Procedure

1. In a terminal window, navigate to the directory where you downloaded the installer JAR file and enter the following command:

   java -jar rhdm-installer-7.0.0.GA.jar

   Note

   When running the installer on Windows, you may be prompted to provide administrator credentials during the installation. To prevent this requirement, add the izpack.mode=privileged option to the installation command:

   java -Dizpack.mode=privileged -jar rhdm-installer-7.0.0.GA.jar

   Furthermore, when running the installer on a 32-bit Java virtual machine, you might encounter memory limitations. To prevent this issue, run this command:

   java -XX:MaxHeapSize=4g -jar rhdm-installer-7.0.0.GA.jar

2. The graphical installer displays a splash screen and a license agreement page.
3. Click I accept the terms of this license agreement and click Next.
4. Specify the Red Hat JBoss EAP 7.1 or Red Hat JBoss 3.1 Web Server with Tomcat 8 server home where you want to install Red Hat Decision Manager and click Next.

5. Select the components that you want to install and click Next.

   You cannot install Decision Central on Red Hat JBoss 3.1 Web Server with Tomcat 8. You can only install it on Red Hat JBoss EAP. However, you can install the Decision Central controller on Red Hat JBoss 3.1 Web Server with Tomcat 8. The controller is used to manage Decision Server. Install it if you plan to manage multiple Decision Server instances.

   Note

   It is possible to install Decision Central and Decision Server on the same server. However, Red Hat recommends installing Decision Central and Decision Server on different servers in production environments. To do this, run the installer twice.

6. Create the Decision Manager admin user and click Next.

   Note

   Make sure that the selected user name is not the same as an existing user, role, or group. For example, do not create a user with the user name admin.

   The password must have at least eight characters and must contain at least one number and one non-alphanumeric character, but not & (ampersand).

   Make a note of the user name and password. You will need them to access Decision Central and Decision Server.

7. On the Component Installation page, click Next to start the installation. The Component Installation page lists the components that you will install.
8. When the installation has completed, click Next on the Processing Finished page. On the next page,you will see the message Installation has completed successfully.

9. If desired, click Generate Installation Script and Properties File to save the installation data in an XML file, then click Done. You can use this file to automatically install Red Hat Decision Manager on the same type of server. Note that you must change the installpath parameter in the XML file to specify the path of new server that you want to install Red Hat Decision Manager on. Enter the following command to perform an installation with the XML file:

   java -jar rhdm-installer-7.0.0.GA.jar <path-to-file>

Procedure

1. In a terminal window, navigate to the directory where you downloaded the installer file and enter the following command:

   java -jar rhdm-installer-7.0.0.GA.jar -console

   The command-line interactive process will start and display the End-User License Agreement.

   press 1 to continue, 2 to quit, 3 to redisplay.

2. Read the license agreement then enter 1 and press Enter to continue:

   Specify the home directory of one of the following servers:  Red Hat JBoss EAP 7.1 or Tomcat 8
   [/home/user/RHDM-7.0.0/jboss-eap-7.1]

3. Enter the parent directory of an existing Red Hat JBoss EAP 7.1 or Red Hat JBoss Web Server 3.1 with Tomcat 8 installation.

   The installer will verify the location of the installation at the location provided. Enter 1 to confirm and continue.

   Note

   It is possible to install Decision Manager and Decision Server on the same server. However, Red Hat recommends installing Decision Central and Decision Server on different servers in production environments.

4. Follow the instructions in the installer to complete the installation.

   Note

   When you create the user name and password, make sure that the specified user name does not conflict with any known title of a role or a group. For example, if there is a role called admin, you should not create a user with the user name admin.

   The password must have at least eight characters and must contain at least one number and one non-alphanumeric character (not including the character &).

   Make a note of the user name and password. You will need them to access Decision Central and Decision Server.

5. When the installation has completed, you will see this message:

   Would you like to generate an automatic installation script and properties file?

6. Enter y to create an XML file that contains the installation data, or n to complete the installation. If you enter y, you are prompted to specify a path for the XML file.
7. Enter a path or press the Enter key to accept the suggested path.

Procedure

1. Extract the rhdm-7.0.0.GA-decision-central-eap7-deployable.zip file to a temporary directory. In the following examples this directory is called TEMP_DIR.

