Chapter 2. Building and running JBoss EAP applications on OpenShift Container Platform

Procedure

1. Copy the following Dockerfile contents as provided:

   # Use EAP 8 Builder image to create a JBoss EAP 8 server
   # with its default configuration
   
   FROM registry.redhat.io/jboss-eap-8/eap81-openjdk21-builder-openshift-rhel9:latest AS builder
   
   # Set up environment variables for provisioning. 

   1

   
   ENV GALLEON_PROVISION_FEATURE_PACKS org.jboss.eap:wildfly-ee-galleon-pack,org.jboss.eap.cloud:eap-cloud-galleon-pack
   ENV GALLEON_PROVISION_LAYERS cloud-default-config
   # Specify the JBoss EAP version  

   2

   
   ENV GALLEON_PROVISION_CHANNELS org.jboss.eap.channels:eap-8.1
   
   
   # Run the assemble script to provision the server.
   RUN /usr/local/s2i/assemble
   
   # Copy the JBoss EAP 8 server from the builder image to the runtime image.
   FROM registry.redhat.io/jboss-eap-8/eap81-openjdk21-runtime-openshift-rhel9:latest AS runtime
   
   # Set appropriate ownership and permissions.
   COPY --from=builder --chown=jboss:root $JBOSS_HOME $JBOSS_HOME
   
   # Steps to add:
   # (1) COPY the WAR/EAR to $JBOSS_HOME/standalone/deployments
   #       with the jboss:root user. For example:
   #     COPY --chown=jboss:root my-app.war $JBOSS_HOME/standalone/deployments 

   3

   
   # (2) (optional) server modification. You can modify EAP server configuration:
   #
   #       * invoke management operations. For example
   #
   #        RUN $JBOSS_HOME/bin/jboss-cli.sh --commands="embed-server,/system-property=Foo:add(value=Bar)"
   #
   #        First operation must always be embed-server.
   #
   #       * copy a modified standalone.xml in $JBOSS_HOME/standalone/configuration/
   #          for example
   #
   #      COPY --chown=jboss:root standalone.xml  $JBOSS_HOME/standalone/configuration
   
   # Ensure appropriate permissions for the copied files.
   RUN chmod -R ug+rwX $JBOSS_HOME

   Copy to Clipboard Toggle word wrap

   1

   You can specify the MAVEN_MIRROR_URL environment variable, which is used by the JBoss EAP Maven plugin internally within the image. For more information, see Artifact repository mirrors.

   2

   You do not need to update this Dockerfile for any of the minor releases. Specify the JBoss EAP version in the GALLEON_PROVISION_CHANNELS environment variable if you want to use a specific version. For more information, see Environment variables.

   3

   Modify the copied Dockerfile to include your WAR file in the container. For example:

   COPY --chown=jboss:root <my-app.war> $JBOSS_HOME/standalone/deployments

   Copy to Clipboard Toggle word wrap

   Replace <myapp.war> with the path to the Web archive you want to add to the image.

2. Build the application image using podman:

   $ podman build -t my-app .

   Copy to Clipboard Toggle word wrap

   After the command is executed, the my-app container image is ready to be deployed on OpenShift.

3. Upload your container image to one of the following options:

   • Your internal registry that is accessible from OpenShift.
   • The OpenShift registry by pushing the image directly from the machine where it was built. For more information, see How to push a container image into the image registry in RHOCP 4.
4. When deploying your image from the registry, use deployment strategies such as Helm charts, Operator, or Deployment. Select your preferred method and use either the full image URL or ImageStreams based on your requirements. For more information, see Using Helm charts to build and deploy JBoss EAP applications on OpenShift.

Procedure

1. Set up a Maven project using the mvn command. The command creates the directory structure for the project and the pom.xml configuration file.

