WebSphere Application Server - Security is EVERYTHING

This is an excellent set of articles from two of my IBM colleagues, Martin Lansche and Keys Botzum.

Summary:  Security consists of more than just some firewalls at the edge of your network protecting you from the outside. It is a difficult and complex set of actions and procedures that strive to strengthen your systems as much as is appropriate. This article discusses many aspects of security in general, including the IBM® WebSphere® Application Server security architecture, and discusses hardening a WebSphere Application Server environment. 

WebSphere Application Server V7 advanced security hardening, Part 1: Overview and approach to security hardening

WebSphere Application Server V7 advanced security hardening, Part 2: Advanced security considerations

Advanced security hardening in WebSphere Application Server V7, V8 and V8.5, Part 1: Overview and approach to security hardening

Just waiting for part 2 of the latest article to come out .....

Creating a Remote Messaging, Remote Support and Web pattern (RMRSW) based Network Deployment environment for IBM Business Process Manager Standard Version 8.0

I'm in the midst of an IBM BPM implementation at the moment, working to deploy a combined Process Center / Process Server environment using IBM BPM Standard 8.0 ( as 8.0.1 isn't  yet available ). Therefore, this set of blog posts look to be terribly useful.

This blog entry walks you thru the step-by-step procedure to create a stand-alone Process Center server and a Remote Messaging, Remote Support and Web pattern-based network deployment environment for the Process Server. Setting this environment can be accomplished in many different ways and this blog post approaches the task in a simple, yet commonly used, methodology that is applicable for most platforms. We would love to hear your feedback and would appreciate it if you shared your own experience with us.

Part 1: Creating a stand-alone Process Center Server

Part 2: Creating the deployment manager and custom nodes

Part 3: Creating deployment environment and database activities

Definitely worth a read ...

Curing the Curly Cable Conniption

Thanks to the kind recommendation of a colleague, Mr Andy Barnes Esq., I've now made a good attempt to tame the rats' nest of wires that I typically carry around - along with a spoon and fork.

I picked up a neat bunch of cord wraps from Cargo ( in Newbury, although I'm sure that they have other outlets ) - they had a buy-two-get-one-free deal, so I paid £15.00 for six of the wraps, in three different sizes

So now I have this: -

which is far far better.

I may get a few more wraps next weekend, just for the odd rainy day ( or the acquisition of more gadgets == more cables ).

Thanks, Andy, good catch.

BPM = Blogs Pour Me // Business Process Management

In this article, I make reference to a new (to me) blog for the IBM Business Process Manager tool, as I continue to discover and, more importantly, bookmark / share resources for my new role in IBM Software Services for WebSphere (ISSW).

From the blog post: -

...

When you contact IBM Support, a Problem Management Record, or PMR, is opened to track your concern and its resolution. Many of those PMRs reference support documents that are used to resolve a specific issue. We are able to analyze those records to find issue trends that are affecting many of our IBM Business Process Manager customers. When we look at the top 10 most referenced support documents in PMRs, we find several of the MustGather documents. If you are not familiar with these documents, they explain the type of information that IBM Support needs to expedite the resolution of your issue. These documents include requests for information about your operating environment and requests for certain files that can help us diagnose your issue. The following MustGather documents are available to help us help you:

• Collect troubleshooting data for database problems in IBM Business Process Manager (BPM)
• Collect troubleshooting data for IBM Process Designer problems in IBM Business Process Manager (BPM)
• Collect troubleshooting data for installation or upgrade problems with IBM Business Process Manager products
• Collect troubleshooting data for Performance Data Warehouse problems in IBM Business Process Manager (BPM)
• Collect troubleshooting data for security problems in IBM Business Process Manager (BPM)
• Collect troubleshooting data for web services problems in IBM Business Process Manager

In addition to the "MustGather" documents, IBM Support Assistant Version 5.0 can help you determine the root cause of an issue and find possible documented resolutions. In fact, Version 5.0 Beta 2 was just released within the last few weeks of this post.

...

What's HOT in IBM Business Process Manager Support?

Whilst I'm at it, here's a few more blogs that I'm making more and more use of: -

Java Weblog

WebSphere BPM Blog

@IT

Live Demos: IBM Operational Decision Manager

Live Demos: IBM Operational Decision Manager - Interactive Web demos every second Wednesday of the month

Join us for our monthly interactive Web demos. See the new face of business rules management in action.

