ConfigureCLMOnWASWithLDAP < Deployment

Engineering Lifecycle Management Wiki - Deployment
Community information and contribution guidelines
TWiki > Deployment Web > DeploymentInstallingUpgradingAndMigrating > ConfigureCLMOnWASWithLDAP
Revision 28 - 2024-08-15 - 14:32:08 - TimFeeney
<div id="header-title" style="padding: 10px 15px; border-width:1px; border-style:solid; border-color:#FFD28C; background-image: url(<nop>https://jazz.net/wiki/pub/Deployment/WebPreferences/TLASE.jpg); background-size: cover; font-size:120%">
---+!! Configuring CLM on !WebSphere Application Server with LDAP
%DKGRAY% Authors: Main.MikeDelargy, Main.MirkoHartwig<br>
Build basis: CLM Versions 3.x, 4.x, 5.x, 6.x and 7.x(up to 7.0.2)
%ENDCOLOR%</div></sticky>

<!-- Page contents top of page on right hand side in box -->
<sticky><div style="float:right; border-width:1px; border-style:solid; border-color:#DFDFDF; background-color:#F6F6F6; margin:0 0 15px 15px; padding: 0 15px 0 15px;">
%TOC{title="Page contents"}%
</div></sticky>
<br>
=Note: Support removed for IBM !WebSphere Application Server (Traditional WAS) starting with ELM version 7.0.3. Use !WebSphere Liberty, either embedded and installed with ELM applications, or separately installed= <br> <br>

<sticky><div style="margin:15px;"></sticky>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

---++ Configure WAS Environmental Variables

1.If !WebSphere is not running, go ahead and start it at this time.  ___

   *      *Windows:*
      *    c:\IBM\WebSphere\AppServer\profiles\CLMAppsrv01\bin>startServer.bat server1       %RED%   _(Your path may be different.)_ %ENDCOLOR%

   *     *Linux:*
      *    /opt/ibm/WebSphere/Appserver/profiles/CLMAppsrv01/bin/startServer.sh server1       %RED%    _(Your path may be different.)_ %ENDCOLOR%

<img src="https://jazz.net/wiki/pub/Deployment/ConfigureCLMOnWASWithLDAP/startserver.png" width="285" height="180" /> 
 <br />
<br />
2.Login into the IBM !WebSphere Admin console   %RED%   _(this WAS installation was configured with the user / pw      wasadmin / wasadmin    yours will probably be different)_ %ENDCOLOR%

  <br />
     <img src="%ATTACHURLPATH%/WAS_LoginPage.png" alt="WAS_LoginPage.png" width="285" height="180" />
 <br />
<br />
3.Navigate to the Server / Server Types / !WebSphere Application Servers and  click server1 <br />
<br />
    <img src="%ATTACHURLPATH%/server1.png" alt="server1.png" width="350" height="162" />
<br />
 <br />
4.On the right hand side, select Server Infrastructure then select Java and Process Management and click Process definition<br />
<br />
     <img src="%ATTACHURLPATH%/java_vert_machine_process_mngmt.png" alt="java_proc_manment.png" width="180" height="159" />
 <br />
<br />
5. Under Additional Properties, select  "Java Virtual Machine"  <br />
     <img src="%ATTACHURLPATH%/process_def_virtual_machin.png" alt="process_def_virtual_machin.png" width="349" height="150" />
 <br />
<br />
6.Enter:

   * *Initial Heap:*  8196

   * *Maximum Heap:* 8196
   * *Enable the Verbose GC checkbox*
<br />


%RED%   _(These are minimum settings - Consult your local rep or Techline for more appropriate settings.)_  <br />
Additionally, since you are setting your Max and Min heap here, you do *not* need to set them in the Generic JVM Arguments.%ENDCOLOR%
<br />
<br />

     <img src="%ATTACHURLPATH%/jvm_settings.png" alt="jvm_settings.png" width="636" height="389" />
 <br />
<br />
Enter the following in for the *Generic JVM Settings* <br />
 %RED% These are generic recommendations, your numbers may vary depending on your max heap and may need to be tuned.  As a guide, set your nursery [*-Xmn*] to 1/4 of your heap [*-Xmx*] for JTS, RTC, and RQM.  For RNDG, set your Nursery [*-Xmn*] to 1/3  of your max heap [*-Xmx*].  %ENDCOLOR%<br />
<br />
<br />
<verbatim>
-Xgcpolicy:gencon -Xcompressedrefs
-Xgc:preferredHeapBase=0x100000000
-XX:MaxDirectMemorySize=1G
-Xmn2048M 

