA dialog is shown:\nConfirm by clicking on “Request AUP signature” and the acceptance of the AUP will be requested from ALL users at their next login.\nSigning the AUP Once defined the AUP text is shown to users for acceptance either at registration time:\nor at the first login after the AUP creation:\nRequest AUP signature Administrator can request user to sign AUP.\nAdministrator privileges are required.\nLog into the service using admin credentials and click on the Users link on the left navigation bar:\nFrom the Users link, select Any user you want to request AUP signature, for example Test-200 User:\nTo request AUP signature click on Request AUP signature button on User details section on the left of the page:\nTo confirm your choice click on Request AUP signature button on the modal window:\nOn success you will get a confirmation message:\nAfter this operation, if the user logs in, they must sign the AUP again before accessing the service.\nSign AUP on behalf of the user Administrator can sign AUP on behalf of the user.\nLog into the service using admin credentials and click on the Users link on the left navigation bar:\nFrom the Users link, select Any user you want to sign AUP on behalf, for example Test-200 User:\nTo sign AUP on behalf of the user click on Sign AUP on behalf of this user button on User details section on the left of the page:\nTo confirm your choice click on Sign AUP button on the modal window:\nOn success you will get a confirmation message:\n","categories":"","description":"","excerpt":"Starting with version 1.2.0, IAM supports defining an Acceptable Usage …","ref":"/v/v1.10.0/docs/tasks/administration/aup-management/","tags":"","title":"Acceptable Usage Policy (AUP) management"},{"body":"X509 authentication in IAM doesn’t require any specific configuration in IAM itself. It is enabled as soon as the proper options have been set in the Nginx configuration.\nFor the X509 authentication to work, it is critical that the user certificate CA is known to Nginx. If it is not part of the CAs configured in /etc/ssl, you may need to add the following line to your Nginx configuration:\nssl_client_certificate CA_certificates_file; where CA_certificates_file is the path to a file containing the certificates (in PEM format) of the CAs that must be accepted by Nginx.\n","categories":"","description":"","excerpt":"X509 authentication in IAM doesn’t require any specific configuration …","ref":"/v/v1.10.0/docs/reference/configuration/external-authentication/x509/","tags":"","title":"X.509 authentication"},{"body":"The IAM service is provided on the following DockerHub repositories:\nindigoiam/iam-login-service The docker image tag corresponding to this version of the documentation is:\nindigoiam/iam-login-service:v1.10.0\nThe IAM image has been tested to run properly with either Docker or Podman. The configuration for the IAM service container is the same but the details to run the container slightly differ. Differences are covered in the next sections. In both cases, it is highly recommended to enable SELinux for increased security.\nConfiguring the IAM service Prepare an environment file that will contain the environment variables settings for the IAM service container. See the configuration reference for a description of the variables.\nThis environment file will be passed to the container with the --env-file option of the container engine. You can choose whatever file path/name you want.\nRunning the container Docker First create a Docker network for the IAM service with the command (the example uses the network name iam but you are free to use another name as long as you use the same one in the runcommand). It has to be done once (not at every restart of the container):\n$ docker network create iam When using Docker the IAM service is run starting container with the following command:\n$ docker run -d \\ --name iam-login-service \\ --net=iam -p 8080:8080 \\ --env-file=/path/to/iam-login-service/env \\ -v /path/to/keystore.jks:/keystore.jks:ro \\ --restart unless-stopped \\ indigoiam/iam-login-service:v1.10.0 Note: --restart is recommended if you want the IAM service to restart automatically when the server running Docker is restarted.\nCheck the logs with:\n# Adapt the container name to the value you provided to --name in previous command $ docker logs -f iam-login-service Podman When using Podman, the docker command must be replaced by podman with the following differences in options:\n--restart is silently ignored as start/stop of the container at boot time is controlled with systemd (see Podman documentation, here).\nYou need to add option Z to third field of -v option so that the SELinux context type is properly managed and the use of the volume by another container is prevented.\nEnsure that the directories containing the environment file and the keystore are labeled. It can be checked with stat command. If they are unlabeled use the following command to fix it:\n$ chcon -R -t default_t /path/to/directory The required commands to start the container then become:\n$ podman network create iam # First time only $ podman run -d \\ --name iam-login-service \\ --net=iam -p 8080:8080 \\ --env-file=/path/to/iam-login-service/env \\ -v /path/to/keystore.jks:/keystore.jks:ro,Z \\ indigoiam/iam-login-service:v1.10.0 $ podman logs -f iam-login-service ","categories":"","description":"","excerpt":"The IAM service is provided on the following DockerHub repositories: …","ref":"/v/v1.10.0/docs/getting-started/docker/","tags":"","title":"Deployment with Docker"},{"body":"Backup The IAM data that needs to saved by a backup is:\ndatabase data; service configuration, typically maintained in an environment file: /etc/sysconfig/iam-login-service on CentOS, /etc/default/iam-login-service on Ubuntuu; the keystore used to sign JWT tokens: /var/lib/indigo/iam-login-service/keystore.jks; the SAML keystore, used when SAML authentication is enabled: /var/lib/indigo/iam/iam-login-service/example.ks. The above locations apply when installing from packages on CentOS or Ubuntu.\nAn example of backup script is given below:\ntimestamp=`date +'%Y-%m-%d_%H%M%S'` MYSQL_HOST=\"mydbhost\" MYSQL_USER=\"iamloginserviceuser\" MYSQL_PWD=\"iamloginservicepassword\" MYSQL_DBNAME=\"iamloginservicedb\" MYSQL_DUMP_OPTS=\"-u ${MYSQL_USER} -p${MYSQL_PWD} --host ${MYSQL_HOST}\" dumpfile=iam_dump.sql mysqldump ${MYSQL_DUMP_OPTS} ${MYSQL_DBNAME} \u003e ${dumpfile} tar czf iam_backup.tar.gz \\ ${dumpfile} \\ /etc/sysconfig/iam-login-service \\ /var/lib/indigo/iam-login-service/keystore.jks \\ /var/lib/indigo/iam/iam-login-service/example.ks The keystore paths can be customized, so adapt the backup script according your configuration.\nIf you are deploying IAM with Docker and use a volume to provide configuration to the service, backup the contents of such volume.\nRestore From the backup, import the database data from the SQL dump:\n$ export MYSQL_HOST=\"mydbhost\" $ export MYSQL_USER=\"iamloginserviceuser\" $ export MYSQL_PWD=\"iamloginservicepassword\" $ export MYSQL_DBNAME=\"iamloginservicedb\" $ mysql --host ${MYSQL_HOST} -u ${MYSQL_USER} -p${MYSQL_PWD} ${MYSQL_DBNAME} \u003c iam_backup/iam_dump.sql Deployment from packages To restore the IAM service from scratch, install the package.\nOn CentOS:\n$ sudo yum install -y iam-login-service Restore the environment file.\nOn CentOS:\n$ sudo cp iam_backup/etc/sysconfig/iam-login-service /etc/sysconfig/iam-login-service On Ubuntu:\n$ sudo cp iam_backup/etc/default/iam-login-service /etc/default/iam-login-service Copy the keystores in the correct path, according to your configuration:\n$ sudo cp iam_backup/var/lib/indigo/iam-login-service/keystore.jks /var/lib/indigo/iam-login-service/keystore.jks $ sudo cp iam_backup/var/lib/indigo/iam/iam-login-service/example.ks /var/lib/indigo/iam/iam-login-service/example.ks Ensure the keystores have the right ownership:\n$ sudo chown -R iam:iam /var/lib/indigo/iam-login-service Start the IAM Login Service daemon:\n$ sudo systemctl start iam-login-service Deployment with Docker Copy the files from the backup to the volume location:\n$ cp iam_backup/iam-login-service/env /path/to/iam-login-service/env $ cp iam_backup/keystore.jks /path/to/keystore.jks Start the container:\n$ docker run \\ --name iam-login-service \\ --net=iam -p 8080:8080 \\ --env-file=/path/to/iam-login-service/env \\ -v /path/to/keystore.jks:/keystore.jks:ro \\ indigoiam/iam-login-service:latest ","categories":"","description":"","excerpt":"Backup The IAM data that needs to saved by a backup is:\ndatabase data; …","ref":"/v/v1.10.0/docs/tasks/deployment/backup_restore/","tags":"","title":"Backup \u0026 Restore"},{"body":"IAM can be deployed from packages on the CentOS 7 platform. Packages and repo files are hosted on the INDIGO IAM package repository.\nWarning We no longer maintain packages for the Ubuntu platform. CENTOS 7 Install the INDIGO IAM release key: $ sudo rpm --import https://indigo-iam.github.io/repo/gpgkeys/indigo-iam-release.pub.gpg Install the repo files: $ sudo yum-config-manager --add-repo https://indigo-iam.github.io/repo/repofiles/rhel/indigoiam-stable-el7.repo Install packages: $ sudo yum makecache $ sudo yum install -y iam-login-service IAM service configuration The IAM service is configured via a configuration file named iam-login-service which holds the settings for the environment variables that drive its configuration (as described in the configuration reference section).\nThe file is located in the following path:\n/etc/sysconfig/iam-login-service Run the service The IAM login service is managed by systemd.\nTo enable the service use the following command:\n$ sudo systemctl enable iam-login-service To start the service use the following command:\n$ sudo systemctl start iam-login-service To access the service logs, use the following command:\n$ sudo journalctl -fu iam-login-service Deployment Tips In headless servers, running haveged daemon is recommended to generate more entropy. Before running the IAM login service, check the available entropy with:\n$ cat /proc/sys/kernel/random/entropy_avail If the obtained value is less than 1000, then haveged daemon is mandatory.\nInstall EPEL repository:\n$ sudo yum install -y epel-release Install Haveged:\n$ sudo yum install -y haveged Enable and run the haveged daemon with:\n$ sudo systemctl enable haveged $ sudo systemctl start haveged ","categories":"","description":"","excerpt":"IAM can be deployed from packages on the CentOS 7 platform. Packages …","ref":"/v/v1.10.0/docs/getting-started/packages/","tags":"","title":"Deployment with packages"},{"body":"Starting with version 1.6.0, IAM introduces support for basic account life cycle management.\nIt’s now possible to set an expiration time for IAM accounts. Once the account expires, login for the account is disabled.\nIAM can be configured to remove expired accounts after a configurable grace period.\nAccount end time settings By default, accounts in IAM do not have an end time set, i.e. the lifetime is unbounded.\nA default account validity period (e.g., 12 months) can be configured and will be set for users at registration time.\nThe relevant settings are managed by placing lifecycle directives in a custom configuration file:\nlifecycle: account: # 0 means unbounded validity account-lifetime-days: 0 # When true, the end time cannot be changed from IAM APIs and dashboard read-only-end-time: false expired-account-policy: # Accounts will be suspended after 7 days since expiration suspension-grace-period-days: 7 # When false, expired accounts are not removed remove-expired-accounts: true # Accounts will be removed after 30 days since expiration # (if remove-expired-accounts is true) removal-grace-period-days: 30 expired-accounts-task: # Internal cron schedule for the lifecycle task. # Default setting is every 5 mins cron-schedule: 0 */5 * * * * # To disable automatic account expiration set this to false enabled: true ","categories":"","description":"","excerpt":"Starting with version 1.6.0, IAM introduces support for basic account …","ref":"/v/v1.10.0/docs/reference/configuration/lifecycle/","tags":"","title":"Membership lifecycle"},{"body":"","categories":"","description":"IAM API \u0026 configuration reference documentation\n","excerpt":"IAM API \u0026 configuration reference documentation\n","ref":"/v/v1.10.0/docs/reference/","tags":"","title":"Reference"},{"body":"RCAuth.eu has been integrated with IAM in order to provide on-demand X.509 certificates to users without a certificate.\nRCAuth is basically an online Certificate Authority, which issues certificates to end-entities based on a successful authentication to a Federated Identity Provider, operated by an academic or research organization.\nIn particular, it extends the OAuth/OIDC specification to include the following endpoints:\nGetCert, to retrieve an X.509 end-entity certificate GetProxy, to retrieve a RFC3820 Proxy Certificate chain on behalf of the authenticated user.\nIAM deployment Configuration The basic configuration required on your IAM deployment to enable the integration of the service with RCAuth is\n# Enable integration with RCAuth. Default to false IAM_RCAUTH_ENABLED=true # Select the hostname of your certificate authority, e.g. https://eir.nikhef.nl/oauth2 IAM_RCAUTH_ISSUER= # A label for the certificate authority (not mandatory) IAM_RCAUTH_LABEL=RCAuth.eu online CA # Id of IAM client registered on RCAuth IAM_RCAUTH_CLIENT_ID= # Secret of IAM client registered on RCAuth IAM_RCAUTH_CLIENT_SECRET= Client registration An INDIGO IAM OAuth client has to be registered on the RCAuth service that will issue an X.509/proxy certificate.\nFor instance, in case of the demo RCAuth hosted at https://eir.nikhef.nl, one has to follow the next steps:\ngo to the Client Registration Page https://eir.nikhef.nl/oauth2/register that will be shown after a successful login with your institutional Identity Provider (e.g. the INFN AAI);\nfill the form with the details of your client. Important fields are\nCallback URLs: https://\u003ciam-hostname\u003e/rcauth/cb; Scopes: openid, edu.uiuc.ncsa.myproxy.getcert; after the request has been submitted, the service will generate a client ID and secret that has to be set in the IAM_RCAUTH_CLIENT_ID and IAM_RCAUTH_CLIENT_SECRET environment variables respectively;\nwait for the manual approval of your client registration.\nIAM user interface The RCAuth issued certificate is listed in the X.509 certificates tab of the IAM homepage.\nTo add a new certificate click the Request certificate button.\nThe user will be redirected to the RCAuth instance to authenticate and give consent for the generation of an X.509 certificate, which will be accessible by IAM.\nThus, IAM links the certificate to the user’s dashboard, as shown in the example below.\nA long-lived plain proxy obtained by the linked X.509 certificate is automatically stored into the IAM database.\nThis is shown in the IAM dashboard when the “Has managed proxy certificate” string is set to true (as in the image above).\nThe proxy certificate can be downloaded from IAM using the Proxy certificate API.\n","categories":"","description":"","excerpt":"RCAuth.eu has been integrated with IAM in order to provide on-demand …","ref":"/v/v1.10.0/docs/reference/configuration/rcauth/","tags":"","title":"Integration with RCAuth"},{"body":"IAM implements a basic registration service that requires the intervention of an IAM admin. In fact, when users apply for membership in an organization, administrators are asked to validate membership requests.\nRegistration with external IdP When an external OIDC or SAML IdP is used to authenticate users, IAM allows to configure:\nWhether users are required to authenticate through an external IdP and optionally which ones Which information must be retrieved from the IdP to fill the account creation form This is done by creating a YAML file in /indigo-iam/config, for example /indigo-iam/config/application-registration.yaml. When deploying IAM with a container, a volume providing this file must be mapped into the container.\nThe contents in this file must be under the following hierarchy:\niam: registration: Requiring external authentication To require that users must authenticate through an external IdP, you need to set the parameter require-external-authentication=true. You can also specify the type of external IdP (oidc or saml) and require one specific issuer.\nThe following fragment is an example of authentication with the (OIDC-based) CERN SSO required before being redirected to the registration page. It also defines how information from identity tokens issued by CERN SSO is mapped to IAM membership information\niam: registration: require-external-authentication: true oidc-issuer: https://auth.cern.ch/auth/realms/cern authentication-type: oidc Filling information from IdP The first time a user authenticates in an IAM instance, the account creation form will be displayed. It is possible to request that some of the fields are filled with the value of an IdP attribute and to define that some of these fields are read-only, i.e. that the value provided by the IdP cannot be changed.\nTo enable filling the creation form with values provided by the IdP, you need to create a YAML file in /indigo-iam/config, for example /indigo-iam/config/application-registration.yaml. The contents should be something similar to:\niam: registration: fields: email: read-only: false external-auth-attribute: email name: read-only: false external-auth-attribute: given_name surname: read-only: false external-auth-attribute: family_name username: read-only: false external-auth-attribute: preferred_username read-only can be set to true if you want to prevent that the value provided supplied by the ID is modified by the user. Note that if a field is defined as read-only=true and now value is not provided by the IdP, it may result that the user cannot submit the account creation form if the field, when it is required.\nexternal-auth-attribue must be the name of the IdP attribute, or token claim (when provided by SAML IdPs, or OIDC Providers, respectively) to use for the mentioned account creation form field.\nAutomatic enrollment through SAML IdPs In case of registration through an external SAML Identity Provider, IAM offers a flexible user enrollment flow, also without IAM admin intervention. The default IAM behavior is that the user enrollment requires an administrator approval step.\nIn order to enable the automatic enrollment flow via an external IdP, one should set the following properties, under the saml hierarchy:\nsaml: jit-account-provisioning: enabled: true # this will consider as trusted all the IdPs declared in your # application-saml.yml file trusted-idps: all In order to directly declare the list of trusted SAML IdPs, a comma separated list of entity IDs have to be set, e.g. saml.jit-account-provisioning.trusted-idps=idp1,idp2,idp3.\nUser editable fields Starting with version 1.6.0, IAM allows to limit which fields of the user profile are editable by users.\nThe default, backward-compatible settings that allow users to edit all their profile fields are defined as follows:\niam: user-profile: editable-fields: - email - name - picture - surname To prevent modifications to any of the fields remove the field name from editable-fields list.\nExternal configuration can be managed by placing directives as shown above in a custom configuration file\nAutomatically set the nickname as attribute Since IAM v1.9.0, during a registration request the username can be automatically added as an attribute named nickname. This process happens both for login with external provider, or when one directly clicks on the Apply for an account button. The nickname value will be the same as the username set during the registration request.\nThis behavior does not appear by default. To enable it, add to your config file\niam: registration: add-nickname-as-attribute: true or set the environment variable IAM_ADD_NICKNAME_AS_ATTRIBUTE=true.\nOnce the new IAM user has been created, the Attributes view from the dashboard looks like the following\n","categories":"","description":"","excerpt":"IAM implements a basic registration service that requires the …","ref":"/v/v1.10.0/docs/reference/configuration/registration/","tags":"","title":"Registration \u0026 Enrollment"},{"body":"IAM already supports a set of SCIM APIs based on the System for Cross-domain Identity Management standard. Starting from IAM v1.9.0, the API response to GET requests on user details (i.e. /scim/Me and /scim/Users) are extended with more information. All the new details are included into the IndigoUser field. To enable this feature, dedicated properties (or environment variables) must be used to maintain backward compatibility.\nThe list of information that may be included into the SCIM response are:\nuser’s autorities set of user-managed groups set of user’s attributes. Authorities In order to include the list of user’s authorities (i.e. ROLE_USER, ROLE_ADMIN, ROLE_GM:\u003cgroup-uid\u003e, etc.) into the SCIM response, one should set the following property (default is false):\nscim: include_authorities: true or the environment variable IAM_SCIM_INCLUDE_AUTHORITIES=true.\nThen, an example of SCIM Me output for an administrator user is the following:\n{ \"id\": \"73f16d93-2441-4a50-88ff-85360d78c6b5\", \"meta\": { ... }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], ... \"userName\": \"admin\", ... \"active\": true, \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"oidcIds\": [ ... ], \"samlIds\": [ ... ], \"certificates\": [ ... ], \"authorities\": [ \"ROLE_ADMIN\", \"ROLE_USER\" ] } } Managed groups In order to include the list of user-managed groups into the SCIM response, one should set the following property (default is false):\nscim: include_managed_groups: true or the environment variable IAM_SCIM_INCLUDE_MANAGED_GROUPS=true.