Working with BEA WebLogic

This chapter provides an overview of BEA WebLogic and discusses how to:

Click to jump to top of pageClick to jump to parent topicUnderstanding BEA WebLogic

This section discusses the PeopleSoft domain and the WebLogic session cookie name format

Click to jump to top of pageClick to jump to parent topicThe PeopleSoft Domain

PeopleSoft Internet Architecture installation on BEA WebLogic Server 8.1 provides three primary server configuration options. Those options and their intended purpose are:

See Also

BEA WebLogic 8.1 Managed Server Architecture

Click to jump to top of pageClick to jump to parent topicWebLogic Session Cookie Name Format

When a user signs in to a PeopleSoft Pure Internet Architecture application, the portal servlet generates a cookie containing the user’s HTTP session ID, and sends it to the user’s browser to maintain the state of the session. The name of the cookie is fixed for all users accessing that portal.

On a WebLogic portal, the session cookie’s name is generated at install time based on the portal hostname and port number, which uniquely identify the portal within your PeopleSoft system. This name is stored in the portal’s weblogic.xml file.

However, the cookie name must not start with a number, and it must not contain any periods. If your users are experiencing problems signing in to PeopleSoft applications at different URLs from the same browser session, make sure that the session cookie names at those sites are valid.

To ensure valid WebLogic session cookie names:

  1. Shut down your WebLogic server.

  2. Open the weblogic.xml file for your web server in a text editor.

    You can find it in PS_HOME\webserv\domain_name\applications\peoplesoft\PORTAL\WEB-INF.

  3. Check the value of the session parameter called CookieName.

    Ensure that the content of the param-value element doesn’t start with a number or contain any periods. For example, the following session cookie name is invalid: 

    <session-param>
  <param-name>CookieName</param-name>
  <param-value>57.28.208.21-80-WebLogicSession</param-value>
</session-param>

    You can replace the periods with dashes (-). Following is a valid version of the session cookie name:

    <session-param>
  <param-name>CookieName</param-name>
  <param-value>c57-28-208-21-80-WebLogicSession</param-value>
</session-param>

  4. Save and close the file.

  5. Restart your WebLogic server.

Click to jump to top of pageClick to jump to parent topicAccessing the BEA WebLogic Server Console

The BEA WebLogic Server console is the main utility that is used to administer and monitor the BEA WebLogic Server processes. Access the console by pointing your browser to http://weblogic_servername/console. Before the console opens, you will be prompted for the weblogic system ID and password that you specified during the PIA install. The default ID is system and the default password is password. After you are authenticated, the console appears. The BEA WebLogic server console provides an interface to monitor and tune aspects of a PeopleSoft application from a web server perspective.

Click to jump to top of pageClick to jump to parent topicStarting BEA WebLogic

This section discusses how to:

See Also

Administering a WebLogic Server Life Cycle

Click to jump to top of pageClick to jump to parent topicStarting BEA WebLogic on Microsoft Windows

To run BEA WebLogic Server on Microsoft Windows, you can use a Windows service or a foreground process.

Using the Command Prompt

Running BEA WebLogic as a foreground process is beneficial if you need to monitor WebLogic in real time. To run WebLogic as a foreground process, enter the following at the command prompt in the weblogic domain directory that the PIA install created for you (PS_HOME\webserv\peoplesoft\):

Using the Windows Service

Two benefits of running BEA WebLogic as a Windows service are:

To install the service, enter the appropriate command from your weblogic domain directory at a command prompt as follows:

To start BEA WebLogic as a Windows service, use either of these methods:

Note. If WebLogic fails to start as a service, try starting it as a foreground process. To uninstall the service, enter the following command: 

UninstallNTservicePIA.cmd

Click to jump to top of pageClick to jump to parent topicStarting BEA WebLogic on UNIX

To start PeopleSoft on UNIX execute the following script in the weblogic domain directory that the PIA install created for you (for example, PS_HOME/webserv/peoplesoft/):

To start the BEA WebLogic server, use the $WL_HOME/startWebLogic.sh script that is provided. This script sets some required environment variables and then starts a Java runtime environment to run BEA WebLogic within it. As delivered, this script starts the Java runtime environment, and, in effect, starts BEA WebLogic as a foreground process.

