Configuring CA WA Agent for Application Services to Work with IBM WebSphere Application Server 8.x

Transcription

1 Configuring CA WA Agent for Application Services to Work with IBM WebSphere Application Server 8.x Kiran Chinthala Jan

2 Table of Contents Scope... 3 Why is this configuration necessary? Copy the IBM JAR files to the agent computer Convert the IBM truststore to SUN Copy the WebSphere properties files to the agent computer Configure the agent plug-in for WebSphere Run EJB and Session Bean jobs from CAWA DE... Error! Bookmark not defined. References... 14

3 Scope This document provides an overview of how to configure CA WA Agent for Application Services to work with the IBM WebSphere Application Server as an endpoint server. Why is this configuration necessary? The agent uses Oracle JRE to communicate with WebSphere Application Server (WAS). To ensure that the agent can communicate with IBM WAS, you must configure the agent as described in this document. Without the necessary configuration, problems can occur in the following areas: Secure communications using Secure Sockets Layer (SSL) o SSL configuration using JSSE o Secure Sockets Layer client certificate authentication (Transport Layer Security [TLS] to perform a SSL handshake with SSL certificates) o Key store configurations for SSL (IBMJCE file-based key stores [JCEKS, JKS, and PKCS12]) Management of X.509 certificates o Default IbmX509 trust manager o Default IbmPKIX trust manager Configuring the Agent 1. Copy the IBM JAR files to the agent computer To set up the agent to run application services jobs and JMX jobs on WebSphere, first copy the IBM JAR files to the agent computer. Note: This procedure assumes that you are using a standard WebSphere Application Server installation with a standalone application server profile. In a standard installation, the installation directory is C:\WebSphere. The application server profile differs by platform: Application Server Profile on Windows: C:\WebSphere\AppServer\profiles\AppSrv01 Application Server Profile on UNIX or Linux: /opt/ibm/websphere/appserver/profiles/appsrv01/ Follow these steps: If the agent uses JRE:

4 Copy the following JAR files from the WAS installation directory into the agent installation directory (<agent_install_directory>/jars/ext), as shown in the following examples: Examples: /opt/ibm/websphere/appserver/runtimes/com.ibm.ws.orb_8.5.0.jar /opt/ibm/websphere/appserver/runtimes/com.ibm.ws.admin.client_8.5.0.jar /opt/ibm/websphere/appserver/runtimes/com.ibm.ws.ejb.thinclient_ jar Note: IBM WAS includes a number of JAR files that are versioned. If the agent does not use IBM JRE: From the IBM JRE (on non-ibm platforms) copy the following files into the <agent_install_directory>/jars/ext directory, typically /opt/ibm/websphere/appserver/ by default: java/jre/lib/ibmpkcs.jar java/jre/lib/ext/ibmkeycert.jar java/jre/lib/ext/ibmjceprovider.jar java/jre/lib/ext/ibmjcefips.jar java/jre/lib/ibmjgssprovider.jar 2. Convert the IBM truststore to SUN/Oracle To ensure that the agent can communicate with IBM WAS, you must configure the agent as described here. The default password for the IBM truststore password is WebAS. On a base application server, the default key and truststores are stored in the node directory of the configuration repository. For example, the default key.p12 and trust.p12 stores are created with the AppSrv01 profile name, the myhostnode01cell name, and the myhostnode01 node name. The key and truststores are located in the following directories: On Windows: o C:\WebSphere\AppServer\profiles\AppSrv01\config\cells\myhostNode01C ell\nodes\myhostnode01\key.p12 o C:\WebSphere\AppServer\profiles\AppSrv01\config\cells\myhostNode01C ell\nodes\myhostnode01\trust.p12 On Unix and Linux:

5 o o /opt/ibm/websphere/appserver/profiles/appsrv01/config/cells/<unix_ma chine_name>node01cell/nodes/<unix_machine_name>node01/key.p12 /opt/ibm/websphere/appserver/profiles/appsrv01/config/cells/<unix_ma chine_name>node01cell/nodes/<unix_machine_name>node01/trust.p1 2 Note: The key.p12 is optional and for best results should be ignored. 1. On the WAS machine, use the IBM JRE in WAS and run the following command based on your platform: On Windows:.\jre\bin\keytool -importkeystore -srckeystore trust.p12 -srcstoretype PKCS12 - deststoretype JKS -destkeystore trust.jks On UNIX and Linux: Type one of the following commands depending on whether you are already in the Java directory or not:./jre/bin/keytool -importkeystore -srckeystore trust.p12 -srcstoretype PKCS12 - deststoretype JKS -destkeystore trust.jks or $/opt/ibm/websphere/appserver/java/jre/bin/keytool -importkeystore - srckeystore trust.p12 -srcstoretype PKCS12 -deststoretype JKS -destkeystore trust.jks 2. Enter the destination keystore password when prompted. 3. On the agent machine, create a folder without spaces in the full path, for example: On Windows: C:\WAS_security On Linux/Unix: /WAS_security 4. Copy trust.jks to the newly-created folder on the agent machine. 3. Copy the WebSphere properties files to the agent computer In this step, you will make a copy (as a backup) of two properties files (ssl.client.props and sas.client.props) and modify them. On the WAS machine, these property files are located in the following directories: On Windows: C:\WebSphere\AppServer\profiles\AppSrv01\properties

