Procedure 2.1. Configure Apache to Load mod_jk

1. Open HTTPD_DIST/conf/httpd.conf and add a single line at the end of the file.

   # Include mod_jk's specific configuration file  
   Include conf/mod-jk.conf
   

2. Create a new file named HTTPD_DIST/conf/mod-jk.conf
3. Add the following configuration to the mod-jk.conf file.

   Important

   The LoadModule directive must reference the mod_jk library directory location applicable to the native binary you installed.

   Note

   The JkMount directive specifies which URLs Apache should forward to the mod_jk module. Based on the directive's configuration, mod_jk forwards the received URL onto the correct Servlet containers.

   To enable Apache to serve static content (or PHP content) directly, and only use the load balancer for Java applications, the suggested configuration specifies all requests with URL path /application/* are sent to the mod_jk load-balancer.

   Only mod_jk is used as a load balancer, forward all URLs to mod_jk by specifying /* in the directive.

   # Load mod_jk module
   # Specify the filename of the mod_jk lib
   LoadModule jk_module modules/mod_jk.so
    
   # Where to find workers.properties
   JkWorkersFile conf/workers.properties
   
   # Where to put jk logs
   JkLogFile logs/mod_jk.log
    
   # Set the jk log level [debug/error/info]
   JkLogLevel info 
    
   # Select the log format
   JkLogStampFormat  "[%a %b %d %H:%M:%S %Y]"
    
   # JkOptions indicates to send SSK KEY SIZE
   JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories
    
   # JkRequestLogFormat
   JkRequestLogFormat "%w %V %T"
                  
   # Mount your applications
   JkMount /application/* loadbalancer
    
   # Add shared memory.
   # This directive is present with 1.2.10 and
   # later versions of mod_jk, and is needed for
   # for load balancing to work properly
   JkShmFile logs/jk.shm 
                 
   # Add jkstatus for managing runtime data
   <Location /jkstatus/>
       JkMount status
       Order deny,allow
       Deny from all
       Allow from 127.0.0.1
   </Location>
   

4. Optional: JKMountFile Directive

   In addition to the JkMount directive, use the JkMountFile directive to specify a mount points configuration file. The configuration file contains multiple Tomcat forwarding URL mappings.
   1. Navigate to HTTPD_DIST/conf.
   2. Create a file named uriworkermap.properties.
   3. Specify the URL to forward and the worker name using the following syntax example as a guide.
      The example block will configure mod_jk to forward requests to /jmx-console and /web-console to Apache.
      The syntax required takes the form /url=worker_name.

      # Simple worker configuration file
      
      # Mount the Servlet context to the ajp13 worker
      /jmx-console=loadbalancer
      /jmx-console/*=loadbalancer
      /web-console=loadbalancer
      /web-console/*=loadbalancer
      

   4. In HTTPD_DIST/conf/mod-jk.conf, append the following directive.

      # Use external file for mount points.
      # It will be checked for updates each 60 seconds.
      # The format of the file is: /url=worker
      # /examples/*=loadbalancer
      JkMountFile conf/uriworkermap.properties

Procedure 6.1. Configure a Load-balancing Proxy Using the HTTP Connector

1. Create a Listen Directive for the Proxy Server

   Edit the configuration file JBOSS_EWS_DIST/httpd/conf.d/JBoss_HTTP.conf and add the following:

   Listen IP_ADDRESS:PORT_NUMBER

   Where IP_ADDRESS is the IP address of a server network interface to communicate with the worker nodes, and PORT_NUMBER is the port on that interface to listen on.

   Note

   The port PORT_NUMBER must be open on the server firewall for incoming TCP connections.

   Example 6.1. Example Listen Directive

   Listen 10.33.144.3:6666

2. Create Virtual Host

   Add the following to the file JBOSS_EWS_DIST/httpd/conf.d/JBoss_HTTP.conf:

   <VirtualHost IP_ADDRESS:PORT_NUMBER> 
   
      <Directory />
         Order deny,allow
         Deny from all
         Allow from 10.33.144.
      </Directory>
   
      KeepAliveTimeout 60
      MaxKeepAliveRequests 0
   
      ManagerBalancerName mycluster
      AdvertiseFrequency 5
      EnableMCPMReceive On
   
   </VirtualHost>

   Where IP_ADDRESS and PORT_NUMBER are the values from the Listen directive.

3. Optional: Disable Server Advertisement

   The AdvertiseFrequency directive, set to five seconds, makes the server to periodically send server advertisement messages via UDP multicast.
   These server advertisement messages contain the IP_ADDRESS and PORT_NUMBER specified in the VirtualHost definition. Worker nodes configured to respond to server advertisements use this information to register themselves with the proxy server.
   To disable server advertisement, add the following directive to the VirtualHost definition:

   ServerAdvertise Off

   If server advertisements are disabled, or UDP multicast is not available on the network between the proxy server and the worker nodes, configure worker nodes with a static list of proxy servers. See Section 8.1, “Static Proxy Configuration” for directions.

4. Restart the JBoss Enterprise Web Server Apache service

   See the JBoss Enterprise Web Server documentation for detailed directions.

Procedure 8.1. Configure Web Server Worker Node with Static Proxy List

1. Disable Dynamic Proxy Discovery

   Edit the file JBOSS_EWS_DIST/tomcat6/conf/server.xml. and set the advertise property of the ModClusterListener to false:

2. Define a mod_cluster listener

   Add a <Listener> element to the server.xml file.

   <Listener className="org.jboss.modcluster.container.catalina.standalone.ModClusterListener" advertise="false" stickySession="true" stickySessionForce="false" stickySessionRemove="true"/>

3. Create a static proxy server list

   Add a comma separated list of proxies in the form of IP_ADDRESS:PORT as the proxyList property of the ModClusterListener <Listener> element.

   Example 8.1. Example Static Proxy List

   <Listener className="org.jboss.modcluster.container.catalina.standalone.ModClusterListener" advertise="false" stickySession="true" stickySessionForce="false" stickySessionRemove="true" proxyList="10.33.144.3:6666,10.33.144.1:6666"/>

Procedure 9.1. To configure httpd for ssl connections:

1. Install mod_ssl using the following command:

   # rpm -qa | grep mod_ssl

2. Edit the HTTPD_HOME/conf.d/ssl.conf file and add ServerName, SSLCertificateFile, and SSLCertificateKeyFile

    Example SSL configuration
       <VirtualHost _default_:443>
   #ServerName www.example.com:443
   SSLCertificateFile /etc/pki/tls/certs/localhost.crt
   SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
   

   1. ServerName must match the Common Name (CN) of the SSL certificate. If the ServerName does not match the CN, the client browsers display a message "domain mismatch".
   2. The SSLCertificateFile is the private key associate with the certificate (the public key).
   3. Verify that the Listen directive in the ssl.conf file is correct as per your setup. For example, if an IP address is specified, it must match the IP address the httpd service is bound to.
3. Restart httpd using the following command:

   # service httpd restart

Procedure 10.1. To httpd to validate OCSP certificates

• Use the SSLOCSPEnable attribute to enable OCSP validation.

  # Require valid client certificates (mutual auth)
    SSLVerifyClient require
    SSLVerifyDepth  3
    # Enable OCSP
    SSLOCSPEnable on
    SSLOCSPDefaultResponder http://10.10.10.25:3456
    SSLOCSPOverrideResponder on