Each month one of our technical experts provides an interactive walk-through of the new IBM Operational Decision Manager v8 product -- the next generation of business rules management capabilities.

This live demo and discussion forum is a good opportunity to see the new product capabilities in action - especially the new business user interface that features social media style collaboration. You can now manage and maintain business rules in an environment as familiar as your favorite social media tool:

- one that's intuitive, easy, fast and features social media style collaboration
- one that requires little to no training for subject matter experts.

Additional developments include enhanced Rules and Events Integration and Testing and Simulation on complex conditions to ensure the right intent is captured in the authored rules.

Come see why IBM ODM v8 and IBM ODM for z/OS v8 are our most consumable business rule management offerings yet.

Upcoming IBM ODM in Action demos

• November 14, Wednesday, 10:00am PST; 1:00pm ET - Sign up now

• December 12, Wednesday, 10:00am PST; 1:00pm ET - Sign up now

IBM Business Process Manager - Defining the Environment

In this brief article, I outline how an IBM BPM cell ( nodes, clusters, Service Integration bus, databases etc. ) can be built using a Deployment Environment.

The Deployment Environment is, in effect, a template that can be created, exported, edited and applied across different BPM environments, allowing one environment to be used as a template or pattern for others.

Here's what the IBM documentation says: -

A deployment environment is a collection of configured clusters, servers, and middleware that collaborate to provide an environment to host software modules. For example, a deployment environment might include a host for message destinations, a processor or sorter of business events, and administrative programs.

So I have a template, and I want to apply it to my newly created WebSphere Application Server v8 cell ( a managed node, with a co-located Deployment Manager ).

Note that I'm running Windows - why ? Because I can .... Just for a change ....

Preparation

(a) Edit Deployment Environment Definition file - in my case, c:\temp\BPM8Std.xml - to set: -

createTable="true"

to: -

createTable="false"

to avoid DB2 database tables being created whilst the Deployment Environment is being imported into, and applied to, the cell

(b) Change SOAP timeout from default of 180 in C:\IBM\WebSphere\AppServer\profiles\Dmgr01\properties\soap.client.props
- from com.ibm.SOAP.requestTimeout=180 to com.ibm.SOAP.requestTimeout=60000

(c) Backup profile directory - C:\IBM\WebSphere\AppServer\profiles

- This is a belt and braces approach to backups - other, better, approaches do exist

(d) Start wsadmin client: -

C:> cd C:\IBM\WebSphere\AppServer\profiles\Dmgr01\bin
C:> wsadmin.bat -lang jython

(e) Import and apply the Deployment Environment

wsadmin> AdminTask.importDeploymentEnvDef([ "-filePath", "c:\\temp\\BPM8Std.xml", "-topologyName", "BPM8Std"])
wsadmin> AdminTask.generateDeploymentEnv(["-topologyName", "BPM8Std"])
wsadmin> AdminConfig.save()

Note that the generateDeploymentEnvironment task may take some time - it took about 10 minutes on my VM

(f) Job done :-)

IBM Worklight Server - Installation via a response file ( of course )

In this post, I briefly outline how I installed an IBM Worklight Server in about 10 minutes, via a small number of commands :-)

For my server, I'm using Red Hat Enterprise Linux 6.3 ( what else ) and the Enterprise version of the Worklight Server product.

I'm actually performing the installation as a non-root user ( wasadmin ) but one could choose to install as root ( ! ).

Me being me, I've downloaded BOTH versions: -

IBM Worklight Consumer Edition V5.0 zip of Installation Manager Repository for IBM Worklight Server Multiplatform English Only (CI88QEN)

-rw-r--r--. 1 501 games 146M Sep 25 17:35 IM_Rep_Worklight_Server_wce_5.0.0.zip

IBM Worklight Enterprise Edition V5.0 zip of Installation Manager Repository for IBM Worklight Server Multiplatform English Only (CI88KEN)

-rw-r--r--. 1 501 games 146M Sep 25 13:18 IM_Rep_Worklight_Server_wee_5.0.0.zip

I'd previously installed IBM Installation Manager 1.5 (IIM) using this command: -

$ /mnt/hgfs/WP8/Setup/IIM/linux_x86/userinstc -input ~/install_IIM.rsp -acceptLicense

as I was using it to prepare for a WebSphere Portal 8 installation ( see this blog post for more details ).

