Chapter 7. Platform-specific Configuration
- 7.1. Configure the Portal Root Password
- 7.2. About JBoss Portal Domain Mode
- 7.3. Provision JCR and IDM Databases
- 7.4. JTA Support Configuration
- 7.5. Email Service Configuration
- 7.6. Email Notifications Configuration
- 7.7. Clustering Configuration
- 7.8. Setting mod_jk for Cluster Configuration
- 7.9. HTTPS Configuration
- 7.10. Enable HTTPS Communication
- 7.11. Specify White-list and Black-list Gadget Proxy Resources
- 7.12. Validator Configuration
- 7.13. Custom Password Policy
- 7.14. Password Encryption
7.1. Configure the Portal Root Password
Procedure 7.1. Setting the Root Password Through the Command-line
- Open a terminal and execute the
portal-setup.shscript.- For Linux,
$JPP_HOME/bin/portal-setup.sh - For Microsoft Windows,
%JPP_HOME%\bin\portal-setup.bat
- Type a value for the root password when prompted and press Enter. Re-type the password and press Enter.The password is encrypted and stored in the
$JPP_HOME/standalone/configuration/gatein/configuration.propertiesfile. - Start JBoss Portal.
- Open the Users Management interface and create the required accounts, including an Administrator account.
Procedure 7.2. Setting the Root Password Through the Web Interface
Important
configuration.properties has no effect.
- Once all configuration in this user guide has been completed, start JBoss Portal.
- Open JBoss Portal in a browser.
- In the Set Root Password page, type a Root password in the Password field, and repeat the same password in the Repeat password field.
- Click Setup to set the Root password.To modify the Root password on subsequent occasions, use the portal administration interface for Users Management.
7.2. About JBoss Portal Domain Mode
7.3. Provision JCR and IDM Databases
JPP_DIST/standalone/configuration/standalone.xml and for clustered configuration in the standalone-ha.xml file.
Procedure 7.3. Configuring the Java Content Repository (JCR)
- Open
JPP_DIST/standalone/configuration/standalone.xmlin edit mode. - Bind the JCR datasource to JNDI under
java:/jdbcjcr_portal.<datasource jndi-name="java:/jdbcjcr_portal" pool-name="JCRPortalDS" enabled="true" use-java-context="true"> <connection-url>jdbc:h2:file:${jboss.server.data.dir}/gatein/portal/jdbcjcr_portal;DB_CLOSE_DELAY=-1</connection-url> <driver>h2</driver> <security> <user-name>sa</user-name> <password>sa</password> </security> </datasource>
- If additional portals are deployed, additional datasources must be configured and bound in JNDI using a separate
java:/jdbcjcr_PORTAL-NAMEdirective.Ensure the user has rights to create tables on jdbcjcr_portal, and to update them as they will automatically be created during the first startup.
Procedure 7.4. Configuring Identity Management (IDM)
- Open
JPP_DIST/standalone/configuration/standalone.xmlin edit mode. - Bind the IDM datasource to JNDI under
java:/jdbcidm_portal.<datasource jndi-name="java:/jdbcidm_portal" pool-name="JCRPortalDS" enabled="true" use-java-context="true"> <connection-url>jdbc:h2:file:${jboss.server.data.dir}/gatein/portal/jdbcjcr_portal;DB_CLOSE_DELAY=-1</connection-url> <driver>h2</driver> <security> <user-name>sa</user-name> <password>sa</password> </security> </datasource>
- If additional portals are deployed, additional datasources must be configured and bound in JNDI using a separate
java:/jdbcjcr_PORTAL-NAMEdirective.Ensure the user has rights to create tables on jdbcjcr_portal, and to update them as they will automatically be created during the first startup.
See Also:
7.4. JTA Support Configuration
7.4.1. JTA Support
7.4.2. JDBC Driver Download Locations
Table 7.1. JDBC driver download locations
| Vendor | Download Location |
|---|---|
| MySQL | |
| PostgreSQL | |
| Oracle | |
| IBM | |
| Sybase | |
| Microsoft |
7.4.3. Install a JDBC Driver as a Core Module
- Select the correct JDBC driver from the information in the Supported Configurations document at https://access.redhat.com/site/articles/119833 and download the driver package.
- Extract the archive.
