MCP Management Portal

1. Purpose of the User Guide

The purpose of this User Guide is to give instructions on how to operate the MCP Management Portal (Previously the Maritime Cloud Management Portal). The reader is expected to be familiar with the concepts of MCP. For more information about MCP, please visit the official homepage: https://maritimeconnectivity.net

NB! This manual is currently being updated, so the information written here might not be up-to-date.

2. General focus of the MCP Management Portal

Everything in the MCP Management Portal is centered around the organization of the logged in user.
Every entity in the Identity Registry section, only has data for the users own organization.
An organization’s own entities: Vessels, Devices, Users, and Certificates are considered private and will never be shown to others. However, the Service Registry section has the possibility to show data for services of all organizations. Services for other organizations are always in read-only mode though and will never show Certificates - regardless of the user’s administrative rights.

2.1. Icons and colors in the MCP Management Portal

Icons and colors in the MCP Management Portal follow the standard in the table:

Icon and color	Function
	Input field with validation not OK
	Blue button: will usually create or update data in the Service- or Identity registry.
	Red button: will most often delete data in the Service- or Identity registry

Icon and color

Function

Input field with validation not OK

Blue button: will usually create or update data in the Service- or Identity registry.

Red button: will most often delete data in the Service- or Identity registry

3. MRN - Maritime Resource Name

Every entity in the Maritime Connectivity Platform requires an MRN. For entities in the Identity Registry (e.g. Vessels) the MRN is autogenerated following the mask:
urn:mrn:mcp:entity:<org-shortname>:<entityID>

Example for a vessel from DMA:
urn:mrn:mcp:entity:dma:imo12345

For entities in the Service Registry the MRN is not autogenerated, because it’s part of the XML that is uploaded when creating or updating Services. The MRN will be validated though.

The MCP Management Portal for the Public Demonstrator environment can be reached at https://management.maritimeconnectivity.net

4.1. Join MCP and get access to the MCP Management Portal

To get access to the MCP Management Portal your organization must be enrolled in MCP by a person who holds the legal rights to act on behalf of the organization. Please follow the "Request to join" link on the MCP Management Portal login page to fill out the application form. The organization will be validated and approved by the MCP Consortium Secretariat, after which the applying organization will get access to the MCP Management Portal.

To log in to the MCP Management Portal, click the blue "Login" button

Choose the "Users" Identity Provider and provide your login information on the next page.

You will be redirected to the MCP Management Portal with access.

4.3. Access Roles

The MCP Management Portal has a number of different roles, which are based on the role hierarchy that is defined in the MIR.

5. Managing the Identity Registry

The entities in your organizations Identity Registry can be found in the menu.

The following subsections will explain how each entity is managed.

5.1. My Organization

This is the "home" of the MCP Management Portal. Here you can find various information about your own organization, like contact info, certificates (for organization level), Access Roles, etc.

5.1.1. Update contact information

To update the contact information of your organization, click the "Update" button on the "My Organization" page.

Make the changes and click "Update organization".

5.1.2. Access Roles

Not yet implemented.

5.1.3. Identity Provider information

Not yet implemented.

5.2. Vessels & Devices

The management of Vessels and Devices is handled in the same way. Therefore, the examples in this section apply for both.

Note: the only reason for creating Vessels and Devices is if you need a certificate for the Vessel or Device concerned. Read more about management of certificates in the section Certificates.

5.2.1. Create

To create a Vessel or Device, click the "+" in the list.

Fill out the form and click "Register Device/Vessel". The "Permissions" field is explained in depth in the Permissions section of this guide.

5.2.2. Update

To create a Vessel or Device, choose it in the list and click the "Update" button on the details page.

Make the changes and click "Update device".

5.2.3. Delete

Warning: If you delete an entity, all issued certificates will be revoked and become invalid.

To delete click the "Delete" button on the entity you want to delete.

5.3. Users

"Users" in this context refers to human users. Users can authenticate using the Openid Connect Identity Provider, or use a certificate issued by MCP.

5.3.1. Create

If an organization is federated into MCP, you do not need to create users!
The users will automatically be created the first time they log in on a webpage that uses MCP, such as the MCP Management Portal.

If an organization is not federated into MCP and is using the "ProjectTestUsers" Identity Provider, users must be created manually in the Management Portal. When the user has been created, he/she will receive an email with instructions for how to log in with a temporary password.

5.3.2. Update

When an organization is federated into MCP, users are automatically created and updated when they log in on a webpage that uses MCP, such as the MC Management Portal.

