6 Installing and Configuring Apache HTTP 2.4 Server WebGate on Windows 64
This chapter contains the following sections:
- Installation Overview of Apache HTTP 2.4 Server WebGate
- Prerequisites for Apache HTTP 2.4 Server WebGate
- Installing Apache HTTP 2.4 Server WebGate
- Post-Installation Steps for Apache HTTP 2.4 Server WebGate
- Verifying the Installation and Configuration of Apache HTTP 2.4 Server WebGate
- Getting Started with a New Apache HTTP 2.4 Server WebGate
- Restarting the Apache HTTP 2.4 Server WebGate Instance
- Deinstalling Apache HTTP 2.4 Server WebGate
- Silent Installation for Apache HTTP 2.4 Server WebGate
Installation Overview of Apache HTTP 2.4 Server WebGate
Installing Apache HTTP 2.4 Server WebGate for Windows 64 includes the following steps:
- Installing the Apache Web Server.
- Installing Apache HTTP 2.4 Server WebGate for Windows.
- Completing the post-installation configuration steps.
- Verifying the Apache HTTP 2.4 Server WebGate installation.
- Registering the new WebGate agent.
Prerequisites for Apache HTTP 2.4 Server WebGate
This section discusses the following topics:
Oracle Fusion Middleware Certification
The Oracle Fusion Middleware Supported System Configurations document provides certification information for Oracle Fusion Middleware, including supported installation types, platforms, operating systems, databases, JDKs, and third-party products related to Oracle Identity and Access Management 12c.
See Oracle Fusion Middleware Supported System Configurations document at http://www.oracle.com/technetwork/middleware/ias/downloads/fusion-certification-100350.html.
Parent topic: Prerequisites for Apache HTTP 2.4 Server WebGate
Installing JRE
You must have a 64-bit Java runtime environment (JRE) 11 or higher installed.
Parent topic: Prerequisites for Apache HTTP 2.4 Server WebGate
Installing Visual C++ Redistributable for Visual Studio 2010 and 2012
vcredist_x64.exe.
WARNING:
During Apache HTTP 2.4 Server WebGate installation, you might encounter Supported MS Visual C++ version is not available in this machine warning if have not installed Visual C++ Redistributable for Visual Studio 2010 and 2012.For information about downloading, installing, and configuring, see the Microsoft download page and product documentation.
Parent topic: Prerequisites for Apache HTTP 2.4 Server WebGate
Installing and Configuring Apache 2.4
For information about installing and configuring Apache 2.4, see the Apache product documentation.
Parent topic: Prerequisites for Apache HTTP 2.4 Server WebGate
Installing and Configuring OAM 12c
For information about installing Oracle Access Manager (OAM), see Installing and Configuring Oracle Identity and Access Management Software in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.
For information about configuring Oracle Access Manager in a new or existing WebLogic administration domain, see Configuring Oracle Access Management in Oracle Fusion Middleware Installation Guide for Oracle Identity and Access Management.
For information about configuring Oracle Access Manager in Open, Simple, or Cert mode, see Securing Communication in Oracle Fusion Middleware Administrator's Guide for Oracle Access Manager .
Parent topic: Prerequisites for Apache HTTP 2.4 Server WebGate
Installing Apache HTTP 2.4 Server WebGate
This section includes the following topics:
Obtaining the Software
For information about obtaining the Apache HTTP 2.4 Server WebGate software, see Oracle Fusion Middleware Download, Installation, and Configuration ReadMe.
Parent topic: Installing Apache HTTP 2.4 Server WebGate
Starting the Apache HTTP 2.4 Server WebGate Installer
To start the installation wizard, do the following:
After the Installer starts, the Welcome screen appears. Continue by referring to the section Installation Flow and Procedure of Apache HTTP 2.4 Server WebGate for installing Apache HTTP 2.4 Server WebGate for Oracle Access Manager.
Parent topic: Installing Apache HTTP 2.4 Server WebGate
Installation Flow and Procedure of Apache HTTP 2.4 Server WebGate
To install Apache HTTP 2.4 Server WebGate for Oracle Access Manager, follow the instructions in Table 6-1.
If you need additional help with any of the installation screens, click Help to access the online help.