Procedure 7.5. Install a JDBC Driver as a Core Module
- Create a file path structure under the
JPP_HOME/modules/system/layers/basedirectory. For example, for a MySQL JDBC driver, createJPP_HOME/modules/system/layers/base/com/mysql/main/. - Copy the JDBC driver JAR into the
main/subdirectory. - In the
main/subdirectory, create amodule.xmlfile. The following is an example of amodule.xmlfile:<?xml version="1.0" encoding="UTF-8"?> <module xmlns="urn:jboss:module:1.0" name="com.mysql"> <resources> <resource-root path="mysql-connector-java-5.1.15.jar"/> </resources> <dependencies> <module name="javax.api"/> <module name="javax.transaction.api"/> </dependencies> </module>
- Start the Server.
- Start the Management CLI.
- Run the CLI command to add the JDBC driver module to the server configuration.The command you choose depends on the number of classes listed in the
/META-INF/services/java.sql.Driverfile located in the JDBC driver JAR. For example, the/META-INF/services/java.sql.Driverfile in the MySQL 5.1.20 JDBC JAR lists two classes:When there is more than one entry, you must also specify the name of the driver class. Failure to do so results in an error similar to the following:com.mysql.jdbc.Drivercom.mysql.fabric.jdbc.FabricMySQLDriver
Example 7.1. Driver class error
JBAS014749: Operation handler failed: Service jboss.jdbc-driver.mysql is already registered
Note
The value for DRIVER_NAME depends on the number of classes listed in the/META-INF/services/java.sql.Driverfile located in the JDBC driver JAR. If there is only one class, the value is the name of the JAR. If there are multiple classes, the value is the name of the JAR + driverClassName + "_" + majorVersion +"_" + minorVersion. Failure to do so will result in the following error being logged:JBAS014775: New missing/unsatisfied dependencies
For example, the DRIVER_NAME value required for the MySQL 5.1.31 driver, ismysql-connector-java-5.1.31-bin.jarcom.mysql.jdbc.Driver_5_1.- Run the CLI command for JDBC JARs containing one class entry.
/subsystem=datasources/jdbc-driver=DRIVER_NAME:add(driver-name=DRIVER_NAME,driver-module-name=MODULE_NAME,driver-xa-datasource-class-name=XA_DATASOURCE_CLASS_NAME)
Example 7.2. CLI Command for Standalone Mode for JDBC JARs with one driver class
/subsystem=datasources/jdbc-driver=mysql:add(driver-name=mysql,driver-module-name=com.mysql,driver-xa-datasource-class-name=com.mysql.jdbc.jdbc2.optional.MysqlXADataSource)
Example 7.3. CLI Command for Domain Mode for JDBC JARs with one driver class
/profile=ha/subsystem=datasources/jdbc-driver=mysql:add(driver-name=mysql,driver-module-name=com.mysql,driver-xa-datasource-class-name=com.mysql.jdbc.jdbc2.optional.MysqlXADataSource)
- Run the CLI command for JDBC JARs containing multiple class entries.
/subsystem=datasources/jdbc-driver=DRIVER_NAME:add(driver-name=DRIVER_NAME,driver-module-name=MODULE_NAME,driver-xa-datasource-class-name=XA_DATASOURCE_CLASS_NAME, driver-class-name=DRIVER_CLASS_NAME)
Example 7.4. CLI Command for Standalone Mode for JDBC JARs with multiple driver class entries
/subsystem=datasources/jdbc-driver=mysql:add(driver-name=mysql,driver-module-name=com.mysql,driver-xa-datasource-class-name=com.mysql.jdbc.jdbc2.optional.MysqlXADataSource, driver-class-name=com.mysql.jdbc.Driver)
Example 7.5. CLI Command for Domain Mode for JDBC JARs with multiple driver class entries
/profile=ha/subsystem=datasources/jdbc-driver=mysql:add(driver-name=mysql,driver-module-name=com.mysql,driver-xa-datasource-class-name=com.mysql.jdbc.jdbc2.optional.MysqlXADataSource, driver-class-name=com.mysql.jdbc.Driver)
7.4.4. Configure Datasources for JTA Support
Procedure 7.6. Shared Datasource Configuration
- Open
JPP_HOME/standalone/configuration/standalone.xml. - Comment the jdbcjcr_portal <datasource> directive to disable the JCR datasource.
<datasources> <!--<datasource jndi-name="java:/jdbcjcr_portal" pool-name="JCRPortalDS" enabled="true" use-java-context="true"> <connection-url>jdbc:h2:file:${jboss.server.data.dir}/gatein/portal/jdbcjcr_portal;DB_CLOSE_DELAY=-1</connection-url> <driver>h2</driver> <security> <user-name>sa</user-name> <password>sa</password> </security> </datasource>--> </datasources>
- Configure jdbcidm_portal <datasource> directive to use the MySQL database.
