Integrating HP Cloud Service Automation with HP Virtualization Performance Viewer

Transcription

1 Technical white paper Integrating HP Cloud Service Automation with HP Virtualization Performance Viewer Instruction steps to configure single sign-on between HP CSA 4.5 and HP vpv 2.20 Table of contents Pre-requsites for configuring single sign-on 2 Configuring single sign-on between CSA admin portal and vpv admin view 2 Configuring LWSSO in CSA 2 Update CSA console dashboard to launch vpv 3 Launch vpv admin page from CSA s Service Management Console (SMC) 3 Configuring single sign-on between CSA s Marketplace portal and vpv s consumer view 3 Configuring HPSSO in Marketplace portal 3 Configuring vpv URL in CSA 6 Configuration steps on HP vpv 7 Register data source 7 Configure CSA end point in vpv 7 Configure LDAP settings in vpv 8 SSO configuration on vpv 8 Launch vpv s consumer view from MPP 9 Known Issues 10 Troubleshooting issues 11 More information 11

2 Integrating HP CSA with HP vpv HP Cloud Service Automation (HP CSA) is cloud management software to automate the management of cloud-based IT-as-a-service, from order, to provision, and retirement. HP CSA orchestrates the provisioning and deployment of complex IT services such as of databases, middleware, and packaged applications onto private, public cloud or hybrid cloud for the end users. HP Virtualization Performance Viewer (HP vpv) is a tool for performance monitoring and capacity management of the virtualized and cloud environment. For more information, refer to the solution brief. HP CSA and HP vpv are both web based solutions which require users to login to view or perform their corresponding activities. A HP CSA user subscribed to cloud infrastructure would like to monitor the performance of the cloud services deployed in the cloud infrastructure and find ways to optimize the resources without having to re-login to HP vpv. A HP CSA administrator would like to monitor the performance, manage and optimize the capacity of the cloud infrastructure through vpv without having to re-login into vpv. This is achieved by integrating HP CSA and HP vpv using single signon. This document lists all the steps to configure single sign-on between CSA 4.5 and vpv 2.20 versions. Pre-requsites for configuring single sign-on Cloud Service Automation version 4.50 Virtualization Performance Viewer consolidated hotfix 3 (VPV_HF_ _3) or later Configuring single sign-on between CSA admin portal and vpv admin view Configuring LWSSO in CSA A CSA administrator can seamlessly launch vpv s administrator view by configuring LWSSO on both CSA and vpv. The following configuration steps are required on CSA to enable LWSSO. 1. Edit file: $CSA_HOME\jboss-as\standalone\deployments\csa.war\WEB-INF\web.xml Mention the correct path to hpssoconfiguration.xml in <param-value> in web.xml. By default, the file location is correctly set. Change the location of the file only if necessary. web.xml <!-- The file below is used by the HP SSO Framework for the configurations required --> <context-param> <param-name>com.hp.sw.bto.ast.security.lwsso.conf.filelocation</param-name> <param-value>c:/program Files/Hewlett-Packard/CSA/jboss-as/standalone/deployments/csa.war/WEB- INF/hpssoConfiguration.xml</param-value> </context-param> 2. Edit file: $CSA_HOME\jboss-as\standalone\deployments\csa.war\WEB-INF\hpssoConfiguration.xml All applications that are integrated with HP SSO needs to have the same cryptography and signing settings as mentioned in hpssoconfig.xml. The domain name specified in this hpssoconfig.xml should be the same as the domain name mentioned in the other applications supporting HP SSO. All the applications should be in the same domain. In the file, replace the domain name place holder as highlighted below in the hpssoconfiguration.xml file. Note: If load balancer is configured with CSA, then domain of the load balancer will be replaced with domain.com. The initstring place holder in the crypto tag has to be updated to reflect the same initstring which is part of the other applications HP SSO configuration. Update the highlighted place holders below to be same as the HP SSO configurations in other applications. hpssoconfig.xml <!-- hpssoconfig is root element. required--> <creationdomains> <domain>domain.com</domain> </creationdomains> <crypto initstring="init string must be replaced for production" ciphertype="symmetricblockcipher" enginename="aes" paddingmode="cbc" keysize="256" encodingmode="base64url" algorithmpaddingname="pkcs7padding" checkintegrity="disabled" cryptosource="lw" directkeyencoded="false" directkeyencoding="hex" jcepbealgorithmname="pbewithhmacsha1" jcepbemacalgorithmname="pbewithhmacsha1" macalgorithmname="sha1" mackeysize="256" macpbecount="20" mactype="hmac"

