The following shows the steps for generating a sample SSL certificate:

1. Create a directory named rsm_keystore under the oc-cn-helm-chart/rsm directory.

2. Generate an SSL certificate. For example:

   openssl req -x509 -newkey rsa:4096 -keyout openSSLKey.pem -out cert.pem -days 365 -nodes

3. Generate a PKCS12 KeyStore file. For example, this creates a KeyStore file named keystore.p12:

   openssl pkcs12 -export -out keyStore.p12 -inkey openSSLKey.pem -in cert.pem

4. Copy your SSL certificate file to the oc-cn-helm-chart/rsm/rsm_keystore directory.

To integrate the SDK with BRM REST Services Manager, generate an SDK image as follows:

1. Copy your extended SDK JAR oc-cn-docker-files-15.0.x.0.0/oc-cn-docker-files/ocrsm/brm_rest_services_manager/SDK/libs to the oc-cn-docker-files-15.0.x.0.0/oc-cn-docker-files/ocrsm/brm_rest_services_manager/SDK directory.

   Note:

   The SDK JAR can be used directly from oc-cn-docker-files-15.0.x.0.0/oc-cn-docker-files/ocrsm/brm_rest_services_manager/SDK/libs if no changes are required. If you need to make further customizations, follow the instructions in REST Services Manager API for Billing and Revenue Management and then copy the updated SDK JAR to the oc-cn-docker-files-15.0.x.0.0/oc-cn-docker-files/ocrsm/brm_rest_services_manager/SDK directory.

2. In your override-values.yaml file for oc-cn-helm-chart, set the ocrsm.rsm.configEnv.rsmExtensionJar key to the name of your extended SDK JAR file, such as BRMRESTExtension.jar.

3. Go to the oc-cn-docker-files-15.0.x.0.0/oc-cn-docker-files/ocrsm/brm_rest_services_manager/SDK directory.

4. Build the Podman image by running this command:

   podman build --format docker --tag imagerepo/brm-rest-services-manager-extension:1 .

5. Push the SDK image to the repository by running this command:

   podman login --username user --password password imagerepo  
   podman push imagerepo/brm-rest-services-manager-extension:1 

If an HTTPS port is used for Oracle Unified Directory, do the following:

1. Create a directory named rsm_oud_keystore under the oc-cn-helm-chart/rsm directory.

2. Copy the Oracle Unified Directory certificate to the oc-cn-helm-chart/rsm/rsm_oud_keystore directory.

If BRM is located in a separate cluster from BRM REST Services Manager, do the following to connect BRM REST Services Manager to BRM:

1. Open the configmap_env_brmrsm.yaml file in a text editor.

2. Set BRM_HOST_NAME to the host name of the cluster on which BRM is located. The default value is cm.

3. Save and close the file.

Table 8-1 lists the keys that directly impact BRM REST Services Manager. Add these keys to your override-values.yaml file with the same path hierarchy.

You can use the following commands to encode and decode passwords in Base64 format:

• To encode strings in Linux:

  echo -n 'password' | base64

• To decode strings in Linux:

  echo 'encoded_password' | base64 --decode

Table 8-2 lists the keys that directly impact PDC REST Services Manager. Add these keys to your override-values.yaml file with the same path hierarchy.

ocpdcrsm:
    labels:
        name: "pdc-rsm"
        version: "15.0.0.0.0"
        isEnabled: true
    deployment:
        deadlineSeconds: 60
        revisionHistLimit: 10
        imageName: "oracle/pdcrsm"
        imageTag: ":15.0.0.0.0"
        imagePullPolicy: IfNotPresent
    configEnv:
        name: "pdcrsm-configmap-env"
        rsmListenerPort:
        baseURL: xxxxx.xxx.xxxxx.xxx
        securityEnabled: true
        securityType: oam
        oam:
            domainName: PDCRSMDomain
            audience: PDCRSMResourceServer
            endpointURL: http://oam_host:oam_port/oauth2/rest/token
            introspectendpointuri: http://oam_host:oam_port/oauth2/rest/token/info
            scopeaudience: http://oam_host:oam_port/
            authorizationendpointuri: http://oam_host:oam_port/oauth2/authorize
            proxyhost: http://proxyhost:proxyport/
            frontenduri: http://oam_host:oam_port
    secretValue:
        name: "pdcrsm-secret-env"
    service:
        name: "pdcrsm"
        type: "NodePort"
        nodePort: 31000