</verbatim>

7.Click *Apply* 


8.Click  *Custom Properties* on the upper right side   <br />
<br />
 <img src="%ATTACHURLPATH%/custom_properites_link.png"  width="254" height="150" />
<br />
 <br />
9.Click *New*   <br />
<br />
 <img src="%ATTACHURLPATH%/new_custom_property.png" alt="new_custom_property.png" width="309" height="187" />
 <br />

10.Enter the following new values:     %RED%  _(Verify your paths before setting the values. If the path to JAZZ_HOME (or any of the custom properties) has spaces, specify the short form of the path name. For example, if the path is C:\Program Files, type the path name as C:\Progra˜1)_ %ENDCOLOR% 

   * 	*Linux:*
         * JAZZ_HOME           *Value*   file:///opt/IBM/JazzTeamServer/server/conf
         * SQLSERVER_JDBC_DRIVER_FILE   *Value*   /opt/IBM/JazzTeamServer/Server/SQLServer/sqljdbc4.jar  _(only if using SQL Server to host your application databases)_
         * ORACLE_JDBC_DRIVER_FILE         *Value*    /opt/IBM/JazzTeamServer/server/ORACLE/ojdbc6.jar  _(only if using Oracle to host your application database files)_
         * org.eclipse.emf.ecore.plugin.EcorePlugin.doNotLoadResourcesPlugin  *Value*  true
         * java.awt.headless   *Value*  true
         Prior to versions 7.0.1 SR1 / 7.0.2 SR1
         * log4j.configuration 	 *Value*  file:///opt/IBM/JazzTeamServer/server/conf/startup_log4j.properties
         Versions 7.0.1 SR1 / 7.0.2 SR1 and beyond
         * log4j.configuration   *Value* file:///opt/IBM/JazzTeamServer/server/conf/startup_log4j2.xml


   * 	*Windows:*
         * JAZZ_HOME   *Value*   file:///C:/IBM/JazzTeamServer/server/conf
         * SQLSERVER_JDBC_DRIVER_FILE   *Value*   C:\IBM\JazzTeamServer\Server\SQLServer\sqljdbc4.jar _(only if using SQL Server to host your application databases)_
         * ORACLE_JDBC_DRIVER_FILE          *Value*    C:\IBM\JazzTeamServer\server\ORACLE\ojdbc6.jar _(only if using Oracle to host your application database files)_
         * java.awt.headless   *Value*  true
         * org.eclipse.emf.ecore.plugin.EcorePlugin.doNotLoadResourcesPlugin *Value*  true
         Prior to versions 7.0.1 SR1 / 7.0.2 SR1
         * log4j.configuration 	 *Value*  file:///C:/IBM/JazzTeamServer/server/conf/startup_log4j.properties  
         Versions 7.0.1 SR1 / 7.0.2 SR1 and beyond
         * log4j.configuration   *Value* file:///C:/IBM/JazzTeamServer/server/conf/startup_log4j2.xml <br />
          

     <img src="%ATTACHURLPATH%/linux_WAS_custom_properties.png" alt="linux_WAS_custom_properties.png" width="562" height="327" />


11. Click *Save directly to master configuration*  

---+++ Configure LDAP for WAS

Go to Security \ Global Security



1.Under Java 2 security, clear the check box for *Use Java 2 security to restrict application access to local resources.* 

 <br />
     <img src="%ATTACHURLPATH%/1A_security.png" alt="1A_security.png" width="408" height="208" />

<br />

2.Ensure that the *Enable administrative security* and *Enable application security* check boxes are selected and click *Apply*   


3. Click Security > Global security > Web and SIP security > General settings. 
<br />
 
     <img src="%ATTACHURLPATH%/3_web_sip_secuirty.png" alt="3_web_sip_secuirty.png" width="180" height="124" />


4.Ensure *“Use available authentication data when an unprotected URI is accessed”* is checked and click *OK*  

 <br />
     <img src="%ATTACHURLPATH%/4_general_security_behavior.png" alt="4_general_security_behavior.png" width="280" height="103 />



5.Under User account repository, change the “Available real definitions” to Standalone LDAP registry and click configure.  

