Hp service Manager Single Sign On Implementation Integration with Integrated Windows Authentication

3.3Demo setup IIS -> Tomcat -> HPSM web application

In the following paragraphs, screen shots are based on Windows 2003 and IIS6.

Review the settings we’ve documented and check the settings described in http://tomcat.apache.org/connectors-doc/webserver_howto/iis.html and especially check if this paragraph make sense:

“In a 64 Bit environment - at least for IIS 7 - the used IIS Application Pool should have "Enable 32-bit Applications" set to "False". Otherwise the redirector will not be called and returns an http code 404. If you think, the 32bit version of isapi_redirect.dll would do the job instead, you will get an http code 500, because the library is not loadable into a 64 Bit IIS. ”

By default, IIS enables kernel-mode authentication, which may improve authentication performance and prevent authentication problems with application pools configured to use a custom identity. As a best practice, do not disable this setting if Kerberos authentication is used in your environment and the application pool is configured to use a custom identity.

The Jakarta ISAPI plugin will be used to connect IIS with Tomcat.

The Jakarta ISAPI plugin will be used to connect Tomcat with IIS¹.

1. 
   Consult Isapi documentation on http://tomcat.apache.org/connectors-doc/reference/iis.html
   
2. 
   Download appropriate binaries from http://tomcat.apache.org/download-connectors.cgi
   
3. 
   Modify content isapi_redirect-1.2.XY.properties and the file should have the same name as the DLL file (without extension of course).
   
4. 
   Rename DLL and properties file to isapi_redirect.dll and isapi_redirect.properties
   

• 
  bin
  
• 
  conf
  
• 
  log
  

• 
  isapi_redirect.properties
  
• 
  isapi_redirect.dll (32 bit or 64 bit, depending on your server OS)
  

The following files need to be put in the conf-directory:

• 
  uriworkermap.properties
  
• 
  workers.properties
  

3.3.4Content of isapi_redirect files

In this file the redirect settings used by Jakarta ISAPI can be configured.
# Configuration file for the Jakarta ISAPI Redirector plug-in for IIS

# more information on http://tomcat.apache.org/connectors-doc/reference/iis.html

# this properties file is intended to replace Windows registry settings
# The path to the ISAPI Redirector Extension, relative to the website

# This must be in a virtual directory with execute privileges

#extension_uri=/jakarta/isapi_redirect.dll
## version 1.2.32

extension_uri=/jakarta/isapi_redirect.dll

#log_file=$(ISAPI_PATH)\log\$(ISAPI_NAME).log

log_file=D:\localapp\Apache\JAKARTA_ISAPI\log\isapi_redirect.log
# Log level (debug, info, warn, error or trace)

log_level=info

worker_file=D:\localapp\Apache\JAKARTA_ISAPI\conf\workers.properties

worker_mount_file=D:\localapp\Apache\JAKARTA_ISAPI\conf\uriworkermap.properties

#reject_unsafe=1

#error_page=

In this file the load balancing method of Jakarta ISAPI is configured. Two workers are defined: sm9lb for Service Manager and jkstatus for the jkmanager application. For the sm9lb-worker the redirect port settings are defined.

The example below has defined 3 workers for possible load balancing. For this setup we only use one of them (tomcat1).

More information can be found on http://tomcat.apache.org/connectors-doc/reference/workers.html

#

# This file provides minimal jk configuration properties needed to

#
ps=\

#
# Define workers using ajp13

# First tomcat server

# ------------------------

worker.tomcat1.port=8019

worker.tomcat1.host=16.111.0.12

worker.tomcat1.type=ajp13

worker.tomcat1.lbfactor=1
# ------------------------

# Second tomcat server

# ------------------------

#worker.tomcat2.port=8010

#worker.tomcat2.host=17.111.12.16

#worker.tomcat2.type=ajp13

#worker.tomcat2.lbfactor=1
# ------------------------

# Third tomcat server

# ------------------------

#worker.tomcat3.port=8011

#worker.tomcat3.host=16.101.12.164

#worker.tomcat3.type=ajp13

#worker.tomcat3.lbfactor=1

################ Define the LB worker

# The advanced router LB worker

##########################################

worker.list=sm9lb

worker.sm9lb.type=lb

#worker.sm9lb.balance_workers=tomcat1,tomcat2,tomcat3

# only worker tomcat1 will be used

worker.sm9lb.balance_workers=tomcat1
worker.sm9lb.socket_keepalive=1

worker.sm9lb.method=S

worker.sm9lb.connection_pool_timeout=40

#worker.sm9lb.max_packet_size= 65536

worker.list=jkstatus

# Define a 'jkstatus' worker using status

worker.jkstatus.type=status

When using one single Tomcat instance, it’s not needed to modify Tomcat’s server.xml.