<datasources> <!--<datasource jndi-name="java:/jdbcjcr_portal" pool-name="JCRPortalDS" enabled="true" use-java-context="true"> <connection-url>jdbc:h2:file:${jboss.server.data.dir}/gatein/portal/jdbcjcr_portal;DB_CLOSE_DELAY=-1</connection-url> <driver>h2</driver> <security> <user-name>sa</user-name> <password>sa</password> </security> </datasource>--> <datasource jndi-name="java:/jdbcidm_portal" pool-name="IDMPortalDS" enabled="true" use-java-context="true"> <connection-url>jdbc:mysql://localhost/portal</connection-url> <driver>mysql</driver> <security> <user-name>portal</user-name> <password>portal</password> </security> <pool> <min-pool-size>10</min-pool-size> <max-pool-size>100</max-pool-size> <prefill>true</prefill> </pool> </datasource> </datasources>
- Add the MySQL module into the list of <drivers>.
<datasources> <!--<datasource jndi-name="java:/jdbcjcr_portal" pool-name="JCRPortalDS" enabled="true" use-java-context="true"> <connection-url>jdbc:h2:file:${jboss.server.data.dir}/gatein/portal/jdbcjcr_portal;DB_CLOSE_DELAY=-1</connection-url> <driver>h2</driver> <security> <user-name>sa</user-name> <password>sa</password> </security> </datasource>--> <datasource jndi-name="java:/jdbcidm_portal" pool-name="IDMPortalDS" enabled="true" use-java-context="true"> <connection-url>jdbc:mysql://localhost/portal</connection-url> <driver>mysql</driver> <security> <user-name>portal</user-name> <password>portal</password> </security> <pool> <min-pool-size>10</min-pool-size> <max-pool-size>100</max-pool-size> <prefill>true</prefill> </pool> </datasource> <drivers> <driver name="mysql" module="com.mysql"> <xa-datasource-class>com.mysql.jdbc.Driver</xa-datasource-class> </driver> </drivers> </datasources>
- Open
JPP_HOME/standalone/configuration/gatein/configuration.properties, and verify the gatein.jcr.datasource.name property has the value java:/jdbcidm. This value ensures the JCR database uses the IDM database as the datasource.gatein.jcr.datasource.name=java:/jdbcidm gatein.idm.datasource.name=java:/jdbcidm
Procedure 7.7. XA Datasource Configuration
Important
- Open
JPP_HOME/standalone/configuration/standalone.xml. - Configure jdbcidm_portal <xa-datasource> directive to use the MySQL database.
<datasources> <xa-datasource jndi-name="java:/jdbcidm_portal" pool-name="IDMPortalDS" enabled="true" use-java-context="true"> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="DatabaseName">portalidm</xa-datasource-property> <driver>mysql</driver> <xa-pool> <min-pool-size>10</min-pool-size> <max-pool-size>100</max-pool-size> <prefill>true</prefill> </xa-pool> <security> <user-name>portal</user-name> <password>portal</password> </security> </xa-datasource> </datasources>
- Configure jdbcjcr_portal <xa-datasource> directive to use the MySQL database.
<datasources> <xa-datasource jndi-name="java:/jdbcidm_portal" pool-name="IDMPortalDS" enabled="true" use-java-context="true"> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="DatabaseName">portalidm</xa-datasource-property> <driver>mysql</driver> <xa-pool> <min-pool-size>10</min-pool-size> <max-pool-size>100</max-pool-size> <prefill>true</prefill> </xa-pool> <security> <user-name>portal</user-name> <password>portal</password> </security> </xa-datasource> <xa-datasource jndi-name="java:/jdbcjcr_portal" pool-name="JCRPortalDS" enabled="true" use-java-context="true"> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="DatabaseName">portaljcr</xa-datasource-property> <driver>mysql</driver> <xa-pool> <min-pool-size>10</min-pool-size> <max-pool-size>100</max-pool-size> <prefill>true</prefill> </xa-pool> <security> <user-name>portal</user-name> <password>portal</password> </security> </xa-datasource> </datasources>
- Add the MySQL module into the list of <drivers>.
