31.6 Preparing Your Web Server

The methods and steps to prepare your host computer for the Access Manager Web component installation depends on the specific Web server and platform.

To use reverse proxy functions with Access Manager, you need to include the proxy module in the configure command.

See "About the Apache and IBM HTTP Reverse Proxy Server".

See "Activating Reverse Proxy for Apache v2 and IHS v2".

Task Overview: Preparing your Web server and installing Access Manager

Install the IHS v2 Web server or compile and install the Apache v2 Web server as discussed in:
Activate reverse proxy capability if desired, as described in "Activating Reverse Proxy for Apache v2 and IHS v2".
Install Oracle Access Management, as described in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.
Finish Web server configuration, as described in "Verifying httpd.conf Updates for Webgates".
Refer to the following topics as needed:

Note:

In all the procedures that follow, path name variables, modules, and options are examples provided only to illustrate the steps. Your environment will vary. Refer to your Web server documentation for additional details.

31.6.1 Preparing the IHS v2 Web Server

To prepare your IHS v2 Web server to accept and use the Webgate for IHS v2, you need to complete one or more of the following procedures, depending on your environment and requirements:

When you have completed the appropriate procedures, you are ready to install the Webgate for IHS v2.

31.6.1.1 Preparing the Host for IHS v2 Installation

You need to complete this procedure to set up the host computer before you can install the IHS Web server.

See Requirements for IHS2 Web Servers.

See Requirements for Apache v2 Web Servers.

This example illustrates installation on AIX 5.1. Your environment may vary.

To prepare for IHS v2 installation

On the host computer, download and install the IBM Developer Kit, Java Technology Edition version 1.4 from the following site:
```
   http://www.ibm.com/java/jdk
```
The IBM Developer Kit ships with the WebSphere Application Server or can be downloaded from this site.
On the host computer, download and install the xlC.rte 6.0 runtime for AIX 5.1, which is required by the GSKit7 runtime executable from the following site:
```
   https://techsupport.services.ibm.com/server/aix.fdc
```
On the host computer, create a new directory in which you will uncompress the IBM HTTP Server install image.
On the host computer, download the IBM HTTP Server install image from the following Web site:

http://www-306.ibm.com/software/webservers/httpservers/
On the host computer, uncompress the install image in your new directory.
For example:
```
tar -xf IHS.tar
```
A listing of the following files appears, based on your operating system:
```
gskit.sh 
setup.jar  
gskta.rte (a GSKit runtime executable for AIX)
```
You are ready to begin the installation, as described next.
Proceed to "Installing the IBM HTTP Server v2".

31.6.1.2 Installing the IBM HTTP Server v2

The procedure that follows walks you through a typical IBM HTTP Web server installation. Alternatively, you may choose to perform a silent installation.

In this case, you use silent.res file with the java -jar setup.jar -silent -options silent.res command. You can customize silent install options by editing the silent.res text file. All options are set to true by default. To disable an option, set its value to false.

To install the IBM HTTP Web server powered by Apache v2

Set your path to point to the Java Technology Edition version 1.4 installed on your computer in the previous example. For example:
```
   export PATH=$PATH:/usr/java14/java/bin
```
From to the directory where you uncompress the install image, type the following command:
```
   java -jar setup.jar
```
Choose the language in which to run the installation.

The Welcome to the InstallShield Wizard for the IBM HTTP Server appears.
Click Next to dismiss the Welcome screen.
Specify the directory name. For example:
```
   AIX: /usr/IBMIHS/
```
Click Next to continue.

Options appear for a typical, custom, or developer installation. When you choose a typical installation, a list will appear with everything included and the size of the image. If you choose a custom installation, a list of components appears and you can clear the box next to the any components you do not want to install.
Select the type of installation you would like to perform, then click Next. For example:
```
   Typical
```
The following message appears. You can click Cancel to stop the installation.
```
   Installing IBM HTTP Server. Please wait.
```
The next message also appears. You can click Cancel to stop the inventory update.
```
   Updating the inventory.
```
Click Finish to complete your installation.
Stop then start the IHS server using the apachectl commands, as follows:
For example:
```
   IHS2_install_dir/bin
   ./apachectl stop
   ./apachectl start
```
where IHS2_install_dir is the directory where you installed the IHS v2 Web server.

You may configure the IHS v2 Web server in several modes either before or after installing the Webgate for IHS v2:

31.6.1.3 Setting Up SSL-Capability

If you need to setup SSL-capability, use the following procedure either before or after installing the Webgate for IHS v2.