   Syntax

   $ mvn archetype:generate \
   -DgroupId=${group-to-which-your-application-belongs} \
   -DartifactId=${name-of-your-application} \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

   Copy to Clipboard Toggle word wrap

   Example

   $ mvn archetype:generate \
   -DgroupId=com.example.app \
   -DartifactId=simple-webapp-example \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

   Copy to Clipboard Toggle word wrap

2. Navigate to the application root directory:

   Syntax

   $ cd <name-of-your-application>

   Copy to Clipboard Toggle word wrap

   Example

   $ cd simple-webapp-example

   Copy to Clipboard Toggle word wrap

3. Replace the content of the generated pom.xml file with the following text:

   <?xml version="1.0" encoding="UTF-8"?>
   
   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
   
     <groupId>com.example.app</groupId>
     <artifactId>simple-webapp-example</artifactId>
     <version>1.0-SNAPSHOT</version>
     <packaging>war</packaging>
   
     <name>simple-webapp-example Maven Webapp</name>
     <!-- FIXME change it to the project's website -->
     <url>http://www.example.com</url>
   
     <properties>
       <maven.compiler.source>11</maven.compiler.source>
       <maven.compiler.target>11</maven.compiler.target>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <version.maven.war.plugin>3.4.0</version.maven.war.plugin>
       <version.eap.plugin>2.0.0.Final-redhat-00009</version.eap.plugin>
       <version.server>8.1.0.GA-redhat-00013</version.server>
       <version.bom.ee>${version.server}</version.bom.ee>
     </properties>
   
   
     <repositories>
       <repository>
           <id>jboss</id>
           <url>https://maven.repository.redhat.com/ga/</url>
           <snapshots>
               <enabled>false</enabled>
           </snapshots>
       </repository>
     </repositories>
   
     <pluginRepositories>
       <pluginRepository>
           <id>jboss</id>
           <url>https://maven.repository.redhat.com/ga/</url>
           <snapshots>
               <enabled>false</enabled>
           </snapshots>
       </pluginRepository>
     </pluginRepositories>
   
     <dependencyManagement>
       <dependencies>
         <dependency>
           <groupId>org.jboss.bom</groupId>
           <artifactId>jboss-eap-ee-with-tools</artifactId>
           <version>${version.bom.ee}</version>
           <type>pom</type>
           <scope>import</scope>
         </dependency>
       </dependencies>
     </dependencyManagement>
   
     <dependencies>
       <dependency>
         <groupId>jakarta.servlet</groupId>
         <artifactId>jakarta.servlet-api</artifactId>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.wildfly.security</groupId>
         <artifactId>wildfly-elytron-auth-server</artifactId>
       </dependency>
     </dependencies>
   
   <build>
       <finalName>${project.artifactId}</finalName>
       <plugins>
           <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-war-plugin</artifactId>
               <version>${version.maven.war.plugin}</version>
           </plugin>
           <plugin>
               <groupId>org.jboss.eap.plugins</groupId>
               <artifactId>eap-maven-plugin</artifactId>
               <version>${version.eap.plugin}</version>
               <configuration>
                   <channels>
                       <channel>
                           <manifest>
                               <groupId>org.jboss.eap.channels</groupId>
                               <artifactId>eap-8.1</artifactId>
                           </manifest>
                       </channel>
                   </channels>
                   <feature-packs>
                       <feature-pack>
                           <location>org.jboss.eap:wildfly-ee-galleon-pack</location>
                       </feature-pack>
                       <feature-pack>
                           <location>org.jboss.eap.cloud:eap-cloud-galleon-pack</location>
                       </feature-pack>
                   </feature-packs>
                   <layers>
                       <layer>cloud-server</layer>
                       <layer>elytron-oidc-client</layer>
                   </layers>
                   <galleon-options>
                           <jboss-fork-embedded>true</jboss-fork-embedded>
                   </galleon-options>
               </configuration>
               <executions>
                   <execution>
                       <goals>
                           <goal>package</goal>
                       </goals>
                   </execution>
               </executions>
           </plugin>
       </plugins>
   </build>
   </project>

   Copy to Clipboard Toggle word wrap
   Note
   • <version.eap.plugin>2.0.0.Final-redhat-00009</version.eap.plugin> is an example version of JBoss EAP Maven plugin. See the Red Hat Maven repository for more information on JBoss EAP Maven plugin releases: https://maven.repository.redhat.com/earlyaccess/all/org/jboss/eap/plugins/eap-maven-plugin/.

