Skip to main content

Get JWT Authentication from Keycloak in BAW

Tags:
🎯context

Obtain a JWT token from Keycloak to authenticate REST API calls from IBM BAW to IBM DevOps Solution Workbench.

Description​

When consuming REST APIs provided by the Workbench from IBM Business Automation Workflow (BAW), authentication is required. This How-To describes the process of obtaining a JWT (JSON Web Token) automatically from the Identity Provider (Keycloak) in IBM DevOps Solution Workbench to authenticate your API calls from BAW.

The JWT token is obtained using client credentials flow, which allows BAW to authenticate with Keycloak directly without user interaction. This approach is suitable for server-to-server communication between BAW and IBM DevOps Solution Workbench.

Preconditions​

  • API Design: You have designed the REST API in Solution Designer
  • Implementation: You have implemented and pushed the REST API successfully
  • Deployment: The deploy pipeline for this Project has completed successfully
  • Keycloak Credentials: A client is created in your Keycloak instance with clientId and clientSecret available to you

Step-by-Step Guide​

1. Prepare Keycloak Token Configuration​

1.1. Download Template:

1.2. Adjust Configuration:

  • Open the downloaded file and adjust the following:
    • Update the host field to point to your Keycloak instance
    • Verify and adjust the paths to match your Keycloak endpoints

2. Create BAW Integration Components​

2.1. Create Toolkit:

  • Create a new toolkit in BAW for reusability across different applications

2.2. Configure Environment Variables:

  • Add the following environment variables:
    • CLIENT_ID: Your Keycloak client ID
    • CLIENT_SECRET: Your Keycloak client secret

2.3. Create External REST Service:

  • In BAW, create an external REST service by uploading the adjusted keycloak_token.json file
  • Follow the wizard with default settings

2.4. Configure SSL Settings:

  • In the created server configuration, set CellDefaultSSLSettings as the SSL setting

3. Implement Token Retrieval​

3.1. Create Service Flow:

  • Create a new service flow named getToken
  • Add jwt as an output variable

3.2. Add Authentication Script:

  • Include the following JavaScript code in your service flow:

    var request = new BPMRESTRequest();
    request.externalServiceName = "keycloak_token";
    request.operationName = "GetToken";
    request.httpHeaders = {
      "Cache-Cpontrol": "no-cache",
      "Content-Type": "application/x-www-form-urlencoded",
      Accept: "application/json"
    };
    request.parameters = {
      grant_type: "client_credentials",
      client_id: tw.env.CLIENT_ID,
      client_secret: tw.env.CLIENT_SECRET,
      scope: "openid"
    };

    var response = tw.system.invokeREST(request);
    if (response.httpStatusCode === 200) {
      var content = response.content.replace(/not-before-policy/, "not_before_policy"); // BPM data type props must not have '-' chars
      var result = JSON.parse(content);
      tw.local.jwt = result.access_token;
    } else if (response.httpStatusCode >= 400) {
      var error = JSON.parse(response.content);
      throw new Error(error.error_description);
    } else {
      throw new Error("General error");
    }

4. Configure SSL Trust (If Needed)​

4.1. Add Trust for Keycloak Endpoint:

  • If you encounter SSL errors, configure trust in WebSphere Application Server:
  • Navigate to: Security → SSL certificate and key management → Key stores and certificates → CellDefaultTrustStore → Signer certificates → Retrieve from port
  • Enter your Keycloak environment details (hostname and port)
  • Complete the certificate import process

5. Using the Token in API Calls​

5.1. Call the Token Service:

  • In your BAW processes, first call the getToken service flow
  • The service returns the JWT token in the jwt output variable

5.2. Include Token in API Calls:

  • Use the returned token in the Authorization header when calling Workbench APIs:
  • Add header: Authorization: Bearer [jwt value]

Conclusion​

🌟result

Congratulations! You have successfully established the JWT authentication between the Workbench and BAW. You can now use the token to authenticate REST API calls from BAW to IBM DevOps Solution Workbench services.

Further Reading​