To set up SSL for IHS v2 using the default configuration file

Locate and open the following file:

IHS2_install_dir/conf/httpd.conf
Specify the SSLEnable directive to enable SSL.
Specify a Keyfile directive and any SSL directives you want to enable.
Stop then start the IHS server, as follows. For example:
```
   IHS2_install_dir/bin
   ./apachectl stop
   ./apachectl start
```
where IHS2_install_dir is the directory where you installed the IHS v2 Web server.
Continue with the following procedures:
- Starting an IHS v2 Secure Virtual Host
- Activating Reverse Proxy for Apache v2 and IHS v2

31.6.1.4 Starting an IHS v2 Secure Virtual Host

If you need to start a secure virtual host, use the following procedure either before or after installing the Webgate for IHS v2.

To start an IHS v2 secure virtual host

Locate and open the following file:
```
   IHS2_install_dir/conf/httpd.conf
```
where IHS2_install_dir is the directory where you installed the IHS v2 Web server.
Specify the SSLEnable directive in the virtual host stanza of the configuration file, to enable SSL for a virtual host.

You can specify any directive, with the exception of the cache directives, inside a virtual host.
Specify a Keyfile directive and any SSL directives you want to enable for that particular virtual host.
Load the mod_ibm_ssl.so using the LoadModule directive in the conf file.
Stop then start the IHS virtual host, as follows. For example:
```
   IHS2_install_dir/bin
   ./apachectl stop
   ./apachectl start
```
Note:

The start and stop instructions for an SSL implementation are the same as non-SSL-capable implementations.
Continue with Activating Reverse Proxy for Apache v2 and IHS v2.

31.6.2 Preparing Apache and Oracle HTTP Server Web Servers on Linux

When installing Webgates for Apache or Oracle HTTP Server on Linux, you are prompted to install as the same user under which the Web server is running.

See the User and Group directive entries in the httpd.conf file.

When installing Access Manager Webgates for vendor-bundled Apache v2 on Red Hat Enterprise Linux 4, ensure that all Webgates are installed for Web server user & group (default: apache).

See "Tuning Apache/IHS v2 Webgates for Access Manager".

Note:

On Linux, Webgates for Oracle HTTP Server 11g use only NPTL; you cannot use the LinuxThreads library. In this case, do not set the environment variable LD_ASSUME_KERNEL to 2.4.19.

31.6.3 Preparing Oracle HTTP Server Web Servers on Linux and Windows Platforms

When using Webgates for Oracle HTTP Server v2 on Windows and Linux platforms, both the Perl module and the PHP module must be commented out in the httpd.conf.

Note:

With Oracle HTTP Server 11g, there is no need to comment out any module for Webgates on any platform.

31.6.4 Setting Oracle HTTP Server Client Certificates

When using cert_decode and credential_mapping authentication modules, you must ensure that the Client Certificate authentication scheme works properly with SSL-enabled Oracle HTTP Server by adding +EarlierEnvVars and +ExportCertData to the existing SSL options in the Oracle HTTP Server Web server configuration file.

For example:

credential_mapping:

     obMappingBase="o=company,c=us",obMappingFilter=
     "(&(objectclass=InetOrgPerson)(mail=%certSubject.E%))"

ssl.conf must include:

   SSLOptions +StdEnvVars +ExportCertData +EarlierEnvVars

To add ssl options to Oracle HTTP Server

Locate and open the Oracle HTTP Server Web server configuration file with a text editor. For example:

$ORACLE_INSTANCE/ohs/conf/ssl.conf
In the ssl.conf file, add the following information to existing SSL options. For example:
```
   SSLOptions +StdEnvVars +ExportCertData +EarlierEnvVars
```
Save the file and restart the Web server.

31.6.5 Preparing the Apache v2 Web Server on UNIX

This discussion provides an overview and steps to prepare the Apache v2 HTTP Web server for Access Manager on UNIX platforms, including Solaris, UNIX, Linux, and AIX.

Apache v2 can be configured, built, and installed plain or as SSL-capable. After downloading and extracting Apache source files, you use a script (configure script on UNIX and the makefile.win make script for Windows) to compile the source tree for your environment.

Note:

Basic requirements are the same regardless of your platform. However, the remainder of this discussion and the procedures that follow focus on UNIX platforms. For more information, see also "Preparing the Apache v2 SSL Web Server on AIX".