2. Copy the contents of the TEMP_DIR/rhdm-7.0.0.GA-decision-central-eap7-deployable/jboss-eap-7.1 directory to EAP_HOME. When asked to overwrite files or merge directories, select Yes.

   Warning

   Ensure the names of the Red Hat Decision Manager deployments you are copying do not conflict with your existing deployments in the Red Hat JBoss EAP instance.

Procedure

1. In a terminal application, navigate to the EAP_HOME/bin directory.

2. Create a user that you will use to log in to Decision Central and Decision Server. In the following command, replace <username> and <password> with the user name and password of your choice.

   $ ./add-user.sh -a --user <USERNAME>  --password <PASSWORD> --role kie-server,admin

   Note

   Make sure that the specified user name is not the same as an existing user, role, or group. For example, do not create a user with the user name admin.

   The password must have at least eight characters and must contain at least one number and one non-alphanumeric character, but not & (ampersand).

3. Make a note of your user name and password.

Procedure

1. In the Decision Central EAP_HOME/standalone/configuration/standalone.xml file, uncomment the following properties in the <system-properties> section and replace <USERNAME> and <USER_PWD> with the credentials of a user with the kie-server role:

      <property name="org.kie.server.user" value="<USERNAME>"/>
      <property name="org.kie.server.pwd" value="<USER_PWD>"/>

2. In the Decision Server EAP_HOME/standalone/configuration/standalone.xml file, uncomment the following properties in the <system-properties> section.

     <property name="org.kie.server.controller.user" value="<CONTROLLER_USER>"/>
     <property name="org.kie.server.controller.pwd" value="<CONTROLLER_PWD>"/>
     <property name="org.kie.server.id" value="<KIE_SERVER_ID>"/>
     <property name="org.kie.server.location" value="http://<HOST>:<PORT>/kie-server/services/rest/server"/>
     <property name="org.kie.server.controller" value="<CONTROLLER_URL>"/>

3. In this file, replace the following values:

   • Replace <CONTROLLER_USER> and <CONTROLLER_PWD> with the credentials of a user with the rest-all role.
   • Replace <KIE_SERVER_ID> with the ID or name of the Decision Server installation, for example, rhdm700-decision-server-1.
   • Replace <HOST> with the ID or name of the Decision Server host, for example, localhost or 192.7.8.9.

   • Replace <PORT> with the port of the Decision Server host, for example, 8080.

     Note

     The org.kie.server.location property specifies the location of Decision Server.

   • Replace <DECISION_CENTRAL_URL> with the URL of Decision Central. Decision Server connects to this URL during startup.

     • If you installed Decision Central using the installer or Red Hat JBoss EAP zip installations, <DECISION_CENTRAL_URL> has this format:

       http://<HOST>:<PORT>/decision-central/rest/controller

     • If you are running Decision Central using the standalone.jar file, <DECISION_CENTRAL_URL> has this format:

       http://<HOST>:<PORT>/rest/controller

Procedure

1. In a terminal application, navigate to EAP_HOME/bin.

2. Run the standalone configuration:

   • On Linux or UNIX-based systems:

     $ ./standalone.sh

   • On Windows:

     standalone.bat

     Note

     If you deployed Decision Server without Decision Central on Red Hat JBoss EAP then you must use one of the following commands to start Red Hat JBoss EAP with the standalone-full profile.

     On Linux or UNIX-based systems:

     $ /standalone.sh -c standalone-full.xml

     On Windows:

     standalone.bat -c standalone-full.xml

3. In a web browser, open the URL localhost:8080/decision-central.
4. Log in using the user name rhdmAdmin and the password password@1.

Procedure

1. Download the rhdm-7.0-controller-ee7.zip file by clicking Download next to Red Hat Decision Manager 7.0.0 Add Ons on the Product Downloads page of the Red Hat Customer Portal.
2. Unzip the rhdm-7.0.0.GA-add-ons.zip file. The rhdm-7.0-controller-ee7.zip file is in the unzipped directory.
3. Extract the rhdm-7.0-controller-ee7 archive to a temporary directory. In the following examples, this directory is called TEMP_DIR.

4. Copy the TEMP_DIR/rhdm-7.0-controller-ee7/controller.war directory to EAP_HOME/standalone/deployments/.

   Warning

   Ensure the names of the standalone Decision Server Controller deployments you are copying do not conflict with your existing deployments in the Red Hat JBoss EAP instance.

