• Apache HTTPD / Tomcat Connector: AJP
  • Requirements
  • Loading a module in apache httpd
    • Windows
    • Linux
  • Configuring routing between apache httpd and tomcat
    • Apache Tomcat
    • Apache HTTPD
      • Timeout
  • Alternative : Configuring routing between apache httpd and tomcat while changing the folder name
    • Objective
    • Apache Tomcat
    • Apache HTTPD
• Enabling https (SSL)
  • Requirements
  • Configuration
    • SSLPassphraseDialog
• Load balancing
  • Requirements
  • Configuration
    • Apache Tomcat
    • Apache HTTPD
• Cookie SameSite: Integrating Digdash Enterprise in a portal

Apache HTTPD / Tomcat Connector: AJP

Requirements

• Install apache httpd
• Check that the proxy and proxy_ajp modules are active (see 1.2)

Loading a module in apache httpd

Windows

1. Check that the file corresponding to the module exists and can be found in the <install_apache>/modules folder.
    For instance for the module proxy_ajp the file would be : mod_proxy_ajp.so. If the file does not exist, find a version of httpd that distributes the required module.
2. Load the module in the <install_apache>/conf/httpd.conf file using:
    LoadModule nom_du_module modules/fichier_du_module
    Example: LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

Linux

Use the command: a2enmod nom_du_module
Example:

If this command fails or does not exist, follow the same steps as for Windows.

Configuring routing between apache httpd and tomcat

Apache Tomcat

Check that the following connector exists and is not commented in the <install_tomcat>/conf/server.xml configuration file:

For your information:

• The redirectPort is used for requests using a security constraint requiring an SSL transport.
• Don’t forget to restart Tomcat after modifying the server.xml file.00

Apache HTTPD

In the virtual host file, add the ProxyPass directive so that httpd can connect to Tomcat’s AJP connector:

Timeout

It may be necessary to specify a greater timeout value than the default for the AJP connector.

Some tasks in DigDash Enterprise take over a minute to complete (exports, builders, save/backup…) and could be interrupted by Apache httpd, which in turn would return a HTTP 500 error to the client.

To change this value you can add the timeout=<seconds> parameter to the ProxyPass directive, for example:

Alternative : Configuring routing between apache httpd and tomcat while changing the folder name

Objective

Connecting to a URL that uses a different parent folder.
 In this example we will use a folder named: security_domain1/ and connect to the home page with this URL: http://machine/security_domain1/adminconsole.

Apache Tomcat

Same configuration as Configuring routing between apache httpd and tomcat.

Apache HTTPD

In the virtual host file, add the ProxyPass, ProxyPassReverse and
ProxyPassReverseCookiePath directives to Tomcat’s AJP connector:

Enabling https (SSL)

Requirements

• A valid certificate for the network or a certificate approved by a trusted third party (CA). (ex: Comodo, Globalsign, Thawte, Verisign…)
• A version of Apache httpd that contains the latest security patches concerning ssl.
• Enabling the mod_ssl ssl module. (see Loading a module in apache httpd)
• Understanding the configurations made in Apache HTTPD / Tomcat connector: AJP

Configuration

A Listen directive must be added for httpd to listen on port 443:
<install_apache>/conf/httpd.conf :

The port used in the VirtualHost must then be changed, ssl must be activated and the certificates and private key must be configured:

SSLPassphraseDialog

If your private key is encrypted, you will need to type in your password when httpd starts up or use the SSLPassPhraseDialog directive.

To use this directive without having to type your password, you must create a script file that displays the required password (on stdout). For example:

password.sh :

httpd.conf :

Load balancing

Each user session is linked to a signle Tomcat server (sticky session). If a Tomcat server fails, the user will have to reauthenticate on the server to which the session has been reassociated (if SSO is enabled, this happens automatically).

Requirements

• Enabling the proxy_balancer module. (see Loading a module in apache httpd)
• Understanding the configurations made in Apache HTTPD / Tomcat connector : AJP

Configuration

Apache Tomcat

In the <install_tomcat>/conf/server.xml configuration file, check that the AJP connector exists (add it if it doesn’t):

Check that the Engine tag has a jvmRoute attribute with a unique identifier on each target machine:

Apache HTTPD

In the virtual host file:

Cookie SameSite: Integrating Digdash Enterprise in a portal

Starting from Chrome version 80, the cookies policy is more restrictive concerning the use of cookies from other sites in the same page. If A Digdash dashboard is inserted into an enterprise portal page (eg. in an IFRAME), you must configure the SameSite policy of the cookies to prevent Chrome from blocking the dashboard cookies. It can be done on the Apache configuration:

1. Activate headers module
   /etc/apache2/mods-enabled# ln -s ../mods-available/headers.load headers.load
2. Configure SameSite cookie policy in /etc/apache2/apache2.conf (at the end)
   Header edit Set-Cookie ^(.*)$ $1;HttpOnly;Secure;SameSite=None