test

Sun GlassFish Enterprise Server v2.1.1 High Availability Administration Guide

Configuring Sun Web Server

For Sun Web Server, when you install the load balancer plug-in using the installation wizard, the installation wizard automatically does all the necessary configuration. No manual configuration is required. The load balancer plug-in bundled with Enterprise Server supports the following versions of Sun Web Server:

But, if you are using GlassFish v2.1 or the Enterprise Server without HADB bundle, you must download the load balancer plug-in separately from http://download.java.net/javaee5/external/SunOS_X86/aslb/jars/ and make some manual changes to set it up. For detailed steps on how to install and set up the plug-in, refer to the Sun GlassFish Enterprise Server v2.1.1 Installation Guide.

ProcedureTo Configure Sun Web Server

Before You Begin
Note –

The following steps are automatically performed by the installation program for Enterprise Server. But, if you are using GlassFish v2.1, you will need to perform these steps manually.

  1. To the web server instance's magnus.conffile, add the following lines:

    ##BEGIN EE LB Plug-in Parameters
Init fn="load-modules"
shlib="web-server-install-dir/plugins/lbplugin/bin/libpassthrough.so"
funcs="init-passthrough,service-passthrough,name-trans-passthrough" Thread="no"
Init fn="init-passthrough"
##END EE LB Plug-in Parameters=

  2. Append the following line if it does not exist already: 

    Init fn="load-modules" shlib=".../libj2eeplugin.so" shlib_flags="(global|now)"

  3. In the file web-server-install-dir/config/obj.conf, insert the following in a single line before the first occurrence of the string nametrans:

    Nametrans fn="name-trans-passthrough" name="lbplugin"
config-file="web-server-install-dir/config/loadbalancer.xml"

    The order in which NameTrans entries appear in obj.conf is very important. The installer puts the NameTrans entries in the correct location, but if you are editing obj.conf for other purposes you must ensure that the order remains correct. In particular, the load balancer info must come before the document-root function. For more information on the obj.conf file, see Sun Java System Web Server 7.0 Administrator’s Configuration File Reference on docs.sun.com.

  4. Append the following lines to the file web-server-install-dir/config/obj.conf:

    <Object name = "lbplugin"> 
ObjectType fn="force-type" type="magnus-internal/lbplugin"
PathCheck fn="deny-existence" path="*/WEB-INF/*"
Service type="magnus-internal/lbplugin" fn="service-passthrough"
Error reason="Bad Gateway" fn="send-error" uri="$docroot/badgateway.html"
</Object>

  5. Edit the web-server-install-dir/start script to update the LD_LIBRARY_PATH value to include app-server-install-dir/lib/lbplugin/lib.

    The app-server-install-dir/lib/lbplugin/lib directory contains binaries that the load balancer plug-in requires.

  6. (Optional) For the new DAS-based Load Balancer Administration, configure the web server for SSL.

    For detailed instructions for Web Server 6.1 , see To Set Up the HTTP Load Balancer in SSL Mode for Sun Web Server 6.1.

    For detailed instructions for Web Server 7, see To Set up the HTTP Load Balancer in SSL Mode for Sun Web Server 7 .

  7. If the web server is not already running, start the web server.

Configuring Sun Java System Web Server to Use Auto Apply

Auto Apply is a feature provided by Enterprise Server 9.1 to send the load balancer configuration automatically over the wire to the web server configuration directory. The following procedures explain how to configure Sun Java System Web Server (versions 6 and 7) to use this feature.

ProcedureTo Set Up the HTTP Load Balancer in SSL Mode for Sun Web Server 6.1

Note –

You need to perform the steps in this section only if you want to use the Auto Apply feature of the load balancer plug-in. This feature helps to send the load balancer configuration automatically over the wire to the web server configuration directory.

  1. Using a browser, access the Admin GUI of Web Server and login.

  2. Select your server instance and click on Manage.

  3. Click on the Security tab.

  4. Initialize the trust database by giving the username and password. This could be done using either the certutil command or the GUI. The following options of the certutil command could be used to initialize the trust database:

    certutil -N -P  "https-instance-name-hostname-" -d .

    • When prompted by certutil, enter the password to encrypt your keys. Enter a password, which will be used to encrypt your keys. The password should be at least eight characters long, and should contain at least one non-alphabetic character.

    • When prompted to enter a new password, specify your password.