3 pbecount="20" pbedigestalgorithm="sha1" /> Update CSA console dashboard to launch vpv CSA by default provides Cloud Optimizer widget on management console dashboard. Widget content has to be updated to reflect vpv URL. 2. Edit file: $CSA_HOME\CSA\jboss-as\standalone\deployments\csa.war\dashboard\config.json config.json... "id": "cloud_optimizer", "name": "cloud_optimizer", "description": "cloud_optimizer_description", "enabled": true, "style": "cloud_optimizer", "target": "new", "data": " FQDN OR IP>:8444/PV?CTX=CSA", Restart CSA services. Configure vpv LDAP configuration for Admin SSO CSA administrator user or group should be configured as a vpv administrator user or group in vpv LDAP s settings. This can be set from the Settings section of vpv. See the section Configure LDAP settings in vpv for more details. Note: initstring should be same for Admin SSO and MPP SSO, as vpv can have only one initstring in its configuration. Launch vpv admin page from CSA s Service Management Console (SMC) One can see a tile on CSA s SMC view with the caption Cloud Optimizer. Clicking on the tile will launch vpv s administrator view without being prompted for vpv credentials. Figure 1 Click on the "Cloud Optimizer" tile to launch vpv's administrator view Configuring single sign-on between CSA s Marketplace portal and vpv s consumer view Configuring HPSSO in Marketplace portal CSA s Marketplace portal consumers can view performance and optimization reports from vpv by integrating HP SSO MPP with LWSSO on both CSA and vpv. The following configuration steps are required on CSA to enable LWSSO. 1. Edit file: $CSA_HOME\jboss-as\standalone\deployments\idm-service.war\WEB-INF\web.xml

4 Uncomment the hpsso listener and update hpssoconfig.xml file s path in the highlighted section of the web.xml file. By default, hpssoconfig.xml file is available at: $CSA_HOME\jboss-as\standalone\deployments\idm-service.war\WEB- INF\hpssoConfig.xml. web.xml <!-- <listener> <listener-class>com.hp.hpsso.hpssocontextlistener</listener-class> </listener> <context-param> <param-name>com.hp.sw.bto.ast.security.lwsso.conf.filelocation</param-name> <param-value>c:\program Files\Hewlett-Packard\CSA\jboss-as\standalone\deployments\idmservice.war\WEB-INF\hpssoConfig.xml</param-value> </context-param> --> 2. Edit file: $CSA_HOME\ jboss-as\standalone\deployments\idm-service.war\web-inf\hpssoconfig.xml All applications that are integrated with HP SSO needs to have the same cryptography and signing settings as mentioned in hpssoconfig.xml. The domain name specified in this hpssoconfig.xml should be the same as the domain name mentioned in the other applications supporting HP SSO. All the applications should be in the same domain. In the file, replace the domain name place holder as highlighted below in the hpssoconfig.xml file. Note: If load balancer is configured with CSA, then domain of loadbalancer will be replaced with domain.com. The initstring place holder in the crypto tag has to be updated to reflect the same initstring which is part of the other applications HP SSO configuration. Update the highlighted place holders below to be same as the HP SSO configurations in other applications. hpssoconfig.xml <!-- hpssoconfig is root element. required--> <creationdomains> <domain>domain.com</domain> </creationdomains> <crypto initstring="init string must be replaced for production" ciphertype="symmetricblockcipher" enginename="aes" paddingmode="cbc" keysize="256" encodingmode="base64url" algorithmpaddingname="pkcs7padding" checkintegrity="disabled" cryptosource="lw" directkeyencoded="false" directkeyencoding="hex" jcepbealgorithmname="pbewithhmacsha1" jcepbemacalgorithmname="pbewithhmacsha1" macalgorithmname="sha1" mackeysize="256" macpbecount="20" mactype="hmac" pbecount="20" pbedigestalgorithm="sha1" /> 3. Edit file: $CSA_HOME\jboss-as\standalone\deployments\idm-service.war\WEB-INF\spring \applicationcontextsecurity.xml The applicationcontext-security.xml file contains most of the HP SSO integration configuration. Check for these entries and uncomment the highlighted XML comments. applicationcontext-security.xml <!-- START HP SSO Configuration --> <!-- <security:http pattern="/idm/v0/login" use-expressions="true" auto-config="false"> <security:custom-filter ref="requesttokencompositefilter" position="first" /> <security:custom-filter ref="hpssoprovidedfilter" before="pre_auth_filter" /> <security:custom-filter ref="hpssointegrationfilter" after="pre_auth_filter" /> <security:custom-filter ref="nopromptfilter" before="form_login_filter" /> <security:http-basic /> </security:http>