Table 6-1 Installation Flow of Apache HTTP 2.4 Server WebGate
| No. | Screen | Description and Action Required |
|---|---|---|
|
1 |
Welcome Screen |
Click Next to continue. |
|
2 |
Specify Installation Location Screen |
Specify the Middleware home and Oracle home locations. For more information about these directories, see Understanding Your Installation Starting Point in Planning an Installation of Oracle Fusion Middleware. Oracle home in case of Apache WebGate is any valid directory, not necessarily in the Middleware home. So, if you do not provide a Middleware home or if you provide an invalid Middleware home, the Installer proceeds without any error. Click Next to continue. |
|
3 |
Prerequisite Checks Screen |
Ignore if you encounter the following error:
Click Next to continue. |
|
4 |
Installation Summary Screen |
Verify the information on this screen. Click Install to begin the installation. |
|
5 |
Installation Progress Screen |
Click Next to continue. |
|
6 |
Installation Complete Screen |
Click Finish to dismiss the Installer. |
Parent topic: Installing Apache HTTP 2.4 Server WebGate
Post-Installation Steps for Apache HTTP 2.4 Server WebGate
This section includes the following topics:
Deploying the Apache HTTP 2.4 Server WebGate Instance
Create an Apache instance by using the
$WEBGATE_HOME\webgate\apache\tools\deployWebGate tool from the
Webgate Oracle home directory.
To deploy the WebGate instance, do the following:
Setting the Environment Variable
For Apache HTTP 2.4 Server WebGate, set the environment variable:
PATH=$WEBGATE_HOME\webgate\apache\lib;%PATH%
Verifying the Installation and Configuration of Apache HTTP 2.4 Server WebGate
After installing Apache HTTP 2.4 Server WebGate for
Oracle Access Manager, you can examine the
installDATE-TIME_STAMP.out log file to
verify the installation. The default location of the log is in the
following file:
WebGate_Home/oraInst.loc
Getting Started with a New Apache HTTP 2.4 Server WebGate
Before you can use the new Apache HTTP 2.4 Server WebGate for Oracle Access Manager, you must complete the following tasks:
- Registering the New WebGate Agent for Apache HTTP 2.4 Server WebGate
Oracle Access Manager WebGate component utilizes a high availability environment to eliminate a single point of failure and to distribute the workload using a load balancer (LBR). OAM needs to be registered only once, the same resulting artifacts are used by all the OAM WebGates that are behind the LBR. - Copying Generated Artifacts to the Apache HTTP 2.4 Server WebGate Instance Location
- Deleting the previous version files
Registering the New WebGate Agent for Apache HTTP 2.4 Server WebGate
Oracle Access Manager WebGate component utilizes a high availability environment to eliminate a single point of failure and to distribute the workload using a load balancer (LBR). OAM needs to be registered only once, the same resulting artifacts are used by all the OAM WebGates that are behind the LBR.
You can register the new WebGate agent with Oracle Access Manager using any one of the following options:
Oracle Access Manager Administration console
For complete information about registering WebGate agent using Oracle Access Manager console, see Registering an OAM Agent Using the Console in Administrator's Guide for Oracle Access Management.
RREG tool
For complete information about registering WebGate agent using RREG tool, see:
Locating and Preparing the RREG Tool
To set up the RREG tool, complete the following steps:
-
Log in to one of the Oracle Access Manager hosts in the Application tier.
-
Change directory to the following directory in the Oracle Access Manager Oracle home:
Note:
The location is required only for the out-of-band mode.OAM_ORACLE_HOME/oam/server/rreg/clientIn this example, OAM_ORACLE_HOME refers to the Oracle home on the system where the Oracle Access Manager software was installed.
Note:
If the Oracle Enterprise Deployment Guide for IDM was used, OAM_ORACLE_HOME may be/u01/oracle/products/access/iam.Note:
If you do not have privileges or access to the Oracle Access Manager server, then you can use out-of-band mode to generate the required files and register the WebGate with Oracle Access Manager. See About RREG In-Band and Out-of-Band Mode. -
Unzip the
RREG.tar.gzfile to the required directory. -
From the unzipped directory, open the
oamreg.shfile and set the following environment variables in the file, as follows:-
Set
OAM_REG_HOMEto the absolute path to the directory in which you extracted the contents of RREG archive.Set
JAVA_HOMEto the absolute path of the directory in which a supported JDK is installed on your machine.
-
Updating the OAM12cRequest.xml File
You must update the agent parameters, such as agentName, in the
OAM12cRequest.xml file in the
RREG_Home/input directory.
