Webdispatcher SSL load balance server mismatch errors

We are setting up a webdispatcher to access an Enterprise Portal with multiple instances. Currently it is working but we are having to overide host mismatches. in webdispacther log we see
[Thr 4856] Mon Mar 07 11:38:02 2011
[Thr 4856] MatchTargetName("aaa.mycompany.com", "CN=bbb.mycompany.com, OU=xxx, O=ooo, L=ccc, SP=sss, C=US") FAILS
[Thr 4856] SSL NI-sock: local=##.21.13.137:50746 peer=##.21.13.131:51001
[Thr 4856] <<- ERROR: SapSSLSessionStart(sssl_hdl=0000000008565100)==SSSLERR_SERVER_CERT_MISMATCH
The Portal instances are on
aaa.mycompany.com
bbb.mycompany.com
Currently have a CA approved certificate for each server installed in the portal. Dispatcher on aaa uses aaa cert, dispatcher on bbb uses bbb cert.
Message server is on aaa, but it will load balance and place you on either instance.
have following related parameters
wdisp/ssl_encrypt = 2
wdisp/ssl_auth = 2
wdisp/ssl_cred = C:\usr\sap\XXX\W00\sec\XXX.pse
wdisp/ssl_certhost = aaa.mycompany.com
wdisp/ssl_ignore_host_mismatch = TRUE
C:\usr\sap\XXX\W00\sec\XXX.pse has ssl cert of both aaa and bbb servers.
All seems to be working, as users are load balancing. They are not getting certificate mismatches in their browser anymore. We are getting the SSSLERR_SERVER_CERT_MISMATCH errors, but the messages do not seem to cause an issue since we have wdisp/ssl_ignore_host_mismatch set.
Can we eliminate those mismatch errors instead of masking the problem with wdisp/ssl_ignore_host_mismatch?
Should each portal instance have their own ssl cert, or is there a way to use one cert such as the aaa.mycompany.com cert on each portal instance? It seems like that might eliminate the mismatch errors. However, what happens when you go directly to the bbb.mycompany.com portal instance? there is a certificate error if you specify aaa's and you go to bbb. I was wondering if the wdisp/ssl_auth and wdisp/ssl_certhost are valid in the portal system so that each server uses the aaa server and certificate. I could not tell if this parameter is valid for java-only portal systems.
Thanks for your help.
Edited by: Fett Patrick on Mar 7, 2011 8:35 PM

Thank you Martin for your prompt reply. Can you clarify please, can we use the wdisp/ssl_certhost parameter in the instance profiles of the portal instances? I wasn't sure if that is only valid for webdispatchers or can also be used in abap/java systems?
We orginally had the aaa server certificate listed for each dispatcher in the portal under ssl provider runtime server identity. That caused a browser "certificate error" when accessing the bbb server. So we then installed an ssl certificate for bbb for its dispatcher. We could then go to either server with no browser "certificate mismatch" error.
Then when we added the webdispatcher, we started getting the server mismatch errors at the webdispatcher level. If the wdisp/ssl_certhost can be used in the portal profiles, then that would hopefully resolve direct access or via web dispatcher aceess mismatches. I.E. only the aaa ssl certificate would be used and parameters would be set at both the webdispatcher and portal profiles
Thanks, Pat.

Similar Messages

Load Balancing Server Error

Hi Expert's
          I am working on Netweaver BI integrated with EP. while creating JCo destinations for both model and meta data, we have an option of selecting load balancing server and application server. the connection with application server is working fine but when come's to load balancing server it is asking for system group.
         Added to this we are working on single server. Pls let us know is system group is necessary? also let us know where to create system group?
Regards
Subbaraju

Hi Ashok,
           As I already mentioned we are working on BI 7.0 We are facing problem while Configuring JCo destinations In JCo we have maintained Meta and Model Data using load balancing server and application server Now when using Tr.RSPLAN and selecting START MODELER it is routing into local host. But after logging, It is routing to standard SAP host (host=pwdfm101) instead of our local host .
Note: Routing means opening the web Dynpro page.
I hope this makes things clear.
Regards
Subbaraju

