Dataspace Operator deployment module - Installation steps

Use this deployment module when you need to deploy the Central Identity Provider responsible for securing access to an OE marketplace, along with the supporting components required to manage registered users’ SSI credentials and Web3 private keys.

Installation checklist

Before proceeding with the installation, make sure you have performed the pre-installation steps described here, and you have the following:

• A server that meets the hardware and software requirements listed

• The TCP ports used by the services of the User Management Package are enabled

• FQDNs entries for:

  • The server that runs the User Management Package

  • The SSI Wallet API service

  • The SSI Wallet UI service

• Qualified digital certificates for:

  • the server that will run the User Management Package

  • Traefik service

  • Signer Server service

  • OpenBao vault

• The Web3 private keys used by the OpenBao vault

Installation steps

To install the User Management Package for Dataspace Operator, perform the following steps:

1

The User Management Package is located here. Clone the User Management Package repository.

git clone https://github.com/OceanProtocolEnterprise/user-management.git && user-management/dataspace-operator

2

Copy the certificate and private key files used by each of the User Management Package services to the corresponding directories, as follows:

Service	Certificate directory
Traefik	<user-management>/dataspace-operator/docker-compose/traefik/certs
Authentik	<user-management>/dataspace-operator/docker-compose/authentik/certs
Signer Server	<user-management>/dataspace-operator/docker-compose/signer-server/certs
OpenBao	<user-management>/dataspace-operator/docker-compose/openbao/certs

Example

# copy the certificate file to Authentik service's certs directory
cp vm3.oceanenterprise.io.pem ~/user-management/dataspace-operator/docker-compose/authentik/certs/
# copy the private key file to Authentik service's certs directory
cp vm3.oceanenterprise.io.key ~/user-management/dataspace-operator/docker-compose/authentik/certs/

3

From the <user-management>/dataspace-operator directory, edit the .env.config file and set the input parameters (see the Environment Variables for Dataspace Operator Configuration chapter for explanations regarding each input parameter in the file).

nano .env.config

4

Run the initialization script.

./dataspace-operator-initial-setup.sh

The initialization script generates the following artifacts:

• .env-<service name> file — the environment file used by the service’s container, located in the service’s directory (e.g., <user-management>/dataspace-operator/docker-compose/authentik/.env-authentik). This file is tailored to the specifics of the deployment.

• Authentik blueprint file — the configuration blueprint loaded by the Authentik server, customized for the deployment (e.g., <user-management>/dataspace-operator/authentik/dataspace_operator_blueprint.py).

• .env.market file — contains the environment variables that must be added to the marketplace’s environment file to integrate with the Authentik service deployed by the User Management Package. Share this file with the marketplace administrator. (Location: <user-management>/dataspace-operator/.env.market)

• .env.federation file — contains the environment variables that must be set in the .env.config file of the Participant Module of the User Management Package deployed by a Participant connecting to the Dataspace. Share this file with the Dataspace Participant Administrator responsible for deploying the User Management Package in their organization. (Location: <user-management>/dataspace-operator/.env.federation)

5

Go to the docker-compose directory and start the services

cd docker-compose
docker compose up -d

This will start all User Management Package services.

When the Authentik server container starts for the first time, it automatically executes the blueprint script to load the configuration settings. This process can take 10–15 minutes, so wait until it completes before accessing the Authentik UI; accessing it too early may result in unexpected browser errors. You can monitor the Authentik server logs to determine when the configuration loading has finished.

The result of the installation process

At the end of the installation of the Dataspace Operator module of the User Management Package, the following will be made available in your environment:

• PostgreSQL service configured to store data for the SSI Wallet API and Authentik services in two distinct databases

• SSI Wallet API service configured to store data in the PostgreSQL service.

  • No DIDs or SSI credentials are stored in the SSI Wallet yet.

• SSI Wallet UI configured as follows:

  • Connects to the SSI Wallet API service

  • Uses the Authentik server to authenticate users

  • Authorizes only the users that are registered on the Dataspace Operator Authentik server

  • Depending on the value of the NUXT_ADMIN_USER_GROUP_NAME environment variable, authorizes only users that are members of a specific Authentik group;

• Traefik service configured to expose the SSI Wallet API and SSI Wallet UI services to users, through their corresponding FQDNs;

• Signer Server configured as follows:

  • Uses the Authentik server to validate user requests

  • Authorized only the users registered on the Dataspace Operator Authentik server

  • Authorizes only requests coming from the marketplace and the SSI Wallet UI

  • Integrates with the OpenBao service for web3 transaction signing;

• OpenBao vault configured to sign web3 transactions

  • The web3 private keys provided at installation time are securely stored in the vault.

• Dataspace Operator Authentik server configured as follows:

  • Stores data in the PostgreSQL service;

  • Authenticates users to the configured marketplace;

  • Authenticates users to the SSI Wallet UI;

  • Validates users' JWTs for calls to the Signer Server components;

  • Passes OE-specific claims in when users authenticate;

  • OE-specific flows for user management;

  • No users or groups are stored in the Authentik database yet;

  • No Participant Authentik servers are onboarded for federated authentication yet.