Wednesday Oct 03, 2007

Difference between notification and polling

Portal Server and Gateway uses Access Manager and Access Manager SDK for session. It can use either use notification or polling for session notification. Below is the explaination for the same.

 

\* The following keys are used to enable session client side notification
\* Default polling period is 180 seconds
\*/
com.iplanet.am.session.client.polling.enable=false
com.iplanet.am.session.client.polling.period=180

The above two properties are used by session client code, if Polling is set to false notification will be enabled , if polling is set to true notification mode will be disabled.
Note : The AM Server always runs in notification mode so changing this property on the server side doesn't has any effect.

Notification Mode: In notification mode for each session the client registers a notification listener on the server, when any thing changes for that session on the server (time out etc) , the server send notification to the client so the client can update its cache.

Polling Mode : In Polling mode, the session client contacts the server for each session if its caching time has expired and will update its cache.

Enabling web proxy between Portal and Gateway

Usually Gateway is inside a DMZ in the internet and Portal Server is in the intranet. A few ports are opened up in the firewall for communication between the two. In case we have to configure a web proxy between Portal and Gateway then below are the steps.

Add into /etc/opt/SUNWportal/platform.conf.default

  •    http.proxyHost=<Proxy Hostname>
  •    http.proxyPort=<Proxy Port number>
  •    http.proxySet=true


Goto /psconsole -> Secure Remote Access -> 'default' profile -> Deployment tab
    In the 'Proxy Setting' add the following

  •       'Use Proxy'           = true
  •       'Webproxy URLs' = \*
  •       'Domain/SubDomain' = <Domain name>
  •       'Proxy'  = <Proxy Hostname>:<Proxy Port>

Sunday Sep 30, 2007

SSL termination at Load Balancer between Gateway and Portal Server

 

SSL Termination at Load Balancer between Gateway and Portal Server means that SSL traffic between Gateway and the Portal Server is terminated at the Load Balancer. SSL has an overhead of encryption/decryption which affects performance. This article provides steps to install this scenario.

There might be other ways to install this scenario but this is the simplest approach to achieve this. 

Assume there are two instances of Portal PS1 and PS2 on Node1 and Node2 respectively. Gateway is on Node3 and Load Balancer on Node4  between Gateway and Portal Server Instances

Access Manager(AM) instances are on Portal Server (PS) instances. Assume there are two instances for AM and PS.

Gateway ---------> LB ---------------> PS instances (PS1, PS2 .......)

1)  Install  PS, AM and Directory Server (DS) on Node1 where AM and DS are from JES5 or JES5u1 RR build. Portal is OpenPortal PS7.2 on top of AS9.1

2) Start the Container and Access /portal to make sure everything is installed fine on Node1

3) On Node3, install Gateway and AM-SDK and point to PS1. Make sure that one can login via gateway to PS1. Now we have basic set-up ready for with single Gateway and Portal Server without a Load Balancer. Now we are going to add complexity to it.

4) On Node2, install AS9.1. This is for creating AM and PS instances i.e AM2 and PS2

5) Login to AM1 amconsole via browser. As soon as you login to amconsole, you will see "Organization Aliases" listbox on the right side with entries <Node1.domain.com> and <domain>. In this listbox add  <Node2.domain.com>.

6) Now click on Service Configuration -> Platform. On the right hand side there will be "Platform Server List" with entry <http://Node1.domain.com:port>. To this add one more entry <http://Node2.domain.com:port>

7) Install AM2 on Node2. Point to DS on Node1. Restart AS9.1 on Node2 and access amconsole to make sure that one can successfully login.

8) Now create portal instance PS2 on Node2. Install PS2 in config later mode. Modify Webcontainer.properties.SJSAS9.1 and run the below command

  • ./psadmin create-instance -u amadmin -f ps_password -p <portal-id> -w /opt/SUNWportal/template/Webcontainer.properties.SJSAS91

9) Restart AS9.1 on Node2 and access /portal for successful login.

10) Install Load Balancer on Node4. This can be software or a hardware load balancer. You should know about how to make it SSL  with certificates signed from Certificate Authority. Make sure that one can loadbalance AM and PS uris via this SSL instance of Load Balancer.