<datasources> <xa-datasource jndi-name="java:/jdbcidm_portal" pool-name="IDMPortalDS" enabled="true" use-java-context="true"> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="DatabaseName">portalidm</xa-datasource-property> <driver>mysql</driver> <xa-pool> <min-pool-size>10</min-pool-size> <max-pool-size>100</max-pool-size> <prefill>true</prefill> </xa-pool> <security> <user-name>portal</user-name> <password>portal</password> </security> </xa-datasource> <xa-datasource jndi-name="java:/jdbcjcr_portal" pool-name="JCRPortalDS" enabled="true" use-java-context="true"> <xa-datasource-property name="ServerName">localhost</xa-datasource-property> <xa-datasource-property name="DatabaseName">portaljcr</xa-datasource-property> <driver>mysql</driver> <xa-pool> <min-pool-size>10</min-pool-size> <max-pool-size>100</max-pool-size> <prefill>true</prefill> </xa-pool> <security> <user-name>portal</user-name> <password>portal</password> </security> </xa-datasource> <drivers> <driver name="mysql" module="com.mysql"> <xa-datasource-class>com.mysql.jdbc.jdbc2.optional.MysqlXADataSource</xa-datasource-class> </driver> </drivers> </datasources>
- Open
JPP_HOME/standalone/configuration/gatein/configuration.properties, and verify the gatein.jcr.datasource.name property has the value java:/jdbcidm. This value ensures the JCR database uses the IDM database as the datasource.gatein.jcr.datasource.name=java:/jdbcjcr gatein.idm.datasource.name=java:/jdbcidm
7.4.5. Configure Hibernate and Picketlink
Procedure 7.8. Configuring Hibernate and Picketlink for JTA
- Open
JPP_HOME/gatein/gatein.ear/portal.war/WEB-INF/conf/organization/idm-configuration.xml - In the hibernate.properties <init-params> group, comment the Non-JTA Setup directives, and uncomment the JTA Setup directives:
<init-params> <properties-param> <name>hibernate.properties</name> <description>Default Hibernate Service</description> <property name="hibernate.hbm2ddl.auto" value="update"/> <property name="hibernate.show_sql" value="false"/> <property name="hibernate.connection.datasource" value="${gatein.idm.datasource.name}${container.name.suffix}"/> <property name="hibernate.connection.autocommit" value="false"/> <!-- Non-JTA setup --> <!--<property name="hibernate.current_session_context_class" value="thread"/>--> <!-- JTA setup --> <property name="hibernate.current_session_context_class" value="jta"/> <property name="hibernate.transaction.factory_class" value="org.hibernate.transaction.JTATransactionFactory" /> <property name="hibernate.transaction.jta.platform" value="org.exoplatform.services.organization.idm.UserTransactionJtaPlatform" /> <!-- Remaining code removed for readability-->
- In the org.exoplatform.services.organization.idm.Config <init-params> group, change useJTA <field> value to
true.<field name="useJTA"> <boolean>true</boolean> </field>
This setting forces PicketlinkIDMOrganizationServiceImpl to encapsulate each HTTP request within the JTA transaction, instead of the Hibernate transaction API. The bounds of the transaction are startRequest and endRequest.Important
If managed transactions are used in portlet applications (for example, using EJB with Container-Managed transactions), be aware that some changes to transaction behavior may occur in the application.Ensure that portlet applications do not attempt to start or commit JTA transactions from the application. - Open
JPP_HOME/gatein/gatein.ear/portal.war/WEB-INF/conf/organization/picketlink-idm/picketlink-idm-config.xml - In the <stores> directives, change the lazyStartOfHibernateTransaction option to
falseto switch transaction management from PicketLink to JTA.
7.4.6. Last Resource Commit Optimization (LRCO)
7.5. Email Service Configuration
Procedure 7.9. Configuring the SMTP Email Service
- Open
JPP_HOME/standalone/configuration/gatein/configuration.propertiesin edit mode. - Specify the Google Account information as indicated in the file.
# EMail gatein.email.smtp.username=[user@gmail.com] gatein.email.smtp.password=[password|app-specific password] gatein.email.smtp.host=smtp.gmail.com gatein.email.smtp.port=465 gatein.email.smtp.starttls.enable=true gatein.email.smtp.auth=true gatein.email.smtp.socketFactory.port=465 gatein.email.smtp.socketFactory.class=javax.net.ssl.SSLSocketFactory
- When provisioning the Email Service for a production environment, it is recommended to specify a corporate SMTP gateway and port for the
smtp.hostandsmtp.portvariables.If using a SMTP gateway over SSL, a certificate trust store containing the SMTP server public certificate is required. Depending on the key sizes, Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy files are required for the Java Runtime Environment (JRE).
7.6. Email Notifications Configuration
Prerequisites:
- Notifications about new users, which are typically useful on portals that have a public registration page.