Click to jump to top of pageClick to jump to parent topicStopping BEA WebLogic

For both Windows and UNIX, you can stop the PeopleSoft server from the BEA WebLogic Server console (http://localhost/console). To stop the PeopleSoft server:

  1. Expand the peoplesoft domain.

  2. Select Servers.

  3. Right-click the name of the server to shut down.

  4. Select Stop this server.

You can also stop the server through the command line by running:

If WebLogic is running as a Windows service you can also stop it via the service in Windows Control Panel.

See Also

Administering a WebLogic Server Life Cycle

Click to jump to top of pageClick to jump to parent topicUsing WebLogic Server 8.1 Console to Monitor PeopleSoft Sessions

The WebLogic Server 8.1 console can display a list of established HTTP sessions for that instance of WebLogic Server. The steps below detail how to enable this level of monitoring for a WebLogic instance.

Note. The following describes how to enable session monitoring for the single server configuration of PIA. When in production, a multi server configuration would be used to perform these steps to the server instance that you intend to monitor, such as PIA1 or PIA2, or both.

  1. Start the PIA server.

    Start the PIA server either via startPIA.cmd(.sh) or if installed as a Windows service, " NET START peoplesoft-PIA".

  2. Log on to PeopleSoft

    Log on to your PeopleSoft application. If possible, log on from a couple different workstations using different PeopleSoft IDs. For the purpose of this test, do not log off.

  3. Log on to the WebLogic Server Administrative Console.

    In a new browser, access the WebLogic Server console at http://localhost/console and specify the WebLogic administrative ID you specified during the PIA installation. The default ID and password are system/password, respectively.

  4. Monitor established HTTP sessions for the PORTAL web application.

    In the graphical domain hierarchy on the left, use the following navigation to view the list of established HTTP sessions for the PORTAL web application:

    1. Expand 'peoplesoft'.

    2. Expand 'Deployments'.

    3. Expand ' Applications'.

    4. Expand 'peoplesoft'.

    5. Select 'PORTAL'.

    6. Click the 'Monitoring' tab.

    7. Click the 'Sessions' tab.

      If 'Session Monitoring Enabled' is not selected, then Session monitoring has been disabled on this WebLogic instance. To re-enable session monitoring simply re-check that box, click 'Apply' and restart WebLogic Server.

      With HTTP session monitoring enabled, the information displayed will be client's PeopleSoft ID, IP address and PeopleSoft site they are logged onto.

Note. An established HTTP session remains on the web server until the client logs off of PeopleSoft or until their HTTP session times out. Simply closing the browser doesn't log a PeopleSoft user off. As a result, when user closes the browser without logging out of the PeopleSoft session, the corresponding HTTP session remains on the webserver until it times out. HTTP session timeouts are controlled via thet site's Web Profile in the PeopleSoft database.

See Also

Tuning Performance and Monitoring Resources

Click to jump to top of pageClick to jump to parent topicSetting Up an RPS

PeopleSoft applications support the use of reverse proxy servers (RPS) with BEA WebLogic. An RPS supplies the URL to which the browsers connect, but a backend web server handles the transaction processing.

This section discusses how to:

Click to jump to top of pageClick to jump to parent topicConfiguring Microsoft IIS as an RPS

This section describes how to proxy content to a single server configuration of PIA. When in production, a multi server configuration would be used to perform these steps to proxy content to your managed server instance of PIA or PIA1, etc.

Microsoft Internet Information Server (IIS) can be configured as a reverse proxy server (RPS) to one or more WebLogic Server 8.1 instances. Multiple instances can be independent instances or grouped into a cluster. When you use a reverse proxy, any URL that would be used to access your PeopleSoft application (even URLs that are stored in the database) would point to the reverse proxy, and not to the WebLogic Server.