Load balancing server names

My Application is handled by three load balanced servers.I have a functionality in which first i send a request for a document printing.This request is posted in Database.Then a backend script runs and takes each requets in DB and executes and creates a file and places in server space. This works fine when i have only one server.But when i have load balanced servers user can give request for print from one server(he does know where from he is giving) and backend shell scripts can take the OPEN record from DB and execute in another server.So user is not able to find the document thought his request is processed.I have tried to know the DNS names of teh server whose are taking the print request so that i can track. But when i check with ServletRequest.getServerName() but i always get the application URL not teh specific load balance server name. I am tryong my luck with java.net.InetAddress

Hey i could solve this problem. i have used java.net.InetAddress class and its methods to know the system name on which my code is executing.
Viswanath

Load balance server

Hello all,
I am using Hyperion v11.1.1.1.0.
I want to install FDM 11.1.1.
Will it work fine with hyperion 11.1.1.1.0?
It is written in the documentation that we need to install & configure Load Balance Server
properly prior to installing FDM.
How to install Load balance server and from where will I get the software for Load balance server?
Thanks

As Gilles said you need to make sure that the return traffic from the real server should come back to CSS.
Your routing infrastructure should ensure that flow should be the following for both "real server in the same DC" & "Real Server in Different DC".
1. Client Traffic should hit the VIP configured on CSS.
2. CSS should forward the client request to the Selected Real Server.
3. Real Server's Response should reach CSS. (It should not go to Client directly)
4. CSS should send the response on Real Server's behalf.
As long as the above conditions are met you are fine. Step 3 is the key and becomes could become tricky for Remote Real Servers.
HTH
Syed Iftekhar Ahmed

Error in creation of JCO with Load balancing server

Hi,
We are using a ABAP user base for our WEBAS server 6.40 (with ABAP+JAVA). i have created a Public group in concerned ECC 5.0 system. I have already configured SLD, and then i maintain data supplier bridge in SLD and run RZ70 in ECC 5.0 system to load system information.. i can see details in SLD ..
now i am trying to create JCO connections .. here i am unable to create JCO with load balancing option.. i get
com.sap.mw.jco.JCO$Exception: (102) RFC_ERROR_COMMUNICATION: Connect to message server host failed Connect_PM TYPE=B MSHOST=<servername> GROUP=PUBLIC R3NAME=SID MSSERV=sapms<SID> PCS=1 ERROR service 'sapms<SID>' unknown TIME Fri Jun 16 12:41:20 2006 RELEASE 640 COMPONENT NI (network interface) VERSION 37 RC -3 MODULE ninti.c LINE 505 DETAIL NiPGetServByName2: service 'sapms<SID>' not found SYSTEM CALL getservbyname_r COUNTER 1
i am able to create single server JCO, but it fails in load balancing.. is there anything i have missed out in settings...
Thanks and regards,
Sudhir

Thanks, Bogdan Rokosa
I have the same problem,and solved it following the steps provided by Bogdan Rokosa :
you must insert an entry for your R3 system
(like: sapms<SID> 3600/tcp)
in services file
(C:\WINDOWS\system32\drivers\etc\services) on Java WAS.
I test the Jco successful without restart J2EE Engine.

Certificate based authentication with SSL load balancer

I've been asked to implement certificate-based authentication (CBA)
on a weblogic cluster serving up web services. I've read through
Chapter 10 (security) and understand the "Identity Assertion" concept.
Environment:
Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
uses sticky-sessions.
Question:
If the load balancer is used to handle SSL, do I still need to turn
on SSL on the weblogic cluster in order to use CBA? Is there another
way to request the client's certificate?
If the above is yes, what is the minnimal level of SSL? Does it have
to be two-way?
If SSL has to be turned on is there any reason to use the load
balancer's SSL? Is there still a performance benefit?

I think the simplest and most secure way is to have the servers configured for
2-way ssl, since this would ensure that the certificate they receive and use for
authentication has been validated during the ssl handshake. In this case the load
balancer itself does not need to and cannot do the handshaking, and would need
to pass the entire SSL connection through to the WLS server (ie: act similar to
a router)
Pavel.
"George Coller" <[email protected]> wrote:
>
I've been asked to implement certificate-based authentication (CBA)
on a weblogic cluster serving up web services. I've read through
Chapter 10 (security) and understand the "Identity Assertion" concept.
Environment:
Weblogic 8.1 cluster fronted by a load-balancer that handles SSL and
uses sticky-sessions.
Question:
If the load balancer is used to handle SSL, do I still need to turn
on SSL on the weblogic cluster in order to use CBA? Is there another
way to request the client's certificate?
If the above is yes, what is the minnimal level of SSL? Does it have
to be two-way?
If SSL has to be turned on is there any reason to use the load
balancer's SSL? Is there still a performance benefit?

