Skip to content

Feat/update det comp registration #197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
brosenberg42 merged 3 commits into from
Jul 10, 2025
Merged

Feat/update det comp registration #197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4ba60ec
Remove component sections from oidc guide.
brosenberg42 Mar 21, 2025
3a7b609
Fix oidc guide
brosenberg42 Mar 24, 2025
e1c84f5
Merge branch 'develop' into feat/update-det-comp-registration
brosenberg42 Jul 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 5 additions & 38 deletions docs/docs/OpenID-Connect-Guide.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,6 @@ with what role. The `OIDC_USER_CLAIM_NAME` and `OIDC_ADMIN_CLAIM_NAME` environme
specify the name of the claim that must be present. The `OIDC_USER_CLAIM_VALUE` and
`OIDC_ADMIN_CLAIM_VALUE` environment variables specify the required value of the claim.

If Workflow Manager is configured to use OIDC, then the component services must also be configured
to use OIDC. The component services will use OIDC if either the `OIDC_JWT_ISSUER_URI` or
`OIDC_ISSUER_URI` environment variables are set on the component service. When a component service
is configured to use OIDC, the `OIDC_CLIENT_ID` and `OIDC_CLIENT_SECRET` environment variables are
used to specify the client ID and secret that will be used during component registration.


### Workflow Manager Environment Variables

Expand Down Expand Up @@ -70,22 +64,6 @@ used to specify the client ID and secret that will be used during component regi
[template variables supported by Spring.](https://docs.spring.io/spring-security/reference/servlet/oauth2/client/authorization-grants.html#oauth2Client-auth-code-redirect-uri)


### Component Environment Variables

- `OIDC_JWT_ISSUER_URI` or `OIDC_ISSUER_URI` (Required): URI for the OIDC provider that will be used
to authenticate REST clients. The OIDC configuration endpoint must exist at the value of this
environment variable with `/.well-known/openid-configuration` appended. If both environment
variables are provided, `OIDC_JWT_ISSUER_URI` will be used. If `OIDC_JWT_ISSUER_URI` is set on
Workflow Manager, it should be set to the same value on the component services. If
`OIDC_JWT_ISSUER_URI` is not set on Workflow Manager, `OIDC_ISSUER_URI` should be set to the
same value on Workflow Manager and the component services. When either environment variable is
set, the `WFM_USER` and `WFM_PASSWORD` environment variables are ignored.
- `OIDC_CLIENT_ID` (Required): The client ID that the component service will use when registering
the component with Workflow Manager.
- `OIDC_CLIENT_SECRET` (Required): The client secret that the component service will use when
registering the component with Workflow Manager.


## Example with Keycloak

The following example explains how to test Workflow Manager with Keycloak as the OIDC provider.
Expand All @@ -110,9 +88,8 @@ docker run -p 9090:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin
4\. Create a new realm:

- Create a new realm using the drop down box in upper left that says "master".
- Use the realm name you entered and the gateway IP address from step 1 to set Workflow
Manager and the component services' `OIDC_ISSUER_URI` environment variable to:
`http://<docker-gateway-ip>:9090/realms/<realm-name>`
- Use the realm name you entered and the gateway IP address from step 1 to set Workflow Manager's
`OIDC_ISSUER_URI` environment variable to: `http://<docker-gateway-ip>:9090/realms/<realm-name>`

5\. Create the client that Workflow Manager will use to authenticate users:

Expand Down Expand Up @@ -158,30 +135,20 @@ docker run -p 9090:8080 -e KEYCLOAK_ADMIN=admin -e KEYCLOAK_ADMIN_PASSWORD=admin
- After creating a user, set a password in the "Credentials" tab.
- Use the "Role mapping" tab to add the user to one of roles created in step 6.

10\. Add Component Registration REST client:

- Use the "Clients" menu to create a new client.
- Capability config:
- The client needs to have "Client authentication" and "Service accounts roles" enabled.
- Use the "Service account roles" tab to add the client to one of the roles created in step 6.
- Set the component services' `WFM_USER` environment variable to the client ID you entered.
- Set component services' `WFM_PASSWORD` environment variable to the "Client secret" in the
"Credentials" tab.

11\. Add external REST clients:
10\. Add external REST clients:

- Use the "Clients" menu to create a new client.
- Capability config:
- The client needs to have "Client authentication" and "Service accounts roles" enabled.
- Use the "Service account roles" tab to add the client to one of the roles created in step 6.

12\. Start Workflow Manager. When you initially navigate to Workflow Manager, you will be
11\. Start Workflow Manager. When you initially navigate to Workflow Manager, you will be
redirected to the Keycloak log in page. You can log in using the users created in step 9.



