Sun Java System Application Server 9.1 High Availability Administration Guide

Chapter 4 Configuring Web Servers for Load Balancing

This chapter explains how to configure the web servers supported by the load balancer plug-in available with Application Server 9.1 and GlassFish v2. The load balancer plug-in available with Application Server 9.1 supports the following web servers:

Sun Java System Web Server 6.1 and 7.0
Apache Web Server 2.0.x
Microsoft IIS 5.0 and 6.0

Note –

GlassFish v2 supports only Sun Java System Web Server (versions 6.1 and 7.0). To use the load balancer plug-in with GlassFish v2, you need to manually install and configure the load balancer plug-in. For more information about installing the load balancer plug-in with GlassFish v2, see Chapter 1, Installing Application Server Software, in Sun Java System Application Server 9.1 Installation Guide.

The load balancer plug-in installation program, which is a part of the Application Server 9.1 installation program, makes a few modifications to the web server’s configuration files. These changes depend upon the web server you are using. In addition, for some web servers you must make manual configurations in order for the load balancer to work properly.

Note –

The load balancer plug-in can be installed either along with Sun Java System Application Server 9.1, or separately, on a machine running the supported web server. For complete details on the installation procedure, see Chapter 1, Installing Application Server Software, in Sun Java System Application Server 9.1 Installation Guide.

Configuring Sun Java System Web Server

For Sun Java System Web Server, when you install the load balancer plug-in using the Sun Java System Application Server 9.1 installation wizard, the installation wizard automatically does all the necessary configuration. No manual configuration is required. The load balancer plug-in bundled with Application Server 9.1 supports the following versions of Sun Java System Web Server:

Sun Java System Web Server 6.1
Sun Java System Web Server 7.0

But, if you are using GlassFish v2, you must download the Application Server load balancer plug-in separately from http://download.java.net/javaee5/external/SunOS_X86/aslb/jars/aslb-9.1-MS4-b7.jar and make some manual changes to set it up. For detailed steps on how to install and set up the plug-in for GlassFish v2, refer to the section To Install the Load Balancing Plug-in (standalone) in Sun Java System Application Server 9.1 Installation Guide.

To Configure Sun Java System Web Server

Before You Begin

Note –

The following steps are automatically performed by the installation program for Application Server 9.1. But, if you are using GlassFish v2, you will need to perform these steps manually.

To the web server instance's magnus.conffile, add the following lines:

##BEGIN EE LB Plug-in Parameters
Init fn="load-modules"
shlib="web-server-install-dir/plugins/lbplugin/bin/libpassthrough.so"
funcs="init-passthrough,service-passthrough,name-trans-passthrough" Thread="no"
Init fn="init-passthrough"
##END EE LB Plug-in Parameters=

Append the following line if it does not exist already:

Init fn="load-modules" shlib=".../libj2eeplugin.so" shlib_flags="(global|now)"

In the file web-server-install-dir/config/obj.conf, insert the following in a single line before the first occurrence of the string nametrans:
```
Nametrans fn="name-trans-passthrough" name="lbplugin"
config-file="web-server-install-dir/config/loadbalancer.xml"
```
The order in which NameTrans entries appear in obj.conf is very important. The installer puts the NameTrans entries in the correct location, but if you are editing obj.conf for other purposes you must ensure that the order remains correct. In particular, the load balancer info must come before the document-root function. For more information on the obj.conf file, see Sun Java System Web Server 7.0 Administrator’s Configuration File Reference.

Append the following lines to the file web-server-install-dir/config/obj.conf:

<Object name = "lbplugin"> 
ObjectType fn="force-type" type="magnus-internal/lbplugin"
PathCheck fn="deny-existence" path="*/WEB-INF/*"
Service type="magnus-internal/lbplugin" fn="service-passthrough"
Error reason="Bad Gateway" fn="send-error" uri="$docroot/badgateway.html"
</Object>

Edit the web-server-install-dir/start script to update the LD_LIBRARY_PATH value to include app-server-install-dir/lib/lbplugin/lib.

The app-server-install-dir/lib/lbplugin/lib directory contains binaries that the load balancer plug-in requires.

(Optional) For the new DAS-based Load Balancer Administration, configure the web server for SSL.