PDC REST Services Manager uses the OAuth 2.0 protocol to authenticate an enterprise product catalog's identity and to authorize the enterprise product catalog to access the PDC REST Services Manager API. It does this by validating an OAuth access token that is passed in the header of every HTTP/HTTPS request to the PDC REST Services Manager API.

To configure OAuth authentication in PDC REST Services Manager:

1. Add these keys to your override-values.yaml file for oc-cn-helm-chart:
   • If you are using Oracle Identity Cloud Service (IDCS) for OAuth:
     • ocpdcrsm.configEnv.isInboundOauthEnabled: Set this to true to enable OAuth authentication.
     • ocpdcrsm.configEnv.inboundOauthUri: Set this to the base URL of your Oracle Identity Cloud Service (IDCS) instance in this format:

       https://idcs-TenantID.identity.oraclecloud.com

     • ocpdcrsm.configEnv.inboundOauthClientId: Set this to the client ID of your confidential application.
     • ocpdcrsm.secretValue.inboundOauthClientSecret: Set this to the Base64-encrypted client secret obtained from your IDCS application.
     • ocpdcrsm.configEnv.inboundOauthFrontendUri: Set this to the base URL of your confidential application when run, such as http://myapp.example.com:8080.
     • ocpdcrsm.configEnv.inboundOauthAudience: Set this to the primary audience as provisioned for the PDC REST Services Manager application in IDCS.
     • ocpdcrsm.configEnv.inboundOauthProxyHost: Set this to the host name of your proxy server, if required.
     • ocpdcrsm.configEnv.inboundOauthPubEventScope: Set this to the name of the scope for accessing the TMF620 Publish Event endpoint for inbound OAuth authentication, such as pubevent.
     • ocpdcrsm.configEnv.inboundOauthMetricsScope: Set this to the name of the scope for accessing the metrics endpoint for inbound OAuth authentication, such as metrics.
   • If you are using Oracle Access Management for OAuth:
     • ocpdcrsm.configEnv.oam.domainName: Set this to the name of the OAuth identity domain created in Oracle Access Management for PDC REST Services Manager.
     • ocpdcrsm.configEnv.oam.audience: Set this to the name of the OAuth resource server created in Oracle Access Management for PDC REST Services Manager.
     • ocpdcrsm.configEnv.oam.endpointURL: Set this to the URL for requesting an OAuth token from Oracle Access Management.
     • ocpdcrsm.configEnv.oam.introspectendpointuri: Set this to the URL for validating an OAuth token from Oracle Access Management.
     • ocpdcrsm.configEnv.oam.scopeaudience: Set this to the primary audience for PDC REST Services Manager in the Oracle Access Management resource, used for error handling. This is the same as ocpdcrsm.configEnv.oam.frontenduri, ending with /.
     • ocpdcrsm.configEnv.oam.authorizationendpointuri: The URL for authorizing role-based access. PDC REST Services Manager does not support role-based access, so this will not be used.
     • ocpdcrsm.configEnv.oam.proxyhost: Set this to the URL for your Oracle Access Management proxy server, if needed.
     • ocpdcrsm.configEnv.oam.frontenduri: Set this to the URL for of the OAuth client created in Oracle Access Management for PDC REST Services Manager.

