Setup Location and Users

Setup Security Environment

Configure Runtime Environment

• Default Configuration

  Choose default configuration for the runtime environment in the next step and click next to review the installation details. If you are happy with the details, click next to start the actual installation or click previous to go back and make changes.

• Advanced Configuration

  Choose to enable advanced configuration options. Select "Perform advanced configuration" and choose the advanced configuration options you want to enable for your environment via the check boxes.
  

  Figure 2.2. Advanced Configuration Options

  • Configure Vault Password

    Vault passwords are used to obfuscate passwords in the various server descriptors using a java secret key generated during the installation process, or manually using the keytool. This prevents passwords from being stored as plain text in the descriptors. The iteration count and salt are both parameters to the encryption process.
    In the case of JBoss BPM Suite, a vault is always installed, even if the user does not choose to install one with their own parameters. When this occurs, default values will be used.
    For more information about vault passwords, see the Red Hat JBoss EAP Security Guide.
    

    Figure 2.3. Configure vault password

  • SSL Security

    This screen allows you to add the <ssl> and <truststore> elements to the ManagementRealm security-realm using the provided keystore.

    • The <ssl> element causes the server to present the certificate within the keystore as its identity, which allows the user to apply their official certificate.
    • The <truststore> element enables "Client-Cert" authentication. This means that, if a remote client attempts to connect to any resource managed by the ManagementRealm, the client can present a certificate, and if an entry in the truststore matches, will be authenticated without needing to provide a username / password.

    The end result is an encrypted connection that is secure between the client and the server for the ManagementRealm.
    

    Figure 2.4. SSL Security Configuration

  • LDAP Security

    This step in the installer allows the user to define an LDAP server, which in turn defines users which should be allowed to authenticate with the ManagementRealm. This replaces the default configuration.
    The LDAP Connection screen allows users to define how to connect to the LDAP server.

    • The Distinguished Name(DN): the user that can connect to the LDAP server. Typically the DN will uniquely define a special user for this purpose.
    

    Figure 2.5. LDAP Connection Configuration

    LDAP Security (Management Console)

    The Management Console LDAP Configuration screen allows you to set up a security realm. This defines the <security-realm> element to be added to the descriptors, and utilizes the connection defined previously.
    

    Figure 2.6. Management Console LDAP Configuration

    • Base DN: Will typically define a 'base search' or 'root context' to begin searching for users.
    • Filter type: Tells JBoss EAP how to find the LDAP attribute that defines a user; it is can be a simple attribute, but can also be a complex "LDAP Filter".
    • Username attribute: The LDAP attribute which holds the username values. A username entered in this field is used for search queries as a value of the 'uid' attribute. If a user chooses 'LDAP syntax query' as a filter type, this query must be specified in this field.
    • Recursive directory search: If enabled, JBoss EAP will traverse the LDAP tree recursively, starting at Base DN. Otherwise, the search will be limited to Base DN.

    LDAP Security (Business Central)

    Most of the following fields are similar to the Base DN. Contexts are used to search for roles, which allows it to perform authorization in addition to authentication. Otherwise, the context fields are analogous to the Base DN from the previous, and attribute fields are analogous to Username attribute. The filters allow fine grained control over which values of the given attribute will be accepted.
    In JBoss BPM Suite, the jbpm.usergroup.callback.properties and jbpm.user.info.properties files used by LDAPUserGroupInfo and LDAPUserInfo components of Task Service, are also filled by values entered on the Business Central LDAP Configuration page.
    Input values from Business Central LDAP Configuration page are used to configure a new security domain, which make use of LdapExtended login module. This security domain is set as default for Business Central web application. For more information about security domains and login modules, see the Red Hat JBoss EAP Security Guide.
    

    Figure 2.7. Business Central LDAP Configuration

  • Security Domain and JSSE

    The Security Domain screen allows you to configure all of the elements of the <security-domain> security subsystem for managing security information, including JSSE configuration. For more detailed information about configuring security domains, see the Red Hat JBoss EAP Security Guide.
    

    Figure 2.8. Security Domain

    

    Figure 2.9. JSSE Configuration

  • Configure JMS SSL Keystores

    This screen allows the encryption of JMS messages sent to Business Central. The client keystores are distributed to systems that need to communicate with the server in order to facilitate encrypted communications. Users can use their pre-existing keystores or generate new ones.
    

