Set-up with different urls for login server and mid-tier

Question

The desired external host names are the following:
Portal -> http://www.myportal.com
Login Server -> http://www.login.com
The real (internal) host names are the following:
midtier -> midtier.xyz.com
infrastructure-> infra.xyz.com
How should the Oracle HTTP Server, Login/SSO server, portal be configured with this type of set-up?
In particular, what should be in the httpd.conf, dads.conf, mod_osso.conf files and which values should be passed to the ssocfg and ptlasst scripts? Does the DAS url need to have the internal or external host name?

Answer 1

How should the scenario described above be integrated into the instructions below? $HOSTNAME may refer to the internal or external midtier or infrastructure machine name. Which should be used?
Assume HTTPS for the login server --> https://www.login.com.
<PRE>
Doc ID: Note:216126.1
Subject: How to configure SSL with Portal 9.0.2
Type: HOWTO
Status: PUBLISHED
Content Type: TEXT/PLAIN
Creation Date: 25-OCT-2002
Last Revision Date: 16-JAN-2003
PURPOSE ------- This note explains how to set up SSL with Portal. There are several ways to configure SSL with Portal. This note uses SSL only between the browser and WebCache. The communication between the Webcache/Apache or PPE/Webcache is done in HTTP. This installation is a lot less CPU extensive than a full SSL configuration. Please note the configuration outlined here is not currently certified for Portal 9.0.2; however, it is fully supported by Oracle Support and Development. This means that this configuration was not tested by the Portal QA Department within Oracle. The difference in the QA test was that all components of the configuration were in SSL mode. SCOPE & APPLICATION ------------------- This note is intended for Portal administrators. This note is based on Unix. The Windows NT configuration is very similar. HISTORY ------- Version 1.0: SSL with a Unix shell script Version 1.1: Comment about the Webcache HTTP port How to configure SSL with Portal 9.0.2 -------------------------------------- Step 1 - Prerequisite --------------------- A. Get a SSL certificate ------------------------ IAS v2 is given with dummy certificates. You can use them. If you wish to use real SSL certificates, follow a note to configure SSL with Webcache like : - Note 161863.1 - Configuring WebCache with SSL - NT/2000 - Note 165305.1 - Configuring WebCache with SSL - Unix B. Password of the database schemas of portal --------------------------------------------- You need to have the passwords of the following database users: Database user Your passwords ---------------------------------------------- portal orasso orasso_ps orasso_pa These passwords are normally randomized during the installation of IAS V2. To find them, please follow one of these notes: - Note 206514.1 : IAS 9.0.2 : How to get the portal passwords to run the PTLASST script (Windows) - Note 199633.1 : Script to determine orasso password in 9iAS 9.0.2 on Unix - Note 205984.1 : Script to determine orasso password in 9iAS 9.0.2 on Windows C. Ports -------- During this installation, you will need to know a lot of ports of IAS V2. Please collect this information, before to begin. You can see the port list by going to the homepage of the midtier and of the infrastructure web page and clicking on the tab Port. You can also read the file portlist.ini that resides in both ORACLE_HOME in the directory $ORACLE_HOME/install. Here is the list, you need: Name of the port My port numbers Your port numbers --------------------------------------------------------------------- Midtier Web Cache HTTP port 7783 Midtier Web Cache HTTPS port 4459 Midtier Web Cache Admin port 4000 Midtier Web Cache Invalidation port 4001 --------------------------------------------------------------------- Infrastructure Oracle HTTP Server port 7784 Infrastructure Oracle