How do I configure a custom domain, session affinity and CORS for BAW on CP4BA?

Question

We expose Workflow to users under our own domain and we have a React front end on another domain that calls the BAW REST APIs. On WebSphere we set the public host, IHS sticky sessions and CORS in a filter. What are the equivalents on OpenShift?

Answer 1

All three are platform settings on OpenShift plus one workflow setting:

• Custom domain: the Zen front door route can be given your hostname (shared_configuration.sc_deployment_hostname_suffix in the CR, and the Zen route with a TLS certificate secret), or you add a second route with the custom host pointing at the same service. BAW's generated links (task URLs in e-mails, launch URLs) use the hostname the request came in on; on containers the public host is derived from the route, so no hostname in 100Custom.xml is needed unless links must always use one host.
• Session affinity: OpenShift routes with passthrough / re-encrypt TLS and multiple pods need cookie-based stickiness: the operator sets the workflow routes to use a session cookie (haproxy.router.openshift.io/disable_cookies=false) so that coaches stay on their pod; if you put another load balancer in front of the router, make it sticky on the router's cookie.
• CORS for a front end on another origin: Liberty's CORS is enabled with a <cors> element in the custom Liberty configuration (allowed origins, headers incl. BPMCSRFToken and Authorization, credentials), and the Zen front door must allow the origin as well (the platform's CORS configuration in the IAM / Zen ConfigMap on newer releases). The simplest alternative: serve the front end from the same origin through a route path or put both behind one API gateway.

<!-- custom Liberty configuration snippet: CORS for https://app.example.com -->
<server>
  <cors domain="/rest/bpm/wle/v1" allowedOrigins="https://app.example.com" allowedMethods="GET, POST, PUT, DELETE, OPTIONS"
        allowedHeaders="Content-Type, Accept, Authorization, BPMCSRFToken" allowCredentials="true" maxAge="3600"/>
  <cors domain="/bpm" allowedOrigins="https://app.example.com" allowedMethods="GET, POST, PUT, DELETE, OPTIONS"
        allowedHeaders="Content-Type, Accept, Authorization, BPMCSRFToken" allowCredentials="true"/>
</server>

Remember the front end still needs a Zen identity for its calls (a bearer token obtained from IAM for the logged-in user, or a backend-for-frontend that holds an API key) and the CSRF token from POST /bpm/system/login.

References

• CP4BA documentation - routes, custom hostnames and certificates
• BAW - CSRF protection for REST calls