Portal¶
| Version | 2.0.0 (tag v2.0.0-release, 2026-10-23) |
| Helm | subchart portal of oop-platform-chart |
| Artefact | labs.etsi.org:5050/oop/code/portal:2.0.0 |
| Specs | portal/, ADR-0064, ADR-0065, ADR-0066 |
| Changes | v1.0.0-release...v2.0.0-release |
The Portal is the self-service web front end of OpenOP. In this release it becomes a full application: it signs users in with Keycloak, works on live OEG data, lets developers create their own API clients, lets operators manage federation partners, and hosts the AI² chat.
New in this release¶
The Portal is one container: a thin FastAPI backend that serves the React GUI (ADR-0064). The backend signs users in through Keycloak (OIDC Authorization Code with PKCE) and keeps sessions in PostgreSQL (ADR-0065). It forwards the GUI's calls to OEG and AI² with the user's own token, and registers API clients in Keycloak (ADR-0066).
| Page | For | What it does |
|---|---|---|
| API Catalog | Everyone | Browse the APIs and open each API's description, version and interactive documentation |
| Edge Application Management | App Providers | Register and remove application profiles, deploy them to zones, and view instances, deployments and zones |
| API clients | App Providers | Create a Keycloak client for your own scripts, choose its API products, see the secret once, delete it |
| Federation | Operators | Register partner platforms, see a partner's status and subscribed zones, and edit each partner's agreement |
| AI² | Signed-in users | Chat with the AI² agent in threads |
| Profile | Signed-in users | See your roles |
Breaking changes¶
- The Portal needs its backend, PostgreSQL and Keycloak. In 1.0.0 the GUI ran alone. For local work without Keycloak, set
AUTH__SECURITY_MODE="none". - No mock data. Every page reads from OEG through the backend.
- The Helm chart is rewritten. On Kubernetes the Portal is deployed by the
portalsubchart ofoop-platform.
Upgrade notes¶
The oop-platform 2.0.0 chart creates what the Portal needs: its database and the Keycloak clients oop-portal (sign-in) and oop-portal-provisioner (API clients). Outside the chart, point API_PRODUCTS__FILE at a JSON file that maps each API product to its Keycloak scopes; api-products.example.json in the repository is a starting point.
Known limitations¶
The full list is in the spec's Implementation & Delivery › Known Gaps in Release 2. The main ones:
- Users are managed in Keycloak's admin console. The Portal has no user pages, and nothing keeps its records and Keycloak in sync.
- API clients belong to their creator, not to an organization. A leaked secret is fixed by deleting and recreating the client, and a client's products cannot change.
- A client deleted directly in Keycloak cannot be deleted from the Portal.
- Revoking a user takes up to 5 minutes, because OEG checks tokens locally.
- Apps that act for an end user (browser or mobile, with consent) are not supported.
- AI² conversations are kept only in the browser tab.
- No link to the Data Lab yet.