HTTPS Server port 4460 Infrastructure Internet Directory(non-SSL) 4039 --------------------------------------------------------------------- D. Backups ---------- You should take a backup of your IAS installation in case that you want to revert all the changes done here and/or if you make a mistake during the configuration. The only good way to do a backup of IAS 9.0.2 is to have a full backup of the both ORACLE_HOMES of the Infrastructure and of the MidTier. Step 2 - Configure Portal to run in SSL --------------------------------------- 1) Edit the Webcache configuration Go to the administration port > http://hostname:web_admin_port/ > Typically http://hostname:4000/ Login: administrator/administrator Go to General Configuration / Site to Server Mapping -> Change the rule WebCache SSL - HTTP SSL -> Below the title Select "Application Web Servers" -> Check the checkbox with HTTP -> Uncheck the one with HTTPS -> Submit On the top of Webcache admin screen, press on <Apply the changes> Then restart WebCache. 2) Edit the dads.conf (in $MIDTIER_ORACLE_HOME/Apache/modplql/conf) Add a new line in the DAD: <Location /pls/portal> PlsqlCGIEnvironmentList REQUEST_PROTOCOL=HTTPS,SERVER_PORT=4459 Where 4459 is the HTTPS port of the MIDTIER. 3) Modify the web.xml of the portal application ($MIDTIER_ORACLE_HOME/j2ee/OC4J_Portal/applications/portal/portal/WEB-INF) Add several parameters to the page servlet (PPE). [...] <servlet> <servlet-name>page</servlet-name> [...] <init-param> <param-name>useWebCache</param-name> <param-value>true</param-value> </init-param> <init-param> <param-name>useScheme</param-name> <param-value>http</param-value> </init-param> <init-param> <param-name>usePort</param-name> <param-value>7783</param-value> </init-param> </servlet> [...] Where 7783 is the HTTP port of Webcache. Step 3 - Run the PTLASST ------------------------ Because of bug 2659809, we will remove an entry in OID before to run the PTLASST script. This entry will be recreated by PTLASST. Because of bug 2654938, we will reconfigure Webcache after PTLASST. Run this script, and modify the environment variables with the values found above. This scripts does 3 things: 1) It configures SSO/DAS to run in the infrastructure HTTPS port 2) It configures Portal in HTTPS mode, and associates Portal with SSO in HTTPS. 3) Restart OC4J and HTTP processes of the MIDTIER and INFRASTRUCTURE - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - portal_ssl.sh - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - export INFRA_ORACLE_HOME=/u01/oracle/product/infra902 export MIDTIER_ORACLE_HOME=/u01/oracle/product/ias902 export INFRA_SID=iasdb export MIDTIER_SID=ias902 export PORTAL_SID=$INFRA_SID export PORTAL_TNS=iasdb export MIDTIER_HTTP_PORT=7783 export MIDTIER_HTTPS_PORT=4459 export WEBCACHE_INV_PORT=4001 export WEBCACHE_ADM_PORT=4000 export INFRA_HTTP_PORT=7784 export INFRA_HTTPS_PORT=4460 export OID_PORT=4039 export EM_PORT=1810 export PORTAL_PASSWORD=ABCDEFGH export ORASSO_PASSWORD=ABCDEFGH export ORASSO_PA_PASSWORD=ABCDEFGH export ORASSO_PS_PASSWORD=ABCDEFGH export HOSTNAME=machine.domain.com export IAS_PASSWORD=ABCDEFGH export ORAENV_ASK=NO export ORACLE_SID=$INFRA_SID . oraenv unset ORAENV_ASK echo '******** PART 1 - SSO IN SSL **********' export LD_LIBRARY_PATH=$INFRA_ORACLE_HOME/lib:$LD_LIBRARY_PATH export PATH=$INFRA_ORACLE_HOME/jdk/bin:$PATH export PATH=$ORACLE_HOME/bin:$PATH # This step will change the URL used to login by default for # all partner application cd $INFRA_ORACLE_HOME/sso/bin ./ssocfg.sh HTTPS $HOSTNAME $INFRA_HTTPS_PORT # This step add a new partner application to SSO. # It associates the new URL used by OIDDAS with SSO. cd $INFRA_ORACLE_HOME/sso/lib java -jar $ORACLE_HOME/sso/lib/ossoreg.jar -host $HOSTNAME -port 1521 -sid $INFRA_SID -site_name ssl_$HOSTNAME -success_url https://$HOSTNAME:$INFRA_HTTPS_PORT/osso_login_success -cancel_url