7 Configuring Web Servers for HTTP Load Balancing

To Set up the HTTP Load Balancer in SSL Mode for Oracle iPlanet Web Server 7

Before You Begin

The Loadbalancer Plug-In does not support iPlanet Web Server administration passwords that are less than 8 characters in length. Ensure that the administration password you use for your iPlanet Web server configuration is eight or more characters long.

1. Create the NSS database using the following command. This step is not needed if the NSS database exists. Make sure that you type the command in a single line.

   webserver-install-dir/bin/certutil -N -d 
   webserver-install-dir/admin-server/config-store/config-name/config
   

   When prompted, provide the NSS database password.

2. Start the Admin Server.

   The command for starting the Admin Server depends on your operating system. For example, on Windows systems:

   webserver-install-dir\admin-server\bin\startserv.bat
   

   webserver-install-dir

   The name of the directory in which the web server is installed.

3. Create a self-signed certificate.

   Enter the following command on a single line:

   webserver-install-dir/bin/wadm create-selfsigned-cert --user=
   admin-user --server-name=host-name 
   --nickname=ServerCert --token=internal --config=config-name
   

   Refer to your web server documentation for complete instructions on the wadm command.

4. Create an HTTP listener.

   Enter the following command on a single line:

   webserver-install-dir/bin/wadm create-http-listener 
   --user=admin-user --server-name=host-name 
   --default-virtual-server-name=default-virtual-server-name 
   --listener-port=8090 --config=config-name http-listener-ssl
   

5. Enable the SSL and assign the certificate.

   Enter the following command on a single line:

   webserver-install-dir/bin/wadm set-ssl-prop 
   --user=admin-user --http-listener=http-listener-ssl 
   --config=config-name enabled=true server-cert-nickname=ServerCert
   

6. Deploy the configuration to the web server.

   webserver-install-dir/bin/wadm deploy-config config-name
   

   The wadm commands operate on the central configuration, so the web server will not use the changes until they are deployed.

7. Proceed with the instructions in Installing the Loadbalancer Plug-In.

Configuring Apache Before Installing the GlassFish Loadbalancer Plug-In

To use SSL mode in Apache, you must compile and build your Apache installation from the Apache source files with SSL enabled. This section describes the minimum requirements and high-level steps needed to successfully compile Apache HTTP Server to run the Loadbalancer Plug-In. These requirements and steps only apply to the Solaris and Linux versions of the software. The Windows version of Apache is not supported.

There are two tasks that you need to perform here to configure Apache with SSL support before installing the Loadbalancer Plug-In:

• To Build and Install Apache With SSL Support

• To Create a Security Certificate for Apache

Configuring Apache After Installing the GlassFish Loadbalancer Plug-In

This section explains the additional Apache HTTP Server configuration steps that are required after you install the GlassFish Loadbalancer Plug-In.

The following topics are addressed here:

• Configuring Security Files to Work With the Load Balancer

• Providing Access Permissions to Apache User

• Loadbalancer Plug-In Initialization

• Modifying Directory Access Permissions to Enable Auto Apply

NSS_STRICT_NOFORK=DISABLED
export NSS_STRICT_NOFORK

Starting Apache on Solaris and Linux

In general, you should start Apache with the same user ID that was used when installing GlassFish Server. You must start Apache as root under the following circumstances:

• If you are using port numbers below 1024

• If Apache runs as a different user than the user that starts GlassFish Server

Use the following command to start Apache 2.2.x:

apachectl start

If necessary, check the Apache web site for the latest information on starting the Apache server.

To Configure SSL for IIS 7.5+

This procedure explains how to configure SSL on a Microsoft IIS 7.5+ server so it can work with the Loadbalancer Plug-In. Note that the load balancer Auto Apply feature is not supported in IIS, so this procedure is only required if you want to use IIS with SSL support for other reasons.

1. Open the Internet Services Manager in Microsoft IIS.

2. Under the host name in Nodes (above Application Pools), select Server Certificates and click Create a self-signed certificate in the Actions pane.

3. Select the Website to make the site Binding, and then click Add to add a new binding.

4. Select HTTPS and select the SSL Certificate from the list.

5. Select SSL Settings in Website and check Require SSL and Accept for client certificate.

6. Launch Browse HTTPS from Website and verify that the Welcome page launches.

   Internet Explorer (IE) 7 will display an error page because the self-signed certificate was issued by your computer, not by a trusted Certificate Authority (CA). IE 7 will trust the certificate if you add it to the list of Trusted Root Certification Authorities in the certificates store on the local computer or in Group Policy for the domain.

7. Click Continue to this Web Site (not recommended).

8. Proceed with the instructions in Installing the Loadbalancer Plug-In.

Microsoft IIS 7.5+ Post-Install Configuration Steps

This section explains the Microsoft IIS 7.5+ configuration steps that must be performed after installing the Loadbalancer Plug-In for GlassFish Server 3.1.2.

