Activiti: [Modeling] Integrate Modeling Service's backend and frontend into one Docker container

[daisuke-yoshimoto]

Salaboy @Salaboy 12月 31 2018 21:10
I was thinking that you might be able to help us in running the modeling backend with the front end all in one docker container
Daisuke Yoshimoto @daisuke-yoshimoto 12月 31 2018 21:21
@Salaboy Ok.
Salaboy @Salaboy 12月 31 2018 21:22
@daisuke-yoshimoto maybe creating a script and a maven profile to package the angular app with the springboot app
Daisuke Yoshimoto @daisuke-yoshimoto 12月 31 2018 21:23
https://github.com/Activiti/activiti-modeling-app
Salaboy @Salaboy 12月 31 2018 21:24
That’s the frontend
So we might need a third repo where we clone both projects and package them together
Daisuke Yoshimoto @daisuke-yoshimoto 12月 31 2018 21:30
@Salaboy Which is another one?
activiti-cloud-modeling
activiti-cloud-process-model-service
activiti-cloud-modeling-dependencies
activiti-cloud-modeling-build
Salaboy @Salaboy 12月 31 2018 21:32
https://github.com/Activiti/activiti-cloud-modeling
Is the backend
So you need to bundle the two together into a single spring boot jar with the angular app inside
Daisuke Yoshimoto @daisuke-yoshimoto 12月 31 2018 21:32
@Salaboy Ok.
@Salaboy Is activiti-cloud-modeling-build not related?
Salaboy @Salaboy 12月 31 2018 22:38
@daisuke-yoshimoto nope that is just the parent pom
It is true that the name is confusingly
Confusing

[daisuke-yoshimoto]

@salaboy @igdianov
Is it okay to load the build artifacts of activiti-modeling-app (contents of the dist directory after npm run-script build command) into the Spring Boot application of activiti-cloud-modeling?

(ex) activiti-modeling-app/dist -> activiti-cloud-modeling/src/main/resources/static

[mteodori]

@daisuke-yoshimoto @salaboy I have a Dockerfile that was doing that already, for the database is it going to use embedded without any need of another docker container?

[salaboy]

@mteodori can you share that please? and yes.. embedded DB.

[daisuke-yoshimoto]

@mteodori @salaboy
Should I stop this issue?

[mteodori]

I am updating the Dockerfile I have and verify, will create a PR for this ticket as soon as I have it working

[mteodori]

I've created an example here: https://github.com/mteodori/activiti-modeling-standalone/

The final result is not standalone though as it requires keycloak, what shall we do, disable?

Also not sure what we want to do next if to apply changes to https://github.com/activiti/activiti-modeling-app repo or create another repository like this one

[salaboy]

@daisuke-yoshimoto @mteodori please collaborate on this one.. @daisuke-yoshimoto check @mteodori approach which is quite clever.. just overlaying two docker images..

What @daisuke-yoshimoto was trying to get working is more on the spring boot world.. which is needed to provide spring security instead of Keycloak integration. But we can solve that on the backend image only.

Next steps in my opinion:

• [ ] Create a backend that works with Spring Security instead of going to Keycloak, this can be configured with a properties file to define a single modeler/modeler user with role ACTIVITI_MODELER
• [ ] Do overlay as @mteodori suggested with containers to avoid moving files around
• [ ] we can create a new repository for the aggregation, but we need to have a script to run from a pipeline so we can automate the publishing of the new standalone docker image.

[mteodori]

I will try and find a property that disables the keycloak adapter and another that disables the spring security check and see how to change the front-end to skip the login screen as it would much less work than the above

[daisuke-yoshimoto]

@mteodori @salaboy
Thanks. I checked activiti-modeling-standalone.

I found another problem.
When transitioning to the direct URL(routing by Spring Boot) instead of the SPA transition, 404 error occurs.

If we change the setting of Spring Boot of activiti-cloud-modeling, it seems to be resolved.
https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-developing-web-applications.html#boot-features-spring-mvc-static-content

[daisuke-yoshimoto]

@salaboy
Is not it ok to integrate the repositories of activiti-cloud-modeling and activiti-modeling-app in the first place? Is there a merit to keep it separated?

[daisuke-yoshimoto]

@mteodori @salaboy

change the front-end to skip the login screen as it would much less work than the above

I think that it is necessary to change the setting on the front-end side. In the current setting, Oauth 2 authentication using keycloak is set up.
https://github.com/Activiti/activiti-modeling-app/blob/master/src/app.config.json

[daisuke-yoshimoto]

@salaboy @mteodori
I started PR with a plan to realize with spring boot world. Authentication etc are not yet available.
https://github.com/Activiti/activiti-cloud-modeling/pull/38

[salaboy]

@mteodori we need spring security there.. I don't want to change the app behaviour because of the way that we choose to deploy it. This is quite common even for standalone applications. We want to make sure that we can pick up the currently logged in user, the entire application relies on such data. Also we don't want to maintain to separate applications.