6 On Unix and Linux: /opt/ibm/websphere/appserver/profiles/appsrv01/properties Follow these steps: 1. Copy the ssl.client.props file to a temporary directory of your choice. 2. Change the copy of the ssl.client.props file as follows: Change com.ibm.ssl.truststorepassword={xor}cdo9hgw= to com.ibm.ssl.truststorepassword=<userdefined> 3. Encode the password in the ssl.client.props file by running one of the following commands: On Windows: From C:\WebSphere\AppServer\bin, run: PropFilePasswordEncoder.bat ssl.client.props com.ibm.ssl.keystorepassword,com.ibm.ssl.truststorepassword On Unix and Linux: From /opt/ibm/websphere/appserver/bin, run:./propfilepasswordencoder.sh /ssl.client.props com.ibm.ssl.keystorepassword,com.ibm.ssl.truststorepassword 4. Copy the ssl.client.props file from the temporary directory on the WAS machine to the agent installation directory on the agent machine. 5. Update the ssl.client.props file. 6. Change the user.root value to the folder where you copied trust.jks: On Windows: user.root=c:\was_security On Unix/Linux: user.root=/was_security 7. Change the value of com.ibm.ssl.truststore to trust.jks: com.ibm.ssl.truststore=${user.root}/trust.jks 8. In the ssl.client.props file, replace the following values in the key=value entries: a. IbmPKIX with SunX509 b. IbmX509 with SunX509

7 c. IBMJSSE2 with SunJSSE d. SSL_TLS with SSL e. PKCS12 with JKS f. IBMJCE with SUN 9. Copy the sas.client.props file to the agent installation directory. 4. Configure the agent plug-in for WebSphere. Copying IBM WAS files is necessary when the WLA Agent and the WebSphere AS reside in different hosts. If the Agent and WebSphere reside in the same host, then you may optionally specify the paths of these JAR file names in the oscomponent.classpath parameter in the agentparam.txt file. If you refer to the IBM WAS file names using their installation location, ensure that you do not use the asterisk (*) wildcard character, such as *.jar or /* to avoid copying unnecessary JAR files into the class path. Unnecessary JAR files can produce unintended results, including preventing the Agent from working correctly. In some cases, the use of *.jar in the class path may be appropriate if you know the nature and purpose of the JAR files in the location. 1. Update the agentparm.txt file as follows: On Windows: oscomponent.classpath=jars/*.jar;jars/ext/*;jars/websphere/jar1.jar;jars/websphe re/jar2.jar;jars/websphere/jar3.jar;jars/ext/was-stubs/*.jar After copying the all the required JAR files into the agent jars/ext directory, modify the parameter oscomponent.classpath in the agentparm.txt file, as shown in the following example: oscomponent.classpath=jars/appservices.jar;jars/commonsvc_log.jar;jars/common svc_transport.jar;jars/config.jar;jars/core.jar;jars/dataservices.jar;jars/filebrowser. jar;jars/filemon.jar;jars/ftp.jar;jars/installer.jar;jars/jmxconnector.jar;jars/js.jar;ja rs/library.jar;jars/management.jar;jars/objmon.jar;jars/pluginlib.jar;jars/plugin_ins taller.jar;jars/router.jar;jars/runner.jar;jars/snmp.jar;jars/snmpagent.jar;jars/snm pconnector.jar;jars/tcpip.jar;jars/utility.jar;jars/ext/axisant.jar;jars/ext/axis.jar;jars/ext/bootstrap.jar;jars/ext/castoranttasks.jar;jars/ext/castor-codegen.jar;jars/ext/castor-core.jar;jars/ext/castorddlgen.jar;jars/ext/castor-jdo.jar;jars/ext/castor-xml-schema.jar;jars/ext/castorxml.jar;jars/ext/castor.jar;jars/ext/com.ibm.mq.jar;jars/ext/com.ibm.mqjms.jar;ja rs/ext/com.ibm.ws.admin.client_8.5.0.jar;jars/ext/com.ibm.ws.ejb.embeddablecon tainer_8.5.0.jar;jars/ext/com.ibm.ws.ejb.embeddablecontainer_nls_8.5.0.jar;jars/ ext/com.ibm.ws.ejb.thinclient_8.5.0.jar;jars/ext/com.ibm.ws.emf.jar;jars/ext/com.i bm.ws.orb_8.5.0.jar;jars/ext/com.ibm.ws.runtime.jar;jars/ext/commons-