For detailed instructions for Web Server 6.1 , see To Set Up the Load Balancer in SSL Mode for Sun Java System Web Server 6.1.

For detailed instructions for Web Server 7, see Setting up the Load Balancer in SSL Mode for Web Server 7.

If the web server is not already running, start the web server.

Configuring Sun Java System Web Server to Use Auto Apply

Auto Apply is a feature provided by Application Server 9.1 to send the load balancer configuration automatically over the wire to the web server configuration directory. For more information about this feature, see Auto Apply. The following procedures explain how to configure Sun Java System Web Server (versions 6 and 7) to use this feature.

To Set Up the Load Balancer in SSL Mode for Sun Java System Web Server 6.1

Note –

You need to perform the steps in this section only if you want to use the Auto Apply feature of the load balancer plug-in. This feature helps to send the load balancer configuration automatically over the wire to the web server configuration directory.

Using a browser, access the Admin Console of Web Server and login.

Select your server instance and click on Manage.

Click on the Security tab.

Initialize the trust database by giving the username and password. This could be done using either the certutil command or the GUI. The following options of the certutil command could be used to initialize the trust database:
```
certutil -N -P  "https-instance-name-hostname-" -d .
```
- When prompted by certutil, enter the password to encrypt your keys. Enter a password, which will be used to encrypt your keys. The password should be at least eight characters long, and should contain at least one non-alphabetic character.
- When prompted to enter a new password, specify your password.

Create a sample local Certificate Authority (CA) using the following command:
```
certutil -S -P "https-boqueron.virkki.com-boqueron-" 
-d . -n SelfCA -s "CN=Self CA,OU=virkki.com,C=US" 
-x -t "TC,TC,TC" -m 101 -v 99 -5
```
1. When prompted to enter 0-7 for the type of certificate, type 5 for SSL CA. When the prompt reappears, specify 9.
2. When queried “Is this a critical extension [y/n]?,” specify “y.”

Use the above sample CA to generate a certificate
```
certutil -S -P "https-instance-name-hostname-"
-d . -n MyServerCert -s "CN=boqueron.virkki.com,C=US"
-c SelfCA -t "u,u,u" -m 102 -v 99 -5
```
1. When prompted to enter 0-7 for the type of certificate, type 1 for SSL Server. When the prompt reappears, specify 9.
2. When queried “Is this a critical extension [y/n]?,” specify “y.”

Create an HTTPS listener as explained in the following steps:
1. Log on to the web server's Administration Server.
2. Select a server and click Manage.
3. Click Add Listen Socket. In the Add Listen Socket page, do the following:
  1. Specify a port number.
  2. Ensure that the fully qualified domain name (FQDN) of the server is specified for the Server Name. For example, if the host name is machine1, and the domain name is server.example.com, then the FQDN is machine1.server.example.com.
  3. Select Enable from the Security drop-down list.
  4. Click OK.
4. Go to Edit Listen Sockets page and select the Listen Socket that you just created.
5. In the Listen Socket page, verify if the Server Certificate name is the same as the certificate name that you provided in Step 6.

To Export and Import the DAS Certificate for Sun Java System Web Server 6.1

If you are using Application Server 9.1, export the DAS certificate by executing the command:
```
<appserver_install_dir>/lib/upgrade/pk12util -d <domain root>/config -o sjsas.p12-W
<file password> -K <master password> -n s1as
```
- If you are using GlassFish v2, you must use the following commands to export the DAS certificate:
```
<JAVA_HOME>/bin/keytool -export -rfc -alias s1as -keystore
<GLASSFISH_HOME>/domains/<DOMAIN_NAME>/config/keystore.jks-file s1as.rfc
```
  where, <GLASSFISH_HOME> indicates the Application Server installation directory and <DOMAIN_NAME> refers to the domain whose certificate is being exported.
- Copy the certificate file to the web server configuration directory.

