Installing Oracle Service Registry in a Publication/Discovery Configuration. Understanding the Multi-Registry Configuration

Transcription

1 Installing Oracle Service Registry in a Publication/Discovery Configuration This document is not intended to provide complete instructions on installing and configuring the Oracle Service Registry, but instead is intended to supplement the product documentation with additional information on installing and configuring the Registry. See the Installation Guide section of the Oracle Service Registry Product Documentation (REGISTRY.PDF) for complete installation and configuration instructions. The document covers the following: Understanding the Multi-Registry Configuration... 1 Creating Additional OC4J Instances in OracleAS... 2 Configuring Startup Parameters on OracleAS... 2 Installing the Discovery Registry... 3 Installing the Publication Registry... 5 Importing Discovery Certificates on the Publication Nodes... 5 Installing Oracle Service Registry in a Cluster... 9 Configuring Registry Configuration Synchronization Understanding the Multi-Registry Configuration Oracle Service Registry includes a built-in quality control workflow feature in which services are first published to one or more staging or Publication Registry instances, then promoted to a production or Discovery Registry instance after being approved. This configuration is appropriate for environments where organizations want to impose more control over the contents of the registry available to service consumers.

2 Note that each registry requires a unique tablespace and schema within a database to serve as a metadata store. Both tablespaces/schemas may be safely created within the same database instance, however. Creating Additional OC4J Instances in OracleAS The Publication and Discovery Registries may be deployed on separate OracleAS hosts, or on the same host. If both Registries are installed in the same OAS instance, they should ideally be deployed into separate OC4J instances. Out of memory issues may occur if Publication and Discovery registries are installed in the same OC4J instance. If installing both registries in a single Oracle Application Server instance, you should create separate OC4J instances for Discovery (e.g. uddi) and Publication (e.g. uddi_pub) Registries. In Oracle Application Server and greater, you can create additional OC4J instances through the Enterprise Manager console. Note that OSR must not be deployed to the same OC4J instance as the SOA Suite components (oc4j_soa), or class conflicts with libraries packaged with the BPEL and ESB servers will occur. Configuring Startup Parameters on OracleAS You must configure the heap size and perm gen size, as well as disable Log4j, on each OC4J instance by setting the following parameters in the entry for each instance in <oracle_home>/opmn/conf/opmn.xml: <ias-component id="oc4j"> <process-type id="uddidis" module-id="oc4j" status="enabled"> <module-data> <category id="start-parameters"> <data id="java-options" value="-dgenerateiiop=true -Dhttp.session.debug=true -mx1024m -XX:MaxPermSize=128m -Doc4j.userThreads=true -Dlog4j.ignoreTCL=true "/> </category>... </module-data> </process-type> </ias-component> <ias-component id="oc4j"> <process-type id="uddipub" module-id="oc4j" status="enabled"> <module-data> <category id="start-parameters"> <data id="java-options" value="-dgenerateiiop=true -Dhttp.session.debug=true -mx1024m -XX:MaxPermSize=128m -Doc4j.userThreads=true -Dlog4j.ignoreTCL=true "/> </category>...

3 </module-data> </process-type> </ias-component> Installing the Discovery Registry The Discovery Registry must be installed BEFORE the Publication Registry. Launch the Registry installer (oracle-service-registry jar) and follow the instructions noted in the Registry documentation. Note that HTTPS must be enabled on the Discovery Registry. On OracleAS, the default SSL listener is configured to use port 443. However, it is possible that a different port is assigned, so use the following OPMN command to verify the HTTPS port: <oracleas>/opmn/bin>opmnctl status l When installing the Discovery Registry, you will be asked for the Discovery Registry Configuration. This is used to configure the IPFilter that is enabled by default on the Discovery registry to filter incoming requests from the Publication registry. Requests from any IP address that the filter is not aware of will be blocked.

4 You must either: Enter the IP address of each HTTP server host or load balancer IP that forwards requests to the Discovery Registry. Note that if your loadbalance utilizes multiple IP addresses, each must be listed here. OR: Disable the IPFilter by setting by setting the value of IPAddress to , which will cause incoming IP addresses to be ignored. The IPFilter configuration is written within the <IPFilter> element in the production.xml file on the Discovery registry server. This file is found within the Discovery registry s OC4J directory structure: <ORACLE >/j2ee/<oc4j_instance>/applications/registry/registry/app/uddi/conf/production.xml

5 Installing the Publication Registry Install the Publication Registry AFTER installing the Discovery Registry. Note that HTTPS must also be enabled on the Publication Registry. Notes on the Publication Registry Configuration panel (shown above): Discovery Registry URL: Supply Registry Certificate: Set the value to the X.509 SSL certificate used by the OracleAS instance hosting the Discovery Registry. If you do not have a certificate available, see Installing a Digital Certificate below for details on a workaround solution for testing your configuration. Importing Discovery Certificates on the Publication Nodes The Service Registry uses HTTPS communication between the Discovery and Publication Registry nodes. This requires that the credentials from the Discovery Registry s X.509 certificate be copied to the pstore.xml file on each Publication Registry node. This file is located in the following directory on either a Publication or Discovery node:

6 <OracleAS>/j2ee/<oc4j>/applications/<registry>/<registry>/conf Note that the certificate must be exported and saved as a.cer file to be recognized by the Registry. The Registry provides a tool the PstoreTool that facilitates the importing of certificate information into the Publication Registry s pstore.xml file. The tool is deployed by fault to the staging directory created when you install the Registry. You can use a single PstoreTool instance to import certificate information on all of your Publication nodes. The process to import these certificates on each Publication node is as follows: 1. Ensure that the Publication Registry node is running. 2. Open a command prompt and navigate to <staging_dir>/bin. 3. Start PstoreTool in GUI mode by typing: PStoreTool.[bat sh] gui 4. Select Pstore->Open From File...