\nThen, an example of SCIM Me output for a group manager is the following:\n{ \"id\":\"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"meta\":{ ... }, \"schemas\":[ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], ... \"userName\": \"gm-user\", ... \"active\": \"true\", \"urn\":\"indigo-dc:scim:schemas:IndigoUser\":{ \"oidcIds\":[ ... ] \"samlIds\":[ ... ], \"endTime\": \"2024-08-06T02:00:00.000+02:00\", \"managedGroups\":[ { \"display\":\"Analysis\", \"value\":\"6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\", \"$ref\":\"http://localhost:8080/scim/Groups/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\" }, { \"display\":\"Production\", \"value\":\"c617d586-54e6-411d-8e38-64967798fa8a\", \"$ref\":\"http://localhost:8080/scim/Groups/c617d586-54e6-411d-8e38-64967798fa8a\" } ] } } Attributes In order to include the list of user’s attributes, selected by attribute name, into the SCIM response, one should set the following property (default is false):\nscim: include_attributes: - name: nickname - name: another-attribute-name Then, an example of SCIM Me output for an IAM user is the following:\n{ \"id\":\"d836e5ec-246c-456c-8476-923ee2f831c8\", \"meta\":{ ... }, \"schemas\":[ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], ... \"userName\": \"tester\", ... \"active\": \"true\", \"urn\":\"indigo-dc:scim:schemas:IndigoUser\":{ \"oidcIds\":[ ... ] \"samlIds\":[ ... ], \"endTime\": \"2024-08-06T02:00:00.000+02:00\", \"attributes\":[ { \"name\":\"nickname\", \"value\":\"tester\" } ], \"endTime\": \"2024-08-06T02:00:00.000+02:00\" } } In this example the user has only one attribute, named nickname, so the second attribute (another-attribute-name) is not shown into the SCIM response.\n","categories":"","description":"","excerpt":"IAM already supports a set of SCIM APIs based on the System for …","ref":"/v/v1.10.0/docs/reference/configuration/scim-response/","tags":"","title":"Handling SCIM response"},{"body":"","categories":"","description":"Common administration \u0026 usage tasks\n","excerpt":"Common administration \u0026 usage tasks\n","ref":"/v/v1.10.0/docs/tasks/","tags":"","title":"Tasks"},{"body":"Most configurable aspects of the IAM are configured via environment variables and Spring profile directives. For a detailed reference of all the options, see the configuration reference.\nAt the bare minimum you should enable the registration service to let users register at your organisation (but you can leave it disabled and add users manually to the organisation using the IAM dashboard if you prefer).\nA minimal example configuration is given below:\nIAM_JAVA_OPTS=-Dspring.profiles.active=prod,registration -Djava.security.egd=file:/dev/./urandom IAM_HOST=iam.local.io IAM_BASE_URL=https://iam.local.io IAM_ISSUER=https://iam.local.io IAM_FORWARD_HEADERS_STRATEGY=native IAM_KEY_STORE_LOCATION=file:/keystore.jwks IAM_DB_HOST=db IAM_DB_NAME=iam IAM_DB_USERNAME=iam IAM_DB_PASSWORD=*********** IAM_NOTIFICATION_FROM=iam@iam.local.io IAM_NOTIFICATION_ADMIN_ADDRESS=iam-administrators@mail.example IAM_MAIL_HOST=smtp.mail.example and has the following meaning:\nIAM_JAVA_OPTS is used to select active profiles (prod, registration) and tell the JVM to use /dev/urandom as the random number generator; IAM_HOST is the host where the IAM will listen for request; this is the hostname of the machine exposed to the internet; IAM_BASE_URL is the base URL where the IAM web application will live; the value for this is typically https://${IAM_HOST}; IAM_ISSUER is the OpenID-connect issuer for the tokens issued by the IAM; we recommend using the same setting as IAM_BASE_URL, i.e. https://${IAM_HOST}; IAM_FORWARD_HEADERS_STRATEGY tells the IAM that whether it lives behind a reverse proxy (i.e., NGINX); in production the value is typically native; IAM_KEY_STORE_LOCATION is the location of the JSON Web keystore generated as explained here; IAM_DB_* are variables used to set the database endpoint and provide database access credentials; IAM_NOTIFICATION_FROM sets the sender of administrative notification sent by the IAM; IAM_NOTIFICATION_ADMIN_ADDRESS sets the email address that will receive administrative notifications from the IAM; IAM_MAIL_HOST is the SMTP server that IAM will use to deliver notifications. Deploying and starting the IAM service with the above configuration will give you an empty service with just one user registered, the admin user.\nWarning As a first thing you should login in the IAM with the following credentials:\nusername: admin password: password and change the password for the admin user, clicking on the Change password button from the admin home page, as shown in the following picture:\n","categories":"","description":"","excerpt":"Most configurable aspects of the IAM are configured via environment …","ref":"/v/v1.10.0/docs/getting-started/basic_setup/","tags":"","title":"Basic IAM setup"},{"body":"IAM has the ability to enable or disable the client registration, and to limit the registration to certain users. The default behavior is that anyone can register a client, even anonymous users.\nTo have control over the below properties using the environment variables, please check the Configuration section.\nDisable client registration In order to totally disable the client registration, set\niam: client-registration: enable: false The client registration is enabled by default in IAM.\nSpecify who can register a client In order to specify who can register a client, please set one among ANYONE, REGISTERED_USERS or ADMINISTRATORS such to limit to all, IAM users or administrators only the client registration\niam: client-registration: allow-for: \u003cANYONE|REGISTERED_USERS|ADMINISTRATORS\u003e The client registration is enabled for anyone by default.\nDefault settings of a new client For any newly registered client, the default value of the related access token, device code, ID token and refresh token lifetimes can be set trough the following properties\niam: client-registration: client-defaults: # IAM default is 1 hour default-access-token-validity-seconds: 3600 # IAM default is 10 minutes default-device-code-validity-seconds: 600 # IAM default is 10 minutes default-id-token-validity-seconds: 600 # IAM default is 30 days default-refresh-token-validity-seconds: 2592000 The above values can be changed per client trough web interface or API by an IAM administrator.\n","categories":"","description":"","excerpt":"IAM has the ability to enable or disable the client registration, and …","ref":"/v/v1.10.0/docs/reference/configuration/client-registration/","tags":"","title":"Client registration"},{"body":"JSON Web Key (JWK) is a JSON data structure that represents a single public key or a set of public keys. IAM uses private JWKs to sign tokens, and IAM clients use public JWKs to validate the tokens. A JWK Generator can be used to generate new keys.\nKeystore Location JWKs are stored in a file that is called keystore. All the keys in this file will be used for validating the tokens. Keystore location is set using the IAM_KEY_STORE_LOCATION environment variable, e.g.:\nIAM_KEY_STORE_LOCATION=file:///secrets/jwk/keystore.jwks Default Key ID (kid) If there are multiple JWKs in the keystore, IAM_JWK_DEFAULT_KEY_ID environment variable can be set to choose the key that signs the tokens, e.g.:\nIAM_JWK_DEFAULT_KEY_ID=rsa2 If this variable is not set it will use the default value rsa1.\nDefault JWE Keys JSON Web Encryption (JWE) represents encrypted content using JSON-based data structures. JWE allows to encrypt the JWT tokens so that only the intended recipient can decrypt and see the content.\nDefault JWE decrypt key and encrypt key id can be set using the IAM_JWK_DEFAULT_JWE_DECRYPT_KEY_ID and IAM_JWK_DEFAULT_JWE_ENCRYPT_KEY_ID environment variables respectively, e.g.:\nIAM_JWK_DEFAULT_JWE_DECRYPT_KEY_ID=jwe-decrypt IAM_JWK_DEFAULT_JWE_ENCRYPT_KEY_ID=jwe-encrypt Default Algorithms Default alorithms used for signing and encrypting the key can be set using IAM_JWK_DEFAULT_JWS_ALGORITHM and IAM_JWT_DEFAULT_JWE_ALGORITHM environment variables respectively, default algorithms are like following:\nIAM_JWK_DEFAULT_JWS_ALGORITHM=RS256 IAM_JWT_DEFAULT_JWE_ALGORITHM=RSA_OAEP_256 Rotating Keys To change the JWKs without any interruption on the service, a rolling update can be done using these configurations. Below is an example of a rolling update.\nAt the beginning there is one JWK in the keystore but it needs to be changed (e.g. regular update or because of a security instance, etc.). For example:\n{ \"keys\": [ { \"p\": \"7IsuNM1T2G83isHFmV8zNUri2x3xLBBT3gbA5905owUTqzqHsj7QJw8GqnadNse9G3FRFLB-ShNq64yvr7hXPO35E5HSrRsWKxYgzdPKPdl-M5xc6O-QQlKmkmje_r82M5KGbDpV_uBjoQHPGMxME6MlFaYtCFSd_keKvzpkev8\", \"kty\": \"RSA\", \"q\": \"6Q5OunfOfXqkvKdh-mUysuS5jJY4t18MAO9KLcH5wIH4iV2FmasEeqB0g0LSNrgitv9icGhQiRUVR8dqpATBgrhZiQlB1KneUdIe8W_QQQVhA_tqJgEuAb_kl8QDHvIyXAs8onYCSDtgSD6gw-qDivGpf7TzXZcosWrgSQDYi9k\", \"d\": \"DUSnJ_OYFqBG9gDzcj20RLPJj-CT6kqH0nh4zQIRV9mB2XkVsWk0mlo4tauqBXT8lrTN5ACyaIhFMItDqkApJeBtvyMf3E8G3tBEQnwEa8HABcCd54ZzC94t-U-pazXvoqpNxEfu6qCFFdV7u-0OgDmYbTT6_c4jDQ9jTZozuzxoh_qv6iOijBJ62yJLf4kvIOB-ghYwig6Cz1OLSgh_Y8EIO-6wk-aSZWXS7l7xnM7_8BBOzKxVG73YfPQi-9fPVnee8Cijd3RU5_uUw4yh5I87wYZzPzN3gK6Pazf6BZ-9vs1SboEyeVtd3TiOB2aBOyS4Ntohj6eljsfXEHYN4Q\", \"e\": \"AQAB\", \"kid\": \"rsa1\", \"qi\": \"oMPC-4NyoDZge2bOL5SHaSNKyrcnpC1XKctcxN64lRql5zETC30Nuq0zJWwFQQfVgkS8fiMRV1NEMy98EbTAj8k63PBfp5jywIx5atQFjZ101tYEsxHG4bfAuTxIwUFALS3KLIHyGAlTognRZ3UWNX0FHwH2AJUS0LJdbCuHqGA\", \"dp\": \"fn0Kj1fA3zrRw5RMuvAKbRQHbU58mah9gHuyCgrleEQNuYGJ8IngOxKw6NSWyyVR_WvCBMNANRJfGWhYxilYFQ_YIlvXAZQ7bXzeu9HmEt7LuoOBt1nrlVunESGdJTJQpJFU6mjjdXC-NenGuab9g365JPOAnzTIa6IMEqgB9Tc\", \"dq\": \"134JQdXBsriSVnYW3GZySIPBJcNJUhSqjrqzxjeT7XLAEpPNEtfU3mY7FZvVsA722mqt5O4veXFrKeG0M1DKdUpsT4-ltTQUg2dcgTY4Q8bre7ke32E73xZGEiaGFDkyY3VobXfciFmOn355PG49j14AsjroxGMel14RYK9Ni5E\", \"n\": \"11flaUmrserMifKmz8ONBbWWfCRAFjerniHvW1kIXP62hVI8xDWipojhLo7Ai-tV0jA4WSyodlfaA1NRXzZbbAC8pOOpPGkwLBHyOhcB4zpwTykvz5Ype3Mex20XIdBAc0DR4i8d9ZEpnIBqmPcmwP0gANmX82RZd3gZKxQ-umfDXZdNJqy2g1kawRjIP_CpznYzX8MY1OCfjZYXXsZvVeC2v0pRRre9tJEilCZEBY42jJyf6bY2cZhu2KTIpIx1_8Y2JB6AAAdnPsEgNRxMe0g5ShCmDvc93m9GsLZSy4Nm0pOWWVbx7-JK6-QWBdaiG_fAT_2OOndDL-hL1Ry3Jw\" } ] } Firstly, new JWK should be added to the keystore using the file in the IAM_KEY_STORE_LOCATION. The IAM_JWK_DEFAULT_KEY_ID should still be left as the key id of the old key. This way all the clients can cache the new public key. Before the next step, waiting as long as the agreed policy for key caching for the infrastructure would be enough to make sure every client cached the new key.\nSo new keystore in the example would be:\n{ \"keys\": [ { \"p\": \"7IsuNM1T2G83isHFmV8zNUri2x3xLBBT3gbA5905owUTqzqHsj7QJw8GqnadNse9G3FRFLB-ShNq64yvr7hXPO35E5HSrRsWKxYgzdPKPdl-M5xc6O-QQlKmkmje_r82M5KGbDpV_uBjoQHPGMxME6MlFaYtCFSd_keKvzpkev8\", \"kty\": \"RSA\", \"q\": \"6Q5OunfOfXqkvKdh-mUysuS5jJY4t18MAO9KLcH5wIH4iV2FmasEeqB0g0LSNrgitv9icGhQiRUVR8dqpATBgrhZiQlB1KneUdIe8W_QQQVhA_tqJgEuAb_kl8QDHvIyXAs8onYCSDtgSD6gw-qDivGpf7TzXZcosWrgSQDYi9k\", \"d\": \"DUSnJ_OYFqBG9gDzcj20RLPJj-CT6kqH0nh4zQIRV9mB2XkVsWk0mlo4tauqBXT8lrTN5ACyaIhFMItDqkApJeBtvyMf3E8G3tBEQnwEa8HABcCd54ZzC94t-U-pazXvoqpNxEfu6qCFFdV7u-0OgDmYbTT6_c4jDQ9jTZozuzxoh_qv6iOijBJ62yJLf4kvIOB-ghYwig6Cz1OLSgh_Y8EIO-6wk-aSZWXS7l7xnM7_8BBOzKxVG73YfPQi-9fPVnee8Cijd3RU5_uUw4yh5I87wYZzPzN3gK6Pazf6BZ-9vs1SboEyeVtd3TiOB2aBOyS4Ntohj6eljsfXEHYN4Q\", \"e\": \"AQAB\", \"kid\": \"rsa1\", \"qi\": \"oMPC-4NyoDZge2bOL5SHaSNKyrcnpC1XKctcxN64lRql5zETC30Nuq0zJWwFQQfVgkS8fiMRV1NEMy98EbTAj8k63PBfp5jywIx5atQFjZ101tYEsxHG4bfAuTxIwUFALS3KLIHyGAlTognRZ3UWNX0FHwH2AJUS0LJdbCuHqGA\", \"dp\": \"fn0Kj1fA3zrRw5RMuvAKbRQHbU58mah9gHuyCgrleEQNuYGJ8IngOxKw6NSWyyVR_WvCBMNANRJfGWhYxilYFQ_YIlvXAZQ7bXzeu9HmEt7LuoOBt1nrlVunESGdJTJQpJFU6mjjdXC-NenGuab9g365JPOAnzTIa6IMEqgB9Tc\", \"dq\": \"134JQdXBsriSVnYW3GZySIPBJcNJUhSqjrqzxjeT7XLAEpPNEtfU3mY7FZvVsA722mqt5O4veXFrKeG0M1DKdUpsT4-ltTQUg2dcgTY4Q8bre7ke32E73xZGEiaGFDkyY3VobXfciFmOn355PG49j14AsjroxGMel14RYK9Ni5E\", \"n\": \"11flaUmrserMifKmz8ONBbWWfCRAFjerniHvW1kIXP62hVI8xDWipojhLo7Ai-tV0jA4WSyodlfaA1NRXzZbbAC8pOOpPGkwLBHyOhcB4zpwTykvz5Ype3Mex20XIdBAc0DR4i8d9ZEpnIBqmPcmwP0gANmX82RZd3gZKxQ-umfDXZdNJqy2g1kawRjIP_CpznYzX8MY1OCfjZYXXsZvVeC2v0pRRre9tJEilCZEBY42jJyf6bY2cZhu2KTIpIx1_8Y2JB6AAAdnPsEgNRxMe0g5ShCmDvc93m9GsLZSy4Nm0pOWWVbx7-JK6-QWBdaiG_fAT_2OOndDL-hL1Ry3Jw\" }, { \"p\": \"04huYoKFVGrsAaJ2djo8YUnmdbz4_Dt5a3A1r32dZhcY6gJYLtQmLzzSt1m7Z3p8UsZ8eerDBYFQYWlMIDhmsNCeKw5kE6LuSi1JGE3boveKcIpBrI5oxIduZUTr8QBltcKuklzR_Nra-JIrR_Nkgd6nA7C7VPC3MDSmQpbAyx8\", \"kty\": \"RSA\", \"q\": \"0wOm2SerufATV0ZWKOZmAgWlQ9qPATVn-FuZsEKMw4LOjlYba63iuHPWhcvgEJEgqP4DKrCn49HI95eDbYpoCpfYDCBNN8K7Q_k3P8T7a_FN-xNc9OtG80lNiFb93CSwJndGhsXoaLjGFcTpIC9RnPzi_tC3OSvdHaXgymkwEyU\", \"d\": \"F02mbTRlQ9J5DKkCfCgkkE_KLOmAr5VTkh2fhOZwsZ78_CNlK1NBr1a0tNpdZbn0Rt31oKLHKhfw6DcV2koso3IZVJynHHvlX3DPI8f6csXLJZGKhG7Zh6X-WnibD65h9nZo8QUd_uRdEfx6aqxPNzVKxeAX6lh7pkvkSRB7zoX_H5Vf7pn9fWXzLDB1BQacFRtdqnEpiLur-Z1CcjC68DcRGrl-EqA37ZohnVPD7T7Lw14V_nfz5rrQZGqLImCOy5Daz4ZuRBXaiR47fkWfyy7PSLnwIAHIe24328zDygNSYohw84iY0440xlAutU8wSWhrMpn4PWB_fWKiFnbiCQ\", \"e\": \"AQAB\", \"kid\": \"rsa2\", \"qi\": \"CnkIYAjTvJ7FS0uQgzTDtdMhi87s5r2wbGjg82HUWyRDsb7Xadf85K0aqgc5UKiM-ZHA-uc9PMDyxxnxAz4MrxVr12Gx2SS_dPFoPYVnr2jE9nQLWDUqitES1NMozhTsngmfVfgux9Rr4-rJFHP10jU9hjh9ELyv4BGoopFaFYU\", \"dp\": \"PKRMIOmSF5Vfe0h79YDUdn-dFfvK1WSndmmAuoKkcPQGLG_nn-Up3Tjun6mV1CCFK6XDYaAvsJBV3tc0_7ermNz1uxoxDoATGCjLX7BSWvHkOkcodLOOzWiV-Wo8yaZ3ghgBu-voNzj2tXQR_FqGYcTW1HQCAGPR4Hv3ffeB5bk\", \"dq\": \"T0fM9UPJane_3IeJsZ4270WNvTuthQe6w34u9SFb380SrDm_3aocR68GB4j861yLh9K__9cVjSvxtMyRTaO1yV0ZiBzOxkd8smI9FtF8oSatZMr2nvKS2q9M2Q_OG1sRb7JapiJPWqEpk15DNJtyr2f4JULnxCwtzIjZN1NkA50\", \"n\": \"rlx3cmO8jN3q32ndXusuoWb7MrMXgEcsJVQiU_BhgNpYEJyyA5QBmH01y04_itbCvBzGHll8y768Zv76ohgcOOW_XtdlPyF1-GgBxVg-Ro-tj5zdP4znFXfNRn6ZGY60lvCFfh3XX-eQp7EZQbHI-wRask991d2-56PzorrJWHiYLza-C87MG-i2hxyQUs5vsdl92J1pqm8_4mjRZhARBQWGXlB-80TdsG3Tl5MliaHdWNJWQ_f43TfG0OfbiCtFITIoHMESL4IO9AxygnYznPXWIoWMsXpsEKUcOgzNqhngQWe9rvJKG5Cy0O0Y0-IJexTEuF68CZpwGra75cCoew\" } ] } In this example IAM_JWK_DEFAULT_KEY_ID=rsa1 is kept unchanged.\nSecondly, after the new key is cached by all of the clients, the signing key should be changed as the new key via the IAM_JWK_DEFAULT_KEY_ID variable. The old key should still be kept in the keystore, otherwise all the current tokens would stop working. Before removing it from the key store, waiting as long the longest allowed token lifetime would be enough for the old tokens to expire and the clients will be left with only tokens that are signed with new key.\nSo in the example default key should be set as IAM_JWK_DEFAULT_KEY_ID=rsa2.\nAs the last step, old key can be removed from the keystore. So only the tokens that were signed with the new key will be valid after this.\nSo the keystore would be like following:\n{ \"keys\": [ { \"p\": \"04huYoKFVGrsAaJ2djo8YUnmdbz4_Dt5a3A1r32dZhcY6gJYLtQmLzzSt1m7Z3p8UsZ8eerDBYFQYWlMIDhmsNCeKw5kE6LuSi1JGE3boveKcIpBrI5oxIduZUTr8QBltcKuklzR_Nra-JIrR_Nkgd6nA7C7VPC3MDSmQpbAyx8\", \"kty\": \"RSA\", \"q\": \"0wOm2SerufATV0ZWKOZmAgWlQ9qPATVn-FuZsEKMw4LOjlYba63iuHPWhcvgEJEgqP4DKrCn49HI95eDbYpoCpfYDCBNN8K7Q_k3P8T7a_FN-xNc9OtG80lNiFb93CSwJndGhsXoaLjGFcTpIC9RnPzi_tC3OSvdHaXgymkwEyU\", \"d\": \"F02mbTRlQ9J5DKkCfCgkkE_KLOmAr5VTkh2fhOZwsZ78_CNlK1NBr1a0tNpdZbn0Rt31oKLHKhfw6DcV2koso3IZVJynHHvlX3DPI8f6csXLJZGKhG7Zh6X-WnibD65h9nZo8QUd_uRdEfx6aqxPNzVKxeAX6lh7pkvkSRB7zoX_H5Vf7pn9fWXzLDB1BQacFRtdqnEpiLur-Z1CcjC68DcRGrl-EqA37ZohnVPD7T7Lw14V_nfz5rrQZGqLImCOy5Daz4ZuRBXaiR47fkWfyy7PSLnwIAHIe24328zDygNSYohw84iY0440xlAutU8wSWhrMpn4PWB_fWKiFnbiCQ\", \"e\": \"AQAB\", \"kid\": \"rsa2\", \"qi\": \"CnkIYAjTvJ7FS0uQgzTDtdMhi87s5r2wbGjg82HUWyRDsb7Xadf85K0aqgc5UKiM-ZHA-uc9PMDyxxnxAz4MrxVr12Gx2SS_dPFoPYVnr2jE9nQLWDUqitES1NMozhTsngmfVfgux9Rr4-rJFHP10jU9hjh9ELyv4BGoopFaFYU\", \"dp\": \"PKRMIOmSF5Vfe0h79YDUdn-dFfvK1WSndmmAuoKkcPQGLG_nn-Up3Tjun6mV1CCFK6XDYaAvsJBV3tc0_7ermNz1uxoxDoATGCjLX7BSWvHkOkcodLOOzWiV-Wo8yaZ3ghgBu-voNzj2tXQR_FqGYcTW1HQCAGPR4Hv3ffeB5bk\", \"dq\": \"T0fM9UPJane_3IeJsZ4270WNvTuthQe6w34u9SFb380SrDm_3aocR68GB4j861yLh9K__9cVjSvxtMyRTaO1yV0ZiBzOxkd8smI9FtF8oSatZMr2nvKS2q9M2Q_OG1sRb7JapiJPWqEpk15DNJtyr2f4JULnxCwtzIjZN1NkA50\", \"n\": \"rlx3cmO8jN3q32ndXusuoWb7MrMXgEcsJVQiU_BhgNpYEJyyA5QBmH01y04_itbCvBzGHll8y768Zv76ohgcOOW_XtdlPyF1-GgBxVg-Ro-tj5zdP4znFXfNRn6ZGY60lvCFfh3XX-eQp7EZQbHI-wRask991d2-56PzorrJWHiYLza-C87MG-i2hxyQUs5vsdl92J1pqm8_4mjRZhARBQWGXlB-80TdsG3Tl5MliaHdWNJWQ_f43TfG0OfbiCtFITIoHMESL4IO9AxygnYznPXWIoWMsXpsEKUcOgzNqhngQWe9rvJKG5Cy0O0Y0-IJexTEuF68CZpwGra75cCoew\" } ] } With this update method, the service is not interrupted for any user and the key is replaced with a new one.\n","categories":"","description":"","excerpt":"JSON Web Key (JWK) is a JSON data structure that represents a single …","ref":"/v/v1.10.0/docs/reference/configuration/jwk/","tags":"","title":"JSON Web Keys (JWK)"},{"body":"IAM has the ability to limit or disable authentication with local IAM credentials, so that external, brokered authentication is required.\nIt’s possible to hide the local login form from the IAM login page and also to control for which users local authentication is enabled (all users, VO administrators, no users).\niam: local-authn: # possible values for enabled-for: all, vo-admins, none enabled-for: vo-admins # possible values: hidden, hidden-with-link, visible login-page-visibility: hidden In alternative, one can configure the local authentication settings using environment variables as described in the Configuration section.\nWhen the local authentication (username/password) fields are hidden on the login page, it is possible to display them by adding the query string ?sll=y to the login page URL. It may be useful, for example, to access the admin account if only username/password authentication has been configured for it and if enable-for has been set to vo-admins.\nNote that hiding local authentication on the login page without restricting the category of users able to use it doesn’t really provide additional security.\n","categories":"","description":"","excerpt":"IAM has the ability to limit or disable authentication with local IAM …","ref":"/v/v1.10.0/docs/reference/configuration/local_authn/","tags":"","title":"Local authentication"},{"body":"IAM Login Service traces interesting, security related events with an audit log.\nAudit log messages are marked with the tag AUDIT in the Java class name field.\nAn example of audit log message is the following:\n2017-09-11 09:58:14.560 INFO 13 --- [o-8080-exec-311] AUDIT : {\"@type\":\"IamAuthenticationSuccessEvent\",\"timestamp\":1505116694560,\"category\":\"AUTHENTICATION\",\"principal\":\"794fb313-6e93-4d02-9d0a-4ed773ee2c5e\",\"message\":\"794fb313-6e93-4d02-9d0a-4ed773ee2c5e authenticated succesfully\",\"sourceEvent\":{\"principal\":\"794fb313-6e93-4d02-9d0a-4ed773ee2c5e\",\"type\":\"InteractiveAuthenticationSuccessEvent\"},\"source\":\"UsernamePasswordAuthenticationToken\"} The IAM login service writes logs to standard output in the default configuration. When deployed from packages, all logs are collected by the system journal.\n","categories":"","description":"","excerpt":"IAM Login Service traces interesting, security related events with an …","ref":"/v/v1.10.0/docs/tasks/deployment/audit-log/","tags":"","title":"Audit log"},{"body":"IAM build requirements The IAM is a Spring Boot Java application.\nTo build it, you will need:\nJava 8 Maven 3.3.x or greater Git Checking out the IAM code You can check out the IAM code as follows:\ngit clone https://github.com/indigo-iam/iam.git Building the IAM You can build the IAM packages with the following command:\nmvn package Setting up the docker-based development environment You will need:\nDocker 1.11.1 or greater Docker compose 1.7 or greater You can start a development/testing environment with the following command:\ndocker-compose build docker-compose up The docker-compose.yml file requires that you set some environment variables for it to run properly, mainly to provide OAuth client credentials for external authentication mechanisms (Google).\nThe setup also assumes that you have an entry in your DNS server (complex) or /etc/hosts (simpler) that maps iam.local.io to the machine (or VM) where docker is running, e.g.:\n$ cat /etc/hosts ... 192.168.99.100 iam.local.io How to run tests against the mysql database IAM JUnit integration tests can (and should) be run against mysql database.\nTo do so, boostrap the database instance with docker-compose:\ndocker-compose up db And then run the tests with the following command:\nmvn -Dspring.profiles.active=mysql-test test Building Docker production images To build the docker images for the iam-service and iam-test client, use the following commands:\nsh iam-login-service/docker/build-prod-image.sh sh iam-test-client/docker/build-prod-image.sh These commands should run after war and jar archives have been built, i.e. after a mvn package.\nFor more details on the image build scripts see the following folders:\niam-login-service iam-test-client Related projects This project builds upon the following projects/technologies:\nSpring Boot MitreID OpenID-Connect client and server libraries ","categories":"","description":"Build instructions and other information for IAM developers\n","excerpt":"Build instructions and other information for IAM developers\n","ref":"/v/v1.10.0/docs/developer-guide/","tags":"","title":"Developer guide"},{"body":"for IAM v1.10.0\n","categories":"","description":"","excerpt":"for IAM v1.10.0\n","ref":"/v/v1.10.0/docs/","tags":"","title":"Documentation"},{"body":"","categories":"","description":"","excerpt":"","ref":"/v/v1.10.0/blog/news/","tags":"","title":"News"},{"body":"","categories":"","description":"","excerpt":"","ref":"/v/v1.10.0/blog/releases/","tags":"","title":"Releases"},{"body":"OAuth OAuth WG home Main OAuth RFC Bearer token usage OAuth threat model Security recommendations Discovery/AuthZ server metadata Token exchange Device flow Token revocation OAuth resource indicators OAuth for native apps OAuth and MTLS OAuth assertion framework JWT profile for client \u0026 authorizationg grants Token introspection Dynamic client registration Dynamic client management Profile for JWT access tokens Authentication method reference values OAuth 2.1 OpenID Connect OpenID Connect specifications home OpenID Connect core OpenID Connect discovery OpenID Connect dynamic registration OpenID Connect federation JSON Web Tokens (JWTs) JOSE WG homme JWT Examples and use cases JSON Web Algorithms JSON Web Encryption JSON Web Key JSON Web Signature JWT Thumbprint JWT best current practices AARC AARC Blueprint architecture AARC guidelines ","categories":"","description":"Specifications and useful resources for IAM development\n","excerpt":"Specifications and useful resources for IAM development\n","ref":"/v/v1.10.0/docs/developer-guide/specs/","tags":"","title":"Specifications and useful resources"},{"body":"This section provides instructions to upgrade the IAM service to the latest available version.