IBM HTTP Server, WebSphere, and SSL

Transcription

1 IBM HTTP Server, WebSphere, and SSL IBM Corporation

2 IBM Presentation Template Full Version Web Server Overview WebSphere Application Server provides Web server plug-ins that work with a Web server to route requests for dynamic content, such as servlets, from the Web server to the proper application server. A Web server plug-in is specific to the type of Web server. It is installed on the Web server machine and configured in the Web server configuration. A plug-in configuration file generated on the application server and placed on the Web server is used for routing information. In order to manage the generation and propagation of these plug-in configuration files, Web servers are defined to the WebSphere Application Server configuration repository. In some cases, Web server configuration and management features are also available from the WebSphere administrative tools. Source If Applicable IBM Corporation

3 Web Server Overview Web Server Node Agent Plug-in server1 server2 Web Users IBM Corporation

4 Web Server Agenda Web Server Configuration WebSphere Application Server Web Server Plug-in Configuring HTTPS connections between a Web Server Plug-in and the WebSphere Application Server IBM Corporation

5 Supported Web Servers The following are the supported Web servers for WebSphere Application Server V6.1: Apache HTTP Server Domino Web Server IBM HTTP Server Microsoft Internet Information Services Sun Java System Web Server (formerly Sun ONE and iplanet) For the latest list of supported Web servers and the versions supported, see the prerequisite document at: IBM Corporation

6 Web Server Management The setup of your Web server and Web server plug-in environment is defined in a Web server definition. The Web server definition includes information about the location of the Web server, its configuration files, and plug-in configuration. During application deployment, Web modules can be mapped to a Web server, ensuring the proper routing information is generated for the plug-in configuration file IBM Corporation

7 Web server Administration - Remote vs. Local Unmanaged node (Remote) An unmanaged node does not have a node agent to manage its servers. This Requires IHS Administration server for administration management of IHS web server. IBM HTTP Server and WebSphere are on different hardware Managed Node (Local) A managed node has a node agent which manages all servers on the node, whether the servers are WebSphere Application Servers, Java Messaging Service (JMS) servers, Web servers, or generic servers IBM HTTP Server and WebSphere are on the same hardware IBM Corporation

8 Web server Control Flow Admin Console Wsadmin WebServer MBean WebServer MBean DMgr SOAP/HTTP or RMI/IIOP HTTP Post IHS WebServer Plug-in Node Agent IHS Admin Web server IHS Web server plug-in Managed Node Unmanaged Node IBM Corporation

9 Web Server Administration Components IHS Admin Server (for Remote Admin) Installation, configuration and operation of IHS Administration Server WebSphere console New/Delete Web server definitions Start/Stop web servers (IHS remote and IHS local) View/Edit IHS Configuration file View IHS Logs Propagate/Generate Plug-in Config IBM Corporation

10 Browse Web Servers IBM Corporation

11 How are nodes and servers defined? During the installation of the plug-in, the Plug-ins installation wizard creates a Web server configuration script named configure<web_server_name> IBM Corporation

12 How are nodes and servers defined? For remote installations, you must copy the script from the Web server machine to the <was_profile_home>/bin directory on the application server machine for execution. The script runs against the default profile. If one machine is running under Linux or UNIX and the other machine is running under Windows, use the script created in the <plug-in_home>/bin/crossplatformscripts directory IBM Corporation

13 Web Server Definition IBM Corporation

14 Multiple Web Servers with Network Deployment IBM Corporation

15 Managing Web Servers Generate and Propagate Start and Stop New and Delete IBM Corporation

16 Web Server Administration - Express/Base Plug-in propagate and generate only Administration and Configuration is not supported No Start/Stop buttons on WebSphere Admin Console No Configuration file edit through textbox. No logfile view No New/Delete Web server buttons on WebSphere Admin Console Definition of ONLY 1 Web Server Web server defined at Plug-in Install thru Plug-in Install script IBM Corporation

17 Web server Administration - Express/Base IBM Corporation

18 Troubleshooting Could not make a connection to the node agent or IBM HTTP Server administration server on node <node>. If managed node, verify node_agent is running, (rest of hints are for remote) Verify that the IBM HTTP Server administration server is running. Verify that the Web server hostname and port that is defined in the WebSphere administrative console matches the IBM HTTP Server administration host name and port. Verify that the firewall is not preventing you from accessing the IBM HTTP Server administration server from the WebSphere administrative console. Verify that the user ID and password that is specified in the WebSphere administrative console, under remote managed, is created in the admin.passwd file, using the htpasswd command. If trying to connect securely, verify that you export the IBM HTTP Server administration server keydb personal certificate into the WebSphere key database as a signer certificate. This key database will be specified by the com.ibm.ssl.truststore in the sas.client.props file in the profile your console is running in. This is mainly for self-signed certificates. If you still have problems, check the IBM HTTP Server admin_error/admin_access.log file and the WebSphere Application Server logs to see if problem can be determined. topic=/com.ibm.websphere.ihs.doc/info/aes/ae/cihs_troubihsadmin.html IBM Corporation