  5. Create a sample local Certificate Authority (CA) using the following command:

    certutil -S -P "https-boqueron.virkki.com-boqueron-" 
-d . 
-n SelfCA -s "CN=Self CA,OU=virkki.com,C=US" 
-x -t "CT,CT,CT" 
-m 101 -v 99 -5

    1. When prompted to enter 0-7 for the type of certificate, type 5 for SSL CA. When the prompt reappears, specify 9.

    2. When queried “Is this a critical extension [y/n]?,” specify “y.”

  6. Use the above sample CA to generate a certificate

    certutil -S -P "https-instance-name-hostname-"
-d . -n MyServerCert -s "CN=boqueron.virkki.com,C=US"
-c SelfCA -t "u,u,u" -m 102 -v 99 -5

    1. When prompted to enter 0-7 for the type of certificate, type 1 for SSL Server. When the prompt reappears, specify 9.

    2. When queried “Is this a critical extension [y/n]?,” specify “y.”

  7. Edit the current HTTP Listener socket by clicking on Preferences->Edit Listen Socket. Enable the security and choose the certificate created in the previous step.

    If you wish to not use the GUI, change the entry to read as follows : Change the tag so that the value of security is "true." The tag must be altered to contain additional body content and a closing tag. Be sure to remove carriage returns when adding the tag. 

    LS id="ls1" port="80" servername="$DEPLOY-INSTANCE" 
defaultvs="https-$DEPLOY-INSTANCE" ip="any" security="true" 
acceptorthreads="1" blocking="false"> 
<SSLPARAMS servercertnickname="$HOST-DOMAIN" ssl2="off"
ssl2ciphers="-rc4,-rc 4export,-rc2,-rc2export,-desede3,-des" 
ssl3="on"
tls="on"
ssl3tlsciphers="-rsa_rc4_128_sha,+rsa_rc4_128_md5,-rsa_rc4_56_sha,-rsa_rc4_40_md5
+rsa_3des_sha,+rsa_des_sha,-rsa_des_56_sha,-rsa_rc2_40_md5,
-rsa_null_md5,-fortezza,-fortezza_rc4_128_sha,-fortezza_null,
+fips_3des_sha,-fips_des_sha" tlsrollback="on" 
clientauth="off"/>
</LS>

ProcedureTo Export and Import the DAS Certificate for Sun Web Server 6.1

  1. If you are using Enterprise Server with HADB, export the DAS certificate by executing the command:

    <as home>/lib/upgrade/pk12util -d <domain root>/config -o sjsas.p12-W
<file password> -K <master password> -n s1as

    • If you are using GlassFish v2.1 or Enterprise Server without HADB bundle, you must use the following commands to export the DAS certificate:

      <JAVA_HOME>/bin/keytool -export -rfc -alias s1as -keystore
<GLASSFISH_HOME>/domains/<DOMAIN_NAME>/config/keystore.jks-file s1as.rfc

      where, <GLASSFISH_HOME> indicates the Application Server installation directory and <DOMAIN_NAME> refers to the domain whose certificate is being exported.

    • Copy the certificate file to the web server configuration directory.

  2. If you are using Enterprise Server with HADB bundle, import the DAS certificate into the Web Server instance using the following commands:

    <webserver home>/bin/https/admin/bin/pk12util-i sjsas.p12-d <webserver
home>/alias -W<file password> -K <webserver security db password> -P
<instance-name>-<hostname>-
    <webserver home>/bin/https/admin/bin/certutil -M -n s1as -t "TCu,Cu,Tuw"
-d alias -P <instance-name>-<hostname>-

    This command makes the Application Server CA be a trusted CA to sign both client and server certificates.

    • If you are using GlassFish v2.1 or Enterprise Server without HADB bundle, import the DAS certificate from the rfc file created using certutil, the NSS security tool.

      <webserver_home>/bin/certutil -A -a -n s1as -t "TCu,Cu,Tuw" -i s1as.rfc -d alias -P <instance-name>-<hostname>-

      where, <webserver_home> refers to the web server installation directory.

      You can check the presence of this certificate by using the following command, which would list the s1as certificate along with other CA certificates including the default server certificate. Ensure that you type the command in a single line.

      <WS_INSTALL_ROOT>/bin/certutil -L -d
<WS_INSTALL_ROOT>/admin-server/config-store/
<DEFAULT_CONFIG_NAME>/config

  3. If obj.conf does not contain the following lines, please append them at the end of the file. If you are using Enterprise Server with HADB bundle, this step is automatically performed by the installation program.

    <Object ppath="*lbconfigupdate*">
PathCheck fn="get-client-cert" dorequest="1" require="1"
<Object>
<Object ppath="*lbgetmonitordata*">
PathCheck fn="get-client-cert" dorequest="1" require="1"
</Object>

  4. You can verify the above set up from the DAS using the steps provided in the section Verifying the Setup. Instead of using the local CA, you can use any other CA and server certificate. In that case you can skip steps 5 and 6 listed in the previous section, but need to import the server certificate that you obtained from other CAs.

ProcedureTo Set up the HTTP Load Balancer in SSL Mode for Sun Web Server 7

  1. (Optional) Create the NSS database using the following command. This step is not needed if the NSS database exists. Make sure that you type the command in a single line.

    webserver-install-dir/bin/certutil -N -d 
/webserver-install-dir/admin-server/config-store/config-name/config

    When prompted, provide the NSS database password.