Automatically Configured sun-passthrough Properties

The Load Balancer Configurator automatically configures the following properties in sun-passthrough.properties. You can change the default values.

To Configure Oracle HTTP Server to Use the Loadbalancer Plug-In

1. Download and install Oracle HTTP Server (OHS) 11.1.1.4+ (32-bit), if it is not already installed.

   OHS is available from the Oracle Middleware Downloads page. Look for Web Tier Utilities under Required Additional Software. Note that you need to install the complete Web Tier Utilities bundle because OHS is not available separately. Be sure to download the 32-bit product version.

2. Prepare for and install the GlassFish Loadbalancer Plug-In.

   1. Create a dummy Apache directory named /tmp/apache on the machine on which OHS is installed.

   2. Install the Loadbalancer Plug-In, as described in Installing the Loadbalancer Plug-In.

      Use the following options when running the GlassFish Loadbalancer Configurator:

      Choose Apache HTTP Server as your web server.

      Point to the dummy /tmp/apache as the Apache HTTP Server installation directory.

      The GlassFish Loadbalancer Configurator will create a new /tmp/apache/glassfish-lbplugin directory.

3. Configure OHS at the installation level.

   1. Copy /tmp/apache/glassfish-lbplugin to ohs-install-dir/ohs.

   2. Update ohs-install-dir/ohs/bin/apachectl.

      Enter the following statement on a single line:

      LD_LIBRARY_PATH=$ORACLE_HOME/ohs/lib:$ORACLE_HOME/pcs/lib:$ORACLE_HOME/lib:
      $ORACLE_HOME/ohs/glassfish-lbplugin/lib:$LD_LIBRARY_PATH; export LD_LIBRARY_PATH
      

      Enter the following statement on a single line:

      NSS_STRICT_NOFORK=DISABLED; export NSS_STRICT_NOFORK
      

4. Configure OHS at the instance level.

   1. Create the following directories:

      ohs-instance-dir/config/OHS/ohs1/modules/resource
      ohs-instance-dir/config/OHS/ohs1/sec_db_files
      

   2. Copy the following file to ohs-instance-dir/config/OHS/ohs1/modules:

      ohs-install-dir/ohs/glassfish-lbplugin/lib/webserver-plugin/linux/apache2.2/mod_loadbalancer.so
      

   3. Copy the following directory to ohs-instance-dir/config/OHS/ohs1/modules:

      ohs-install-dir/ohs/glassfish-lbplugin/lib/webserver-plugin/linux/apache2.2/errorpages
      

   4. Copy the following files to ohs-instance-dir/config/OHS/ohs1/modules/resource:

      ohs-install-dir/ohs/glassfish-lbplugin/lib/webserver-plugin/linux/apache2.2/*.res
      

   5. Copy the following files to ohs-instance-dir/config/OHS/ohs1/sec_db_files:

      ohs-install-dir/ohs/glassfish-lbplugin/lib/webserver-plugin/linux/apache2.2/*.db
      

   6. Add the following entry as the last line in ohs-instance-dir/config/OHS/ohs1/httpd.conf:

      include "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/gf.conf"
      

   7. Also in ohs-instance-dir/config/OHS/ohs1/httpd.conf, modify the worker MPM settings as follows:

      Set StartServers to 1.

      Set MaxClients to 64.

      Set ThreadsPerChild to 64.

   8. In ohs-instance-dir/config/OHS/ohs1/ssl.conf, set <VirtualHost *:4444>.

   9. Create a file named ohs-instance-dir/config/OHS/ohs1/gf.conf and add the following entries.

      In this code sample, note that lines that are too long for this publication are truncated with a space and backslash (\). In cases where this truncation is used for a line, be sure to enter that line and the subsequent line in a single line in your configuration file.

      LoadModule apachelbplugin_module \
      ${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/ \
         modules/mod_loadbalancer.so
      <IfModule apachelbplugin_module>
         config-file "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/ \
            ${COMPONENT_NAME}/loadbalancer.xml"
         locale en
      </IfModule>
      <VirtualHost *:7777>
      DocumentRoot "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/htdocs"
      ServerName myserver
      </VirtualHost>
      

      Note:

      Replace port 7777 and ServerName with whatever values are used in your configuration.

   10. Copy the following file to ohs-instance-dir/config/OHS/ohs1:

       ohs-install-dir/ohs/glassfish-lbplugin/lib/dtds/glassfish-loadbalancer_1_3.dtd
       

   11. Generate a load-balancer.xml configuration file on GlassFish Server, and copy this file to ohs-instance-dir/config/OHS/ohs1.

       Use the export-http-lb-config subcommand to generate a load-balancer.xml file. See the export-http-lb-config(1) help page for more information.

   12. Start OHS.

       For example:

       ohs-instance-dir/bin/opmnctl startall
       

To Enable the Load Balancer Auto Apply Feature

This procedure is only required if you plan on using the load balancer Auto Apply feature with Oracle HTTP Server (OHS). The Auto Apply feature enables changes made to a configuration through the GlassFish Server Administration Console or from the command line with the apply-http-lb-changes subcommand to be automatically sent over the wire to the web server configuration directory.

