To install identical Tomcat nodes:

1. Install a complete PRIME system on one node, including Tomcat, Java, PRIME applications, and database connection.
2. Copy the setup from the first node to other nodes, to make sure that all components are exactly the same on all nodes.

For the general requirements for Identity Manager, see Identity Manager requirements IDM 23.10.3 - Requirements and interoperability.

The following additional components are required:

• Apache HTTP Server 2.4 (Tested on Version 2.4.17)
• mod_jk 1.2 (tested on Version 1.2.41)

Supported platforms for the high availability configuration:

• Windows 7, Windows 8.1, Windows Server 2008/2008 R2/ 2012/ 2012 R2
• Linux
  
  

On the Apache HTTP Server, do the following to get the Load balancer running:

1. Create a workers.properties file and place it together with httpd.conf in c:\apache24\conf. Edit the host name and port for Apache JServ Protocol (AJP), in this example 8009, to your corresponding environment.
   
   The file workers.properties does the configuration of the different Tomcat nodes (in most cases you will have two nodes). It holds some very basic parameters like Tomcat host names, ports, but also a lot of additional things (like load balancing factor sticky session setup etc) can be defined here. The following example describes the most basic setup to get the system running, depending on the customers’ requirements it might be necessary to fine-tune this according to the official mod_jk documentation.

   Code Block
   language text title Example: workers.properties
   # workers to contact, that's what you have in your httpd.conf worker.list=loadbalancer,status #setup node1 worker.node1.port=8009 worker.node1.host=myTomcatHost.node1 worker.node1.type=ajp13 worker.node1.lbfactor=50 #setup node2 worker.node2.port=8009 worker.node2.host= host=myTomcatHost.node2 worker.node2.type=ajp13 worker.node2.lbfactor=50 #setup the load-balancer worker.loadbalancer.type=lb worker.loadbalancer.balance_workers=node1,node2 worker.loadbalancer.sticky_session=true worker.loadbalancer.sticky_session_force=true worker.loadbalancer.set_session_cookie=true # Status worker for managing load balancer worker.status.type=status

   
   

2. Do the following updates in the file httpd.conf:

   1. Add the following lines to the httpd.conf, to set up the mod_jk configuration for the load balancer, pointing to the corresponding file workers.properties:

      Code Block
      language text title Example: httpd.conf
      JkWorkersFile C:/Apache24/conf/workers.properties JkShmFile C:/Apache24/logs/httpd/mod_jk.shm JkLogFile C:/Apache24/logs/httpd/mod_jk.log JkLogLevel debug JkLogStampFormat "[%a %b %d %H:%M:%S %Y] " #global JkMounts - you can remove them when using virtual hosts JkMount /prime_explorer/** loadbalancer JkMount /prime_ussp/** loadbalancer # optionally add the status mount point # JkMount /jkmanager/* status

      This example assumes that Identity Manager and Smart ID Self-Service are deployed as prime_explorer and prime_ussp webapps on both Tomcats.

      The jkmanager is deactivated in this setup. To activate it, remove the # in the beginning of the line. Consider that the jkmanager should be restricted only to admins, for example by using a certain authenticate port. The jkmanager allows to maintain the nodes.

   2. If the Identity Manager service should run on certain ports, for example in an HTTPS environment, set up a virtual host in httpd.conf.
      The following example describes a setup for HTTPS.
      

      Code Block
      language text title Example: virtual host in httpd.conf
      Listen 444 NameVirtualHost *:444 <VirtualHost *:444> ServerName nexusprime.local SSLEngine on SSLCertificateFile "c:/apache24/conf/primeServerCert.cer" SSLCertificateKeyFile "c:/apache24/conf/ primeServerCert.key" #SSLVerifyClient require #SSLVerifyDepth 1 #SSLCACertificateFile "c:/apache24/conf/ primeTrustedCA.cer" JkMount /prime_explorer/** loadbalancer JkMount /prime_ussp/** loadbalancer #JkMount /jkmanager/* status </VirtualHost>

      This setup provides an HTTPS Connection on Port 444. For client authentication you need to activated the three lines marked with #. If you use client certificates, you might want to remove the global JkMount entries shown in the first example.
      
      When using SSL client authentication, you might want to forward the certificates to the PRIME system. Please check the AJP manual for the corresponding parameters.

All Tomcat nodes must have exactly the same setup. Especially the deployment of the applications (in webapps) and the server-side configuration in these applications must be identical, for example, database.properties and log4j.xml. It is also a good idea to keep server.xml and Java OS Environment identical.

Also, communication to subsystems must be available in the same way on each node, for example File Export, LDAP connection, and PKI connections.

To install identical Tomcat nodes:

1. Install a complete Identity Manager system on one node, including Tomcat, Java, Identity Manager applications, and database connection.
2. Copy the setup from the first node to other nodes, to make sure that all components are exactly the same on all nodes.
3. Verify that each Identity Manager instance on each node works properly on its own.