Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 3. Business application configuration

By default, business applications are secured by protecting all REST endpoints (URLs that contain /rest/). In addition, business applications have two sets of log in credentials that allow users to connect to Business Central in development mode: the user with the ID user and password user and the user with the ID kieserver and password kieserver1!.

Both authentication and authorization is based on Spring security. Alter this security configuration for all business applications used in production environments. You can make configuration changes in the <business-application>/<business-application>-services/src/main/java/com/company/service/DefaultWebSecurityConfig.java file: 

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;


@Configuration("kieServerSecurity")
@EnableWebSecurity
public class DefaultWebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
        .csrf().disable()
        .authorizeRequests()
        .antMatchers("/rest/*").authenticated()
        .and()
        .httpBasic();
    }

  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
      PasswordEncoder encoder = PasswordEncoderFactories.createDelegatingPasswordEncoder();
      auth.inMemoryAuthentication().withUser("kieserver").password(encoder.encode("kieserver1!")).roles("kie-server")
      .and()
      .withUser("john").password(encoder.encode("john@pwd1")).roles("kie-server", "PM", "HR");
  }
}
Copy to Clipboard Toggle word wrap

3.2. Configuring the application.properties file
Copy link

After you create your business application, you can configure several components through the application.properties file to customize your application.

Prerequisites

  • You have a <business-application>.zip file that you created using the business application website.

Procedure

  1. Unzip the <business-application>.zip file and navigate to the <business-application>/<business-application>-service/src/main/resources folder.
  2. Open the application.properties file in a text editor.

  3. Configure the host, port, and path for the REST endpoints, for example: 

    server.address=localhost
server.port=8090

cxf.path=/rest
    Copy to Clipboard Toggle word wrap

  4. Configure the Decision Server (kieserver) so that it can be easily identified, for example: 

    kieserver.serverId=<business-application>-service
kieserver.serverName=<business-application>-service
kieserver.location=http://localhost:8090/rest/server
kieserver.controllers=http://localhost:8080/jbpm-console/rest/controller
    Copy to Clipboard Toggle word wrap

    The following table lists the Decision Server parameters that you can configure in your business application:

    Expand
    Table 3.1. kieserver parameters
    ParameterValuesDescription

    kieserver.serverId

    string

    The ID used to identify the business application when connecting to the Decision Manager controller.

    kieserver.serverName

    string

    The name used to identify the business application when connecting to the Decision Manager controller. Can be the same string used for the kieserver.serverId parameter.

    kieserver.location

    URL

    Used by other components that use the REST API to identify the location of this server. Do not use the location as defined by server.address and server.port.

    kieserver.controllers

    URLs

    A comma-separated list of controller URLs.

  5. If you selected Business Automation when you created your business application, specify which of the following components that you want to start at runtime:

    Expand
    Table 3.2. kieserver capabilities parameters
    ParameterValuesDescription

    kieserver.drools.enabled

    true, false

    Enables or disables the Decision Manager component.

    kieserver.dmn.enabled

    true, false

    Enables or disables the Decision Model and Notation (DMN) component.

You can use Red Hat Single Sign-On (RH SSO) to enable single sign-on between your services and to have a central place to configure and manage your users and roles.

Prerequisites

Procedure

  1. Download and install RH SSO. For instructions, see the Red Hat Single Sign-On Getting Started Guide.

  2. Configure RH SSO:

    1. Either use the default master realm or create a new realm.
    2. Create the springboot-app client and set the AccessType to public.

    3. Set a valid redirect URI and web origin according to your local setup, for example:

      • Valid redirect URIs: http://localhost:8090/*
      • Web origin: http://localhost:8090
    4. Create realm roles that are used in the application.
    5. Create users that are used in the application and assign roles to them.

  3. Add the following dependencies to the service project pom.xml file: 

    <dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.keycloak.bom</groupId>
      <artifactId>keycloak-adapter-bom</artifactId>
      <version>${version.org.keycloak}</version>
      <type>pom</type>
      <scope>import</scope>
    </dependency>
  </dependencies>
</dependencyManagement>

  ....

<dependency>
  <groupId>org.keycloak</groupId>
  <artifactId>keycloak-spring-boot-starter</artifactId>
</dependency>
    Copy to Clipboard Toggle word wrap

  4. Update the application.properties file: 

    # keycloak security setup
keycloak.auth-server-url=http://localhost:8100/auth
keycloak.realm=master
keycloak.resource=springboot-app
keycloak.public-client=true
keycloak.principal-attribute=preferred_username
keycloak.enable-basic-auth=true
    Copy to Clipboard Toggle word wrap