\nDeployment from packages Stop the service:\n$ systemctl stop iam-login-service Update the package:\n$ yum update -y iam-login-service Restart the service:\n$ systemctl start iam-login-service Deployment with Docker Stop and remove the running container:\n$ docker stop iam-login-service $ docker rm iam-login-service Pull the latest image:\n$ docker pull indigoiam/iam-login-service:latest Restart the container:\n$ docker run \\ --name iam-login-service \\ --net=iam -p 8080:8080 \\ --env-file=/path/to/iam-login-service/env \\ -v /path/to/keystore.jks:/keystore.jks:ro \\ indigoiam/iam-login-service:latest Otherwise, you can specify the exact tag version. For example, if the latest tag is v1.1.0-latest:\n$ docker run \\ --name iam-login-service \\ --net=iam -p 8080:8080 \\ --env-file=/path/to/iam-login-service/env \\ -v /path/to/keystore.jks:/keystore.jks:ro \\ indigoiam/iam-login-service:v1.1.0-latest ","categories":"","description":"","excerpt":"This section provides instructions to upgrade the IAM service to the …","ref":"/v/v1.10.0/docs/tasks/deployment/upgrade/","tags":"","title":"Upgrade"},{"body":"Starting from version 1.8.0, the IAM service can be deployed in High Availability mode.\nIt relies on redis as external component used for storing the log-in sessions, which has to be deployed as well.\nHere is an example on how to deploy three IAM replicas on a kubernetes cluster.\nIAM Deployment in HA An example of three replicas of the IAM service deployment on k8s is the following:\napiVersion: apps/v1 kind: Deployment metadata: name: iam-login-service spec: selector: matchLabels: app: iam tier: login-service replicas: 3 strategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 1 template: metadata: labels: app: iam tier: login-service spec: affinity: podAntiAffinity: requiredDuringSchedulingIgnoredDuringExecution: - labelSelector: matchExpressions: - key: tier operator: In values: - login-service topologyKey: kubernetes.io/hostname volumes: - name: json-keystore-secret-vol secret: secretName: json-keystore-secret containers: - name: iam-login-service image: indigoiam/iam-login-service:v1.8.0 imagePullPolicy: Always ports: - containerPort: 8080 name: iam - containerPort: 1044 name: iam-debug volumeMounts: - name: json-keystore-secret-vol mountPath: /secrets/json-keystore readOnly: true readinessProbe: httpGet: path: /actuator/health port: 8080 initialDelaySeconds: 90 timeoutSeconds: 10 resources: requests: cpu: 500m memory: 1Gi limits: cpu: 1 memory: 2Gi env: - name: IAM_BASE_URL value: https://iam.example - name: IAM_ISSUER value: https://iam.example/ envFrom: - configMapRef: name: login-service-env - secretRef: name: db-secret-env Here a configMap for the login-service-env file is used.\nYou can set there the Configuration properties used to enable Redis. The minimal ones required, for a password less Redis service are\nIAM_SPRING_SESSION_STORE_TYPE=redis IAM_SPRING_REDIS_HOST=redis.example Redis service Deployment A basic example of the Redis deployment on k8s (without replicas) based on the redis docker image is the following:\napiVersion: apps/v1 kind: Deployment metadata: name: redis spec: selector: matchLabels: app: redis template: metadata: labels: app: redis spec: containers: - name: redis image: redis:6 resources: requests: memory: \"512Mi\" cpu: \"2\" limits: memory: \"512Mi\" cpu: \"2\" ports: - containerPort: 6379 ","categories":"","description":"Instructions on how to deploy the IAM service in High Availability on k8s\n","excerpt":"Instructions on how to deploy the IAM service in High Availability on …","ref":"/v/v1.10.0/docs/tasks/deployment/ha/","tags":"","title":"Deploying IAM in HA"},{"body":"The IAM VOMS attribute authority The IAM VOMS attribute authority (AA) provide backward-compatible VOMS support for a Virtual Organization managed with IAM.\nDeployment architecture The VOMS attribute authority can access the IAM database and encode IAM groups and other attributes in a standard VOMS attribute certificate. This means in practice that IAM can act both as an OAuth/OpenID Connect authorization server and as a VOMS server for a given organization. TLS termination and client VOMS atttribute certificate parsing and validation is delegated to an NGINX VOMS module, which can de deployed as a sidecar service that just protects the VOMS AA or also in front of the IAM backend application. The two scenarios are depicted above.\nIn order to deploy a VOMS attribute authority, you can use the following docker images:\ncnafsd/nginx-httpg-voms, for the NGINX VOMS module (which replaces OpenResty VOMS) indigoiam/voms-aa:v1.10.0, for the VOMS AA service Deployment from packages is not currently supported for the VOMS attribute authority.\nNGINX VOMS module configuration The NGINX VOMS module requires:\nIGTF trust anchors properly configured; see the EGI trust anchors container container the vomsdir folder, with the VOMS LSC configuration generated starting from the VOMS attribute authority X.509 credential VOMS LSC configuration Let’s assume that the IAM VOMS AA will answer on voms.test.example for the VO example.vo, to generate the LSC you need to get the subject and issuer of the VOMS AA X.509 credential and put them in a file named as the fully qualified domain name of the VOMS attribute authority with the .lsc extension.\nThe following command does exactly that (X509_VOMS_DIR can be set to any directory where you have writing privileges):\n\u003e mkdir -p ${X509_VOMS_DIR}/example.vo \u003e openssl x509 -in voms_local_io.cert.pem -noout -subject -issuer -nameopt compat | \\ gsed -e 's/^subject=//' -e 's/^issuer=//' \u003e \\ ${X509_VOMS_DIR}/example.vo/voms.test.example.lsc For an example nginx configuration, see the VOMS AA docker compose configuration.\nVOMS AA configuration The VOMS AA is a spring boot application that shares the persistence layer implementation with IAM, and as such can inspect the IAM database.\nAn example configuration for the VOMS AA service is given below, with comments to explain the meaning of the parameters:\nserver: address: 0.0.0.0 # bind on all IP addresses port: 8080 # listen on port 8080 use-forward-headers: true # assume you're behind a reverse proxy # change the default http header size limit to accomodate VOMS information passed # down by the ngx-voms server max-http-header-size: 16000 spring: main: banner-mode: \"off\" jpa: open-in-view: true ## Database connection parameters datasource: dataSourceClassName: com.mysql.jdbc.jdbc2.optional.MysqlDataSource url: jdbc:mysql://${IAM_DB_HOST}:${IAM_DB_PORT:3306}/${IAM_DB_NAME}?useLegacyDatetimeCode=false\u0026serverTimezone=UTC\u0026useSSL=false username: ${IAM_DB_USERNAME} password: ${IAM_DB_PASSWORD} flyway: enabled: false voms: tls: # The VOMS AA certificate certificate-path: /certs/hostcert.pem # The VOMS AA certificate key private-key-path: /certs/hostkey.pem # Where to look for X.509 trust anchors trust-anchors-dir: /etc/grid-security/certificates # How often should trust anchors (and CRLs) be refreshed # The default value is 86400 trust-anchors-refresh-interval-secs: 14400 aa: # The VOMS attribute authority host host: voms.example # The VOMS attribute authority port. Note that this is the port on # the reverse proxy, not the local service port port: 443 # The VOMS VO name vo-name: ${VOMS_AA_VO} # Use FQAN legacy encoding, i.e., # /voms/Role=NULL/Capability=NULL # instead of # /voms # The default value is false use-legacy-fqan-encoding: true # The VOMS proxy lifetime in seconds # The default value is 12 hours max-ac-lifetime-in-seconds: 43200 # The optional group label # The default value is wlcg.optional-group # This option specify the label to be assigned for custom VOMS roles. # E.g.: \"pilot\" is a subgroup of the \"vo-name\" IAM group. If it is made # \"optional group\" in IAM via the dedicated button, users belonging to # it can request the \"pilot\" VOMS role. optional-group-label: voms.role For an example configuration, see the VOMS AA docker compose file.\n","categories":"","description":"Instructions on how to deploy and configure the IAM VOMS attribute authority micro-service\n","excerpt":"Instructions on how to deploy and configure the IAM VOMS attribute …","ref":"/v/v1.10.0/docs/tasks/deployment/voms/","tags":"","title":"Deploying the IAM VOMS attribute authority"},{"body":"The VOMS importer script For VOs that already use VOMS to manage their organization, a script is available to synchronize one-way their VOMS instance with their IAM instance.\nThe VOMS information that is synchronized includes:\nVOMS Groups VOMS Roles VOMS Users Personal information X.509 certificates Group and role membership Generic attributes The script needs admininistrative privileges on both VOMS and IAM, represented respectively by a VOMS proxy and an IAM access token.\nA typical run is as follows:\nexport REQUESTS_CA_BUNDLE=/etc/grid-security/certificates export BEARER_TOKEN=... export X509_USER_PROXY=... python vomsimporter.py --vo test.vo --voms-host vgrid02.cnaf.infn.it --iam-host iam-dev.cloud.cnaf.infn.it The script can be run with many different options. python vomsimporter.py --help gives all the details.\nThe script is currently deployed only for LHC VOs and includes some CERN specificities, but it is general enough that can be easily adapted to other situations.\nMigration of groups and roles Both IAM and VOMS support the concepts of group and role.\nGroups are very similar in both contexts. They differ slightly in the representation: a VOMS group has the form /\u003cgroup\u003e/\u003csubgroup\u003e/..., whereas a IAM group has the form \u003cgroup\u003e/\u003csubgroup\u003e/..., i.e. there is no leading /.\nFor example, the VOMS group /atlas/production becomes the IAM group atlas/production.\nRoles differ in a more profound way: whereas a VOMS role is a distinct entity from a group, in IAM a role is simply a group with the specific labels wlcg.optional-group and voms.role. An optional group is included in an OAuth token or in a VOMS proxy only if requested.\nFor example, the VOMS group with role /atlas/Role=VO-Admin becomes the IAM optional group atlas/VO-Admin.\nGroups and roles are imported in IAM only if not already present there.\nGroups and roles can be created directly in IAM without any corresponding group or role in VOMS; those are not considered by the importer script.\nMigration of users Only active VOMS users are migrated. A user suspended in VOMS, may not be also suspended in IAM. Since IAM at CERN is also integrated with the CERN Human Resource (HR) database, the HR check will ensure that users are suspended/removed from the VO when experiment membership is no longer valid.\nWhen creating a IAM account for a newly-discovered VOMS user, the importer script generates a username of the form voms.\u003cvoms-id\u003e. There is an option to use the value of an attribute (e.g. nickname) from the user entry in VOMS, if available.\nThe script by default removes a user from groups (including roles) where they do not belong any more.\nCERN SSO automatic linking The importer script can be configured to automatically link the imported account to the CERN SSO identity in two ways:\nusing the nickname VOMS account generic attribute resolving the CERN username from the CERN LDAP Unique email address for users in IAM VOMS allows different users to share an email address. IAM instead requires that each user has a unique email address.\nThe import script implements an email override mechanism, that maps a VOMS user id to another email address; however, a better approach would be to clean up the VOMS database in order to avoid multiple accounts sharing email addresses.\nVOMS importer log The importer script produces an auditing log, detailing the actions applied to groups, roles and users.\n","categories":"","description":"","excerpt":"The VOMS importer script For VOs that already use VOMS to manage their …","ref":"/v/v1.10.0/docs/tasks/deployment/voms_importer/","tags":"","title":"Importing VOMS information into IAM"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v1.10.0.\nThis release provides bug fixes and enhancements, as can be seen in the release notes.\nThe major highlights include:\nE-mail notification for AUP reminder/expiration, account suspension/restoration and client disabled/enabled events Add a statistical endpoint which shows the number of IAM users Allow for a definition of a set of default groups, automatically linked to newly registered users Mandate the usage of a stronger user password (during the password reset step) Allow to set a property which disables any kind of IAM cache As usual, the IAM docker image can be obtained from DockerHub.\n","categories":"","description":"The v1.10.0 release focuses on improving the management of the Virtual Organization (VO)","excerpt":"The v1.10.0 release focuses on improving the management of the Virtual …","ref":"/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/","tags":"","title":"IAM v1.10.0"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v1.9.0.\nThis release introduces new features, including:\nAdministrators have the ability to disable a client VO members can re-sign the AUP whenever they choose Clients now have a last used property to find out when was the last time it was used It is now possible to add a nickname as an attribute during the registration process This release also provides bug fixes and enhancements, as can be seen in the release notes.\nAs usual, the IAM docker image can be obtained from DockerHub.\n","categories":"","description":"The v1.9.0 release focuses on better management of the Virtual Organization (VO)","excerpt":"The v1.9.0 release focuses on better management of the Virtual …","ref":"/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/","tags":"","title":"IAM v1.9.0"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v1.8.4.\nThis release is mainly focused on the limitation of the client_credentials grant type, which can be set only by registered IAM users (admins or normal users) in a Client registration/update request.\nThis release also provides bug fixes and enhancements, as can be seen in the release notes.\nAs usual, the IAM docker image can be obtained from DockerHub.\n","categories":"","description":"The v1.8.4 release restricts the selection of client_credentials grant type for an OAuth Client","excerpt":"The v1.8.4 release restricts the selection of client_credentials grant …","ref":"/v/v1.10.0/blog/2024/03/25/iam-v1.8.4/","tags":"","title":"IAM v1.8.4"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v1.8.3.\nThis release provides bug fixes and enhancements, as can be seen in the release notes.\nThe major highlights include:\nsave an access token value as a hash and add missing foreign keys to the database because of this change, we strongly recommend to make a backup of your database before upgrading to v1.8.3. The migration will take an amount of time which will be proportional to the amount of currently active access tokens, which could be very long enable caching of scope matchers and of the contents of the well-known endpoint on a Redis server match custom scopes based on string equality fix CERN workflow for restored accounts fix authorization on IAM APIs such to avoid cases where access is granted to already approved scopes instead of effective token scopes. As usual, the IAM docker image can be obtained from DockerHub.\n","categories":"","description":"The v1.8.3 release introduces several database migrations to increase IAM performance","excerpt":"The v1.8.3 release introduces several database migrations to increase …","ref":"/v/v1.10.0/blog/2023/10/30/iam-v1.8.3/","tags":"","title":"IAM v1.8.3"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v.1.8.2.\nThis release provides bug fixes and enhancements, as can be seen in the release notes.\nThe major highlights include:\naddition of new admin scopes in order to access IAM API endpoints an administrator access token is not enough to have full access to IAM API endpoints; iam:admin.read and iam:admin.write scopes are required Spring-Boot update to version 2.6.14 As usual, the IAM docker image can be obtained from DockerHub.\n","categories":"","description":"The v1.8.2 release introduces new admin scopes in order to access IAM API endpoints","excerpt":"The v1.8.2 release introduces new admin scopes in order to access IAM …","ref":"/v/v1.10.0/blog/2023/06/05/iam-v1.8.2/","tags":"","title":"IAM v1.8.2"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v.1.8.1.\nThis release provides bug fixes and enhancements, as can be seen in the release notes.\nThe major highlights are:\nAdd a Scopes tab to the Organization Management section of the IAM dashboard, that basically replaces the functionality of the System Scope tab on the ADMINISTRATIVE section of the MitreID dashboard (only visible by Admins); Add a Managed groups tab to the Organization Management section of the IAM dashboard (visible by Group Managers), that allows to list the groups a user is manager of, their subgroups, their members, etc. Group Managers can also remove members from groups, but the ability to invite/add users to their managed groups will be included in future release; The default Refresh Token lifetime is set to 30 days for every newly registered client (it does not change the lifetime of old clients). This default can be overridden from configuration, e.g. client-registration.client-defaults.default-refresh-token-validity-seconds=-1 reverts to the previous behavior where the RT does not expire; When a user lets the Acceptable Usage Policy expire, IAM no longer issues refresh tokens and VOMS proxies; When a IAM account has been disabled, a user can no longer login with x509 certificates and request access tokens through the refresh token flow; IAM is more compliant with the guideline AARC-G069, i.e., groups and roles membership information can be requested with the entitlements scope and appears in the entitlements claim of the access token. As usual, the IAM docker image can be obtained from DockerHub.\nWarning Starting from this release, the forward to the old /health endpoints used to show the service status has been removed. ","categories":"","description":"The v1.8.1 release includes new Managed groups and Scope pages","excerpt":"The v1.8.1 release includes new Managed groups and Scope pages","ref":"/v/v1.10.0/blog/2023/02/28/iam-v1.8.1/","tags":"","title":"IAM v1.8.1"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v.1.8.0.\nThis release provides many bug fixes and enchancements, but the major highlightes are:\nSpring Boot migration to 2.6.6 version and Flyway upgrade to 7.15.0 version New clients management and registration pages on IAM dashboard migrated away from MitreID New consent page in IAM migrated away from MitreID Support for JWT-based client authentication Compliance with some AARC guidelines, in particular G025 for expressing affiliation information and G021 on the exchange of specific assurance information between Infrastructures Persistence layer migrations for Multi-Factor Authentication support Significant changes and other details are described in the release notes.\n","categories":"","description":"The v1.8.0 release includes a spring boot upgrade and a new client management page","excerpt":"The v1.8.0 release includes a spring boot upgrade and a new client …","ref":"/v/v1.10.0/blog/2022/09/09/iam-v1.8.0/","tags":"","title":"IAM v1.8.0"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v.1.7.2.\nThis release paves the way for the upgrade to v1.8.0 which will provide an update of the core Spring dependencies IAM is built upon.\nIn order to enable a smooth transition without requiring manual interventions from deployers, we need to issue an intermediate release that just updates the version of the flyway library that is used to manage the database schema updates.\nNo other change is introduced with this release.\nAs usual, the IAM docker images can be obtained from DockerHub, while RPM packages for CENTOS 7 can be obtained from our package repository.\n","categories":"","description":"The v1.7.2 release prepares the migration to IAM v1.8.0","excerpt":"The v1.7.2 release prepares the migration to IAM v1.8.0","ref":"/v/v1.10.0/blog/2021/12/03/iam-v1.7.2/","tags":"","title":"IAM v1.7.2"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v.1.7.1.\nThis release fixes a problem introduced in v1.7.0 of the IAM test client application released last week that prevented its correct behaviour.\nAlso starting with this release IAM test client does not expose received tokens in the default configuration. In order to restore the previous behaviour, set the following envirnoment variable:\nIAM_CLIENT_HIDE_TOKENS=false or, in the application.yml file use:\niam: hide-tokens: false More information in the release notes.\nThis release provide updates only for the iam-test-client application, which is only released as a Docker image on DockerHub.\n","categories":"","description":"The v1.7.1 fixes a problem in the IAM test client application","excerpt":"The v1.7.1 fixes a problem in the IAM test client application","ref":"/v/v1.10.0/blog/2021/09/13/iam-v1.7.1/","tags":"","title":"IAM v1.7.1"},{"body":"The IAM website and documentation has moved, and if you’re reading this you already know.\nThe new IAM website is powered by Docsy, a Hugo theme for creating technical documentation sites, which is increasingly popular in Open Source projects.\nThe new site provides new and improved documentation.\nIf you find something is missing or broken, let us know by opening an issue or suggest changes. The new Docsy website makes this very easy to anyone with a Github account, just see the tab on the right of each page.\n","categories":"","description":"The new IAM website (powered by the Docsy Hugo theme)","excerpt":"The new IAM website (powered by the Docsy Hugo theme)","ref":"/v/v1.10.0/blog/2021/09/07/new-iam-website/","tags":"","title":"New IAM website!"},{"body":"The IAM development team is pleased to announce the release of INDIGO IAM v.1.7.0.\nThis release provides many bug fixes and enhancements, as can be seen in the release notes.\nThe highlights of this release are:\nScalability improvements: the group membership persistence management has been refactored to improve scalability; SCIM APIs have also been changed to support pagination over group members (see the new SCIM API documentation for more information); Improved token exchange flexibility: token exchange can now be controlled in more detail using scope and token exchange policies; SSH key management: IAM now allows users to link SSH keys to their account; ssh keys are then exposed to relying parties either via the SCIM APIs or via the OpenID connect userinfo endpoint; see the documentation. As usual, the IAM docker images can be obtained from DockerHub, while RPM packages for CENTOS 7can be obtained from our package repository.