When you configure Apache v2 on UNIX platforms, you specify the installation directory path name using the -prefix= option with the ./configure command. During configuration you enable the modules that are appropriate for your environment. For example, mod_so is included in the server automatically when dynamic modules are included in the compilation. However, you can ensure the server is capable of loading DSOs by including the -enable-so option with the configure command. If you have multiple Perl interpreters installed, you can include the -with-perl option to ensure the correct interpreter is selected during configuration.

In the configure command, you can also include the options to enable mod_ssl, and to activate an MPM. After configuration, you can verify which MPM was chosen using ./httpd -l to list every module that is compiled into the server.

When you finish configuring Apache, you build the various parts that form the Apache package using the make command then install the package under the installation directory you specified with the -prefix= option during configuration.

For steps and examples, see the following procedures and your Apache documentation:

In the procedures that follow, path name variables, modules, and options are examples provided only to illustrate the steps. Your environment will vary. Refer to your Web server documentation for additional details. There is no difference in the build procedure between Apache v2.0.48 and v2.0.52.

31.6.5.1 Preparing plain Apache v2 for UNIX

You can prepare the plain Apache v2 Web Server for Unix.

Confirm that your environment meets Apache requirements for the appropriate compiler and build tools, as described in Apache documentation located at:
```
http://httpd.apache.org/docs-2.0/install.html#requirements
```
Note:

There are no known restrictions with regard to supported compiler versions for Apache v2 and Access Manager plug-ins. See the Apache documentation.
Download a complete, unmodified version of the Apache HTTP Server v2, as described in the Apache documentation. For example:
```
http://httpd.apache.org/download.cgi
```
Note:

Be sure to download Perl, if needed.
Extract (uncompress, then untar) source files from the tarball, as described in the Apache documentation. For example:
```
   gzip -d httpd-2_0_48.tar.gz
   tar -xvf httpd-2_0_48.tar
```
You can use the following step as an example of configuring the Apache source tree. If you compile Apache on UNIX with the mpm_worker_module for Webgate, see "Apache v2 on UNIX with the mpm_worker_module for Webgate".

Note:

To use reverse proxy functions with Access Manager, you need to include the proxy module in the configure command, as discussed in "About the Apache and IBM HTTP Reverse Proxy Server".
Ensure that you have the correct version of GNU gcc libraries in the proper path to build the Apache source; gcc libraries should be in the PATH:
```
export PATH=/usr/local/packages/gcc-3.4.6/bin:$PATH
```
Configure the Apache source tree and enable or activate the desired modules using details in the Apache documentation. For example:
```
cd apache_source_dir
./configure --with-mpm=prefork --prefix=apache_install_dir --with-included-apr
./configure --with-mpm=worker --prefix=apache_install_dir --with-included-apr
```
where apache_source_dir refers to the directory where you extracted Apache and apache_install_dir refers to the directory where you want to install Apache.
Compile the Apache package you configured using the make command. For example:
```
   make
```
Install the Apache package in the configured directory path that you specified earlier using the --prefix= option. For example:
```
   make install
```
Customize the installation using instructions in the Apache documentation.
For example, you may need to tune the httpd.conf to set basic values for:
```
   ServerName
   User/owner of the WebServer
   Group
```
Note:

To view the complete list of values, use the command: ./configure --help.
Stop then restart the Apache Web server to test the installation using commands in the apache_install_dir/bin directory. For example:
```
   ./apachect1 stop
   ./apachectl start
```
Continue with appropriate tasks for your environment, as follows:

The following procedure outlines how to prepare an SSL-capable Apache v2 Web server on UNIX. The Apache mod_ssl is loadable; however, this installation requires the Open Source toolkit for SSL/TLS. Again, be sure to download Perl, if needed. If AIX is the platform you are using, be sure to see "Preparing the Apache v2 SSL Web Server on AIX" for additional information.

