Federating IBM Business Automation Workflow running on-premise with IBM Process Federation Server containers running on OpenShift with Platform UI service enabled

*=info:com.ibm.ws.security.oidc.*=all:com.ibm.ws.security.openidconnect.*=all:com.ibm.ws.security.openid20.*=all:com.ibm.ws.security.web.*=all

Step 3: Provide self-signed certificates of the on-premise topology so the Process Federation Server truststore can include them

If the on-premise IBM Business Automation Workflow system and/or its database exposes self-signed certificates, add these certificates to the Process Federation Server truststore. For each of these certificates, create a secret resource with an entry named tls.crt, which contains the public key of the certificate in PEM format.

Once all the self-signed certificates are packaged into secrets, declare them under the pfs_configuration.tls.tls_trust_list CR value.

Step 4: Provide the Process Federation Server config-dropin, which declares the on-premise IBM Business Automation Workflow system to federate

Once the on-premise IBM Business Automation Workflow system is properly configured to perform indexing and to use Portal UI JSON Web Tokens for user authentication, provide the proper XML config-dropin to Process Federation Server.

In the CR values that are used to install IBM Cloud Pak for Business Automation, reference a secret that contains XML configuration dropins as the pfs_configuration.config_dropins_overrides_secret CR value. The entries from this secret are mapped as files in the /config/configDropins/overrides directory of each pod that runs the Process Federation Server.

To federate the on-premise IBM Business Automation Workflow system, create a new entry in this secret. This entry contains the following configuration elements:

• The declaration of the <ibmPfs_federatedSystem> element, with attribute authenticationMechanism set to the value "PFS_ACCESS_TOKEN"
• The datasource of the on-premise IBM Business Automation Workflow system (<datasource> element)
• he <ibmPfs_bpdIndexer> element
• The <ibmPfs_bpdRetriever> element

For more information on the configuration elements, see Configuration properties for federated systems.

Important:

• If the on-premise IBM Business Automation Workflow system uses an IBM® Db2 database, reference the "DB2JCC4Lib" pre-defined library when you declare the jdbcDriver used by your datasource as follows: 

  <jdbcDriver libraryRef="DB2JCC4Lib"/>

• If the on-premise IBM Business Automation Workflow system uses an Oracle database and Process Federation Server already federates an IBM Business Automation Workflow Container that also uses an Oracle database, reference the "OracleLib" pre-defined library when you declare the jdbcDriver used by your datasource as follows:

  <jdbcDriver libraryRef="OracleLib"/>

  In this case, the Oracle drivers are already mounted in the Process Federation Server Container by the IBM Cloud Pak for Business Automation operator.
• In the other cases where the on-premise IBM Business Automation Workflow system uses an Oracle or Microsoft SQL Server database:
  • Package the corresponding JDBC drivers in a persistent volume (PV)
  • Create a persistent volume claim, which binds this PV and references it in the pfs_configuration.custom_libs_pvc CR value.
    Note: Instead of creating a new PVC, you can also reuse the IBM Cloud Pak for Business Automation operator shared PVC if it already contains the libraries that you need. The PVC is mounted in the /config/resources/libs directory on each pod that runs Process Federation Server. You can then use a <library> configuration element in the configuration dropins that you create, and reference this library when you declare the IBM Business Automation Workflow datasource.

<server>
  <ibmPfs_federatedSystem
    authenticationMechanism="PFS_ACCESS_TOKEN"
    indexProcessInstances="true"
    allowedOrigins="*"
    displayName="GAITS1"
    id="gaits1"
    index.number_of_replicas="1"
    index.number_of_shards="3"
    indexName="gaits1-bpd"
    launchListPriority="1"
    portalSupportUrlPrefix="https://gaits1.fyre.ibm.com:9443/portal"
    restUrlPrefix="https://gaits1.fyre.ibm.com:9443/rest/bpm/wle"
    taskCompletionUrlPrefix="https://gaits1.fyre.ibm.com:9443/teamworks"/>

  <dataSource commitOrRollbackOnCleanup="commit" id="gaits1_bpd_db2" isolationLevel="TRANSACTION_READ_COMMITTED" jndiName="jdbc/gaits1bpd" type="javax.sql.DataSource">
    <jdbcDriver libraryRef="DB2JCC4Lib"/>
    <properties.db2.jcc databaseName="BPMDB" password="xxxxxx" portNumber="50000" serverName="gaits1.fyre.ibm.com" user="db2admin"/>
  </dataSource>
 
  <ibmPfs_bpdIndexer 
    dataSourceRef="gaits1_bpd_db2" 
    federatedSystemRef="gaits1" 
    schemaName="DB2ADMIN" />

  <ibmPfs_bpdRetriever
    connectTimeout="10s"
    federatedSystemRef="gaits1"
    internalRestUrlPrefix="https://gaits1.fyre.ibm.com:9443/rest/bpm/wle"
    readTimeout="10s"/>

  <ibmPfs_restConfig systemStatusCheckInterval="1s"/>
</server>