### Test REST authentication
Using the Docker gateway IP address from step 1, the client ID and secret from step 11, and the
Using the Docker gateway IP address from step 1, the client ID and secret from step 10, and the
realm name from step 4, run the following command:
```bash
curl -d grant_type=client_credentials -u '<client-id>:<client-secret>' 'http://<docker-gateway-ip>:9090/realms/<realm-name>/protocol/openid-connect/token'
Expand Down
43 changes: 5 additions & 38 deletions docs/site/OpenID-Connect-Guide/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -276,11 +276,6 @@ <h2 id="configuration">Configuration</h2>
with what role. The <code>OIDC_USER_CLAIM_NAME</code> and <code>OIDC_ADMIN_CLAIM_NAME</code> environment variables
specify the name of the claim that must be present. The <code>OIDC_USER_CLAIM_VALUE</code> and
<code>OIDC_ADMIN_CLAIM_VALUE</code> environment variables specify the required value of the claim.</p>
<p>If Workflow Manager is configured to use OIDC, then the component services must also be configured
to use OIDC. The component services will use OIDC if either the <code>OIDC_JWT_ISSUER_URI</code> or
<code>OIDC_ISSUER_URI</code> environment variables are set on the component service. When a component service
is configured to use OIDC, the <code>OIDC_CLIENT_ID</code> and <code>OIDC_CLIENT_SECRET</code> environment variables are
used to specify the client ID and secret that will be used during component registration.</p>
<h3 id="workflow-manager-environment-variables">Workflow Manager Environment Variables</h3>
<ul>
<li><code>OIDC_ISSUER_URI</code> (Required): URI for the OIDC provider that will be used to authenticate users
Expand Down Expand Up @@ -317,21 +312,6 @@ <h3 id="workflow-manager-environment-variables">Workflow Manager Environment Var
OIDC provider is different from the OIDC provider's public host name. The value can use the
<a href="https://docs.spring.io/spring-security/reference/servlet/oauth2/client/authorization-grants.html#oauth2Client-auth-code-redirect-uri">template variables supported by Spring.</a></li>
</ul>
<h3 id="component-environment-variables">Component Environment Variables</h3>
<ul>
<li><code>OIDC_JWT_ISSUER_URI</code> or <code>OIDC_ISSUER_URI</code> (Required): URI for the OIDC provider that will be used
to authenticate REST clients. The OIDC configuration endpoint must exist at the value of this
environment variable with <code>/.well-known/openid-configuration</code> appended. If both environment
variables are provided, <code>OIDC_JWT_ISSUER_URI</code> will be used. If <code>OIDC_JWT_ISSUER_URI</code> is set on
Workflow Manager, it should be set to the same value on the component services. If
<code>OIDC_JWT_ISSUER_URI</code> is not set on Workflow Manager, <code>OIDC_ISSUER_URI</code> should be set to the
same value on Workflow Manager and the component services. When either environment variable is
set, the <code>WFM_USER</code> and <code>WFM_PASSWORD</code> environment variables are ignored.</li>
<li><code>OIDC_CLIENT_ID</code> (Required): The client ID that the component service will use when registering
the component with Workflow Manager.</li>
<li><code>OIDC_CLIENT_SECRET</code> (Required): The client secret that the component service will use when
registering the component with Workflow Manager.</li>
</ul>
<h2 id="example-with-keycloak">Example with Keycloak</h2>
<p>The following example explains how to test Workflow Manager with Keycloak as the OIDC provider.
It is just an example and should not be used in production.</p>
Expand All @@ -349,9 +329,8 @@ <h2 id="example-with-keycloak">Example with Keycloak</h2>
<p>4. Create a new realm:</p>
<ul>
<li>Create a new realm using the drop down box in upper left that says "master".</li>
<li>Use the realm name you entered and the gateway IP address from step 1 to set Workflow
Manager and the component services' <code>OIDC_ISSUER_URI</code> environment variable to:
<code>http://&lt;docker-gateway-ip&gt;:9090/realms/&lt;realm-name&gt;</code></li>
<li>Use the realm name you entered and the gateway IP address from step 1 to set Workflow Manager's
<code>OIDC_ISSUER_URI</code> environment variable to: <code>http://&lt;docker-gateway-ip&gt;:9090/realms/&lt;realm-name&gt;</code></li>
</ul>
<p>5. Create the client that Workflow Manager will use to authenticate users:</p>
<ul>
Expand Down Expand Up @@ -402,19 +381,7 @@ <h2 id="example-with-keycloak">Example with Keycloak</h2>
<li>After creating a user, set a password in the "Credentials" tab.</li>
<li>Use the "Role mapping" tab to add the user to one of roles created in step 6.</li>
</ul>
<p>10. Add Component Registration REST client:</p>
<ul>
<li>Use the "Clients" menu to create a new client.</li>
<li>Capability config:<ul>
<li>The client needs to have "Client authentication" and "Service accounts roles" enabled.</li>
<li>Use the "Service account roles" tab to add the client to one of the roles created in step 6.</li>
</ul>
</li>
<li>Set the component services' <code>WFM_USER</code> environment variable to the client ID you entered.</li>
<li>Set component services' <code>WFM_PASSWORD</code> environment variable to the "Client secret" in the
"Credentials" tab.</li>
</ul>
<p>11. Add external REST clients:</p>
<p>10. Add external REST clients:</p>
<ul>
<li>Use the "Clients" menu to create a new client.</li>
<li>Capability config:<ul>
Expand All @@ -423,10 +390,10 @@ <h2 id="example-with-keycloak">Example with Keycloak</h2>
</ul>
</li>
</ul>
<p>12. Start Workflow Manager. When you initially navigate to Workflow Manager, you will be
<p>11. Start Workflow Manager. When you initially navigate to Workflow Manager, you will be
redirected to the Keycloak log in page. You can log in using the users created in step 9.</p>
<h3 id="test-rest-authentication">Test REST authentication</h3>
<p>Using the Docker gateway IP address from step 1, the client ID and secret from step 11, and the
<p>Using the Docker gateway IP address from step 1, the client ID and secret from step 10, and the
realm name from step 4, run the following command:</p>
<pre><code class="language-bash">curl -d grant_type=client_credentials -u '&lt;client-id&gt;:&lt;client-secret&gt;' 'http://&lt;docker-gateway-ip&gt;:9090/realms/&lt;realm-name&gt;/protocol/openid-connect/token'
</code></pre>
Expand Down
2 changes: 1 addition & 1 deletion docs/site/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -408,5 +408,5 @@ <h1 id="overview">Overview</h1>

<!--
MkDocs version : 0.17.5
Build Date UTC : 2025-06-27 10:50:29
Build Date UTC : 2025-07-10 17:36:41
-->
Loading