31.6.5.2 Preparing SSL-capable Apache v2 on UNIX

The following steps provides instructions on how to prepare the SSL-capable Apache v2 Web Server for Unix

Confirm that your environment meets Apache requirements for the appropriate compiler and build tools, as described in Apache documentation located at:
```
http://httpd.apache.org/docs-2.0/install.html
```
Download a complete, unmodified version of the Apache HTTP Server v2 and Open Source, as described in the Apache documentation.
```
http://httpd.apache.org/download.cgi
http://www.openssl.org/
```

Extract (uncompress, then untar) source files from the tarballs, as described in the Apache documentation. For example:

   gzip -d httpd-2_0_48.tar.gz
   tar -xvf httpd-2_0_48.tar
   gzip -d openssl-0_9_6f.tar.gz
   tar -xvf openssl-0_9_6f.tar

Configure the OpenSSL source tree, as described in Apache documentation. For example:
```
   cd openssl_source_dir
   ./config -fPIC --prefix=openssl_install_dir 
```
where openssl_source_dir refers to the directory where you extracted OpenSSL and openssl_install_dir refers to the directory where you want to install the configured OpenSSL package.
Compile the OpenSSL package in the installation directory you configured using the make command with the --prefix= option. For example:
```
   make
```
Issue the make test command to complete any sanity testing of OpenSSL and check the correct version of the tools required. For example:
```
   make test
```
Install the OpenSSL package in the configured directory path that you specified earlier using the --prefix= option. For example:
```
   make install
```
Configure the Apache source tree and enable or activate desired modules, as described in your Apache documentation. For example:
```
cd apache_source_dir ./configure --prefix=apache_install_dir
 --enable-so \ --with-mpm='prefork' --with-perl=perl_interpreter_path \ 
--with-port=non_ssl_port --enable-ssl \ --with-ssl=openssl_install_dir
```
where apache_source_dir refers to the directory where you extracted Apache; apache_install_dir refers to the directory where you want to install Apache; and openssl_install_dir refers to the directory where you installed the configured OpenSSL package.
Compile using the make command to build the Apache SSL-capable package in the installation directory you configured using the --prefix= option. For example:
```
   make install
```
Install the Apache SSL-capable package in the configured directory path that you specified earlier using the --prefix= option. For example:
```
   make install
```
You must explicitly make certificates for the Apache v2 server to enable SSL using the openssl tool located at openssl_install_dir/bin/. The make certificate command does not work with Apache v2.
Make certificates using the OpenSSL tool in the openssl_install_dir/bin directory, as described in your OpenSSL documentation and remember that "Common Name" is the fully qualified host name.

Customize the installation using instructions in the Apache documentation:

Tune the httpd.conf to set basic values for:

ServerName
User/owner of the WebServer
`Group

Tune the ssl.conf to set basic values for:

 Listen 7000
 <VirtualHost _default_:7000>
 ServerName ps0733.persistent.co.in:7000
 SSLCertificateFile /home/qa/software/ws/apache/
 apache-2.0.48_ssl_7000/conf/ssl.crt/server.crt
 SSLCertificateKeyFile /home/qa/software/ws/apache/
 apache-2.0.48_ssl_7000/conf/ssl.key/server.key

Stop then restart the Apache Web server to test the installation using commands in the apache_install_dir/bin directory. For example:
```
   ./apachectl stop   
   ./apachectl startssl
```
Continue with Activating Reverse Proxy for Apache v2 and IHS v2, if needed.

31.6.6 Preparing the Apache v2 SSL Web Server on AIX

While building the Apache v2 SSL Web server, the symbols from the OpenSSL Library libssl.a are exported into the httpd executable in Apache.

The symbols needed by Access Manager from the OpenSSL library are:

SSL_get_peer_certificate( )
i2d_X509( )

During linking and binding on the AIX platform, any unused or unreferenced symbols are deleted. Therefore, the two symbols required by Access Manager are missing from the httpd executable.

You need to use openssl-0.9.7d to compile on AIX (openssl-0.9.7e does not compile on AIX). The rest of the steps are the same as on UNIXopenssl-0.9.7d.

Client Cert Authentication: If you are using Client Cert Authentication on the AIX platform, be sure to use AIX 5.2 Maintenance Level 4 with the following hot fix applied for dlsym problem on AIX:

http://www-1.ibm.com/support/docview.wss?uid=isg1IY63366

To prepare the AIX platform for Apache v2

Ensure that your AIX platform meets the system requirements for Access Manager.
See details in "Preparing the Apache v2 Web Server on UNIX" and when building the Apache v2 Web server:
- Use openssl-0.9.7d to compile the Web server for AIX.
- Use the make command in the following manner:
```
make MFLAGS=EXTRA_LDFLAGS='-Wl,-bE:OpenSSL_Symbols.exp'
```

where OpenSSL_Symbols.exp is the file containing the two required symbols. The symbol must be exported using the export file only, as shown.

Note:

Do not export the symbol on AIX with the following methods: -bnog: To suppress garbage collection of symbols -bexpal: To export all symbols -uSymbolName: To export a particular symbol.

