Chapter 7. Integrating Red Hat Decision Manager with Red Hat Single Sign-On

Procedure

1. Download RH-SSO from the Downloads section of the Red Hat Customer Portal.

2. Install and configure a basic RH-SSO standalone server. To do this, follow the instructions in the "Install and Boot" chapter of the Red Hat Single Sign On Getting Started Guide. For production environment settings, consult the Red Hat Single Sign On Server Administration Guide.

   Note

   If you want to run both RH-SSO and Red Hat Decision Manager servers on the same system, ensure that you avoid port conflicts. by doing one of the following:

   • Update the RHSSO_HOME/standalone/configuration/standalone.xml file and set a port offset to 100. For example:

     <socket-binding-group name="standard-sockets" default-interface="public" port-offset="${jboss.socket.binding.port-offset:100}">

   • Use an environment variable to run the server:

     bin/standalone.sh -Djboss.socket.binding.port-offset=100

3. Start the RH-SSO server to configure RH-SSO from RHSSO_HOME/bin:

   ./standalone.sh

   After the RH-SSO server starts, open http://localhost:8180/auth/admin in a web browser and log in using the admin credentials that you created while installing RH-SSO. When you login for the first time, you can set up the initial user on the new user registration form.

4. In the RH-SSO Admin Console, click the Realm Settings menu item.

5. On the Realm Settings page, click Add Realm.

   The Add realm page opens.

6. On the Add realm page, provide a name for the realm and click Create.

7. Click the Clients menu item and click Create.

   The Add Client page opens.

8. On the Add Client page, provide the required information to create a new client for your realm. For example:

   • Client ID: kie
   • Client protocol: openid-connect
   • Root URL: http://localhost:8080/decision-central

9. Click Save to save your changes.

   After you create a new client, its Access Type is set to public by default. Change it to confidential.

   At this point, the RH-SSO server is configured with a realm with a client for Red Hat Decision Manager applications and running and listening for HTTP connections at localhost:8180. This realm provides different users, roles, and sessions for Red Hat Decision Manager applications.

Procedure

1. Install Red Hat JBoss EAP 7.1.

   See chapter Installing Red Hat JBoss EAP in the Red Hat JBoss Enterprise Application Platform Installation Guide.

2. Install Red Hat Decision Manager in the freshly installed Red Hat JBoss EAP home.

   If you configure the RH-SSO adapter by making changes to the standalone.xml file, and then unzip Red Hat Decision Manager, you may overwrite and lose the RH-SSO adapter configuration.

3. Download the Red Hat JBoss EAP adapter from the Red Hat Customer Portal.
4. Unzip and install the adapter. For installation instructions, see the JBoss EAP Adapter section of the Red Hat Single Sign On Securing Applications and Services Guide.
5. Go to EAP_HOME/standalone/configuration and open the standalone.xml and standalone-full.xml files. Delete the <single-sign-on/> element from both of the files.

Procedure

1. Navigate to EAP_HOME/standalone/configuration directory in your Red Hat JBoss EAP installation and edit the standalone.xml file to add the RH-SSO subsystem configuration. For example:

   <subsystem xmlns="urn:jboss:domain:keycloak:1.1">
    <secure-deployment name="decision-central.war">
      <realm>demo</realm>
      <realm-public-key>MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB</realm-public-key>
      <auth-server-url>http://localhost:8180/auth</auth-server-url>
      <ssl-required>external</ssl-required>
      <enable-basic-auth>true</enable-basic-auth>
      <resource>kie</resource>
      <credential name="secret">759514d0-dbb1-46ba-b7e7-ff76e63c6891</credential>
      <principal-attribute>preferred_username</principal-attribute>
    </secure-deployment>
   </subsystem>

   In this example:

   • secure-deployment name is the name of your application’s WAR file.
   • realm is the name of the realm that you created for the applications to use.
   • realm-public-key is the public key of the realm you created. You can find the key in the Keys tab in the Realm settings page of the realm you created in the RH-SSO Admin Console. If you do not provide a value for realm-public-key, the server retrieves it automatically.
   • auth-server-url is the URL for the RH-SSO authentication server.
   • enable-basic-auth is the setting to enable basic authentication mechanism, so that the clients can use both token-based and basic authentication approaches to perform the requests.
   • resource is the name for the client that you created.
   • credential name is the secret key for the client you created. You can find the key in the Credentials tab on the Clients page of the RH-SSO Admin Console.

   • principal-attribute is the login name of the user. If you do not provide this value, your User Id is displayed in the application instead of your user name.

     Note

     The RH-SSO server converts the user names to lowe rcase. Therefore, after integration with RH-SSO, your user name will appear in lowe rcase in Red Hat Decision Manager. If you have user names in upper case hard coded in business processes, the application may not be able to identify the upper case user.

2. Navigate to EAP_HOME/bin/ and enter the following command to start the Red Hat JBoss EAP server:

   ./standalone.sh

1. Log in to the RH-SSO Admin Console and open the realm to which you wish to add a user.

2. Click the Users menu item under the Manage section.

   An empty user list page called Users opens.