Import the DAS certificate.
- If you are using Application Server 9.1, import the DAS certificate into the Web Server instance using the following commands:
```
<webserver_install_dir>/bin/https/admin/bin/pk12util-i sjsas.p12 -d 
<webserver_install_dir>/alias -W<file password> -K <webserver security db password> -P
<instance-name>-<hostname>-
```
```
<webserver_install_dir>/bin/https/admin/bin/certutil -M -n s1as -t "TCu"
-d <webserver_install_dir>/alias -P <instance-name>-<hostname>-
```
  These commands make the Application Server CA a trusted CA to sign both client and server certificates.
- If you are using GlassFish v2, import the DAS certificate from the rfc file created using certutil, the NSS security tool.
```
<webserver_install_dir>/bin/certutil -A -a -n s1as -t "TCu" -i s1as.rfc 
-d <webserver_install_dir>/alias -P <instance-name>-<hostname>-
```
  You can check the presence of this certificate by using the following command, which would list the s1as certificate along with other CA certificates including the default server certificate. Ensure that you type the command in a single line.
```
<WS_INSTALL_ROOT>/bin/certutil -L 
-d <webserver_install_dir>/alias -P <instance-name>-<hostname>-
```

If obj.conf does not contain the following lines, please append them at the end of the file. (If you are using Application Server 9.1, this step is automatically performed by the installation program.)

<Object ppath="*lbconfigupdate*">
PathCheck fn="get-client-cert" dorequest="1" require="1"
<Object>
<Object ppath="*lbgetmonitordata*">
PathCheck fn="get-client-cert" dorequest="1" require="1"
</Object>

You can verify the above set up from the DAS using the steps provided in the section Verifying the Setup. Instead of using the local CA, you can use any other CA and server certificate. In that case you can skip steps 5 and 6 listed in the previous section, but need to import the server certificate that you obtained from other CAs.

Setting up the Load Balancer in SSL Mode for Web Server 7

Start the Web Server's Administration Server using the following command.
```
webserver-install-dir/admin_server/bin/startserv
```
Create an HTTPS listener as explained in the following steps. If an HTTP listener already exists, you can skip the following steps and proceed to the section To Export and Import the DAS Certificate for Sun Java System Web Server 7.
1. Log in to Web Server Admin console.
2. Select the default configuration. Generally, the default configuration name will be identical to the host name. To do this from the Common Tasks page, select the configuration from the Select Configurations list and click Edit Configuration. Alternatively, open the Configurations page and click on the default configuration name in Configurations table.
3. If you are in the Common Tasks page, click Request Server Certificate. Else, if you are in the Configuration page, open the Certificates page and click the Request button from the Server Certificates table. This is required to create a self signed server certificate for this default configuration.
4. Provide the details requested by the Request Server Certificate window.
  
  While doing so, just ensure that the value provided for "*Server Name (cn)" is the fully qualified domain name (FQDN) of the machine where the web server is installed. For example, if the host name is machine1, and the domain name is server.example.com, then the FQDN is machine1.server.example.com. Select the defaults wherever provided.
  
  You can also create a self-signed certificate using the following command. Make sure that you type the command in a single line.
```
webserver-install-dir/bin/wadm create-selfsigned-cert --user=
admin-user --server-name=host-name 
--nickname=ServerCert --token=internal --config=config-name
```
5. Go back to the selected configuration page.
6. Open the HTTP Listeners page and click the New button. This is to create an SSL-enabled HTTP listener.
7. Provide the details sought by the New HTTP Listener wizard. Ensure that the server name is the FQDN provided in the earlier step. Select the SSL button and from the Certificate list, select the previously created server certificate. For example, cert-machine1.server.example.com.
  
  You can also create an HTTP listener using the following commands. Make sure that you type each command in a single line.
```
webserver-install-dir/bin/wadm create-http-listener 
--user=admin-user --server-name=host-name 
--default-virtual-server-name=default-virtual-server-name 
--listener-port=8090 --config=config-name http-listener-ssl
```
```
webserver-install-dir/bin/wadm set-ssl-prop 
--user=admin-user --http-listener=http-listener-ssl 
--config=config-name enabled=true server-cert-nickname=ServerCert
```
8. Once you have performed the steps listed above, you would see the alert “Deployment Pending” on the top right corner of the Admin console. Click on it and follow the instructions to complete the deployment. This step ensures that the changes to the config store in the web server's Administration Server are copied to the web server instance.

To Export and Import the DAS Certificate for Sun Java System Web Server 7

By exporting and importing the DAS certificate, you can make the DAS a trusted client of Web Server. Client authentication using a DAS certificate ensures that only the DAS connects to Web Server as a trusted client.