5. Copy the contents of the TEMP_DIR/rhdm-7.0-controller-ee7/SecurityPolicy/ directory to EAP_HOME/bin. When asked to overwrite files, select Yes.
6. In the EAP_HOME/standalone/deployments/ directory, create an empty file named controller.war.dodeploy. This file ensures that the standalone Decision Server Controller is automatically deployed when the server starts.

Procedure

1. Extract the rhdm-7.0-controller-jws.zip archive to a temporary directory. In the following examples, this directory is called TEMP_DIR.

2. Copy the TEMP_DIR/rhdm-7.0-controller-jws.zip/controller.war directory to the JWS_HOME/tomcat8/webapps directory.

   Warning

   Ensure the names of the Red Hat Decision Manager deployments you are copying do not conflict with your existing deployments in the Red Hat JBoss Web Server instance.

3. Remove the .war extensions from the controller.war folder.
4. Copy the contents of the TEMP_DIR/rhdm-7.0-controller-jws/SecurityPolicy/ directory to JWS_HOME/bin. When asked to overwrite files, select Yes.
5. In the JWS_HOME/standalone/deployments/ directory, create an empty file named controller.war.dodeploy. This file ensures that the standalone Decision Server Controller is automatically deployed when the server starts.

6. Add the kie-server role and user to the JWS_HOME/tomcat8/conf/tomcat-users.xml file. In the following example, <USERNAME> and <PASSWORD> is a user and password combination of your choice:

   <role rolename="kie-server"/>
   <user username="<USER_NAME>" password="<PASSWORD>" roles="kie-server"/>

7. In the JWS_HOME/tomcat8/bin directory of the instance running Decision Server, create a readable setenv.sh file with the following content:

   CATALINA_OPTS="-Xmx1024m -Dorg.jbpm.server.ext.disabled=true -Dorg.jbpm.ui.server.ext.disabled=true -Dorg.jbpm.case.server.ext.disabled=true -Dorg.kie.server.controller.user=<CONTROLLER_USER> -Dorg.kie.server.controller.pwd=<CONTROLLER_PWD> -Dorg.kie.server.id=<KIE_SERVER_ID> -Dorg.kie.server.location=http://<HOST>:<PORT>/kie-server/services/rest/server -Dorg.kie.server.controller=http://<HOST>:<PORT>/controller/rest/controller"

8. In the JWS_HOME/tomcat8/bin directory of the instance running the standalone Decision Server Controller, create a readable setenv.sh file with the following content:

   CATALINA_OPTS="-Dorg.kie.server.user=<USERNAME> -Dorg.kie.server.pwd=<USER_PWD>"

9. To start the standalone Decision Server Controller, enter one of the following commands in the JWS_HOME/tomcat8/bin directory:

   • On Linux or UNIX-based systems:

     $ ./startup.sh

   • On Windows:

     startup.bat

10. After a few minutes, review the the JWS_HOME/tomcat8/logs directory and correct any errors.

11. To verify that the Controller is working on Red Hat JBoss Web Server, enter the following command. In this command, replace <CONTROLLER> and <CONTROLLER_PWD> with the values in the tomcat-users.xml file. The output of this command provides information about the Decision Server instance.

    curl -X GET "http://<HOST>:<PORT>/controller/rest/controller/management/servers" -H  "accept: application/xml" -u '<CONTROLLER>:<CONTROLLER_PWD>'

Procedure

1. Generate a Maven project. A pom.xml file is automatically generated when you create a Maven project.

2. Edit pom.xml to add more dependencies and new repositories.

   Maven downloads all of the JAR files and the dependent JAR files from the Maven repository when you compile and package your project.