In this properties file the HPSM web application with example context root smbsc is configured to work with the already configured worker sm9lb. The jkmanager-tag is redirected to the worker jkstatus.

#

# This file provides sample mappings for example wlb

# The general syntax for this file is:

# [URL]=[Worker name]
#/admin/*=wlb

#/manager/*=wlb

# For no mapping the url has to start with exclamation (!)

# Mount jkstatus to /jkmanager

# For production servers you will need to secure the access to the /jkmanager url via IIS

#

#/jkmanager=jkstatus

/smbsc|/*=sm9lb

(local computer), to the Default Web Site,


Verify that the Default Web Site has been stopped,


From the Internet Information Services tree, select the Web Services Extensions node
Right click on the “Web Service Extensions” and select “Add a new Web service extension …” item:


Enter the following line into the ‘Extension name’ field in the opened window: Jakarta Isapi Redirector.

Via the Add button, select the isapi_redirect.dll and after clicking OK, select the checkbox ‘Set extension status to Allowed’.

3.3.7.2Step 2: configure isapi_redirect.dll

Right-click on the Default Web Site node in the IIS Manager tree, and select Properties from the drop-down menu.

From the Default Web Site Properties window, select the ISAPI Filters tab, and click on the Add button,


On the Add/Edit Filter Properties window set the following parameters :

Filter name: Jakarta Isapi Redirector,

Executable: for instance C:\Apache\JAKARTA_ISAPI\bin\isapi_redirect.dll

3.3.7.3New -> Virtual Directory for Jakarta

• 
  On the Default Web Site Properties window click OK to save the settings,
  
• 
  right click on the Default Web Site node in the IIS Manager tree, and
  
• 
  select New -> Virtual Directory... from the drop-down menu.
  
• 
  This launches the Virtual Directory Creation Wizard.
  

• 
  From the Virtual Directory Creation Wizard, Virtual Directory Alias, set the Alias to : Jakarta.
  

• 
  From the Virtual Directory Creation Wizard, Web Site Content Directory, set for instance the path to: C:\Apache\JAKARTA_ISAPI\bin\
  

• 
  From the Virtual Directory Creation Wizard, Virtual Directory Access Permissions, enable the following checkboxes:
  

• 
  Read,
  
• 
  Execute (such as ISAPI applications or CGI),
  
• 
  Write,
  

• 
  and accept the warning from IIS Manager,
  

• 
  In the Internet Information Services tree, below the Default Web Site node, a new folder has been added called Jakarta,
  

3.3.7.4Check running ISAPI filter

• 
  Start the Default Web Site
  
• 
  verify that the Jakarta Isapi Redirector filter on the ISAPI Filters tab from the Default Web Site Properties window is running,
  
• 
  and that the Priority is set to High,
  

Note - If you check on its status, you may notice that the ISAPI filter hasn’t been successfully loaded at this stage, even if you have re-started IIS. This is expected behavior and is documented in the IIS6 Operations Guide,
“In an effort to optimize resources in IIS 6.0, an ISAPI filter is not loaded until a request is made to a Web site that requires the ISAPI filter. Until this request is made, IIS Manager does not display the status of the ISAPI filter.”
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/93f23233-2a47-4104-b0b4-a7ec0d3116f3.mspx
However, once IIS has served a successful request to it you will see the status of the ISAPI filter change to ‘Loaded’.
3.3.7.5You cannot use port 80 ?

Note: If the previous steps were executed, you can ignore this paragraph.
As there is another web site running on port 80 in the customers environment, we will define a new web site that listens on port 81.

Please create a new node under Web Sites with the following properties:

Step 1: Web Services Extensions for Jakarta
Open the IIS Manager, and expand the Internet Information Services tree, from the (local computer), down to Web Sites.


From the Internet Information Services tree, select the Web Services Extensions node

Right click on the “Web Service Extensions” and select “Add a new Web service extension …” item:

Enter the following line into the ‘Extension name’ field in the opened window:

Jakarta Isapi Redirector.

Via the Add button, select the isapi_redirect.dll and after clicking OK, select the checkbox ‘Set extension status to Allowed’.

Finally, you’ll get back to this screen:


Step 2: configure isapi_redirect.dll
Right-click on the newly created node in the IIS Manager tree, and select Properties from the drop-down menu.
From the Site Properties window, select the ISAPI Filters tab, and click on the Add button:


On the Add/Edit Filter Properties window set the following parameters :

Filter name: Jakarta Isapi Redirector,

Executable: D:\localapps\Apcache\JAKARTA_ISAPI\bin\isapi_redirect.dll

Step 3: New -> Virtual Directory for Jakarta
On the Node Properties window click on the OK to save the settings,

right-click on the node in the IIS Manager tree,

and select New -> Virtual Directory... from the drop-down menu.

