Cluster operation Cluster Configuration

Note Latest configurations are identified by internal index sequencing. Time stamps of configurations as displayed in configuration management UI are not relevant as they may be unreliable in case of clock skew on a cluster node. Cluster operation is affected by the interaction of connection security HTTPS and the load balancer. For security reasons, client access is done using the HTTPS protocol. This protocol requires that there is a valid and matching security certificate on the server side possibly on the client side too if client authentication is required. There are generally two methods for achieving clustered operation via independent load balancer. If you deploy on an application server it may provide an integrated load balancer for you which may be easier to configure than an independent load balancer. 1. Secure connection can take a place between a client and the load balancer. The load balacner is the end point for the secure connection which originated at the client. The load balancer will make an independent connection to some of the Oracle Service Registry nodes. This connection may be either in HTTP or HTTPS. The certificate which the client checks has to be placed on the load balancer. A connection between the load balancer and each Oracle Service Registry can be protected by HTTPS in which case the load balancer and the registries should know each others certificates. Figure 46. Security in cluster, method 1. 2. Secure connection can be passed by the load balancer and terminated at the cluster node. This case requires that the certificates on all the nodes be the same to provide the illusion of a single service. However the common name inside the certificate should specify the DNS name of the balancer. Page 125

7.1. Cluster operation

Figure 47. Security in cluster, method 2. Note Load balancer is not part of Oracle Service Registry product. You can use almost any HTTPHTTPS load balancer that supports the described configurations. Most of the Client - Oracle Service Registry interactions require an authentication token to be passed along the way. This token is encrypted by the Oracle Service Registry certificate. Therefore each Oracle Service Registry behind the balancer has to have the same certificate. WEB interfaces of Oracle Service Registry Registry Console need to know the absolute HTTP addresses of themselves. This address in the cluster is the address of the load balancer and the possible context under which it is deployed. This address can be changed during setup.

7.2. Cluster installation

Cluster installation requires the setup of a load balancer and multiple registries. These steps are recommended on the Oracle Service Registry side when an application server is used: 1. Install Oracle Service Registry. • Fill-in the hostname and ports of the load balancer. 2. Port Oracle Service Registry via the Deploy option in the Oracle Service Registry Setup program or directly in Installer program. 3. Deploy the generated WAR or EAR to all cluster nodes via the application server. These steps are recommended on the Oracle Service Registry side where multiple standalone instances of Oracle Service Registry are used: 1. Install the first Oracle Service Registry. • Fill-in the hostname and ports of the load balancer. Page 126

7.2. Cluster installation

2. Setup SSL certificates as required in the first Oracle Service Registry. 3. Install other Registries. • Do not create new databases, just connect to the database of first Oracle Service Registry. • Copy REGISTRY_HOME\conf\pstore.xml from the first registry to each Oracle Service Registry. This assures that each Oracle Service Registry will have the same identity with respect to authentication tokens. • Copy the configuration files in the REGISTRY_HOME\app\uddi\conf\ directory from the first Oracle Service Registry. This is requireded because some fields in the configuration files are coded by a key specified in application_core.xml. Failure to do so may result in error messages during startup and inconsistent configuration data in the database. 4. Run the first installed Oracle Service Registry first so that its configuration files are stored in database first. The next time you can run the Registries in any order including the first one.

7.3. Setting Up Security

If using a cluster of standalone registries, they must share the same private key for validating authentication tokens.

7.3.1. Sharing Token Key

If Oracle Service Registry is installed as a cluster of standalone registries, you must ensure that all cluster nodes share the same private key for checking authentication token validity. By a standalone registry, we mean Oracle Service Registry that is not deployed to an application server. You do not need to do this if Oracle Service Registry is deployed to an application server. To set this up, choose one of the cluster nodes and copy its private key to all other nodes in the cluster by entering this command at a command prompt: PStoreTool copy -alias authTokenIdentity -keyPassword SSL_CERTIFICATE_PASSWORD -config REGISTRY_HOME\conf\pstore.xml -config2 TARGET_REGISTRY_HOME\conf\pstore.xml SSL_CERTIFICATE_PASSWORD is a ssl certificate password entered during the installation TARGET_REGISTRY_HOME is the directory where a cluster node is installed.

7.4. WebLogic specific configuration for use with cluster

This section will guide you through an example setup of clustering with a WebLogic application server. To deploy Oracle Service Registry to a WebLogic cluster follow these steps: 1. Install WebLogic, then configure it by adding machines to the cluster. In our case, the cluster is named cluster and is running on 10.0.0.79 . The nodes in the WebLogic cluster are named: • kila 10.0.0.79, running on kila.mycompany.com , with an http port of 7101 and https port of 7102 • fido 10.0.0.134, running on fido.mycompany.com , with an http port of 7101 and https port of 7102 2. Generate the certificates of all cluster nodes: Lets create proper certificates for our two nodes. It will be done via the CertGen tool provided by WebLogic. Go to the directory WEB_LOGIC_HOME\weblogic81\server\lib. CertGen is located in weblogic.jars utils package. Invoke it with the command: java -cp weblogic.jar utils.CertGen changeit kilacert kilakey export kila.mycompany.com Page 127

7.4. WebLogic specific configuration for use with cluster