11) Access psconsole either on Node1 or Node2. Go to Secure Remote Access -> default.  There is a listbox for "Portal Servers". Remove the existing entry in this listbox and add <https://Node4.domain.com:port/portal>. Below that there is listbix for " URLs to which User Session Cookie is Forwarded". In this add below URLs and Save .

http://Node1.domain.com:port
http://Node1.domain.com:port/portal
http://Node2.domain.com:port
http://Node2.domain.com:port/portal
https://Node4.domain.com:port
https://Node4.domain.com:port/portal

 

12. Click on security Tab. In the Non-Authenticated URL list below entries will be there.

http://Node1.domains.com:port/amserver/css
http://Node1.domain.com:port/amserver/login_images,
http://Node1.domain.com:port/amserver/js
http://Node1.domain.com:port/amconsole/console/js
http://Node1.domain.com:port/amconsole/console/images
http://Node1.domain.com:port/amconsole/console/css
http://Node1.domain.com:port/amserver/images


Add below set of entries also

http://Node2.domains.com:port/amserver/css
http://Node2.domain.com:port/amserver/login_images,
http://Node2.domain.com:port/amserver/js
http://Node2.domain.com:port/amconsole/console/js
http://Node2.domain.com:port/amconsole/console/images
http://Node2.domain.com:port/amconsole/console/css
http://Node2.domain.com:port/amserver/images

https://Node4.domains.com:port/amserver/css
https://Node4.domain.com:port/amserver/login_images,
https://Node4.domain.com:port/amserver/js
https://Node4.domain.com:port/amconsole/console/js
https://Node4.domain.com:port/amconsole/console/images
https://Node4.domain.com:port/amconsole/console/css
https://Node4.domain.com:port/amserver/images

13. Now run below command from Node1 AND Node2

  • ./psadmin provision-sra -u amadmin -f ps_password -p portal1 --gateway-profile default --enable
  • ./psadmin provision-sra -u amadmin -f ps_password  --loadbalancer-url https://Node4.domain.com:port/portal --console --console-url https://Node4.domain.com:port/psconsole --gateway-profile default --enable

This will populate Non-Authenticated URL list under the default gateway profile.

14. On Node1, open /etc/opt/SUNWam/config/AMConfig.properties and edit following

  • Add line: com.sun.identity.server.fqdnMap[Node4.domain.com]=Node4.domain.com
  • Edit line: com.sun.identity.loginurl=https://Node4.domain.com:port/amserver/UI/Login
  • com.iplanet.am.jssproxy.trustAllServerCerts=true

15. Add Certificate Authority Root CA certificate to JVM keystore  as follows on Node1 and Node2

  • cd /usr/jdk/entsys-j2se/jre/lib security
  • /usr/jdk/entsys-j2se/jre/bin/keytool -keystore cacerts -keyalg RSA -import -trustcacerts -alias "Node1.domain.com" -storepass changeit -file <path-to-rootca-certificate>

16. Run below command on both the Nodes

  • ./psadmin set-attribute -u amadmin -f ps_password  -p portal1 -m desktop -a AccessURL  "https://Node4.domain.com:port"

17. Repeat above step on Node2. Restart AS9.1 and cacao on both the nodes.

18. Install server certificate and Root CA certificate on Gateway Node from the same Certificate Authority from where Load Balancer was asigned certificate.

19 Now we have to point the gateway to LB instead of PS1 and AM1. Do the following on Gateway Node

  • In the platform.conf.default file change gateway.ignoreServerList=true
  • In the platform.conf.default file change gateway.dsame.agent=https\\://Node4.domain.com\\:port/portal/RemoteConfigServlet
  • In the AMConfig-default.properties and AMConfig.properties change the AM related information as shown below

            com.iplanet.am.server.host=Node4.domain.com
            com.iplanet.am.server.port=<LB_PORT>
            com.iplanet.am.console.protocol=https
            com.iplanet.am.console.host=Node4.domain.com
            com.iplanet.am.console.port=<LB_PORT>
            com.iplanet.am.profile.host=Node4.domain.com
            com.iplanet.am.profile.port=<LB_PORT>
            com.iplanet.am.naming.url=https://Node4.domain.com:<LB_PORT>/amserver/namingservice
            com.iplanet.am.notification.url=https://Node4.domain.com:<LB_PORT>/amserver/notificationservice

20. Restart the Gateway and access it via browser. 




 

 

About

Ajit Kamble

Search

Categories
Archives
« April 2014
SunMonTueWedThuFriSat
  
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
   
       
Today