- Notifications about invalid login attempts, which can help in identifying security attacks.
Procedure 7.10. Enabling Notifications about New User Registration
- Configure an SMTP account.
- Configure the following mandatory configuration items located in the
PostRegistrationServicepart of theJPP_HOME/gatein/gatein.ear/portal.war/WEB-INF/conf/admin/admin-configuration.xmlconfiguration file.- sendMailAfterRegistration
- Boolean value that specifies whether an email notification is sent for new user registrations.The default value is
false. If set totrue, email notifications are sent when users join. - mailTo
- Specifies the email address to which notifications are sent.
- Configure optional parameters to customize the content of the notification emails:
- mailFrom
- Specifies the email address from which the notification email is sent.
- mailSubject
- Specifies the subject of the notification email.
- mailMessage
- Specifies the body of the notification email.The
${user.name},${user.firstName},${user.lastName}and${user.email}macros can be used in the text to dynamically include the respective values in each notification email.
- Test the configuration by restarting the server and registering a new user in the JBoss Portal user interface. An email is sent to the specified email address, notifying the recipient that a user has been registered to the portal.
Procedure 7.11. Enabling Notifications about Invalid Login Attempts
- Configure an SMTP account.
- Configure the following mandatory configuration items located in the
InvalidLoginAttemptsServicepart of theJPP_HOME/gatein/gatein.ear/portal.war/WEB-INF/conf/admin/admin-configuration.xmlconfiguration file.- sendingMailsEnabled
- boolean value determining if e-mail notifications about invalid login attempts are enabled. It is
falseby default and needs to be changed totruefor the e-mail notifications to be sent. - mailTo
- Specifies the email address to which notifications are sent.
- Configure optional parameters to customize the content and policies associated with notification emails:
- mailFrom
- Specifies the email address from which the notification email is sent.
- mailSubject
- Specifies the subject of the notification email.
- mailMessage
- Specifies the body of the notification email.The
${user.name},${user.firstName},${user.lastName}and${user.email}macros can be used in the text to dynamically include the respective values in each notification email. - numberOfFailedAttempts
- Specifies the number of invalid login attempts after which an email notification is sent. The default value is
3. - invalidLoginPolicy
- Specifies the policy used to determine that invalid login attempts are coming from same source. The available values are
SESSION- the default, indicating that invalid login attempts must originate from the same HTTP session.SESSION_AND_USER- indicates that invalid login attempts must originate from the same HTTP session, and contain the same user name.SERVER- indicates that invalid login attempts must come from the same remote server.
- Test the configuration by restarting the server and attempting to login to JBoss Portal with invalid account credentials.Repeat the attempt for the number of times specified in the
numberOfFailedAttemptsparameter (the default is three attempts). - An email is sent to the specified email address, notifying the recipient that an invalid login attempt has been detected.
7.7. Clustering Configuration
- Using a single physical server
- One physical server using two virtual IP addresses.This configuration is used during basic clustering testing in a development environment, and can use the pre-configured Hypersonic (H2) database (which is not supported in production environments).For assistance configuring virtual IP addresses, consult the Operating System documentation for guidance.
- Using more than one physical server
- This method uses two or more servers, each configured to use a JBoss Portal binary. For example, a "node1" directory available on server one and a "node2" directory available on server two.This configuration is recommended for production environments. A supported databased documented in Tested Configurations is required for this configuration.
Configuring a Red Hat JBoss Portal Virtual Cluster for Basic Testing
standalone-ha.xml file. For this example, no modification is required to the file. For production environments, changes to this file are required and are documented in this guide.
- Configure two virtual IP addresses:
- 192.168.210.101, which is used for "node1" in this procedure.
- 192.168.210.102, which is used for "node2" in this procedure.
- Create two cluster nodes from the JBoss Portal binary:
$ cp -r jboss-jpp-6.2/ node1 $ cp -r jboss-jpp-6.2/ node2
- Copy the Hypersonic database JAR into the JRE to act as the data store for the virtual servers.
$ java -cp modules/system/layers/base/com/h2database/h2/main/h2-1.3.168.redhat-4.jar org.h2.tools.Server
- Start the servers from the node1 and node2 directories:From node1 directory.