4. Create a directory to store the Java files.

   Syntax

   $ mkdir -p src/main/java/<path_based_on_artifactID>

   Copy to Clipboard Toggle word wrap

   Example

   $ mkdir -p src/main/java/com/example/app

   Copy to Clipboard Toggle word wrap

5. Navigate to the new directory.

   Syntax

   $ cd src/main/java/<path_based_on_artifactID>

   Copy to Clipboard Toggle word wrap

   Example

   $ cd src/main/java/com/example/app

   Copy to Clipboard Toggle word wrap

6. Create a file SecuredServlet.java with the following content:

   package com.example.app;
   
   import java.io.IOException;
   import java.io.PrintWriter;
   import java.security.Principal;
   import java.util.ArrayList;
   import java.util.Collection;
   import java.util.Iterator;
   import java.util.List;
   import java.util.Set;
   
   import jakarta.servlet.ServletException;
   import jakarta.servlet.annotation.WebServlet;
   import jakarta.servlet.http.HttpServlet;
   import jakarta.servlet.http.HttpServletRequest;
   import jakarta.servlet.http.HttpServletResponse;
   import org.wildfly.security.auth.server.SecurityDomain;
   import org.wildfly.security.auth.server.SecurityIdentity;
   import org.wildfly.security.authz.Attributes;
   import org.wildfly.security.authz.Attributes.Entry;
   /**
    * A simple secured HTTP servlet. It returns the user name and
    * attributes obtained from the logged-in user's Principal. If
    * there is no logged-in user, it returns the text
    * "NO AUTHENTICATED USER".
    */
   
   @WebServlet("/secured")
   public class SecuredServlet extends HttpServlet {
   
       @Override
       protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
           try (PrintWriter writer = resp.getWriter()) {
   
           	Principal user = req.getUserPrincipal();
           	SecurityIdentity identity = SecurityDomain.getCurrent().getCurrentSecurityIdentity();
           	Attributes identityAttributes = identity.getAttributes();
           	Set <String> keys = identityAttributes.keySet();
           	String attributes = "<ul>";
   
           	for (String attr : keys) {
           		attributes += "<li> " +  attr + " : " + identityAttributes.get(attr).toString() + "</li>";
           	}
   
           	attributes+="</ul>";
           	writer.println("<html>");
           	writer.println("  <head><title>Secured Servlet</title></head>");
           	writer.println("  <body>");
           	writer.println("    <h1>Secured Servlet</h1>");
           	writer.println("    <p>");
           	writer.print(" Current Principal '");
           	writer.print(user != null ? user.getName() : "NO AUTHENTICATED USER");
           	writer.print("'");
           	writer.print(user != null ? "\n" + attributes : "");
           	writer.println("    </p>");
           	writer.println("  </body>");
           	writer.println("</html>");
           }
       }
   
   }

   Copy to Clipboard Toggle word wrap

7. Configure the application’s web.xml to protect the application resources.

   Example

   <?xml version="1.0" encoding="UTF-8"?>
   
   <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
       metadata-complete="false">
   
       <security-constraint>
           <web-resource-collection>
               <web-resource-name>secured</web-resource-name>
               <url-pattern>/secured</url-pattern>
           </web-resource-collection>
   
           <auth-constraint>
               <role-name>Users</role-name>
           </auth-constraint>
       </security-constraint>
   
       <login-config>
           <auth-method>OIDC</auth-method>
       </login-config>
   
       <security-role>
           <role-name>*</role-name>
       </security-role>
   </web-app>

   Copy to Clipboard Toggle word wrap

   In this example, only the users with the role Users can access the application.

Procedure

1. Deploy your application code to Git Repository.

2. Create a secret containing the OIDC configuration.

   1. Create a file named oidc-secret.yaml using the following content:

      apiVersion: v1
      kind: Secret
      metadata:
        name: oidc-secret
      type: Opaque
      stringData:
        OIDC_PROVIDER_NAME: rh-sso
        OIDC_USER_NAME: demo
        OIDC_USER_PASSWORD: demo
        OIDC_SECURE_DEPLOYMENT_SECRET: mysecret

      Copy to Clipboard Toggle word wrap

   2. Use the following command to create a secret:

      $ oc apply -f oidc-secret.yaml

      Copy to Clipboard Toggle word wrap

3. Create a file named helm.yaml using the following content:

   build:
     uri: [URL TO YOUR GIT REPOSITORY]
   deploy:
     envFrom:
   	- secretRef:
       	  name: oidc-secret

   Copy to Clipboard Toggle word wrap

4. Deploy the example application using JBoss EAP Helm charts:

   $ helm install eap-oidc-test-app -f helm.yaml jboss-eap/eap8

   Copy to Clipboard Toggle word wrap

5. Add the environment variables to the oidc-secret.yaml file to configure the OIDC provider URL and application hostname.