https://$HOSTNAME:$INFRA_HTTPS_PORT/ -logout_url https://$HOSTNAME:$INFRA_HTTPS_PORT/osso_logout_success -home_url https://$HOSTNAME:$INFRA_HTTPS_PORT/ -start_date 08012002 -admin_id oracle -ip_check false -config_mod_osso true -oracle_home_path $INFRA_ORACLE_HOME -u root -sso_server_version v1.2 echo '---------------------' echo 'Change the URL of DAS' echo '---------------------' rm das.ldif echo 'dn:cn=OperationURLs,cn=DAS,cn=Products,cn=OracleContext' > das.ldif echo 'changetype:modify' >> das.ldif echo 'replace:orcldasurlbase' >> das.ldif echo orcldasurlbase:https://$HOSTNAME:$INFRA_HTTPS_PORT/ >> das.ldif ldapmodify -h $HOSTNAME -p $OID_PORT -D "cn=orcladmin" -w "$IAS_PASSWORD" -f das.ldif echo '******** PART 2 - PORTAL IN SSL **********' echo '-----------------------' echo 'Delete an entry in LDAP' echo '-----------------------' ldapdelete -h $HOSTNAME -p $OID_PORT -D "cn=orcladmin" -w "$IAS_PASSWORD" "orclApplicationCommonName=PORTAL,cn=Portal,cn=Products,cn=OracleContext"
echo '-------------' echo 'Configure SSL' echo '-------------' export ORACLE_HOME=$MIDTIER_ORACLE_HOME $MIDTIER_ORACLE_HOME/assistants/opca/ptlasst.csh -mode MIDTIER -i custom -s portal -sp $PORTAL_PASSWORD -c $HOSTNAME:1521:$PORTAL_SID -sdad portal -o orasso -op $ORASSO_PASSWORD -odad orasso -host $HOSTNAME -ssl -port $MIDTIER_HTTPS_PORT -ldap_h $HOSTNAME -ldap_p $OID_PORT -ldap_w $IAS_PASSWORD -pwd $IAS_PASSWORD -sso_c $HOSTNAME:1521:$PORTAL_SID -sso_h $HOSTNAME -sso_p $INFRA_HTTPS_PORT -ultrasearch -oh $MIDTIER_ORACLE_HOME -mc false -mi true -chost $HOSTNAME -cport_i $WEBCACHE_INV_PORT -cport_a $WEBCACHE_ADM_PORT -wc_i_pwd invalidator -emhost $HOSTNAME -emport $EM_PORT -pa orasso_pa -pap $ORASSO_PA_PASSWORD -ps orasso_ps -pp $ORASSO_PS_PASSWORD -pd portal_dblink -p_tns $PORTAL_TNS -s_tns $PORTAL_TNS -verbose -portal_only $MIDTIER_ORACLE_HOME/assistants/opca/ptlasst.csh -mode SSOPARTNERCONFIG -i custom -s portal -sp $PORTAL_PASSWORD -c $HOSTNAME:1521:$PORTAL_SID -sdad portal -o orasso -op $ORASSO_PASSWORD -odad orasso -host $HOSTNAME -ssl -port $MIDTIER_HTTPS_PORT -sso_c $HOSTNAME:1521:$PORTAL_SID -sso_h $HOSTNAME -sso_p $INFRA_HTTPS_PORT -pa orasso_pa -pap $ORASSO_PA_PASSWORD -ps orasso_ps -pp $ORASSO_PS_PASSWORD -p_tns $PORTAL_TNS -s_tns $PORTAL_TNS -verbose -silent echo '--------' echo 'WebCache' echo '--------' export ORACLE_HOME=$INFRA_ORACLE_HOME sqlplus portal/$PORTAL_PASSWORD@$PORTAL_TNS @$MIDTIER_ORACLE_HOME/portal/admin/plsql/wwc/cachseed.sql $HOSTNAME $WEBCACHE_INV_PORT $WEBCACHE_ADM_PORT invalidator on portal echo '********** Part 3 - restart the MIDTIER **************' export ORAENV_ASK=NO export ORACLE_SID=$MIDTIER_SID . oraenv unset ORAENV_ASK echo '--- MIDTIER: stop all the dcm processes' cd $ORACLE_HOME/dcm/bin dcmctl stop -v echo '--- MIDTIER: clear the PLSQL cache' rm -Rf $ORACLE_HOME/Apache/modplsql/cache/plsql echo '--- MIDTIER: start all the dcm processes' dcmctl start -v export ORAENV_ASK=NO export ORACLE_SID=$INFRA_SID . oraenv unset ORAENV_ASK echo '--- INFRA: stop all the dcm processes' cd $ORACLE_HOME/dcm/bin dcmctl stop -v echo '--- INFRA: start all the dcm processes' dcmctl start -v - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - SECURITY COMMENTS ----------------- This configuration has HTTP port of Webcache reachable from outside. Webcache has no way to limit the use of a port to a specific machine or IP address. This is not a real issue because the goal of SSL is not to avoid that people access your server but that people intercept the data sent between the browser and the webserver. But in case that you/your customer is very sensible about security and want a webserver with SSL only (what is very rare), you may want to add a firewall in front of Webcache to block the HTTP port. RELATED DOCUMENTS ----------------- Note 161863.1 - Configuring WebCache with SSL - NT/2000 Note 165305.1 - Configuring WebCache with SSL - Unix
</PRE>