Chapter 4. Authenticating Decision Central through RH-SSO

1. In the RH-SSO Admin Console, click the Realm Settings menu item.

2. On the Realm Settings page, click Add Realm.

   The Add realm page opens.

3. On the Add realm page, provide a name for the realm and click Create.

4. Click the Clients menu item and click Create.

   The Add Client page opens.

5. On the Add Client page, provide the required information to create a new client for your realm. For example:

   • Client ID: kie
   • Client protocol: openid-connect
   • Root URL: http://localhost:8080/decision-central

6. Click Save to save your changes.

   After you create a new client, its Access Type is set to public by default. Change it to confidential.

   The RH-SSO server is now configured with a realm with a client for Decision Central applications and running and listening for HTTP connections at localhost:8180. This realm provides different users, roles, and sessions for Decision Central applications.

Procedure

1. Navigate to the Software Downloads page in the Red Hat Customer Portal (login required), and select the product and version from the drop-down options:

   • Product: Red Hat Single Sign-On
   • Version: 7.2
2. Download Red Hat Single Sign-on 7.2.0 Client Adapter for JBoss EAP 7 (rh-sso-7.2.0-eap7-adapter.zip).
3. Unzip and install rh-sso-7.2.0-eap7-adapter.zip. For installation instructions, see the "JBoss EAP Adapter" section of the Red Hat Single Sign On Securing Applications and Services Guide.
4. Go to EAP_HOME/standalone/configuration and open the standalone.xml and standalone-full.xml files.
5. Delete the <single-sign-on/> element from both of the files.

6. Navigate to the EAP_HOME/standalone/configuration directory in your Red Hat JBoss EAP installation and edit the standalone.xml and standalone-full.xml files to add the RH-SSO subsystem configuration. For example:

   <subsystem xmlns="urn:jboss:domain:keycloak:1.1">
    <secure-deployment name="decision-central.war">
      <realm>demo</realm>
      <realm-public-key>MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCrVrCuTtArbgaZzL1hvh0xtL5mc7o0NqPVnYXkLvgcwiC3BjLGw1tGEGoJaXDuSaRllobm53JBhjx33UNv+5z/UMG4kytBWxheNVKnL6GgqlNabMaFfPLPCF8kAgKnsi79NMo+n6KnSY8YeUmec/p2vjO2NjsSAVcWEQMVhJ31LwIDAQAB</realm-public-key>
      <auth-server-url>http://localhost:8180/auth</auth-server-url>
      <ssl-required>external</ssl-required>
      <enable-basic-auth>true</enable-basic-auth>
      <resource>kie</resource>
      <credential name="secret">759514d0-dbb1-46ba-b7e7-ff76e63c6891</credential>
      <principal-attribute>preferred_username</principal-attribute>
    </secure-deployment>
   </subsystem>

   In this example:

   • secure-deployment name is the name of your application’s WAR file.
   • realm is the name of the realm that you created for the applications to use.
   • realm-public-key is the public key of the realm you created. You can find the key in the Keys tab in the Realm settings page of the realm you created in the RH-SSO Admin Console. If you do not provide a value for realm-public-key, the server retrieves it automatically.
   • auth-server-url is the URL for the RH-SSO authentication server.
   • enable-basic-auth is the setting to enable basic authentication mechanism, so that the clients can use both token-based and basic authentication approaches to perform the requests.
   • resource is the name for the client that you created.
   • credential name is the secret key for the client you created. You can find the key in the Credentials tab on the Clients page of the RH-SSO Admin Console.

   • principal-attribute is the login name of the user. If you do not provide this value, your User Id is displayed in the application instead of your user name.

     Note

     The RH-SSO server converts the user names to lower case. Therefore, after integration with RH-SSO, your user name will appear in lower case in Red Hat Decision Manager. If you have user names in upper case hard coded in business processes, the application might not be able to identify the upper case user.