   yaml
   stringData:
     ...
     OIDC_HOSTNAME_HTTPS: <host of the application>
     OIDC_PROVIDER_URL: https://<host of the SSO provider>/realms/JBossEAP

   Copy to Clipboard Toggle word wrap

   The value for OIDC_HOSTNAME_HTTPS corresponds to the following output:

   echo $(oc get route eap-oidc-test-app --template='{{ .spec.host }}')

   Copy to Clipboard Toggle word wrap

   The value for OIDC_PROVIDER_URL corresponds to the following output:

   echo https://$(oc get route sso --template='{{ .spec.host }}')/realms/JBossEAP

   Copy to Clipboard Toggle word wrap

   A route discovery attempt is made if OIDC_HOSTNAME_HTTP(S) is not set. To enable route discovery, the OpenShift user must be able to list the route resources. For example, to create and associate the routeview role with the view user, use the following oc command:

   $ oc create role <role-name> --verb=list --resource=route
   
   $ oc adm policy add-role-to-user <role-name> <user-name> --role-namespace=<your namespace>

   Copy to Clipboard Toggle word wrap
6. Update the secret with oc apply -f oidc-secret.yaml.

7. Deploy the application again to ensure OpenShift uses the new environment variables:

   $ oc rollout restart deploy eap-oidc-test-app

   Copy to Clipboard Toggle word wrap

Verification

1. In your browser, navigate to https://<eap-oidc-test-app route>/.

   You will be redirected to Red Hat build of Keycloak login page.

2. Access the secured servlet.

3. Log in with the following credentials:

   username: demo
   password: demo

   Copy to Clipboard Toggle word wrap

   A page appears that contains the Principal ID.

Procedure

1. Create a Single Sign-On realm, users, and roles.

2. Generate the key and certificate by using the Java keytool command:

   keytool -genkeypair -alias saml-app -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore keystore.p12 -storepass password -dname "CN=saml-basic-auth,OU=EAP SAML Client,O=Red Hat EAP QE,L=MB,S=Milan,C=IT" -ext ku:c=dig,keyEncipherment -validity 365

   Copy to Clipboard Toggle word wrap

3. Import the keystore into a Java KeyStore (JKS) format:

   keytool -importkeystore -deststorepass password -destkeystore keystore.jks -srckeystore keystore.p12 -srcstoretype PKCS12 -srcstorepass password

   Copy to Clipboard Toggle word wrap

4. Create a secret in OpenShift for the keystore:

   $ oc create secret generic saml-app-secret --from-file=keystore.jks=./keystore.jks --type=opaque

   Copy to Clipboard Toggle word wrap
   Note

   These steps are only necessary when using the automatic SAML client registration feature. When JBoss EAP registers a new SAML client into Red Hat build of Keycloak as the client-admin user, JBoss EAP must store the certificate of the new SAML client in the Red Hat build of Keycloak client configuration. This allows JBoss EAP to retain the private key while only storing the public certificate in Red Hat build of Keycloak, which establishes an authenticated client for communication with Red Hat build of Keycloak.

Procedure

1. Set up a Maven project by using the mvn command. This command creates both the directory structure for the project and the pom.xml configuration file.

   Syntax

   $ mvn archetype:generate \
   -DgroupId=${group-to-which-your-application-belongs} \
   -DartifactId=${name-of-your-application} \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

   Copy to Clipboard Toggle word wrap

   Example

   $ mvn archetype:generate \
   -DgroupId=com.example.app \
   -DartifactId=simple-webapp-example \
   -DarchetypeGroupId=org.apache.maven.archetypes \
   -DarchetypeArtifactId=maven-archetype-webapp \
   -DinteractiveMode=false

   Copy to Clipboard Toggle word wrap

2. Navigate to the application root directory:

   Syntax

   $ cd <name-of-your-application>

   Copy to Clipboard Toggle word wrap

   Example

   $ cd simple-webapp-example

   Copy to Clipboard Toggle word wrap

3. Replace the content of the generated pom.xml file with the following text:

   <?xml version="1.0" encoding="UTF-8"?>
   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
   