\nWarning Starting from this release, we no longer provide packages for the Ubuntu platform. ","categories":"","description":"The v1.7.0 release provides numerous bug fixes and enhancements","excerpt":"The v1.7.0 release provides numerous bug fixes and enhancements","ref":"/v/v1.10.0/blog/2021/09/07/iam-v1.7.0/","tags":"","title":"IAM v1.7.0"},{"body":"","categories":"","description":"","excerpt":"","ref":"/v/v1.10.0/blog/","tags":"","title":"INDIGO IAM Blog"},{"body":"Once logged in, you can change information in your account (if allowed by the IAM configuration) by clicking the “Edit Details” from your home page:\n","categories":"","description":"","excerpt":"Once logged in, you can change information in your account (if allowed …","ref":"/v/v1.10.0/docs/tasks/user/change-details/","tags":"","title":"Change account information"},{"body":"Once logged in you can change your account password by clicking on the “Change password” button in your home page:\nNote that the “Change password” functionality is only useful if you remember your IAM account password. In case you forgot it, logout from the IAM and follow the instructions in the Reset account password section.\n","categories":"","description":"","excerpt":"Once logged in you can change your account password by clicking on the …","ref":"/v/v1.10.0/docs/tasks/user/change-password/","tags":"","title":"Changing the account password"},{"body":"IAM supports brokered authentication via standard OpenID-Connect and SAML protocols as well as X.509 authentication.\n","categories":"","description":"","excerpt":"IAM supports brokered authentication via standard OpenID-Connect and …","ref":"/v/v1.10.0/docs/reference/configuration/external-authentication/","tags":"","title":"External authentication"},{"body":"IAM Login Service provides a RESTful API to create and manage group membership requests.\nPOST /iam/group_requests Create a new group membership request. The body of the request must contain a JSON with the group name and a motivation of the submitted request.\nAuthentication required: true\nSuccess response Conditions:\nThe user is authenticated; the user is not already member of the requested group; a request from the user for such group does not exist. Code: 200 Ok\nContent: A JSON representation of the new request.\nError response Condition: The user is not authenticated.\nCode: 401 Unauthorized\nContent: A JSON with the error description.\n{ \"error\" : \"unauthorized\", \"error_description\" : \"Full authentication is required to access this resource\" } Condition: The request already exists.\nCode: 400 Bad Request\nContent: A JSON with the error description.\n{ \"error\": \"Group membership request already exist for [test, Test-001]\" } Example Request:\nPOST /iam/group_requests HTTP/1.1 Host: iam.local.io Content-Type: application/json Cache-Control: no-cache { \"groupName\":\"Test-001\", \"notes\":\"Test API\" } Response:\n{ \"uuid\": \"d5b652b2-4bb5-401a-bfb9-a795353798b3\", \"username\": \"test\", \"status\": \"PENDING\", \"notes\": \"Test API\", \"groupName\": \"Test-001\", \"creationTime\": 1524233011676 } GET /iam/group_requests Returns a paginated list of group requests. The list can be filtered by username, group name or request status. Users with administrative privileges can list all requests; other users only the requests they submitted.\nAuthentication required: true\nSuccess response Condition: The user is authenticated.\nCode: 200 Ok\nContent: A JSON representation of the request list.\nError response Condition: The user is not autheticated.\nCode: 401 Unauthorized\nContent: A JSON with an error message representation.\n{ \"error\": \"unauthorized\", \"error_description\": \"Full authentication is required to access this resource\" } Example Request:\nGET /iam/group_requests/?groupName=Test-001\u0026status=PENDING HTTP/1.1 Host: iam.local.io Content-Type: application/json Cache-Control: no-cache Response:\n{ \"Resources\": [ { \"uuid\": \"d5b652b2-4bb5-401a-bfb9-a795353798b3\", \"username\": \"test\", \"status\": \"PENDING\", \"notes\": \"Test API\", \"groupName\": \"Test-001\", \"creationTime\": 1524233011000, \"lastUpdateTime\": 1524233012000 }, { \"uuid\": \"b28790d4-90d4-471f-8b85-79d5fd761b8c\", \"username\": \"test_100\", \"status\": \"PENDING\", \"notes\": \"Test API\", \"groupName\": \"Test-001\", \"creationTime\": 1524237532000, \"lastUpdateTime\": 1524237532000 } ], \"totalResults\": 2, \"startIndex\": 1, \"itemsPerPage\": 2 } GET /iam/group_requests/{uuid} Returns the details about a group request.\nAuthentication required: true\nSuccess response Condition: The user is authenticated and can access the request (privileged users can access all request, other users only the requests they submitted).\nCode: 200 Ok\nContent: The JSON representation of the group membership request.\nError response Condition: The user is not authenticated.\nCode: 401 Unauthorized\nContent:\n{ \"error\": \"unauthorized\", \"error_description\": \"Full authentication is required to access this resource\" } Condition: User is not authorized to access the group request.\nCode: 403 Forbidden\nContent:\nAccess is denied Condition: A request linked to the given id does not exist.\nCode: 400 Bad request\nContent:\n{ \"error\": \"Group request with UUID [d5b652b2-4bb5-401a] does not exist\" } Example Request:\nGET /iam/group_requests/d5b652b2-4bb5-401a-bfb9-a795353798b3 HTTP/1.1 Host: iam.local.io Content-Type: application/json Cache-Control: no-cache Response:\n{ \"uuid\": \"d5b652b2-4bb5-401a-bfb9-a795353798b3\", \"username\": \"test\", \"status\": \"PENDING\", \"notes\": \"Test API\", \"groupName\": \"Test-001\", \"creationTime\": 1524233011000, \"lastUpdateTime\": 1524233012000 } DELETE /iam/group_requests/{uuid} Deletes a group request. Administrators can delete any request, users can only delete the PENDING requests they previously submitted.\nAuthentication required: true\nSuccess response Condition: A request linked to the given id exists.\nCode: 204 No Content\nContent: Empty body\nError response Condition: A request linked to the given id does not exist.\nCode: 400 Bad Request\nContent: A JSON with an error message representation.\n{ \"error\": \"Group request with UUID [b28790d4-90d4-471f-8b85-79d5fd761b8c] does not exist\" } Example Request:\nDELETE /iam/group_requests/b28790d4-90d4-471f-8b85-79d5fd761b8c HTTP/1.1 Host: iam.local.io Content-Type: application/json Cache-Control: no-cache POST /iam/group_requests/{uuid}/approve Approves a group request. Only administrators can approve requests.\nAuthentication required: true\nSuccess response Condition:\nThe user is authenticated and has administrative privileges; the request is in PENDING status. Code: 200 Ok\nContent: The JSON representation of the updated group membership request.\nError response Condition:\nThe request doesn’t exist; The request isn’t in PENDING status. Code: 400 Bad Request\nContent: A JSON with an error message representation.\n{ \"error\": \"Group request with UUID [b28790d4-90d4-471f-8b85-79d5fd761b8c] does not exist\" } { \"error\": \"Invalid group request transition: APPROVED -\u003e APPROVED\" } Example Request:\nPOST /iam/group_requests/d5b652b2-4bb5-401a-bfb9-a795353798b3/approve HTTP/1.1 Host: iam.local.io Content-Type: application/json Cache-Control: no-cache Response:\n{ \"uuid\": \"d5b652b2-4bb5-401a-bfb9-a795353798b3\", \"username\": \"test\", \"status\": \"APPROVED\", \"notes\": \"Test API\", \"groupName\": \"Test-001\", \"creationTime\": 1524233011000, \"lastUpdateTime\": 1524238898590 } POST /iam/group_requests/{uuid}/reject Rejects a group request. A motivation parameter is required. Only administrators can reject requests.\nAuthentication required: true\nSuccess response Condition:\nThe user is authenticated and has administrative privileges; the request is in PENDING status. Code: 200 Ok\nContent: The JSON representation of the updated group membership request.\nError response Condition:\nThe request doesn’t exist; The request isn’t in PENDING status; The motivation required request parameter is missing. Code: 400 Bad Request\nContent: A JSON with an error message representation.\n{ \"error\": \"Invalid group request transition: APPROVED -\u003e REJECTED\" } { \"error\": \"Group request with UUID [d5b652b2-4bb5-401a-bfb9-a79535379b3] does not exist\" } Example Request:\nPOST /iam/group_requests/b28790d4-90d4-471f-8b85-79d5fd761b8c/reject?motivation=Test API HTTP/1.1 Host: iam.local.io Content-Type: application/json Cache-Control: no-cache Response:\n{ \"uuid\": \"b28790d4-90d4-471f-8b85-79d5fd761b8c\", \"username\": \"test_100\", \"status\": \"REJECTED\", \"notes\": \"Test API\", \"motivation\": \"Test API\", \"groupName\": \"Test-001\", \"creationTime\": 1524237532000, \"lastUpdateTime\": 1524238811254 } ","categories":"","description":"","excerpt":"IAM Login Service provides a RESTful API to create and manage group …","ref":"/v/v1.10.0/docs/reference/api/group-requests/","tags":"","title":"Group requests API"},{"body":"The IAM Login Service exposes a set of health endpoints that can be used to monitor the status of the service.\nHealth endpoints expose a different set of information depending on the user privileges; requests from the Actuator user will see more details, while anonymous requests typically receive only a summary of the health status.\nThe Actuator role has been introduced in IAM starting with version 1.8.0, in order to access the following resources\n/actuator/health /actuator/info without being an IAM user and it is useful for deployment purposes.\nThe Actuator user credentials can be configured with the environment variables IAM_ACTUATOR_USER_USERNAME and IAM_ACTUATOR_USER_PASSWORD, as explained in Configuration.\nThe health endpoints return:\nHTTP status code 200 if everything is ok; HTTP status code 500 if any health check fails. /actuator/health This is a general application health check endpoint which composes disk space and database health checks.\nExamples.\n$ curl -s https://iam.local.io/actuator/health | jq { \"status\": \"UP\", \"components\": { \"db\": { \"status\": \"UP\" }, \"diskSpace\": { \"status\": \"UP\" }, \"ping\": { \"status\": \"UP\" } } } Sending basic authentication, the endpoint returns a response with more details:\n$ curl -s -u $IAM_ACTUATOR_USER_USERNAME:$IAM_ACTUATOR_USER_PASSWORD https://iam.local.io/actuator/health | jq { \"status\": \"UP\", \"components\": { \"db\": { \"status\": \"UP\", \"details\": { \"database\": \"H2\", \"validationQuery\": \"isValid()\" } }, \"diskSpace\": { \"status\": \"UP\", \"details\": { \"total\": 502468108288, \"free\": 320953249792, \"threshold\": 10485760, \"exists\": true } }, \"ping\": { \"status\": \"UP\" } } } /actuator/health/mail This endpoint monitors the connection to the SMTP server configured for the IAM Notification Service.\nIn order to enable the SMTP server check, set the environment variable IAM_HEALTH_MAIL_PROBE_ENABLED to true.\n$ curl -s https://iam.local.io/actuator/health/mail | jq { \"status\": \"UP\" } With an authenticated request, the SMTP server details are returned:\n$ curl -u $IAM_ACTUATOR_USER_USERNAME:$IAM_ACTUATOR_USER_PASSWORD https://iam.local.io/actuator/health/mail | jq { \"status\": \"UP\", \"details\": { \"location\": \"smtp.local.io:25\" } } /actuator/health/externalConnectivity This endpoint checks service connectivity to the Internet. By default, the endpoint triggers a check on the connectivity to Google.\nIn order to enable the external connectivity check, set the environment variable IAM_HEALTH_EXTERNAL_CONNECTIVITY_PROBE_ENABLED to true.\n$ curl -s https://iam.local.io/actuator/health/externalConnectivity | jq { \"status\": \"UP\" } With an authenticated request, the external service URL is shown in the details.\n$ curl -s -u $IAM_ACTUATOR_USER_USERNAME:$IAM_ACTUATOR_USER_PASSWORD https://iam.local.io/actuator/health/externalConnectivity | jq { \"status\": \"UP\", \"details\": { \"endpoint\": \"https://www.google.it\" } } ","categories":"","description":"","excerpt":"The IAM Login Service exposes a set of health endpoints that can be …","ref":"/v/v1.10.0/docs/reference/api/health_endpoints/","tags":"","title":"Health checks"},{"body":"IAM provides a RESTful API that can be used to manage users, group membership, clients, etc.\nIAM implements the following endpoints:\n/iam/account/{id}/attributes, providing access to user attributes /iam/account/{id}/authorities, providing access to user authorities/roles /iam/account/me/clients, providing access to clients owned by the user /iam/account/find/{option}, searching users by username/label/e-mail/group/certificate subject /iam/account/{id}/groups/{groupId}, providing access to user groups /iam/account/{id}/managed-groups, providing access to groups to which a user is manager /iam/group/{groupId}/group-managers, listing managers of a certain group /iam/account/{id}/labels, providing access to user account labels /iam/account/{id}/endTime, managing user membership end time /iam/account/me/proxycert, managing user proxy certificate /iam/account/search, listing user accounts /iam/group/search, listing all groups Authentication is required in all the endpoints and the access is based on IAM roles. Remember that there are three roles in Indigo IAM: Amdin, User, Group Manager.\nUser attributes GET /iam/account/{id}/attributes Retrieves user attributes. The {id} refers to the account identifier.\nRequires that the Access Token contains the restricted System Scope iam:admin.read, or the token subject is the one represented by the {id}.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/attributes | jq [ { \"name\": \"Nickname\", \"value\": \"Test\" } ] PUT /iam/account/{id}/attributes Adds attributes to the user account. It can be done directly through the IAM dashboard by clicking on “Set attribute” button in Attributes section of the user homepage.\nRequires iam:admin.write scope.\n$ curl -X PUT -H \"Accept: application/json\" \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer ${AT}\" -d @attribute.json \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/attributes where attribute.json is:\n{ \"name\":\"Nickname\", \"value\":\"Test\" } DELETE /iam/account/{id}/attributes Deletes user attribute by adding the query parameter at the end of the endpoint.\nRequires iam:admin.write scope.\n$ curl -X DELETE -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/attributes?name=Nickname User roles GET /iam/account/{id}/authorities Retrieves user roles.\nRequires iam:admin.read scope.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/authorities | jq { \"authorities\": [ \"ROLE_GM:c617d586-54e6-411d-8e38-649677980001\", \"ROLE_USER\" ] } The above example shows that the Test User is also a group manager (of group with c617d586-54e6-411d-8e38-649677980001 id).\nPOST /iam/account/{id}/authorities Adds an authority to the user.\nRequires iam:admin.write scope.\n$ curl -X POST -H \"Content-Type: application/x-www-form-urlencoded\" \\ -H \"Authorization: Bearer ${AT}\" -d \"authority=ROLE_ADMIN\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/authorities DELETE /iam/account/{id}/authorities Revokes user authority by specifying the query parameter.\nRequires iam:admin.write scope.\n$ curl -X DELETE -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/authorities?authority=ROLE_ADMIN Managed clients GET /iam/account/me/clients Retrieves information about clients owned by the currently authenticated user.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/me/clients | jq { \"totalResults\": 1, \"itemsPerPage\": 1, \"startIndex\": 1, \"Resources\": [ { \"client_id\": \"client\", \"client_name\": \"Test Client\", \"redirect_uris\": [ \"https://iam.local.io/iam-test-client/openid_connect_login\", \"http://localhost:9090/iam-test-client/openid_connect_login\" ], \"scope\": \"address phone openid profile offline_access read-tasks attr write-tasks email read:/ write:/\", \"created_at\": 1658764288643 } ] } Account filtering GET /iam/account/find/{option} Filters user information by label, e-mail, username, certificate subject or group/notingroup.\nRequires iam:admin.read scope.\nOption Attribute Value byusername username string bylabel name string byemail email string bycertsubject certificateSubject URL-encoded Examples of the available options:\nbyusername\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/find/byusername?username=test | jq { \"totalResults\": 1, \"itemsPerPage\": 10, \"startIndex\": 1, \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:ListResponse\" ], \"Resources\": [ { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"meta\": { \"created\": \"2022-07-26T13:48:35.442+02:00\", \"lastModified\": \"2022-07-26T13:48:35.442+02:00\", \"location\": \"http://localhost:8080/scim/Users/80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"resourceType\": \"User\" ... ] } bylabel\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/find/bylabel?name=test byemail\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/find/byemail?email=test.user@gmail.com bycertsubject\n$ curl -s -H \"Authorization: Bearer $AT\" \\ http://localhost:8080/iam/account/find/bycertsubject?certificateSubject=CN%3dTest%20User%20test%40infn.it%2cO%3dIstituto%20Nazionale%20di%20Fisica%20Nucleare%2cC%3dIT%2cDC%3dtcs%2cDC%3dterena%2cDC=org bygroup/{groupId}\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/find/bygroup/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1 notingroup/{groupId}\n$ curl -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/find/notingroup/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1 Group members POST /iam/account/{id}/groups/{groupId} Adds user to a group. It can be done directly through the IAM dashboard as explained here.\nRequires iam:admin.write scope.\n$ curl -X POST -H \"Content-Type: application/x-www-form-urlencoded\" \\ -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/groups/c617d586-54e6-411d-8e38-649677980004 DELETE /iam/account/{id}/groups/{groupId} Removes user from a specific group.\nRequires iam:admin.write scope.\n$ curl -X DELETE -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/groups/c617d586-54e6-411d-8e38-649677980004 Group managers GET /iam/account/{id}/managed-groups Lists the user’s managed and not managed groups.\nRequires that the Access Token contains the restricted System Scope iam:admin.read, or the token subject is the one represented by the {id}.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/managed-groups | jq { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"username\": \"test\", \"managedGroups\": [ { \"name\": \"Test-001\", \"id\": \"c617d586-54e6-411d-8e38-649677980001\", \"description\": null, \"parent\": null } ], \"unmanagedGroups\": [ ... ] } POST /iam/account/{id}/managed-groups/{groupId} Gives a user represented by {id} ROLE_GM privileges of the group identified by {groupId}.\nRequires iam:admin.write scope.\n$ curl -X POST -H \"Content-Type: application/x-www-form-urlencoded\" \\ -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/managed-groups/c617d586-54e6-411d-8e38-649677980004 DELETE /iam/account/{id}/managed-groups/{groupId} Removes a group manager from a certain group.\nRequires iam:admin.write scope.\n$ curl -X DELETE -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/managed-groups/c617d586-54e6-411d-8e38-649677980004 GET /iam/group/{groupId}/group-managers Shows the information of managers in a certain group.\nRequires that the Access Token contains the restricted System Scope iam:admin.read, or ROLE_GM privileges of the group identified by {groupId}.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/group/c617d586-54e6-411d-8e38-649677980004/group-managers [ { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"meta\": { \"created\": \"2022-07-26T13:48:35.442+02:00\", \"lastModified\": \"2022-07-26T18:19:03.786+02:00\", \"location\": \"http://localhost:8080/scim/Users/80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"resourceType\": \"User\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"test\", \"name\": { \"familyName\": \"User\", \"formatted\": \"Test User\", \"givenName\": \"Test\" }, ... } ] Account labels GET /iam/account/{id}/labels Shows the user account labels.\nRequires that the Access Token contains the restricted System Scope iam:admin.read, or the token subject is the one represented by the {id}.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/labels [ { \"prefix\": \"hr.cern\", \"name\": \"ignore\" } ] PUT /iam/account/{id}/labels Adds labels to user account.\nRequires iam:admin.write scope.\n$ curl -X PUT -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer ${AT}\" -d @labels.json \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/labels where labels.json is:\n{ \"prefix\": \"hr.cern\", \"name\": \"ignore\" } DELETE /iam/account/{id}/labels Deletes an account label by specifying the label name and the label prefix (if present).\nRequires iam:admin.write scope.\n$ curl -X DELETE -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/labels \\ -d name=ignore -d prefix=\"hr.cern\" User account expiration time PUT /iam/account/{id}/endTime Adds/changes the membership end time of the user. It can be done directly through the IAM dashboard by clicking on “Change membership end time” button in the user homepage.\nRequires iam:admin.write scope.\n$ curl -X PUT -d @endTime.json \\ -H \"Content-Type: application/json\" \\ -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/80e5fb8d-b7c8-451a-89ba-346ae278a66f/endTime where endTime.json is:\n{ \"endTime\":\"2022-08-06T02:00:00.000+02:00\" } Proxy certificate PUT /iam/account/me/proxycert Adds user proxy certificate. It can be done directly through the IAM dashboard by clicking on “Add managed proxy certificate” button appearing on the user homepage after uploading the X.509 certificate.\nWhen using curl commands, it requires the restricted System Scope iam:admin.write in the Access Token.\n$ curl -i -X PUT -d @proxy.json \\ -H \"Authorization: Bearer ${AT}\" \\ -H \"Content-Type: application\" \\ http://localhost:8080/iam/account/me/proxycert where proxy.json includes only the certificate_chain key:\n{\"certificate_chain\":\"-----BEGIN CERTIFICATE-----\\nMIIFGT...FlCU=\\n-----END CERTIFICATE-----\"} List accounts and groups GET /iam/account/search Shows the list of IAM accounts.