Open a terminal window and set the LD_LIBRARY_PATH using the following command:
```
export LD_LIBRARY_PATH=/opt/SUNWappserver/lib
```

Export the DAS certificate.
- If you are using Application Server 9.1, export the DAS certificate by executing the command. The DAS certificate acts as both the server certificate as well as the client certificate.
```
<appserver_install_dir>/lib/upgrade/pk12util -d <domain root>/config -o s1as.p12 -W
<s1as.pk12-file-password> -K <master password> -n s1as
```
- If you are using GlassFish v2, export the DAS certificate, named with the alias “s1as” using the Java SE 5.0 security tool called keytool. While doing so, select the -rfc option to export the certificate in the printable encoding format, as defined by the Internet RFC 1421 standard.
  
  From the command line, you can use the following commands to export the DAS certificate:
```
<JAVA_HOME>/bin/keytool -export -rfc -alias s1as -keystore
<GLASSFISH_HOME>/domains/<DOMAIN_NAME>/config/keystore.jks-file s1as.rfc
```
  where, <GLASSFISH_HOME> indicates the Application Server installation directory and <DOMAIN_NAME> refers to the domain whose certificate is being exported.

After exporting, copy the certificate file to the web server configuration directory.

Import the DAS certificate.
- If you are using Application Server 9.1, import the DAS certificate into the Web Server instance and set the trust attributes for the certificate using the following commands:
```
<webserver_install_dir>/bin/pk12util -i <path_to_s1as.pk12-file> 
-d <webserver_install_dir>/admin-server/config-store/<default-config-name>/config 
-K <webserver security db password> -W <s1as.pk12-file-passwd>
```
```
<webserver_install_dir>/bin/certutil -M -n s1as -t "TCu" 
-d <webserver_install_dir>/admin-server/config-store/<default-config-name>/config
```
  These commands make the Application Server CA be a trusted CA to sign both client and server certificates.
- If you are using GlassFish v2, import the DAS certificate from the rfc file created using certutil, the NSS security tool.
```
<webserver_install_dir>/bin/certutil -A -a -n s1as -t "TCu" -i s1as.rfc -d
<webserver_install_dir>/admin-server/config-store/<CONFIG_NAME>/config
```
  where, <webserver_install_dir> refers to the web server installation directory and <CONFIG_NAME> refers to the configuration name created for the default web server instance.
  
  You can check the presence of this certificate by using the following command, which would list the s1as certificate along with other CA certificates including the default server certificate. Make sure that you type the entire command in a single line.
```
<webserver_install_dir>/bin/certutil -L -d
<webserver_install_dir>/admin-server/config-store/
<DEFAULT_CONFIG_NAME>/config
```
  You can also use the Web Server Admin Console to view this. Select the configuration to which the certificate has been imported to (default config, in this case), and then select the Certificates tab. To look at all the certificates available, select the Certificate Authorities sub tab.

Make the following configuration changes to Web Server 7 if you are using GlassFish v2. You can skip to the next step if you are using Application Server 9.1.
1. Append the following lines to obj.conffile located at <WS_INSTALL_ROOT>/admin-server/config-store/<DEFAULT_CONFIG_NAME>/config/. Make sure that you type in these lines without any trailing spaces.
```
 <Object ppath="*lbconfigupdate*">
 PathCheck fn="get-client-cert" dorequest="1" require="1"
</Object>
<Object ppath="*lbgetmonitordata*">
 PathCheck fn="get-client-cert" dorequest="1" require="1"
</Object>
```

Deploy the configuration. While doing the changes listed in the previous steps, the Admin Console would mark this configuration to be deployed.
1. Select the icon for Deployment Pending in the Web Server Admin Console. You can also deploy this configuration using the CLI utility wadm as follows:
```
<webserver_install_dir>/bin/wadm deploy-config --user=<admin> <DEFAULT_CONFIG_NAME>
```

Test this setup from the GlassFish DAS to see if it communicates with the configured HTTP Load Balancer over SSL. For more information, see Verifying the Setup.

Using Apache Web Server

The load balancer plug-in bundled with Application Server 9.1 supports Apache Web Server 2.0.x. To use Apache Web Server, you must perform certain configuration steps before and after installing the load balancer plug-in. The load balancer plug-in installation also makes additional modifications to the Apache Web Server. After the plug-in is installed, you must perform additional configuration steps.