     <groupId>com.example.app</groupId>
     <artifactId>simple-webapp-example</artifactId>
     <version>1.0-SNAPSHOT</version>
     <packaging>war</packaging>
   
     <name>simple-webapp-example Maven Webapp</name>
     <!-- FIXME change it to the project's website -->
     <url>http://www.example.com</url>
   
     <properties>
       <maven.compiler.source>11</maven.compiler.source>
       <maven.compiler.target>11</maven.compiler.target>
       <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
       <version.maven.war.plugin>3.4.0</version.maven.war.plugin>
       <version.eap.plugin>2.0.0.Final-redhat-00009</version.eap.plugin>
       <version.server>8.1.0.GA-redhat-00013</version.server>
       <version.bom.ee>${version.server}</version.bom.ee>
     </properties>
   
     <repositories>
       <repository>
           <id>jboss</id>
           <url>https://maven.repository.redhat.com/ga/</url>
           <snapshots>
               <enabled>false</enabled>
           </snapshots>
       </repository>
     </repositories>
   
     <pluginRepositories>
       <pluginRepository>
           <id>jboss</id>
           <url>https://maven.repository.redhat.com/ga/</url>
           <snapshots>
               <enabled>false</enabled>
           </snapshots>
       </pluginRepository>
     </pluginRepositories>
   
     <dependencyManagement>
       <dependencies>
         <dependency>
           <groupId>org.jboss.bom</groupId>
           <artifactId>jboss-eap-ee-with-tools</artifactId>
           <version>${version.bom.ee}</version>
           <type>pom</type>
           <scope>import</scope>
         </dependency>
       </dependencies>
     </dependencyManagement>
   
     <dependencies>
       <dependency>
         <groupId>jakarta.servlet</groupId>
         <artifactId>jakarta.servlet-api</artifactId>
         <scope>provided</scope>
       </dependency>
       <dependency>
         <groupId>org.wildfly.security</groupId>
         <artifactId>wildfly-elytron-auth-server</artifactId>
       </dependency>
     </dependencies>
   
     <build>
       <finalName>${project.artifactId}</finalName>
       <plugins>
           <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-war-plugin</artifactId>
               <version>${version.maven.war.plugin}</version>
           </plugin>
           <plugin>
               <groupId>org.jboss.eap.plugins</groupId>
               <artifactId>eap-maven-plugin</artifactId>
               <version>${version.eap.plugin}</version>
               <configuration>
                   <channels>
                       <channel>
                           <manifest>
                               <groupId>org.jboss.eap.channels</groupId>
                               <artifactId>eap-8.1</artifactId>
                           </manifest>
                       </channel>
                   </channels>
                   <feature-packs>
                       <feature-pack>
                           <location>org.jboss.eap:wildfly-ee-galleon-pack</location>
                       </feature-pack>
                       <feature-pack>
                           <location>org.jboss.eap.cloud:eap-cloud-galleon-pack</location>
                       </feature-pack>
                       <feature-pack>
                           <location>org.keycloak:keycloak-saml-adapter-galleon-pack</location>
                       </feature-pack>
                   </feature-packs>
                   <layers>
                       <layer>cloud-server</layer>
                       <layer>keycloak-saml</layer>
                   </layers>
                   <galleon-options>
                       <jboss-fork-embedded>true</jboss-fork-embedded>
                   </galleon-options>
               </configuration>
               <executions>
                   <execution>
                       <goals>
                           <goal>package</goal>
                       </goals>
                   </execution>
               </executions>
           </plugin>
       </plugins>
     </build>
   </project>

   Copy to Clipboard Toggle word wrap
   Note
   • <version.eap.plugin>2.0.0.Final-redhat-00009</version.eap.plugin> is an example version of JBoss EAP Maven plugin. See the Red Hat Maven repository for more information on JBoss EAP Maven plugin releases: https://maven.repository.redhat.com/earlyaccess/all/org/jboss/eap/plugins/eap-maven-plugin/.

