Provision and Configure OCI Load Balancing

OCI Load Balancing distributes traffic across multiple web servers. You'll provision the load balancer as a virtual resource just like any other resource. Oracle MAA recommends that you provision the load balancer onto its own subnet (private or public).

Verify that the OCI Load Balancer Prerequisites for PeopleSoft are Met

Before provisioning OCI Load Balancing, make sure that the following configurations are correct:

1. All PIA web server domains must have the same cookie name and network domain specified in the $PS_CFG_HOME/webserv/domain/applications/peoplesoft/PORTAL.war/WEB-INF/weblogic.xml file.
   For this project, the Oracle WebLogic domain is HR92U033 and the file location is: $PS_CFG_HOME/webserv/HR92U033/applications/peoplesoft/PORTAL.war/WEB-INF/weblogic.xml.
2. Define the cookies in the XML file.
   Within this XML file, we specified our cookie as follows:

   <cookie-name>iad-hcm-8080-PORTAL-PSJSESSIONID</cookie-name>
   <cookie-domain>.appprivatesu.ebscloudmaavcn.oraclevcn.com</cookie-domain>

   The cookie domain is the network domain name associated with the private subnet app_private_subnet. Make sure all PIA WebLogic server domains have the exact same cookie and network domain names in their respective weblogic.xml file.
3. Create an SSL bundle with the certificate files in PEM format.
   This bundle is uploaded during or after you create a load balancer. After creating the load balancer, click the Certificates link to upload the certificate bundle. You must upload the certificate bundle before associating it with the listener that will be SSL-enabled. Consult your corporate security team for what is required by your company for your SSL certificates.

Provision OCI Load Balancer

Provision your Oracle Cloud Infrastructure (OCI) Load Balancer.

The following is a high-level overview. For more information on specifics, see Creating a Load Balancer in the OCI documentation.

1. Open the navigation menu, click Networking, and then click Load balancers. Click Load balancer.
2. Choose a Compartment.
3. Click Create load balancer.
4. Complete the Add details page for your environment.
   For Bandwidth, we used the following in the example:

   • Shape: 400 megabits per second for our test environment
   • Display name: IAD_PSFT_LBaaS_PROD

   You can change the load balancer's bandwidth shape after creating the load balancer.

5. Complete the Choose backends page for your environment.
   The following are some of the selections used for the example:
   1. Load balancer policy: Weighted round robin traffic distribution policy.
   2. Session persistence: iad-hcm-8080-PORTAL-PSJSESSIONID
   3. SSL enablement: If you choose to have the backend servers SSL- enabled, then select the Use SSL check box and complete the fields.
      We did not select this in our test environment.
   4. Health check: You must define the health check.
      It is applied to all available backend servers to determine their health according to your configuration. The load balancer will not route traffic to an unhealthy backend server. The table defines the attributes we specified for our example's health check:

      Attribute	Value
      Protocol	HTTP Since SSL is terminated at the load balancer, HTTP is selected.
      Port	8080 HTTP port for all PIA web servers.
      Interval in milliseconds	10000 Number of milliseconds between each check. 10000ms = 10 seconds
      Timeout milliseconds	3000 Number of milliseconds that the check will wait before timing out. 3000 = 3 seconds.
      Number of retries	3 Number of attempts to get a response from a given backend server.
      Status code	200 The expected successful status code for HTTP GET calls.
      URL path (URI)	/ Starting path, normally the root path of /.
      Response Body RegEx	.* Regular expression that allows any response returned from the HTML page to be acceptable.

6. Complete the Configure listener page for your environment.
7. Complete the Manage logging page for your environment.

Configure PeopleSoft for SSL Termination at OCI Load Balancer

Configure PeopleSoft to use your new SSL-terminated load balancer. This configuration is required so that dynamically generated URL redirects use the https protocol. Copy your current PeopleSoft Internet Architecture (PIA) web profile and adjust it to use your SSL configuration.

1. Log in to the PIA Web application as a PeopleSoft administrator, such as PS.
   • User: PeopleSoft Admin User, PS
2. Copy the current or active web profile, as the PS user.
   • User: PeopleSoft Admin User, PS
   1. Click the navigation bar icon.
   2. Click Navigator.
   3. Click PeopleTools.
      You might need to scroll through the options.
   4. Click Web Profile.
      You might need to scroll through the options.
   5. Click Copy Web Profile.
   6. Click Search.
      You don't need to enter anything into the search box.
   7. Click on an active web profile from the list, such as PROD.
   8. Enter a name, such as PROD_SSL, in the To field.
   9. Click Save.
   10. Click the Home icon.
3. Configure the copied web profile.
   • User: PeopleSoft Admin User, PS
   1. Click the navigation bar icon.
   2. Click Navigator.
      If you're in the same session as Step 2, then the navigator remembers where you are.
   3. Click Web Profile Configuration.
   4. Click Search.
      You don't need to enter anything in the search box.
   5. Click an active web profile from the list, such as PROD_SSL that you just created.
   6. Click the Virtual Addressing tab.
   7. Protocol: Enter https (lower case) for Default Addressing.
   8. Port: Enter 443 for the default port, or enter different port.
      Leaving it blank will default to port 443.
   9. Click Save.
   10. Exit the application.
4. Modify the PIA configuration.properties file on each PIA web domain server.
   • Node: All PIA web nodes
   • User: psadm2
   1. SSH to a PIA web server.
   2. Edit the PIA configuration.properties file to change the WebProfile setting to the modified web profile.

      $ cd /peoplesoft/local/ps_config/webserv/PIA domain/applications/peoplesoft/PORTAL.war/WEB-INF/psftdocs/site-name

      In this example, the following is the modification:

      $ cd /peoplesoft/local/ps_config/webserv/HR92U033/applications/peoplesoft/PORTAL.war/WEB-INF/psftdocs/ps

   3. Create a backup of the configuration.properties file.

      $ cp configuration.properties configuration.properties.backup

   4. Edit the configuration.properties file and set the WebProfile profile to WebProfile=PROD_SSL.
      Note that we commented out the original setting:

      # WebProfile=PROD           Original web profile
      WebProfile=PROD_SSL

   5. Save the file.
5. Restart the PIA web server, using the PeopleSoft Startup and Shutdown Scripts.
   We assume these scripts are in the administrator account’s PATH.
   • Node: All PIA web nodes
   • User: psadm2

   $ stopWS.sh
       $ startWS.sh

6. Repeat Step 4 and Step 5 for each PIA web server.
7. Issue firewall-cmd commands on each PIA web compute instance, as root, to allow traffic from the load balancer onto each PIA web server compute instance.
   • Node: All PIA web server compute instances
   • User: root
   The following are the commands for our example environment:

   $ firewall-cmd --zone=public --add-rich-rule 'rule family=ipv4 source address=10.0.105.0/24 port port=8080 protocol=tcp accept' –permanent $ firewall-cmd --reload

8. Check the load balancer backend servers to ensure they each come up with a status of OK.
   It may take a few minutes for the status to change from a red diamond Critical to a yellow triangle Warning, and then to a green OK.

At this point, you should be able to log in to the PeopleSoft application through the OCI Load Balancer using a URL similar to the following:

https://load balancer alias name.VCN domain/ psc/ps//?cmd=login&languageCd=ENG

The URL for our example environment is:

https://psfthcm.appprivatesu.ebscloudmaavcn.oraclevcn.com/psc/ps//?cmd=login&languageCd=ENG