\nRequires iam:admin.read scope.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/account/search { \"totalResults\": 254, \"itemsPerPage\": 10, \"startIndex\": 1, \"Resources\": [ { \"id\": \"73f16d93-2441-4a50-88ff-85360d78c6b5\", \"meta\": { \"created\": \"2022-09-21T17:20:14.034+02:00\", \"lastModified\": \"2022-09-21T17:20:14.034+02:00\", \"location\": \"http://localhost:8080/scim/Users/73f16d93-2441-4a50-88ff-85360d78c6b5\", \"resourceType\": \"User\" }, \"userName\": \"admin\", \"name\": { \"familyName\": \"User\", \"formatted\": \"Admin User\", \"givenName\": \"Admin\" }, \"displayName\": \"admin\", \"active\": true, \"emails\": [ { \"type\": \"work\", \"value\": \"1_admin@iam.test\", \"primary\": true } ] }, ... GET /iam/group/search Shows the list of IAM groups.\nAccess granted to all IAM users or iam:admin.read scope.\n$ curl -s -H \"Authorization: Bearer ${AT}\" \\ http://localhost:8080/iam/group/search { \"totalResults\": 22, \"itemsPerPage\": 10, \"startIndex\": 1, \"Resources\": [ { \"id\": \"6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\", \"meta\": { \"created\": \"2022-09-21T17:20:15.478+02:00\", \"lastModified\": \"2022-09-21T17:20:15.478+02:00\", \"location\": \"http://localhost:8080/scim/Groups/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\", \"resourceType\": \"Group\" }, \"displayName\": \"Analysis\", \"urn:indigo-dc:scim:schemas:IndigoGroup\": { \"parentGroup\": null, \"description\": \"The analysis group\", \"labels\": null } }, ... ","categories":"","description":"","excerpt":"IAM provides a RESTful API that can be used to manage users, group …","ref":"/v/v1.10.0/docs/reference/api/account-api/","tags":"","title":"IAM account API"},{"body":"The IAM server has a RESTful API used to list and revoke active access and refresh tokens.\nAccess to the API is limited to users with administrator privileges authenticated via a web session or to access token containing predefined restricted System Scopes.\nAll examples assume authorization via OAuth2 bearer token; e.g.\nGET /iam/api/access-tokens/13 HTTP/1.1 Host: example.com Authorization: Bearer h480djs93hd8 These are the tokens REST API endpoints:\nAccessing tokens:\nGET /iam/api/access-tokens GET /iam/api/access-tokens/:id GET /iam/api/refresh-tokens GET /iam/api/refresh-tokens/:id DELETE /iam/api/access-tokens/:id DELETE /iam/api/refresh-tokens/:id Deleting tokens:\nGET /iam/api/access-tokens GET /iam/api/access-tokens/:id GET /iam/api/refresh-tokens GET /iam/api/refresh-tokens/:id DELETE /iam/api/access-tokens/:id DELETE /iam/api/refresh-tokens/:id GET /iam/api/access-tokens Retrieves the paginated list of all the active access tokens. Returns results in application/json.\nRequires iam:admin.read scope.\nParameters:\nName Description countinteger Specifies the desired maximum number of query results per page. startIndexinteger The 1-based index of the first query result. userIdstring Filters by userName. clientIdstring Filters by clientId. Example:\nGET http://example.com:8080/iam/api/access-tokens { \"totalResults\": 1, \"itemsPerPage\": 1, \"startIndex\": 1, \"resources\": [ { \"id\": 6, \"value\": \"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MDEzMTQ1MjksImF1ZCI6WyJhOGFmNzUzYy1mMzI0LTRlNDAtYTE3Ny04N2RmYzA2MjQ5YjciXSwiaXNzIjoiaHR0cDpcL1wvbG9jYWxob3N0OjgwODBcL29wZW5pZC1jb25uZWN0LXNlcnZlci13ZWJhcHBcLyIsImp0aSI6Ijg4ZjM4OGE4LTk1NzctNGQyMC1hZTZjLWMyMDMxOGQ1OWJjNiIsImlhdCI6MTQwMTMxMDkyOX0.HYnNxRvGRdKFykVChL-hdxszcFBvygkeUmc8_iv2Jl4MU-jPJVzMnTwKJbCMWBjeBp8hrb0Dgd9XbnHUDyXxwj8MDrWQEH3QnwYJGRW9JFWjHMGfKDQDFY6Ffl3OFERVbyoB2ObiGTUgbw4Nkl1L1ihuMpMAc5nKi0rk3QXcS1M\", \"scopes\": [ \"openid\", \"phone\", \"email\", \"address\", \"profile\" ], \"expiration\": \"2014-05-28T18:02:09-0400\", \"client\": { \"id\": 2, \"clientId\": \"iam-test-client\", \"contacts\": [ \"andrea.ceccanti@cnaf.infn.it\" ], \"ref\": \"https://iam-test.indigo-datacloud.eu/api/clients/2\" }, \"user\": { \"id\": \"e1eb758b-b73c-4761-bfff-adc793da409c\", \"userName\": \"andrea\", \"ref\": \"https://iam-test.indigo-datacloud.eu/scim/Users/e1eb758b-b73c-4761-bfff-adc793da409c\" }, \"idToken\": { \"id\": 5, \"ref\": \"https://iam-test.indigo-datacloud.eu/access-tokens/5\" } } ] } GET /iam/api/access-tokens/:id Retrieves all the information about the access token identified by id and returns results in application/json.\nRequires iam:admin.read scope.\nGET http://example.com:8080/iam/api/access-tokens/6 { \"id\": 6, \"value\": \"eyJhbGciOiJSUzI1NiJ9.eyJleHAiOjE0MDEzMTQ1MjksImF1ZCI6WyJhOGFmNzUzYy1mMzI0LTRlNDAtYTE3Ny04N2RmYzA2MjQ5YjciXSwiaXNzIjoiaHR0cDpcL1wvbG9jYWxob3N0OjgwODBcL29wZW5pZC1jb25uZWN0LXNlcnZlci13ZWJhcHBcLyIsImp0aSI6Ijg4ZjM4OGE4LTk1NzctNGQyMC1hZTZjLWMyMDMxOGQ1OWJjNiIsImlhdCI6MTQwMTMxMDkyOX0.HYnNxRvGRdKFykVChL-hdxszcFBvygkeUmc8_iv2Jl4MU-jPJVzMnTwKJbCMWBjeBp8hrb0Dgd9XbnHUDyXxwj8MDrWQEH3QnwYJGRW9JFWjHMGfKDQDFY6Ffl3OFERVbyoB2ObiGTUgbw4Nkl1L1ihuMpMAc5nKi0rk3QXcS1M\", \"scopes\": [ \"openid\", \"phone\", \"email\", \"address\", \"profile\" ], \"expiration\": \"2014-05-28T18:02:09-0400\", \"client\": { \"id\": 2, \"clientId\": \"iam-test-client\", \"contacts\": [ \"andrea.ceccanti@cnaf.infn.it\" ], \"ref\": \"https://iam-test.indigo-datacloud.eu/api/clients/2\" }, \"user\": { \"id\": \"e1eb758b-b73c-4761-bfff-adc793da409c\", \"userName\": \"andrea\", \"ref\": \"https://iam-test.indigo-datacloud.eu/scim/Users/e1eb758b-b73c-4761-bfff-adc793da409c\" }, \"idToken\": { \"id\": 5, \"ref\": \"https://iam-test.indigo-datacloud.eu/access-tokens/5\" } } GET /iam/api/refresh-tokens Retrieves the paginated list of all the active refresh tokens. Returns results in application/json.\nRequires iam:admin.read scope.\nParameters:\nName Description countinteger Specifies the desired maximum number of query results per page. startIndexinteger The 1-based index of the first query result. userIdstring Filters by userId. clientIdstring Filters by clientId. Example:\nGET http://example.com:8080/iam/api/refresh-tokens { \"totalResults\": 1, \"itemsPerPage\": 1, \"startIndex\": 1, \"resources\": [ { \"id\": 1083, \"value\": \"eyJhbGciOiJub25lIn0.eyJqdGkiOiIxMTdmMWRkOS1iOWViLTQ5MjctYThkMS1hYzQ4NjIwYWQzOWYifQ.\", \"scopes\": [ \"openid\", \"phone\", \"email\", \"address\", \"profile\" ], \"expiration\": \"2014-05-28T18:02:09-0400\", \"client\": { \"id\": 2, \"clientId\": \"iam-test-client\", \"contacts\": [ \"andrea.ceccanti@cnaf.infn.it\" ], \"ref\": \"https://iam-test.indigo-datacloud.eu/api/clients/2\" }, \"user\": { \"id\": \"e1eb758b-b73c-4761-bfff-adc793da409c\", \"userName\": \"andrea\", \"ref\": \"https://iam-test.indigo-datacloud.eu/scim/Users/e1eb758b-b73c-4761-bfff-adc793da409c\" } } ] } GET /iam/api/refresh-tokens/:id Retrieves all the information about the refresh token identified by id and returns results in application/json.\nRequires iam:admin.read scope.\nGET http://example.com:8080/iam/api/refresh-tokens/1083 { \"id\": 1083, \"value\": \"eyJhbGciOiJub25lIn0.eyJqdGkiOiIxMTdmMWRkOS1iOWViLTQ5MjctYThkMS1hYzQ4NjIwYWQzOWYifQ.\", \"scopes\": [ \"openid\", \"phone\", \"email\", \"address\", \"profile\" ], \"expiration\": \"2014-05-28T18:02:09-0400\", \"client\": { \"id\": 2, \"clientId\": \"iam-test-client\", \"contacts\": [ \"andrea.ceccanti@cnaf.infn.it\" ], \"ref\": \"https://iam-test.indigo-datacloud.eu/api/clients/2\" }, \"user\": { \"id\": \"e1eb758b-b73c-4761-bfff-adc793da409c\", \"userName\": \"andrea\", \"ref\": \"https://iam-test.indigo-datacloud.eu/scim/Users/e1eb758b-b73c-4761-bfff-adc793da409c\" } } DELETE /iam/api/access-tokens/:id Revoke the access token identified by id.\nRequires iam:admin.write scope.\nDELETE http://example.com:8080/iam/api/access-tokens/6 204 AccessToken revoked DELETE /iam/api/refresh-tokens/:id Revoke the access token identified by id.\nRequires iam:admin.write scope.\nDELETE http://example.com:8080/iam/api/refresh-tokens/1083 204 RefreshToken revoked ","categories":"","description":"","excerpt":"The IAM server has a RESTful API used to list and revoke active access …","ref":"/v/v1.10.0/docs/reference/api/tokens-api/","tags":"","title":"IAM Token management API"},{"body":" Welcome to the INDIGO IAM service website! The open source, self-contained Identity And Access Management (IAM) solution for Scientific computing!\nLearn More ","categories":"","description":"","excerpt":" Welcome to the INDIGO IAM service website! The open source, …","ref":"/v/v1.10.0/","tags":"","title":"INDIGO IAM"},{"body":"IAM supports several methods to authenticate an OAuth2 client to the token endpoint.\nThe authentication via JWT assertion is defined in RFC7523. It can be used to request an access token when a client wishes to utilize an existing trust relationship, expressed through the semantics of the JWT, without a direct user-approval step at the authorization server. Client authentication using a JWT is nothing more than an alternative way for a client to authenticate to the token endpoint and must be used in conjunction with some grant type to form a complete and meaningful protocol request, for instance the authorization code flow (when a user has to approve the client in order to access to their resources), the client credential flow (when a client is acting on its own behalf), etc.\nJWT assertion validation The IAM Authorization Server validates the JWT assertion and issues an access token if the following conditions are satisfied.\nJWT assertion header\nthe “alg” (algorithm) claim must be present to indicate the algorithm used to sign the token; the “kid” (key ID) claim must be present in the asymmetrically signed assertions to identify the public key. JWT assertion body\nthe “iss” (issuer) and “sub” (subject) claims must be equal to the client_id; the “aud” (audience) claim must be equal to the token endpoint URL; the “exp” (expiration) claim must be present to limit the JWT assertion lifetime; the “jti” (JWT ID) claim must be present and provides a unique identifier for the token. Client settings You need to configure an OAuth2 client in IAM which is used to issue a JWT assertion and get an access token.\nFollow the instruction on how to register a new client, or edit an existing client (click on the My clients link on the left navigation bar of the IAM dashboard and select the client name). From the Credentials tab you can choose the authentication method to the token endpoint:\nclient secret with symmetrically signed JWT assertion; asymmetrically signed JWT assertion. Symmetrically signed JWT assertion This authentication mechanism is used when your JWT assertion is signed with a symmetric key.\nTo use this mechanism, select Client secret with symmetrically signed JWT assertion; the Client secret generated by IAM must be used as symmetric key to sign your JWT assertion.\nA symmetrically signed JWT assertion looks like\n## Header { \"alg\": \"HS256\" } ## Payload { \"sub\": \"181f26f9-4562-4919-b718-759241485335\", \"aud\": \"https://iam.local.io/token\", \"nbf\": 1649162752, \"iss\": \"181f26f9-4562-4919-b718-759241485335\", \"exp\": 1651754752, \"iat\": 1649162752, \"jti\": \"120240aa-e389-4a55-8384-f4d7a54c2633\" } Asymmetrically signed JWT assertion This authentication mechanism is used when your JWT assertion is signed with a private key.\nTo use this mechanism, select Asymmetrically signed JWT assertion and then choose how IAM can get the public key used to validate your JWT assertion. Into the section Public key set below, choose between:\nBy URI and provide a valid JSON Web Keyset URI in the corresponding box, or By value and provide a JSON Web Keyset value in the corresponding box. An asymmetrically signed JWT assertion looks like\n## Header { \"alg\": \"RS256\", \"kid\": \"rsa1\" } ## Payload { \"sub\": \"bdb6ca15-be9c-470a-81dc-69d30dabb340\", \"aud\": \"https://iam.local.io/token\", \"nbf\": 1649162752, \"iss\": \"bdb6ca15-be9c-470a-81dc-69d30dabb340\", \"exp\": 1651754752, \"iat\": 1649162752, \"jti\": \"f4392c1e-6d6a-423e-8e5e-5d114585f750\" } Getting an access token Here is an example of an HTTP POST request to the token endpoint where the client is authenticated with JWT assertion and is authorized via the client credential OAuth2 flow.\n$ curl -d client_assertion=${JWTA} -d client_assertion_type=urn:ietf:params:oauth:client-assertion-type:jwt-bearer -d grant_type=client_credentials https://iam.local.io/token | jq { \"access_token\": \"eyJraWQiOiJyc2ExIiwiY...\", \"token_type\": \"Bearer\", \"expires_in\": 3599, \"scope\": \"storage.read:/ storage.create:/ storage.modify:/\" } If not explicitly requested in the payload, the scopes returned in the access token are all the ones registered for your client.\n","categories":"","description":"","excerpt":"IAM supports several methods to authenticate an OAuth2 client to the …","ref":"/v/v1.10.0/docs/tasks/user/jwt-authn/","tags":"","title":"JWT client authentication"},{"body":"A user can link an external account from the IAM dashboard (i.e., the user must be logged in the IAM service). The following sets of screenshots show the process followed to link a Google account.\nClicking on the “Link Google account” opens a confirmation dialog:\nWhen the user clicks on the Link, button is redirected to Google for authentication:\nAfter a succesfull authentication the user is redirected to the IAM page, and a confirmation dialog shows that the account was linked succesfully: Now the user can logout from the IAM and login using the Sign in with Google button.\nA similar process is implemented for SAML external accounts.\n","categories":"","description":"","excerpt":"A user can link an external account from the IAM dashboard (i.e., the …","ref":"/v/v1.10.0/docs/tasks/user/external-account-linking/","tags":"","title":"Linking an external account"},{"body":"IAM provides the ability to link X.509 certificates to a user account. X.509 account linking works if:\nX.509 certificate authentication is enabled for the IAM instance in use; for more information on this see the Getting started guide The certificate is correctly installed in the browser used to access the IAM; The certificate is trusted by the IAM (i.e. is signed by a certificate authority known and trusted by the IAM) Authenticating with an X.509 certificate If a certificate is correctly configured in the browser, the browser will show a dialog to select whether to authenticate with the certificate or not as in the following screenshot:\nNote that this happens when enstabilishing the connection to the IAM. If no dialog is shown, either:\nthere’s no certificate in the browser that is trusted by the IAM (either the certificate is expired or signed by a CA not trusted by the IAM) a certificate was selected automatically by the browser when authenticating to the IAM In case the certificate used for the authentication is linked to an organization account, the IAM login page will display a “Sign in with your certificate” button:\nLinking a certificate If a certificate was recognized but is not linked to any membership in the IAM, the user will have to authenticate with other credentials (local username \u0026 password, or external authentication mechanisms (e.g. Google)).\nAfter having logged in, the user can link a certificate by clickin on the Link Certificate button:\nNote that the Link certificate button will be shown in the page only if a valid and trusted certificate was detected by the IAM during the TLS handshake.\nClicking the Link certificate button opens a dialog that shows information about the certificate that should be linked to the account:\nIf the linking completes succesfully, the linked certificate information will be shown in the X.509 certificates panel:\nTo check that the linking actually works, the user can logout from the IAM and login again with the certificate.\nUnlinking a certificate A user can unlink a certificate by clicking on the Unlink button shown in the certificate panel (see the image above).\n","categories":"","description":"","excerpt":"IAM provides the ability to link X.509 certificates to a user account. …","ref":"/v/v1.10.0/docs/tasks/user/x509-linking/","tags":"","title":"Linking an X.509 certificate"},{"body":"You can see which access and refresh tokens bound to your identity are currently active from the MitreID dashboard following the “Manage Active Tokens” link:\n","categories":"","description":"","excerpt":"You can see which access and refresh tokens bound to your identity are …","ref":"/v/v1.10.0/docs/tasks/user/manage-active-tokens/","tags":"","title":"Managing active tokens"},{"body":"You can manage approved sites (i.e. sites and services that you approved when authenticating at the IAM) from the MitreID dashboard following the “Manage Approved Sites” link:\n","categories":"","description":"","excerpt":"You can manage approved sites (i.e. sites and services that you …","ref":"/v/v1.10.0/docs/tasks/user/manage-approved-sites/","tags":"","title":"Managing approved sites"},{"body":"Starting with version v1.7.0, IAM allows users to link SSH public keys to their accounts.\nSSH keys are then exposed to relying parties in two ways:\nthrough the IAM SCIM APIs; as a claim in the OpenID Connect userinfo endpoint response, if the token has the ssh-keys scope. Managing account SSH keys The IAM dashboard allows a user to link one or more SSH keys to their account, as shown below:\nAccessing account SSH keys via SCIM APIs As clarified in the SCIM APIs documentation, ssh keys are exposed in the user information returned to authorized clients, as in the following fragment:\n{ \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", ... \"userName\": \"test\", \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"sshKeys\": [ { \"display\": \"my-key\", \"primary\": true, \"value\": \"ssh-rsa AAAAB...\", \"fingerprint\": \"M9vqQeuPrPI0wiaT6sftgfxu1/kowbb37fcLU2+R7yk=\", \"created\": \"2021-08-25T15:18:45.978+02:00\", \"lastModified\": \"2021-08-25T15:18:45.978+02:00\" } ], } } Accessing account SSH keys via the userinfo endpoint SSH keys linked to a user account are returned in the userinfo endpoint response if the token used to access the endpoint has the ssh-keys scope, as in the following example:\n❯ curl -s -L -H \"Authorization: Bearer ${AT}\" https://iam.local.io/userinfo | jq . { \"sub\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"ssh_keys\": [ { \"fingerprint\": \"M9vqQeuPrPI0wiaT6sftgfxu1/kowbb37fcLU2+R7yk=\", \"value\": \"ssh-rsa AAAAB3NzaC1yc2E...\" } ] } Note that the ssh-keys scope is a restricted scope, i.e., it can be assigned to client registered in IAM only by IAM administrators.\n","categories":"","description":"","excerpt":"Starting with version v1.7.0, IAM allows users to link SSH public keys …","ref":"/v/v1.10.0/docs/tasks/user/manage-ssh-keys/","tags":"","title":"Managing SSH keys"},{"body":"The current release of the INDIGO IAM implements part of the Token Exchange OAuth specification. The Token Exchange OAuth specification defines “a lightweigth protocol that enables clients to request and obtain security tokens from authorization servers”.\nOAuth 2.0 was designed to solve the problem of a delegated access to resources across services, mediated by an authorization server, as shown in the following picture:\nOAuth delegation In the picture above we have the usual OAuth roles:\nThe user (or resource owner, in OAuth terminology); A resource server, ie. a service hosting user resources, capable of accepting and responding to protected resource requests using access tokens. A client: this is an agent that has received a permission from the user to act on his behalf on his resources hosted on a resource server; An authorization server: a service that issues access token to clients after having authenticated the user and obtained an authorization from the user that the client is entitled to act on user’s resources There are scenarios when a resource server, in order to satisfy a client request, needs to access resources hosted by other downstream services on behalf of the user, like in the following picture:\nOAuth token exchange In OAuth, access tokens are bearer tokens, so the first resource server could simply use the access token received from the client to interact, on behalf of the user, with the downstream resource server.\nThere are, however, situations in which just using the received access token against the downstream service is not possible, like for instance if the token audience was scoped to be valid only on the first resource server.\nMoreover, the resource server could need the ability to act on behalf of the user for an unbounded amount of time (e.g., to implement long-running computations), not limited by the validity of the received access token.\nThe token exchange specification was designed to provide a protocol in support of these scenarios, where a client can exchange an access token received from antoher client with a new token (or a set of tokens, as we will see) by interacting with a trusted OAuth authorization server.\nImpersonation vs delegation As specified in the Token Exchange OAuth specification, when a subject A impersonates B, A has all the rights of B and it is indistinguishable from B. So, when A interacts within any other entity, A is B.\nWith delegation A still has its own identity, separate from B. So when A interacts within another entity, it is explicit that A is representing B, because B has delegated some of its rights to A.\nMore details about the difference from this two semantics can be found in this section of the specification.\nThe INDIGO IAM token exchange implementation currently supports only impersonation semantics.\nClient configuration requirements In order to request a token exchange, a client must be configured with the urn:ietf:params:oauth:grant-type:token-exchange grant type enabled. The token exchange grant type is disabled by default for dynamically registered clients, and can be enabled only by users with administrative privileges.\nThe token exchange request A client who wants to exchange an access token with a new one (or a couple of new tokens, in case a refresh token is requested), must send an authenticated request to the IAM /token endpoint, specifying the following properties:\nParameter Value grant_type urn:ietf:params:oauth:grant-type:token-exchange subject_token The subject access token that the client wants to exchange scope The set of scopes requested for the new access token audience Optional. A space-separated list of resource identifiers that will be used to limit the audience of the issued token Scopes in exchanged tokens A client, when requesting a token exchange, can request any of the scopes enabled by its client configuration. IAM system scopes are however handled in a special way. These scopes, in order to be “exchanged” across clients, need to be\nenabled for the client requesting the token exchange linked to the subject token presented for the token exchange The list of system scopes currently defined in the IAM can be obtained by registered users by issuing a request to the IAM system scopes API:\ncurl -H \"Authorization: Bearer ...