Webdispatcher for Load balancing

Hi All,
We have implemented EP7. The portal is configured to redirect to https.
Now we want to use sapwebdispatcher for load balancing.
We are performing the following steps to configure the sapwebdispatcher
1. uncar the icmadmin.SAR
2. sapwebdisp -bootstrap
The following screen appears:
This bootstrap will perform the following steps:
1. create profile file "sapwebdisp.pfl"for SAP Web Dispatcher (if not already existing)
2. create user for web based administration in file "icmauth.txt"(if not already exisiting)
3. start SAP Web Dispatcher with the created profile
After the bootstrap you can use the web based administration
Generating Profile "sapwebdisp.pfl"
Hostname of Message Server (rdisp/mshost): <hostname>
HTTP Port of Message Server (ms/http_port): 8101
Checking connection to message server...OK
Unique Instance Number for SAP Web Dispatcher (SAPSYSTEM): 38
HTTP port number for SAP Web Dispatcher: 8101
Create configuration for s(mall), m(edium), l(arge) system (default: medium): l
WARNING: Maximum number of sockets supported on this system: 2045
Please check the operating system configuration
Profile "sapwebdisp.pfl" generated
Authentication file "icmauth.txt" generated
Web Administration user is "icmadm" with password "xxxxxxxxx"
Restart sapwebdisp with profile: sapwebdisp.pfl
sapwebdisp started with new pid 14014
Web administration accessible with "http://<hostname>:8101/sap/wdisp/admin/default.html"
SAP Web Dispatcher bootstrap ended (rc=0)
<hostname>47> *** WARNING: Could not start service 8101 for protocol HTTP on host "<hostname>m"(on all adapters)
SAP Web Dispatcher up and operational (pid: 14014) ***
Now, if I use any port other than 8101 for HTTP port number for SAP Web Dispatcher the webdispatcher does not work.
If i use port 8101(which i am using currently) then the webdispatcher does the load balancing however i cannot access the http://<hostname>:8101/sap/wdisp/admin/default.html url
Can anyone help me getting both thigs: load balancing and the webdisp admin page also.
Thanks!!
Regards,
Rohit

Hi Rohit,
this is your Profile File
Generating Profile "sapwebdisp.pfl"
Hostname of Message Server (rdisp/mshost): <hostname>
HTTP Port of Message Server (ms/http_port): 8101
Checking connection to message server...OK
Unique Instance Number for SAP Web Dispatcher (SAPSYSTEM): 38
HTTP port number for SAP Web Dispatcher: 8101
Create configuration for s(mall), m(edium), l(arge) system (default: medium): l
WARNING: Maximum number of sockets supported on this system: 2045
Please check the operating system configuration
Profile "sapwebdisp.pfl" generated
Authentication file "icmauth.txt" generated
Web Administration user is "icmadm" with password "xxxxxxxxx"
Restart sapwebdisp with profile: sapwebdisp.pfl
sapwebdisp started with new pid 14014
Web administration accessible with "http://<hostname>:8101/sap/wdisp/admin/default.html"
You have wrongly configured your HTTP port number for SAP Web Dispatcher make it as 80 by default
Sample Profile File:
Profile generated by sapwebdisp bootstrap
unique instance number
SAPSYSTEM = 1
add default directory settings
DIR_EXECUTABLE = .
DIR_INSTANCE = .
Accessibility of Message Servers
rdisp/mshost = Hostname
ms/http_port = 8101
SAP Web Dispatcher Parameter
wdisp/auto_refresh = 120
wdisp/max_servers = 100
wdisp/shm_attach_mode = 6
configuration for small scenario
icm/max_conn      = 100
icm/max_sockets   = 1024
icm/req_queue_len = 300
icm/min_threads   = 5
icm/max_threads   = 15
mpi/total_size_MB = 20
#maximum number of concurrent connections to one server
wdisp/HTTP/max_pooled_con = 100
wdisp/HTTPS/max_pooled_con = 100
SAP Web Dispatcher Ports
icm/server_port_0 = PROT=HTTP,PORT=80
icm/server_port_1 = PROT=ROUTER,PORT=443
Swapnil

