Running flow services by using mTLS authentication

Overview of the basic steps to run flow services with mTLS enabled.

Before you begin

You must have permissions for your role to create and run a flow service in the project.

Procedure

  1. Create a flow service.
  2. On the flow service card, click the ellipsis icon, select Overview, and on the Overview page, select the Enable Flow service to be invoked over HTTP option.
  3. Go to Settings > Client Certificate > Configuration. Select Force as the security mode and click Apply.
  4. Go to the Client Certificate > User Certificate page. In the Select User field, select the user. In the Select Certificate field, select Generate Private Key and Certificate. Click Generate and select the format to generate the certificate. The generated certificate is named as username.fileformat.
  5. Open any REST client and configure the certificate that is generated from the tenant.
  6. Go to webMethods Integration. For the flow service, select Overview > Advanced details. Copy the synchronous URL and specify it in the Host field (<Yourdomain>.ibm.com/integration/rest/external/integration/run/development/<project_id>/<service_name>.).
  7. Select the generated certificate and provide the certificate passphrase. The default passphrase is changeit. Click Add.
  8. From the Overview > Advanced details page in webMethods Integration, note the request details (Sample JSON input and the mandatory Content-Type parameter).
  9. In the REST Client, specify the request URL, add the port as 443, and select the Authorization type as No Auth. If you select the Authorization type as Basic Auth, you need to also provide the username and password.
  10. On the Headers page of the REST Client, add the required headers noted from the Advanced details section of the flow service.
    For example, specify Content-Type as the Key and application/json as the Value
    .
  11. On the Body page of the REST Client, add the body for the flow service noted from the Advanced details section.
    For example, specify the sample JSON input.
  12. Run the flow service endpoint.
    Note:
    • For mTLS security mode to work with a tenant certificate, the tenant credentials and tenant certificate are mandatory.
    • The mTLS Security mode determines how the service authenticates requests. When you set the security mode to Exclusive, the service requires a valid OAuth 2.0 token and a valid tenant certificate

      When you set the security mode to Default or Force, the service requires only a valid OAuth 2.0 token. It does not require a tenant certificate in these modes.

      Make sure that you configure your tenant certificate correctly when you use the Exclusive mode. This helps prevent authentication failures.