$ ./bin/standalone.sh --server-config=standalone-ha.xml -Djboss.node.name=node1 -b 192.168.210.101 -u 239.23.42.2 -Djboss.bind.address.management=192.168.210.101
From node2 directory.$ ./bin/standalone.sh --server-config=standalone-ha.xml -Djboss.node.name=node2 -b 192.168.210.102 -u 239.23.42.2 -Djboss.bind.address.management=192.168.210.102
Both nodes start, and can be accessed through their web interfaces:- node1 on http://192.168.210.101:8080/portal
- node2 on http://192.168.210.102:8080/portal
7.8. Setting mod_jk for Cluster Configuration
Procedure 7.12. To setup the loadbalancer server which uses Apache HTTPD+Mod_jk:
Install apache server and mod_jk module
The package that contains Apache HTTP Server is known as httpd. To build and install mod_jk from source code use the package httpd-devel.Setup apache to use mod_jk
Copy the filemod-jk.confto/etc/httpd/conf.dand append the following line to/etc/httpd/conf/httpd.confto load the module.LoadModule jk_module modules/mod_jk.so
Filemod-jk.confis as follows:# Where to find workers.properties JkWorkersFile workers.properties # Where to put jk logs JkLogFile /var/log/apache2/mod_jk.log # Set the jk log level [debug/error/info] JkLogLevel debug # Select the log format JkLogStampFormat "[%a %b %d %H:%M:%S %Y]" # JkOptions indicates to send SSK KEY SIZE JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories # JkRequestLogFormat #JkRequestLogFormat "%w %V %T" JkMountFile uriworkermap.properties # Add shared memory. # This directive is present with 1.2.10 and # later versions of mod_jk, and is needed for load balancing to work properly JkShmFile /var/log/apache2/jk.shm # Add jkstatus for managing runtime data <Location> /jkstatus/> JkMount status </Location>
Setup Workers:
Createworkers.propertiesfile in /etc/httpd/.Note
The Balanced workers must have the same name as the name of jboss.node.name as shown in Section 7.7, “Clustering Configuration”. The example uses the names node1 and node2. The values for balanced workers inworkers.propertiesfile must also have the same name as node1 and node2.The fileworkers.propertiesis as follows:# Define list of workers that will be used for mapping requests worker.list=loadbalancer,status # modify the host as your host IP or DNS name worker.node1.port=8009 worker.node1.host=192.168.210.101 worker.node1.type=ajp13 worker.node1.lbfactor=1 ## modify the host as your host IP or DNS name worker.node2.port=8009 worker.node2.host=192.168.210.102 worker.node2.type=ajp13 worker.node2.lbfactor=1 # Load-balancing behaviour worker.loadbalancer.type=lb worker.loadbalancer.method=Session worker.loadbalancer.balance_workers=node1,node2 worker.loadbalancer.sticky_session=1 #worker.list=loadbalancer worker.status.type=status
The fileuriworkermap.propertiesis as follows:/portal=loadbalancer /portal/*=loadbalancer /eXo*=loadbalancer /eXoResources*/*=loadbalancer /exo*=loadbalancer /exo*/*=loadbalancer /web=loadbalancer /web/*=loadbalancer /integration=loadbalancer /integration/*=loadbalancer /dashboard=loadbalancer /dashboard/*=loadbalancer /rest=loadbalancer /rest/*=loadbalancer /jpp_branding_skin|/*=loadbalancer /jpp-branding-skin|/*=loadbalancer /jpp-branding-extension|/*=loadbalancer /status=status /status/*=status
Troubleshooting error "503 Service Temporarily Unavailable"
- Problem Description
- When accessing JBoss Portal using Apache, a "503 Service Temporarily Unavailable" response is received when trying to access JBoss Portal using Apache. The cluster is working and the individual JBoss Portal nodes can be accessed directly. The logs mod_jk.log indicates mod_jk is working, but Tomcat is reported as not running on the specified port.
- Cause
- In Red Hat Enterprise Linux, SELinux prevents httpd from accessing an important resource, such as jk.shm. Check SELinux alerts to verify this fact.
- Solution
- Temporarily disable SELinux to allow Apache to initialize the mod_jk connector properly by executing the following command:
setenforce 0
7.9. HTTPS Configuration
Important
- Generate encryption keys and certificate.
- Export the self-signed certificate.
- Import the certificate to the trust store.
- Define the keystore and truststore details in the HTTPS connector directive file.
7.10. Enable HTTPS Communication
Generate a Keystore using the Java Keytool
Note
native="false" flag on the web subsystem configuration.
Prerequisites
- Read and understand how keypairs and certificates operate in the About SSL Encryption section of the JBoss Enterprise Application Platform 6 Development Guide.
- Understand the command-line parameters of
keytoolas documented in the Oracle Java Tools documentation. - Obtain the JDK keystore password. For new installations, the default JDK password is "
changeme".