31.6.7 Apache v2 Installation on Windows versus Installation on UNIX

Following are some details about how installing and configuring Apache v2 on Windows differs from Apache v2 on UNIX.

For more information, see your Apache documentation.

During Installation: Apache configures files in the \conf subdirectory to reflect the chosen installation directory. If any configuration files in this directory already exist, a new copy of the corresponding file is then written with the extension .ORIG. For example, \conf\httpd.conf.ORIG.

After Installation: Apache is configured using the files in the \conf subdirectory. These are the same files used to configure the UNIX version. However, there are a few differences.

You must edit the configuration files in the \conf subdirectory to customize Apache for your environment. These files will be configured during the installation; Apache is ready to run from the installation directory, with the documents server from the subdirectory htdocs. There are many options you should set before starting to use Apache. For example, Apache listens on port 80 unless you change the Listen directive in the configuration files or install Apache only for the current user.

Multi-Threading: Apache for Windows is multi-threaded, which means that it does not use a separate process for each request as Apache does on UNIX. Instead there are usually only two Apache processes running: a parent process, and a child which handles the requests. Within the child process each request is handled by a separate thread.

UNIX-Style Names: Apache uses UNIX-style names internally. The directives that accept filenames as arguments must use Windows filenames instead of UNIX filenames. However, you must use forward slashes, not back slashes. Drive letters may be used. However, if a drive letter is omitted, the drive with the Apache executable is assumed.

LoadModule Directive: Apache for Windows includes the ability to load modules at runtime without recompiling the server. If Apache is compiled normally, it will install a number of optional modules in the \Apache2\modules directory. To activate these or other modules, you must use the LoadModule directive. For example, to activate the status module, use the following (in addition to the status-activating directives in access.conf):

LoadModule status_module modules/mod_status.so

On UNIX, the loaded code typically comes from shared object files (.so extension), on Windows this may be either the .so or .dll extension.

Process Management Directives: These directives are also different for Apache on Windows.

Error Logging: During Apache startup, any errors are logged into the Windows event log, which provides a backup to the error.log file. For more information, see your Apache documentation.

Apache Service Monitor: Apache comes with an Apache Service Monitor utility. With it you can see and manage the state of all installed Apache services on any computer on your network. To manage an Apache service with the monitor, you must first install the service. Apache may be run as a service on Windows. For details, see your Apache documentation.

Starting, Restarting, Shutting Down: Running Apache as a service is the recommended method. An Apache service is typically started, restarted, and shut down using the Apache Service Monitor and commands like NET START Apache2 and NET STOP Apache2. You may also use standard Windows service management.

You may work with Apache from the command line using the apache command. Apache will execute and remain running until it is stopped by pressing Control-C. You may also run Apache from the Start Menu during installation.

Note:

Pressing Control-C may not allow Apache to end any current operations and clean up gracefully.

Apache Services Accounts: By default, all Apache services are registered to run as the system user (the LocalSystem account). The LocalSystem account has no network privileges through any Windows-secured mechanism. However, the LocalSystem account has wide privileges locally. For details about creating a separate account to run one or more Apache services, see your Apache documentation.

31.6.8 Preparing Apache v2 for Windows

The following section provides instructions on preparing Apache v2 Web Server for Windows.

Confirm that your environment meets Apache requirements, as described in Apache documentation located at:
```
http://httpd.apache.org/docs-2.0/install.html
```
For Windows installations a list of HTTP and FTP mirrors from which you can download Apache v2 is provided online.

When you complete the next step, be sure to download the version of Apache for Windows with the .msi extension.
Download a complete, unmodified version of the Apache HTTP Server v2 (and OpenSSL), as described in the Apache documentation. For example:
```
http://httpd.apache.org/download.cgi
http://www.openssl.org/
```
Install Apache v2 (run the .msi file you downloaded and supply requested information), using your Apache documentation as a guide.
Locate the .default.conf file, verify new settings, then update your existing configuration file if needed.
Start Apache, either in a console window or as a service.
Launch a browser and enter the following URL to connect to the server and access the default page.
For example:
```
http://localhost/
```
A welcome page and a link to the Apache manual should appear. If not, look in the error.log file in the logs subdirectory.

Once your basic installation is working, you need to configure it properly by editing the files in the \conf subdirectory.
Configure the Apache installation for your environment, using the Apache documentation as a guide.
Test your customized environment.
Continue with Activating Reverse Proxy for Apache v2 and IHS v2, if needed.