test

Deployment Example: Single Sign-On, Load Balancing and Failover Using Sun OpenSSO Enterprise 8.0

10.2 Installing the Session Failover Components

Install the OpenSSO Enterprise session failover components on the mq-1 host machine and the mq-2 host machine. Use the following list of procedures as a checklist for completing the task.

  1. To Install Session Failover Components on Message Queue 1

  2. To Install Session Failover Components on Message Queue 2

ProcedureTo Install Session Failover Components on Message Queue 1

  1. As a root user, log in to the mq–1 host machine.

  2. Create a directory into which the Message Queue and Berkeley Database bits can be downloaded and change into it.


    # mkdir /export/SFO
# cd /export/SFO

  3. Copy ssoSessionTools.zip from the osso–1 host machine to the mq–1 host machine.

    ssoSessionTools.zip is included in the opensso_enterprise_80.zip file downloaded in To Generate an OpenSSO Enterprise WAR on the OpenSSO Enterprise 1 Host Machine under the tools directory.

  4. Unzip ssoSessionTools.zip.


    # cd /export/SFO
# unzip ssoSessionTools.zip -d ssoSessionTools

  5. Modify the permissions on the setup script and run it to initialize the session failover tools.


    # cd /export/SFO/ssoSessionTools
# chmod +x setup
# ./setup

  6. When prompted, enter opensso as the Directory to install the scripts (example: opensso).

    Note –

    The directory location should be relative to the current directory.

    When the script is finished, the following messages are displayed:


    The scripts are properly setup under directory 
   /export/SFO/ssoSessionTools/opensso
JMQ is properly setup under directory 
   /export/SFO/ssoSessionTools/jmq

  7. Change to the bin directory.


    # cd /export/SFO/ssoSessionTools/jmq/mq/bin

  8. Run the imqbrokerd command to create a new broker instance named msgqbroker.


    # ./imqbrokerd -name msgqbroker -port 7777 &

  9. Run netstat to verify that the new Message Queue broker instance is up and running.


    # netstat -an | grep 7777

*.7777		*.*			0			0	49152		0	LISTEN

  10. Add a new user named msgquser.

    This user will connect to the Message Queue broker instance on servers where Message Queue is installed. This user will be used only for session failover purposes, and does not assume the privileges of the guest user. It is a good practice to create a custom user for such purposes, and not to rely on the known user accounts or default user accounts to help prevent brute force or DOS attacks.


    # ./imqusermgr add -u msgquser -g admin -p m5gqu5er -i msgqbroker

User repository for broker instance: msgqbroker

User msgquser successfully added.

  11. Disable the guest user.

    This step ensures that the guest user will not be able to access the OpenSSO Enterprise server.


    # ./imqusermgr update -u guest -a false -i msgqbroker

User repository for broker instance: msgqbroker

Are you sure you want to update user guest? (y/n) y

User guest successfully updated.

  12. Modify the amsfo.conf file.

    amsfo.conf has parameters that are consumed by the OpenSSO Enterprise session failover startup script, amsfo.

    1. Change to the lib directory.


      # cd /export/SFO/ssoSessionTools/opensso/config/lib
      Tip –

      Backup amsfo.conf before you modify it.

    2. Set the following properties:


      CLUSTER_LIST=mq-1.example.com:7777,mq-2.example.com:7777
BROKER_INSTANCE_NAME=msgqbroker
USER_NAME=msgquser
BROKER_PORT=7777
      Note –

      The port used for BROKER_PORT should be the same as the one used in the value of the CLUSTER_LIST.

    3. Save the file and close it.

  13. Generate an encrypted password in a .password file with the following sub procedure.

    1. Change to the bin directory.


      # cd /export/SFO/ssoSessionTools/opensso/bin

    2. Run amsfopassword.

      This command generates an encrypted password, creates a new file named .password, and stores the encrypted password in the new file.

      Caution – Caution –

      amsfopassword creates the .password file in a default location based on where the scripts were installed. If a different location is used, the PASSWORDFILE property in amsfo.conf should be changed accordingly.