Note –

Apache 2 has multithreaded behavior if compiled with the --with-mpm=worker option.

Requirements for Using Apache Web Server

For the Apache Web Server, your installation must meet the minimum requirements.

With Apache, the load balancer plug-in requires:

openssl-0.9.7e (source)
httpd-2.0.59 (source)
gcc-3.3-sol9-sparc-local packages (for Solaris 9 SPARC).
gcc-3.3-sol9-intel-local packages (for Solaris 9 x86)
The pre-installed gcc (for Solaris 10)
flex-2.5.4a-sol9-sparc-local packages (for Solaris 9 SPARC)
flex-2.5.4a-sol9-intel-local packages (for Solaris 9 x86)
The pre-installed flex (for Solaris 10)

The software sources are available at http://www.sunfreeware.com

In addition, before compiling Apache:

On the Linux platform, install Sun Java System Application Server on the same machine.
On the Solaris 9 operating system, use pkgadd to install gcc and flex. Note that pkgadd requires root access.
On the Solaris 9 operating system, ensure that gcc version 3.3 and make are in the PATH, and flex is installed.
On the Solaris 10 operating system, before running make for OpenSSL, run mkheaders, located in /usr/local/lib/gcc-lib/sparc-sun-solaris2.9/3.3/install-tools on Solaris SPARC or /usr/local/lib/gcc-lib/i386-pc-solaris2.9/3.3/install-tools on Solaris x86.
If you are using gcc on Red Hat Enterprise Linux Advanced Server 2.1, the version must be later than gcc 3.0.

Note –

To use a C compiler other than gcc, set the path of the C compiler and make utility in the PATH environment variable.

Applying the Apache Web Server Patch

Before installing the load balancer plug-in for Apache, apply the patch for the Apache Web Server issue 12355. More details about this issue are available at http://issues.apache.org/bugzilla/show_bug.cgi?id=12355. This patch is required for the Auto Apply feature to work. To apply the patch, follow these steps.

Untar http-2.0.59.tar and go to the directory httpd-2.0.59.
Download the patch from http://issues.apache.org/bugzilla/attachment.cgi?id=16495 and save it as a file, for example, 12355.diff.
From the directory httpd-2.0.59/modules/ssl, run the following command:
```
patch < 12355.diff
```

Configuring Apache before Installing the Load Balancer Plug-in

The Apache source must be compiled and built to run with SSL. This section describes the minimum requirements and high-level steps needed to successfully compile Apache Web Server to run the load balancer plug-in. These requirements and steps only apply to the Solaris and Linux versions of the software. For information on the Windows version of Apache, see the Apache web site.

Note –

The instructions included here are adapted from the instructions at http://httpd.apache.org/docs. For detailed instructions on installing SSL-aware Apache, please see that web site.

To Install SSL-aware Apache

Before You Begin

You must have already downloaded and uncompressed the Apache software.

Download and unpack the OpenSSL source, available at http://openssl.org.

Compile and build OpenSSL.

For full installation instructions, see the file named INSTALL in the directory where you uncompressed OpenSSL. That file has information on installing OpenSSL in a user-specified location.

For more information about OpenSSL, see the http://www.openssl.org/.

Download and unpack Apache.

Apache is available from http://httpd.apache.org.

Compile and build Apache. Configure the source tree:
1. cd http-2.0_x.
2. Run the following command:
  
  ./configure --with-ssl= OpenSSL-install-path --prefix= Apache-install-path --enable-ssl --enable-so
  
  In the above commands, x is the Apache version number, open-ssl-install-path is the absolute path to directory where OpenSSL is installed, and Apache-install-path is the directory in which to install Apache.
  
  Note that you only need to use the --enable-ssl --enable-so options if your Apache 2 server will be accepting HTTPS requests.

For Apache on Linux 2.1, before compiling:
1. Open src/MakeFile and find the end of the automatically generated section.
2. Add the following lines after the first four lines after the automatically generated section:
```
LIBS+= -licuuc -licui18n -lnspr4 -lpthread -lxerces-c 
-lsupport -lnsprwrap -lns-httpd40
LDFLAGS+= -L/application-server-install-dir/lib -L/opt/sun/private/lib
```
  Note that -L/opt/sun/private/lib is only required if you installed Application Server as part of a Java Enterprise System installation.
  