Procedure

1. Declare the BOM in pom.xml. For example:

   Example 3.1. BOM for Red Hat Decision Manager 7.0.0

   <dependencyManagement>
    <dependencies>
     <dependency>
      <groupId>org.jboss.bom.rhdm</groupId>
      <artifactId>rhdm-platform-bom</artifactId>
      <version>7.0.0.Final-redhat-4</version>
      <type>pom</type>
      <scope>import</scope>
     </dependency>
    </dependencies>
   </dependencyManagement>
   <dependencies>
   <!-- Your dependencies -->
   </dependencies>

2. Declare dependencies needed for your project in the <dependencies> tag.

   • For a basic Red Hat Business Automation project, declare the following dependencies:

     Embedded jBPM Engine Dependencies

     <dependency>
       <groupId>org.jbpm</groupId>
       <artifactId>jbpm-kie-services</artifactId>
     </dependency>
     
     <!-- Dependency needed for default WorkItemHandler implementations. -->
     <dependency>
       <groupId>org.jbpm</groupId>
       <artifactId>jbpm-workitems-core</artifactId>
     </dependency>
     
     <!-- Logging dependency. You can use any logging framework compatible with slf4j. -->
     <dependency>
       <groupId>ch.qos.logback</groupId>
       <artifactId>logback-classic</artifactId>
       <version>${logback.version}</version>
     </dependency>
     
     <dependency>
       <groupId>org.kie</groupId>
       <artifactId>kie-api</artifactId>
     </dependency>

   • For a Red Hat Business Automation project that uses CDI, declare the following dependencies:

     CDI-Enabled jBPM Engine dependencies

     <dependency>
       <groupId>org.kie</groupId>
       <artifactId>kie-api</artifactId>
     </dependency>
     
     <dependency>
       <groupId>org.jbpm</groupId>
       <artifactId>jbpm-kie-services</artifactId>
     </dependency>
     
     <dependency>
       <groupId>org.jbpm</groupId>
       <artifactId>jbpm-services-cdi</artifactId>
     </dependency>

   • For a basic Red Hat Decision Manager project, declare the following dependencies:

     Embedded Drools Engine Dependencies

     <dependency>
       <groupId>org.drools</groupId>
       <artifactId>drools-compiler</artifactId>
     </dependency>
     
     <!-- Dependency for persistence support. -->
     <dependency>
       <groupId>org.drools</groupId>
       <artifactId>drools-persistence-jpa</artifactId>
     </dependency>
     
     <!-- Dependencies for decision tables, templates, and scorecards.
     For other assets, declare org.drools:drools-workbench-models-* dependencies. -->
     <dependency>
       <groupId>org.drools</groupId>
       <artifactId>drools-decisiontables</artifactId>
     </dependency>
     <dependency>
       <groupId>org.drools</groupId>
       <artifactId>drools-templates</artifactId>
     </dependency>
     <dependency>
       <groupId>org.drools</groupId>
       <artifactId>drools-scorecards</artifactId>
     </dependency>
     
     <!-- Dependency for loading KJARs from a Maven repository using KieScanner. -->
     <dependency>
       <groupId>org.kie</groupId>
       <artifactId>kie-ci</artifactId>
     </dependency>

   • To use the Decision Server, declare the following dependencies:

     Client Application Decision Server Dependencies

     <dependency>
       <groupId>org.kie.server</groupId>
       <artifactId>kie-server-client</artifactId>
     </dependency>
     <dependency>
         <groupId>org.kie.server</groupId>
         <artifactId>kie-server-api</artifactId>
     </dependency>
     
     <!-- Dependency for Red Hat JBoss BRMS functionality. -->
     <dependency>
       <groupId>org.drools</groupId>
       <artifactId>drools-core</artifactId>
     </dependency>
     
     <dependency>
       <groupId>org.kie</groupId>
       <artifactId>kie-api</artifactId>
     </dependency>

   • To create a remote client for Red Hat Business Automation or Red Hat Decision Manager, declare the following dependencies:

     Client Dependencies

     <dependency>
       <groupId>org.uberfire</groupId>
       <artifactId>uberfire-rest-client</artifactId>
     </dependency>

   • To use assets in KJAR packaging, the recommended way is to include kie-maven-plugin:

     Kie Maven Plugin

     <packaging>kjar</packaging>
     <build>
      <plugins>
       <plugin>
        <groupId>org.kie</groupId>
        <artifactId>kie-maven-plugin</artifactId>
        <version>7.0.0.Final-redhat-4</version>
        <extensions>true</extensions>
       </plugin>
      </plugins>
     </build>

Procedure

1. Start Red Hat JBoss Developer Studio.
2. Click Help → Install New Software.
3. Click Add to enter the Add Repository menu.
4. Provide a name next to the Name field and add the following URL in the Location field: https://devstudio.jboss.com/11/stable/updates/integration-stack/.
5. Click OK.
6. Select the JBoss Business Process and Rule Development feature from the available options, click Next, and then click Next again.
7. Read the license and accept it by selecting the appropriate radio button, and click Finish.
8. Restart Red Hat JBoss Developer Studio after the installation process finishes.