4. Create a directory to store the Java files.

   Syntax

   $ mkdir -p src/main/java/<path_based_on_artifactID>

   Copy to Clipboard Toggle word wrap

   Example

   $ mkdir -p src/main/java/com/example/app

   Copy to Clipboard Toggle word wrap

5. Navigate to the new directory.

   Syntax

   $ cd src/main/java/<path_based_on_artifactID>

   Copy to Clipboard Toggle word wrap

   Example

   $ cd src/main/java/com/example/app

   Copy to Clipboard Toggle word wrap

6. Create a file named SecuredServlet.java that contains the following settings:

   package com.example.app;
   
   import java.io.IOException;
   import java.io.PrintWriter;
   import java.security.Principal;
   import java.util.Set;
   
   import jakarta.servlet.ServletException;
   import jakarta.servlet.annotation.WebServlet;
   import jakarta.servlet.http.HttpServlet;
   import jakarta.servlet.http.HttpServletRequest;
   import jakarta.servlet.http.HttpServletResponse;
   import org.wildfly.security.auth.server.SecurityDomain;
   import org.wildfly.security.auth.server.SecurityIdentity;
   import org.wildfly.security.authz.Attributes;
   /**
    * A simple secured HTTP servlet. It returns the user name and
    * attributes obtained from the logged-in user's Principal. If
    * there is no logged-in user, it returns the text
    * "NO AUTHENTICATED USER".
    */
   
   @WebServlet("/secured")
   public class SecuredServlet extends HttpServlet {
   
       @Override
       protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
           try (PrintWriter writer = resp.getWriter()) {
   
           	Principal user = req.getUserPrincipal();
           	SecurityIdentity identity = SecurityDomain.getCurrent().getCurrentSecurityIdentity();
           	Attributes identityAttributes = identity.getAttributes();
           	Set <String> keys = identityAttributes.keySet();
           	String attributes = "<ul>";
   
           	for (String attr : keys) {
           		attributes += "<li> " +  attr + " : " + identityAttributes.get(attr).toString() + "</li>";
           	}
   
           	attributes+="</ul>";
           	writer.println("<html>");
           	writer.println("  <head><title>Secured Servlet</title></head>");
           	writer.println("  <body>");
           	writer.println("    <h1>Secured Servlet</h1>");
           	writer.println("    <p>");
           	writer.print(" Current Principal '");
           	writer.print(user != null ? user.getName() : "NO AUTHENTICATED USER");
           	writer.print("'");
           	writer.print(user != null ? "\n" + attributes : "");
           	writer.println("    </p>");
           	writer.println("  </body>");
           	writer.println("</html>");
           }
       }
   
   }

   Copy to Clipboard Toggle word wrap

7. Create the directory structure for the web.xml file:

   mkdir -p src/main/webapp/WEB-INF
   cd src/main/webapp/WEB-INF

   Copy to Clipboard Toggle word wrap

8. Configure the application’s web.xml file to protect the application resources.

   Example

   <?xml version="1.0" encoding="UTF-8"?>
   <web-app version="2.5" xmlns="http://java.sun.com/xml/ns/javaee"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
       metadata-complete="false">
   
       <security-constraint>
           <web-resource-collection>
               <web-resource-name>secured</web-resource-name>
               <url-pattern>/secured</url-pattern>
           </web-resource-collection>
   
           <auth-constraint>
               <role-name>user</role-name>
           </auth-constraint>
       </security-constraint>
   
       <login-config>
           <auth-method>KEYCLOAK-SAML</auth-method>
       </login-config>
   
       <security-role>
           <role-name>user</role-name>
       </security-role>
   </web-app>

   Copy to Clipboard Toggle word wrap

   In this example, only users with the user role can access the application.

1. Create a Git repository such as https://github.com/your-username/simple-webapp-example. For more information about remote repositories and Git, see Getting started with Git - About remote repositories.

2. From the root folder of the application, run the following Git commands:

   git init -b main
   git add pom.xml src
   git commit -m "First commit"
   git remote add origin git@github.com:your-username/simple-webapp-example.git
   git remote -v
   git push -u origin main

   Copy to Clipboard Toggle word wrap

Procedure

1. Deploy your application code to the Git Repository.

2. Create an OpenShift secret containing the required environment variables:

   apiVersion: v1
   kind: Secret
   metadata:
     name: saml-secret
   type: Opaque
   stringData:
     SSO_REALM: "saml-basic-auth"
     SSO_USERNAME: "client-admin"
     SSO_PASSWORD: "client-admin"
     SSO_SAML_CERTIFICATE_NAME: "saml-app"
     SSO_SAML_KEYSTORE: "keystore.jks"
     SSO_SAML_KEYSTORE_PASSWORD: "password"
     SSO_SAML_KEYSTORE_DIR: "/etc/sso-saml-secret-volume"
     SSO_SAML_LOGOUT_PAGE: "/simple-webapp-example"
     SSO_DISABLE_SSL_CERTIFICATE_VALIDATION: "true"

   Copy to Clipboard Toggle word wrap
3. Save the provided YAML content to a file, such as saml-secret.yaml.