  For example:
```
## (End of automatically generated section)
## 
CFLAGS=$(OPTIM) $(CFLAGS1) $(EXTRA_CFLAGS)
LIBS=$(EXTRA_LIBS) $(LIBS1)
INCLUDES=$(INCLUDES1) $(INCLUDES0) $(EXTRA_INCLUDES)
LDFLAGS=$(LDFLAGS1) $(EXTRA_LDFLAGS)
"LIBS+= -licuuc -licui18n -lnspr4 -lpthread 
-lxerces-c -lsupport -lnsprwrap -lns-httpd40
LDFLAGS+= -L/application-server-install-dir /lib -L/opt/sun/private/lib
```
3. Set environment variable LD_LIBRARY_PATH.
  
  With stand–alone installations, set it to the Application Server: as-install/lib
  
  With Java Enterprise System installations, set it to the Application Server: as-install/lib:opt/sun/private/lib.
  
  If you are using Solaris 9, add /usr/local/lib to the LD_LIBRARY_PATH.

Compile Apache as described in the installation instructions for the version you are using.

For more information, see the http://httpd.apache.org/

In general, the steps are:
1. make
2. make install

Make sure Apache's ssl.conf and httpd.conf files contain the correct values for your environment.
- In ssl.conf, for VirtualHost default:port replace the default hostname and port with the hostname of the local system where Apache is installed and the server's port number.
  
  Without this change, the load balancer will not work. On Solaris Apache may not start and on Linux, HTTPS requests may not work.
- In ssl.conf, for ServerName www.example.com:443, replace www.example.com with the hostname of the local system where Apache is installed.
  
  Without this change, the following warning appears when you start Apache if a security certificate is installed:
  [warn] RSA server certificate CommonName (CN) hostname does NOT match server name!
  For more information on installing certificates for Apache, see To Create a Security Certificate for Apache .
- In httpd.conf, for ServerName www.example.com:80, replace www.example.com with the hostname of the local system where Apache is installed.
  
  Without this change, you see warnings when you start Apache that the system could not determine the server's fully qualified domain name, and that there are overlapping VirtualHost entries.

Ensure that the Apache user has the required access permissions to the apache-install-location/conf/ directory and files in this directory.

The Apache user is the UNIX user under which the Apache server responds to requests. This user is defined in the file httpd.conf.

If you installed Apache as a root user, read the note about configuring the Apache user and group in apache-install-location/conf/httpd.conf.

Note –
Ensure that your configuration of users and groups meets the security requirements for this directory. For example, to restrict access to this directory, add the Apache user to the same user group as the owner of the directory.
1. To ensure that the Auto Apply feature operates correctly, grant the Apache user read access, write access, and execute access to the apache-install-location/conf/ directory.
  - If the Apache user is in the same group as the owner of this directory, change the mode to 775.
  - If the Apache user is in a different group than the owner of this directory, change the mode to 777.
2. To ensure that the load balancer plug-in is initialized when Apache is started, grant the Apache user read access and write access to the following files:
  - apache-install-location/conf/loadbalancer.xml
  - apache-install-location/conf/sun-loadbalancer_1_2.dtd

Exporting and Importing the DAS Certificate

You must manually export the DAS certificate using the following command:

appserver-install-dir/lib/upgrade/certutil -L -d appserver-instance-dir/config -n s1as -a -o sjsas.crt

This certificate will be required at the time of installing the load balancer plug-in.

The Application Server 9.1 installation program performs the following tasks for you.

Imports the DAS certificate by copying sjsas.crt to the apache-install-dir/conf/ssl.crt directory.

Appends the following lines to httpd.conf.