2. Run the helm upgrade command to update the Helm release:

   helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

3. Restart the PDC REST Services Manager pods. If downtime is not a concern, both pods can be deleted and re-created by running the following command. Otherwise, delete one pod at a time, waiting for its replacement pod to become "Running" before deleting the next one.

   kubectl -n BrmNameSpace delete pods --selector=app.kubernetes.io/name=pdcrsm

PDC REST Services Manager sends requests to the enterprise product catalog when calling the enterprise product catalog's REST API and when publishing acknowledgment notifications.

To configure PDC REST Services Manager to send requests to the enterprise product catalog:

1. Open the override-values.yaml file for oc-cn-helm-chart.

2. Edit the keys in the file based on the type of authentication required by your enterprise product catalog:

   • For OAuth 2.0 authentication, edit the keys in Table 8-3.

     Table 8-3 OAuth 2.0 Keys

     Key	Path in Values.yaml file	Description
     tokenEndpoint	ocpdcrsm.configEnv.httpClients.security.oauth2	The endpoint used to retrieve a token from.
     clientId	ocpdcrsm.configEnv.httpClients.security.oauth2	The client ID used to authenticate the request from PDC REST Services Manager.
     username	ocpdcrsm.configEnv.httpClients.security.oauth2	The user name required for accessing the enterprise product catalog.
     scope	ocpdcrsm.configEnv.httpClients.security.oauth2	The scopes required by the enterprise product catalog.
     grantType	ocpdcrsm.configEnv.httpClients.security.oauth2	The grant type to be used for the OAuth flow: client_credentials or password.
     clientsecret	ocpdcrsm.secretValue.httpClients.security.oauth2	The encrypted client secret used to authenticate the request from PDC REST Services Manager.
     password	ocpdcrsm.secretValue.httpClients.security.oauth2	The encrypted password required for accessing the enterprise product catalog.

   • For basic authentication, edit the keys in Table 8-4.

     Table 8-4 basicAuth Keys

     Key	Path in Values.yaml file	Description
     username	ocpdcrsm.configEnv.httpClients.security.basicAuth	The user name required for accessing the enterprise product catalog.
     password	ocpdcrsm.secretValue.httpClients.security.basicAuth	The password required for accessing the enterprise product catalog.

3. Run the helm upgrade command to update the Helm release:

   helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

4. Restart the PDC REST Services Manager pods. If downtime is not a concern, both pods can be deleted and re-created by running the following command. Otherwise, delete one pod at a time, waiting for its replacement pod to have a "Running" status before deleting the next one.

   kubectl --namespace BrmNameSpace delete pods --selector=app.kubernetes.io/name=pdcrsm

The following shows an example configuration for OAuth 2.0 authentication.

configEnv:
    httpClients:
        - urlRegex: "http://hostname:port/mobile/custom/catalogManagement/.*"
          security:
              oauth2:
                  tokenEndpoint: "https://idcs_hostname/oauth2/v1/token"
                  clientId: "fcb3443f6c504ed789ba38a78341b88a"
                  username: "user"
                  scope: "https://hostnameurn:opc:resource:consumer::all"
                  grantType: "password"
secretValue:
    httpClients:
        - urlRegex: "http://hostname:port/mobile/custom/catalogManagement/.*"
          security:
              oauth2:
                  clientSecret: client_secret
                  password: password

The following shows an example configuration for Basic authentication:

configEnv:
    httpClients:
        - urlRegex: "http://hostname:port/mobile/custom/PublishingAPI.*"
          security:
              basicAuth:
                 username: eccUser
secretValue:
    httpClients:
        - urlRegex: "http://hostname:port/mobile/custom/PublishingAPI.*"
          security:
              basicAuth:
                  password: password

You can enable TLS encryption in PDC REST Services Manager to secure the communications it receives from your enterprise product catalog.

To enable TLS in PDC REST Services Manager:

1. Generate a self-signed SSL certificate:

   1. Create a directory for storing your SSL certificate that is accessible by the BRM Helm chart, such as oc-cn-helm-chart/rsm_cert.