  5. Modify the DefaultWebSecurityConfig.java file to ensure that Spring Security works correctly with RH SSO: 

    import org.keycloak.adapters.KeycloakConfigResolver;
import org.keycloak.adapters.springboot.KeycloakSpringBootConfigResolver;
import org.keycloak.adapters.springsecurity.authentication.KeycloakAuthenticationProvider;
import org.keycloak.adapters.springsecurity.config.KeycloakWebSecurityConfigurerAdapter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.authority.mapping.SimpleAuthorityMapper;
import org.springframework.security.core.session.SessionRegistryImpl;
import org.springframework.security.web.authentication.session.RegisterSessionAuthenticationStrategy;
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;

@Configuration("kieServerSecurity")
@EnableWebSecurity
public class DefaultWebSecurityConfig extends KeycloakWebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        super.configure(http);
        http
        .csrf().disable()
        .authorizeRequests()
            .anyRequest().authenticated()
            .and()
        .httpBasic();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        KeycloakAuthenticationProvider keycloakAuthenticationProvider = keycloakAuthenticationProvider();
        SimpleAuthorityMapper mapper = new SimpleAuthorityMapper();
        mapper.setPrefix("");
        keycloakAuthenticationProvider.setGrantedAuthoritiesMapper(mapper);
        auth.authenticationProvider(keycloakAuthenticationProvider);
    }

    @Bean
    public KeycloakConfigResolver KeycloakConfigResolver() {
       return new KeycloakSpringBootConfigResolver();
    }

    @Override
    protected SessionAuthenticationStrategy sessionAuthenticationStrategy() {
        return new RegisterSessionAuthenticationStrategy(new SessionRegistryImpl());
    }
}
    Copy to Clipboard Toggle word wrap

With Red Hat Decision Manager, you can manage human-centric activities. To provide integration with user and group repositories, you can use two KIE API entry points:

  • UserGroupCallback: Responsible for verifying whether a user or group exists and for collecting groups for a specific user
  • UserInfo: Responsible for collecting additional information about users and groups, for example email addresses and preferred language

You can configure both of these components by providing alternative code, either code provided out of the box or custom developed code.

For the UserGroupCallback component, retain the default implementation because it is based on the security context of the application. For this reason, it does not matter which backend store is used for authentication and authorisation (for example, RH-SSO). It will be automatically used as a source of information for collecting user and group information.

The UserInfo component is a separate component because it collects more advanced information.

Prerequisites

  • You have a <business-application>.zip file that you created using the business application website and that contains a business automation project.

Procedure

  1. To provide an alternative implementation of UserGroupCallback, add the following code to the Application class or a separate class annotated with @Configuration: 

    @Bean(name = "userGroupCallback")
public UserGroupCallback userGroupCallback(IdentityProvider identityProvider) throws IOException {
    return new MyCustomUserGroupCallback(identityProvider);
}
    Copy to Clipboard Toggle word wrap

  2. To provide an alternative implementation of UserInfo, add the following code to the Application class or a separate class annotated with @Configuration: 

    @Bean(name = "userInfo")
public UserInfo userInfo() throws IOException {
    return new MyCustomUserInfo();
}
    Copy to Clipboard Toggle word wrap

3.5. Enabling Swagger documentation
Copy link

You can enable Swagger-based documentation for all endpoints available in the service project of your Red Hat Decision Manager business application.

Prerequisites

Procedure

  1. Unzip the <business-application>.zip file and navigate to the <business-application>/<business-application>-service folder.
  2. Open the service project pom.xml file in a text editor.

  3. Add the following dependencies to the service project pom.xml file and save the file. 

    <dependency>
  <groupId>org.apache.cxf</groupId>
  <artifactId>cxf-rt-rs-service-description-swagger</artifactId>
  <version>3.2.6</version>
</dependency>
<dependency>
  <groupId>io.swagger</groupId>
  <artifactId>swagger-jaxrs</artifactId>
  <version>1.5.15</version>
  <exclusions>
    <exclusion>
      <groupId>javax.ws.rs</groupId>
      <artifactId>jsr311-api</artifactId>
    </exclusion>
  </exclusions>
</dependency>
    Copy to Clipboard Toggle word wrap

  4. To enable the Swagger UI (optional), add the following dependency to the pom.xml file and save the file. 

    <dependency>
  <groupId>org.webjars</groupId>
  <artifactId>swagger-ui</artifactId>
  <version>2.2.10</version>
</dependency>
    Copy to Clipboard Toggle word wrap
  5. Open the <business-application>/<business-application>-service/src/main/resources/application.properties file in a text editor.

  6. Add the following line to the application.properties file to enable Swagger support: 

    kieserver.swagger.enabled=true
    Copy to Clipboard Toggle word wrap

After you start the business application, you can view the Swagger document at http://localhost:8090/rest/swagger.json. The complete set of endpoints is available at http://localhost:8090/rest/api-docs?url=http://localhost:8090/rest/swagger.json.

Back to top
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2025 Red Hat