Procedure

1. Start Red Hat JBoss Developer Studio.
2. To open the Drools view, click Window → Open Perspective → Other, select Drools, select specific views, and click OK.
3. Click Window → Show View → Other…​ and select Server → Servers to add the server view.
4. Right click the Servers panel and select New → Server to open the server menu.
5. Click JBoss Enterprise Middleware → JBoss Enterprise Application Platform 7.1+ and click Next to define the server.

6. Set the home directory by clicking the Browse button. Navigate to theRed Hat JBoss EAP directory where Red Hat Decision Manager is installed.

   To configure the Red Hat Decision Manager server, select the Red Hat JBoss EAP directory where Red Hat Decision Manager is installed.

7. Provide a name for the server in the Name field, ensure that the configuration file is set, and click Finish.

Procedure

1. In Red Hat JBoss Developer Studio, select the server from the Server tab and click the start icon to start your server.

2. Enter the following command in a terminal to start the Secure Shell server, if it is not running already.

   /sbin/service sshd start

   Note

   This command is specific to Linux and Apple Macintosh. On these platforms, if sshd has already been started, this command fails. If this happens, you may safely ignore this step.

3. In Red Hat JBoss Developer Studio , select File → Import…​ and navigate to the Git folder. Open the Git folder to select Projects from Git and click Next.
4. Select the repository source as Clone URI and click Next.
5. Enter the details of the Git repository in the next window and click Next.
6. Select the branch you wish to import in the following window and click Next.
7. To define the local storage for this project, enter (or select) a non-empty directory, make any configuration changes and click Next.
8. Import the project as a general project in the following window and click Next.
9. Name the project and click Finish.

Procedure

1. Select your server from the Server tab and click the start icon to start the server.
2. In Red Hat JBoss Developer Studio, select File → Import…​ and navigate to the Git folder. Open the Git folder to select Projects from Git and click Next.
3. Select the repository source as Existing local repository and click Next.
4. Select the repository that is to be configured from the list of available repositories and click Next.
5. In the dialog window that opens, select the Import as general project radio button from the Wizard for project import group and click Next.
6. Name the project and click Finish.

Procedure

1. Download RH-SSO from the Downloads section of the Red Hat Customer Portal.

2. Install and configure a basic RH-SSO standalone server. To do this, follow the instructions in the "Install and Boot" chapter of the Red Hat Single Sign On Getting Started Guide. For production environment settings, consult the Red Hat Single Sign On Server Administration Guide.

   Note

   If you want to run both RH-SSO and Red Hat Decision Manager servers on the same system, ensure that you avoid port conflicts. by doing one of the following:

   • Update the RHSSO_HOME/standalone/configuration/standalone.xml file and set a port offset to 100. For example:

     <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:100}">

   • Use an environment variable to run the server:

     bin/standalone.sh -Djboss.socket.binding.port-offset=100

3. Start the RH-SSO server to configure RH-SSO from RHSSO_HOME/bin:

   ./standalone.sh

   After the RH-SSO server starts, open http://localhost:8180/auth/admin in a web browser and log in using the admin credentials that you created while installing RH-SSO. When you login for the first time, you can set up the initial user on the new user registration form.

4. In the RH-SSO Admin Console, click the Realm Settings menu item.

5. On the Realm Settings page, click Add Realm.

   The Add realm page opens.

6. On the Add realm page, provide a name for the realm and click Create.

7. Click the Clients menu item and click Create.

   The Add Client page opens.

8. On the Add Client page, provide the required information to create a new client for your realm. For example:

   • Client ID: kie
   • Client protocol: openid-connect
   • Root URL: http://localhost:8080/decision-central

9. Click Save to save your changes.

   After you create a new client, its Access Type is set to public by default. Change it to confidential.

   At this point, the RH-SSO server is configured with a realm with a client for Red Hat Decision Manager applications and running and listening for HTTP connections at localhost:8180. This realm provides different users, roles, and sessions for Red Hat Decision Manager applications.

