How to setup HTTP & HTTPS Load balancer for Mediator

Transcription

1 How to setup HTTP & HTTPS Load balancer for Mediator Setting up the Apache HTTP Load Balancer for Mediator This guide would help you to setup mediator product to run via the Apache Load Balancer in HTTP and HTTPS mode. For Setting up a load balancer we need to have two instances of IS/Mediator running on different machines Download the Apache Server from the location and install it in the machine where you want to setup the load balancer Go to install location of the Apache Load Balancer and open the file..\apache2.2\conf\httpd.conf a. Provide the Listening port number which we intend to use, be default it would 80. For Example: Listen 8081 b. Provide the server name / ip address of the machine where the load balancer is running, ServerName gives the name and port that the server uses to identify itself. If your host doesn't have a registered DNS name, enter its IP address here. For Example: ServerName VMCHNSMGME08.eur.ad.sag:8081 c. Provide the Document Root information,the directory out of which you will serve your documents. BalancerMember points to IS/Mediator instance which needs to be accessed in this case it is HTTPD.conf DocumentRoot "C:/Apache2.2/htdocs" <VirtualHost *:8081> ServerAdmin admin@eur.ad.sag ServerName VMCHNSMGME08.eur.ad.sag:8081 ServerAlias VMCHNSMGME08.eur.ad.sag ProxyPass / balancer://mediator/ ProxyPassReverse / balancer://mediator/ ProxyTimeout 6000 ErrorLog logs/error.log CustomLog logs/access.log combined </VirtualHost> <Proxy balancer://mediator> BalancerMember </Proxy> <Location /balancer-manager> SetHandler balancer-manager </Location> d. Once done save the httpd.conf file and close it. e. Now verify if all the syntax of the file are correct or not by passing the command "httpd -t" from the..\apache2.2\bin folder. f. If the response says Syntax OK, then go ahead and execute the httpd.exe file 3. Open the mediator administrator screen and go to General screen and modify the parameters as shown in the below screen.

2 4. Once done save the load balancer settings, Open the web browser and verify by hitting the uri provided in the above screen and it should direct to the server address provided in the httpd.cnf file as shown below.

3 Setting up the Apache HTTPS Load Balancer for Mediator (SSL) Above mentioned steps are for setting up the HTTP endpoint load balancer and now we would do the same for HTTPS endpoint load balancer. We have used the version Win64 OpenSSL v1.0.1g for demonstration, other flavors of the Open SSL can be downloaded from here To begin with we need to have the OpenSSL installed and generate a self signed certificate and 1024 bit RSA key as shown below, if you don't have one.

4 1. Make sure that the security configuration is done in Mediator,For further guidance on that how to configure keystore and trust store refer the section below or look for Securing Communications with the Server in the webmethods Integration Server Administrator's Guide. 2. Enable the HTTPS port created in the Integration Server ports settings at the Mediator General page of the Mediator Administration screen. 3. Open the httpd.conf file and uncomment the line "Include conf/extra/httpd-ssl.conf" to include the httpd-ssl.conf file during startup 4. Make sure the following lines are uncommented which acts as supporting modules for SSL, ignore if any of the lines are already un-commented and save it. a.

