Roadmap for configuring Process Federation Server and federated environments

Federated environments accommodate various configuration scenarios. This roadmap guides you through the most common paths for configuring Process Federation Server and federated environments and helps you ensure that the federated environment is secure.

Note: Process Federation Server is not available in IBM® Business Automation Workflow Express.

This roadmap provides the following paths for configuring your federated environment.

Quick start: The quick start path provides basic configuration that is suitable for development or test systems. It assumes that the federated process environment has a basic topology without any clustering. It also includes only minimal security configuration, for example, file-based basic user registry for user authentication.
To allow non-secure communication between Process Federation Server and a federated Business Automation Workflow system or IBM BPM system V8.5.7 cumulative fix 2017.03 or later with no certificate exchange, you must enable non-secure HTTP transport using the configureBPMTransportSecurity AdminTask. See configureBPMTransportSecurity command for more details.
Production: The production path provides steps for configuring and securing federated environments that are based on clustered topologies.

For more information about configuration topologies, see Planning the topology of your federated environment.

The following table shows in greater detail the order in which to configure the components in the federated environment and includes an overview of the steps to perform for the configuration. It also has specific information for the two configuration paths. The associated interactive diagram provides an at-a-glance view of the configuration steps and quick links to the relevant topics.

You can use the Process Federation Server validation tool to check certain configuration steps. These steps are indicated by an asterisk (*) in the table. For more information, see Validating the Process Federation Server and federated environment configuration .

Interactive high-level flow diagram that illustrates the steps that are associated with the
configuration of the federated environments. Click a box for more information, or shift-click to
open a new browser.

Table 1. Configuration roadmap for federated environments
Component	Configuration steps	Quick start path	Production path
1. Prerequisite: create a process federation server	Use the ibmProcessFederationServer template to create a server. See Creating a process federation server.	Required	Required
2. Configure the federated environment	a. *Configure the Process Federation Server database. See Configuring the Process Federation Server database.	Required	Required
	b. *Set up a common user registry that spans Process Federation Server and the federated systems. See Configuring a common user registry for federated process server environments.	File-based basic user registry	LDAP or custom user registry
	c. *Set up single sign-on (SSO) between Process Portal, Process Federation Server, and the federated systems. See Configuring SSO for federated environments.	LTPA	LTPA or third-party, for example, IBM Security Access Manager WebSEAL
	d. Set up IBM HTTP Server or another reverse proxy solution. See Configuring IBM HTTP Server for federated environments.	N/A	Required
	e. *Configure the Process Federation Server Elasticsearch service. See Configuring the Elasticsearch service.	Required	Required
3. Federate business process management systems	a. Enable indexing on each system that is to be federated. See Enabling indexing on a federated system.	Required	Required
3. Federate business process management systems	b. *On Process Federation Server, configure the data source, federated system, and indexing service for each system that is to be federated. See Adding a business process management system to a federated environment.	Required	Required
4. Configure Process Portal	a. Configure cross-origin resource sharing (CORS). See Configuring allowed origins for Process Portal	Required	Required if browser traffic does not go through a common reverse proxy server layer
4. Configure Process Portal	b. Configure endpoint URLs on the server that hosts Process Portal. See Configuring endpoint URLs for Process Portal .	Required	Required
5. Configure secure communications (SSL)	a. *Configure secure inbound communication to Process Federation Server. See Securing inbound communications to Process Federation Server .	Required. Note: Process Federation Server is configured for inbound communication by default.	Required for secure communication
	b. *Configure secure outbound communication between Process Federation Server and each federated system. See Securing outbound communications between Process Federation Server and federated systems.	Optional for outbound communication between Process Federation Server and REST services on federated systems.	Required for secure communication
	c. Configure secure communication between Elasticsearch nodes, or between Process Federation Server and the remote Elasticsearch cluster. See Securing communication between Elasticsearch service nodes or Securing communication between Process Federation Server and a remote Elasticsearch cluster.	Not applicable because the quick-start path has only one Elasticsearch node	Required for secure communication
	d. *Configure secure communication between Process Federation Server and LDAP. See Securing communications between Process Federation Server and LDAP.	N/A	Required for secure communication
	e. *Configure secure communication between Process Federation Server and the database on each of the federated systems. See Configuring secure database access in federated environments.	Optional	Required for secure communication
	f. Configure secure communication between Process Portal and Process Federation Server See Securing SSL communications between client applications and Process Federation Server.	Required Note: Process Federation Server is configured for inbound communication by default.	Required for secure communication