IDM 23.10.3 - Requirements and interoperability.

The following additional components are required:

• Apache HTTP Server 2.4 (Tested on Version 2.4.17)
• mod_jk 1.2 (tested on Version 1.2.41)

Supported platforms for the high availability configuration:

• Windows 7, Windows 8.1, Windows Server 2008/2008 R2/ 2012/ 2012 R2
• Linux
  
  

To do a standard Apache HTTP server setup:

1. Download and install the Apache HTTP server. See Apache HTTP Server Project for downloads and install guide.
   
   Example:
   With the Apache Lounge Distribution, the file unzips to the folder C:\Apache24. The Windows service can be installed with the following command:

   Code Block
   language text title Example: Command for installing Apache HTTP Server
   httpd.exe -k install

   
   

2. When the service is running, call http://localhost in your browser to test the server. You should get a website saying "It works".
3. The mod_jk extension is not part of the standard delivery, so it needs to be installed separately:
   Copy the file mod_jk.so to the subfolder modules in your Apache installation, for example

1. C:/Apache24/modules.
2. Open the file httpd.conf located in the subfolder conf, for example: C:/Apache24/conf/http.conf.

3. Add the following line in the file, to activate the module:

   Code Block
   language text
   LoadModule jk_module modules/mod_jk.so

   
   

4. Save the file.

5. Restart the Apache HTTP Service.

1. 1. ussp webapps on both Tomcats.

      The jkmanager is deactivated in this setup. To activate it, remove the # in the beginning of the line. Consider that the jkmanager should be restricted only to admins, for example by using a certain authenticate port. The jkmanager allows to maintain the nodes.

   2. If the Identity Manager service should run on certain ports, for example in an HTTPS environment, set up a virtual host in httpd.conf.
      The following example describes a setup for HTTPS.
      

      Code Block
      language text title Example: virtual host in httpd.conf
      Listen 444 NameVirtualHost *:444 <VirtualHost *:444> ServerName nexusprime.local SSLEngine on SSLCertificateFile "c:/apache24/conf/primeServerCert.cer" SSLCertificateKeyFile "c:/apache24/conf/ primeServerCert.key" #SSLVerifyClient require #SSLVerifyDepth 1 #SSLCACertificateFile "c:/apache24/conf/ primeTrustedCA.cer" JkMount /prime_explorer/** loadbalancer JkMount /prime_ussp/** loadbalancer #JkMount /jkmanager/* status </VirtualHost>

      This setup provides an HTTPS Connection on Port 444. For client authentication you need to activated the three lines marked with #. If you use client certificates, you might want to remove the global JkMount entries shown in the first example.
      
      When using SSL client authentication, you might want to forward the certificates to the PRIME system. Please check the AJP manual for the corresponding parameters.

identical,

for example, database.properties and log4j.xml. It is also a good idea to keep server.xml and Java OS Environment identical.

Also, communication to subsystems must be available in the same way on each node, for example File Export, LDAP connection, and PKI connections.

To install identical Tomcat nodes:

1. Install a complete Identity Manager system on one node, including Tomcat, Java, Identity Manager applications, and database connection.
2. Copy the setup from the first node to other nodes, to make sure that all components are exactly the same on all nodes.
3. Verify that each Identity Manager instance on each node works properly on its own.

1. 
   

   Note
   The jvmroute will also be picked up by object history to make sure every node has their own history chain. For other clustering techniques see: Chained signature for object history in Identity Manager section Clustering

   
   

2. The AJP connector itself is normally also activated by default on Tomcat. In server.xml, verify that the following Connector entry is present, and that :

   Code Block
   language text title Example: Connector element in server.xml
   <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />

   
   

3. If you want to avoid that someone can access one of the Tomcat nodes directly, deactivate all the other HTTP- or HTTPS-based connectors on the Tomcats.

4. When the Apache HTTP Server and the Tomcats are successfully configured, the Loadbalancer is ready to use.

   Info
   It doesn’t matter in which order the services are started, the connections are established or re-established on demand. To see the status of each node, check the jkmanager.

• IDM 23.10.3 - Requirements and interoperability

• Windows failover clustering deployment
• Apache HTTP Server Project