<Location /lbconfigupdate>
SSLVerifyClient require
SSLVerifyDepth 1
SSLRequireSSL
SSLCACertificateFile apache-install-dir//conf/ssl.crt/sjsas.crt
SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
and %{SSL_CLIENT_S_DN_O} eq "Sun Microsystems" \
and %{SSL_CLIENT_S_DN_OU} eq "Sun Java System Application Server" \
and %{SSL_CLIENT_M_SERIAL} eq "<*serial number*>" )
</Location>
<Location /getmonitordata>
SSLVerifyClient require
SSLVerifyDepth 1
SSLRequireSSL
SSLCACertificateFile apache-install-dir/conf/ssl.crt/sjsas.crt
SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
and %{SSL_CLIENT_S_DN_O} eq "Sun Microsystems" \
and %{SSL_CLIENT_S_DN_OU} eq "Sun Java System Application Server" \
and %{SSL_CLIENT_M_SERIAL} eq "<*serial number*>" )
</Location>

Modifications Made by the Load Balancer Plug-in Installer

The load balancer plug-in installation program extracts the necessary files to the modules directory in the web server’s root directory:

It adds the following entries to the web server instance’s httpd.conf file:

##BEGIN EE LB Plugin Parameters
LoadModule apachelbplugin_module modules/mod_loadbalancer.so
#AddModule mod_apache2lbplugin.cpp
<IfModule mod_apache2lbplugin.cpp> 
  config-file webserver-instance/httpd/conf/loadbalancer.xml
  locale en
</IfModule>
<VirtualHost machine-ip-address
  DocumentRoot "webserver-instance/httpd/htdocs"
  ServerName server-name
</VirtualHost>
##END EE LB Plugin Parameters

Configuring Apache After Installing the Load Balancer Plug-In

Apache Web Server must have the correct security files to work with the load balancer plug-in. The load balancer depends on the NSS (Network Security Service) library, which requires these security database files. You need to get these security database files from Application Server, so an installation of Application Server must be available in a location accessible by the Web Server.

To configure Apache security files to work with the load balancer, do the following:

Append /usr/lib/mps to LD_LIBRARY_PATH in the Apache-install-dir/bin/apachectl script.

To Create a Security Certificate for Apache

These steps are required to support HTTPS requests on Apache.

For detailed information on setting up a security certificate on Apache, see the instructions on http://httpd.apache.org/docs/2.2/ssl/ssl_faq.html and http://www.modssl.org/docs/2.8/ssl_faq.html. The following procedure is adapted from those web sites.

Set up the following environment variable:

OPENSSL_CONF=OpenSSL-installation-directory/apps/openssl.cnf.

Create the server certificate and key by executing the following command:

openssl req -new -x509 -keyout newreq.pem -out newreq.pem -days 365

When asked for a common name, give the host name on which you plan to run Apache. For all other prompts, enter values that meet any specific requirements you have.

This command creates newreq.pem.

Open the newly-created newreq.pem from the location where the openssl command was run.

Copy the lines beginning with BEGIN CERTIFICATE and ending with END CERTIFICATE and paste them in Apache-install-dir/conf/ssl.crt/server.crt. For example:
-----BEGIN CERTIFICATE----- .... ... -----END CERTIFICATE-----

Copy the lines beginning with BEGIN RSA PRIVATE KEY and END RSA PRIVATE KEY and paste them in Apache-install-dir/conf/ssl.key/server.key. For example:
-----BEGIN RSA PRIVATE KEY----- ... ... ... -----END RSA PRIVATE KEY-----

Make sure that the variables SSLCertificateKeyFileand SSLCertificateFile in Apache-install-dir/conf/ssl.conf have the correct values.

Ensure that the ServerName is not www.example.com. The ServerName should be the actual host name where Apache will run, matching the Common Name you entered when creating the server certificate and key.

Modifying httpd.conf parameters to enable sticky round robin

For the sticky round robin feature to work, in the httpd.conf file, under the section prefork MPM, ensure that the values of the parameters StartServers and maxclients are set to 1. Otherwise, every new session request will spawn a new Apache process and the load balancer plug-in will be initialized resulting in requests landing in the same instance.

Starting Apache on Solaris and Linux

In general, you should start Apache with the same user that installed the Application Server. You must start Apache as root under the following circumstances:

If you are a Java Enterprise System user.
If you've used port numbers which are less than 1024.
If Apache runs as a different user from the user that starts it.

To start Apache in SSL mode, use one of the following commands:

apachetl startssl or apachetl -k start -DSSL

If needed, check the Apache web site for the latest information on starting the Apache server.

