6.2. Token-based authentication
If you want a more secure option of authentication, you can consume the remote services from both Business Central and Decision Server by using a granted token provided by RH-SSO.
Procedure
In the RH-SSO Admin Console, click the Clients menu item and click Create to create a new client.
The Add Client page opens.
On the Add Client page, provide the required information to create a new client for your realm. For example:
- Client ID: kie-remote
- Client protocol: openid-connect
- Click Save to save your changes.
Change the token settings in Realm Settings:
- In the RH-SSO Admin Console, click the Realm Settings menu item.
- Click the Tokens tab.
Change the value for Access Token Lifespan to
15
minutes.This gives you enough time to get a token and invoke the service before it expires.
- Click Save to save your changes.
After a public client for your remote clients is created, you can now obtain the token by making an HTTP request to the RH-SSO server’s token endpoint using:
RESULT=`curl --data "grant_type=password&client_id=kie-remote&username=admin&password=password" http://localhost:8180/auth/realms/demo/protocol/openid-connect/token`
The user in this command is a Business Central RH-SSO user. For more information, see 3章Adding Red Hat Decision Manager users.
To view the token obtained from the RH-SSO server, use the following command:
TOKEN=`echo $RESULT | sed 's/.*access_token":"//g' | sed 's/".*//g'`
You can now use this token to authorize the remote calls. For example, if you want to check the internal Red Hat Decision Manager repositories, use the token as shown below:
curl -H "Authorization: bearer $TOKEN" http://localhost:8080/decision-central/rest/repositories