Webdispatcher with load-balancing and local icm configuration

Dear all,
we have a webdispatcher in place to load-balance the requests to our three application servers (ABAP). The webdispatcher has a hostname that is resolved by the DNS. The application servers use local hostnames that can't be resolved in our infrastructure at the moment.
That configuration works fine for all requests that reach the infrastructure from outside.
But, if a user logs on with SAP GUI and then calls a web transaction like a webdynpro, the browser opens with the local application server hostname. However that hostname can't be resolved.
Is it possible to change the three local icm configurations in a way that all local generated web requests refers to the webdispatcher too? What is the preferred configuration for this more or less usual scenario?
Thanks in advance,
Daniel

Hello,
In your scenario, I would try to create entries in table HTTPURLLOC. After that the 3 app servers should generate URLs using the SAP Web Dispatcher.
Best Regards,
Olivier

Load Balancing, Server and / or Client ?

Hi
I am experiencing a problem with the connection pooling in odp.net. I have a simple test app that creates a connection, executes a query, populates an object then closes the connection. I have found that when I have client side load balancing on via the odp.net connection string property many connections are made unnecessary (sometime the actual number created reaches the max pool size but the numbers differ randomly). It appears that rather than a free connection in the pool being used more connections are being created which defeats the point of having a connection pool. I do have server side load balancing configured correctly also. Due to this finding can someone possibly answer the following questions.
a) Do I need both server side and client side load balancing set?
b) If I do why is the above behaviour being seen? If not could you give me a short explanation as to why not?
Current set up is 11g (patched to 6, awaiting 7 to be applied) RAC, 2 nodes.
Below is the C# code used while testing this. The table queried is a simple person table containing 16000 rows if data.
OcConnection = "User Id=XXX; Password=XXX; Connection Lifetime = 60; Data Source=(DESCRIPTION=(ADDRESS_LIST=(FAILOVER=on)(LOAD_BALANCE=off)(ADDRESS=(PROTOCOL=tcp)(HOST=XXX)(PORT=1521))(ADDRESS=(PROTOCOL=tcp)(HOST=XXX)(PORT=1521)))(CONNECT_DATA=(SERVICE_NAME=MyFirstTest))); Pooling=true; HA Events = true; Load Balancing = true";
Code:-
Oracle.DataAccess.Client.OracleConnection con;
con = new Oracle.DataAccess.Client.OracleConnection();
con.ConnectionString =OcConnection;
con.Open();
// the command object to use for this test
OracleCommand cmd = con.CreateCommand();
cmd.CommandText = "select * from PERSON";
OracleDataReader rdr = cmd.ExecuteReader();
List<test> listTest = new List<test>();
while (rdr.Read())
test dc = new test();
if (!rdr.IsDBNull(0))
dc.id = Convert.ToInt32(rdr.GetValue(0));
if (!rdr.IsDBNull(1))
dc.forename = rdr.GetString(1);
if (!rdr.IsDBNull(2))
dc.surname = rdr.GetString(2);
if (!rdr.IsDBNull(3))
dc.street = rdr.GetString(3);
if (!rdr.IsDBNull(4))
dc.city = rdr.GetString(4);
if (!rdr.IsDBNull(5))
dc.postcode = rdr.GetString(5);
if (!rdr.IsDBNull(6))
dc.country = rdr.GetString(6);
if (!rdr.IsDBNull(7))
dc.email = rdr.GetString(7);
if (!rdr.IsDBNull(8))
dc.dateadded = rdr.GetDateTime(8);
if (!rdr.IsDBNull(9))
dc.randWords = rdr.GetString(9);
if (!rdr.IsDBNull(10))
dc.uniqueNumber = Convert.ToInt32(rdr.GetValue(10));
listTest.Add(dc);
rdr.Close();
con.Close();
rdr.Dispose();
cmd.Dispose();
con.Dispose();
Thanks for your time
Victoria