7 5. Navigate to the pstore.xml file for the Production (staging) Registry node. 6. Right-click in the Aliases window and choose Import alias. 7. Change Type from KEY_ENTRY to TRUSTED_CERTIFICATE_ENTRY. 8. Click Load Certificate Chain button and navigate to the certificate (.CER) of Discovery Registry.

8 9. Click Open and then OK. You should now see the selected alias/certificate in the list of aliases.

9 10. Repeat steps 4-9 for each Discovery node if necessary. Typically however a single certificate will exist at either the Oracle HTTP Server or loadbalancer level. 11. Simply close the PStoreTool application when finished. No save is needed; your updates are automatically saved. Installing Oracle Service Registry in a Cluster To install OSR into an OracleAS cluster, you must install each Registry node into an OC4J instance within each OracleAS node. This process is identical to installing OSR in a nonclustered configuration with the following exceptions. You will create the Registry tablespace and schema when you install the first Registry instance, as illustrated below.

10 You will then connect each subsequent Registry instance you install to this database schema.

11 You must supply the existing database username and password as part of this configuration:

12 In the Deployment to Application Server panel of the installer, you will specify the information needed to enable the Registry application to receive client requests. The values must be the same for each Service Registry instance. These values will enable all Registry instances within the cluster to receive requests from the same Oracle HTTP Server instance. Note that you are specifying the following: HTTP Port: The Oracle HTTP Server or loadbalancer listener port SSL Port: The secure listener port that Registry will utilize. This is required if using the Publication/Discovery configuration. Hostname: The Oracle HTTP Server or loadbalancer hostname or virtual IP address not OracleAS instance hostname! Application Server Context: The root context used in the URL to access the application. Ensure this value is identical across instances. Application Server Name: The application name. Ensure this value is identical across instances.

13 If these values are configured correctly, Oracle HTTP Server/loadbalancer will be able to route requests to any OSR instance in the cluster. Configuring Registry Configuration Synchronization In an OSR cluster, changes made to the Registry configuration are actually made to a specific Registry instance within the cluster. These changes are then propagated to the other Registry nodes within the cluster, ensuring that configuration of all nodes are synchronized. This configuration is documented in the Cluster Configuration in the OSR product documentation (registry.pdf). Note that configuring the cluster for synchronization is not explicitly required, but it is strongly recommended. The following Registry configuration data will be synchronized across clustered nodes: Account and security settings Server settings like SMTP properties, default business limits, etc. Web UI settings including web UI endpoints UI page customizations Taxonomy cache updates

14 In this configuration, one OSR node is the manager and remaining nodes are listeners. Any configuration change is sent to the manager which then distributes the change to the other nodes. Note that an HTTPS connection is utilized between the manager and listener nodes. This means that if different hosts are used for Discovery or Publication Registry nodes, the certificate for each node must be imported into the pstore.xml file of every other node as described in the Importing Discovery Certificates on the Publication Nodes section. For example, if you have two Discovery nodes, the certificate for each must be imported into the other s pstore.xml file. As noted in the documentation, the cluster configuration is specified in the configurator.xml file, which is installed in the following directory in within the OC4J directory structure: <oracle>/j2ee/<oc4jinstance>/applications/registry/registry/app/uddi/conf/ The manager node is configured in the <configmanagerurls> element within configurator.xml as illustrated below: <configmanagerurls> <url> <managerserviceurlpath>/[registry]/uddi/configuratormanager</managerserviceurlpath> <managerconfiguratorurlpath>/[registry]/uddi/configurator</managerconfiguratorurlpath> </configmanagerurls> Set <url> to the internal IP address and HTTPS listener port of the OracleAS host containing the manager OSR node. Set [registry] in <managerserviceurlpath> and <managerconfiguratorurlpath> to the context URI defined during installation for the Registry instance. This will generally be either /registry or /registrypub. Next configure the IPFilter, which allows only those incoming configuration change messages from specified IP addresses to be received. That is, if the incoming message comes from a foreign IP address it is ignored and not distributed among the other cluster nodes. <IPFilter name="configuratorfilter"> <subnet IPAddress=" " subnetmask=" "/> </IPFilter> You can either specify all IP addresses of all nodes within cluster or you may use subnetmask if you know that cluster nodes IP addresses will be in the same range. For example, to configure 10.0.*.* : <IPFilter name="configuratorfilter"> <subnet IPAddress=" " subnetmask=" "/>

15 </IPFilter> Finally, you will specify each listener node in a <configuratorlistener> element. The syntax on this URL is as follows: <configuratorlisteners> <configuratorlistener> </configuratorlistener> <configuratorlistener> </configuratorlistener> </configuratorlisteners>