\" https://iam.example/api/scopes Token Exchange example This section describes a token exchange flow.\nWe start with a normal OAuth flow where a client, token-exchange-subject, requests an access token from the IAM using the resource owner password credential flow. The token-exchange-subject client is configured to use HTTP basic authentication against the IAM token endpoint, and in this example acts on behalf of the test user. We use the resource owner password credentials flow for convenience, but any other OAuth or OpenID connect flow that involves a user identity would be fine (i.e., authorization code).\n$ export IAM_TOKEN_ENDPOINT=https://iam.local.io/token $ export SUBJECT_ID=token-exchange-subject $ export SUBJECT_SECRET=... $ export USERNAME=test $ export PASSWORD=... $ curl -s -u $SUBJECT_ID:$SUBJECT_SECRET \\ -d username=$USERNAME \\ -d password=$PASSWORD \\ -d grant_type=password \\ -d scope=\"openid profile\" \\ $IAM_TOKEN_ENDPOINT | tee /tmp/response | jq Note that the only scopes requested in this first request are openid and profile, i.e. the scopes required to access user identity information. IAM token endpoint returns a JSON containing an access token and other info:\n{ \"access_token\": \"eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJhY2JjY2QwOC1kNzNkLTQxZjItODk3MS1iNjA4ZmNjNjYyNmQiLCJpc3MiOiJodHRwczpcL1wvaWFtLmxvY2FsLmlvXC8iLCJleHAiOjE0NzY5NTcxMDIsImlhdCI6MTQ3Njk1MzUwMiwianRpIjoiMjBiZThlNjYtNmNmOS00YzE0LWI4ZDEtZjJmZTc0NDk0YjAxIn0.kqAhZ2MNmBLYIA_-xW9356kD-ndqJ7jKUZRPb7ox_4iXbjcnV6oZYAHZzTH_uBTXA2WsVIJJ-Qicm5JQ0ydb2ewgECAmGkKfL3X4qnnRq2_GgZZof3zlM_rIz3QrDB3v1eIt42YeMdUgODUYGKeDwntT5a7wPDtxe-GM2uL5fik\", \"token_type\": \"Bearer\", \"expires_in\": 3599, \"scope\": \"openid profile\", \"id_token\": \"eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJhY2JjY2QwOC1kNzNkLTQxZjItODk3MS1iNjA4ZmNjNjYyNmQiLCJhdWQiOiIzMmMzMTUyOS05YmM2LTQ1ZWQtYjU0YS0wNGEyNThiMDRmYmYiLCJraWQiOiJyc2ExIiwiaXNzIjoiaHR0cHM6XC9cL2lhbS5sb2NhbC5pb1wvIiwiZXhwIjoxNDc2OTU0MTAyLCJpYXQiOjE0NzY5NTM1MDIsImp0aSI6IjhhMzk1OTM5LTM1N2QtNGY5My04MmEzLTJkMTBkM2ZhMzgzZCJ9.DtNR-ob8kMIUMa2x6TW7krSYMt78tfr5fnTK4aeoIY-wmEWcjPRx1_vT6_lesjMr9w0B_OCALXfOoDBfbF7DhmV7vpbotirkMxvowFBzgppmtBTZNAzLc_Wiwr4IAiGydwjy_UbYrxx6qlWJAKRwzSbDDd3oDVpU-KM8gtLIEa8\" } We put this access token in an environment variable:\n$ export SUBJECT_TOKEN=$(cat /tmp/response | jq -r .access_token) We use this access token to access the app API, which only requires access to user identity to grant access:\ncurl -H \"Authorization: Bearer $SUBJECT_TOKEN\" https://app.example.org/api Suppose now that the app API needs, to properly answer the request from the client, to interact with another downstream service, https://tasks.example.org, on behalf of the user. Unfortunately the set of scopes linked to the access token received are not sufficient to do this, and so app decides to exchange the token received with another one granting enough privileges.\nIn Token Exchange terms, here app is the actor, the subject identity linked to the token is the test user, and the audience for the new token being requested would be the https://tasks.app.example.org/api API.\nSo app would do a request like the following:\n$ export ACTOR_ID=https://app.example.org/api $ export ACTOR_SECRET=... $ export AUDIENCE=https://tasks.example.org/api $ curl -s -u $ACTOR_ID:$ACTOR_SECRET \\ -d grant_type=urn:ietf:params:oauth:grant-type:token-exchange \\ -d audience=$AUDIENCE \\ -d subject_token=$SUBJECT_TOKEN \\ # This token was received from the initial client -d scope=\"openid profile read-tasks\" \\ $IAM_TOKEN_ENDPOINT | tee /tmp/response | jq Note that app requests an additional scope, read-tasks, to interact with the downstream service.\nSince app is a trusted client for token exchange, the IAM responds with the following JSON:\n{ \"access_token\": \"eyJra...\", \"token_type\": \"Bearer\", \"expires_in\": 3599, \"scope\": \"openid profile read-tasks\", \"issued_token_type\": \"urn:ietf:params:oauth:token-type:jwt\" } And app can use the newly issued access token to invoke services on https://task-app.example.org/api on behalf of user test:\n$ curl -H \"Authorization: Bearer eyJra...\" http://tasks.example.org/api Trust Clients that have the token exchange grant enabled are considered trusted clients i.e., no explicit grant from the user is needed to grant access to client scopes. For IAM system scopes, however, these can be “exchanged” only if linked to the original subject token.\nLimitation and known issues The current implementation of Token Exchange in Indigo IAM has the following limitations:\nDelegation is not yet supported: if actor_token or the want_composite parameters are specified within the request, an error response is returned by the authorization server; The resource field is ignored. ","categories":"","description":"","excerpt":"The current release of the INDIGO IAM implements part of the Token …","ref":"/v/v1.10.0/docs/reference/api/oauth-token-exchange/","tags":"","title":"OAuth token exchange API"},{"body":"IAM, through the MitreID OpenID Connect server implementation, supports the OAuth token introspection API API at the /introspect endpoint.\nThe /introspect endpoint requires client authentication.\n","categories":"","description":"","excerpt":"IAM, through the MitreID OpenID Connect server implementation, …","ref":"/v/v1.10.0/docs/reference/api/oauth-token-introspection/","tags":"","title":"OAuth token introspection API"},{"body":"IAM, through the MitreID OpenID Connect server implementation, provides an OAuth/OpenID connect client management API at the /api/clients endpoint.\nDocumentation for this API can be found on the MitreID connect wiki.\n","categories":"","description":"","excerpt":"IAM, through the MitreID OpenID Connect server implementation, …","ref":"/v/v1.10.0/docs/reference/api/oidc-client-management/","tags":"","title":"OpenID Connect client management API"},{"body":"Starting from version 1.8.0, IAM supports the OpenID Connect Dynamic Client Registration API at the /iam/api/client-registration endpoint.\nWarning Support to the dynamic client registration through the MitreID OpenID Connect server implementation at the /register endpoint is deprecated. Client registration does not require authentication.\nExample: registering and deleting a client from the command line With the following template JSON you can easily register a client in the IAM:\n{ \"redirect_uris\": [ \"https://another.client.example/oidc\" ], \"client_name\": \"another-example-client\", \"contacts\": [ \"test@iam.test\" ], \"token_endpoint_auth_method\": \"client_secret_basic\", \"scope\": \"address phone openid email profile offline_access\", \"grant_types\": [ \"refresh_token\", \"authorization_code\" ], \"response_types\": [ \"code\" ] } Save the above JSON into a file (after changing the relevant fields, like contact, rediret_uris, etc…). We will use the client-req.json file name for this example. You can then use httpie as follows to generate the client on the IAM\nhttp https://iam.local.io/iam/api/client-registration \u003c client-req.json \u003e client.json If the command terminates correctly, you will have the client configuration saved in the client.json file. You can use jq to display in a pretty way its contents:\n$ jq . client.json { \"client_id\": \"9bef3e68-f329-4dbf-9c3e-45647c08dfd5\", \"client_secret\": \"ALMjVauX1tXtU2lZytbxfW7JrEx6-ZhZml8bZcEocYOf1enNdIQaWB0aDUmr-nilGjjrznzbWNNWdh8bP0neyUI\", \"client_name\": \"another-example-client\", \"redirect_uris\": [ \"https://another.client.example/oidc\" ], \"contacts\": [ \"test@iam.test\" ], \"grant_types\": [ \"authorization_code\", \"refresh_token\" ], \"response_types\": [ \"code\" ], \"token_endpoint_auth_method\": \"client_secret_basic\", \"scope\": \"address phone openid profile offline_access email\", \"reuse_refresh_token\": true, \"dynamically_registered\": true, \"clear_access_tokens_on_refresh\": true, \"require_auth_time\": false, \"registration_access_token\": \"eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ.eyJpc3MiOiJodHRwOlwvXC9sb2NhbGhvc3Q6ODA4MFwvIiwiYXVkIjoiOWJlZjNlNjgtZjMyOS00ZGJmLTljM2UtNDU2NDdjMDhkZmQ1IiwiaWF0IjoxNjQ5MzM4OTcxLCJqdGkiOiJmNTFlZWIzMS1kY2RkLTQ5MDctYThlZC1jZTViMGU3ODRiODAifQ.Ec5PCjaaIveIpMPhTcYvJfsnJc9Ag_n46ICcaDhh8GDXupKAARv_fx4oCQPgomSKAz4j1bVRgzrmQsswR8lKmWQZv5fG2BMaRdh9epENArUbTsaPqdUfoMsqo-rqeN-eOcl4I1NChnfCPdBi2rSg2M5y4o9DSqhtQUUnig3-n77X8QhN8ES2i2MFgLkwBkc88nvPFdtSpNHvKjIlaXx6YRA3F7kqv7LHNP5OKfnfXNAFPhKweRRTXamEu_oN3-u0TQbxkg8YdNo4CN8hfMYMKsaCigND765zxFeRXSgNkpfZdV3d-8K5aU6TQoIOR41_kylbOh6rt6TGD4IIosEn5w\", \"registration_client_uri\": \"https://iam.local.io/iam/api/client-registration/9bef3e68-f329-4dbf-9c3e-45647c08dfd5\", \"created_at\": 1649338971207 } and also to extract information from it conveniently from the command line. For example, you can extract the client_id and registration_access_token with the following commands:\nexport CID=$(jq -r .client_id client.json) export RAT=$(jq -r .registration_access_token client.json) and use them to delete the client:\n$ http DELETE https://iam.local.io/iam/api/client-registration/${CID} Authorization:\"Bearer ${RAT}\" HTTP/1.1 204 No Content Access-Control-Allow-Origin: * Cache-Control: no-cache, no-store, max-age=0, must-revalidate Connection: keep-alive Content-Language: en-US Date: Thu, 07 Apr 2022 13:51:40 GMT Expires: 0 Pragma: no-cache Server: nginx/1.13.1 Strict-Transport-Security: max-age=31536000 ; includeSubDomains X-Application-Context: INDIGO IAM:mysql,google,registration,saml,mysql-test:8080 X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block or get client information:\nhttp GET https://iam.local.io/iam/api/client-registration/${CID} Authorization:\"Bearer ${RAT}\" HTTP/1.1 200 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Connection: keep-alive Content-Encoding: gzip Content-Type: application/json Date: Fri, 03 Nov 2023 16:54:53 GMT Expires: 0 Pragma: no-cache Server: nginx/1.13.12 Strict-Transport-Security: max-age=15724800; includeSubDomains Transfer-Encoding: chunked Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block { \"clear_access_tokens_on_refresh\": true, \"client_id\": \"9bef3e68-f329-4dbf-9c3e-45647c08dfd5\", \"client_name\": \"another-example-client\", \"client_secret\": \"ALMjVauX1tXtU2lZytbxfW7JrEx6-ZhZml8bZcEocYOf1enNdIQaWB0aDUmr-nilGjjrznzbWNNWdh8bP0neyUI\", \"contacts\": [ \"test@iam.test\" ], \"created_at\": 1699030393000, \"dynamically_registered\": true, \"grant_types\": [ \"authorization_code\", \"refresh_token\" ], \"redirect_uris\": [ \"https://another.client.example/oidc\" ], \"registration_client_uri\": \"https://iam.local.io/iam/api/client-registration/9bef3e68-f329-4dbf-9c3e-45647c08dfd5\", \"require_auth_time\": false, \"response_types\": [ \"code\" ], \"reuse_refresh_token\": true, \"scope\": \"address phone openid profile offline_access email\", \"token_endpoint_auth_method\": \"client_secret_basic\" } or update the client, e.g. client name:\nhttp PUT https://iam.local.io/iam/api/client-registration/${CID} Authorization:\"Bearer ${RAT}\" @update-client.json HTTP/1.1 200 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Connection: keep-alive Content-Encoding: gzip Content-Type: application/json Date: Fri, 03 Nov 2023 16:56:15 GMT Expires: 0 Pragma: no-cache Server: nginx/1.13.12 Strict-Transport-Security: max-age=15724800; includeSubDomains Transfer-Encoding: chunked Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers X-Content-Type-Options: nosniff X-Frame-Options: DENY X-XSS-Protection: 1; mode=block { \"clear_access_tokens_on_refresh\": true, \"client_id\": \"9bef3e68-f329-4dbf-9c3e-45647c08dfd5\", \"client_name\": \"another-client\", \"client_secret\": \"ALMjVauX1tXtU2lZytbxfW7JrEx6-ZhZml8bZcEocYOf1enNdIQaWB0aDUmr-nilGjjrznzbWNNWdh8bP0neyUI\", \"contacts\": [ \"test@iam.test\" ], \"created_at\": 1699030393000, \"dynamically_registered\": true, \"grant_types\": [ \"refresh_token\", \"authorization_code\" ], \"redirect_uris\": [ \"https://another.client.example/oidc\" ], \"registration_client_uri\": \"https://iam.local.io/iam/api/client-registration/9bef3e68-f329-4dbf-9c3e-45647c08dfd5\", \"require_auth_time\": false, \"response_types\": [ \"code\" ], \"reuse_refresh_token\": true, \"scope\": \"address phone openid profile offline_access email\", \"token_endpoint_auth_method\": \"client_secret_basic\" } ","categories":"","description":"","excerpt":"Starting from version 1.8.0, IAM supports the OpenID Connect Dynamic …","ref":"/v/v1.10.0/docs/reference/api/oidc-client-registration/","tags":"","title":"OpenID Connect client registration API"},{"body":"Users can reset their password from the IAM login page by clicking on the Forgot your password? link, which opens a dialog where users can then enter their email address, and if the entered email address is linked to a registered user a reset password link will be sent to such email address.\n","categories":"","description":"","excerpt":"Users can reset their password from the IAM login page by clicking on …","ref":"/v/v1.10.0/docs/tasks/user/reset-password/","tags":"","title":"Reset an account password"},{"body":"The IAM server provides a RESTful API, based on the System for Cross-domain Identity Management (SCIM) standard, that can be used to manage users, change their personal information, manage their group membership, etc.\nAccess to the API is restricted to administrator users authenticated via web interface or OAuth clients that have access to the scim:read (for read access) or scim:write (for write access) OAuth scopes. Note that these scopes are restricted in the default IAM configuration, i.e. can be assigned to clients only by IAM administrators.\nExamples below assume OAuth authorization via bearer token: e.g.\nGET /Users/2819c223-7f76-453a-919d-413861904646 HTTP/1.1 Host: example.com Authorization: Bearer h480djs93hd8 The SCIM protocol specifies well known endpoints and HTTP methods for managing Resources defined in the SCIM core schema specification.\nIAM SCIM Endpoints IAM implements the following SCIM endpoints:\n/scim/Users, providing access to user account resources; /scim/Groups, providing access to group resources; /scim/Me, providing access to the user account resource for the currently authenticated user. For the /scim/Users and /scim/Groups endpoints the following methods are implemented:\nHTTP Method Description GET Retrieves a complete or partial Resource. POST Create new Resource or bulk modify Resources. PUT Replace completely a Resource. PATCH Modifies a Resource with a set of specified changes (partial update). DELETE Deletes a Resource. For the /scim/Me endpoint, only the GET and PATCH methods are implemented.\nWarning For scalability reasons, IAM no longer returns the members claim for the SCIM Group resources, as the SCIM standard does not currently describe a way to implement pagination on group members.\nFor this reason, IAM provides two additional resources:\nthe members resource, which returns a paginated view of users belonging to a given group; the sugroups resource, which returns a paginated view of subgroups of a given group. Pagination IAM SCIM implementation supports pagination on the /scim/Users, /scim/Groups resources, as mandated by the standard, but also on the non-standard /scim/Groups/{id}/members and /scim/Groups/{id}/subgroups endpoints.\nPagination allows to “page through” large numbers of resources. Pagination is not session based so clients must never assume repeatable results.\nThe following table describes URL pagination parameters:\nParameter Description Default startIndex The 1-based index of the first search result. 1 count Non-negative Integer. Specifies the desired maximum number of search results per page; e.g., 10. None. The following table describes the query response pagination attributes:\nElement Description itemsPerPage Non-negative Integer. Specifies the number of search results returned in a query response page; e.g., 10. totalResults Non-negative Integer. Specifies the total number of results matching the client query; e.g., 1000. startIndex The 1-based index of the first result in the current set of search results; e.g., 1. The IAM SCIM resource schemas SCIM provides an extensible schema mechanism that allows to describe multiple resource types. Currently IAM supports two resource types:\nUsers Groups User resources The IAM SCIM user resource provides basic user information as mandated by the SCIM user schema (e.g., username, group membership, email addresses) as well as IAM specific information as defined by the urn:indigo-dc:scim:schemas:IndigoUser schema.\nClaim Description oidcIds A list of OpenID Connect accounts linked to the user account samlIds A list of SAML accounts linked to the user account certificates A list of X.509 certificates linked to the user account endTime The user membership end time aupSignatureTime The time when the organization AUP document was last signed labels A set of labels linked to the account Example { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"meta\": { \"created\": \"2021-08-24T11:42:22.463+02:00\", \"lastModified\": \"2021-08-24T17:37:58.838+02:00\", \"location\": \"https://iam.local.io/scim/Users/80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"resourceType\": \"User\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"test\", \"name\": { \"familyName\": \"User\", \"formatted\": \"Test User\", \"givenName\": \"Test\" }, \"displayName\": \"test\", \"active\": true, \"emails\": [ { \"type\": \"work\", \"value\": \"test@iam.test\", \"primary\": true } ], \"groups\": [ { \"display\": \"Production\", \"value\": \"c617d586-54e6-411d-8e38-64967798fa8a\", \"$ref\": \"https://iam.local.io/scim/Groups/c617d586-54e6-411d-8e38-64967798fa8a\" }, { \"display\": \"Analysis\", \"value\": \"6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\", \"$ref\": \"https://iam.local.io/scim/Groups/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\" } ], \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"oidcIds\": [ { \"issuer\": \"https://accounts.google.com\", \"subject\": \"105440632287425289613\" }, { \"issuer\": \"urn:test-oidc-issuer\", \"subject\": \"test-user\" } ], \"sshKeys\": [ { \"display\": \"my-ssh-key\", \"primary\": true, \"value\": \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAjeLbypc7mmllwLgeVTh85s42ctrt4NhIyoW2oyyMkfGA+7LxDCoui0ttXIl06ATA7vDnuMpuQpPtW6V+4K7Mb65mQOOcy+aooQhLSdxhRNxiYmcJ80SK2lded0HiJUPi8H0iVF5ZiYh3ZYargI38Q182nAgcqPIFEmCgJ+h74d/BpE8LgfoB2fGHznShPjECrrDqruwnzjVljVKVK1PRSyfxoDLKT+ha26IDVTp3BimXOA/Iq53U0EPYP4n8S8EZfdVCdvH0vjZqASD1kBVXuoi50A/ls748bO4dADPXVmahsF+AeJzV6cnah9/6thSLa04v+z0fJ4kD/1g12uP1 cecco@dot1x-179.cnaf.infn.it\", \"fingerprint\": \"DIXYv4H+HoUUkH07cM0NCOKMVVRTl3ZLfGoWNCgN9v0=\", \"created\": \"2021-08-24T14:53:54.130+02:00\", \"lastModified\": \"2021-08-24T14:53:54.130+02:00\" } ], \"samlIds\": [ { \"idpId\": \"https://idptestbed/idp/shibboleth\", \"userId\": \"andrea.ceccanti@example.org\", \"attributeId\": \"urn:oid:0.9.2342.19200300.100.1.3\" }, { \"idpId\": \"https://idptestbed/idp/shibboleth\", \"userId\": \"78901@idptestbed\", \"attributeId\": \"urn:oid:1.3.6.1.4.1.5923.1.1.1.13\" } ], \"certificates\": [ { \"primary\": false, \"subjectDn\": \"CN=Andrea Ceccanti,CN=657221,CN=aceccant,OU=Users,OU=Organic Units,DC=cern,DC=ch\", \"issuerDn\": \"CN=CERN Grid Certification Authority,DC=cern,DC=ch\", \"pemEncodedCertificate\": \"-----BEGIN CERTIFICATE-----\\nMIIIyjCCBrKgAwIBAgIKKVs4XgAAACyrkDANBgkqhkiG9w0BAQ0FADBWMRIwEAYK\\nCZImiZPyLGQBGRYCY2gxFDASBgoJkiaJk/IsZAEZFgRjZXJuMSowKAYDVQQDEyFD\\nRVJOIEdyaWQgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMjAwNTA1MTIyNTMx\\nWhcNMjEwNjA5MTIyNTMxWjCBkDESMBAGCgmSJomT8ixkARkWAmNoMRQwEgYKCZIm\\niZPyLGQBGRYEY2VybjEWMBQGA1UECxMNT3JnYW5pYyBVbml0czEOMAwGA1UECxMF\\nVXNlcnMxETAPBgNVBAMTCGFjZWNjYW50MQ8wDQYDVQQDEwY2NTcyMjExGDAWBgNV\\nBAMTD0FuZHJlYSBDZWNjYW50aTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoC\\nggEBAKj1dA0ghFbopQFnq3GS/kMfF9DQ7gyqy1vr7rbX8b2MHhkxObS+3mHrDlDm\\nrKfvHhf2jmX/qfb22QGiD//NYOqzFGrjdyR/tFJNIjpy32GUzQWwW57YWpKaQTFB\\npU3UjZFLQQYd7fBdcbjnqvgdshEXxJfz8R74XS03w1qgVpBt27xnVXq2iwQTV9oo\\nv8FvY3RiNeZUMqN7or6QuDQ779wfd8/TaKDWUCmHUihcYW2wJsOtAQO3pIpMo+zE\\nf+W2vjq6l8b0LMLQh0wR094Rpl5Teu1eYgRRyKFRDHTP80XYpjDBy7YZttg3zmy5\\n4vAZYJmD3KC1EN0KkUBiwLdLMI8CAwEAAaOCBF0wggRZMB0GA1UdDgQWBBQD4yJP\\nZK7pptCVP+aRL6BF0nGzUDAfBgNVHSMEGDAWgBSloP1mWP253Xrhsp2fo9HlUBiU\\n5zCCATgGA1UdHwSCAS8wggErMIIBJ6CCASOgggEfhk5odHRwOi8vY2FmaWxlcy5j\\nZXJuLmNoL2NhZmlsZXMvY3JsL0NFUk4lMjBHcmlkJTIwQ2VydGlmaWNhdGlvbiUy\\nMEF1dGhvcml0eS5jcmyGgcxsZGFwOi8vL0NOPUNFUk4lMjBHcmlkJTIwQ2VydGlm\\naWNhdGlvbiUyMEF1dGhvcml0eSxDTj1DRVJOUEtJMDUsQ049Q0RQLENOPVB1Ymxp\\nYyUyMEtleSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24s\\nREM9Y2VybixEQz1jaD9jZXJ0aWZpY2F0ZVJldm9jYXRpb25MaXN0P2Jhc2U/b2Jq\\nZWN0Q2xhc3M9Y1JMRGlzdHJpYnV0aW9uUG9pbnQwggFiBggrBgEFBQcBAQSCAVQw\\nggFQMGMGCCsGAQUFBzAChldodHRwOi8vY2FmaWxlcy5jZXJuLmNoL2NhZmlsZXMv\\nY2VydGlmaWNhdGVzL0NFUk4lMjBHcmlkJTIwQ2VydGlmaWNhdGlvbiUyMEF1dGhv\\ncml0eS5jcnQwgcIGCCsGAQUFBzAChoG1bGRhcDovLy9DTj1DRVJOJTIwR3JpZCUy\\nMENlcnRpZmljYXRpb24lMjBBdXRob3JpdHksQ049QUlBLENOPVB1YmxpYyUyMEtl\\neSUyMFNlcnZpY2VzLENOPVNlcnZpY2VzLENOPUNvbmZpZ3VyYXRpb24sREM9Y2Vy\\nbixEQz1jaD9jQUNlcnRpZmljYXRlP2Jhc2U/b2JqZWN0Q2xhc3M9Y2VydGlmaWNh\\ndGlvbkF1dGhvcml0eTAkBggrBgEFBQcwAYYYaHR0cDovL29jc3AuY2Vybi5jaC9v\\nY3NwMA4GA1UdDwEB/wQEAwIFoDA9BgkrBgEEAYI3FQcEMDAuBiYrBgEEAYI3FQiD\\nvdAJgu2NDYbtiyuB3vU3hYDQYh6FiuNMgbWqBAIBZAIBEDApBgNVHSUEIjAgBgor\\nBgEEAYI3CgMEBggrBgEFBQcDBAYIKwYBBQUHAwIwJwYDVR0gBCAwHjAOBgwrBgEE\\nAWAKBAICAwEwDAYKKoZIhvdMBQICATA1BgkrBgEEAYI3FQoEKDAmMAwGCisGAQQB\\ngjcKAwQwCgYIKwYBBQUHAwQwCgYIKwYBBQUHAwIwVQYDVR0RBE4wTKAsBgorBgEE\\nAYI3FAIDoB4MHGFuZHJlYS5jZWNjYW50aUBjbmFmLmluZm4uaXSBHGFuZHJlYS5j\\nZWNjYW50aUBjbmFmLmluZm4uaXQwRAYJKoZIhvcNAQkPBDcwNTAOBggqhkiG9w0D\\nAgICAIAwDgYIKoZIhvcNAwQCAgCAMAcGBSsOAwIHMAoGCCqGSIb3DQMHMA0GCSqG\\nSIb3DQEBDQUAA4ICAQBt1/UjP+mz2/7SnAacu4BiELdBAumD+HiO2RZR9BltqX8u\\n1nDsOYnwBKvoSYFRWrVv19s0uHdlOGQkJV10Un6KpNES91LosT/EVcBn4EIDK+qH\\ncSjJAWUWCeu0Vfqm5HD0adH7K210gvqVC6U/m+nCAcNqWcPiH84YwiFBDKVqzolO\\nRqkGc7C1tvljeiskcXEDbY8QOPIJSbpsgPEihOAmz9mZ72MwQMbYc8x0f/2ucw9I\\nIUwm/FYzGSVDL3XOmc3+wGsmb4dYSaSReBCpbtt0aHuNHGaRzYpHn65lbkN31kok\\nqAUoWyjd2MHVfzPCc9kyTxACWI1NvkiQuetr/UHF3pDQsdJj51DkmApLn/RvSwq7\\nS9tFpYcrAWYYpqWwH7rnvvWxQUZLgtrYc2PK7AUSq5AW3fMYqYyPPeHEb5Nn4LJ1\\nTisVMJgXk+vx3FGLSIbry+qzY1mENjzKGHQnV+8OhZAcykTi1torMoC0dJZDZzWf\\nnWPiBweoUDH8TgvfI8SqID6CI6CQnOqh8VXD9vQsRoeCwqNVnNHQUh2qUAVUMyuU\\n5z/nWRhjsgqcCB1ERfWeI0xznj86o8GgaTMkXiZgGWDrdwqqm5S75tUWJ6BDJd/1\\nJD7zeEY8Vl9sjqsUQIX2m5MPNkdW57SkpSbNFx55uiUNJmpUxOSxcuR+PIvSJw==\\n-----END CERTIFICATE-----\", \"display\": \"test\", \"created\": \"2021-08-24T17:37:58.838+02:00\", \"lastModified\": \"2021-08-24T17:37:58.838+02:00\", \"hasProxyCertificate\": false } ] } } OpenId Connect accounts Claim Description issuer The issuer string of the linked OpenID connect account subject The subject string of the linked OpenID connect account SAML accounts Claim Description idpId The entityId of the SAML IdP of the linked account attributeId The id of the attribute used for the linking userId The valute of the attribute used for the linked account Certificates Claim Description primary Whether the certificate should be considered the primary certificate for the user subjectDn The certificate subject distinguished name issuerDn The certificate issuer distinguished name pemEncodedCertificate An optional pem encoded certificate for the user display A display name for the certificate created When the certificate was first linked to the account lastModified When the certificate was last modified hasProxyCertificate Whether a managed proxy certificate is stored in IAM for this cert SshKeys Claim Description display A descriptive label linked to the key primary Whether the key should be considered the primary one for the user value The ssh key encoded value fingerprint The key fingerprint created When the key was first linked to the account lastModified When the key was last modified Group resources The IAM SCIM group resource provides basic group information as mandated by the SCIM core group schema (e.g., group display name, username, group membership, email addresses) as well as IAM specific information as defined by the urn:indigo-dc:scim:schemas:IndigoGroup schema.