IBM Bob
EnterpriseOn-premises

Accessing Bob on-premises

Connect bob-ide or bob-shell to an IBM Bob on-premises deployment by configuring certificate trust, the client endpoint, and user authentication.

Bob on-premises enables you to use Bob capabilities within your own infrastructure while maintaining control over security, identity management, and network access. Before you can use bob-ide or bob-shell, you must configure trust for the deployment certificate, connect to the appropriate service endpoint, and authenticate with your organization credentials.

Before you begin

Confirm the following with your cluster administrator before proceeding:
  • A Bob on-premises deployment is installed and operational. The Bob custom resource (CR) must report a Ready status.
    •
  • You have the Bob API endpoint URL in the format https://api.<cluster-domain>. Your administrator can retrieve this by running oc get route after installation.
    •
  • If the deployment uses a self-signed or internal certificate authority (CA), you have received the CA certificate file (for example, bob-ca.crt or bob-ca.pem).
    •
  • A user account is available for you. Your administrator has either configured LDAP or Active Directory federation, or created a direct Keycloak user account. See User management.
    •
Note:

If any prerequisite is missing, contact your cluster administrator before proceeding.

Trust the CA certificate

If the Bob deployment uses a self-signed or internally managed certificate authority, your workstation must trust the CA certificate before it can establish secure HTTPS connections to Bob services.
Note:

Skip this section if the deployment uses a publicly trusted or enterprise CA that is already trusted by your workstation.

Verify the certificate:

openssl x509 -in bob-ca.crt -noout -subject -issuer -dates

The output shows the subject and issuer fields. For a self-signed CA, these values are equal. Confirm that the notAfter date is in the future.

Import the certificate using one of the following options:

Option 1: Keychain Access

  1. Locate the bob-ca.crt file in Finder.
  2. Double-click the file. macOS opens an Add Certificates sheet.
  3. In the keychain dropdown, select System and click Add. Enter your password when prompted.
  4. Open Keychain Access, select System in the sidebar, and click Certificates.
  5. Locate the imported certificate and open its properties.
  6. Expand Trust and set When using this certificate to Always Trust.
  7. Save the changes.

After importing, quit and relaunch bob-ide.

Note:

On macOS Sequoia, if double-clicking the certificate file has no effect, rename the file to ensure it has a .crt extension and try again.

Option 2: Command line

sudo security add-trusted-cert \
  -d \
  -r trustRoot \
  -k /Library/Keychains/System.keychain \
  bob-ca.crt

Verify the certificate import:

security find-certificate -c "Bob Internal CA" \
  /Library/Keychains/System.keychain

After importing the certificate, quit and relaunch bob-ide.

Note:

If bob-ide still shows UNABLE_TO_VERIFY_LEAF_SIGNATURE after relaunching, enable the experimental system certificate setting in your bob-ide settings file:

{
  "http.experimental.systemCertificatesV2": true
}

If bob-shell still does not trust the certificate, configure Node.js to use the CA certificate:

export NODE_EXTRA_CA_CERTS="/path/to/bob-ca.crt"

Add the variable to your shell profile to make the setting persistent.

Import the CA certificate into the system trust store:

sudo cp bob-ca.crt /usr/local/share/ca-certificates/bob-ca.crt
sudo update-ca-certificates

Import the certificate into the Trusted Root Certification Authorities store using certmgr.msc, or run:

certutil -addstore "Root" bob-ca.crt

Configure the client endpoint

After your workstation trusts the deployment certificate, configure your client to communicate with the Bob API endpoint provided by your cluster administrator.

bob-ide

Configure the API gateway endpoint in your settings file:
  1. Open Settings.
    2.
  2. Click Open settings file.
    3.
  3. Specify the gateway URL:
    4.  
{
  "gatewayUrl": "https://api.<cluster-domain>"
}
  1. Save the file.
    2.

bob-shell

Configure the endpoint that bob-shell uses to connect to the Bob deployment.

Environment variables (recommended)

Add the following variables to your shell profile (for example, ~/.bashrc or ~/.zshrc) to persist them across sessions:

 
export BOB_GATEWAY_URL=https://api.<cluster-domain>
export BOB_WEB_LOGIN_URL=https://<login-domain>

Command-line options

 
bob \
  --gateway-url https://api.<cluster-domain> \
  --web-login-url https://<login-domain>
Note:
  • BOB_WEB_LOGIN_URL and --web-login-url are required only when using SSO authentication and the login URL cannot be derived automatically from the gateway URL.
  • For API key authentication, only BOB_GATEWAY_URL is required.
  • If gatewayUrl is configured in settings.json, both bob-ide and bob-shell use that value.

Sign in

After configuring the endpoint, authenticate with the Bob deployment using your assigned credentials.
  • For bob-ide, click Sign In.
    •
  • For bob-shell, run the bob command.
    •

You are redirected to your organization's authentication provider (for example, Keycloak), where you sign in using your organizational credentials.

After you authenticate successfully, you can use bob-ide or bob-shell to access the IBM Bob on-premises deployment for code generation, analysis, refactoring, and other supported development workflows.

How is this topic?

Managing entitlements

Learn how Bob on-premises uses backend and frontend entitlements to control Premium Package deployment and user access.

Installation overview

Understand the roles involved and the four phases required to install IBM Bob on-premises on Red Hat OpenShift Container Platform.

On this page

Before you beginTrust the CA certificateConfigure the client endpointbob-idebob-shellSign in