In the case that an organization is not federated into MCP, but is using the "ProjectTestUsers" Identity Provider, users must be updated manually in the Management Portal.
Updating the password of a user cannot be done in the portal, this must be done from the "ProjectTestUsers" Identity Provider.

5.3.3. Delete

For organizations, which is federated into MCP, users are automatically created or updated when they log in on a webpage that uses MCP, such as the MCP Management Portal. Therefore, deleting users does not make much sense for federated organizations, unless it is necessary to clean up the user list, or to remove all the users’ certificates.

If an organization is not federated into MCP and is using the "ProjectTestUsers" Identity Provider, users can be deleted from the portal. This will also remove the user from the "ProjectTestUsers" Identity Provider. The user will no longer be able to log in to access MCP services.

When a user is deleted all of the user’s certificates are revoked.

5.4. Permissions

"Permissions" is a field which service providers can use to implement a method of access control (authorization) in their services. As an example, an organization could wish to grant extended access to a service for all their pilots from a single point of control. The permissions field is a way to facilitate this.

For a more thorough explanation and example, please refer to the online documentation for authorization in MCP.

5.5. Certificates

Certificates can be issued on all entities in MCP (e.g. Devices, Vessels, Users, Organizations, Services). For a better understanding of how certificates is used in MCP and which parameters is included, please refer to the online documentation.

5.5.1. Information in the certificate

In the certificate, there are several information’s about the entity. Please refer to the online documentation.

5.5.2. Issuing a certificate

On every entity details page, there is a certificate section. This section is the same component for all entities. Therefore, the description and examples applies for all.

To issue a new certificate, click on the "Issue new Certificate" button.

Click on "Issue Certificate".

And that is it. A certificate has been issued and is ready for download.

When you download you will receive a zip file that contains public key, private key and certificate in PEM format, and the certificate in .p12 and .jks keystores. The password for the keystores are written in a .txt file that is also contained in the zip file.

NOTE: It is very important that you download the certificate, because it is the only time, that you can download the public- and private key.

5.5.3. Revoking a certificate

When a certificate needs to be revoked, find the relevant user/vessel/device/service and the certificate that should be revoked at click on "Revoke".

certificate revoke1

This will show a window where you will have to choose a reason and a date for the revocation in the selectors. Once these has been entered you can click "Revoke".

certificate revoke2

The certificate will now have been revoked and the certificate will be marked as such in the certificate list.

certificate revoke3

6. Managing the Service Registry

The Service Registry consists of 3 levels:

Specification: Technology-agnostic logical level (What)
Technical Design: Technology level (How)
Instance: The actual service implementation (Where)

For more information of the 3 levels and how they are connected, please refer to the online documentation at http://maritimeconnectivity.net or the "How To?" page in the MCP Management Portal.

The following subsections will describe each level in the service registry and how to manage.

Note: At the moment, service data is shown for all organizations with no possibility to filter or search. In the future, there will be filtering and searching options. Service data for other organizations is always in read-only mode though and will never show Certificates - regardless of the user’s administrative rights.

6.1. Service Instance

6.1.1. View and download

To view an Instance, click "Instances" in the menu and a list of Instances appear. Click on any column of a row in the list to view that Instance.

You can also get to the Instance by clicking any column of a row if you have a Technical Design in view.

In the details page, you can see a subset of the Instance data. To view all data, you can download the actual documents that were uploaded upon the registration of the Instance.

6.1.2. Create/Register

To register a new Instance, you need to select the Technical Design you want the Instance to implement. When the Technical Design is selected, you should click on the "Register new Instance" at the Technical Design details page.

Now you can upload 2 documents (see online documentation for templates of the documents):

An XML-file following the official template with machine readable information. This is a required document
A document in human readable format of the Instance. This is not required, but it is highly recommended to provide

When the XML-file is uploaded, there will be a validation of the Instance ID, which should be a MRN (refer to the MRN - Maritime Resource Name section of this guide. An example MRN for DMA would be: urn:mrn:mcl:service:instance:dma:nw-nm

When all is uploaded correctly, you can provide additional information to the service if you should need to issue certificates for the service later. This includes the field "Certificate Domain Name", where you should enter the name of the domain where the service will be hosted (e.g. Service.dma.dk) and the field "Permissions" which will also be embedded in the certificate. Should this not be relevant for your service, simply leave the fields empty.

When everything is OK, click the "Register Instance" button.

MCP Management Portal - User Guide