[salaboy]

@daisuke-yoshimoto yes.. we need to basically exclude keycloak apdater and just configure spring security to use OAuth2 with a set of users defined maybe in a property file (??) we need to investigate this. Using OAuth2 will allow us to not change the front end at all.

[salaboy]

@daisuke-yoshimoto we cannot merge both projects in a single repository.. because backend and front end have separate lifecycles.. what I suggested above is to have a third repository where we do the integration using a script.

[daisuke-yoshimoto]

@salaboy

we cannot merge both projects in a single repository.. because backend and front end have separate lifecycles.. what I suggested above is to have a third repository where we do the integration using a script.

Ok. As the following pr, how about submodule approach?
https://github.com/Activiti/activiti-cloud-modeling/pull/38

[salaboy]

@daisuke-yoshimoto as submodule yes.. that looks better.. because it is just a link between two repos.

[mteodori]

I am checking with @popovicsandras if we can have an option to skip login otherwise at the moment we need an oauth2 implementation in the backend, for the other approach I am a bit lost for me the third repository would have been similar to the one I created with no changes on the other ones

[daisuke-yoshimoto]

@salaboy
Hi. Let me check a little about process modeler issue. https://github.com/Activiti/Activiti/issues/2324

When this issue is completed, will we basically use modeler's frontend and backend as one container? Do we leave use cases treated as separate containers?

[daisuke-yoshimoto]

@salaboy @mteodori

interim report

• I'm working on this issue by creating 3rd repository.
  
  
  
  • https://github.com/daisuke-yoshimoto/activiti-cloud-modeling-standalone
  
  
• I excluded KeyCloack and are trying to authenticate with Spring Security OAuth2.
  
  
  
  • However, since activiti-modeling-app requires OpenID specification not simple OAuth2, I am struggling.
  
  
  • In addition to using Spring Security OAuth 2, it seems necessary to implement an OpenID provider.
  
  

[mteodori]

that is the reason why I was pushing for a simple disable for a desktop install, checked with @eromano and on the front-end app the login component can be skipped by pointing to /application/dashboard as entry point as the front-end is driven by the API return code so everything should work

[daisuke-yoshimoto]

@mteodori Thanks 😄 I will check that endpoint.

[daisuke-yoshimoto]

@mteodori
Sorry. I tried the endpoint /application/dashboard. But I got same state 😢
activiti-modeling-app tries to access the openid endpoint (.well-known/openid-configuration).

[daisuke-yoshimoto]

@salaboy

https://spring.io/guides/tutorials/spring-boot-oauth2/

I checked your proposal. But here is the explanation of OpenID's client side.
Also @EnableOAuth2Sso is about OpenID's client side.

So, I'm considering using another library with Spring Security.

[mteodori]

@daisuke-yoshimoto /application/dashboard should resolve to the front-end index.html in order to be equivalent to the front-end docker image behaviour and actually any URL which is not API URL should resolve to that

[salaboy]

@daisuke-yoshimoto what do you mean that is only client side? -> https://spring.io/guides/tutorials/spring-boot-oauth2/#_social_login_authserver

That points to this one: @EnableAuthorizationServer which is an embedded authorization server

[mteodori]

@salaboy still OAuth2 only the OIDC part would still be missing, I have the fear you have to embed a full keycloak in or similar like the one @daisuke-yoshimoto posted

on removing the auth instead I have the URLs working as expected but still a config on the front-end to jump the login should be added by @popovicsandras to make it work, going to the deep link /dashboard/applications still triggers the redirect to the OIDC server login page

[daisuke-yoshimoto]

@mteodori @salaboy

It would be appreciated if activiti-modeling-app prepare a mode that does not ask for authentication.
It would be appreciated if that mode can be set in https://github.com/Activiti/activiti-modeling-app/blob/master/src/app.config.json.

If activiti-modeling-app do that, Spring Boot can apply authentication processing before rendering activiti-modeling-app.

[daisuke-yoshimoto]

@mteodori @salaboy
It seems that @mkawczynski07 has encountered a similar problem.
https://github.com/Activiti/activiti-modeling-app/issues/23

[mteodori]

I checked with @popovicsandras and required changes are larger than I thought so as a quick win it doesn't work, another option would be to use plain spring security and set on the Alfresco JS API the APS 1.x authentication mode rather than OAUTH which is BASIC: https://github.com/Alfresco/alfresco-js-api#authentication-js-api

[daisuke-yoshimoto]

@mteodri

Could you change app to set the endpoint for basic auth in app.config.json? Not aps endpoint.