These instructions are based on a logical separation of BEA WebLogic Server and Microsoft IIS, where both web servers are installed on the same machine. If your configuration has BEA WebLogic Server and Microsoft IIS on separate machines, you must perform three additional steps. Those steps are:

To set up a Microsoft IIS RPS:

  1. Install the PeopleSoft Internet Architecture.

    Run the multiplatform PeopleSoft Internet Architecture install from %PS_HOME%\setup\mpinternet\setup.exe.

  2. Access the Microsoft IIS configuration.

    On a Microsoft Windows server, select Start, Programs, Administrative Tools, Internet Services Manager.

    Note. Windows workstation and Windows 2000 Professional are not supported.

  3. Open the Default Web Site properties

    Expand your list of available servers, right click the Default Web Site and select Properties.

  4. Add an ISAPI filter.

  5. Define a new application extension mapping.

  6. Create the IIS-Plugin configuration file.

    Create c:\bea\weblogic81\server\\bin\iisproxy.ini, containing the following lines and setting the values appropriately.

    #
#For a list of available parameters see
#http://edocs.bea.com/wls/docs81/plugins/index.html
#
WebLogicHost=<hostname or IP of weblogic server to forward requests to>
WebLogicPort=<HTTP port of weblogic server to forward requests to>
DebugConfigInfo=OFF
Debug=OFF
#
#To proxy all IIS directed requests to WebLogic set "WlForwardPath=/"
#To selectively proxy only PeopleSoft requests to WebLogic set "WlForwardPath="to 
#the list of PeopleSoft sites to proxy. 
#e.g. To proxy requests for only 'ps' and 'crm' set WlForwardPath to the following;
#WlForwardPath=*/ps/*,*/crm/*
WlForwardPath=/
#
#If you have specified an AuthTokenDomain during your PIA installation, 
#you must set the cookieName for your reverse proxy.
#CookieName=<CookieName as specified on weblogic in PORTAL webapps's weblogic.xml>

  7. Restart Microsoft IIS.

    Restart the two Windows services, IIS Admin Service and World Wide Web Publishing Service by using the Services utility in the Control Panel or by issuing the following three commands at a command prompt: 

    NET STOP IISADMIN /Y
NET START IISADMIN
NET START W3SVC

  8. Start the BEA WebLogic server.

    Start the PeopleSoft Internet Architecture server either by invoking startPIA.cmd (.sh) or if installed as a Windows service, “NET START peoplesoft–PIA”.

    See Starting BEA WebLogic.

    See Stopping BEA WebLogic.

  9. Test your configuration by accessing the Microsoft IIS server by using the URL for your site.

    For example, http://IIS_server:port/ps/signon.html.

    Note. To connect to Microsoft IIS by using HTTPS, you must install digital certificates on the Microsoft IIS server.

See Also

“BEA documentation for IIS-plugin, ” http://e-docs.bea.com/wls/docs81/plugins/isapi.html

“BEA documentation for IISPROXY.INI parameters, ” http://e-docs.bea.com/wls/docs81/plugins/plugin_params.html

Click to jump to top of pageClick to jump to parent topicConfiguring BEA WebLogic as an RPS

This section discusses how to configure a BEA WebLogic server as a reverse proxy server (RPS).

Creating the RPS

To create an RPS, select Multi Server Domain as the configuration to install during PIA setup. As a result, a server named “RPS” is automatically defined in addition to the main PIA server, and is configured to be a reverse proxy server to other managed servers. By default, the following settings are applied to the RPS:

Setting

Value

Name

RPS

HTTP Listen Port

8080

HTTPS Listen Port

8443

Default web application

HttpProxyServlet

Address of back-end WebLogic content server

The hostname of the machine from which the PIA setup was run, with the HTTP listen port specified during the PIA setup.

