Make a note of the LDAP server configuration.

1. In the WebSphere Application Server administration console, navigate to Security > Global security > Single sign-on, enter a Domain Name, and check the following settings:
   • Enabled
   • Requires SSL (with Domain name)
   • Web inbound security attribute propagation
   • Set security cookies HTTPOnly to help prevent cross-site scripting attacks
   
2. Export LTPA keys
   1. In the WebSphere Application Server administration console, navigate to Security > Global security > LTPA.
   2. Provide a password for the ltpa.keys file.
   3. Provide a path for the LTPA file, for example, /opt/IBM/WebSphere/AppServer/profiles/Appsrv01/ltpa.keys.
   4. Click Export
3. Make note of the Realm value in the ltpa.keys file:

   The ltpa.keys file is a text file; open it and verify the value of the Realm property: com.ibm.websphere.ltpa.Realm=ldap_realm.

   This realm should match the Realm name under Security > Global security > Federated Repositories.

   This realm must match the realm in the LDAP configuration of your GraphQL Liberty server.

   

4. Configure the LDAP setup in your GraphQL WebSphere Liberty server with similar settings as the LDAP configuration in the WebSphere Application Server instance for Content Platform Engine.

Configuring Content Services GraphQL Liberty Container

You can use the instructions in the IBM FileNet Content Manager Download Document to download the container image from Passport Advantage:
IBM FileNet Content Services GraphQL API V5.5.5 Linux x86 Container Multilingual (CC6UAML )

The image file is called IBM_FILENET_CSG_API_V5.5.5.tgz.

You can use a command like the following example to load the container image into your Docker registry:

%  tar xzvf IBM_FILENET_CSG_API_V5.5.5.tgz 
% docker load -i images/graphql_ga-555-p8cgql.tar.gz

Get the repository identifier and tag of the GraphQL container using the following command and use them in your run script when starting the GraphQL container:

% docker images | grep graphql
graphql         ga-555-p8cgql        fca79e90f205        4 months ago        876MB 

Note that all configuration for Content Services GraphQL is performed by creating files in the configDropins/overrides directory that is mounted to a directory on the host machine.

Use a run script similar to the following to start the GraphQL container.  This sample script mounts the logs and configDropins/overrides directory to the Docker host.

    docker run -d -p 8182:9080 -p 8545:9443 \  -e LICENSE=accept -u 50001 --hostname cs-graphql \  --restart=always \   -v /root/docker_data/graphql/logs:/opt/ibm/wlp/usr/servers/defaultServer/logs \  -v /root/docker_data/graphql/configDropins/overrides:/opt/ibm/wlp/usr/servers/defaultServer/configDropins/overrides \  --name graphql \  graphql:ga-555-p8cgql    

jvm.options

Start the container using the run script from the previous section, and copy the jvm.options from inside the container to the overrides directory, for example:

    docker cp graphql:/opt/ibm/wlp/usr/servers/defaultServer/jvm.options /root/docker_data/graphql/configDropins/overrides/jvm.options    

Add this JVM option to ensure that LTPA is used between GraphQL and Content Platform Engine servers:

  -Dcom.filenet.authentication.wsi.AuthTokenOrder=ltpa,oauth,oidc    

Update the CPE URI JVM option to point to your on-prem Content Platform Engine server running on WebSphere Application Server:

  -Decm.content.remote.cpeuri=http://cpe-host:9080/wsi/FNCEWS40MTOM    

Note: If you use an https URL to the Content Platform Engine server, make sure you import the Content Platform Engine server's SSL certificate into the Liberty truststore.

When done, your jvm.options should look similar to the following example:

    -Dcom.filenet.gcd.LicenseModel=FNCM.CU  -Dcom.filenet.AppServerType=liberty  -Dcom.filenet.authentication.wsi.AutoDetectAuthToken=true  -Dcom.filenet.authentication.wsi.AuthTokenOrder=ltpa,oauth,oidc  -Dhttps.protocols=TLSv1.2  -Decm.content.remote.cpeuri=http://cpe-host:9080/wsi/FNCEWS40MTOM  #-DtestUsername=admin  #-DtestPassword=password  -Dcom.ibm.ws.http.options.readTimeout=180  -Dcom.ibm.ws.http.options.writeTimeout=180  -XshowSettings:vm  -XX:InitialRAMPercentage=40  -XX:MaxRAMPercentage=66  -Dcom.ibm.ecm.content.graphql.enable.graphiql=FALSE  -DContainerType=1  -Dcom.ibm.jsse2.usefipsprovider=true  -Dcom.ibm.jsse2.sp800-131=transition  # other containers will add entries on the next line    

ltpa.keys

Copy the ltpa.keys files that you exported from the WebSphere Application Server instance for Content Platform Engine to the configDropins/overrides directory of your GraphQL server.

Create a ltpa.xml file that points to this ltpa.keys file and set the password to match the password used when you exported this file from the WebSphere Application Server instance for Content Platform Engine.

The following is a sample ltpa.xml file:

<server>

   <ltpa keysFileName="/opt/ibm/wlp/usr/servers/defaultServer/configDropins/overrides/ltpa.keys" keysPassword="XXXX"expiration="120" />

</server>

ldap.xml

Create an ldap.xml file in the configDropins/overrides directory to connect to the same LDAP server used by the WebSphere Application Server instance for Content Platform Engine.

Make sure you set the realm attribute of the ldap configuration to match the realm in the ltpa.keys file.