[daisuke-yoshimoto]

[Note] Basic Auth

Setting

• app.config.json/authType -> BASIC

Auth Endpoint

• [POST] alfresco/api/-default-/public/authentication/versions/1
  
  
  
  • Request
  
  

{
  "userId": "test",
  "password": "test"
}

• Response

{
  "entry": {
    "id": "TICKET_ed4981b4bbb15fc2713f7caaffd23982d0dd4e5c",
    "userId": "test"
  }
}

Basic Auth with tichekt

• format
  ROLE_TICKET:%id% -> base64 encoding

• header
  Authorization: Basic %base64 encoding result%

Reference

• https://github.com/Alfresco/alfresco-js-api#authentication-js-api

• https://github.com/Alfresco/alfresco-js-api/blob/67942c5c0604d80d6c02b3a451a2fcce45b55554/src/api/auth-rest-api/README.md

• https://community.alfresco.com/community/ecm/blog/2017/05/02/v1-rest-api-10-things-you-should-know

[daisuke-yoshimoto]

@mteodori
I tried BASIC auth mode. But I got script error. I try to log in, a script error occurs.
I created the issue for this script error.
https://github.com/Activiti/activiti-modeling-app/issues/30

[daisuke-yoshimoto]

@salaboy @mteodori

It seems that I can proceed any further without fixing the front end side(https://github.com/Activiti/activiti-modeling-app/issues/30).

So, I will stop this issue once.

[mteodori]

look like there is work to do with this option too, I think we should move this issue to later as it's more of a nice to have, and anyway I am still more for the no auth option as for a desktop style app it feels bad to ask for a dummy authentication

[salaboy]

@daisuke-yoshimoto let's discuss about this.. I would like to reproduce the issue that you are hitting with your configuration to understand where the problem is. I think that @mteodori is confusing priorities here regarding what is needed for the community project. Can you send me an email on how to reproduce the error that you are having?

[daisuke-yoshimoto]

@salaboy @mteodori

Although org-service calls process-model-service via feign, since it is both in the same application in the standalone version, I will replace the implementation class so that org-service calls process-model-service directly in Java layer.

[daisuke-yoshimoto]

Note

When the following issues are completed, I will add fix for endpoint of connector to the standalone version.
https://github.com/Activiti/Activiti/issues/2437

[daisuke-yoshimoto]

@salaboy @mteodori
The standalone modeler is almost complete. However, since the build of activiti-modeling-app is broken, now it can not be checked.
https://github.com/daisuke-yoshimoto/activiti-cloud-modeling-standalone

[mkawczynski07]

@salaboy what is the status of standalone modeler for activiti 7? When we could expect it? Honestly, for us it is serious blocker ;/

[salaboy]

@mkawczynski07 we couldn't make it for GA, and we are coordinating that work.
Can you please describe what is blocking you exactly? Would a local web application storing files in the file system be enough for unblocking you? Is that application a Docker Image or does it need to be a spring boot app? I can share what we are planning but it will be great if we can match to your expectations.

[daisuke-yoshimoto]

@salaboy
Have @popovicsandras completed basic authentication on the activiti-modeling-app side?

[mkawczynski07]

We are using activiti 7 core and for us, the blocker is lack of process modeler. You know like a tool that people from our customer could use and easily model processes.

I assume @daisuke-yoshimoto tries to setup standalone modeler as a Docker image. That's right?

[daisuke-yoshimoto]

@mkawczynski07
I was creating standalone modeler as a Spring Boot web application in the following repository. However, it is still an experimental stage.
https://github.com/Activiti/activiti-cloud-modeling-standalone

This repository is slightly customized for activiti-modeling-app, as activiti-modeling-app only supports OpenID authentication. Since the content to be customized has become old, I will try to update it once.

Then you may be able to get the standalone modeler to be tested experimentally.

[daisuke-yoshimoto]

By following PR, the version of alfresco-js-api is updated, and the behavior of Basic authentication is changed.
https://github.com/Activiti/activiti-modeling-app/pull/73

Memo

• https://github.com/Alfresco/alfresco-js-api/blob/master/src/authentication/processAuth.ts#L81
• https://github.com/Alfresco/alfresco-js-api/blob/master/test/mockObjects/process-services/authResponseMock.js#L14

[salaboy]

@daisuke-yoshimoto I will check, but I don't think that it was their priority.

[daisuke-yoshimoto]

@salaboy
I created pr for activiti-cloud-modeling-standalone to retrieve activiti-modeling-app repo's updates. Please review and merge this pr.
https://github.com/Activiti/activiti-cloud-modeling-standalone/pull/4

[mteodori]

@daisuke-yoshimoto shall we review the status of this?

[daisuke-yoshimoto]

@mteodori
I'm sorry. It is not in a condition to be reviewed yet. There was a problem on the activiti-modeling-app side, so it stopped, but today and tomorrow I will check the latest activiti-modeling-app to see if the problem is resolved.

[mteodori]

we can also take some actions to make things simpler, any help you might need just ask :)

[daisuke-yoshimoto]

@mteodori

Sorry I made you wait. confirmed.

After all, it seems that Basic authentication is not supported on the activiti-modeling-app side, so it is necessary to support the OpenId provider on the backend side. This is a hard task. Spring Boot does not support OpenId provider, so refer to openid-connect-server-spring-boot etc. However, I must create an OpenId provider.

By the way, where is the repository for backend services such as activiti-cloud-modeling? It seems that the existing repository has already been archived.

[zoltanpalfi]

You can find activiti-cloud-modeling and all other activiti-cloud related services as modules it here: https://github.com/activiti/activiti-cloud