Chapter 2. Building and running JBoss EAP applications on OpenShift Container Platform

Procedure

1. Set up a Maven project using the mvn command. The command creates the directory structure for the project and the pom.xml configuration file.

   Syntax

   $ mvn archetype:generate \
   -DgroupId=${group-to-which-your-application-belongs} \
   -DartifactId=${name-of-your-application} \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

   Example

   $ mvn archetype:generate \
   -DgroupId=com.example.app \
   -DartifactId=simple-webapp-example \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

2. Navigate to the application root directory:

   Syntax

   $ cd <name-of-your-application>

   Example

   $ cd simple-webapp-example

3. Replace the content of the generated pom.xml file with the following text:

   <?xml version="1.0" encoding="UTF-8"?>
   
   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
   
     <groupId>com.example.app</groupId>
     <artifactId>simple-webapp-example</artifactId>
     <version>1.0-SNAPSHOT</version>
     <packaging>war</packaging>
   
     <name>simple-webapp-example Maven Webapp</name>
     <!-- FIXME change it to the project's website -->
     <url>http://www.example.com</url>
   
     <properties>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <version.maven.war.plugin>3.3.2</version.maven.war.plugin>
       <version.eap.plugin>1.0.0.Beta-redhat-00001</version.eap.plugin>
     </properties>
   
     <repositories>
       <repository>
           <id>jboss</id>
           <url>https://maven.repository.redhat.com/earlyaccess/all/</url>
           <snapshots>
               <enabled>false</enabled>
           </snapshots>
       </repository>
     </repositories>
     <pluginRepositories>
       <pluginRepository>
           <id>jboss</id>
           <url>https://maven.repository.redhat.com/earlyaccess/all/</url>
           <snapshots>
               <enabled>false</enabled>
           </snapshots>
       </pluginRepository>
     </pluginRepositories>
   
     <dependencies>
       <dependency>
         <groupId>jakarta.servlet</groupId>
         <artifactId>jakarta.servlet-api</artifactId>
         <version>6.0.0</version>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.wildfly.security</groupId>
         <artifactId>wildfly-elytron-auth-server</artifactId>
         <version>1.19.0.Final</version>
       </dependency>
     </dependencies>
   
   <build>
       <finalName>${project.artifactId}</finalName>
       <plugins>
           <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-war-plugin</artifactId>
               <version>${version.maven.war.plugin}</version>
           </plugin>
           <plugin>
               <groupId>org.jboss.eap.plugins</groupId>
               <artifactId>eap-maven-plugin</artifactId>
               <version>${version.eap.plugin}</version>
               <configuration>
                   <channels>
                       <channel>
                           <groupId>org.jboss.eap.channels</groupId>
                           <artifactId>eap-8.0-beta</artifactId>
                       </channel>
                   </channels>
                   <feature-packs>
                       <feature-pack>
                           <location>org.jboss.eap:wildfly-ee-galleon-pack</location>
                       </feature-pack>
                       <feature-pack>
                           <location>org.jboss.eap.cloud:eap-cloud-galleon-pack</location>
                       </feature-pack>
                   </feature-packs>
                   <layers>
                       <layer>cloud-server</layer>
                       <layer>elytron-oidc-client</layer>
                   </layers>
                   <galleon-options>
                           <jboss-fork-embedded>true</jboss-fork-embedded>
                   </galleon-options>
               </configuration>
               <executions>
                   <execution>
                       <goals>
                           <goal>package</goal>
                       </goals>
                   </execution>
               </executions>
           </plugin>
       </plugins>
   </build>
   </project>

4. Create a directory to store the Java files.

   Syntax

   $ mkdir -p src/main/java/<path_based_on_artifactID>

   Example

   $ mkdir -p src/main/java/com/example/app

5. Navigate to the new directory.

   Syntax

   $ cd src/main/java/<path_based_on_artifactID>

   Example

   $ cd src/main/java/com/example/app

6. Create a file SecuredServlet.java with the following content:

   package com.example.app;
   
   import java.io.IOException;
   import java.io.PrintWriter;
   import java.security.Principal;
   import java.util.ArrayList;
   import java.util.Collection;
   import java.util.Iterator;
   import java.util.List;
   import java.util.Set;
   
   import jakarta.servlet.ServletException;
   import jakarta.servlet.annotation.WebServlet;
   import jakarta.servlet.http.HttpServlet;
   import jakarta.servlet.http.HttpServletRequest;
   import jakarta.servlet.http.HttpServletResponse;
   import org.wildfly.security.auth.server.SecurityDomain;
   import org.wildfly.security.auth.server.SecurityIdentity;
   import org.wildfly.security.authz.Attributes;
   import org.wildfly.security.authz.Attributes.Entry;
   /**
    * A simple secured HTTP servlet. It returns the user name and
    * attributes obtained from the logged-in user's Principal. If
    * there is no logged-in user, it returns the text
    * "NO AUTHENTICATED USER".
    */
   
