SRVLOGIC-98-security: Another round of Walter review round 4

Author: Kalyani Desai

modules/serverless-logic-security-config-auth-credentials-openapi.adoc

@@ -17,10 +17,10 @@ The security schemes defined in an OpenAPI specification file are global to all
 .Prerequisites
 
 * You have access to a {ServerlessLogicProductName} project with the appropriate roles and permissions to create applications and other workloads in {ocp-product-title}.
-* Your OpenAPI specification is defined in one or more security schemes.
+* Your OpenAPI specification includes one or more security schemes.
 * You have access to the OpenAPI specification files.
 * You have identified the schemes you want to configure `http-basic-example` or `api-key-example`.
-* You have access to the application properties file, the workflow `ConfigMap`, or environment variable setup.
+* You have access to the `application.properties` file, the workflow `ConfigMap`, or the `SonataFlow` CR.
 
 .Procedure
 
@@ -31,16 +31,16 @@ The security schemes defined in an OpenAPI specification file are global to all
 quarkus.openapi-generator.[filename].auth.[security_scheme_name].[auth_property_name]
 ----
 +
-** `filename` is the sanitized name of the file containing the OpenAPI specification, such as security_example_json.
-** `security_scheme_name` is the sanitized name of the security scheme object definition in the OpenAPI specification file, such as http_basic_example or api_key_example.
+** `filename` is the sanitized name of the file containing the OpenAPI specification, such as security_example_json. To sanitize this name, you must replace all non-alphabetic characters with `_` underscores.
+** `security_scheme_name` is the sanitized name of the security scheme object definition in the OpenAPI specification file, such as `http_basic_example` or `api_key_example`. To sanitize this name, you must replace all non-alphabetic characters with `_` underscores.
 ** `auth_property_name` is the name of the property to configure, such as username. This property depends on the defined security scheme type.
 +
 [NOTE]
 ====
 When you are using environment variables to configure properties, follow the MicroProfile environment variable mapping rules. You can replace all non-alphabetic characters in the property key with underscores `_`, and convert the entire key to uppercase.
 ====
 
-The following examples show how to provide these configuration properties using `application.properties`, a `ConfigMap` associated with your workflow, or environment variables defined in the `SonataFlow` CR: 
+The following examples show how to provide these configuration properties using `application.properties`, the `ConfigMap` associated with your workflow, or environment variables defined in the `SonataFlow` CR: 
 
 .Example of configuring the credentials by using the `application.properties` file
 [source,text]
@@ -65,6 +65,11 @@ metadata:
   namespace: example-namespace
 ----
 
+[NOTE]
+====
+If the name of the workflow is `example-workflow`, the name of the `ConfigMap` with the user defined properties must be `example-workflow-props`.
+====
+
 .Example of configuring the credentials by using environment variables in the `SonataFlow` CR
 [source,yaml]
 ----

modules/serverless-logic-security-example-oauth-authentication.adoc

@@ -95,10 +95,11 @@ To access the secured operation, define an `OidcClient` configuration in your `a
 
 [source,terminal]
 ----
+# adjust these configurations according with the authentication service.
 quarkus.oidc-client.oauth_example.auth-server-url=https://example.com/oauth
 quarkus.oidc-client.oauth_example.token-path=/tokens
 quarkus.oidc-client.oauth_example.discovery-enabled=false
-quarkus.oidc-client.oauth_example.client-id=kogito-app
+quarkus.oidc-client.oauth_example.client-id=example-app
 quarkus.oidc-client.oauth_example.grant.type=client
 quarkus.oidc-client.oauth_example.credentials.client-secret.method=basic
 quarkus.oidc-client.oauth_example.credentials.client-secret.value=secret