8 codec.jar;jars/ext/commons-discovery.jar;jars/ext/commonslogging.jar;jars/ext/dhbcore.jar;jars/ext/employee.ear;jars/ext/endorsed_apis_ jar;jars/ext/httpclientcache.jar;jars/ext/httpclient.jar;jars/ext/httpcore.jar;jars/ext/httpmime.jar;jars/ext /ibmcfw.jar;jars/ext/ibmjcefips.jar;jars/ext/ibmjceprovider.jar;jars/ext/ibmjgssprov ider.jar;jars/ext/ibmkeycert.jar;jars/ext/ibmorb.jar;jars/ext/ibmorbapi.jar;jars/ext/ ibmpkcs.jar;jars/ext/ireasoningsnmp.jar;jars/ext/iwsorbutil.jar;jars/ext/j2ee.jar;jar s/ext/j2ee_svr.jar;jars/ext/jaxrpc.jar;jars/ext/jsafejcefips.jar;jars/ext/lmproxy.jar ;jars/ext/naming.jar;jars/ext/opensaml.jar;jars/ext/phtest.ear;jars/ext/qname.jar;j ars/ext/resolver.jar;jars/ext/serializer.jar;jars/ext/sinetfactory.jar;jars/ext/startup.j ar;jars/ext/testejb.jar;jars/ext/urlprotocols.jar;jars/ext/was_public.jar;jars/ext/wsa s_stubs;jars/ext/wsdl4j.jar;jars/ext/wss4j.jar;jars/ext/xalan.jar;jars/ext/xercesimp l.jar;jars/ext/xercessamples.jar;jars/ext/xmlapis.jar;jars/ext/xmlsec.jar;jars/ext/wsas_stubs/j2ee_svr.jar;jars/ext/wsas_stubs/t estejb.jar; On UNIX and Linux: oscomponent.classpath=jars/*.jar:jars/ext/*:jars/ext/wsas_stubs/sample1.jar:jars /ext/wsas_stubs/sample2.jar Example: oscomponent.classpath=jars/appservices.jar:jars/commonsvc_log.jar:jars/common svc_transport.jar:jars/config.jar:jars/core.jar:jars/dataservices.jar:jars/filebrowser. jar:jars/filemon.jar:jars/ftp.jar:jars/installer.jar:jars/jmxconnector.jar:jars/js.jar:ja rs/library.jar:jars/management.jar:jars/objmon.jar:jars/plugin_installer.jar:jars/plu ginlib.jar:jars/router.jar:jars/runner.jar:jars/snmpagent.jar:jars/snmpconnector.jar :jars/snmp.jar:jars/tcpip.jar:jars/utility.jar:jars/ext/axisant.jar:jars/ext/axis.jar:jars/ext/castor-anttasks.jar:jars/ext/castorcodegen.jar:jars/ext/castor-core.jar:jars/ext/castorddlgen.jar:jars/ext/castor.jar:jars/ext/castor-jdo.jar:jars/ext/castorxml.jar:jars/ext/castor-xmlschema.jar:jars/ext/com.ibm.ws.admin.client_8.5.0.jar:jars/ext/com.ibm.ws.ejb.thi nclient_8.5.0.jar:jars/ext/com.ibm.ws.orb_8.5.0.jar:jars/ext/commonscodec.jar:jars/ext/commons-discovery.jar:jars/ext/commonslogging.jar:jars/ext/httpclientcache.jar:jars/ext/httpclient.jar:jars/ext/httpcore.jar:jars/ext/httpmime.jar:jars/ext /ibmjcefips.jar:jars/ext/ibmjceprovider.jar:jars/ext/ibmjgssprovider.jar:jars/ext/ib mkeycert.jar:jars/ext/ibmpkcs.jar:jars/ext/ireasoningsnmp.jar:jars/ext/jaxrpc.jar:j ars/ext/jsafejcefips.jar:jars/ext/opensaml.jar:jars/ext/qname.jar:jars/ext/resolver.jar:jars/ext/serializer.jar:jars/ext/sinetfactory.jar:jars/ext/wsas_stubs:jars/ext/ws dl4j.jar:jars/ext/wss4j.jar:jars/ext/xalan.jar:jars/ext/xercesimpl.jar:jars/ext/xerces Samples.jar:jars/ext/xml-

9 apis.jar:jars/ext/xmlsec.jar:jars/ext/wsas_stubs/j2ee_svr.jar:jars/ext/wsas_stubs/t estejb.jar: com.ibm.ssl.configurl=file:/<agent_install_directory>/ssl.client.props com.ibm.corba.configurl=file:/<agent_install_directory>/sas.client.props appservices.jmx.provider=was java.util.logging.config.class=cybermation.commonservice.logging.cybjavalo gginghandler$factory 2. Restart the Agent. The following image shows the JAR files for CA Workload Automation Agent for Application Services plug-in installed on Windows.

10 The following image shows the JAR files for CA Workload Automation Agent for Application Services plug-in installed on UNIX or Linux. 3. Deploy the custom-written JAR files on the WAS server.

11 5. Run EJB and Session Bean Jobs from DE In Workload Automation for DE, the job definition will look like the one in the following image after you pull the EJB and Session Beans jobs from the Job palette. Note: You can run the same jobs from AE as well. The following image shows the deployed JAR files in WAS.

12

13 Upload to the DE server and click the trigger button shown in the following image. To view the status of the job, go to the Monitor perspective. The following image shows that the job ran successfully.

14 References For additional information, refer to the following publications in the IBM knowledge center.: Secure communications using Secure Sockets Layer (SSL) Keystore configurations for SSL