The default address specified for the back-end WebLogic content server assumes that it's the same machine as the one on which you're configuring the RPS, using the HttpProxyServlet application. There's no need to change this setting unless the content server is a different machine, or you enable load balancing with multiple content servers. If it's a different machine, you must change this setting to specify the correct content server. If you enable load balancing, you'll need to specify additional content servers.

Enabling Load Balancing

In addition to the HttpProxyServlet application, the PIA setup also defines an HttpClusterServlet application in your WebLogic configuration, which by default isn't active. The primary difference between the two applications is that for a given HTTP request, HttpProxyServlet can proxy content only from a single back-end content server, whereas HttpClusterServlet can proxy content from multiple back-end content servers, all of which serve the same content. This enables the RPS to load-balance the requests across a cluster of WebLogic servers.

You can configure the RPS for load balancing by changing the default web application from HttpProxyServlet to HttpClusterServlet, which becomes active as a result.

To change the default web application:

  1. Start the WebLogic server.

  2. Sign in to the WebLogic administration console.

  3. Navigate to Deployments, Web Application Modules, HttpProxyServlet.

  4. Select the Targets tab.

  5. Clear the RPS Server check box, then click Apply.

  6. Navigate to Deployments, Web Application Modules, HttpClusterServlet.

  7. Select the Targets tab.

  8. Select the RPS Server check box, then click Apply.

  9. Sign out of the WebLogic administration console.

Specifying Back-End WebLogic Content Servers

You need to specify back-end WebLogic content servers only for the currently designated default web application (HttpProxyServlet or HttpClusterServlet).

You can edit the appropriate web.xml configuration file directly, or you can use the WebLogic Builder software provided with BEA WebLogic. Refer to your BEA WebLogic documentation for details about WebLogic Builder. To edit the configuration file directly:

Starting the RPS

To start the RPS, open a command prompt, change to PS_HOME\webserv\weblogic_domain, and launch the following commands:

  1. startWebLogicAdmin

  2. startManagedWebLogic RPS

Note. You can also run the RPS as a service on Windows.

See Also

Starting BEA WebLogic

Stopping BEA WebLogic

“BEA documentation for WebLogic Proxy, ” http://e-docs.bea.com/wls/docs81/plugins/http_proxy.html

“BEA documentation for proxy parameters, ” http://e-docs.bea.com/wls/docs81/plugins/plugin_params.html

Click to jump to top of pageClick to jump to parent topicConfiguring Sun iPlanet as an RPS

This section describes how to proxy content to a single server configuration of PIA. When in production, a multi server configuration would be used to perform these steps to proxy content to your managed server instance of PIA or PIA1.

Sun's iPlanet web server can be installed and configured as a reverse proxy to WebLogic Server. BEA has certified different version of iPlanet web server version on different OS platforms. PeopleSoft extends that certification list to its customer.

See http://e-docs.bea.com/platform/suppconfigs/index.html

See http://e-docs.bea.com/wls/docs81/plugins/nsapi.html

To configure iPlanet as an RPS:

  1. Download iPlanet Web Server, Enterprise Edition.

    Download and install a BEA certified platform/version of iPlanet Web Server from Sun.

    See http://www.sun.com/software/products/web_srvr/home_web_srvr.html

  2. Install WebLogic iPlanet plug-in.

    Note. If you are going to run iPlanet on the same machine as WebLogic, it is recommended to skip this copy step.

    WebLogic_home refers to the root directory of your WebLogic installation.

    iPlanet_dir refers to the location where iPlanet is installed. For iPlanet 4.x on Windows, the default is c:\netscape\server4\. For iPlanet 6.x on Windows, the default is C:\iPlanet\servers\

    iPlanet_platform refers to the OS platform on which BEA has certified iPlanet.

    shared_library refers to the iPlanet plugin library that BEA provides with WebLogic.