Note:
The OAM12cRequest.xml file or the short version
OAM12cRequest_short.xml is used as a template. You can copy
this template file and use it.
Modify the following required parameters in the OAM12cRequest.xml
file or in the OAM12cRequest_short.xml file:
-
serverAddressSpecify the host and the port of the OAM Administration Server.
-
agentNameSpecify any custom name for the agent.
-
agentBaseUrlSpecify the host and the port of the machine on which Oracle Traffic Director 11g WebGate is installed.
-
preferredHostSpecify the host and the port of the machine on which Oracle Traffic Director 11g WebGate is installed.
-
securitySpecify the security mode, such as
open, based on the WebGate installed. -
primaryServerListSpecify the host and the port of Managed Server for the Oracle Access Manager proxy, under a
Servercontainer element.
After modifying the file, save and close it.
Running the RREG Tool
The following topics provide information about running the RREG tool to register your Oracle HTTP Server Webgate with Oracle Access Manager.
About RREG In-Band and Out-of-Band Mode
You can run the RREG Tool in one of two modes: in-band and out-of-band.
Use in-band mode when you have the privileges to access the Oracle Access Manager server and run the RREG tool yourself from the Oracle Access Manager Oracle home. You can then copy the generated artifacts and files to the Web server configuration directory after you run the RREG Tool.
Use out-of-band mode if you do not have privileges or access to the Oracle Access Manager server. For example, in some organizations, only the Oracle Access Manager server administrators have privileges access the server directories and perform administration tasks on the server. In out-of-band mode, the process can work as follows:
-
The Oracle Access Manager server administrator provides you with a copy of the RREG archive file (
RREG.tar.gz).The server administrator can find it in the location described in Updating the Standard Properties in the OAM12cRequest.xml File.
-
Untar the
RREG.tar.gzfile that was provided to you by the server administrator.For example:
gunzip RREG.tar.gztar -xvf RREG.tarAfter you unpack the RREG archive, you can find the tool for registering the agent in the following location:
RREG_HOME/bin/oamreg.shIn this example,
RREG_Homeis the directory in which you extracted the contents of RREG archive. -
Use the instructions in Updating the Standard Properties in the OAM12cRequest.xml File to update the
OAM12cRequest.xmlfile, and send the completedOAM12cRequest.xmlfile to the Oracle Access Manager server administrator. -
The Oracle Access Manager server administrator then uses the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool and generate the
AgentID_response.xmlfile. -
The Oracle Access Manager server administrator sends the
AgentID_response.xmlfile to you. -
Use the instructions in Running the RREG Tool in Out-Of-Band Mode to run the RREG Tool with the
AgentID_response.xmlfile and generate the required artifacts and files on the client system.
Parent topic: Running the RREG Tool
Running the RREG Tool in In-Band Mode
To run the RREG Tool in in-band mode:
-
Navigate to the RREG home directory.
If you are using in-band mode, the RREG directory is inside the Oracle Access Manager Oracle home:
OAM_ORACLE_HOME/oam/server/rregIf you are using out-of-band mode, then the RREG home directory is the location where you unpacked the RREG archive.
-
In the RREG home directory, navigate to the bin directory:
cd RREG_HOME/bin/ -
Set the permissions of the
oamreg.shcommand so you can execute the file:chmod +x oamreg.sh
-
Run the following command:
./oamreg.sh inband RREG_HOME/input/OAM12cRequest_edg.xml
In this example:
-
It is assumed the edited
OAM12cRequest.xmlfile is located in theRREG_HOME/inputdirectory. -
The output from this command will be saved to the following directory:
RREG_HOME/output/
The following example shows a sample RREG session:
Welcome to OAM Remote Registration Tool!
Parameters passed to the registration tool are:
Mode: inband
Filename: /u01/oracle/products/fmw/iam_home/oam/server/rreg/client/rreg/input/OAM12cRequest_edg.xml
Enter admin username:weblogic_idm
Username: weblogic_idm
Enter admin password:
Do you want to enter a Webgate password?(y/n):
n
Do you want to import an URIs file?(y/n):
n
----------------------------------------
Request summary:
OAM12c Agent Name:SOA12214_EDG_AGENT
Base URL: https://soa.example.com:443
URL String:null
Registering in Mode:inband
Your registration request is being sent to the Admin server at: http://host1.example.com:7001
----------------------------------------
Jul 08, 2015 7:18:13 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Jul 08, 2015 7:18:14 PM oracle.security.jps.util.JpsUtil disableAudit
INFO: JpsUtil: isAuditDisabled set to true
Inband registration process completed successfully! Output artifacts are created in the output folder.Parent topic: Running the RREG Tool
Running the RREG Tool in Out-Of-Band Mode
To run the RREG Tool in out-of-band mode on the WEBHOST server, the administrator uses the following command:
RREG_HOME/bin/oamreg.sh outofband input/OAM12cRequest.xmlIn this example:
-
Replace RREG_HOME with the location where the RREG archive file was unpacked on the server.
