Integrations

To integrate ADS with Axiomatics Services Manager (ASM) or the Authorization Hub, configure ADS to retrieve its authorization domain configuration from the respective service. This requires two steps: prepare ASM or the Authorization Hub to serve the domain, then update your ADS deployment configuration.

Preparation

Select the tab for your service.

• ASM
• Authorization Hub

1. Configure an authorization domain in an ASM project

   See the Domain managementOpens in a new tab section of the ASM documentation.

2. Configure Keycloak

   Set up the Keycloak client to give ADS authentication access. Follow the instructions in the Configure Keycloak for ADSOpens in a new tab section of the ASM documentation.

1. Configure an authorization domain in the Authorization Hub

   See the DomainsOpens in a new tab section of the Authorization Hub documentation.

2. Manage client access through Keycloak

   Set up the Keycloak client to give ADS authentication access. Follow the instructions in the Client managementOpens in a new tab section of the Authorization Hub documentation.

Deployment configuration

Update your deployment.yaml file to point to the remote HTTP/HTTPS endpoint and configure the appropriate authentication.

1. Set the domain path

   Set path under the domain section to the HTTP/HTTPS URL of your ASM or Authorization Hub endpoint.

   note

   URL-encode spaces in domain names as %20. For example, Project 1 becomes Project%201.

   path: https://<hostname>/adm/api/namespaces/Project%201/names/mydomain/domain.yaml

2. Configure authentication

   ADS requires client credentials to request the domain configuration from ASM or the Authorization Hub. Under domain.authentication, configure OAuth2 authentication:

   1. Specify an oauth2ClientId under domain.authentication.

   2. Add the corresponding OAuth2 properties (client-id, client-secret, scope, authorization-grant-type, and token-uri) under spring.security.oauth2.client.

      tip

      Use environment variables to protect sensitive information such as your client secret.

3. Configure TLS

   Secure communications between ADS and your service using TLS:

   1. Define a tlsConfigurationId (for example, admBundle) in the domain.authentication section.

      Optionally, define an oauth2TlsConfigurationId to configure TLS for OAuth2 token retrieval separately from domain retrieval. It can reference the same bundle as tlsConfigurationId or a different one.

   2. Add keystore (location, password, type) and truststore (location, password, type) properties under spring.ssl.bundle.jks.

      ADS supports both basic TLS with a KeyStore and TLS with client certificates (mTLS).

   tip

   As an alternative to defining a Spring TLS bundle, configure TLS trust at the JVM level by passing truststore properties as JVM startup arguments. See Configure TLS: JVM truststore for details.

deployment.yaml

# ADS configuration for integration with ASM or the Authorization Hub

license: file:<path_to_file>/axiomatics_ADS.license

domain:
  path: https://<host>/domain.yaml
  authentication:
    oauth2ClientId: adm-client
    tlsConfigurationId: admBundle
    # oauth2TlsConfigurationId: tokenBundle 

spring:
  security:
    oauth2:
      client:
          registration:
            adm-client:
              client-id: <your_client_id>
              client-secret: ${OAUTH_CLIENT_SECRET}
              scope: openid  # Defines the scope of access requested by the client.
              authorization-grant-type: <your_grant_type>
              provider: adm-client
          provider:
            adm-client:
              # Uncomment the line for either ASM or the Hub. Do NOT uncomment both.
              # token-uri: https://<asm-hostname>/auth/realms/asm/protocol/openid-connect/token
              # token-uri: https://<hub-hostname>/auth/realms/hub/protocol/openid-connect/token
  ssl:
    bundle:
      jks:
        admBundle:                             
          keystore:
            location: file:<path_to_keystore.jks>  # Or .p12 for PKCS12
            password: ${KEYSTORE_PASSWORD}
            type: JKS # Replace with PKCS12 depending on the keystore type used
          truststore:
            location: file:<path_to_truststore.jks>
            password: ${TRUSTSTORE_PASSWORD}
            type: JKS # Replace with PKCS12 depending on the keystore type used
        # tokenBundle:
        #   keystore:
        #     location: file:<path_to_keystore.jks>  # Or .p12 for PKCS12
        #     password: ${KEYSTORE_PASSWORD}
        #     type: JKS or PKCS12
        #   truststore:
        #     location: file:<path_to_truststore.jks>
        #     password: ${TRUSTSTORE_PASSWORD}
        #     type: JKS or PKCS12

caution

Replace all placeholders with your actual values before deploying.