3. Click the Add User button on the empty user list to start creating your new user.

   The Add user page opens.

4. Provide user information on the Add user page and click Save.
5. Set a new password under the Credentials tab.

6. Assign the new user one of the roles that allow access to Red Hat Decision Manager. For example, the admin or analyst role.

   Define the roles as realm roles in the Realm Roles tab under the Roles section.

7. Click Role Mappings tab on the Users page to assign roles.

Procedure

1. Open your application deployment descriptor file (WEB-INF/web.xml) and apply the following changes to it:

   • Remove the following lines to remove the servlet filter and its mapping for class org.uberfire.ext.security.server.BasicAuthSecurityFilter:

     <filter>
       <filter-name>HTTP Basic Auth Filter</filter-name>
       <filter-class>org.uberfire.ext.security.server.BasicAuthSecurityFilter</filter-class>
       <init-param>
         <param-name>realmName</param-name>
         <param-value>KIE Workbench Realm</param-value>
       </init-param>
     </filter>
     
     <filter-mapping>
       <filter-name>HTTP Basic Auth Filter</filter-name>
       <url-pattern>/rest/*</url-pattern>
       <url-pattern>/maven2/*</url-pattern>
       <url-pattern>/ws/*</url-pattern>
     </filter-mapping>

   • Add the following lines to add the security-constraint for the url-patterns that you have removed from the filter mapping:

     <security-constraint>
       <web-resource-collection>
         <web-resource-name>remote-services</web-resource-name>
         <url-pattern>/rest/*</url-pattern>
         <url-pattern>/maven2/*</url-pattern>
         <url-pattern>/ws/*</url-pattern>
       </web-resource-collection>
       <auth-constraint>
         <role-name>rest-all</role-name>
         <role-name>rest-project</role-name>
         <role-name>rest-deployment</role-name>
         <role-name>rest-process</role-name>
         <role-name>rest-process-read-only</role-name>
         <role-name>rest-task</role-name>
         <role-name>rest-task-read-only</role-name>
         <role-name>rest-query</role-name>
         <role-name>rest-client</role-name>
       </auth-constraint>
     </security-constraint>

2. Save your changes.

Procedure

1. Navigate to the RH-SSO Admin Console located at http://localhost:8080/auth/admin.
2. Click Clients.

3. Create a new client with the following settings:

   • Set Client ID as kie-git.
   • Set Access Type as confidential.
   • Disable the Standard Flow Enabled option.
   • Enable the Direct Access Grants Enabled option.
   
4. Click Save.
5. Click the Installation tab at the top of the client configuration screen and choose Keycloak OIDC JSON as a Format Option.
6. Click Download.

7. Move the downloaded JSON file to an accessible directory in the server’s file system or add it to the application class path.

   For more information, see the JAAS plugin chapter of the Keycloak Securing Applications and Services Guide.

Procedure

1. Ensure that the following libraries are in the WEB-INF/lib directory:

   uberfire-security-management-api-<latest_artifact_version>.jar
   uberfire-security-management-backend-<latest_artifact_version>.jar
   uberfire-security-management-keycloak-<latest_artifact_version>.jar
   keycloak-core-<latest_artifact_version>.jar
   keycloak-common-<latest_artifact_version>.jar

2. Remove third-party security JAR files, for example:

   uberfire-security-management-wildfly-<latest_artifact_version>.jar
   uberfire-security-management-tomcat-<latest_artifact_version>.jar

3. Replace the entire contents of the WEB-INF/classes/security-management.properties file with the following content:

   org.uberfire.ext.security.management.api.userManagementServices=KCCredentialsUserManagementService
   org.uberfire.ext.security.management.keycloak.authServer=http://localhost:8081/auth
   org.uberfire.ext.security.management.keycloak.realm=demo
   org.uberfire.ext.security.management.keycloak.user=admin
   org.uberfire.ext.security.management.keycloak.password=admin
   org.uberfire.ext.security.management.keycloak.clientId=kie
   org.uberfire.ext.security.management.keycloak.clientSecret=759514d0-dbb1-46ba-b7e7-ff76e63c6891

   Note

   If the WEB-INF/classes/security-management.properties file does not exist, create it.

4. Edit the following dependencies and exclusions in the /META-INF/jboss-deployment-structure.xml file:

   <dependencies>
       <module name="org.jboss.resteasy.resteasy-jackson-provider" services="import"/>
   </dependencies>
   <exclusions>
       <module name="org.jboss.resteasy.resteasy-jackson2-provider"/>
   </exclusions>

Procedure

1. In the RH-SSO Admin Console, open the security realm that you created.

2. Click the Clients menu item and click Create.

   The Add Client page opens.

3. On the Add Client page, provide the required information to create a new client for your realm. For example:

   • Client ID: kie-execution-server
   • Root URL: http://localhost:8080/kie-server
   • Client protocol: openid-connect

4. Click Save to save your changes.

   The new client Access Type is set to public by default. Change it to confidential and click Save again.