19 Web Server Plugin IBM Corporation

20 Plug-in Module and Config Files IBM HTTP Server (httpd.conf) Unix Windows Additional plugin files LoadModule ibm_app_server_http_module /WebSphere/AppServer/bin/mod_ibm_app_server_http.so WebSpherePluginConfig /WebSphere/AppServer/config/plugin-cfg.xml LoadModule ibm_app_server_http_module c:/websphere/appserver/bin/mod_ibm_app_server_http.dll WebSpherePluginConfig c:\websphere\appserver\config\plugin-cfg.xml The plugin-cfg.xml contains all the information needed by the plugin to communicate with the WebSphere Application Server IBM Corporation

21 Elements/Attributes of the plugin config file There are Four "major" elements/attributes that need to be understood in order to successfully troubleshoot HTTP request failures... VirtualHostGroup, UriGroup, Route and ServerGroup 1. VirtualHostGroup <VirtualHostGroup Name="default_host"> <VirtualHost Name="*:9080"/> <VirtualHost Name="*:80"/> <VirtualHost Name="*:9443"/> <VirtualHost Name="*:443"/> <VirtualHost Name="websphere01.ibm.com:9080"/> <VirtualHost Name="websphere01.ibm.com:80"/> <VirtualHost Name="websphere01.ibm.com:9443"/> <VirtualHost Name="websphere01.ibm.com:443"/> <VirtualHost Name="websphere02.ibm.com:9080"/> <VirtualHost Name="websphere02.ibm.com:80"/> <VirtualHost Name="websphere02.ibm.com:9443"/> <VirtualHost Name="websphere02.ibm.com:443"/> </VirtualHostGroup> VirtualHostGroup - A group of virtual host names that will be specified in the HTTP Host header IBM Corporation

22 Elements/Attributes of the plugin config file 2. UriGroup (URI definitions) <UriGroup Name="default_host_ProfilesCluster_URIs"> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/profiles/nav/*"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/profiles/ibm_semanticTagServlet/*"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/profiles/*"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/profiles/bookmarklet/*"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/profiles/ajax/*"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/profiles/seedlist/*"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/profiles/mashupmaker/*"/> </UriGroup> UriGroup - A group of URIs that will be specified on the HTTP request line. The same application server must be able to handle the URIs. The route will compare the incoming URI with the URIs in the group to determine if the application server will handle the request IBM Corporation

23 Elements/Attributes of the plugin config file 3. ServerCluster (Server info / Transport info) <ServerCluster CloneSeparatorChange="false" GetDWLMTable="false" IgnoreAffinityRequests="true" LoadBalance="Round Robin" Name="ProfilesCluster" PostBufferSize="64" PostSizeLimit="-1" RemoveSpecialHeaders="true" RetryInterval="60"> <Server CloneID="14bolitfg" ConnectTimeout="0" ExtendedHandshake="false" LoadBalanceWeight="2" MaxConnections="-1" Name="websphere01Node_Profiles01" ServerIOTimeout="0" WaitForContinue="false"> <Transport Hostname="websphere01.ibm.com" Port="9086" Protocol="http"/> <Transport Hostname="websphere01.ibm.com" Port="9449" Protocol="https"> <Property Name="keyring" Value="c:\IBM\HTTPServer\Plugins\config\webserver1\plugin-key.kdb"/> <Property Name="stashfile" Value="c:\IBM\HTTPServer\Plugins\config\webserver1\plugin-key.sth"/> </Transport> </Server> <Server CloneID="14bomsk98" ConnectTimeout="0" ExtendedHandshake="false" LoadBalanceWeight="2" MaxConnections="-1" Name="websphere02Node_Profiles02" ServerIOTimeout="0" WaitForContinue="false"> <Transport Hostname="websphere02.ibm.com" Port="9092" Protocol="http"/> <Transport Hostname="websphere02.ibm.com" Port="9455" Protocol="https"> <Property Name="keyring" Value="c:\IBM\HTTPServer\Plugins\config\webserver1\plugin-key.kdb"/> <Property Name="stashfile" Value="c:\IBM\HTTPServer\Plugins\config\webserver1\plugin-key.sth"/> </Transport> </Server> <PrimaryServers> <Server Name="websphere01Node_Profiles01"/> <Server Name="websphere02Node_Profiles02"/> </PrimaryServers> </ServerCluster> IBM Corporation