IIM can be downloaded from a variety of places, including this: -

Installation Manager, 1.5

Unpack Worklight

$ cd /tmp

$ mkdir WL

$ cd WL/
$ unzip /mnt/hgfs/Software/Worklight/IM_Rep_Worklight_Server_wee_5.0.0.zip 

Record a response file

$ /opt/IBM/InstallationManager/eclipse/IBMIM -record install_WLEE.rsp -skipInstall skippy

which generates the following response file: -

install_WLEE.rsp

<?xml version="1.0" encoding="UTF-8"?>
<!--The "acceptLicense" attribute has been deprecated. Use "-acceptLicense" command line option to accept license agreements.-->
<agent-input acceptLicense='true'>
<server>
<repository location='/tmp/WL/imf-offering/wee'/>
</server>
<profile id='Worklight' installLocation='/opt/IBM/Worklight'>
<data key='eclipseLocation' value='/opt/IBM/Worklight'/>
<data key='user.import.profile' value='false'/>
<data key='cic.selector.os' value='linux'/>
<data key='cic.selector.ws' value='gtk'/>
<data key='cic.selector.arch' value='x86_64'/>
<data key='user.writable.data.group' value='wasadmins'/>
<data key='user.database.preinstalled' value='false'/>
<data key='user.database.selection' value='derby'/>
<data key='user.appserver.was85liberty.preinstalled' value='false'/>
<data key='user.appserver.selection' value='was85liberty'/>
<data key='cic.selector.nl' value='en'/>
</profile>
<install modify='false'>
<offering id='com.ibm.imp.wee' version='5.0.0.20120608_0925' profile='Worklight' features='main.feature' installFixes='none'/>
</install>
<preference name='com.ibm.cic.common.core.preferences.eclipseCache' value='/opt/IBM/IMShared'/>
<preference name='com.ibm.cic.common.core.preferences.connectTimeout' value='30'/>
<preference name='com.ibm.cic.common.core.preferences.readTimeout' value='45'/>
<preference name='com.ibm.cic.common.core.preferences.downloadAutoRetryCount' value='0'/>
<preference name='offering.service.repositories.areUsed' value='true'/>
<preference name='com.ibm.cic.common.core.preferences.ssl.nonsecureMode' value='false'/>
<preference name='com.ibm.cic.common.core.preferences.http.disablePreemptiveAuthentication' value='false'/>
<preference name='http.ntlm.auth.kind' value='NTLM'/>
<preference name='http.ntlm.auth.enableIntegrated.win32' value='true'/>
<preference name='com.ibm.cic.common.core.preferences.preserveDownloadedArtifacts' value='true'/>
<preference name='com.ibm.cic.common.core.preferences.keepFetchedFiles' value='false'/>
<preference name='PassportAdvantageIsEnabled' value='false'/>
<preference name='com.ibm.cic.common.core.preferences.searchForUpdates' value='false'/>
<preference name='com.ibm.cic.agent.ui.displayInternalVersion' value='false'/>
<preference name='com.ibm.cic.common.sharedUI.showErrorLog' value='true'/>
<preference name='com.ibm.cic.common.sharedUI.showWarningLog' value='true'/>
<preference name='com.ibm.cic.common.sharedUI.showNoteLog' value='true'/>
</agent-input>

Note the three highlighted lines; the first indicates the location of the Worklight repository, post the unpacking process ( /tmp/WL/imf-offering/wee/ ), the other two lines indicate the location into which Worklight is going to be installed.

In addition, note that, for my own purposes, I'm using Apache Derby ( this colour ) and WebSphere Application Server 8.5 Liberty Profile ( this colour ).

Of course, you can record your own response file, and choose to use an existing DB2 UDB 9.7, MySQL 5.1 or Oracle 11g installation, and also choose an existing ( installed ) version of WAS 7 or, perhaps, Tomcat 7 JEE server.

Perform the installation

$ /opt/IBM/InstallationManager/eclipse/IBMIM -input install_WLEE.rsp -acceptLicense -noSplash -silent

This took a few minutes, at the end of which Worklight is installed in /opt/IBM/Worklight.

To prove it, I started the server: -

$ /opt/IBM/Worklight/server/wlp/bin/server.bin start worklightServer

and then access the Worklight console: -

http://scooby.uk.ibm.com:9080/worklight/console/#catalog

That's it for now.

For further information, here's the official IBM Worklight documentation: -

Getting started with IBM Worklight

IBM Worklight V5.0 - Administration Guide [PDF]

IBM Worklight V5.0 - Application Center User's Guide [PDF]

Enjoy !