-
The edited
OAM12cRequest.xmlfile is located in theRREG_HOME/inputdirectory. -
The RREG Tool saves the output from this command (the
AgentID_response.xmlfile) to the following directory:RREG_HOME/output/The Oracle Access Manager server administrator can then send the
AgentID_response.xmlto the user who provided theOAM12cRequest.xmlfile.
To run the RREG Tool in out-of-band mode on the Web server client machine, use the following command:
RREG_HOME/bin/oamreg.sh outofband input/AgentID_response.xmlIn this example:
-
Replace RREG_HOME with the location where you unpacked the RREG archive file on the client system.
-
The
AgentID_response.xmlfile, which was provided by the Oracle Access Manager server administrator, is located in the RREG_HOME/input directory. -
The RREG Tool saves the output from this command (the artifacts and files required to register the Webgate software) to the following directory on the client machine:
RREG_HOME/output/
Parent topic: Running the RREG Tool
Files and Artifacts Generated by RREG
Regardless of the method or mode you use to register the new WebGate agent, the following files and artifacts are generated in the RREG_Home/output/Agent_ID directory:
-
cwallet.sso -
ObAccessClient.xml -
RREG from OAM 11.1.2.3 will generate two cwallet.ss:
-
rreg/output/<webgate_id>/cwallet.sso -
rreg/output/<webgate_id>/wallet/cwallet.sso
-
-
For WebGate 11.1.2.2, copy
rreg/output/<webgate_id>/cwallet.ssoto theWebGate_Instance_Home/webgate/config/ folder. -
For WebGate 11.1.2.3, copy
rreg/output/<webgate_id>/wallet/cwallet.ssoto theWebGate_Instance_Home/webgate/config/wallet/ folder -
In SIMPLE mode, RREG generates:
-
password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be the same as the passphrase used on the server. -
aaa_key.pem -
aaa_cert.pem
-
-
In CERT mode, RREG generates
password.xml, which contains the obfuscated global passphrase to encrypt the private key used in SSL. This passphrase can be different than the passphrase used on the server.Note:
You can use these files generated by RREG to generate a certificate request and get it signed by a third-party Certification Authority. To install an existing certificate, you must use the existing
aaa_cert.pemandaaa_chain.pemfiles along withpassword.xmlandaaa_key.pem.
Copying Generated Artifacts to the Apache HTTP 2.4 Server WebGate Instance Location
After the RREG Tool generates the required artifacts, manually copy the artifacts
from the RREG_Home/output/agent_ID directory to the
Apache configuration directory on the Web tier host.
The location of the files in the Apache configuration directory depends upon the Oracle Access Manager security mode setting (OPEN, SIMPLE, or CERT).
The following table lists the required location of each generated artifact in the Apache configuration directory, based on the security mode setting for Oracle Access Manager. In some cases, you might have to create the directories if they do not exist already. For example, the wallet directory might not exist in the configuration directory.
Note:
For an enterprise deployment, Oracle recommends simple mode, unless additional requirements exist to implement custom security certificates for the encryption of authentication and authorization traffic. The information about using open or certification mode is provided here as a convenience.
Avoid using open mode, because in open mode, traffic to and from the Oracle Access Manager server is not encrypted.