    <br />
     <img src="%ATTACHURLPATH%/5_standalone_ldap.png" alt="5_standalone_ldap.png" width="240" height="126" />

<br />

6.Enter  data similar to the following:  %RED%  (Your ldap admin will need to supply you with this information) %ENDCOLOR%

                            *Primary administrative user name:*  wasadmin

                           *Type of LDAP server:*  Custom 

                           *Host:*    jazzapacheds

                           *Port:*    10389       %RED%   _(default port is 389 verify your port with your ldap admin)_ %ENDCOLOR%

                            *Base distinguished name (DN):*  dc=upgrade,dc=ws

                             *Search timeout:*  120 (default)


<br />
     <img src="%ATTACHURLPATH%/6_ldap_information.png" alt="6_ldap_information.png" width="246" height=261" />
<br />
<br />
*Note*: If you are using another LDAP provider, such as Microsoft AD, start with the default settings provided by selecting Microsoft AD, in the dropdown for Type of LDAP server.

7. Click *Apply*              <br />  <img src="%ATTACHURLPATH%/14_apply.png" alt="14_apply.png" width="95" height="79" /> <br />



8.    click  *Advanced Lightweight Directory Access Protocol (LDAP) user registry settings* 

<br />
     <img src="%ATTACHURLPATH%/7_advanced_ldap.png" alt="7_advanced_ldap.png" width="269" height="77" />

<br />

9.  Enter data similar to the following:  %RED%  _(Your ldap admin will need to supply you with this information)_ %ENDCOLOR% 

                                  *User filter:*   (&(uid=%v)(objectclass=inetOrgPerson))

                                  *Group Filter:*    (&(cn=%v)(objectclass=groupOfUniqueNames))

                                  *Group member ID map:*    groupOfUniqueNames:uniquemember

%RED%   _Worth noting.  The Group member ID map value is the object class name from the Group filter section in congunction with the group unique identifier._ %ENDCOLOR%

 <br />
     <img src="%ATTACHURLPATH%/8_advnacedldao_properties.png" alt="8_advnacedldao_properties.png" width="276" height="292" />
<br />


10.  Click *OK*     <br />
  <img src="%ATTACHURLPATH%/9_0k.png" alt="9_0k.png" width="38" height="37" />
<br />

11.   Click *Test Connection*   

 <br />
     <img src="%ATTACHURLPATH%/10_test.png" alt="10_test.png" width="168" height="108" />
 <br />


_You should receive a message the the test was successful_

 <br />
     <img src="%ATTACHURLPATH%/11_test_success.png" alt="11_test_success.png" width="315" height="121" />
 <br />
 

12. Click *Save* directly to the master configuration.  

 <br />

     <img src="%ATTACHURLPATH%/15_save_master.png" alt="15_save_master.png" width="268" height="152" />
 <br />
 <br />

13.  Click *OK*  (bottom of page)      <br /> 
<img src="%ATTACHURLPATH%/9_0k.png" alt="9_0k.png" width="39" height="38" />


14.  Click *set as current*  

 <br />
     <img src="%ATTACHURLPATH%/13_set_as_current.png" alt="13_set_as_current.png" width="251" height="120" />
<br />
<br />

15.   Click *Apply*     <br />  <img src="%ATTACHURLPATH%/14_apply.png" alt="14_apply.png" width="95" height="79" />

<br />


16.    Click *Save* directly to the master configuration. 

<br />
     <img src="%ATTACHURLPATH%/15_save_master.png" alt="15_save_master.png" width="268" height="151" />
<br />
<br />


---+++ Configure WAS for JTS and CLM war files



1. Go to Applications \ New Application  then click New Enterprise Application.   



     <img src="%ATTACHURLPATH%/1_new_application.png" alt="1_new_application.png" width="519" height="221" />

2. Select “Local file system” and click Browse  

Drill down to /opt/IBM/JazzTeamServer/server/tomcat/webapps 
 
%RED%  _(This is the path for a default installation; your path may be different)_   <br />
_(On Windows, your path may look similar to C:\IBM\JazzTeamServer\server\tomcat\webapps)_ %ENDCOLOR% 


     <img src="%ATTACHURLPATH%/2b_path2war.png" alt="2b_path2war.png" width="289" height="149" />


These war files need to be added one at a time:  