- Run the command to generate a simple certificate using the keytool command (if you do not have your own X.509 certificate). The certificate is stored in the
server.keystorefile.keytool -genkey -alias serverkeys -keyalg RSA -keystore server.keystore -storepass 123456 -keypass 123456 -dname "CN=localhost, OU=MYOU, O=MYORG, L=MYCITY, ST=MYSTATE, C=MY"
- Import the key into the Sun JDK keystore:
keytool -importkeystore -srckeystore server.keystore -destkeystore $JAVA_HOME/jre/lib/security/cacerts
Note
On OS X, thecacertsfile is located at$JAVA_HOME/lib/security/cacerts - Change the key password to match the new keystore password (in most instances this is the default JDK trustore password;
changeit.keytool -keypasswd -alias serverkeys --keystore $JAVA_HOME/jre/lib/security/cacerts
Generate a Keystore using OpenSSL
Note
native="false" flag on the web subsystem configuration.
Prerequisites
- Read and understand how keypairs and certificates operate in the "About SSL Encryption" section of the JBoss Enterprise Application Platform 6 Development Guide
- Understand the command-line parameters of
opensslas documented in the command-line help. - Obtain the JDK keystore password. For new installations, the default JDK password is "
changeme".
- Generate a simple key file using the openssl genrsa command:
openssl genrsa -des3 -out server.pem 1024
The above command will store the key inserver.keystore. - Generate a certificate signing request using the openssl
-reqcommand:openssl req -new -key server.pem -out server.csr
- Generate a server certificate from the server.csr key using the openssl
-reqcommand:openssl x509 -req -days 365 -in server.csr -signkey server.pem -out servercert.pem
Configure JBoss Portal to Use The Key
- Edit
JPP_HOME/standalone/configuration/standalone.xmlto add the HTTPS connector to the web subsystem configuration.Changecertificate-key-fileandpasswordto values appropriate for the keystore. This procedure assumes the keystore password is the default:changeit):For Java keytool, as described in Generate a Keystore using the Java Keytool: <subsystem xmlns="urn:jboss:domain:web:1.2" default-virtual-server="default-host" native="false"> ... <connector name="https" protocol="HTTP/1.1" socket-binding="https" scheme="https" secure="true"> <ssl name="https" key-alias="serverkeys" password="changeit" certificate-key-file="${java.home}/jre/lib/security/cacerts"/> </connector> ... </subsystem>
For OpenSSL, as described in Generate a Keystore using OpenSSL:<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true" enabled="true"> <ssl password="mypassword" certificate-key-file="server.pem" protocol="TLSv1" verify-client="true" certificate-file="servercert.pem"/> </connector>
- Save and close the file.
- Restart the portal.
- JBoss Portal can now communicate using a secure connection.
7.11. Specify White-list and Black-list Gadget Proxy Resources
Task: Specify White-list and Black-list Gadget Proxy Resources
Prerequisites
- You have installed the platform, and performed all configuration tasks up to this task.
- Navigate to
JPP_HOME/gatein/gatein.ear/portal.war/WEB-INF/conf/common/ - Open
common-configuration.xmlin a text editor. - Append the ProxyFilterService <component> block to the file.
<component> <key>org.exoplatform.web.security.proxy.ProxyFilterService</key> <type>org.exoplatform.web.security.proxy.ProxyFilterService</type> <init-params> <values-param> <!-- The white list --> <name>white-list</name> <value></value> </values-param> <values-param> <name>black-list</name> <value></value> </values-param> </init-params> </component>
- In the <name>white-list</name> block, specify the name of the domains you want to grant access to by adding <value> directives for each domain name.
Important
A required resource must be explicitly defined in the white-list. Failure to do so will result in the resource being treated as black-listed.Wildcard characters can be used to simplify configuration. For example,*.example.comwould allow all domains withexample.comas the suffix. - In the <name>black-list</name> block, specify the name of the domains you want to deny access to by adding <value> directives for each domain name.Wildcard characters can be used to simplify configuration. For example,
*.example.comwould deny all domains withexample.comas the suffix. - Save and close
common-configuration.xml. - You have specified the gadget domains required in your installation. This completes the procedure.
7.12. Validator Configuration
JPP_HOME/standalone/configuration/gatein/configuration.properties file.
Important
- Length must be between 3 and 30 characters.
- Must start with a letter.
- Must end with a letter or number.
- Only lowercase letters, numbers, underscores (_) and period (.) can be used.
- No consecutive underscores (_) or period (.) can be used.