7. Navigate to EAP_HOME/bin/ and enter the following command to start the Red Hat JBoss EAP server:

   ./standalone.sh -c standalone-full.xml

Procedure

1. Open the Decision Central application deployment descriptor file (WEB-INF/web.xml) and apply the following changes to it:

   • Remove the following lines to remove the servlet filter and its mapping for class org.uberfire.ext.security.server.BasicAuthSecurityFilter:

     <filter>
       <filter-name>HTTP Basic Auth Filter</filter-name>
       <filter-class>org.uberfire.ext.security.server.BasicAuthSecurityFilter</filter-class>
       <init-param>
         <param-name>realmName</param-name>
         <param-value>KIE Workbench Realm</param-value>
       </init-param>
     </filter>
     
     <filter-mapping>
       <filter-name>HTTP Basic Auth Filter</filter-name>
       <url-pattern>/rest/*</url-pattern>
       <url-pattern>/maven2/*</url-pattern>
       <url-pattern>/ws/*</url-pattern>
     </filter-mapping>

   • Add the following lines to add the security-constraint parameter for the url-patterns that you have removed from the filter mapping:

     <security-constraint>
       <web-resource-collection>
         <web-resource-name>remote-services</web-resource-name>
         <url-pattern>/rest/*</url-pattern>
         <url-pattern>/maven2/*</url-pattern>
         <url-pattern>/ws/*</url-pattern>
       </web-resource-collection>
       <auth-constraint>
         <role-name>rest-all</role-name>
         <role-name>rest-project</role-name>
         <role-name>rest-deployment</role-name>
         <role-name>rest-process</role-name>
         <role-name>rest-process-read-only</role-name>
         <role-name>rest-task</role-name>
         <role-name>rest-task-read-only</role-name>
         <role-name>rest-query</role-name>
         <role-name>rest-client</role-name>
       </auth-constraint>
     </security-constraint>

2. Save your changes.

Procedure

1. Generate a JSON configuration file:

   1. Navigate to the RH-SSO Admin Console located at http://localhost:8180/auth/admin.
   2. Click Clients.

   3. Create a new client with the following settings:

      • Set Client ID as kie-git.
      • Set Access Type as confidential.
      • Disable the Standard Flow Enabled option.
      • Enable the Direct Access Grants Enabled option.
      
   4. Click Save.
   5. Click the Installation tab at the top of the client configuration screen and choose Keycloak OIDC JSON as a Format Option.
   6. Click Download.
2. Move the downloaded JSON file to an accessible directory in the server’s file system or add it to the application class path.

3. Specify the correct RH-SSO login module in the EAP_HOME/standalone/configuration/standalone.xml and standalone-full.xml files. By default, the security domain in Red Hat Decision Manager is set to other. Replace the default values of the login-module in this security domain with the values in the following example:

   <security-domain name="other" cache-type="default">
     <authentication>
       <login-module code="org.keycloak.adapters.jaas.DirectAccessGrantsLoginModule" flag="required">
         <module-option name="keycloak-config-file" value="$EAP_HOME/kie-git.json"/>
       </login-module>
     </authentication>
   </security-domain>

4. The JSON file specified in the module-option element contains a client used for securing the remote services. Replace the $EAP_HOME/kie-git.json value of the module-option element with the absolute path or the class path (classpath:/EXAMPLE_PATH/kie-git.json) to this JSON configuration file.

   At this point, all users authenticated through the RH-SSO server can clone internal GIT repositories. In the following command, change USER_NAME to a RH-SSO user, for example admin:

   git clone ssh://USER_NAME@localhost:8001/system

Procedure

1. Ensure that the following libraries are in the WEB-INF/lib directory:

   uberfire-security-management-api-<latest_artifact_version>.jar
   uberfire-security-management-backend-<latest_artifact_version>.jar
   uberfire-security-management-keycloak-<latest_artifact_version>.jar
   keycloak-core-<latest_artifact_version>.jar
   keycloak-common-<latest_artifact_version>.jar

2. Remove third-party security JAR files, for example:

   uberfire-security-management-wildfly-<latest_artifact_version>.jar
   uberfire-security-management-tomcat-<latest_artifact_version>.jar

3. Replace the entire contents of the WEB-INF/classes/security-management.properties file with the following content:

   org.uberfire.ext.security.management.api.userManagementServices=KCAdapterUserManagementService
   org.uberfire.ext.security.management.keycloak.authServer=http://localhost:8180/auth

   Note

   If the WEB-INF/classes/security-management.properties file does not exist, create it.

4. Edit the following dependencies and exclusions in the /META-INF/jboss-deployment-structure.xml file:

   <dependencies>
       <module name="org.jboss.resteasy.resteasy-jackson-provider" services="import"/>
   </dependencies>
   <exclusions>
       <module name="org.jboss.resteasy.resteasy-jackson2-provider"/>
   </exclusions>