24 Elements/Attributes of the plugin config file 4. Route (routing table) <Route ServerCluster="ProfilesCluster" UriGroup="default_host_ProfilesCluster_URIs" VirtualHostGroup="default_host"/> The Route tag ties the previous three sections together. Inbound requests for URIs contained in default_host_profilescluster_uris received on the interfaces defined by default_host are routed to the ProfilesCluster IBM Corporation

25 Elements/Attributes of the plugin config file Highlights/Recap: A) The plugin first looks at the hostname and port of the request and looks for a match in the VirtualHostGroup B) The plugin then looks at the URI of the request and attempts to find match in the URIGroup C) Then if it matches the above it then tries to find a communication channel to the backend by looking at the Route to determine which ServerGroup has a Server and Transport available to handle the given request. D) If the plugin is not able to match any of the above it then leaves the request for the IBM HTTP Server's default-handler which in turn will attempt to serve the request from the WebServer's DocumentRoot IBM Corporation

26 Tracing Stop IHS Clear all logs in the /IHS HOME/logs directory Edit the plugin-cfg.xml and change "Loglevel" to "Trace" example: <Log LogLevel="Trace" Name="c:\IBM\HTTPServer\Plugins\log\webserver1\http_plugin.log"/> Edit the httpd.conf and change "Loglevel" to "debug" Restart IHS Recreate the problem Capture a netstat -na > netstat.out Provide the following datafiles httpd.conf, error.log, access.log plugin-cfg.xml http_plugin.log netstat output (netstat.out) IBM Corporation

27 HTTP server plug-in log: Configuration In WAS and IBM HTTP Server 6.1 the log level can be changed on the fly Can be set to one of three levels: Error, Warn, or Trace Default is Error Trace has high overhead Configure using the properties page for your Web server in the Administrative Console 2010 IBM Corporation

28 HTTP server plug-in log output [Thu Mar 04 15:05: ] DEBUG: ws_common: webspherevhostmatch: Found a match '*:80' to 'vmpe01.swg.usma.ibm.com:80' in VhostGroup: default_host with score 1, exact match 0 [Thu Mar 04 15:05: ] DEBUG: ws_common: websphereurimatch: Found a match '/homepage' to '/homepage' in UriGroup: default_host_homepagecluster_uris with score 9, exact match 9 [Thu Mar 04 15:05: ] TRACE: mod_was_ap20_http: as_translate_name: WebSphere will handle: /homepage 2010 IBM Corporation

29 Configuring HTTPS connections between a Web Server Plug-in and the WebSphere Application Server v IBM Corporation

30 Agenda Introduction (typical configurations) Web Server Connections Application Server Connection Common Problems Question & Answer IBM Corporation

31 Introduction Web Server Plug-in Architecture Deployment Manager HTTPS Web Server Plug-in HTTPS Node Agent server1 server IBM Corporation

32 WebSphere SSL Basics Sending a request to an application requires two unique SSL connections HTTPS from the WebSphere web server plug-in to the application server, over port 9443 HTTPS connection from the client web browser to the web server, typically over port 443 Server side SSL authentication will be today's focus IBM Corporation

33 Keep in Mind All SSL methods use the same basic principals Terms used by the different SSL methods may seem unrelated but the basic use will be the same IBM Http server and plug-in, use what we call a key database to hold the SSL certificates WebSphere Application server will use what is called a repertoire to hold the certificates used by its Java application In Domino we called this a key file IBM Corporation

34 HTTP Server The initial SSL connection is between the client browser and web server This requires having properly configured an SSL key database with a personal certificate for the website There are several how-to's that can be followed to configure SSL for all of the web servers supported by WebSphere IBM HTTP server url=/windows2000/en/server/iis/htm/core/iisslsc.htm IBM Corporation

35 HTTP Server It is up to the web server to establish the connection, complete the SSL handshake with the client, then read the client's HTTP request The plug-in will then begin evaluating the client's request Once the plug-in has figured out that the request should be handled by the backend App server, the plug-in SSL action will begin IBM Corporation

36 HTTP Server Plug-In The plug-in will initiate the connection to the WebSphere application server, then the SSL handshake will occur The App server will send the public certificate to the plug-in The plug-in will use it's key database to evaluate the validity of the certificate IBM Corporation

37 HTTP Server Plug-In The key database used by the plug-in can be found in the plugin-cfg.xml. An example: <Transport Hostname= (JVM_HOSTNAME) Port="9080" Protocol="http"/> <Transport Hostname= (JVM_HOSTNAME) Port="9443" Protocol="https"> <Property name="keyring" value= /path/to/plugin-key.kdb"/> <Property name="stashfile" value= /path/to/plugin-key.sth"/> </Transport> The default password on the plug-in key database is WebAS. More information can be found at tform.doc/info/ae/ae/csec_sslwebserverplugconf.html IBM Corporation