Installation appeared to work, or did it?

[Jonathan Brooks]

Hi All,

I've managed to make it to the end of the secure installation using:

Ubuntu 20.04LTS

dcm4chee-arc-5.23.3-mysql-secure

keycloak-14.0.0

wildfly -24.0.0.Final

OpenLDAP

Openjdk-11

mysql (Server version: 8.0.26-0ubuntu0.20.04.2)

mysql-connector-java 8.0.26 (JDBC module)

Made it through to the end (took a day) and was able to deploy without errors. I used my host name as "localhost" throughout (no quotes), it's not a VM, no docker involved.

I'm going to post some instructions for this, but before I do I need to get the actual archive working!

I visit:

https://localhost:8443/dcm4chee-arc/ui2/

I can log in using the standard (?) username/password = admin/changeit

I'm presented with the J4Care background image and a menu icon top left, which if I select and then click on Navigation I get several warning messages appear (see attached image).

I've checked that the configuration for the dcm4chee-arc-ui client in keycloak is correct (so I don't think it's a web origins problem e.g. here), and it doesn't make any difference if I choose to use https or http, or use a private browsing window (not a caching problem).

I'm attaching the output from the Inspector->Network errors from the browser. I suspect this is related to keycloak thinking that the Node name is "my_machine_name", but I'm trying to access resources at "localhost" - not sure if this is relevant (connection blocked by CORS policy).

Any help with solving this would be much much much appreciated.

Best wishes,

Jon

[Vrinda Nayak]

It seems you have deployed secured version of archive (UI and RESTful) but only secured UI in Keycloak subsystem's secure-deployment.

[Jonathan Brooks]

Hi Vrinda,

Thanks for this - can I check that your interpretation is that from the following two commands:

1. /subsystem=keycloak/secure-deployment=dcm4chee-arc-ui2-5.x.x-secure.war/:add(realm=dcm4che,resource=dcm4chee-arc-ui,auth-server-url=https://localhost:8843/auth,ssl-required=external,public-client=true,truststore=/home/vrinda/work/secure/wildfly-19.1.0.Final/standalone/configuration/keystores/cacerts.p12,truststore-password=secret,allow-any-hostname=true)
2. /subsystem=keycloak/secure-deployment=dcm4chee-arc-war-5.x.x-secure.war/:add(realm=dcm4che,resource=dcm4chee-arc-rs,auth-server-url=https://localhost:8843/auth,ssl-required=external,bearer-only=true,truststore=/home/vrinda/work/secure/wildfly-19.1.0.Final/standalone/configuration/keystores/cacerts.p12,truststore-password=secret,allow-any-hostname=true)

I only completed the first?

Or is it it that I didn't issue the following new(?) commands?

https://github.com/dcm4che/dcm4chee-arc-light/wiki/Secure-Archive-UI-and-RESTful-Services-using-Keycloak#secure-wildfly-management-console

I'm a bit confused where I went wrong with this.

Best wishes,

Jon

[Vrinda Nayak]

Only if you want to secure the management console of Wildfly, you may follow https://github.com/dcm4che/dcm4chee-arc-light/wiki/Secure-Archive-UI-and-RESTful-Services-using-Keycloak#secure-wildfly-management-console

Which version of archive have you deployed?

- /subsystem=keycloak/secure-deployment=dcm4chee-arc-ui2-5.x.x-secure.war/.........

and

- /subsystem=keycloak/secure-deployment=dcm4chee-arc-war-5.x.x-secure.war/.........

is required if you have deployed secured version of archive (where both UI & RESTful services of archive are secured) i.e. eg. dcm4chee-arc-ear-5.23.3-psql-secure.ear and dcm4chee-arc-ui2-5.23.3-secure.war

- /subsystem=keycloak/secure-deployment=dcm4chee-arc-ui2-5.x.x-secure.war/.........

is sufficient, if you've deployed only secure-ui version (where RESTful services are not secured) i.e. eg. dcm4chee-arc-ui2-5.23.3-secure.war and dcm4chee-arc-ear-5.23.3-psql.ear

[Jonathan Brooks]

HI Vrinda,

Thanks - as I mentioned in a follow up email I am trying to deploy secured UI and RESTful services. I deployed both - with no errors, but still couldn't interact with the UI without the unauthorized 401 errors.

No idea what's going wrong - the logs aren't particularly instructive.

Any other steps I should try?

Cheers, Jon

[Vrinda Nayak]

Can you share your wildfly configuration?

If you've deployed secured version of archive (UI and RESTful services both are secured) and also added them in Keycloak's server subsystem, check if requesting an access token from Keycloak and using it in a RESTful service works.

[Jonathan Brooks]

Appears to have worked, I think the only thing I did different this time was Secure the Wildfly Console as per your recent instructions.

Only other change was that I used the timezone=Europe/London instead of timezone=UTC when adding the mysql database via the JBoss CLI.

Requesting an access token worked using the curl command in the link you sent. Very exciting! :-)

Is there a recommended way to test uploading and downloading of data? At some point I will "attach" this server to the MRI scanner, but until then I need to do thing by hand I guess.

Thanks for all your help!!!!

Have a great weekend.

Best wishes,

Jon

[Vrinda Nayak]

You can check Archive UI Testplan - Accessing Own Archive - Tests