  3. Define the NSAPI Module

    Be sure to backup your obj.conf before you begin this step. This step covers modifying the iPlanet configuration file, obj.cont, (magnus.conf for iPlanet (6.x) so as to reference the BEA provided NSAPI module.

    Following are examples using configuration files on a Windows machine named crm.peoplesoft.com.

  4. Define which requests to be handled by the plug-in.

    The type of requests to be handled by the iPlanet plug-in, and subsequently handed off to BEA WebLogic, must be declared as part of an object definition in the obj.conf file. A specific string in the URL, referred to as a ppath, can identify these requests.

    To proxy all requests of a single PeopleSoft Internet Architecture site, such as ps (which would be accessed as http://crm.peoplesoft.com/ps/signon.html), define the following object tag in the obj.conf file. Define this and any other object tags directly following the default object tag. 

    <Object name="ps" ppath="*/ps/*">
Service fn=wl-proxy WebLogicHost=server1\
 WebLogicPort=7001
</Object>

    The default object tag is generally several lines long and can be identified by <Object name=default>...</Object>.

    To proxy additional sites, add subsequent object tags referencing the other site names:

    <Object name="hr" ppath="*/hr/*">
Service fn=wl_proxy WebLogicHost=server1\
 WebLogicPort=7001
</Object>

    To proxy all requests that are made to iPlanet, create a single object tag named “peoplesoft” and set the ppath parameter to *.

  5. Apply changes to iPlanet

    With these settings saved, access the iPlanet server manager, perhaps http://localhost:8888. Supply the ID and password that you specified during the iPlanet install. The default ID/password is admin/password. When prompted, click the Apply button to update iPlanet with your changes and restart it.

  6. Start WebLogic Server.

    Start the PIA server either via starPIA.cmd(.sh) or if installed as a Windows service, “NETSTART peoplesoft-PIA.

    See Starting BEA WebLogic.

    See Stopping BEA WebLogic.

  7. Confirm the configuration.

    To confirm an installation, with both the WebLogic Server and iPlanet servers started, simply access PeopleSoft using the typical URL, http://iPlanet/ps/signon.html. If you are able to logon to PeopleSoft, your installation and configuratiion was successful.

    See http://edocs.bea.com/wls/docs81/plugins/index.html

Applying Changes to iPlanet

After saving settings, access the iPlanet server manager (for example, http://localhost:8888).

Enter the ID and password that you specified during the iPlanet installation. The default ID and password are admin and password. When prompted, click Apply to update iPlanet with your changes and restart it.

Starting the Server and Confirming the Installation

 

Start the PIA server with either startPIA.cmd(.sh) or, if installed as a Microsoft Windows service,NET START peoplesoft-PIA. .

To confirm an installation, with both the BEA WebLogic server and iPlanet servers started, access the PeopleSoft system by using the typical URL, http://iPlanet/ps/signon.html. If you can sign in to the PeopleSoft system, your installation and configuration was successful.

Click to jump to top of pageClick to jump to parent topicUsing the iPlanet Plug-in

If you plan to proxy all requests for the PeopleSoft Internet Architecture through iPlanet, you must also update any URLs that are defined in the PeopleSoft database to reference the iPlanet server, not the BEA WebLogic server.

Those URLs are:

The iPlanet obj.conf file is strict about the placement of text. To avoid problems, follow these guidelines:

The BEA online documentation contains a complete listing of BEA WebLogic plug-in attributes and parameters.

See http://edocs.bea.com/wls/docs81/plugins/index.html

iPlanet Plug-in Considerations

If you intend to proxy all requests for PeopleSoft Internet Architecture through iPlanet, you must also update any URLs defined in your PeopleSoft database to reference the iPlanet server, not the WebLogic Server. Those URLs are:

The iPlanet obj.conf file is strict about the placement of text. To avoid problems, be certain that you adhere to the following guidelines:

Click to jump to top of pageClick to jump to parent topicConfiguring Apache HTTP as an RPS

This section describes how to proxy content to a single server configuration of PIA. When in production, a multi server configuration would be used to perform these steps to proxy content to your managed server instance of PIA or PIA1, etc.

