TEMS TEMS dataspace
EBU
dev home.dndm.ch

TEMS — three-participants topology

Local Trusted European Media data Space staging stack: a governance authority, three participants (EBU matchmaker, News-Agg consumer, AFP media provider), and the consuming apps (dashboards, Source Explorer, gateway, local indexer). Everything below runs on a single Docker Swarm node and is reachable on the public internet through Let's Encrypt-fronted nginx.

Governance Matchmaker Consumer Media Provider Internal service

📚 Developer documentation for adopting these services lives at tems-docs.home.dndm.ch — API references (Source Explorer ingestion, Local Indexer indexing) plus the integration guide (basePath-aware SPA, edge nginx, DID:web JWT validator).

Topology

┌──────────────────────────────────────────────────────┐ │ EBU corporate Keycloak (external, prod identity) │ │ keycloak.idp-ebu.ch · realm: tems │ │ Manages real EBU users — single SSO across TEMS apps│ └────────────────────────┬─────────────────────────────┘ │ federated SSO + broker target for `ebu` ▼ ┌──────────────────────────────────────┐ │ Governance (Authority) │ │ • Keycloak local (realm: common) │ │ • Federated Catalogue · DID resolver│ │ • Brokers : ebu→corp KC, afp+news- │ │ agg→local KCs (containers) │ └──┬──────────────┬────────────────┬───┘ │ broker │ broker │ broker │ (afp) │ (news-agg) │ (ebu) ┌─────────────┘ │ └─────────┐ │ │ │ │ ┌─────────────────▼──────────────┐ │ │ │ AFP — Media Provider │ │ │ │ EDC • IdH • KC local • Dash. │ │ │ │ TEMSAcquisitionService │ │ │ └────────────────────────────────┘ │ ▼ ▼ ┌─────────────────────────────────┐ ┌────────────────────────────┐ │ EBU — Matchmaker │ │ News-Agg — Consumer │ │ EDC • IdH (no local KC) │ │ EDC • IdH • KC local │ │ Dashboard │ │ Dashboard • Gateway │ │ Source Explorer (BFF + SPA) │◄─ingest─┤ (SE proxy via signed_claim│ │ (auth → EBU corporate KC) │ │ │ └─────────────────────────────────┘ └────────────────────────────┘ ▲ │ push (OAuth2 internal) │ ┌──────────┴──────────────────┐ │ Local Indexer (EBU) │ │ RQ pipeline: chunk → embed │ └─────────────────────────────┘

Endpoints

Governance

Federated Authority
DID
did:web:tems-gov.home.dndm.ch
DID doc
/.well-known/did.json
Keycloak
/auth/admin (realm common)
Catalogue UI
/catalogue/
FC server
/fc/

EBU

Matchmaker
DID
did:web:ebu.home.dndm.ch
Connector
ebu.home.dndm.ch
Identity
EBU corp KC · realm tems (external)
Dashboard
dashboard-ebu.home.dndm.ch
Catalogue UI
/catalogue/
Source Explorer
se-ebu.home.dndm.ch
Local Indexer
local-indexer-ebu.home.dndm.ch

News-Agg

Consumer
DID
did:web:news-agg.home.dndm.ch
Connector
news-agg.home.dndm.ch
Keycloak
/auth/admin (realm edc)
Dashboard
dashboard-news-agg.home.dndm.ch
Catalogue UI
/catalogue/
Gateway
gateway-news-agg.home.dndm.ch

AFP

Media Provider
DID
did:web:afp.home.dndm.ch
Connector
afp.home.dndm.ch
Keycloak
/auth/admin (realm edc)
Dashboard
dashboard-afp.home.dndm.ch
Catalogue UI
/catalogue/
Acquisition
/acquire-offering
Each Catalogue UI uses federated SSO via Governance: click Login → governance broker → your participant's Keycloak → back. Tokens issued by each Keycloak include aud=<participant> via the tems-audience mapper.

Operational entry points

Keycloak — DID resolution & OIDC

Issuers
ebu / tems (external corp KC)
news-agg / edc
afp / edc
tems-gov / common

Identity Hubs — Credentials

DID docs
ebu
news-agg
afp
tems-gov

Gateway JWKS — signed_claim

JWKS
gateway-news-agg
Health
/health
Adoption
tems-docs / gateway integration

Developer documentation

Portal
tems-docs.home.dndm.ch
Source Explorer — Ingestion API
/docs/source-explorer/ingestion
Local Indexer — Indexing API
/docs/local-indexer/index
Gateway — Integration guide
/docs/gateway/integration