Verifying the Setup

Install the load balancer plug-in. For detailed steps to install the plug-in, see Sun Java System Application Server 9.1 Installation Guide. During the installation, provide the path to the DAS certificate.
Log in to the Application Server Admin Console and create a new cluster. For steps to create a new cluster, refer to the Admin Console Online Help.
Create a new HTTP Load Balancer. While creating the load balancer, specify the FQDN of the web server host as the device host name, web server SSL Port as the device port and select the cluster you created in the previous step as the target. For detailed steps to create a new HTTP Load Balancer, refer to the Admin Console Online Help.
To verify that the communication between the DAS and the web server is working properly, in the Admin Console, navigate to the HTTP Load Balancers node and click the HTTP Load Balancer. In the Load Balancer Device Settings page that appears, press the Test Connection button.

If you have not enabled the Automatically Apply Changes option while creating a load balancer, then you must manually export the load balancer configuration by going to the Export tab and clicking Apply Changes now.
If the test connection fails, be sure to check the Application Server domain logs and the web server logs to troubleshoot the problem. Also check if all the configuration steps have been performed correctly.

Using Microsoft IIS

To use Microsoft Internet Information Services (IIS) with the load balancer plug-in, follow the steps provided in these sections.

To Configure Microsoft IIS to use the Load Balancer Plug-in

Open the Internet Services Manager.

Select the web site for which you want to enable the plug-in.

This web site is typically named the Default Web Site.

Right click on the web site and select Properties to open the Properties notebook.

Add a new ISAPI filter, following these steps:
1. Open the ISAPI Filters tab.
2. Click Add.
3. In the Filter Name field, enter Application Server
4. In the Executable field, type C:\Inetpub\wwwroot\sun-passthrough\sun-passthrough.dll. This path will always be IIS_ROOT\wwwroot\sun-passthrough\sun-passthrough.dll even if the default web site has been deleted (which is a common action on IIS).
5. Click OK, and close the Properties notebook.

Create and configure a new virtual directory:
1. Right click on the default web site, select New, and then Virtual Directory.
  
  The Virtual Directory Creation Wizard opens.
2. In the Alias field, type sun-passthrough .
3. In the Directory field, type C:\Inetpub\wwwroot\sun-passthrough.
4. Check the Execute Permission checkbox.
  
  Leave all other permission-related check boxes are left unchecked.
5. Click Finish.

Add the path of the sun-passthrough.dll file, the Application Server as-install/bin and the Application Server as-install/lib to the system’s PATH environment variable.

For IIS 6.0 users, configure the Load Balancer Web Service Extension to run in IIS 6 using the following steps:
1. In the IIS manager, expand the local computer, and click Web Service Extensions.
2. In the Tasks pane, select Add a new Web Service Extension.
3. Enter the name of the Extension as Sun-Passthrough and click Add.
4. Type the path to sun-passthrough.dll, C:\Inetpub\wwwroot\sun-passthrough.
5. Click OK.
6. Select Set extension status to Allowed.

For IIS 6.0 users, create the file C:\inetput\wwwroot\sun-passthrough\lb.log and give NTFS write and modify permissions to the group IIS_WPG on the file.

Because IIS 6.0 runs in Worker Process Isolation Mode, it runs the IIS server with the security privileges of the group IIS_WPG.

For all IIS users, restart the machine.

Verify that the web server, load balancer plug-in, and Application Server are operating correctly.

Type the following in a web browser to access the web application context root: http://web-server-name/web-application, where web-server-name is the host name or IP address of the web server and web-application is the context root that you listed in the C:\Inetpub\wwwroot\sun-passthrough\sun-passthrough.properties file.

Tip –
The ISAPI filter status should be green. To check the filter status, access the web site's Properties notebook and click the ISAPI Filters tab. If the status is not green, try sending any HTTP request to the IIS HTTP port. It is OK if the request fails. Recheck the ISAPI filter status.

Automatically configured sun-passthrough properties

The installer automatically configures the following properties in sun-passthrough.properties. You can change the default values.

Property	Definition	Default Value
`lb-config-file`	Path to the load balancer configuration file	`IIS-www-root\sun-passthrough\loadbalancer.xml`
`log-file`	Path to the load balancer log file	`IIS-www-root\sun-passthrough\lb.log`
`log-level`	Log level for the web server	INFO

Note –

The Auto Apply feature of Application Server 9.1 is not currently supported with IIS.