Procedure

1. Install Red Hat JBoss EAP 7.1.

   See chapter Installing Red Hat JBoss EAP in the Red Hat JBoss Enterprise Application Platform Installation Guide.

2. Install Red Hat Decision Manager in the freshly installed Red Hat JBoss EAP home.

   If you configure the RH-SSO adapter by making changes to the standalone.xml file, and then unzip Red Hat Decision Manager, you may overwrite and lose the RH-SSO adapter configuration.

3. Download the Red Hat JBoss EAP adapter from the Red Hat Customer Portal.
4. Unzip and install the adapter. For installation instructions, see the JBoss EAP Adapter section of the Red Hat Single Sign On Securing Applications and Services Guide.
5. Go to EAP_HOME/standalone/configuration and open the standalone.xml and standalone-full.xml files. Delete the <single-sign-on/> element from both of the files.

Procedure

1. Navigate to EAP_HOME/standalone/configuration directory in your Red Hat JBoss EAP installation and edit the standalone.xml file to add the RH-SSO subsystem configuration. For example:

   <subsystem xmlns="urn:jboss:domain:keycloak:1.1">
    <secure-deployment name="decision-central.war">
      <realm>demo</realm>
      <realm-public-key>MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB</realm-public-key>
      <auth-server-url>http://localhost:8180/auth</auth-server-url>
      <ssl-required>external</ssl-required>
      <enable-basic-auth>true</enable-basic-auth>
      <resource>kie</resource>
      <credential name="secret">759514d0-dbb1-46ba-b7e7-ff76e63c6891</credential>
      <principal-attribute>preferred_username</principal-attribute>
    </secure-deployment>
   </subsystem>

   In this example:

   • secure-deployment name is the name of your application’s WAR file.
   • realm is the name of the realm that you created for the applications to use.
   • realm-public-key is the public key of the realm you created. You can find the key in the Keys tab in the Realm settings page of the realm you created in the RH-SSO Admin Console. If you do not provide a value for realm-public-key, the server retrieves it automatically.
   • auth-server-url is the URL for the RH-SSO authentication server.
   • enable-basic-auth is the setting to enable basic authentication mechanism, so that the clients can use both token-based and basic authentication approaches to perform the requests.
   • resource is the name for the client that you created.
   • credential name is the secret key for the client you created. You can find the key in the Credentials tab on the Clients page of the RH-SSO Admin Console.

   • principal-attribute is the login name of the user. If you do not provide this value, your User Id is displayed in the application instead of your user name.

     Note

     The RH-SSO server converts the user names to lowe rcase. Therefore, after integration with RH-SSO, your user name will appear in lowe rcase in Red Hat Decision Manager. If you have user names in upper case hard coded in business processes, the application may not be able to identify the upper case user.

2. Navigate to EAP_HOME/bin/ and enter the following command to start the Red Hat JBoss EAP server:

   ./standalone.sh

1. Log in to the RH-SSO Admin Console and open the realm to which you wish to add a user.

2. Click the Users menu item under the Manage section.

   An empty user list page called Users opens.

3. Click the Add User button on the empty user list to start creating your new user.

   The Add user page opens.

4. Provide user information on the Add user page and click Save.
5. Set a new password under the Credentials tab.

6. Assign the new user one of the roles that allow access to Red Hat Decision Manager. For example, the admin or analyst role.

   Define the roles as realm roles in the Realm Roles tab under the Roles section.

7. Click Role Mappings tab on the Users page to assign roles.

Procedure

1. Open your application deployment descriptor file (WEB-INF/web.xml) and apply the following changes to it:

   • Remove the following lines to remove the servlet filter and its mapping for class org.uberfire.ext.security.server.BasicAuthSecurityFilter:

     <filter>
       <filter-name>HTTP Basic Auth Filter</filter-name>
       <filter-class>org.uberfire.ext.security.server.BasicAuthSecurityFilter</filter-class>
       <init-param>
         <param-name>realmName</param-name>
         <param-value>KIE Workbench Realm</param-value>
       </init-param>
     </filter>
     
     <filter-mapping>
       <filter-name>HTTP Basic Auth Filter</filter-name>
       <url-pattern>/rest/*</url-pattern>
       <url-pattern>/maven2/*</url-pattern>
       <url-pattern>/ws/*</url-pattern>
     </filter-mapping>