Here are the HTTP Headers as monitored on the client side. Notice the good.txt file includes a GET as it's initial request. All works fine in this case. However, the initial request in the bad.txt is a POST. This is odd since the URL was opened using the same shortcut in both incidents and the browser was closed between each trace that was taken. I've also reviewed the shortcut with notepad to verify it does not include unwanted data such as the JSESSIONID info....etc.
Once you have reviewed the HTTP headers, I have these questions.
1. IIS is sending the 100 Continue messages as you mention, but why is the CSS injecting the cookie in a 100 response that is not typically processed by the client? The bad.txt file shows the client receiving two ARPT cookies because the first cookie in the 100 continue response was ignored.
2. I know Cisco is not really in the business of troubleshooting browser behaviour. But do you know why the browser would behave differently....GET in one request and a POST in the next? We do not wish to get into modifying the browser, so I'm hoping we can provide a solution on the server side that will allow the browser to function this way if it chooses to do so. Do you think it would make sence to push the state management up a level to the cookie handed out by JRUN? This way, the cookie would not be handed back in a 100 response from IIS, and we could tell the CSS to monitor the JRUN cookie. Of course this would require we determine how to manage this cookie either by modifying to cookie to have static data for each server, or by using the right method of hashing...etc.
Chris

System with load balancing server

Hi All,
We are having SAP NW 7.0 Portal and back end we have R3 implemented in a cluster environment. The system object in EP have used "System with Load balancing" template; using the LOGON group and the other related parameters.
But we have some problem with the ITS and WAS parameters; since we are using some Transaction iViews.
Let me explain.. for the R3 cluster we have 2 systems PROD1.domain.ext and PROD2.domain.ext. Now in the system object in portal, how to specify the parameters for ITS and WAS parameters? Since the host name in these we need to specify a single server which defeats the basic purpose of having clustered environment.
Can any one please help in resolving this issue.
Thanks,
Sravanthi

Hi Sravanthi,
Please check the below for finding ITS and WAS parameters from backend :
For ITS - Go to SE37 >> Utilities >> Setting >> Click on ICON Right Top Corner in popup window >> Select Internet Transaction Server >> you will find the Standard Path and HTTP URL.
For WAS - Go to SE37 >> Run FM - RSBB_URL_PREFIX_GET >> Execute it >> you will find PRefix and PAth paramter for WAS.
Please refer to this may help step-by-step : How-to create a portal system for using it in Visual Composer
Hope it helps
Regards
Arun

SSL Load Balancing (Java applets problem)

Hi,
I have implemented loadbalancing of two webservers using CSS 11503.
Servers are containing SSL pages which need to be loadbalanced.
I have tried configuring the content rule for ssl using
port 443
application ssl
advanced-balance ssl
commands.The site opens properly using the VIP address (checked the SSL certificate issued by one of the servers. ) and I am able to see all the TABS on the same.The real problem starts when I am trying to upload a file to the server using the VIP address.
The moment I try to upload a file the session shifts to the second server and prompts for new certificate issued by the second server.
One more thing which I would like to mention here is that while uploading the file, JAVA is used.
i.e.the files are being uploaded using JAVA applets.
If anybody has encountered this kind of problem kindly suggest on the same.
Would appreciate if you send the solution on [email protected]
Any configs needed plz contact me on the above e-mail ID.
Thanks,
Pankaj P.

HI Pankaj,
depending on your Java applett it might be possible that the applett opens a new connection. therefore depending on your total configuration it might be possible taht another server is used.Even worse if you do SSL-offloading the applett might tell the user to do http instead of https. I suggest that you check with a sniffertrace what is happening:
1) is there a new connection setup while the applett runs
2) is it again http or https and if https is it a new https session which will be again balanced not depending on the original https session.
Hope that helps
regards,
Joerg

How to load balance serving MP4 files via AMS

Hey gurus,
We have one centralized storage server that stores videos, Lets call this Server A, we have 4 more servers that we want to use to load the files from Server A to load balance and location balance the loading of files.
Servers B-E are on a private VLAN with Server A; so what we're doing now is mounting Server A on to Servers B-E and serving the files via AMS; this has proved to be quite inefficient.
For Live Streams; we use multi-point publishing to achieve this; is there a way to do this with recorded files?
Please advise!
Thanks