5 <security:http pattern="/idm/v0/logout" use-expressions="true" auto-config="false"> <security:custom-filter ref="requesttokencompositefilter" position="first" /> <security:custom-filter ref="hpssoprovidedfilter" before="pre_auth_filter" /> <security:custom-filter ref="hpssointegrationfilter" after="pre_auth_filter" /> <security:http-basic /> </security:http> --> <!-- END HP SSO Configuration --> applicationcontext-security.xml <!-- START CAC HPSSO CONFIGURATION --> <!-- <bean id="hpssofederatingprovider" class="com.hp.ccue.identity.filter.certificate.certificateldapauthenticationprovider"> <property name="config" ref="csaauthconfig" /> <property name="templatefactory" ref="csatemplatefactory" /> </bean> <security:authentication-manager id="hpssoauthmanager"> <security:authentication-provider ref="hpssofederatingprovider" /> </security:authentication-manager> <bean id="hpssoprovidedfilter" class="com.hp.hpsso.api.hpssofilter" /> <bean id="hpssointegrationfilter" class="com.hp.ccue.identity.filter.hpsso.hpssofilter"> <constructor-arg ref="hpssoauthmanager" /> <property name="generatetokenutil" ref="generatetokenutil" /> <property name="tokenfactory" ref="tokenfactory"/> <property name="loginredirectionhandler" ref="loginredirectionhandler"/> </bean> <bean id="hpssotokenwriter" class="com.hp.ccue.identity.hpsso.hpssocookietokenwriter"> <property name="tokenstore" ref="tokenstore" /> <property name="tokenservice" ref="tokenservice" /> <property name="tokenfactory" ref="tokenfactory" /> </bean> --> <!-- END CAC HP SSO Configuration --> applicationcontext-security.xml <!-- START Certificate Authentication / SiteMinder SSO / HP SSO Configuration --> <!-- <bean id="loginredirectionhandler" class="com.hp.ccue.identity.filter.loginredirectionhandler"> <property name="tokenservice" ref="tokenservice"/> </bean> <bean name="generatetokenutil" class="com.hp.ccue.identity.utilities.generateresponsetokenutil" /> --> <!-- END Certificate Authentication / SiteMinder SSO / HP SSO Configuration --> 4. Edit file: $CSA_HOME\jboss-as\standalone\deployments\idm-service.war\WEB-INF\spring applicationcontextv0.xml The applicationcontext-v0.xml file configures to write the HP SSO token to the HP SSO cookie. Check and uncomment the highlighted comments from following configurations. applicationcontext-v0.xml. <!-- START HP SSO Configuration --> <!-- <property name="tokenwriter" ref="hpssotokenwriter" /> --> <!-- END HP SSO Configuration -->

6 5. Edit file: $CSA_HOME\jboss-as \standalone\deployments\idm-service.war\web- INF\spring\applicationContext.properties Update the hostname in the applicationcontext.properties file to match the environment. Replace the idm.csa.hostname place holder highlighted below in the applicatoncontext.properties file. applicationcontext.properties # Properties of CSA server that manages organization LDAP configurations idm.csa.protocol = https idm.csa.hostname = <CSA FQDN> Configuring vpv URL in CSA Create a URL link for the consumer s organization in CSA to enable launching vpv s consumer view from Marketplace portal. The URL link will appear as a widget on Marketplace portal dashboard for CSA consumers. On accessing the link, a separate browser window will launch vpv s consumer view. Consider you have created a consumer organization Finance in Organizations section. Add vpv URL link as shown in Figure 1. URL to configure vpv: vpv_fqdn: Fully Qualified Domain name (FQDN) of vpv server. Note: IP Address should not be used in this URL. On Windows, add IP Address and FQDN name of VPV in hosts file. Replace the OrganizationId with the name of the CSA Consumer Organization in your setup. For example, replace Finance with the consumer organization in your setup. Figure 2 Example: Adding vpv URL link to Finance organization that displays a widget on MPP dashboard.