For more information using certificate mode or about Oracle Access Manager supported security modes in general, see Securing Communication Between OAM Servers and WebGates in Administrator's Guide for Oracle Access Management.
| File | Location When Using OPEN Mode | Location When Using SIMPLE Mode | Location When Using CERT Mode |
|---|---|---|---|
wallet/cwallet.sso |
OHS_CONFIG_DIR/webgate/config/wallet |
OHS_CONFIG_DIR/webgate/config/wallet/ |
OHS_CONFIG_DIR/webgate/config/wallet/ |
ObAccessClient.xml |
OHS_CONFIG_DIR/webgate/config |
OHS_CONFIG_DIR/webgate/config/ |
OHS_CONFIG_DIR/webgate/config/ |
password.xml |
N/A | OHS_CONFIG_DIR/webgate/config/ |
OHS_CONFIG_DIR/webgate/config/ |
aaa_key.pem |
N/A | OHS_CONFIG_DIR/webgate/config/simple/ |
OHS_CONFIG_DIR/webgate/config/ |
aaa_cert.pem |
N/A | OHS_CONFIG_DIR/webgate/config/simple/ |
OHS_CONFIG_DIR/webgate/config/ |
aaa_chain.pem |
N/A | N/A | OHS_CONFIG_DIR/webgate/config/ |
Note:
aaa_chain.pem is generated when certificates are created for CERT mode.
Migrating an Existing Certificate
If you want to migrate an existing certificate (aaa_key.pem, aaa_cert.pem, and aaa_chain.pem), then ensure that you use the same passphrase that you used to encrypt aaa_key.pem. You must enter the same passphrase during the RREG registration process. If you do not use the same passphrase, then the password.xml file generated by RREG will not match the passphrase used to encrypt the key.
If you enter the same passphrase, then you can copy these certificates as follows:
Deleting the previous version files
After installing the newer version of the Apache HTTP 2.4 Server WebGate, you must manually delete the older files in the configuration folder.
Complete the following steps:
-
Go to the
{Oracle_OAMWebGate1}/webgate/apache/configdirectory. -
Delete the
np{previous_rel}_wg.txtfile.Where,
{previous_rel}is the version number of the previous release from which you have upgraded from.
Restarting the Apache HTTP 2.4 Server WebGate Instance
To stop the server, run the following command:
httpd.exe -k stop
SET PATH=$WEBGATE_HOME\webgate\apache\lib;%PATH%
httpd.exe -k startTo restart the Apache HTTP 2.4 Server WebGate instance, stop all running instances, and then run the start command.
Deinstalling Apache HTTP 2.4 Server WebGate
You should always use the instructions provided in this section for removing the Apache HTTP 2.4 Server WebGate for Oracle Access Manager. If you try to remove the software manually, then you may experience problems when you try to reinstall the software again at a later time. Following the procedures in this section will ensure that the software is properly removed.
To deinstall the WebGate agent, do the following:
After the deinstaller starts, the Welcome screen is displayed, proceed with the deinstallation.
Deinstallation Screens and Instructions
Follow the instructions in Table 6-2 to complete the deinstallation.
If you need additional help with any of the deinstallation screens, then click Help to access the online help.
Table 6-2 Deinstallation Flow
| Sl. No. | Screen | Description | Action Required |
|---|---|---|---|
|
1. |
Welcome |
Each time the deinstaller starts, the Welcome screen is displayed. |
Click Next. |
|
2. |
Deinstall Oracle Home |
The Deinstall Oracle Home screen shows the Oracle home you are about to deinstall. |
Verify the Oracle home you are about to deinstall. Click Deinstall. On the Warning screen, select whether or not you want the deinstaller to remove the Oracle home directory in addition to removing the software. Click Yes to have the deinstaller remove the software and Oracle home, No to remove only the software, or Cancel to return to the previous screen. If you select No, go to Manually Removing the Oracle Home Directory for instructions on how to manually remove your Oracle home directory. |
|
3. |
Deinstallation progress |
The Deinstallation Progress screen shows the progress and status of the deinstallation. |
Wait until the Deinstallation Complete screen appears. |
|
4. |
Deinstallation Complete |
The Deinstallation Complete screen appears when the deinstallation is complete. |
Click Finish to dismiss the screen. |
Parent topic: Deinstalling Apache HTTP 2.4 Server WebGate
Manually Removing the Oracle Home Directory
If you have selected No on the warning screen during deinstallation, then you
must manually remove your Webgate_Home directory and any
sub-directories. For example: if your Oracle WebGate home directory was
\home\Oracle\Middleware\Oracle_OAMWebGate1, run the following
command:
cd \home\Oracle\Middleware\
rm -rf Oracle_OAMWebGate1
On Windows, if your Oracle Common home directory was C:\Oracle\Middleware\Oracle_OAMWebGate1, then use a file manager window, go to the C:\Oracle\Middleware directory, right-click on the Oracle_OAMWebGate1 folder, and then select Delete.
Parent topic: Deinstalling Apache HTTP 2.4 Server WebGate