This article describes how to run Smart ID Digital Access component (Hybrid Access Gateway) in distributed mode.

Distributed mode is used when the different functions in Digital Access component are distributed to several virtual appliances. A typical case is when you want to enforce the access in one appliance (PEP, Policy Enforcement Point) and process the authorization and authentication requests in one appliance (PDP, Policy Decision Point). In this case you will need two appliances. One that runs access point and another that runs the other Digital Access component services.

Administration service limitations

There can be only one administration service in a node network. The appliance that runs administration service can be toggled to and from distributed mode. When toggling from distributed mode, no other than the services running locally on the appliance can be a part of the node network. Toggling an appliance with no administration service to and/or from distributed mode in general doesn’t make sense since there is no local administration service. Once a service has successfully connected to an administration service, then that service cannot easily be switched to work with another appliance's administration service.

Configure distributed mode

Log in on all hosts and go through the basic setup. The Administration Service UI setup system wizard should not be run on an appliance that will not run a local Administration service. Make a note of each host's network IP address which the other hosts should use to communicate with it.
On virtual appliance
1. This can be viewed in the console under “modify interfaces”.
On Orchestrator
1. This is the IP address of host network.
Log in to Digital Access Admin of the host that will run the Administration service.
Go to Manage System. Here you can add, remove and configure the services: Administration service (configure, not add/remove), Access point, Policy service, Authentication service and Distribution service according to your preferred setup. As the services must be able to communicate with each other, you must set them to listen on the host's network IP address, overriding the default 127.0.0.1:
1. Set the value Internal Host to an external IP address.
2. Make a note of the Service ID for all services, including the new services that have been created.
3. When configuring the Policy service make sure to also configure XPI:REST.
Go to Manage Resource Access and select the api resource.
Select Edit Resource Host…
Configure the same IP address as you configured under XPI:REST.
If the Administration service, Policy service(s) and/or Authentication service(s) are to be spread out over multiple hosts, then the built-in default internal database cannot be used due to it being reachable only on the loopback adapter (127.0.0.1). Consequently an external database has to be used that can be reached by the hosts running these services.
1. Go to Manage System > Database Service to configure it, see also Database service in Digital Access.
If multiple Authentication services are to be used, then the built-in default OATH database cannot be used for the same reason as above.
1. Go to Manage System > OATH Configuration.
2. Select Configure Database Connection.
Click Publish.
Log on to the host running the Administration service and disable the services that this host should not run.
On virtual appliance
1. In the console, select 2) Detailed server setup. A list of local services is displayed.
2. Select each service that shall be deactivated. Answer the questions (first question is "Should this service be enabled?") with No.
On Orchestrator
1. For each service that should be disabled, run the following command:
  docker exec orchestrator hagcli -s policy-service -o disable
Log on to the host running the Administration service and enable distributed mode.
On virtual appliance
1. Select 6) Activate distributed mode to toggle to “distributed mode”.
On Orchestrator
1. Run the following command:
  docker exec orchestrator hagcli -s distributed-service -o enable
Log on to the other host(s) not running Administration service and select and disable all services you do not want to run on this host:
1. Disable all services you do not want to run on this host.
  On virtual appliance
  1. Select Detailed server setup in the console.
  On Orchestrator
  1. For each service that should be disabled, run the following command:
    
    docker exec orchestrator hagcli -s policy-service -o disable
2. Since the Administration service is not hosted on this/these host(s), then an external one needs to be pointed to.
  On virtual appliance
  1. Select Detailed server setup in the console.
  2. Disable Administration Service and answer question where to find Administration service. This will change all IP addresses of the Administration service in the LocalConfiguration.xml automatically.
  On Orchestrator
  1. Change IP address of Administration Service for each service enabled on this host
    Open LocalConfiguration.xml in opt/nexus/primary/<service>/config/LocalConfiguration.xml
    Search for Administration Service section
    Change value of mHost to external IP address of Administration Service
The Activate distributed mode option can be used as a convenience on an appliance to quickly set all IP address fields to a given value, and their port and node id to the default values:
1. In the console, select 2) Detailed server setup.
2. Then select 6) Activate distributed mode.
To further manually configure any service on this appliance,
On virtual appliance
1. Select 2) Detailed server setup, and select the service to modify and answer the questions.
On Orchestrator
1. Open LocalConfiguration.xml in opt/nexus/primary/<service>/config/LocalConfiguration.xml
2. Change id values in element <id> and attribute mId to a the number you got when adding the new service node in Digital Access Admin.

This article is valid from Digital Access 6.0

Run Digital Access component in distributed mode

Administration service limitations

Related information