For the JTS server:
   * *jts.war*,
   * *clmhelp.war*,
   * *admin.war*

For the CCM (RTC) server:
   * *ccm.war*

For the RQM server:
   * *rqm.war*

For the RRC server:
   * *rm.war*,
   * *converter.war*   %RED%   _(The converter.war can only be installed on windows or linux)_ %ENDCOLOR%


3. Start with the *jts.war* and click OK  then Click Next  %RED%   _(The order of installing the war files does not matter)_ %ENDCOLOR%




4 .Use the fast path installation

<img src="%ATTACHURLPATH%/3fastpath.png" alt="3fastpath.png" width="370" height="193" />

 

Click Next  


5 .Accept the default installation options and click Next 


<img src="%ATTACHURLPATH%/4_install_options.png" alt="4_install_options.png" width="348" height="403" />

  

6. Map Modules to servers

<img src="%ATTACHURLPATH%/5_check_box.png" alt="5_check_box.png" width="242" height="211" />

 
Click Next  

7. Check the box for to map the war file to the default host and click Next   

 <img src="%ATTACHURLPATH%/5_check_box_again.png" alt="5_check_box_again.png" width="273" height="255" />

  

8. Add the context root for the war file %RED%   _(If you have upgraded from 2.x versions, your context roots may be different)_ %ENDCOLOR%

*jts.war*  =  /jts 


 <img src="%ATTACHURLPATH%/6_context_root.png" alt="6_context_root.png" width="300" height="89" />


Click Next   

9. Review the summary page and click Finish  

<img src="%ATTACHURLPATH%/8_finish.png" alt="8_finish.png" width="303" height="380" />

10. When this completes, click Save directly to the master configuration.  

<img src="%ATTACHURLPATH%/9_save.png" alt="9_save.png" width="222" height="400" />

  

11. When this is done, repeat the process for the other war files that you will be installing on this server.  

%RED%   _(Here is a list of the war files and their associated context roots:)_ %ENDCOLOR%


  * *admin.war*     		/admin    <br />

  * *ccm.war*        		/ccm  	 <br />	

  * *clmhelp.war*  		/clmhelp   	 <br />

  * *converter.war* 		/converter    <br />	

  * *jts.war*             	/jts    <br />		

  * *qm.war*          		/qm    <br /> 		

  * *rm.war*         		/rm      <br /> 		


12.  When you have completed configuring each of these war files, go to:
  
    Applications / Application types / !WebSphere enterprise applications   and you should see each of your applications listed     __

<img src="%ATTACHURLPATH%/10_select_application.png" alt="10_select_application.png" width="464" height="215" />

 
*Enable security*

%RED%   _(Security only needs to be enabled for the jts.war, ccm.war, and the qm.war files.)_ %ENDCOLOR%

13. To enable security for the jts.war, click on the jts.war link in the  Applications / Application types / WebSphere enterprise applications  section   (shown above)   

14. Click on Security role to user/group mapping   

 <img src="%ATTACHURLPATH%/11_security_role.png" alt="11_security_role.png" width="225" height="229" />

 

15. For each of the listed “Roles” we will need to map groups.
Check the !JazzAdmins role and click “Map Groups...” <br />
         
 <img src="%ATTACHURLPATH%/12_map_group.png" alt="12_map_group.png" width="247" height="191" />

  
16. Click the “Search” button _(It is possible to 'filter' this list when you have a large ldap community)_  

  <img src="%ATTACHURLPATH%/13_search_group.png" alt="13_search_group.png" width="514" height="205" />

 
17. You should see a list of available Groups %RED%   _(from our ldap server .. your groups will probably be different, Consult your LDAP Admin)_   %ENDCOLOR%

18. For !JazzAdmn, highlight cn=JazzAdmins,ou=Groups,dc=upgrade,dc=ws and click the “right” button       %RED%   _(your groups will match the values in your ldap server)_ %ENDCOLOR%


19. Click OK   _

Repeat for each of the other groups listed


 <img src="%ATTACHURLPATH%/14_repeat_groups.png" alt="14_repeat_groups.png" width="485" height="218" />

20. When you have finished, click OK    


21. Click Save directly to the master configuration.   

22. Repeat this for the ccm.war, and the qm.war %RED%   _(if you are using ccm and qm)_    _(You do NOT have to do it for the rm, admin, clmhelp, nor the converter war files.)_    %ENDCOLOR%