      # ./amsfopassword -e m5gqu5er -f /export/SFO/ssoSessionTools/opensso/.password

os.name=SunOS
SUCCESSFUL

    3. (Optional) View the encrypted password for verification.


      # more /export/SFO/ssoSessionTools/opensso/.password

M27OGb6U4ufRu+oWAzBdWw==

  14. (Optional) Modify the amsessiondb script if necessary.

    The amsessiondb script (located in the /export/SFO/ssoSessionTools/opensso/bin directory) starts the Berkeley Database client, creates the database, and sets specific database values. It is called when the amsfo script is run for the first time. The amsessiondb script contains variables that specify default paths and directories. If any of the following components are not installed in their default directories, edit the amsessiondb script to set the variables to the correct locations.


    JAVA_HOME=/usr/jdk/entsys-j2se    
IMQ_JAR_PATH=/export/SFO/ssoSessionTools/jmq/mq/lib
JMS_JAR_PATH=/export/SFO/ssoSessionTools/jmq/mq/lib
AM_HOME=/export/SFO/ssoSessionTools
    Tip –

    Backup amsessiondb before you modify it.

  15. Restart the session failover components with the following sub procedure.

    1. Change to the bin directory.


      # cd /export/SFO/ssoSessionTools/jmq/mq/bin

    2. Stop the Message Queue instance using the product's command line interface.

      See the Message Queue documentation for more information.

    3. Run the netstat command to verify that the mq-1 broker instance is stopped.


      # netstat -an | grep 7777

      If netstat returns no result, the mq-1 broker instance is stopped.

      Tip –

      If the mq-1 broker instance is not stopped, kill the process using the following procedure.

      1. Get the Java process IDs.


        # ps -ef | grep java

      2. Kill the Java process IDs that were returned.


        # kill -9 #### ####

      3. Run netstat again.

    4. Restart the mq-1 broker instance.


      # cd /export/SFO/ssoSessionTools/opensso/bin
# ./amfso start

    5. Run the netstat command to verify that the Message Queue port is open and listening.


      # netstat -an | grep 7777

*.7777			*.*			0			0	49152			0	LISTEN

  16. Log out of the mq-1 host machine.

ProcedureTo Install Session Failover Components on Message Queue 2

  1. As a root user, log in to the mq–2 host machine.

  2. Create a directory into which the Message Queue and Berkeley Database bits can be downloaded and change into it.


    # mkdir /export/SFO
# cd /export/SFO

  3. Copy ssoSessionTools.zip from the osso–1 host machine to the mq–2 host machine.

    Note –

    ssoSessionTools.zip is included in the opensso_enterprise_80.zip file downloaded in To Generate an OpenSSO Enterprise WAR on the OpenSSO Enterprise 1 Host Machine under the tools directory.

  4. Unzip ssoSessionTools.zip.


    # cd /export/SFO
# unzip ssoSessionTools.zip -d ssoSessionTools

  5. Modify the permissions on the setup script and run it to initialize the session failover tools.


    # cd /export/SFO/ssoSessionTools
# chmod +x setup
# ./setup

  6. When prompted, enter opensso as the Directory to install the scripts (example: opensso).

    Note –

    The directory location should be relative to the current directory.

    When the script is finished, the following messages are displayed:


    The scripts are properly setup under directory 
   /export/SFO/ssoSessionTools/opensso
JMQ is properly setup under directory 
   /export/SFO/ssoSessionTools/jmq

  7. Change to the bin directory.


    # cd /export/SFO/ssoSessionTools/jmq/mq/bin

  8. Run the imqbrokerd command to create a new broker instance named msgqbroker.


    # ./imqbrokerd -name msgqbroker -port 7777 &

  9. Run netstat to verify that the new Message Queue broker instance is up and running.


    # netstat -an | grep 7777

*.7777		*.*			0			0	49152		0	LISTEN

  10. Add a new user named msgquser.

    This user will connect to the Message Queue broker instance on servers where Message Queue is installed. This user will be used only for session failover purposes, and does not assume the privileges of the guest user. It is a good practice to create a custom user for such purposes, and not to rely on the known user accounts or default user accounts to help prevent brute force or DOS attacks.


