Chapter 3. Business application configuration

3.1. Business application authentication and authorization

By default, business applications are secured by protecting all REST endpoints (URLs that contain /rest/). In addition, business applications have two sets of log in credentials that allow users to connect to Business Central in development mode: the user with the ID user and password user and the user with the ID kieserver and password kieserver1!.

Both authentication and authorization is based on Spring security. Alter this security configuration for all business applications used in production environments. You can make configuration changes in the <business-application>/<business-application>-services/src/main/java/com/company/service/DefaultWebSecurityConfig.java file:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;


@Configuration("kieServerSecurity")
@EnableWebSecurity
public class DefaultWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests()
        .antMatchers("/rest/*").authenticated()
        .and()
        .httpBasic();
    }

  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
      auth.inMemoryAuthentication().withUser("kieserver").password(encoder.encode("kieserver1!")).roles("kie-server")
      .and()
      .withUser("john").password(encoder.encode("john@pwd1")).roles("kie-server", "PM", "HR");
  }
}

3.2. Configuring the application.properties file

After you create your business application, you can configure several components through the application.properties file to customize your application.

Prerequisites

  • You have a <business-application>.zip file that you created using the business application website.

Procedure

  1. Unzip the <business-application>.zip file and navigate to the <business-application>/<business-application>-service/src/main/resources folder.
  2. Open the application.properties file in a text editor.
  3. Configure the host, port, and path for the REST endpoints, for example:

    server.address=localhost
    server.port=8090
    
    cxf.path=/rest
  4. Configure the KIE Server (kieserver) so that it can be easily identified, for example:

    kieserver.serverId=<business-application>-service
    kieserver.serverName=<business-application>-service
    kieserver.location=http://localhost:8090/rest/server
    kieserver.controllers=http://localhost:8080/decision-central/rest/controller

    The following table lists the KIE Server parameters that you can configure in your business application:

    Table 3.1. kieserver parameters

    ParameterValuesDescription

    kieserver.serverId

    string

    The ID used to identify the business application when connecting to the Decision Manager controller.

    kieserver.serverName

    string

    The name used to identify the business application when connecting to the Decision Manager controller. Can be the same string used for the kieserver.serverId parameter.

    kieserver.location

    URL

    Used by other components that use the REST API to identify the location of this server. Do not use the location as defined by server.address and server.port.

    kieserver.controllers

    URLs

    A comma-separated list of controller URLs.

  5. If you selected Business Automation when you created your business application, specify which of the following components that you want to start at runtime:

    Table 3.2. kieserver capabilities parameters

    ParameterValuesDescription

    kieserver.drools.enabled

    true, false

    Enables or disables the Decision Manager component.

    kieserver.dmn.enabled

    true, false

    Enables or disables the Decision Model and Notation (DMN) component.

3.3. Configuring the business application with Red Hat Single Sign-On

You can use Red Hat Single Sign-On (RH SSO) to enable single sign-on between your services and to have a central place to configure and manage your users and roles.

Prerequisites

Procedure

  1. Download and install RH SSO. For instructions, see the Red Hat Single Sign-On Getting Started Guide.
  2. Configure RH SSO:

    1. Either use the default master realm or create a new realm.
    2. Create the springboot-app client and set the AccessType to public.
    3. Set a valid redirect URI and web origin according to your local setup, for example:

      • Valid redirect URIs: http://localhost:8090/*
      • Web origin: http://localhost:8090
    4. Create realm roles that are used in the application.
    5. Create users that are used in the application and assign roles to them.
  3. Add the following dependencies to the service project pom.xml file:

    <dependencyManagement>
      <dependencies>
        <dependency>
          <groupId>org.keycloak.bom</groupId>
          <artifactId>keycloak-adapter-bom</artifactId>
          <version>${version.org.keycloak}</version>
          <type>pom</type>
          <scope>import</scope>
        </dependency>
      </dependencies>
    </dependencyManagement>
    
      ....
    