   @WebServlet("/secured")
   public class SecuredServlet extends HttpServlet {
   
       @Override
       protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
           try (PrintWriter writer = resp.getWriter()) {
   
           	Principal user = req.getUserPrincipal();
           	SecurityIdentity identity = SecurityDomain.getCurrent().getCurrentSecurityIdentity();
           	Attributes identityAttributes = identity.getAttributes();
           	Set <String> keys = identityAttributes.keySet();
           	String attributes = "<ul>";
   
           	for (String attr : keys) {
           		attributes += "<li> " +  attr + " : " + identityAttributes.get(attr).toString() + "</li>";
           	}
   
           	attributes+="</ul>";
           	writer.println("<html>");
           	writer.println("  <head><title>Secured Servlet</title></head>");
           	writer.println("  <body>");
           	writer.println("    <h1>Secured Servlet</h1>");
           	writer.println("    <p>");
           	writer.print(" Current Principal '");
           	writer.print(user != null ? user.getName() : "NO AUTHENTICATED USER");
           	writer.print("'");
           	writer.print(user != null ? "\n" + attributes : "");
           	writer.println("    </p>");
           	writer.println("  </body>");
           	writer.println("</html>");
           }
       }
   
   }

7. Configure the application’s web.xml to protect the application resources.

   Example

   <?xml version="1.0" encoding="UTF-8"?>
   
   <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
       metadata-complete="false">
   
       <security-constraint>
           <web-resource-collection>
               <web-resource-name>secured</web-resource-name>
               <url-pattern>/secured</url-pattern>
           </web-resource-collection>
   
           <auth-constraint>
               <role-name>Users</role-name>
           </auth-constraint>
       </security-constraint>
   
       <login-config>
           <auth-method>OIDC</auth-method>
       </login-config>
   
       <security-role>
           <role-name>*</role-name>
       </security-role>
   </web-app>

   In this example, only the users with the role Users can access the application.

Procedure

1. Deploy your application code to Git Repository.

2. Create a secret containing the OIDC configuration.

   1. Create a file named oidc-secret.yaml using the following content:

      apiVersion: v1
      kind: Secret
      metadata:
        name: oidc-secret
      type: Opaque
      stringData:
        OIDC_PROVIDER_NAME: rh-sso
        OIDC_USER_NAME: demo
        OIDC_USER_PASSWORD: demo
        OIDC_SECURE_DEPLOYMENT_SECRET: mysecret

   2. Use the following command to create a secret:

      $ oc apply -f oidc-secret.yaml

3. Create a file named helm.yaml using the following content:

   build:
     uri: [URL TO YOUR GIT REPOSITORY]
   deploy:
     envFrom:
   	- secretRef:
       	  name: oidc-secret

4. Deploy the example application using JBoss EAP Helm charts:

   $ helm install eap-oidc-test-app -f helm.yaml jboss-eap/eap8

5. Add the environment variables to the oidc-secret.yaml file to configure the OIDC provider URL and application hostname.

   yaml
   stringData:
     ...
     OIDC_HOSTNAME_HTTPS: <host of the application>
     OIDC_PROVIDER_URL: https://<host of the SSO provider>/auths/realms/JBossEAP

   The value for OIDC_HOSTNAME_HTTPS corresponds to the following output:

   echo $(oc get route eap-oidc-test-app --template='{{ .spec.host }}')

   The value for OIDC_PROVIDER_URL corresponds to the following output:

   echo https://$(oc get route sso --template='{{ .spec.host }}')/auth/realms/JBossEAP

   A route discovery attempt is made if OIDC_HOSTNAME_HTTP(S) is not set. To enable route discovery, the OpenShift user must be able to list the route resources. For example, to create and associate the routeview role with the view user, use the following oc command:

   $ oc create role <role-name> --verb=list --resource=route
   
   $ oc adm policy add-role-to-user <role-name> <user-name> --role-namespace=<your namespace>

6. Update the secret with oc apply -f oidc-secret.yaml.

7. Deploy the application again to ensure OpenShift uses the new environment variables:

   $ oc rollout restart deploy eap-oidc-test-app

Verification

1. In your browser, navigate to https://<eap-oidc-test-app route>/.

   You will be redirected to Red Hat Single Sign-On login page.

2. Access the secured servlet.

3. Log in with the following credentials:

   username: demo
   password: demo

   A page appears that contains the Principal ID.