    # ./imqusermgr add -u msgquser -g admin -p m5gqu5er -i msgqbroker

User repository for broker instance: msgqbroker

User msgquser successfully added.

  11. Disable the guest user.

    This step ensures that the guest user will not be able to access the OpenSSO Enterprise server.


    # ./imqusermgr update -u guest -a false -i msgqbroker

User repository for broker instance: msgqbroker

Are you sure you want to update user guest? (y/n) y

User guest successfully updated.

  12. Modify the amsfo.conf file with the following sub procedure.

    amsfo.conf has parameters that are consumed by the OpenSSO Enterprise session failover startup script, amsfo.

    1. Change to the lib directory.


      # cd /export/SFO/ssoSessionTools/opensso/config/lib
      Tip –

      Backup amsfo.conf before you modify it.

    2. Set the following properties:


      CLUSTER_LIST=mq-1.example.com:7777,mq-2.example.com:7777
BROKER_INSTANCE_NAME=msgqbroker
USER_NAME=msgquser
BROKER_PORT=7777
      Note –

      The port used for BROKER_PORT should be the same as the one used in the value of the CLUSTER_LIST.

    3. Save the file and close it.

  13. Generate an encrypted password in a .password file with the following sub procedure.

    1. Change to the bin directory.


      # cd /export/SFO/ssoSessionTools/opensso/bin

    2. Run amsfopassword.

      This command generates an encrypted password, creates a new file named .password, and stores the encrypted password in the new file.

      Caution – Caution –

      amsfopassword creates the .password file in a default location based on where the scripts were installed. If a different location is used, the PASSWORDFILE property in amsfo.conf should be changed accordingly.


      # ./amsfopassword -e m5gqu5er -f /export/SFO/ssoSessionTools/opensso/.password

os.name=SunOS
SUCCESSFUL

    3. (Optional) View the encrypted password for verification.


      # more /export/SFO/ssoSessionTools/opensso/.password

M27OGb6U4ufRu+oWAzBdWw==

  14. (Optional) Modify the amsessiondb script if necessary.

    The amsessiondb script (located in the /export/SFO/ssoSessionTools/opensso/bin directory) starts the Berkeley Database client, creates the database, and sets specific database values. It is called when the amsfo script is run for the first time. The amsessiondb script contains variables that specify default paths and directories. If any of the following components are not installed in their default directories, edit the amsessiondb script to set the variables to the correct locations.


    JAVA_HOME=/usr/jdk/entsys-j2se    
IMQ_JAR_PATH=/export/SFO/ssoSessionTools/jmq/mq/lib
JMS_JAR_PATH=/export/SFO/ssoSessionTools/jmq/mq/lib
AM_HOME=/export/SFO/ssoSessionTools
    Tip –

    Backup amsessiondb before you modify it.

  15. Restart the session failover components.

    1. Change to the bin directory.


      # cd /export/SFO/ssoSessionTools/jmq/mq/bin

    2. Stop the Message Queue instance using the product's command line interface.

      See the Message Queue documentation for more information.

    3. Run the netstat command to verify that the mq-2 broker instance is stopped.


      # netstat -an | grep 7777

      If netstat returns no result, the mq-2 broker instance is stopped.

      Tip –

      If the mq-2 broker instance is not stopped, kill the process using the following procedure.

      1. Get the Java process IDs.


        # ps -ef | grep java

      2. Kill the Java process IDs that were returned.


        # kill -9 #### ####

      3. Run netstat again.

    4. Restart the mq-2 broker instance.


      # cd /export/SFO/ssoSessionTools/opensso/bin
# ./amfso start

    5. Run the netstat command to verify that the Message Queue port is open and listening.


      # netstat -an | grep 7777

*.7777			*.*			0			0	49152			0	LISTEN

  16. Log out of the mq-2 host machine.