4. Apply the saved YAML file by using the following command:

   oc apply -f saml-secret.yaml

   Copy to Clipboard Toggle word wrap

5. Create a file named helm.yaml that contains the following settings:

   build:
     uri: [WEB ADDRESS TO YOUR GIT REPOSITORY]
   deploy:
     volumes:
       - name: saml-keystore-volume
         secret:
           secretName: saml-app-secret
     volumeMounts:
       - name: saml-keystore-volume
         mountPath: /etc/sso-saml-secret-volume
         readOnly: true
     envFrom:
       - secretRef:
           name: saml-secret

   Copy to Clipboard Toggle word wrap
   Note

   Specify the web address in the HTTP format, such as http://www.redhat.com. If you are using a maven mirror, specify the web address as follows:

   build:
     uri: [WEB ADDRESS TO YOUR GIT REPOSITORY]
     env:
       - name: "MAVEN_MIRROR_URL"
         value: "http://..."

   Copy to Clipboard Toggle word wrap

6. Deploy the example application by using JBoss EAP Helm charts:

   $ helm install saml-app -f helm.yaml jboss-eap/eap8

   Copy to Clipboard Toggle word wrap

7. Add the environment variables to the saml-secret.yaml file to configure the Keycloak server URL and application route:

   stringData:
     ...
     HOSTNAME_HTTPS: <saml-app application route>
     SSO_URL: https://<host of the Keycloak server>

   Copy to Clipboard Toggle word wrap

   Replace <saml-app application route> and <host of the Keycloak server> with the appropriate values.

   The value for HOSTNAME_HTTPS corresponds to the following output:

   echo $(oc get route saml-app --template='{{ .spec.host }}')

   Copy to Clipboard Toggle word wrap

   The value for SSO_URL corresponds to the following output:

   echo https://$(oc get route sso --template='{{ .spec.host }}')

   Copy to Clipboard Toggle word wrap
   Note

   If you cannot use this command, use oc get routes to list the available routes and select the route to your Red Hat build of Keycloak instance.

8. Update the secret with oc apply -f saml-secret.yaml.

Verification

1. Deploy the application again to ensure that OpenShift uses the new environment variables:

   $ oc rollout restart deploy saml-app

   Copy to Clipboard Toggle word wrap

2. In a browser, navigate to the application URL. For example, https://<saml-app route>/simple-webapp-example.

   You are redirected to the Red Hat build of Keycloak login page.

3. To get the web address, use the following command to access the secured servlet:

   echo https://$(oc get route saml-app --template='{{ .spec.host }}')/simple-webapp-example/secured

   Copy to Clipboard Toggle word wrap

4. Log in with the following credentials:

   username: demo
   password: demo

   Copy to Clipboard Toggle word wrap

   A page is displayed that contains the Principal ID.

Procedure

1. Log in to the Red Hat build of Keycloak admin console using the URL: https://<SSO route>/.

2. Create a realm in Red Hat build of Keycloak; for example, saml-basic-auth. You can subsequently use this realm to create the required users, roles, and a client.

   For more information, see Creating a realm.

3. Create a role within the saml-basic-auth realm. For example, user.

   For more information, see Creating a realm role.

4. Create a user. For example, demo.

   For more information, see Creating users.

5. Create a password for the user. For example, demo.

   Ensure that the password is not temporary. For more information, see Setting a password for a user.

6. Assign the user role to the demo user for login access.

   For more information, see Assigning role mappings.

7. Create a user. For example, client-admin.

   To create the SAML client in the Keycloak server when the JBoss EAP server starts, you can use the client-admin user, which requires additional privileges. For more information, see Creating users.

8. Create a password for the user. For example, client-admin.

   Ensure that the password is not temporary. For more information, see Setting a password for a user.

9. Select realm-management from the Client Roles drop down list.

10. Assign the roles create-client, manage-clients, and manage-realm to the client-admin user.

    For more information, see Assigning role mappings.