   • Add the following lines to add the security-constraint for the url-patterns that you have removed from the filter mapping:

     <security-constraint>
       <web-resource-collection>
         <web-resource-name>remote-services</web-resource-name>
         <url-pattern>/rest/*</url-pattern>
         <url-pattern>/maven2/*</url-pattern>
         <url-pattern>/ws/*</url-pattern>
       </web-resource-collection>
       <auth-constraint>
         <role-name>rest-all</role-name>
         <role-name>rest-project</role-name>
         <role-name>rest-deployment</role-name>
         <role-name>rest-process</role-name>
         <role-name>rest-process-read-only</role-name>
         <role-name>rest-task</role-name>
         <role-name>rest-task-read-only</role-name>
         <role-name>rest-query</role-name>
         <role-name>rest-client</role-name>
       </auth-constraint>
     </security-constraint>

2. Save your changes.

Procedure

1. Navigate to the RH-SSO Admin Console located at http://localhost:8080/auth/admin.
2. Click Clients.

3. Create a new client with the following settings:

   • Set Client ID as kie-git.
   • Set Access Type as confidential.
   • Disable the Standard Flow Enabled option.
   • Enable the Direct Access Grants Enabled option.
   
4. Click Save.
5. Click the Installation tab at the top of the client configuration screen and choose Keycloak OIDC JSON as a Format Option.
6. Click Download.

7. Move the downloaded JSON file to an accessible directory in the server’s file system or add it to the application class path.

   For more information, see the JAAS plugin chapter of the Keycloak Securing Applications and Services Guide.

Procedure

1. Ensure that the following libraries are in the WEB-INF/lib directory:

   uberfire-security-management-api-<latest_artifact_version>.jar
   uberfire-security-management-backend-<latest_artifact_version>.jar
   uberfire-security-management-keycloak-<latest_artifact_version>.jar
   keycloak-core-<latest_artifact_version>.jar
   keycloak-common-<latest_artifact_version>.jar

2. Remove third-party security JAR files, for example:

   uberfire-security-management-wildfly-<latest_artifact_version>.jar
   uberfire-security-management-tomcat-<latest_artifact_version>.jar

3. Replace the entire contents of the WEB-INF/classes/security-management.properties file with the following content:

   org.uberfire.ext.security.management.api.userManagementServices=KCCredentialsUserManagementService
   org.uberfire.ext.security.management.keycloak.authServer=http://localhost:8081/auth
   org.uberfire.ext.security.management.keycloak.realm=demo
   org.uberfire.ext.security.management.keycloak.user=admin
   org.uberfire.ext.security.management.keycloak.password=admin
   org.uberfire.ext.security.management.keycloak.clientId=kie
   org.uberfire.ext.security.management.keycloak.clientSecret=759514d0-dbb1-46ba-b7e7-ff76e63c6891

   Note

   If the WEB-INF/classes/security-management.properties file does not exist, create it.

4. Edit the following dependencies and exclusions in the /META-INF/jboss-deployment-structure.xml file:

   <dependencies>
       <module name="org.jboss.resteasy.resteasy-jackson-provider" services="import"/>
   </dependencies>
   <exclusions>
       <module name="org.jboss.resteasy.resteasy-jackson2-provider"/>
   </exclusions>

Procedure

1. In the RH-SSO Admin Console, open the security realm that you created.

2. Click the Clients menu item and click Create.

   The Add Client page opens.

3. On the Add Client page, provide the required information to create a new client for your realm. For example:

   • Client ID: kie-execution-server
   • Root URL: http://localhost:8080/kie-server
   • Client protocol: openid-connect

4. Click Save to save your changes.

   The new client Access Type is set to public by default. Change it to confidential and click Save again.

5. Navigate to the Credentials tab and copy the secret key. The secret key is necessary to configure the kie-execution-server client in the next section.