23. Logout of the admin console   


24. We need to restart !WebSphere    (Command line option)         

Stop the server 

   *      *Windows:*
      *    c:\IBM\WebSphere\AppServer\profiles\CLMAppsrv01\bin>stopServer.bat server1     

   *     *Linux:*
      *    /opt/ibm/WebSphere/Appserver/profiles/CLMAppsrv01/bin/stopServer.sh server1

25. Now start the services again


Start the server   <br />

   *      *Windows:*
      *    c:\IBM\WebSphere\AppServer\profiles\CLMAppsrv01\bin>startServer.bat server1     

   *     *Linux:*
      *    /opt/ibm/WebSphere/Appserver/profiles/CLMAppsrv01/bin/startServer.sh server1
26. Log back into the admin console to verify the Applications are running  __

Applications \ Application Types  \ WebSphere enterprise applications
 

27. Go back to the IBM Admin Console and logout.   _

---++++ You have completed the configuring !Websphere for CLM
<br />

---+++ OPTIONAL - Setting up a Windows Service when using LDAP

The following shows how to setup the Windows service to use an LDAP user.  You will need to do this when you enable Standalone LDAP user authentication with !Websphere.  This section is a supplement to the !Websphere technote on [[http://www-01.ibm.com/support/docview.wss?uid=swg21397335][Using WASServiceCmd to create Windows services for WebSphere Application Servers]].
<br />

In this example we will use an Active Directory user and show how to fix the problem of a service that will not shutdown.

   1. Stop the service.  This will fail with a 1053 error that the service did not respond to the stop attempt.  You will need to kill 3 processes if you created a service already 
      * WASService.exe
      * Java x2 processes to stop the service.
   2. Then run the following command from the {path to IBM}\WebSphere\AppServer\bin directory
 
   *WASService.exe -add <i>was1Node01</i> -serverName server1 -profilePath {path to IBM}\WebSphere\AppServer\profiles\AppSrv01 -stopArgs "-username <Primary administrative user name> -password <password>"*
  <br />

where <i>username</i> corresponds to the Primary administrative user name.   <br />
where <i>was1Node01</i> is the node name appended to the service name .  <br />
  <br />
  <br />
*Tip 1:* To find the <i>Primary administrative user name</i>, in !Websphere go to:
  <br />
Security -> Global Security -> Available realm definition  {It will state <i>Standalone LDAP</i> }   <br />
Configure -> Type of LDAP will be <i>Microsoft Active Directory</i>   <br />
<img src="%ATTACHURLPATH%/primaryadminuserinwas.jpg" alt="primaryadminuserinwas.jpg" width="386" height="383" />
 
See "Primary administrative user name" - this is the user that needs to start and stop the service.  This must be an active directory user.

  <br />

*Tip 2:* To find the Node name perform the following:
   Run *services.msc* -> {search for} IBM !Websphere Application Server -> {right-click Properties} select the node information suffixed to the Service Name   <br />
  <img src="%ATTACHURLPATH%/wasnodeinfo.jpg" alt="wasnodeinfo.jpg" width="410" height="461" />
  <br />
The above picture highlights text which will be needed for the WASService command above.
  <br />
  <br />
---+++++!! Related topics: [[DeploymentWebHome][Deployment web home]], [[http://www.ibm.com/support/knowledgecenter/SSYMRC_6.0.3/com.ibm.jazz.install.doc/topics/c_user_management_methods_was.html][Managing users on WebSphere Application Server]], [[http://www.ibm.com/support/knowledgecenter/SSYMRC_6.0.3/com.ibm.jazz.install.doc/topics/r_ldap_config_param.html][LDAP configuration parameters]]
  <br />

---+++++!! Additional contributors: Main.PaulEllis, Main.ChristianGlockner, Main.RosaNaranjo

<sticky></div></sticky>
Attachments
Topic attachments
I	Attachment	Action	Size	Date	Who	Comment
jpg	primaryadminuserinwas.jpg	manage	26.1 K	2016-10-06 - 10:09	PaulEllis	Primary Admininistrative User screenshot
jpg	wasnodeinfo.jpg	manage	39.9 K	2016-10-06 - 10:10	PaulEllis	Showing where to get the WAS node information
Copyright © by IBM and non-IBM contributing authors. All material on this collaboration platform is the property of the contributing authors.
Contributions are governed by our Terms of Use. Please read the following disclaimer.
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.