Apache HTTP server can be installed and configured as a reverse proxy server to WebLogic Server. For a list of certified platforms,

See http://e-docs.bea.com/platform/suppconfigs/index.html

To configure Apache HTTP:

  1. Download the Apache HTTP server.

    See http://www.apache.org/dist/httpd/

  2. Install Apache.

    See http://httpd.apache.org/docs-project/

  3. Install the Apache HTTP server plug-in.

    The installation of the Apache plug-in from BEA depends on whether you are installing the plug-in as a dynamic shared object (DSO) or a statically linked module. If you have downloaded the binary distribution of Apache, you will probably install the Apache plug-in from BEA as a shared object. (If you are in doubt as to which type, install the plug-in as a DSO.) Exact instructions are available from BEA.

    See http://e-docs.bea.com/wls/docs81/plugins/apache.html

  4. Specify the parameters that will be used by the Apache plug-in by defining them in an IfModule tag for BEA WebLogic in the Apache httpd.conf file.

    Add this tag in the ### Section 2: 'Main' server configuration section of httpd.conf. For example, to configure the Apache to proxy all requests that it receives to a BEA WebLogic server that is running on a machine named crm.peoplesoft.com and listening on port 7001, you would define the following tag: 

    <IfModule mod_weblogic.c>
	  WebLogicHost crm.peoplesoft.com
	  WebLogicPort 7001
	  MatchExpression /</IfModule>

    BEA provides sample and template configuration files.

    See http://edocs.bea.com/wls/docs81/plugins/index.html

    To proxy requests to a cluster of BEA WebLogic servers, replace the two attributes, WebLogicHost and WebLogicPort, with WebLogicCluster.

    The syntax of the WebLogicCluster is wlserver1:port,wlserver2:port.

    Details about clustering setup are available in a red paper.

    See The red paper on the PeopleSoft Customer Connection website: Clustering and High Availability for PeopleSoft 8.4

    If you specified an AuthTokenDomain during the PeopleSoft Internet Architecture installation, you must set the cookieName for the reverse proxy to that same value. To do so, add the cookieName attribute and set its value to CookieName, as specified on the BEA WebLogic server in the PORTAL web application's weblogic.xml file (for example, c:\bea\wlserver6.1\config\peoplesoft\applications\PORTAL\web-inf\weblogic.xml).

  5. Start the Apache HTTP server following the Apache usage instructions.

  6. Start the BEA WebLogic server with either startPIA.cmd(.sh) or, if installed, as a Microsoft Windows service, NET START peoplesoft-PIA.

  7. To confirm an installation, with both the BEA WebLogic server and Apache servers started, access the PeopleSoft system by using the typical URL, http://Apache/ps/signon.html.

    If you can sign in to the PeopleSoft system, your installation and configuration was successful.

See Also

http://edocs.bea.com/wls/docs81/plugins/index.html

Click to jump to top of pageClick to jump to parent topicSetting Up HTTP Session Timeout

HTTP session timeout controls are accessible on the Security page of the web profiles in the PeopleSoft database. PeopleSoft Internet Architecture no longer uses session timeout control set on the web server. The session timeouts set in the Web Profiles override any HTTP session timeouts set on the webserver at runtime.

See Configuring Portal Security.

Click to jump to top of pageClick to jump to parent topicEnabling or Disabling HTTP Keep Alive

This section describes how to change HTTP Keep-Alive settings for a single server configuration of PIA. When in production, a mult server configuration would be used to perform these steps to your managed server instance of PIA, PIA1, etc.