Procedure

1. Navigate to EAP_HOME/standalone/configuration in your Red Hat JBoss EAP installation and edit the standalone.xml file to add the RH-SSO subsystem configuration. For example:

   <subsystem xmlns="urn:jboss:domain:keycloak:1.1">
     <secure-deployment name="kie-execution-server.war">
        <realm>demo</realm>
        <realm-public-key>MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB</realm-public-key>
        <auth-server-url>http://localhost:8180/auth</auth-server-url>
        <ssl-required>external</ssl-required>
        <resource>kie-execution-server</resource>
        <enable-basic-auth>true</enable-basic-auth>
        <credential name="secret">03c2b267-7f64-4647-8566-572be673f5fa</credential>
        <principal-attribute>preferred_username</principal-attribute>
     </secure-deployment>
   </subsystem>
   
   <system-properties>
     <property name="org.kie.server.sync.deploy" value="false"/>
   </system-properties>

   In this example:

   • secure-deployment name is the name of your application WAR file.
   • realm is the name of the realm that you created for the applications to use.
   • realm-public-key is the public key of the realm you created. You can find the key in the Keys tab in the Realm settings page of the realm you created in the RH-SSO Admin Console. If you do not provide a value for this public key, the server retrieves it automatically.
   • auth-server-url is the URL for the RH-SSO authentication server.
   • resource is the name for the server client that you created.
   • enable-basic-auth is the setting to enable basic authentication mechanism, so that the clients can use both token-based and basic authentication approaches to perform the requests.
   • credential name is the secret key of the server client you created. You can find the key in the Credentials tab on the Clients page of the RH-SSO Admin Console.
   • principal-attribute is the login name of the user. If you do not provide this value, your User Id is displayed in the application instead of your user name.
2. Save your configuration changes in the standalone.xml file.

3. Use the following command to restart the Red Hat JBoss EAP server and run Decision Server.

   EXEC_SERVER_HOME/bin/standalone.sh -Dorg.kie.server.id=<ID> -Dorg.kie.server.user=<USER> -Dorg.kie.server.pwd=<PWD> -Dorg.kie.server.location=<LOCATION_URL> -Dorg.kie.server.controller=<CONTROLLER_URL> -Dorg.kie.server.controller.user=<CONTROLLER_USER> -Dorg.kie.server.controller.pwd=<CONTOLLER_PASSWORD>

   Here is an example:

   EXEC_SERVER_HOME/bin/standalone.sh -Dorg.kie.server.id=kieserver1 -Dorg.kie.server.user=kieserver -Dorg.kie.server.pwd=password -Dorg.kie.server.location=http://localhost:8080/kie-execution-server/services/rest/server -Dorg.kie.server.controller=http://localhost:8080/decision-central/rest/controller -Dorg.kie.server.controller.user=kiecontroller -Dorg.kie.server.controller.pwd=password

4. After Decision Server is running, you can check the server status. In the following command, kieserver is a user name with the kie-server role and password password:

   curl http://kieserver:password@localhost:8080/kie-execution-server/services/rest/server/

Procedure

1. To configure Red Hat Decision Manager to manage Decision Server using the tokens set the org.kie.server.token property.
2. Make sure that the org.kie.server.user and org.kie.server.pwd properties are not set. Red Hat Decision Manager will then use the Authorization: Bearer $TOKEN authentication method.

Procedure

1. If you want to use the REST API using the token-based authentication, set the org.kie.server.controller.token property.
2. Make sure that the org.kie.server.controller.user and org.kie.server.controller.pwd properties are not set.

Procedure

1. In the RH-SSO Admin Console, click the Clients menu item and click Create to create a new client.

   The Add Client page opens.

2. On the Add Client page, provide the required information to create a new client for your realm. For example:

   • Client ID: kie-remote
   • Client protocol: openid-connect
3. Click Save to save your changes.

4. Change the token settings in Realm Settings:

   1. In the RH-SSO Admin Console, click the Realm Settings menu item.
   2. Click the Tokens tab.

   3. Change the value for Access Token Lifespan to 15 minutes.

      This gives you enough time to get a token and invoke the service before it expires.

   4. Click Save to save your changes.

5. After a public client for your remote clients is created, you can now obtain the token by making an HTTP request to the RH-SSO server’s token endpoint using:

   RESULT=`curl --data "grant_type=password&client_id=kie-remote&username=admin&password=password" http://localhost:8180/auth/realms/demo/protocol/openid-connect/token`

   The user used in the command above is an RH-SSO user. For further information, see Section 7.1.3, “Adding a new user”.

6. To view the token obtained from the RH-SSO server, use the following command:

   TOKEN=`echo $RESULT | sed 's/.*access_token":"//g' | sed 's/".*//g'`