5 a. httpd-ssl.conf LoadModule ssl_module modules/mod_ssl.so LoadModule setenvif_module modules/mod_setenvif.so LoadModule negotiation_module modules/mod_negotiation.so LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_ajp_module modules/mod_proxy_ajp.so LoadModule proxy_balancer_module modules/mod_proxy_balancer.so LoadModule proxy_connect_module modules/mod_proxy_connect.so LoadModule proxy_ftp_module modules/mod_proxy_ftp.so LoadModule proxy_http_module modules/mod_proxy_http.so LoadModule proxy_scgi_module modules/mod_proxy_scgi.so LoadModule reqtimeout_module modules/mod_reqtimeout.so LoadModule mime_module modules/mod_mime.so LoadModule log_config_module modules/mod_log_config.so LoadModule isapi_module modules/mod_isapi.so LoadModule include_module modules/mod_include.so LoadModule env_module modules/mod_env.so LoadModule dir_module modules/mod_dir.so LoadModule cgi_module modules/mod_cgi.so LoadModule authz_user_module modules/mod_authz_user.so LoadModule autoindex_module modules/mod_autoindex.so LoadModule authz_default_module modules/mod_authz_default.so LoadModule authz_groupfile_module modules/mod_authz_groupfile.so LoadModule authz_host_module modules/mod_authz_host.so LoadModule authn_default_module modules/mod_authn_default.so LoadModule authn_file_module modules/mod_authn_file.so LoadModule actions_module modules/mod_actions.so LoadModule alias_module modules/mod_alias.so LoadModule asis_module modules/mod_asis.so LoadModule auth_basic_module modules/mod_auth_basic.so Open httpd-ssl.conf file available in the Aparche Installation direction at..\apache2.2\conf\extra\httpd-ssl.conf in notepad. Provide the Listening port number which we intend to use, be default it would 443 and update the SSL Virtual Context information as provided below. a.

6 a. httpd-ssl.conf ## ## SSL Virtual Host Context ## <VirtualHost _default_:443> # General setup for the virtual host DocumentRoot "C:/Apache2.2/htdocs" ServerName VMCHNSMGME08.eur.ad.sag:443 ServerAdmin admin@eur.ad.sag ProxyPass / balancer://mediator/ ProxyPassReverse / balancer://mediator/ ProxyTimeout 6000 ErrorLog "C:/Apache2.2/logs/error.log" TransferLog "C:/Apache2.2/logs/access.log" <Proxy balancer://mediator> BalancerMember </Proxy> <Location /balancer-manager> SetHandler balancer-manager </Location> Provide the Server private key and the Server certificate path generated via the OpenSSL in the below parameters under the httpd-ssl.conf file a. SSLCertificateFile C:/OpenSSL-Win64/bin/server.crt (or) any location where the certificate is copied to. b. SSLCertificateKeyFile C:/OpenSSL-Win64/bin/server.key (or) any location where the certificate is copied to Provide the HTTPS Load balancer URL in the Mediator Administrator screen under the General section and test if the url works.

7 9. Now once the virtual service is deployed to the Mediator, we can check in the load balancer uri in the end point during service invocation. Note: If you want to have multiple instances of Mediator to be load balanced then add the following parameter with the desired destination In the httpd.conf file <Proxy balancer://mediator> BalancerMember BalancerMember </Proxy> In the httpd-ssl.conf file <Proxy balancer://mediator> BalancerMember BalancerMember </Proxy> Once done restart the httpd.conf or httpd-ssl.conf file and provide the load balancer uri in the desired mediator general administration screen. Configure keystore and truststore If we want to deploy virtual services with the security policies apply,we have to first setup the security configuration settings in Mediator.

8 1. Go to the Mediator and click on Security > Key store, By default you would not find any information related to keystore added out of the box. Click on create keystore alias and and provide the certificate information as given below in the screen shots a. By default, Mediator ship sample JKS keystore under the location: C:\SoftwareAG\IntegrationServer\instances\default\packages\WmMediator\config\resources\security\pgkeystore.jks b. password would be "password"

9 2. Once the key store alias is configured, you will find that information in the key store list. Now create a trust store alias by pointing to the "cacert" in the same location a. C:\SoftwareAG\IntegrationServer\instances\default\packages\WmMediator\config\resources\security\cacerts b. password would be "changeit" 3. Once the keystore and truststore are configured we should configure the client certificates by specifying the certificate path. a. In Mediator, if user authenticate against X.509 certificate, user has to map with certificate. Below is the configuration step to map the user. b. Go to location to get the certificate available by default C:\SoftwareAG\IntegrationServer\instances\default\packages\WmMediator\config\resources\security\partner1cert.der c. Select the user as "Administrator" or any valid IS user by searching the users in the configuration section by clicking the search icon next to search field. d. Once configured click on "Import Certificate" button and then the certificate would be added to the certificates list.

10 4. Now configure the security information in Mediator. Open the Mediator console Go to General Configured Keystore and truststore information will be listed here. Choose the appropriate one.