  2. Start the Admin Server using the following command.

    webserver-install-dir/admin-server/bin/startserv.bat

  3. Create a self-signed certificate using the following command. Make sure that you type the command in a single line.

    webserver-install-dir/bin/wadm create-selfsigned-cert --user=
admin-user --server-name=host-name 
--nickname=ServerCert --token=internal --config=config-name

  4. Create an HTTP listener using the following command. Make sure that you type the command in a single line.

    webserver-install-dir/bin/wadm create-http-listener 
--user=admin-user --server-name=host-name 
-default-virtual-server-name=default-virtual-server-name 
--listener-port=8090 --config=config-name http-listener-ssl

  5. Enable the SSL and assign certificate using the following command. Make sure that you type the command in a single line.

    webserver-install-dir/bin/wadm set-ssl-prop 
--user=admin-user --http-listener=http-listener-ssl 
--config=config-name enabled=true server-cert-nickname=ServerCert

ProcedureTo Export and Import the DAS Certificate for Sun Web Server 7

  1. If you are using Enterprise Server with HADB bundle, export the DAS certificate by executing the command:

    <as home>/lib/upgrade/pk12util -d <domain root>/config -o sjsa.p12 -W
<file password> -K <master password> -n s1as

    • If you are using GlassFish v2.1 or Enterprise Server without HADB bundle, export the DAS certificate, named with the alias “s1as” using the Java SE 5.0 security tool called keytool. While doing so, select the -rfc option to export the certificate in the printable encoding format, as defined by the Internet RFC 1421 standard.

      From the command line, you can use the following commands to export the DAS certificate:

      <JAVA_HOME>/bin/keytool -export -rfc -alias s1as -keystore
<GLASSFISH_HOME>/domains/<DOMAIN_NAME>/config/keystore.jks-file s1as.rfc

      where, <GLASSFISH_HOME> indicates the Application Server installation directory and <DOMAIN_NAME> refers to the domain whose certificate is being exported.

    • Copy the certificate file to the web server configuration directory.

  2. If you are using Enterprise Server with HADB bundle, import the DAS certificate into the Web Server instance using the following commands:

    <webserver home>/bin/https/admin/bin/pk12util-i sjsas.p12 -d <webserver
home>/alias -W<file password> -K <webserver security db password> -P
<instance-name>-<hostname>-
    <webserver home>/bin/https/admin/bin/certutil -M -n s1as -t "TCu,Cu,Tuw"
-d alias -P <instance-name>-<hostname>-

    This command makes the Application Server CA be a trusted CA to sign both client and server certificates.

    • If you are using GlassFish v2.1 or Enterprise Server without HADB bundle, import the DAS certificate from the rfc file created using certutil, the NSS security tool.

      <webserver_home>/bin/certutil -A -a -n s1as -t "TC" -i s1as.rfc -d
<WS_INSTALL_ROOT>/admin-server/config-store/<CONFIG_NAME>/config

      where, <webserver_home> refers to the web server installation directory and <CONFIG_NAME> refers to the configuration name created for the default web server instance.

      You can check the presence of this certificate by using the following command, which would list the s1as certificate along with other CA certificates including the default server certificate. Make sure that you type the entire command in a single line.

      <WS_INSTALL_ROOT>/bin/certutil -L -d
<WS_INSTALL_ROOT>/admin-server/config-store/
<DEFAULT_CONFIG_NAME>/config

      You can also use the Web Server Admin Console to view this. Select the configuration to which the certificate has been imported to (default config, in this case), and then select the Certificates tab. To look at all the certificates available, select the Certificate Authorities sub tab.

  3. Make the following configuration changes to Web Server 7.0.

    1. Append the following lines to obj.conffile located at <WS_INSTALL_ROOT>/admin-server/config-store/<DEFAULT_CONFIG_NAME>/config/:

       <Object ppath="*lbconfigupdate*">
 PathCheck fn="get-client-cert" dorequest="1" require="1"
</Object>
<Object ppath="*lbgetmonitordata*">
 PathCheck fn="get-client-cert" dorequest="1" require="1"
</Object>

  4. Deploy the configuration. While doing the changes listed in the previous steps, the Admin Console would mark this configuration to be deployed.

    1. Select the icon for Deployment Pending in the Web Server Admin Console. You can also deploy this configuration using the CLI utility wadm as follows:

      <WS_INSTALL_ROOT>/bin/wadm deploy-config-user=<admin><DEFAULT_CONFIG_NAME>

      where <admin> is the administator user name.

  5. Test this setup from the GlassFish DAS to see if it communicates with the configured HTTP Load Balancer over SSL. For more information, see Verifying the Setup.