Before You Begin

Before proceeding with the instructions in this procedure, ensure that you have completed the instructions in To Configure Oracle HTTP Server to Use the Loadbalancer Plug-In.

1. Export the GlassFish Server DAS certificate.

   Enter the following command on a single line:

   keytool -export -rfc -keystore domain-dir/config/keystore.jks
    -alias s1as -file glassfish.crt -storepass keystore-password
   

2. Copy the glassfish.crt file to the directory of your choice on the OHS server.

3. Add the GlassFish Server DAS certificate to the OHS keystore.

   Enter the following command on a single line:

   orapki wallet add
    -wallet ohs-instance-dir/config/OHS/ohs1/keystores/default/cwallet.sso
    -cert glassfish.crt -trusted_cert -auto_login_only
   

   Refer to the OHS documentation for more information about the orapki utility.

4. Create a new file named ohs-instance-dir/config/OHS/ohs1/gf-admin.conf and add the following entries:

   # OHS Listen PortListen 5443
   
   <VirtualHost *:5443>
     <IfModule ossl_module>
      #  SSL Engine Switch:
      #  Enable/Disable SSL for this virtual host.
      SSLEngine on
   
      #  Client Authentication (Type):
      #  Client certificate verification type and depth.  Types are
      #  none, optional and require.
      SSLVerifyClient require
   
      #  SSL Cipher Suite:
      #  List the ciphers that the client is permitted to negotiate
      #  (enter these ciper names on a single line).
      SSLCipherSuite SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,
      SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_DES_CBC_SHA,
      TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA
   
      # SSL Certificate Revocation List Check
      # Valid values are On and Off
      SSLCRLCheck Off
   
      #Path to the wallet (enter path on a single line).
      SSLWallet "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/
      ${COMPONENT_NAME}/keystores/default"
          
     </IfModule>
   
   <Location /lbconfigupdate>
                  SSLRequireSSL
                  SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
                          and %{SSL_CLIENT_S_DN_O} eq "Oracle Corporation" \
                          and %{SSL_CLIENT_S_DN_OU} eq "GlassFish" \
                          and %{SSL_CLIENT_M_SERIAL} eq <SERIAL NUMBER> )
   </Location>
   
   </VirtualHost>
   

   Note:

   Port 5443 is used in this example. This port can be changed to any port that is appropriate for your system. This same port must be used when running the create-http-lb subcommand.

5. Update the <SERIAL NUMBER> entry in the new ohs-instance-dir/config/OHS/ohs1/gf-admin.conf file.

   1. Get the serial number from the glassfish.crt file.

      keytool -printcert -file path-name/glassfish.crt
      

   2. Replace <SERIAL NUMBER> in the gf-admin.conf file with the value from the glassfish.crt file.

   3. Convert the updated <SERIAL NUMBER> string in the gf-admin.conf file to all uppercase.

6. Add the following line to the httpd.conf:

   include "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/gf-admin.conf"
   

7. Stop and restart OHS.

To Install the Loadbalancer Plug-In

This procedure explains how to download and install the GlassFish Loadbalancer Plug-In. Most of the configuration instructions for the Plug-In are integrated into the GlassFish Loadbalancer Configurator interface and online help, so the instructions here are intended only to get you started with the plug-in configuration process.

Before You Begin

Before installing the Loadbalancer Plug-In, ensure that the following conditions have been met:

• Your operating system and web server combination is supported by the Loadbalancer Plug-in. See Supported Operating Systems and Web Servers.

• GlassFish Server 3.1.2 is installed and configured as described in the Oracle GlassFish Server Installation Guide.

• The web server for which you want to configure the Loadbalancer Plug-In is installed and configured according to the web server software provider's instructions.

• You have reviewed and, if necessary, performed the preparatory web server configuration steps explained earlier in this chapter.

1. Download the GlassFish Loadbalancer Configurator ZIP archive.

   The Configurator ZIP archive is available for download at http://www.oracle.com/technetwork/middleware/glassfish/downloads/index.html.

2. Unzip the Configurator ZIP archive to the directory of your choice.

3. Launch the Loadbalancer Configurator by running the glassfish-lbconfigurator-3_1.jar file that was included in the Configurator ZIP archive.

   The version number will vary depending on the version of the Configurator archive you downloaded. For example:

   java -jar glassfish-lbconfigurator-3_1.jar
   

4. Follow the onscreen instructions in the Loadbalancer Configurator.

   Use the Help button to display online help for any screen for which you want additional information.

5. When the Configurator has completed, proceed with the instructions in Verifying Loadbalancer Plug-In Configuration.

To Verify the Loadbalancer Plug-In Configuration

1. Create a GlassFish Server cluster.

   Use the asadmin create-cluster command. For instructions, refer to Creating, Listing, and Deleting Clusters.

2. Follow the instructions in To Set Up Load Balancing Using the asadmin Tool.