This launches the Virtual Directory Creation Wizard,

From the Virtual Directory Creation Wizard, Virtual Directory Alias, set the Alias to: Jakarta.

From the Virtual Directory Creation Wizard, Web Site Content Directory set the path to: “D:\localapps\Apache\JAKARTA_ISAPI\bin\”
From the Virtual Directory Creation Wizard, Virtual Directory Access Permissions, enable the following checkboxes:

• 
  Read,
  
• 
  Execute (such as ISAPI applications or CGI),
  
• 
  Write,
  

And accept the warning from the IIS Manager.

In the Internet Information Services tree, below the Site node, a new folder has been added called: Jakarta.

Check running ISAPI filter
Start the Default Web Site, and verify that the Jakarta Isapi Redirector filter on the ISAPI Filters tab from the Default Web Site Properties window is up and running, and that the Priority is set to: High.

Note - If you check on its status, you may notice that the ISAPI filter hasn’t been successfully loaded at this stage, even if you have re-started IIS. This is expected behavior and is documented in the IIS6 Operations Guide,
“In an effort to optimize resources in IIS 6.0, an ISAPI filter is not loaded until a request is made to a Web site that requires the ISAPI filter. Until this request is made, IIS Manager does not display the status of the ISAPI filter.”
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/93f23233-2a47-4104-b0b4-a7ec0d3116f3.mspx
However, once IIS has served a successful request to it you will see the status of the ISAPI filter change to ‘Loaded’.

3.3.8Enable Integrated Windows Authentication (IWA) on IIS

Go to the properties of the Default Web Site and go to the Directory Security tab, click the Edit button from Authentication and Access control.

Enable “Integrated Windows Authentication” and disable all the rest:

By enabling the checkbox “Integrated Windows Authentication”, we will force Kerberos above NTLM authentication.
3.3.9How-to secure jkmanager

Create a new virtual directory “jkmanager” and let it point to the ISAPI log file directory.

Allow only 127.0.0.1 and local access:



Beside 127.0.0.1, add also the local IP addresses of the web server (ex. 10.136.17.185):

This is the result when you access jkmanager from the local machine. Only this URL will work: http://localhost:81/jkmanager

3.3.10Configuring Internet Explorer

Start the Internet Explorer browser on the machine

• 
  on the menu bar click on Tools, and select Internet Options,
  
• 
  Select the Security tab,
  
• 
  select the Local Intranet content zone,
  
• 
  and click on the Sites... button,
  
• 
  add the following address to the list of trusted web sites : http://
  
• 
  make sure that the "Require server verification (https:) for all site in this zone" option is not selected,
  
• 
  on the Security tab page, select the Local Intranet content zone, and click on the Custom Level... button,
  
• 
  at the bottom, on the User Authentication, Logon section, select the following option :
  
• 
  automatic logon with current username and password
  

The following screen shots are based on IE8.

Go to Tools- Internet Options.

Click on the button Sites

Add your IIS server FQDN (before, uncheck Require server verification if https is not enabled).

Click close

Click button Custom level

Go to the User Authentication part and change the default "Automatic logon in Intranet Zone" to "Automatic logon with current user name and password"

Click OK and go to the Advanced Tab in Internet Options

Check if Integrated Windows Authentication is enabled (Kerberos authN. instead of NTLM)

3.3.11Request Entity Too Large

In case you get a Request Entity Too Large error in your browser, you should consider these additional steps.

Figure : Request Entity Too Large error

Very often the HTTP header encodes the users group membership in the authorization header. By default Tomcat has an 8k maximum header, whilst users belonging to many groups can have an authorization token that can swell to larger than this size. This explains why you see some people can login and others can't.

To solve this issue, you just change the maxHttpHeaderSize to something larger than the default 8k and you should be set.

In order to change the ISAPI Redirector, look for max_packet_size on http://tomcat.apache.org/connectors-doc/reference/workers.html and don't forget to read the comment about also changing the Tomcat configuration.

On the Tomcat level, we need to change the packetSize.

This attribute sets the maximum AJP packet size in Bytes. The maximum value is 65536. It should be the same as the max_packet_size directive configured for mod_jk. Normally it is not necessary to change the maximum packet size. Problems with the default value have been reported when sending certificates or certificate chains. The default value is 8192.

A useful example can be found on http://builddeploy.blogspot.com/2009/04/resolving-http-error-413-request-entity.html

Example Tomcat AJP port change:

enableLookups="false" redirectPort="8443" debug="0" tomcatAuthentication=”false” packetSize=20000

protocol="AJP/1.3" />”

The values of packetSize and max_packet_size must be equal !