- gatein.validators.[username|groupmembership].length.min
- Minimum length of the validated field.
- gatein.validators.[username|groupmembership].length.max
- Maximum length of the validated field.
- gatein.validators.[username|groupmembership].regexp
- Regular expression to which values of the validated field must conform.
- gatein.validators.[username|groupmembership].format.message
- Information message that displays when the value of the validated field does not conform to the specified regular expression.
[username|groupmembership] refers to the configuration type.
username configuration type sets how user names are validated when created by the user registration portlet, or modified by the user account portlet.
groupmembership configuration type sets how user names are validated when created or modified by the group membership portlet.
email configuration type sets how email fields are validated.
displayname configuration type sets how user's display name fields are validated.
jobtitle configuration type sets how user profile's job title fields are validated.
grouplabel configuration type sets how group membership label is validated.
Example 7.7. Email as the User Name Mask
# validators
gatein.validators.username.regexp=^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-za-z]{2,4}$
gatein.validators.username.format.message=Username must be a valid email address.
Example 7.8. Letter and Number Combination
# validators
gatein.validators.username.length.min=5
gatein.validators.username.length.max=10
gatein.validators.username.regexp=^u\d{4,9}$
gatein.validators.username.format.message=Username must start with ''u'' and be followed by 4 to 9 digits.7.13. Custom Password Policy
passwordpolicy property.
passwordpolicy property is defined in the configuration.properties file.
passwordpolicy property defines the format, length, and valid expression for an acceptable password.
gatein.validators.passwordpolicy.format.message=Minimum of 1 digit, 1 lower case, 1 upper case, minimum of 6 chars, max of 20. gatein.validators.passwordpolicy.regexp=((?=.*\\d)(?=.*[a-z])(?=.*[A-Z]).{6,20}) gatein.validators.passwordpolicy.length.max=20 gatein.validators.passwordpolicy.length.min=6
Important
7.14. Password Encryption
7.14.1. About Remember Me Password Encryption
7.14.2. Symmetric Password Encryption
Example 7.9. JCA-based Configuration
configuration.properties file.
gatein.codec.builderclass=org.exoplatform.web.security.codec.JCASymmetricCodecBuilder
gatein.codec.config=${gatein.conf.dir}/codec/jca-symmetric-codec.properties
Note
jca-symmetric-codec.properties file in the default JBoss Portal binary.
org.exoplatform.web.security.codec.JCASymmetricCodecBuilder is used, and that it is configured in the jca-symmetric-codec.properties file.
Example 7.10. Customized Properties File
configuration.properties values can be changed if the default settings require customization. Observe how the values in the file correspond to the keytool command parameters.
# Detailed information on JCA standard names can be found at # # http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#KeyStore # # The file key.txt is generated using the keytool utility in the JDK # # keytool -genseckey -alias "gtnKey" -keypass "gtnKeyPass" -keyalg "AES" -keysize 128 -keystore "key.txt" -storepass "gtnStorePass" -storetype "JCEKS" # # gatein.codec.jca.symmetric.alias=gtnKey gatein.codec.jca.symmetric.keypass=gtnKeyPass gatein.codec.jca.symmetric.keyalg=AES gatein.codec.jca.symmetric.keystore=key.txt gatein.codec.jca.symmetric.storepass=gtnStorePass gatein.codec.jca.symmetric.storetype=JCEKS
7.14.3. Customization using JCASymmmetricCodecBuilder
Example 7.11. Command to generate secret key
$JAVA_HOME/bin/keytool -genseckey -alias "customAlias" -keypass "customKeyPass" -keyalg "customAlgo" -keystore "customStore" -storepass "customStorePass" -storetype "customStoreType"
Note
- The list of available algorithms can be found in Standard Algorithm Name Documentation .
- Some extra params for keytool might be required for some algorithms.
- In JCA, only JCEKS storetype supports symmetric encryption.
keytool command stores the freshly generated secret key in a file named customStore . Copy this file to the gatein/conf/codec directory to be able to reference it in jca-symmetric-codec.properties file.
jca-symmetric-codec.properties file with parameters used in the above keytool invocation:
Example 7.12. Update jca-symmetric-codec.properties file
gatein.codec.jca.symmetric.alias=customAlias gatein.codec.jca.symmetric.keypass=customKeyPass gatein.codec.jca.symmetric.keyalg=customAlgo gatein.codec.jca.symmetric.keystore=customStore gatein.codec.jca.symmetric.storepass=customStorePass gatein.codec.jca.symmetric.storetype=customStoreType