Here are few bits of info:
For load balancing for Analytics, that isn't officially supported yet for the UI and Administration components. It might work with sticky sessions from portal-to-analytics but that doesn't get you much. Improving the options there would be a good enhancement request.
For the collector, I think there are two important things to remember. Use broadcast mode. I've never actually seen it in unicast mode, but broadcast definitely works. Also, remember that this is all managed by Portal and Analytics - you don't use your own load balancer between Portal instances and the Analytics Collector instances.
Finally, ALUI Directory is not certified to be load balanced yet. On a separate note, ALUI Directory has a socket leak on Windows due to a bug in the version of Jrockit that ships with it. Upgrading the embedded application server for the ALUI/WCI installation to jrockit-R27.5.0-jdk1.5.0_14 will resolve it.

SSL load balancing requirements

Hi all
I'm fairly new to CSS so apologies if this is an aobvious question...
Do I need an ssl module to load balance https requests using certificates on the servers themselves, simple round robin, two web servers, setup
regards
nigel

Nigel,
you only need and ssl module if you want the css to decrypt the traffic in order to make loadbalancing decision based on the http data contained in the encrypted ssl data.
For example, if you want to check the url or do stickyness based on a cookie.
All this info is encrypted in HTTPS, so this is when you need the ssl module.
If you don't need this feature, you can simpply consider https as normal tcp traffic and loadbalanced based on the tcp destination port.
Gilles.

Two load balanced server sending requests to external system on different protocol

Hi,
I have two loadbalanced OEG servers (server A and server B) with same endpoint configurations in envsetting.props. But when requesting the service, it is creting different URI in both servers. In one of server (server A)it sets URI with following details :
DEBUG   30/Mar/2015:07:29:34.356 [92b0e940]     Set host='abc.tdc.dk'
DEBUG   30/Mar/2015:07:29:34.356 [92b0e940]     Set port='80'
DEBUG   30/Mar/2015:07:29:34.356 [92b0e940]     Set scheme='https'
and fails with following error : ERROR   30/Mar/2015:07:29:34.370 [92b0e940]         [SSL_connect, 0x1220]: error - SSLv2/v3 read server hello A.
However another server (server B),sets URI as :
DEBUG   30/Mar/2015:07:29:34.356 [92b0e940]     Set host='abc.tdc.dk'
DEBUG   30/Mar/2015:07:29:34.356 [92b0e940]     Set port='80'
DEBUG   30/Mar/2015:07:29:34.356 [92b0e940]     Set scheme='http'
and successfully processes the request.
So can you please help here to know even if we are using same endpoints configuration (abc.tdc.dk ) and port (80) on both the servers , then why the URL is set as http on one of server and https on another.
Thanks !!!
Akshay

Hi
Thanks for immediate respose. I tried the ping/acknowledgement example in the biginning itself. It doesn't work. I also tried by changing the agents ( to respective values suitable for my systems) of that example. Then also it failed. The error in that case also same. The message will not propogate from the out going agent.

Load Balance serve issue

Hi,
We have defined 2 servers (server1,server2)in FDM and also added these servers in Machine profile.
We are executing UPSshell.exe which should place .dat file in server1. The server name is also specified as server1 in Upsshell script. But, the issue we are facing is, on first execution, .dat is placed in openbacth of server1,while on second execution .dat is placed in server2. This is causing issue in our dataload. Batch load script is looking for file in server1 and since the file is in server2, datais not getting loaded. Can anyone let me know wht am I missing here , as the .dat file is saved in server2, even after specifying serever as server1 in upsshell.exe script.
Appreciate early response as this is refraining us from proceeding ahead ..Thanks

You need to have a single FDM application folder share point, such as FDMDATA and then your application sub-folders beneath it.
Then your application path should be specified as UNC path (\\ServerNameFDMDATA\AppName)
You can update the path using <Add Application>
A) Choose <Add Application> at the login form
B) Login and highlight the application and choose "modify"
C) Update the application path.

Webdispatcher SSL load balance server mismatch errors

Similar Messages

Maybe you are looking for