\nClaim Description parentGroup A reference to the parent group description A textual description linked to the group labels A set of labels linked to the group Example { \"id\": \"4dc76711-3b5d-4ed6-a73d-b8154faca9d6\", \"meta\": { \"created\": \"2021-08-24T18:17:58.407+02:00\", \"lastModified\": \"2021-08-24T18:17:58.407+02:00\", \"location\": \"https://iam.local.io/scim/Groups/4dc76711-3b5d-4ed6-a73d-b8154faca9d6\", \"resourceType\": \"Group\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:Group\", \"urn:indigo-dc:scim:schemas:IndigoGroup\" ], \"displayName\": \"Analysis/subgroup\", \"urn:indigo-dc:scim:schemas:IndigoGroup\": { \"parentGroup\": { \"display\": \"Analysis\", \"value\": \"6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\", \"$ref\": \"https://iam.local.io/scim/Groups/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\" }, \"description\": \"A subgroup of the Analysis group\", \"labels\": [ { \"name\": \"temporary\" } ] } } GET /scim/Me Retrieves information about the currently authenticated user.\nGET http://localhost:8080/scim/Me { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"meta\": { \"created\": \"2021-08-24T11:42:22.463+02:00\", \"lastModified\": \"2021-08-24T14:53:54.130+02:00\", \"location\": \"https://iam.local.io/scim/Users/80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"resourceType\": \"User\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"test\", \"name\": { \"familyName\": \"User\", \"formatted\": \"Test User\", \"givenName\": \"Test\" }, \"displayName\": \"test\", \"active\": true, \"emails\": [ { \"type\": \"work\", \"value\": \"test@iam.test\", \"primary\": true } ], \"groups\": [ { \"display\": \"Production\", \"value\": \"c617d586-54e6-411d-8e38-64967798fa8a\", \"$ref\": \"https://iam.local.io/scim/Groups/c617d586-54e6-411d-8e38-64967798fa8a\" }, { \"display\": \"Analysis\", \"value\": \"6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\", \"$ref\": \"https://iam.local.io/scim/Groups/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\" } ], \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"oidcIds\": [ { \"issuer\": \"https://accounts.google.com\", \"subject\": \"105440632287425289613\" }, { \"issuer\": \"urn:test-oidc-issuer\", \"subject\": \"test-user\" } ], \"sshKeys\": [ { \"display\": \"my-ssh-key\", \"primary\": true, \"value\": \"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDAjeLbypc7mmllwLgeVTh85s42ctrt4NhIyoW2oyyMkfGA+7LxDCoui0ttXIl06ATA7vDnuMpuQpPtW6V+4K7Mb65mQOOcy+aooQhLSdxhRNxiYmcJ80SK2lded0HiJUPi8H0iVF5ZiYh3ZYargI38Q182nAgcqPIFEmCgJ+h74d/BpE8LgfoB2fGHznShPjECrrDqruwnzjVljVKVK1PRSyfxoDLKT+ha26IDVTp3BimXOA/Iq53U0EPYP4n8S8EZfdVCdvH0vjZqASD1kBVXuoi50A/ls748bO4dADPXVmahsF+AeJzV6cnah9/6thSLa04v+z0fJ4kD/1g12uP1 cecco@dot1x-179.cnaf.infn.it\", \"fingerprint\": \"DIXYv4H+HoUUkH07cM0NCOKMVVRTl3ZLfGoWNCgN9v0=\", \"created\": \"2021-08-24T14:53:54.130+02:00\", \"lastModified\": \"2021-08-24T14:53:54.130+02:00\" } ], \"samlIds\": [ { \"idpId\": \"https://idptestbed/idp/shibboleth\", \"userId\": \"andrea.ceccanti@example.org\", \"attributeId\": \"urn:oid:0.9.2342.19200300.100.1.3\" }, { \"idpId\": \"https://idptestbed/idp/shibboleth\", \"userId\": \"78901@idptestbed\", \"attributeId\": \"urn:oid:1.3.6.1.4.1.5923.1.1.1.13\" } ] } } GET /scim/Users/{id} Retrieves all the information about the user identified by id and returns results in application/json.\nRequires scim:read scope.\nGET http://localhost:8080/scim/Users/2cb10ac5-5b1a-47a0-8f60-48995999f18d { \"id\": \"2cb10ac5-5b1a-47a0-8f60-48995999f18d\", \"meta\": { \"created\": \"2016-07-13T18:38:16.314+02:00\", \"lastModified\": \"2016-07-13T18:38:16.314+02:00\", \"location\": \"http://localhost:8080/scim/Users/2cb10ac5-5b1a-47a0-8f60-48995999f18d\", \"resourceType\": \"User\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"paul_mccartney\", \"name\": { \"givenName\": \"Paul\", \"familyName\": \"McCartney\", \"formatted\": \"Paul McCartney\" }, \"displayName\": \"paul_mccartney\", \"active\": false, \"emails\": [ { \"type\": \"work\", \"value\": \"paul@beatles.uk\", \"primary\": true } ] } POST /scim/Users Creates a new user, using the info specified within the request body, sent as application/json.\nRequires scim:write scope.\nPOST http://localhost:8080/scim/Users/ { \"userName\": \"paul_mccartney\", \"name\": { \"givenName\": \"Paul\", \"familyName\": \"McCartney\", \"formatted\": \"Paul McCartney\" }, \"emails\": [ { \"type\": \"work\", \"value\": \"paul@beatles.uk\", \"primary\": true } ] } Successful Resource creation is indicated with a 201 Created response code. Upon successful creation, the response body contains the newly created User.\n{ \"id\": \"2cb10ac5-5b1a-47a0-8f60-48995999f18d\", \"meta\": { \"created\": \"2016-07-13T18:38:16.314+02:00\", \"lastModified\": \"2016-07-13T18:38:16.314+02:00\", \"location\": \"http://localhost:8080/scim/Users/2cb10ac5-5b1a-47a0-8f60-48995999f18d\", \"resourceType\": \"User\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"paul_mccartney\", \"name\": { \"givenName\": \"Paul\", \"familyName\": \"McCartney\", \"formatted\": \"Paul McCartney\" }, \"displayName\": \"paul_mccartney\", \"active\": false, \"emails\": [ { \"type\": \"work\", \"value\": \"paul@beatles.uk\", \"primary\": true } ] } GET /scim/Users Requires scim:read scope.\nSCIM defines a standard set of operations that can be used to filter, sort, and paginate response results. The operations are specified by adding query parameters to the Resource’s endpoint.\nThe example below returns the first 10 users (implicit startIndex as 1):\nGET /scim/Users?count=10 { \"totalResults\": 250, \"itemsPerPage\": 10, \"startIndex\": 1, \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:ListResponse\" ], \"Resources\": [ { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"meta\": { \"created\": \"2016-07-14T12:22:46.376+02:00\", \"lastModified\": \"2016-07-14T12:22:46.376+02:00\", \"location\": \"http://localhost:8080/scim/Users/80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"resourceType\": \"User\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"test\", \"name\": { \"givenName\": \"Test\", \"familyName\": \"User\", \"formatted\": \"Test User\" }, \"displayName\": \"test\", \"active\": true, \"emails\": [ { \"type\": \"work\", \"value\": \"test@iam.test\", \"primary\": true } ], \"groups\": [ { \"display\": \"Production\", \"value\": \"c617d586-54e6-411d-8e38-64967798fa8a\", \"$ref\": \"http://localhost:8080/scim/Groups/c617d586-54e6-411d-8e38-64967798fa8a\" }, { \"display\": \"Analysis\", \"value\": \"6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\", \"$ref\": \"http://localhost:8080/scim/Groups/6a384bcd-d4b3-4b7f-a2fe-7d897ada0dd1\" } ], \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"oidcIds\": [ { \"issuer\": \"https://accounts.google.com\", \"subject\": \"105440632287425289613\" } ], \"samlIds\": [ { \"idpId\": \"https://idptestbed/idp/shibboleth\", \"userId\": \"andrea.ceccanti@example.org\" } ] } }, [...] ] } The details of the returned users can be reduced/filtered by specifying the needed attribute(s). The below example returns only the userName for all Users:\nGET http://localhost:8080/scim/Users?attributes=userName { \"totalResults\": 250, \"itemsPerPage\": 100, \"startIndex\": 1, \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:ListResponse\" ], \"Resources\": [ { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"test\" }, { \"id\": \"73f16d93-2441-4a50-88ff-85360d78c6b5\", \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"admin\" }, [...] ] } Multiple attributes are also supported:\nGET http://localhost:8080/scim/Users?count=2\u0026attributes=userName%2Cemails%2Curn%3Aindigo-dc%3Ascim%3Aschemas%3AIndigoUser Request params:\ncount=2 attributes=userName,emails,urn:indigo-dc:scim:schemas:IndigoUser { \"totalResults\": 250, \"itemsPerPage\": 2, \"startIndex\": 1, \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:ListResponse\" ], \"Resources\": [ { \"id\": \"80e5fb8d-b7c8-451a-89ba-346ae278a66f\", \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"test\", \"emails\": [ { \"type\": \"work\", \"value\": \"test@iam.test\", \"primary\": true } ], \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"oidcIds\": [ { \"issuer\": \"https://accounts.google.com\", \"subject\": \"105440632287425289613\" } ], \"samlIds\": [ { \"idpId\": \"https://idptestbed/idp/shibboleth\", \"userId\": \"andrea.ceccanti@example.org\" } ] } }, { \"id\": \"73f16d93-2441-4a50-88ff-85360d78c6b5\", \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"admin\", \"emails\": [ { \"type\": \"work\", \"value\": \"admin@iam.test\", \"primary\": true } ], \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"oidcIds\": [ { \"issuer\": \"https://accounts.google.com\", \"subject\": \"114132403455520317223\" } ], \"samlIds\": [ { \"idpId\": \"https://idptestbed/idp/shibboleth\", \"userId\": \"ciccio.paglia@example.org\" } ] } } ] } SCIM Filtering and sorting of results are currently not supported.\nPUT /scim/Users/{id} Requires scim:write scope.\nPUT performs a full update. Clients should retrieve the entire resource and then PUT the desired modifications as the operation overwrites all previously stored data. A successful PUT operation returns a 200 OK response code and the entire resource within the response body.\nExample of changing the userName from john_lennon to j.lennon and setting active as true:\nGET http://localhost:8080/scim/Users/e380b4e3-7b63-47c2-b156-3699be9ebcfe { \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"john_lennon\", \"name\": { \"givenName\": \"John\", \"familyName\": \"Lennon\", \"formatted\": \"John Lennon\" }, \"emails\": [ { \"type\": \"work\", \"value\": \"lennon@email.test\", \"primary\": true } ] } Retrieved the user’s info, update userName as \"userName\": \"j.lennon\" and add \"active\": true:\nPUT http://localhost:8080/scim/Users/e380b4e3-7b63-47c2-b156-3699be9ebcfe { \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"j.lennon\", \"name\": { \"givenName\": \"John\", \"familyName\": \"Lennon\", \"formatted\": \"John Lennon\" }, \"active\": true, \"emails\": [ { \"type\": \"work\", \"value\": \"lennon@email.test\", \"primary\": true } ] } The returned answer is:\nHTTP/1.1 200 OK Content-Type: application/scim+json;charset=UTF-8 { \"id\": \"e380b4e3-7b63-47c2-b156-3699be9ebcfe\", \"meta\": { \"created\": \"2016-07-14T15:42:56.275+02:00\", \"lastModified\": \"2016-07-14T15:42:56.445+02:00\", \"location\": \"http://localhost:8080/scim/Users/e380b4e3-7b63-47c2-b156-3699be9ebcfe\", \"resourceType\": \"User\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:User\", \"urn:indigo-dc:scim:schemas:IndigoUser\" ], \"userName\": \"j.lennon\", \"name\": { \"givenName\": \"John\", \"familyName\": \"Lennon\", \"formatted\": \"John Lennon\" }, \"displayName\": \"j.lennon\", \"active\": true, \"emails\": [ { \"type\": \"work\", \"value\": \"lennon@email.test\", \"primary\": true } ] } PATCH /scim/Users/{id} Requires scim:write scope.\nPATCH enables consumers to send only the attributes requiring modification, reducing network and processing overhead. Attributes may be deleted, replaced, merged, or added in a single request. The body of a PATCH request MUST contain a partial resource with the desired modifications. The server MUST return either a 200 OK response code and the entire Resource within the response body, or a 204 No Content response code and the appropriate response headers for a successful PATCH request.\nThe following example shows how to replace the userName:\nPATCH http://localhost:8080/scim/Users/b6769dd1-3d7d-416d-be6d-020be23ba904 Body: { \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:PatchOp\" ], \"operations\": [ { \"op\": \"replace\", \"value\": { \"userName\": \"john_lennon_jr\", } } ] } The following example shows how to add an OpenID Connect account and a ssh key:\nPATCH http://localhost:8080/scim/Users/b6769dd1-3d7d-416d-be6d-020be23ba904 Body: { \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:PatchOp\" ], \"operations\": [ { \"op\": \"add\", \"value\": { \"urn:indigo-dc:scim:schemas:IndigoUser\": { \"oidcIds\": [ { \"issuer\": \"test_issuer\", \"subject\": \"test_subject\" } ], \"sshKeys\": [ { \"display\": \"Personal\", \"primary\": true, \"value\": \"AAAAB3NzaC1yc2EAAAADAQABAAABAQC4tjz4mfMLvJsM8RXIgdRYPBhH//VXLXbeLbUsJpm5ARIQPY6Gu1befPA3jqKacvdcBrMsYGiMp/DOhpkAwWclSnzMdvYLbYWkrOPwBVrRh7lvFtXFLaQZ6do4uMZHb5zU2ViTFacrJ6zJ/GLltjk4nBea7Z4qHaQdWou3Fk/108oMQGx7jqW44m+TA+HYo6rEbVWbimWVXyyiKchO2LTLKUbK6GBSWJiItezwAWR3KKs3FXKRmbJDiKESh3mDccJidfkjzNLPyDf3JHI2b/C/mcvtJsoAtkIWuVll2BhBBiqkYt3tX2llZCYGtF7rZOYTsqhw+LPnsJtsX+W7e4iN\" } ] } } } ] } DELETE /scim/Users/{id} Requires scim:write scope.\nClients request user removal via DELETE.\nDELETE /scim/Users/4380e98c-02f2-4d10-85ba-9fbbdb819ed8 HTTP/1.1 200 OK Example: Client attempt to retrieve the previously deleted User:\nGET /scim/Users/4380e98c-02f2-4d10-85ba-9fbbdb819ed8 { \"status\": \"404\", \"detail\": \"No user mapped to id '4380e98c-02f2-4d10-85ba-9fbbdb819ed8'\", \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:Error\" ] } GET /scim/Groups/{id} Retrieves information about the group identified by id and returns results in application/json.\nRequires scim:read scope.\nGET /scim/Groups/c617d586-54e6-411d-8e38-64967798fa8a { \"id\": \"c617d586-54e6-411d-8e38-64967798fa8a\", \"meta\": { \"created\": \"2016-07-14T16:22:05.170+02:00\", \"lastModified\": \"2016-07-14T16:22:05.170+02:00\", \"location\": \"http://localhost:8080/scim/Groups/c617d586-54e6-411d-8e38-64967798fa8a\", \"resourceType\": \"Group\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:Group\" ], \"displayName\": \"Production\" } Warning To provide scalable management of group membership, IAM does no longer return the members claim for the SCIM Group resources, as the SCIM standard does not currently describe a way to implement pagination on group members.\nSee the members and subgroups sub-resources.\nGET /scim/Groups/{id}/members Returns a paginated list of user accounts, ordered by username, which are members of the group identified by id. To know about more about pagination parameters, see the Pagination section.\nRequires scim:read scope.\nGET https://wlcg.cloud.cnaf.infn.it/scim/Groups/b86a9e99-9f0e-478f-999c-2046c764aa14/members?count=5 { \"totalResults\": 151, \"itemsPerPage\": 5, \"startIndex\": 1, \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:ListResponse\" ], \"Resources\": [ { \"display\": \"Example User 1\", \"value\": \"92287eed-80eb-4702-be59-a9e313d7b85e\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Users/92287eed-80eb-4702-be59-a9e313d7b85e\" }, { \"display\": \"Example User 2\", \"value\": \"bda5a5af-4067-4814-9b59-fd7265978cc4\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Users/bda5a5af-4067-4814-9b59-fd7265978cc4\" }, { \"display\": \"Example User 3\", \"value\": \"7489bf81-65db-4457-8ea6-6707d6405681\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Users/7489bf81-65db-4457-8ea6-6707d6405681\" }, { \"display\": \"Example User 4\", \"value\": \"90cc5097-d904-4290-97b9-08a2646326b3\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Users/90cc5097-d904-4290-97b9-08a2646326b3\" }, { \"display\": \"Example User 5\", \"value\": \"e83eec5a-e2e3-43c6-bb67-df8f5ec3e8d0\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Users/e83eec5a-e2e3-43c6-bb67-df8f5ec3e8d0\" } ] } GET /scim/Groups/{id}/subgroups Returns a paginated list of groups, ordered by name, which are direct sub-groups of the group identified by id. To know about more about pagination parameters, see the Pagination section.\nRequires scim:read scope.\nGET https://wlcg.cloud.cnaf.infn.it/scim/Groups/b86a9e99-9f0e-478f-999c-2046c764aa14/subgroups?count=10 { \"totalResults\": 3, \"itemsPerPage\": 3, \"startIndex\": 1, \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:ListResponse\" ], \"Resources\": [ { \"display\": \"wlcg/pilots\", \"value\": \"25084f30-1d71-4ab2-91e8-11148af16682\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Groups/25084f30-1d71-4ab2-91e8-11148af16682\" }, { \"display\": \"wlcg/test\", \"value\": \"34bdcf9e-fc17-4a80-a4b7-19f7964439e6\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Groups/34bdcf9e-fc17-4a80-a4b7-19f7964439e6\" }, { \"display\": \"wlcg/xfers\", \"value\": \"f356885a-9d06-4687-b5fe-57322430f111\", \"$ref\": \"https://wlcg.cloud.cnaf.infn.it/scim/Groups/f356885a-9d06-4687-b5fe-57322430f111\" } ] } POST /scim/Groups Creates a new group, using the info specified within the request body, sent as application/json.\nRequires scim:write scope.\nPOST http://localhost:8080/scim/Groups/ { \"id\": \"7b427ebe-9058-479e-95b6-f3cebec91731\", \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:Group\" ], \"displayName\": \"engineers\" } Successful Resource creation is indicated with a 201 (“Created”) response code. Upon successful creation, the response body contains the newly created User.\n{ \"id\": \"7b427ebe-9058-479e-95b6-f3cebec91731\", \"meta\": { \"created\": \"2016-07-14T16:24:50.941+02:00\", \"lastModified\": \"2016-07-14T16:24:50.941+02:00\", \"location\": \"http://localhost:8080/scim/Groups/7b427ebe-9058-479e-95b6-f3cebec91731\", \"resourceType\": \"Group\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:Group\" ], \"displayName\": \"engineers\" } GET /scim/Groups Requires scim:read scope.\nThe pagination seen for users can be applied also to groups:\nExample: retrieve the 22nd group\nGET http://localhost:8080/scim/Groups?startIndex=22\u0026count=1 { \"totalResults\": 22, \"itemsPerPage\": 1, \"startIndex\": 22, \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:ListResponse\" ], \"Resources\": [ { \"id\": \"c617d586-54e6-411d-8e38-649677980020\", \"meta\": { \"created\": \"2016-07-14T16:33:20.135+02:00\", \"lastModified\": \"2016-07-14T16:33:20.135+02:00\", \"location\": \"http://localhost:8080/scim/Groups/c617d586-54e6-411d-8e38-649677980020\", \"resourceType\": \"Group\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:Group\" ], \"displayName\": \"Test-020\" } ] } PUT /scim/Groups/{id} Requires scim:write scope.\nPUT performs a full update. Clients should retrieve the entire resource and then PUT the desired modifications as the operation overwrites all previously stored data. A successful PUT operation returns a 200 OK response code and the entire resource within the response body.\nExample of replacing group with a different displayName:\nPUT http://localhost:8080/scim/Groups/891d042d-fc6e-4408-8a3a-ad9dfdf5db89 { \"id\": \"891d042d-fc6e-4408-8a3a-ad9dfdf5db89\", \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:Group\" ], \"displayName\": \"engineers_updated\" } { \"id\": \"891d042d-fc6e-4408-8a3a-ad9dfdf5db89\", \"meta\": { \"created\": \"2016-07-14T16:37:18.302+02:00\", \"lastModified\": \"2016-07-14T16:37:18.411+02:00\", \"location\": \"http://localhost:8080/scim/Groups/891d042d-fc6e-4408-8a3a-ad9dfdf5db89\", \"resourceType\": \"Group\" }, \"schemas\": [ \"urn:ietf:params:scim:schemas:core:2.0:Group\" ], \"displayName\": \"engineers_updated\" } PATCH /scim/Groups/{id} Requires scim:write scope.\nThe following example shows how to add member to a group:\nPATCH http://localhost:8080/scim/Groups/4ca7fa98-0875-4eb3-a71f-0f88ce5632cf { \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:PatchOp\" ], \"operations\": [ { \"op\": \"add\", \"path\": \"members\", \"value\": [ { \"display\": \"john_lennon\", \"value\": \"e9c8cfca-7158-4a0d-9684-4abdede617cd\", \"$ref\": \"http://localhost:8080/scim/Users/e9c8cfca-7158-4a0d-9684-4abdede617cd\" } ] } ] } DELETE /scim/Groups/{id} Requires scim:write scope.\nClients request group removal via DELETE.\nDELETE /scim/Groups/5bae2407-08e3-4171-b180-4b4a0196e7b6 HTTP/1.1 200 OK Example: Client attempt to retrieve the previously deleted User:\nGET /scim/Groups/5bae2407-08e3-4171-b180-4b4a0196e7b6 { \"status\": \"404\", \"detail\": \"No group mapped to id '5bae2407-08e3-4171-b180-4b4a0196e7b6'\", \"schemas\": [ \"urn:ietf:params:scim:api:messages:2.0:Error\" ] } ","categories":"","description":"","excerpt":"The IAM server provides a RESTful API, based on the System for …","ref":"/v/v1.10.0/docs/reference/api/scim-api/","tags":"","title":"SCIM API"},{"body":"In OpenID Connect and OAuth, scopes are used to determine the privileges granted to a client application for a given session. For example, the openid and profile scopes are used to obtain access to identity information about a user, but applications can define their own scopes to implement domain-specific authorization (e.g., the WLCG storage.read and storage.modify scopes are examples of domain-specific OAuth scopes).