7 Configuration steps on HP vpv Note: The pre-requisites are vpv version 2.20 and consolidated hotfix 3 (VPV_HF_ _3) or later. Register data source To monitor a VMware vsphere virtualized environment, vpv connects to the VMware vcenter Server to source performance and capacity metrics. Follow the steps provided below to add a VMware vcenter data source target in vpv. For other data sources, refer to the online help of vpv. - Launch vpv in a web browser and add a vcenter data source as shown in Figure 2. vpv URL: Default port for VPV: 8081 Figure 3 Register VMware vcenter a data source The vcenter Server added to HP vpv should be same vcenter Server which is used as a provider by HP CSA to deploy the virtual machines. Configure CSA end point in vpv Configure the CSA server details in vpv to enable vpv to retrieve user subscription and organization details. Provide CSA URL and credentials in vpv as shown in Figure 3. CSA URL: CSA admin portal URL as FQDN>:<PORT> User Name: CSA user having admin privileges to access CSA artifacts Server Component Type: Base component type name for a Server. Leave it blank if using OOTB server component in your service designs. Hostname Property: Property name on the component which identifies hostname of the server instance. Leave it blank if using hostname as property on the component.

8 Configure LDAP settings in vpv User authentication in HP vpv is provided using Microsoft Active Directory, AD LDS and OpenLDAP. You can configure LDAP from the Settings page of HP vpv. To know more about each configuration items, use the context relevant help. SSO configuration on vpv 1. Login into the vpv system. 2. Edit file: /opt/ov/www/webapps/pv/web-inf/classes/lwssofmconf.xml The domain name and crypto settings like initstring should be the same as what is configured in the hpssoconfig.xml file in HP CSA. Update the highlighted lines to match the environment and the HP SSO configurations made on other applications like HP CSA supporting HP SSO. lwssofmconf.xml <validation> <in-ui-lwsso> <lwssovalidation id="id000001"> <domain>mention the domain here for e.g. (refer to domain name in hpssoconfig.xml )</domain> <crypto ciphertype="symmetricblockcipher" enginename="aes" paddingmodename="cbc" keysize="256" encodingmode="base64url" initstring="mention the init string here"></crypto> </lwssovalidation> </in-ui-lwsso> </validation>

9 3. Restart the Tomcat service of vpv. Login into vpv system and run the command the following command to restart the Tomcat service. # /opt/ov/bin/ovc restart ovtomcatb Launch vpv s consumer view from MPP Login into CSA Marketplace Portal (MPP) as an Organization user. Click on the Cloud Optimizer widget to launch vpv s consumer view.

10 Known Issues Issue Description Workaround Issue Description Workaround Consumer logging out of vpv does not logout on HP MPP. Consider customer launches vpv consumer view from MPP. vpv consumer view is launched in a separate browser window displaying resource consumption reports. Customer logs out on vpv consumer view. Customer session is still active on CSA MPP page. No workaround available. MPP browser maintains SSO session cookie and logging out on vpv report page does not terminate session on MPP browser server. HP CSA cannot support FIPS with HP SSO enabled HP CSA cannot support FIPS with HP SSO enabled No workaround available. HP SSO does not comply with the FIPS 140-2, so the initialization string in the encryption configuration is stored in clear text.

11 Troubleshooting issues Problem Unable to launch vpv consumer view from MPP. Cause 1. Timezones of CSA and vpv servers are different. 2. Firewall on vpv is enabled. Solution CSA and vpv server are in different timezones. Set vpv timezone to match timezone on MPP server: 1. Launch vpv s VAMI portal: 2. Login with vpv system s root credentails 3. Go to System->Timezone 4. Select the timezone and save the settings Firewall on vpv is enabled Disable firewall on vpv server to allow MPP communication to vpv. Execute the following commands in the vpv server: service iptables save service iptables stop chkconfig iptables off service iptables status To enable trace logs in vpv, run the following command: pv trace on More information For help, visit the HP Live Network Portal at To access other toolkits to design and extend cloud services running on HP CloudSystem, go to hp.com/go/csdevelopers. HP software product manuals and documentation for the following products can be found at You will need an HP Passport to sign in and gain access. To help us improve our documents, please send feedback to CSAdocs@hp.com. Learn more at hp.com/go/csa hp.com/go/vpv Copyright 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein. Trademark acknowledgments, if needed. October 2015