    <dependency>
      <groupId>org.keycloak</groupId>
      <artifactId>keycloak-spring-boot-starter</artifactId>
    </dependency>
  4. Update the application.properties file:

    # keycloak security setup
    keycloak.auth-server-url=http://localhost:8100/auth
    keycloak.realm=master
    keycloak.resource=springboot-app
    keycloak.public-client=true
    keycloak.principal-attribute=preferred_username
    keycloak.enable-basic-auth=true
  5. Modify the DefaultWebSecurityConfig.java file to ensure that Spring Security works correctly with RH SSO:

    import org.keycloak.adapters.KeycloakConfigResolver;
    import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
    import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
    import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
    import org.springframework.beans.factory.annotation.Autowired;
    import org.springframework.context.annotation.Bean;
    import org.springframework.context.annotation.Configuration;
    import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
    import org.springframework.security.config.annotation.web.builders.HttpSecurity;
    import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
    import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
    import org.springframework.security.core.session.SessionRegistryImpl;
    import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
    import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
    
    @Configuration("kieServerSecurity")
    @EnableWebSecurity
    public class DefaultWebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {
    
        @Override
        protected void configure(HttpSecurity http) throws Exception {
            super.configure(http);
            http
            .csrf().disable()
            .authorizeRequests()
                .anyRequest().authenticated()
                .and()
            .httpBasic();
        }
    
        @Autowired
        public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
            KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
            SimpleAuthorityMapper mapper = new SimpleAuthorityMapper();
            mapper.setPrefix("");
            keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(mapper);
            auth.authenticationProvider(keycloakAuthenticationProvider);
        }
    
        @Bean
        public KeycloakConfigResolver KeycloakConfigResolver() {
           return new KeycloakSpringBootConfigResolver();
        }
    
        @Override
        protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
            return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
        }
    }

3.4. Configuring business application user group providers

With Red Hat Decision Manager, you can manage human-centric activities. To provide integration with user and group repositories, you can use two KIE API entry points:

  • UserGroupCallback: Responsible for verifying whether a user or group exists and for collecting groups for a specific user
  • UserInfo: Responsible for collecting additional information about users and groups, for example email addresses and preferred language

You can configure both of these components by providing alternative code, either code provided out of the box or custom developed code.

For the UserGroupCallback component, retain the default implementation because it is based on the security context of the application. For this reason, it does not matter which backend store is used for authentication and authorisation (for example, RH-SSO). It will be automatically used as a source of information for collecting user and group information.

The UserInfo component is a separate component because it collects more advanced information.

Prerequisites

  • You have a <business-application>.zip file that you created using the business application website and that contains a business automation project.

Procedure

  1. To provide an alternative implementation of UserGroupCallback, add the following code to the Application class or a separate class annotated with @Configuration:

    @Bean(name = "userGroupCallback")
    public UserGroupCallback userGroupCallback(IdentityProvider identityProvider) throws IOException {
        return new MyCustomUserGroupCallback(identityProvider);
    }
  2. To provide an alternative implementation of UserInfo, add the following code to the Application class or a separate class annotated with @Configuration:

    @Bean(name = "userInfo")
    public UserInfo userInfo() throws IOException {
        return new MyCustomUserInfo();
    }

3.5. Enabling Swagger documentation

You can enable Swagger-based documentation for all endpoints available in the service project of your Red Hat Decision Manager business application.

Prerequisites

Procedure

  1. Unzip the <business-application>.zip file and navigate to the <business-application>/<business-application>-service folder.
  2. Open the service project pom.xml file in a text editor.
  3. Add the following dependencies to the service project pom.xml file and save the file.

    <dependency>
      <groupId>org.apache.cxf</groupId>
      <artifactId>cxf-rt-rs-service-description-swagger</artifactId>
      <version>3.2.6</version>
    </dependency>
    <dependency>
      <groupId>io.swagger</groupId>
      <artifactId>swagger-jaxrs</artifactId>
      <version>1.5.15</version>
      <exclusions>
        <exclusion>
          <groupId>javax.ws.rs</groupId>
          <artifactId>jsr311-api</artifactId>
        </exclusion>
      </exclusions>
    </dependency>
  4. To enable the Swagger UI (optional), add the following dependency to the pom.xml file and save the file.

    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>swagger-ui</artifactId>
      <version>2.2.10</version>
    </dependency>
  5. Open the <business-application>/<business-application>-service/src/main/resources/application.properties file in a text editor.
  6. Add the following line to the application.properties file to enable Swagger support:

    kieserver.swagger.enabled=true

After you start the business application, you can view the Swagger document at http://localhost:8090/rest/swagger.json. The complete set of endpoints is available at http://localhost:8090/rest/api-docs?url=http://localhost:8090/rest/swagger.json.