How to use new CIB seven Webapps in a springboot project

[amardeep2006]

I have added following dependency in my springboot project but new webapps does not seem available. I can see the classic camunda webapps.

    <dependency>
      <groupId>org.cibseven.bpm.springboot</groupId>
      <artifactId>cibseven-bpm-spring-boot-starter-webapp</artifactId>
    </dependency>

I downloaded CIBSeven Tomcat version and it opens new webapps but default. Is there some extra setup required for it to work?
It tried this url and see a white screen only.
http://localhost:8080/webapp/#/seven/auth/start

I assume some extra setup is required for this to work. Please let me know if someone knows the steps/documentation.
Thanks a lot.

[amardeep2006]

I was able to enable this by reading Camunda Run source code and configurations of CIBSeven Run. Had to create a new Filter to add "org.cibseven.bpm.engine.rest.security.auth.impl.CompositeAuthenticationProvider" filter , cibseven.webclient configurations and had to create cibseven-webclient.properties .

One thing still does not feel good to me for dockerised environment . Seems like we need to create cibseven-webclient.properties/cibseven-webclient.yaml via some shell script while starting the docker container. For security reasons, it will prefer to read it via env variables. Let me try if that is possible ?
Just scratching my head on what is the use of following in application.yaml , am i missing something very obvious ?

cibseven:
  webclient:
    # Token generation
    authentication:
      jwtSecret:

[PascalLugon]

Hello,
Could you be more explicit about how you fixed the CIB7 Webapps blank screen?
BR
Pascal

[amardeep2006]

I donot have a sample code ready but will publish in a day or two.
High level steps are below:

1. Add a new http filter in your code for engine-rest . You can refer this https://github.com/cibseven/cibseven/blob/main/distro/run/core/src/main/java/org/cibseven/bpm/run/CamundaBpmRunRestConfiguration.java
2. Add the webclient related properties in you application.yml https://github.com/cibseven/cibseven/blob/384372d81c9aa93776680c87cbe3c4ac4a5fe715/distro/run/assembly/resources/default.yml#L50
   Make sure you generate a Generate a 155-character alphanumeric random string and set it as jwt secret (DONOT checkin the secret)

cibseven:
  webclient:
    authentication:
      jwtSecret: h0tzLJ65jN4gdAeBj5nx78rqKYvqqZswZlP4k2TV218JbHD8kUf6R5HpP4fHDzd2ZbO3f53COn9OmUMnr7Qwhkb3roySoSOgt0bEFhEenCrJfqX043PVRcvsk8v9K3Wprf0NwfJXuPDKAvZnT9jhVE88888

3. Create a cibseven-webclient.properties in src/main/resources folder. Make sure this property file has the same 155 character string you generated in last step. Example :
   cibseven.webclient.authentication.jwtSecret=h0tzLJ65jN4gdAeBj5nx78rqKYvqqZswZlP4k2TV218JbHD8kUf6R5HpP4fHDzd2ZbO3f53COn9OmUMnr7Qwhkb3roySoSOgt0bEFhEenCrJfqX043PVRcvsk8v9K3Wprf0NwfJXuPDKAvZnT9jhVE88888

In the real world scenarios, you may want to generate and set via some shell scripts and add cibseven-webclient.properties into class path.

I have raised issues as ideally it should all configurable via single yaml and env variable.

[PascalLugon]

Amar,
Thx for the different references and indications. I will try to integrate them in my current app.
BR
Pascal

[amardeep2006]

I did some more research and in spring boot app and here is what you need to make it work.

1. Without securing /engine-rest , you need to add following in your application.yml

cibseven:
  webclient:
    authentication:
      jwtSecret: ***********
    services:
      basePath: /webapp/services/v1

3. When you want to secure /engine-rest enfpoint as well.
   a. Add a REST security filter and create a cibseven-webclient.properties in src/main/resources and add cibseven.webclient.authentication.jwtSecret=********
   b. Add following to your application.yml

cibseven:
  webclient:
    services:
      basePath: /webapp/services/v1

I feel following must be improved in CIB Seven

1. Default basePath must be set to /webapp/services/v1
2. The composite filter must read values form application.yml for jwtSecret

I have published a hello world type example on github .

Unsecured engine-rest example : https://github.com/amardeep2006/cibseven-springboot-example/tree/feat/unsecured-engine-rest

Main Branch has engine-rest secured example : https://github.com/amardeep2006/cibseven-springboot-example

[amardeep2006]

I have raised two issues I observed in my setup .

cibseven/cibseven-webclient#223
cibseven/cibseven#93

[PascalLugon]

Well, one step further...

After reading the documentation https://docs.cibseven.org/manual/latest/user-guide/spring-boot-integration/spring-security/

• I've added the cibseven-bpm-spring-boot-starter-security to my project.
• Deleted the @EnableSecurityConfiguration in my app
• And added camunda.bpm.oauth2.identity-provider.enabled: false to my application.yml

I was able to login and to access the CIB 7 webapps.

The last point is Swagger is not correctly displayed. According to https://www.baeldung.com/java-spring-security-permit-swagger-ui, I've just needed to add the configuration class:

  @Configuration
  public class SecurityConfig {
  
      @Bean
      public WebSecurityCustomizer webSecurityCustomizer() {
          return (web) -> web.ignoring()
                  .requestMatchers("/swagger-ui/**", "/v3/api-docs*/**");
      }
  
  }

But I couldn't make my Swagger work for now...

[PascalLugon]

In fact it's working now. I was just using an old springdoc-openapi-starter-webmvc-ui. Set the dependency to the latest available.
Finally

[amardeep2006]

Will you be able to publish a small example on github . Feeling bit lazy since you have figured out sso as well. I have done it in past with camunda with my own security filters and okta https://github.com/amardeep2006/camunda-okta-oidc-sso . Did not use the official okta security starter as it makes user/group functionality read only. I wanted sso for login but ability to do crud on user/groups.

I am interested in how rest filter config and cibseven webclient configs you have .

[PascalLugon]

Oups... my mistake : in fact our integration tests were running smoothly, but the SecurityFilterChain we used was somehow deactivated. If I'm trying to reactivate it -> conflict with the CIB 7 one

[PascalLugon]

Finally I was able to implement the SecurityFilterChain to protect my controller using AzureAD with the CIB 7 security layer enabled.

I've used the security matcher in my SecurityFilterChain:

@Bean
public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
    // Deprecated apply, but pending update of the Azure Spring Boot Starter
    http.apply(AadResourceServerHttpSecurityConfigurer.aadResourceServer());

    http.csrf(AbstractHttpConfigurer::disable);

    return http
            .securityMatcher("/sample/**")
            .authorizeHttpRequests(auth -> {
                auth.anyRequest().authenticated();
            })
            .build();
}

My sample project is available at: https://github.com/PascalLugon/cibseven-springboot-entra-example