\nIAM implements two levels of access control on OAuth scopes:\na client-level vetting, implemented through the MitreID connect library, so that each registered client has a list of allowed scopes. When a client requests a scope that is not allowed to get, it gets an invalid_scope error.\nan identity-related vetting, implemented through the concept of Scope policies, that can be used to limit access to scopes based on user identity.\nThis behaviour is described in the following picture:\nScope policies IAM Scope policies provide a mechanism to control access to OAuth scopes. A scope policy defines:\na rule, which can be PERMIT or DENY, that determines the behaviour of the policy. PERMIT policies are used to allow access to scopes, while DENY policies are used to block access to scopes;\na scopes selector, i.e. a set of scopes for which the policy applies (and a scope matchingPolicy used to determine the scope matching algorithm used);\nan account or group selector, used to determine for which user account or group of accounts the policy should apply.\nAn example scope policy is given below:\n{ \"id\": 1, \"description\": \"Default Permit ALL policy\", \"creationTime\": \"2019-10-08T13:52:20.000+02:00\", \"lastUpdateTime\": \"2019-10-08T13:52:20.000+02:00\", \"rule\": \"PERMIT\", \"matchingPolicy\": \"EQ\", \"account\": null, \"group\": null, \"scopes\": null } The policy above is a PERMIT policy that allows access to all the scopes to any account, as clarified by the policy description.\nIn the policy, the account and group selector are not specified, which means that the policy would apply to any user account. Also the scopes selector is not specified, which means that the policy would apply to any scope.\nThe policies that are not explicitly bound to an account or a group are called default scope policies. The example policy above is enabled by the default IAM configuration, which in practice limits the default scope vetting only to the client level.\nHere’s an another example, now showing two policies:\n[{ \"id\": 4, \"description\": \"Deny access to compute.* scopes to normal users\", \"creationTime\": \"2019-12-18T15:11:04.000+01:00\", \"lastUpdateTime\": \"2019-12-18T15:11:04.000+01:00\", \"rule\": \"DENY\", \"matchingPolicy\": \"EQ\", \"account\": null, \"group\": null, \"scopes\": [ \"compute.create\", \"compute.read\", \"compute.cancel\", \"compute.modify\" ] }, { \"id\": 13, \"description\": \"Allow access to compute.* scopes to wlcg/pilot users\", \"creationTime\": \"2019-12-18T15:19:20.000+01:00\", \"lastUpdateTime\": \"2019-12-18T15:19:20.000+01:00\", \"rule\": \"PERMIT\", \"matchingPolicy\": \"EQ\", \"account\": null, \"group\": { \"uuid\": \"25084f30-1d71-4ab2-91e8-11148af16682\", \"name\": \"wlcg/pilots\", \"location\": \"https://wlcg.cloud.cnaf.infn.it/scim/Groups/25084f30-1d71-4ab2-91e8-11148af16682\" }, \"scopes\": [ \"compute.create\", \"compute.read\", \"compute.cancel\", \"compute.modify\" ] }] The first policy, as clarified in the description, would block access to the compute.create, compute.read, compute.cancel and compute.modify scopes to any authenticated user. The second policy would instead allow access to compute.* scopes only to members of the wlcg/pilot group (again, as written in the policy description).\nThe two policies can work together because the IAM policy engine evaluates the policy in a specific order: account-level policies are applied first, then group-level policies are applied and finally policies that are not bound to any specific account or group are applied. This means that a policy defined to apply at the account or group-level typically wins over a more general one, as in the example above. Also, scopes being vetted are evaluated only once across different levels. This means, for example, that a scope that was evaluated at account-level will not be re-evaluated at group-level: the decision taken for such scope is not reconsidered.\nIn more technical terms, the policy engine implements a deny-override policy composition logic, which means that a deny policy which matches a request at a given level wins over a permit policy at that same level. For example, if there are two account-level policies that would apply for scope s, one which would yield a PERMIT result, and one that would yield a DENY, the DENY will win.\nScope matching algorithms IAM currently supports three scope matching algorithms:\nEQ: which is the default, uses string equality when comparing requested scopes to scopes allowed by the client configuration or by the scope policies;\nREGEXP: which uses a regular expression evaluation when comparing requested scopes to scopes allowed by the client configuration or scope policies;\nPATH: which uses a WLCG-specific path-matching logic, described in more detail below, to compare requested scopes to scopes allowed by the client configuration or by the scope policies.\nREGEXP and PATH matching algorithms are configured by adding a scope.matchers section to the IAM configuration, as shown in the following fragment which defines the scope matching algorithm for WLCG profile scopes:\nscope: matchers: - name: storage.read type: path prefix: storage.read path: / - name: storage.create type: path prefix: storage.create path: / - name: storage.modify type: path prefix: storage.modify path: / - name: wlcg.groups type: regexp regexp: ^wlcg\\.groups(?::((?:\\/[a-zA-Z0-9][a-zA-Z0-9_.-]*)+))?$ PATH scope matching The PATH scope matching algorithm is used to implement a scope-matching logic compliant with the WLCG JWT profile rules for storage scope matching, which allow a scope to contain a parametric part describing a path. Following the Scitokens model, permissions granted on a path apply transitively to subpaths. To give an example:\nstorage.read:/cms will grant read access to the /cms directory and all its content and subdirectories, but does not grant access to the /atlas directory.\nFollowing the same logic, a client allowed to request storage.read:/example, when PATH scope matching is configured as described above for the storage.read parametric scope, will be allowed to request the storage.read:/example but also any scope containing subpaths of /example, e.g., storage.read:/example/subdir/file.\nREGEXP scope matching The REGEXP scope matching algorithms uses regular expression matching to determine whether a scope is allowed for a given client or user.\nTaking the parametric wlcg.groups scope described above:\n- name: wlcg.groups type: regexp regexp: ^wlcg\\.groups(?::((?:\\/[a-zA-Z0-9][a-zA-Z0-9_.-]*)+))?$ A client allowed to request the scope wlcg.groups will also be allowed for the scope wlcg.groups:/a/group or any other group name matching the regexp.\nThe Scope policy API The Scope Policy API is a REST API that allows to manage scope policies. Access to the API is restricted to administrator users authenticated via web interface or OAuth clients that have access to the iam:admin.read (for read access) or iam:admin.write (for write access) OAuth scopes.\nGET /iam/scope_policies Returns a JSON representation of the Scope Policies defined for the organization.\nAuthentication required: yes\nAuthorization required: iam:admin.read scope\nCommand example\n$ curl -i -H \"Accept: application/json\" -H \"Content-Type: application/json\" -H \"Authorization: Bearer $TOKEN\" -X GET https://example.com/iam/scope_policies/ Success response Condition: Being Authenticated and authorized\nCode: 200 OK\nContent: An array of JSON representations for the scope policies defined in the organization\n[{ \"id\": 1, \"description\": null, \"creationTime\": \"2018-02-27T07:26:21.000+01:00\", \"lastUpdateTime\": \"2018-02-27T07:26:21.000+01:00\", \"rule\":\"PERMIT\", \"matchingPolicy\":\"EQ\", \"account\":null, \"group\":null, \"scopes\":null }] Error responses Condition: User is not authenticated\nCode: 401 Unauthorized\nContent:\n{ \"error\":\"unauthorized\", \"error_description\":\"Full authentication is required to access this resource\" } OR\n{ \"error\":\"invalid_token\", \"error_description\":\"Invalid access token: \u003cAccess Token\u003e\" } If an invalid token is provided or no token is provided.\nGET /iam/scope_policies/{id} Returns the JSON representation for the scope policy identified by id.\nAuthentication required: yes\nAuthorization required: iam:admin.read scope\nCommand example\n$ curl -i -H \"Accept: application/json\" -H \"Content-Type: application/json\" -H \"Authorization: Bearer $TOKEN\" -X GET https://example.com/iam/scope_policies/1 Success response Condition: Being Authenticated\nCode: 200 OK\nContent: The JSON representation for the scope policy\n{ \"id\": 1, \"description\": null, \"creationTime\": \"2018-02-27T07:26:21.000+01:00\", \"lastUpdateTime\": \"2018-02-27T07:26:21.000+01:00\", \"rule\":\"PERMIT\", \"matchingPolicy\":\"EQ\", \"account\":null, \"group\":null, \"scopes\":null } Error responses Condition: User is not authenticated\nCode: 401 Unauthorized\nContent:\n{ \"error\":\"unauthorized\", \"error_description\":\"Full authentication is required to access this resource\" } OR\n{ \"error\":\"invalid_token\", \"error_description\":\"Invalid access token: \u003cAccess Token\u003e\" } If an invalid token is provided or no token is provided.\nCondition: The Scope Policy {id} is not defined for the organization\nCode: 404 NOT FOUND\nContent:\n{ \"error\":\"No scope policy found for id: {id}\" } PUT /iam/scope_policies/{id} Changes an existing Scope Policy.\nAuthentication required: yes\nAuthorization required: iam:admin.write scope\nData constraints\nProvide a representation of the Scope Policy to be modified.\n{ \"id\": [positive integer], \"description\": [text, optional, at most 512 chars], \"rule\": [text, allowed values: \"PERMIT\", \"DENY\"], \"matchingPolicy\":[text, allowed values: \"EQ\", \"REGEXP\", \"PATH\"], \"account\":[a valid account selector], \"group\":[a valid group selector ], \"scopes\":[a list of scopes, minimum 1 and maximum 255 chars] } Success response Condition: The Scope Policy is modified for the organization\nCode: 204 No Content\nError responses Condition: Policy validation error\nCode: 400 BAD REQUEST\n{ \"error\":\"Invalid scope policy: rule cannot be empty\" } Or\nCondition: Unauthenticated access\nCode: 401 UNAUTHORIZED\nContent:\n{ \"error\":\"unauthorized\", \"error_description\":\"Full authentication is required to access this resource\" } OR\n{ \"error\":\"invalid_token\", \"error_description\":\"Invalid access token: \u003cAccess Token\u003e\" } If an invalid token is provided or no token is provided at all\nOr\nCondition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\":\"access_denied\", \"error_description\":\"Access is denied\" } POST /iam/scope_policies Creates a Scope Policy for the organization\nAuthentication required: yes\nAuthorization required: iam:admin.write scope\nData constraints\nProvide a representation of the Scope Policy to be created\n{ \"description\": [text, optional, at most 512 chars], \"rule\": [text, allowed values: \"PERMIT\", \"DENY\"], \"matchingPolicy\":[text, allowed values: \"EQ\", \"REGEXP\", \"PATH\"], \"account\":[a valid account selector], \"group\":[a valid group selector], \"scopes\":[a list of scopes, each scope string should be no longer than 255 chars] } Data example\n{ \"description\": \"Allow access to compute.* scopes to wlcg/pilot users\", \"rule\": \"PERMIT\", \"scopes\": [\"compute.read\", \"compute.modify\", \"compute.create\", \"compute.cancel\"], \"matchingPolicy\": \"EQ\", \"group\": { \"uuid\": \"25084f30-1d71-4ab2-91e8-11148af16682\" } } Success response Condition: The Scope Policy is created for the organization\nCode: 201 Created\nError responses Condition: Policy validation error\nCode: 400 BAD REQUEST\n{ \"error\":\"Invalid scope policy: rule cannot be empty\" } Or\nCondition: Unauthenticated access\nCode: 401 UNAUTHORIZED\nContent:\n{ \"error\":\"unauthorized\", \"error_description\":\"Full authentication is required to access this resource\" } OR\n{ \"error\":\"invalid_token\", \"error_description\":\"Invalid access token: \u003cAccess Token\u003e\" } If an invalid token is provided or no token is provided at all\nOr\nCondition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\":\"access_denied\", \"error_description\":\"Access is denied\" } DELETE /iam/scope_policies/{id} Deletes the Scope Policy for the organization.\nAuthentication required: yes\nAuthorization required: iam:admin.write scope\nCommand example\n$ curl -i -H \"Accept: application/json\" -H \"Content-Type: application/json\" -H \"Authorization: Bearer $TOKEN\" -X DELETE https://example.com/iam/scope_policies/{id} Where {id} is the Scope Policy id number\nSuccess response Condition: The Scope Policy is defined for the organization\nCode: 204 NO CONTENT\nError responses Condition: The Scope Policy {id} is not defined or inexistent for the organization\nCode: 404 NOT FOUND\nContent:\n{ \"error\":\"No scope policy found for id: 1\" } Or\nCondition: Unauthenticated access\nCode: 401 UNAUTHORIZED\nContent:\n{ \"error\": \"unauthorized\", \"error_description\": \"Full authentication is required to access this resource\" } OR\n{ \"error\":\"invalid_token\", \"error_description\":\"Invalid access token: \u003cAccess Token\u003e\" } If an invalid token is provided or no token is provided.\nOr\nCondition: Authorization error\nCode: 403 FORBIDDEN\nContent:\n{ \"error\": \"Access is denied\" } ","categories":"","description":"","excerpt":"In OpenID Connect and OAuth, scopes are used to determine the …","ref":"/v/v1.10.0/docs/reference/api/scope-policy-api/","tags":"","title":"Scope Policy API"},{"body":"","categories":"","description":"","excerpt":"","ref":"/v/v1.10.0/search/","tags":"","title":"Search Results"},{"body":"The Token exchange policy API allows to define fine-grained policies to control:\nwhich clients can be involved in a token exchange, and which scopes can be exchanged. Token exchange policies By default IAM comes with a permissive default token exchange policy:\n{ \"id\": 2, \"description\": \"Allow all exchanges\", \"creationTime\": \"2021-08-05T14:38:52.000+02:00\", \"lastUpdateTime\": \"2021-08-05T14:38:52.000+02:00\", \"rule\": \"PERMIT\", \"originClient\": { \"type\": \"ANY\" }, \"destinationClient\": { \"type\": \"ANY\" } } The policy above will allow exchanges among all clients that have the token exchange grant type enabled.\nAs can be seen by the above example a token exchange policy specifies:\na rule, which can be PERMIT or DENY, which determines the policy behaviour an origin client selector: this selector will match the client linked to the access token presented during the token exchange; in this case, the selector will match ANY client. a destination client selector: this selector will match the destination client, i.e. the client requesting the token exchange; in this case, the selector will match ANY client. The policy above does not specify any scope policy, which basically means that all scopes allowed by the origin and destination client configurations could be exchanged among the clients.\nLet’s see a policy which limits the scopes exchanged:\n{ \"id\": 3, \"description\": \"Allow exchanges for openid and offline_access scopes for client token-exchange-actor\", \"creationTime\": \"2021-08-05T14:46:58.000+02:00\", \"lastUpdateTime\": \"2021-08-05T14:46:58.000+02:00\", \"rule\": \"PERMIT\", \"originClient\": { \"type\": \"ANY\" }, \"destinationClient\": { \"type\": \"BY_ID\", \"matchParam\": \"token-exchange-actor\" }, \"scopePolicies\": [ { \"rule\": \"PERMIT\", \"type\": \"EQ\", \"matchParam\": \"openid\" }, { \"rule\": \"PERMIT\", \"type\": \"EQ\", \"matchParam\": \"offline_access\" } ] } The policy above allows all exchanges for the scopes openid and offline_access between any origin client and the token-exchange-actor client. We see a new type of client selector, which is used to target the policy to a specific client selected by clientId.\nWe see that the policy provides a list of scope policies, which allow exchange only for the openid and offline_access scopes.\nClient selectors IAM currently supports three client selector types:\nANY: which will match any client BY_SCOPE: which will match any client that is authorized to request a scope passed as a parameter BY_ID: which will a client by clientId ... \"originClient\": { \"type\": \"BY_ID\", \"matchParam\": \"origin-client\" }, \"destinationClient\": { \"type\": \"BY_SCOPE\", \"matchParam\": \"storage.write:/\" }, ... For example, the policy fragment above would apply to any token exchange started by a client allowed to request the storage.write:/ scope when exchanging a token issued to origin-client.\nToken exchange scope policies Token exchange scope policies (not to be confused with Scope policies) define which scopes are authorized or blocked in a token exchange policy. When scope policies are not defined in an exchange policy, the meaning is that all scopes allowed by the origin and destination client configurations are allowed for an exchange.\nA scope policy defines:\na rule, which can be PERMIT or DENY a type, where allowed values are EQ, REGEXP, PATH which identifies the matching algorithm used to match the exchanged scope a matchParam, which specifies the scope to be matched For example:\n\"scopePolicies\": [ { \"rule\": \"PERMIT\", \"type\": \"REGEXP\", \"matchParam\": \"compute.*\" }, { \"rule\": \"DENY\", \"type\": \"REGEXP\", \"matchParam\": \"storage.*\" } ] The two scope policies above combined will allow any exchange of scopes that would match the regular expression compute.* and will block exchanges of scopes matching regular expression storage.*. Important scope policy evaulation rules:\nToken exchange scope policies are applied to all the scopes requested in a token exchange, i.e. a policy allowing each requested scope must be present for the token exchange to succeed.\nWhen multiple scope policies apply to a given scope, DENY policies win.\nWhen scope policies are defined, a PERMIT policy should always be included, otherwise any exchange would be blocked. If that is the intended behaviour, simply use a DENY token exchange policy.\nWhen a requested scope is not authorized, either due to a DENY scope policy or a missing PERMIT policy, the exchange fails with an invalid_scope error.\nDefining scope policies in a DENY token exchange policy is redundant (the evaluation would block at client level) and would not make sense.\nToken exchange policy ranking The engine that evaluates token exchange policies implements a policy ranking algorithm to determine which policy should be applied for an exchange. As with scope policies, the ranking algorithm is based on how specific the policies are for the input origin and destination clients in a token exchange.\nAs we have seen, origin and destination clients can be matched in three ways:\nusing the ANY selector, i.e. matching any client using the BY_SCOPE selector, i.e., matching any client that can request a given scope using the BY_ID selector, i.e. matching clients by clientId We link a rank, which is an integer value, to each of the selector to represent the selector specificity. The rank of the selectors are given in the following table:\nClient selector Rank ANY 0 BY_SCOPE 1 BY_ID 2 The rank of a policy P is computed as the sum of rank of the origin and destination client selectors:\nrank(P) = rank(origin) + rank(destination) At the same rank, DENY policies will win. Let’s assume we have two exchange policies defined:\n[ { \"id\": 2, \"description\": \"All all exchanges just for the openid scope\", \"creationTime\": \"2021-08-05T14:38:52.000+02:00\", \"lastUpdateTime\": \"2021-08-05T14:38:52.000+02:00\", \"rule\": \"PERMIT\", \"originClient\": { \"type\": \"ANY\" }, \"destinationClient\": { \"type\": \"ANY\" }, \"scopePolicies\": [ { \"rule\": \"PERMIT\", \"type\": \"EQ\", \"matchParam\": \"openid\" } ] }, { \"id\": 3, \"description\": \"Allow any exchange among clients A and B\", \"creationTime\": \"2021-08-05T14:38:52.000+02:00\", \"lastUpdateTime\": \"2021-08-05T14:38:52.000+02:00\", \"rule\": \"PERMIT\", \"originClient\": { \"type\": \"BY_ID\", \"matchParam\": \"A\" }, \"destinationClient\": { \"type\": \"BY_ID\", \"matchParam\": \"B\" } } ] Also let’s assume client B requests a token exchange for scopes openid storage.read:/ presenting an access token issued to client A.\nIAM would cycle through the exchange policies and select the ones that would apply to the exchange, in this case both policy 2 and 3.\nThen IAM would rank the policy according to the specificity of the client selectors, which would be\nrank(p_2)=0 rank(p_3)=4 so policy 3 would be selected, which would allow the exchange.\n","categories":"","description":"","excerpt":"The Token exchange policy API allows to define fine-grained policies …","ref":"/v/v1.10.0/docs/reference/api/token-exchange-policy-api/","tags":"","title":"Token exchange policy API"}]
\ No newline at end of file
diff --git a/v/v1.10.0/search/index.html b/v/v1.10.0/search/index.html
index 710ddb771..06a735932 100644
--- a/v/v1.10.0/search/index.html
+++ b/v/v1.10.0/search/index.html
@@ -91,7 +91,7 @@
     aria-label="Search this site…"
     autocomplete="off"
     
-    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.b5004fb9b3ceca1b2cd4e55472ee66f6.json"
+    data-offline-search-index-json-src="/v/v1.10.0/offline-search-index.950189c6feef4c5f558bebc703ea5ca3.json"
     data-offline-search-base-href="/"
     data-offline-search-max-results="10"
   >
diff --git a/v/v1.10.0/sitemap.xml b/v/v1.10.0/sitemap.xml
index 684d7ca18..f5cd2aff4 100644
--- a/v/v1.10.0/sitemap.xml
+++ b/v/v1.10.0/sitemap.xml
@@ -151,6 +151,9 @@
   </url><url>
     <loc>/v/v1.10.0/docs/tasks/deployment/voms_importer/</loc>
     <lastmod>2022-06-21T12:23:18+02:00</lastmod>
+  </url><url>
+    <loc>/v/v1.10.0/blog/2024/08/07/iam-v1.10.0/</loc>
+    <lastmod>2024-08-12T18:50:44+02:00</lastmod>
   </url><url>
     <loc>/v/v1.10.0/blog/2024/06/19/iam-v1.9.0/</loc>
     <lastmod>2024-06-21T10:34:49+02:00</lastmod>