    Figure 2.10. Configure JMS SSL Keystores

java -jar jboss-bpmsuite-6.1.0.GA-installer.jar -console

press 1 to continue, 2 to quit, 3 to redisplay.

The location below must specify the JBOSS_HOME of an existing EAP installation.

[/home/user/BPMSuite-6.1.0/jboss-eap-6.4]

Create an administrative user
This user will be added to the host container's management realm for administrative purposes. It can be used to access the management console, the management CLI or other applications secured in this realm.

Create a Business Process Management Suite Admin User
Create a BPM Suite admin user. The user will be added to the ApplicationRealm, and can be used to access the Business Central Console. The User will be assigned the 'admin' application roles. The BPM Suite username cannot be any of the following: 'admin', 'analyst', 'user', 'manager' or 'developer'.


BPM Suite username: [bpmsAdmin]

The password must have at least 8 characters, and contain at least one number and one non-alphanumeric symbol (not including the character &).

BPM Suite password: []

Confirm BPM Suite password: [****************]

(Optional) You can add this user to additional roles that will be used for task management.  These roles are custom named and used again when building your processes with human tasks.  Add your custom named roles in a comma separated list below.

Additional user roles: []

Configure the Java Security Manager
A Java security manager offers JVM level security beyond what is provided by the application container. It enforces access rules at the JVM runtime based on one or more security policies.

This installer will place two security policies in the installation directory with the filenames 'security.policy' and 'kie.policy' regardless of choice. Those policies will be enabled at runtime if the option below is selected.

Please note that a security manager imposes a significant performance overhead when enabled. It is suggested the included policies be applied in production if user requirements call for a stronger measure than what is already provided by the application container's authentication and authorization mechanism.

Please see the JBoss Business Process Management Suite administrative documentation for further details and consideration.
  [ ] Enable the Java security manager
Input 1 to select, 0 to deselect:

press 1 to continue, 2 to quit, 3 to redisplay.

IPv6 configuration

If this computer is using a pure IPv6 configuration, please check the box below. A pure IPv6 setup requires additional configuration at runtime to ensure the proper bindings of the management and http interfaces.
  [ ] Enable pure IPv6 configuration
Input 1 to select, 0 to deselect:

press 1 to continue, 2 to quit, 3 to redisplay.

Configure runtime environment
Red Hat JBoss Business Process Management Suite can be further customized at this time.
0  [x] Perform default configuration
1  [ ] Perform advanced configuration

•   [ ] Install password vault
  Input 1 to select, 0 to deselect:
  

•   [ ] Enable SSL security
  Input 1 to select, 0 to deselect:
  

•   [ ] Secure EAP Management Console with LDAP
  Input 1 to select, 0 to deselect:
  

•   [ ] Secure Business Central with LDAP
  Input 1 to select, 0 to deselect:
  

•   [ ] Add a security-domain
  Input 1 to select, 0 to deselect:
  

•   [ ] Generate JMS Client Keystores
  Input 1 to select, 0 to deselect:
  

press 1 to continue, 2 to quit, 3 to redisplay.

Installation has completed successfully.
Application installed on /home/user/BPMSuite-6.1.0/jboss-eap-6.4
Would you like to generate an automatic intallation script and properties file?
(y/n) [n]:

Select path for the automatic installation script: [/home/user/BPMSuite-6.1.0/jboss-eap-6.4/<auto script filename>]

java -jar jboss-bpmsuite-6.1.0.GA-installer.jar <auto script filename>

-variablefile <variable filename>

-variables key1=value1,key2=value2

XML written successfully.
[ Console installation done ]
[BPMS_Installer]$

./standalone.sh

./domain.sh

./domain.bat

1. To deploy the archive via ${jboss-eap-home}/bin/jboss-cli.sh or ${jboss-eap-home}/bin/jboss-cli.bat, move into the ${jboss-eap-home}/bin directory and deploy the WAR file:
   In a Unix environment, run:

   ./jboss-cli.sh

   In a Windows environment, run:

   ./jboss-cli.bat

2. To deploy the archive via management web UI (localhost:9990/):
   • log in using your EAP management account
   • select Domain -> Manage Deployments -> Content Repository -> Add
   • select the web archive from the file system, upload the web archive
   • select the deployment, click the Assign button
   • select the server group