> For the complete documentation index, see [llms.txt](https://docs.digit.org/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.digit.org/mgramseva/introducing-mgramseva/platform/technical-user-docs/backend-services/mgramseva-user-service.md). # mGramSeva - User Service ## Overview User service is responsible for user data management and providing functionality to log in and log out of the DIGIT system. ## Pre-requisites Before you proceed with the configuration, make sure the following pre-requisites are met - * *Java 8* * Kafka server is up and running * Encryption and MDMS services are running * PSQL server is running and the database * Redis is running ## Key Functionalities * Store, update and search user data * Provide authentication * Provide login,logout functionality into MgramSeva platform * Store user data PIIs in encrypted form ## Interaction Diagram ![](https://3004460086-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQx3WcyfCEvIVnLyuvkbo%2Fuploads%2FmjN9WPX25o1X16cozeXt%2Fimage.png?alt=media\&token=6eb464fe-ec57-4c63-bd4f-a2f7185b3792) ![](https://3004460086-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQx3WcyfCEvIVnLyuvkbo%2Fuploads%2FmCeXllajF7MWWhxeHKTi%2Fimage.png?alt=media\&token=9762256a-6690-4625-b4ee-e80ef1747c60) ## Deployment Details 1. Setup latest version of egov-enc-service and egov-mdms- service 2. Deploy the latest version of egov-user service 3. Add Role-Action mapping for API’s ## Configuration Details Following are the properties in application.properties file in user service which is configurable. | **Property** | **Value** | **Remarks** | | ------------------------------------------- | --------- | -------------------------------------------------- | | `egov.user.search.default.size` | 10 | default search record number limit | | `citizen.login.password.otp.enabled` | true | whether citizen login otp based | | `employee.login.password.otp.enabled` | false | whether employee login otp based | | `citizen.login.password.otp.fixed.value` | 123456 | fixed otp for citizen | | `citizen.login.password.otp.fixed.enabled` | false | allow fixed otp for citizen | | `otp.validation.register.mandatory` | true | whether otp compulsory for registration | | `access.token.validity.in.minutes` | 10080 | validity time of access token | | `refresh.token.validity.in.minutes` | 20160 | validity time of refresh token | | `default.password.expiry.in.days` | 90 | expiry date of a password | | `account.unlock.cool.down.period.minutes` | 60 | unlock time | | `max.invalid.login.attempts.period.minutes` | 30 | window size for counting attempts for lock | | `max.invalid.login.attempts` | 5 | max failed login attempts before account is locked | | `egov.state.level.tenant.id` | pb | | ## Integration ### Integration Scope User data management and functionality to log in and log out into the DIGIT system using OTP and password. ### Integration Benefits Providing the following functionality to citizen and employee type users * Employee: * User registration * Search user * Update user details * Forgot password * Change password * User role mapping(Single ULB to multiple roles) * Enable employees to login into the DIGIT system based on the password. * Citizen: * Create user * Update user * Search user * User registration using OTP * OTP based login ### Steps to Integration * To integrate, the host of egov-user should be overwritten in the helm chart. * Use `/citizen/_create` endpoint for creating users into the system. This endpoint requires the user to validate his mobile Number using OTP. The first OTP will be sent to his mobile number and then that OTP will be sent as `otpReference` in the request body * Use `/v1/_search` and `/_search` endpoints to search users in the system depending on various search parameters * Use `/profile/_update` for updating the user profile. The user will be validated (either by OTP-based validation or password validation) when this API is called * `/users/_createnovalidate` and `/users/_updatenovalidate` are endpoints to create user data into the system without any validations (no OTP or password required). They should be strictly used only for creating/updating user’s internally and should not be exposed outside * **Forgot password:** In case the user forgets the password it can be reset by first calling `/user-otp/v1/_send` which will generate and send OTP on the employee’s mobile number, the password can then be updated using this OTP by calling API `/password/nologin/_update` in which a new password along with the OTP has to be sent. * Use `/password/_update` to update the existing password by logging in. In the request body, both old and new password has to be sent. Details of the API can be found in the attached swagger documentation * Use `/user/oauth/token` for generating tokens, `/_logout`for logout and `/_details` for getting user information from his token * **Multi-Tenant User**: The Multi-tenant User functionality allows a user to perform actions across multiple ULBs. For example, an employee belonging to Amritsar can perform the role of Trade License Approver for Jalandhar by assigning a tenant level role of tenantId pb.jalandhar to him. Following is an example of such a user: ``` { "id": 24226, "uuid": "11t0e02b-0145-4de2-bc42-c97b96264807", "userName": "xyz", "name": "abc", "mobileNumber": "9999999999", "emailId": "abc@gmail.com", "locale": null, "type": "EMPLOYEE", "roles": [ { "name": "GP Admin", "code": "GP_ADMIN", "tenantId": "pb.massewal" }, { "name": "Collector", "code": "COLLECTION_OPERATOR", "tenantId": "pb.lodhipur" } ], "active": true, "tenantId": "pb" } ``` If an employee has a role with state level `tenantId` he can perform actions corresponding to that role across all tenants * **Refresh Token:** Whenever the `/user/oauth/token` is called to generate the `access_token` , along with the `access_token` one more token is generated called `refresh_token` . The refresh token is used to generate new `access_token` whenever the existing one expires. Till the time the refresh token is valid the user won’t have to log in even if his `access_token` get’s expired, as it will be generated using `refresh_token`. The validity time of the refresh token is configurable and can be configured using the property: `refresh.token.validity.in.minutes` ## Reference Docs ### Doc Links | **Title** | **Link** | | -------------------------------------- | ---------------------------------------------------------------------------------- | | User Data encryption promotion details | [User data encryption promotion](https://digit-discuss.atlassian.net/l/c/xSSnmk12) | | Encryption Service | [Encryption Service](https://digit-discuss.atlassian.net/l/c/HJwxmms6) | ### API List | | **Link** | | --------------------------- | ------------------------------------------------------------- | | `/citizen/_create` | | | `/users/_createnovalidate` | | | `/_search` | | | `/v1/_search` | | | `/_details` | | | `/users/_updatenovalidate` | | | `/profile/_update` | | | `/password/_update` | | | `/password/nologin/_update` | | | `/_logout` | | | `/user/oauth/token` | | *(Note: All the API’s are in the same postman collection therefore the same link is added in each row)* > [![Creative Commons License](https://i.creativecommons.org/l/by/4.0/80x15.png)*​*](http://creativecommons.org/licenses/by/4.0/)*All content on this page by* [*eGov Foundation*](https://egov.org.in/) *is licensed under a* [*Creative Commons Attribution 4.0 International License*](http://creativecommons.org/licenses/by/4.0/)*.* --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.digit.org/mgramseva/introducing-mgramseva/platform/technical-user-docs/backend-services/mgramseva-user-service.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.