Chapter 4. OpenIDM User Interface

The default user interface is provided as a reference implementation that demonstrates the capabilities of the REST API. You can modify certain aspects of the default user interface according to the requirements of your deployment. Note, however, that the default user interface is still evolving and is not guaranteed to be compatible with the next OpenIDM release.

To access the user interface, install and start OpenIDM, then point your browser to http://localhost:8080/openidmui.

Log in as the default administrative user (Login: openidm-admin, Password: openidm-admin) or as an existing user in the repository. The display differs, depending on the role of the user that has logged in.

For an administrative user (role openidm-admin), two tabs are displayed - Dashboard and Users. The Dashboard tab lists any tasks assigned to the user, processes available to be invoked, and any notifications for that user. The Users tab provides an interface to manage user entries (OpenIDM managed objects under managed/user).

The Profile link enables the user to modify elements of his user data. The Change Security Data link enables the user to change his password and, optionally, to select a new security question.

For a regular user (role openidm-authorized), the Users tab is not displayed - so regular users cannot manage user accounts, except for certain aspects of their own accounts.

The following sections outline the configurable aspects of the default user interface.

{
    "configuration" : {
        "selfRegistration" : true,
...    
    

{
    "configuration" : {
        "securityQuestions" : true,
...    
    

{
    "configuration" : {
        "siteIdentification" : true,
...    
    

"siteImages" : [
"images/passphrase/mail.png",
"images/passphrase/user.png",
"images/passphrase/report.png",
"images/passphrase/twitter.png"
],
...    
    

"siteImages" : [
"images/passphrase/mail.png",
"images/passphrase/user.png",
"images/passphrase/report.png",
"images/passphrase/twitter.png",
"images/my-new-image.jpg"
],
...
      

        {
            "key" : "norway",
            "value" : "Norway",
            "states" : [
                {
                    "key" : "akershus",
                    "value" : "Akershus"
                },
                {
                    "key" : "aust-agder",
                    "value" : "Aust-Agder"
                },
                {
                    "key" : "buskerud",
                    "value" : "Buskerud"
                },
...
    

Only administrative users (with the role openidm-admin) can add, modify, and delete user accounts. Regular users can modify certain aspects of their own accounts.

The user interface is integrated with the embedded Activiti worfklow engine, enabling users to interact with workflows. Available workflows are displayed under the Processes item on the Dashboard. In order for a workflow to be displayed here, the workflow definition file must be present in the openidm/workflow directory.

A sample workflow integration with the user interface is provided in openidm/samples/workflow, and documented in Sample Workflow - Provisioning User Accounts. Follow the steps in that sample for an understanding of how the workflow integration works.

Access to workflows is based on OpenIDM roles, and is configured in the file conf/process-access.json. By default all users with the role openidm-authorized or openidm-admin can invoke any available workflow. The default process-access.json file is as follows:

{
    "workflowAccess" : [
        {
            "propertiesCheck" : {
                "property" : "_id",
                "matches" : ".*",
                "requiresRole" : "openidm-authorized"
            }
        },
        {
            "propertiesCheck" : {
                "property" : "_id",
                "matches" : ".*",
                "requiresRole" : "openidm-admin"
            }
        }
    ]
}  
  

You can customize the theme of the default user interface to apply your own branding. Note that at this stage, the default user interface is still evolving. Customizations that you make to the functionality of the UI, are therefore not guaranteed to work in the next OpenIDM release.

By default the user interface reads the stylesheets and images from the openidm/ui/default directory. Modifications to the default theme should be made in the openidm/ui/extension directory. If you modify the files in the default directory, there is no guarantee that your changes will not be overwritten in the next OpenIDM release. The UI searches the extension directory first and applies any styles or images located in this directory.

By default, the password reset mechanism is handled internally, in OpenIDM. You can reroute password reset in the event that a user has forgotten his password, by specifying an external URL to which password reset requests are sent. Note that this URL applies to the password reset link on the login page only, not to the security data change facility that is available after a user has logged in.

To set an external URL to handle password reset, set the passwordResetLink parameter in the conf/ui-configuration.json file. The following example sets the passwordResetLink to https://accounts.example.com/account/reset-password.

passwordResetLink: "https://accounts.example.com/reset-password"

The passwordResetLink parameter takes either an empty string as a value (which indicates that no external link is used) or a full URL to the external system that handles password reset requests.

By default, a UI session is invalidated when a user clicks on the Log out link. In certain situations your external applications might require a distinct logout URL to which users can be routed, to terminate their UI session.

The logout URL is #logout, appended to the UI URL, for example, http://localhost:8080/openidmui/index.html#logout/.

The logout URL effectively performs the same action as clicking on the Log out link of the UI.

By default, the UI is registered at a specific URL (base-context/openidmui). To override the default URL and specify your own path, edit the openidm/conf/ui.context-enduser.json file, setting the urlContextRoot property to the new URL. For example, to change the path to base-context/exampleui, edit the file as follows:

"urlContextRoot" : "/exampleui",

The UI is packaged as a separate bundle that can be disabled in the configuration before server startup. To disable the registration of the UI servlet, edit the openidm/conf/ui.context-enduser.json file, setting the enabled property to false:

"enabled" : false,