Passing parameters and registering the truststore

You set up parameters in the jvm.options file for Rule Execution Server. The parameters are used in the Rule Execution Server console. You also register the truststore to run Ant tasks.

About this task

You set parameters for Rule Execution Server in the jvm.options file.

To minimize manual configuration, a sample jvm.options file is provided in the <ODM_InstallDir>/shared/oidc directory.
Note: If you choose to use the sample jvm.options file, you must verify the content of this file and customize the configuration to suit your system.

Also, you must register the certificate (that is, setting the truststore) in Ant so that the Ant tasks for Rule Execution Server can connect to Rule Execution Server.

Procedure

  1. Add the following two parameters in the jvm.options file for your Liberty server: 
    -Dcom.ibm.odm.res.console.csrfFilter.allowedDomains=<domain1>,<domain2>
-Dilog.rules.res.AUTHORIZATION_CONFIGURATION=type=oidc,logoutUrl=https://<my_domain>:<port_number>/oidc/endpoint/ssoserver/logout
    Parameter Description
    com.ibm.odm.res.console.csrfFilter.allowedDomains

    Domains that are specified in this parameter are considered safe from the Cross-Site Request Forgery (CSRF) attacks.

    For example, requests and redirection that originate from components in these domains are accepted.
    ilog.rules.res.AUTHORIZATION_CONFIGURATION
    • type: openid
    • logoutUrl: You need to provide a custom logout URL for the Rule Execution Server console. If the logout URL is not provided or if it is empty, the user cannot log out. In some cases, the OpenID Connect Provider does not have a logout endpoint.
    • logoutTokenParam: (Optional) Certain OpenID providers require this token to be passed as a parameter to the logout request. This attribute is the name of the parameter that is added to the logout request. For Okta, the value is id_token_hint.
    • post_logout_redirect_uri: (Optional) This attribute specifies the post-logout redirect URI to the OpenID provider. It is added to the logout request to tell the provider where to redirect the user after the logout process completes.
    The equivalent parameters exist in the web.xml file. However, it is more convenient to pass these values in the jvm.options file. See the following example in the web.xml file:
    <context-param>
      <description>Third party authorization delegation configuration</description>
      <param-name>ilog.rules.res.AUTHORIZATION_CONFIGURATION</param-name>
      <param-value>type=openid,logoutUrl=https://<my_domain>:<port_number>/oidc/endpoint/ssoserver/logout</param-value>
</context-param>
<context-param>
       <description/>
       <param-name>com.ibm.odm.res.console.csrfFilter.allowedDomains</param-name>
       <param-value><my_domain></param-value>
</context-param>
  2. Run a command to set the truststore.
    For example, in Windows:
    SET ANT_OPTS=-Djavax.net.ssl.trustStore=<path>/odmtruststore.jks -Djavax.net.ssl.trustStorePassword=changeit