   2. Generate an SSL certificate. For example, this creates a certificate file named cert.pem:

      openssl req -x509 -newkey rsa:4096 -keyout openSSLKey.pem -out cert.pem -days 365 -nodes

   3. Generate a PKCS12 KeyStore file. For example, this creates a KeyStore file named keystore.p12:

      openssl pkcs12 -export -out keyStore.p12 -inkey openSSLKey.pem -in cert.pem

2. Add these keys to your override-values.yaml file for oc-cn-helm-chart:

   • security.tlsVersions: Set this to the list of TLS versions supported by PDC REST Services Manager, such as TLSv1.2,TLSv1.3. This is the default global value for PDC REST Services Manager.

   • ocpdcrsm.configEnv.isTlsEnabled: Set this to true to enable TLS encryption for PDC REST Services Manager.

   • ocpdcrsm.configEnv.tlsVersions: Set this to the list of supported TLS versions, such as TLSv1.2,TLSv1.3.

     Note:

     Set this key if you want to override the value set it security.tlsVersions for communication with PDC or an enterprise product catalog.

   • ocpdcrsm.configEnv.tlsCertificatePath: Set this to the path of the TLS certificate bundle relative to this Helm chart, such as rsm_cert/keyStore.p12.

   • ocpdcrsm.secretValue.tlsCertificatePassphrase: Set this to the Base64-encrypted passphrase for the TLS certificate.

3. Run the helm upgrade command to update the Helm release:

   helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

4. To apply the changes, re-create any previously existing PDC REST Services Manager pods:

   kubectl --namespace BrmNameSpace delete pods --selector=app.kubernetes.io/name=pdcrsm

After you enable TLS, connect to PDC REST Services Manager services using HTTPS only.

Enable the T3S protocol in PDC REST Services Manager to secure its communications to PDC.

To enable T3S in PDC REST Services Manager:

1. Add these keys to your override-values.yaml file for oc-cn-helm-chart:

   • ocpdcrsm.configEnv.useT3s: Set this to true.

   • ocpdcrsm.configEnv.jksTrustStorePath: Set this to the path of the JKS TrustStore for the PDC T3S connection, such as rsm/truststore.jks.

2. Run the helm upgrade command to update the Helm release:

   helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

3. To apply the changes, re-create any previously existing PDC REST Services Manager pods:

   kubectl --namespace BrmNameSpace delete pods --selector=app.kubernetes.io/name=pdcrsm

If you are using PDC REST Services Manager, you must configure the mappings of BRM event names to the values your enterprise product catalog sends in the priceType property of the ProductOfferingPrice element of the TMF620 payload.

The mappings are configured in configmap_pdcrsm_appeventCfg.yaml. You can add mappings as needed for your deployment or use the default mappings provided at installation.

To add or edit mappings:

1. Open the configmap_pdcrsm_appeventCfg.yaml file.

2. Edit the existing mappings, or use them as templates to add new ones. Use the following format:

   pricetype : "eventname" 

   where:

   • pricetype is the value sent in the priceType property of the ProductOfferingPrice element of the TMF620 payload.

   • eventname is the name of the BRM event the price type should be mapped to.

   For example, the default mappings for one-time fees and usage events are:

   ONE_TIME : "EventBillingProductFeePurchase"
   ONE_TIME_PRICE_PLAN : "EventBillingProductFeePurchase"
   USAGE : "EventSession"
   USAGE_PRICE_PLAN : "EventSession"

3. Run the helm upgrade command to update the Helm release:

   helm upgrade BrmReleaseName oc-cn-helm-chart --values OverrideValuesFile --namespace BrmNameSpace

4. Restart the PDC REST Services Manager pods. If downtime is not a concern, both pods can be deleted and re-created by running the following command. Otherwise, delete one pod at a time, waiting for its replacement pod to become "Running" before deleting the next one.

   kubectl --namespace BrmNameSpace delete pods --selector=app.kubernetes.io/name=pdcrsm