Environments
The ISBE credential system is deployed in two environments: pre-production (pre) and production (pro). Each environment is independent: it has its own trust anchor DID, its own TIR, and its own issuance and verification services.
Credential Issuer
| Environment | Base URL | Notes |
|---|---|---|
| Pre-production | https://identity-credentials-issuer.pre.cloud-w.envs.redisbe.com | Pre-production validation. |
| Production | https://identity-credentials-issuer.pro.cloud-w.envs.redisbe.com | Productive environment. |
Interactive API documentation (Swagger/OpenAPI) is available at /swagger in each environment.
Credential IDP
| Environment | Base URL | Notes |
|---|---|---|
| Pre-production | https://identity-credentials-idp.pre.cloud-w.envs.redisbe.com | Pre-production validation. |
| Production | https://identity-credentials-idp.pro.cloud-w.envs.redisbe.com | Productive environment. |
The OIDC Discovery document is available at /.well-known/openid-configuration in each IDP environment.
Trusted Issuers Registry (TIR)
| Environment | TIR URL |
|---|---|
| Production | https://tir.portal.redisbe.com/trusted-issuers-registry |
| Pre-production | Available through the pre-production portal |
Trust anchor DID per environment
Each environment has its own RTAO/TAO DID, which is the DID that signs the accreditations registered in the TIR:
| Environment | Root DID |
|---|---|
| Production | did:isbe:uc:z12kVar5p6bD5WCjEJcQ18Zyt8XV |
| Pre-production | did:isbe:uc-pre:z1N1q5h8vcuHaic1fZjpZiQaSDHt |
An IsbePortalLearCredential issued in pre is not valid in pro and vice versa. Accreditations in each environment's TIR are independent. If your organization needs to be accredited in production, you must complete the accreditation process in the production environment.
Keycloak configuration per environment
The Credential Issuer queries Keycloak's JWKS to validate access tokens. The Keycloak JWKS URL varies by environment:
| Environment | JWKS URL pattern |
|---|---|
| Production | http://keycloakx-http.keycloak-idp.svc.cluster.local/auth/realms/pro-isbe/protocol/openid-connect/certs |
| Other environments | Replace pro-isbe with {env}-isbe in the realm |
These URLs are internal to the cluster. Integrators deploying their own Keycloak client must configure the public URL of the corresponding realm.
Admin panel
Both the Credential Issuer and the Credential IDP expose a Django admin panel at /admin/. Access is restricted to ISBE system administrators. The IDP's default credentials (admin/admin) must be changed on first deployment.