5. Navigate to the Credentials tab and copy the secret key. The secret key is necessary to configure the kie-execution-server client in the next section.

Procedure

1. Navigate to EAP_HOME/standalone/configuration in your Red Hat JBoss EAP installation and edit the standalone.xml file to add the RH-SSO subsystem configuration. For example:

   <subsystem xmlns="urn:jboss:domain:keycloak:1.1">
     <secure-deployment name="kie-execution-server.war">
        <realm>demo</realm>
        <realm-public-key>MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB</realm-public-key>
        <auth-server-url>http://localhost:8180/auth</auth-server-url>
        <ssl-required>external</ssl-required>
        <resource>kie-execution-server</resource>
        <enable-basic-auth>true</enable-basic-auth>
        <credential name="secret">03c2b267-7f64-4647-8566-572be673f5fa</credential>
        <principal-attribute>preferred_username</principal-attribute>
     </secure-deployment>
   </subsystem>
   
   <system-properties>
     <property name="org.kie.server.sync.deploy" value="false"/>
   </system-properties>

   In this example:

   • secure-deployment name is the name of your application WAR file.
   • realm is the name of the realm that you created for the applications to use.
   • realm-public-key is the public key of the realm you created. You can find the key in the Keys tab in the Realm settings page of the realm you created in the RH-SSO Admin Console. If you do not provide a value for this public key, the server retrieves it automatically.
   • auth-server-url is the URL for the RH-SSO authentication server.
   • resource is the name for the server client that you created.
   • enable-basic-auth is the setting to enable basic authentication mechanism, so that the clients can use both token-based and basic authentication approaches to perform the requests.
   • credential name is the secret key of the server client you created. You can find the key in the Credentials tab on the Clients page of the RH-SSO Admin Console.
   • principal-attribute is the login name of the user. If you do not provide this value, your User Id is displayed in the application instead of your user name.
2. Save your configuration changes in the standalone.xml file.

3. Use the following command to restart the Red Hat JBoss EAP server and run Decision Server.

   EXEC_SERVER_HOME/bin/standalone.sh -Dorg.kie.server.id=<ID> -Dorg.kie.server.user=<USER> -Dorg.kie.server.pwd=<PWD> -Dorg.kie.server.location=<LOCATION_URL> -Dorg.kie.server.controller=<CONTROLLER_URL> -Dorg.kie.server.controller.user=<CONTROLLER_USER> -Dorg.kie.server.controller.pwd=<CONTOLLER_PASSWORD>

   Here is an example:

   EXEC_SERVER_HOME/bin/standalone.sh -Dorg.kie.server.id=kieserver1 -Dorg.kie.server.user=kieserver -Dorg.kie.server.pwd=password -Dorg.kie.server.location=http://localhost:8080/kie-execution-server/services/rest/server -Dorg.kie.server.controller=http://localhost:8080/decision-central/rest/controller -Dorg.kie.server.controller.user=kiecontroller -Dorg.kie.server.controller.pwd=password

4. After Decision Server is running, you can check the server status. In the following command, kieserver is a user name with the kie-server role and password password:

   curl http://kieserver:password@localhost:8080/kie-execution-server/services/rest/server/

Procedure

1. To configure Red Hat Decision Manager to manage Decision Server using the tokens set the org.kie.server.token property.
2. Make sure that the org.kie.server.user and org.kie.server.pwd properties are not set. Red Hat Decision Manager will then use the Authorization: Bearer $TOKEN authentication method.

Procedure

1. If you want to use the REST API using the token-based authentication, set the org.kie.server.controller.token property.
2. Make sure that the org.kie.server.controller.user and org.kie.server.controller.pwd properties are not set.

Procedure

1. In the RH-SSO Admin Console, click the Clients menu item and click Create to create a new client.

   The Add Client page opens.

2. On the Add Client page, provide the required information to create a new client for your realm. For example:

   • Client ID: kie-remote
   • Client protocol: openid-connect
3. Click Save to save your changes.

4. Change the token settings in Realm Settings:

   1. In the RH-SSO Admin Console, click the Realm Settings menu item.
   2. Click the Tokens tab.

   3. Change the value for Access Token Lifespan to 15 minutes.

      This gives you enough time to get a token and invoke the service before it expires.

   4. Click Save to save your changes.

5. After a public client for your remote clients is created, you can now obtain the token by making an HTTP request to the RH-SSO server’s token endpoint using:

   RESULT=`curl --data "grant_type=password&client_id=kie-remote&username=admin&password=password" http://localhost:8180/auth/realms/demo/protocol/openid-connect/token`

   The user used in the command above is an RH-SSO user. For further information, see Section 7.1.3, “Adding a new user”.

6. To view the token obtained from the RH-SSO server, use the following command:

   TOKEN=`echo $RESULT | sed 's/.*access_token":"//g' | sed 's/".*//g'`