Keep-Alive, or more accurately termed "Persistent Connections" is a default feature of HTTP 1.1 as described in http://www.w3.org/Protocols/rfc2616/rfc2616.html. Keep-Alive allows for the client (generally a web browser) and the web server to maintain open connections between requests for specified period of time. That time period is generally less then 60 seconds. The benefit of a persistent connection is that with each subsequent request the client and the server do not need to perform the overhead of opening a new connection. Enabling keep-Alive is generally recommended, but in some situations it may introduce a problem. Sporadic "The Page cannot be displayed" can be the result of a problem with keep-Alive. In situations where keep-Alive issues are suspected, disabling the web server keep-Alive will help to determine if the problem is indeed related to connection persistence.

To enable or disable Keep-Alive:

  1. Start the PIA server.

    Start the PIA server either via startPIA.cmd(.sh) or if installed as a Windows service, " NET START peoplesoft-PIA".

    See Starting BEA WebLogic.

    See Stopping BEA WebLogic.

  2. Log on to the WebLogic Server Administrative Console.

    In a new browser, access the WebLogic Server console at http://localhost/console and specify the WebLogic administrative ID that you specified during the PIA installation. The default ID and password are system and password, respectively.

  3. Open Server's HTTP configuration page.

    In the navigation window on the left,use the following navigation to open the PIA server's HTTP configuration settings. (If you are using a custom server name, substitute that name where appropriate.):

    1. Expand 'peoplesoft'.

    2. Expand 'Servers'.

    3. Select 'PIA'.

    4. Click the 'Protocols' tab.

  4. Change keep-alive settings.

  5. Restart WebLogic Server.

Click to jump to top of pageClick to jump to parent topicChanging a WebLogic User's Password

The WebLogic domain built by the PIA install includes 3 WebLogic user IDs. Those IDs are: system, operator and monitor. Each of those IDs have a default password of 'password'. It is highlyrecommended to change this password on any production or critical servers.

To change the password for the system:

  1. Start the PIA server.

    Start the PIA server either via PS_HOME\webserv\weblogic_domain\startPIA.cmd(.sh) or if installed as a Windows service, " NET START peoplesoft-PIA".

    See Starting BEA WebLogic.

    See Stopping BEA WebLogic.

  2. Log in to the WebLogic Server Administrative Console.

    Access the WebLogic Server console at http://webserver/console (for example, http://localhost/console). When prompted for a user name and password, specify the WebLogic system ID and password. If you've followed the default WebLogic Server install, the ID and password are 'system' and 'password'. Otherwise, specify the password supplied during your PIA installation.

  3. Change a WebLogic Server user's password.

    In the graphical domain hierarchy on the left, use the following navigation path to change a user's password.

    1. Expand 'peoplesoft'.

    2. Expand 'Security'.

    3. Expand 'Realms'

    4. Expand 'myrealm' or your custom realm if you have created one.

    5. Select 'Users'.

    6. Select the user whose password you would like to change, in this case that is 'system'.

    7. Click the Change button.

    8. Enter and re-enter a new password for this user.

    9. Click the Apply button.

Extra Step for Running WebLogic as a Windows Service

When you run WebLogic as a Windows service, WebLogic uses the default ID or 'operator' and its password of 'password'. Changing the password for the WebLogic ID that runs the Windows service requires an additional manual step. That step is to update setEnv.cmd (for example, PS_HOME\webserv\peoplesoft\setEnv.cmd ) and set the WLS_PW environment variable to 'operator's new password. Once that is done, reinstall the Windows service by re-running the installNTservice command file located in the same WebLogic domain directory as the setEnv.cmd that you edited.

Click to jump to top of pageClick to jump to parent topicImplementing WebLogic SSL Keys and Certificates

This section provides an overview of Secure Sockets Layer (SSL) encryption with WebLogic 8.1 and discusses how to:

Click to jump to top of pageClick to jump to parent topicUnderstanding SSL Encryption with WebLogic 8.1

To use SSL encryption with WebLogic 8.1 and the current PeopleTools release, the WebLogic keystore must contain the following appropriately configured encryption keys:

A public key is transferred and stored as a data element in a digital certificate or a certificate signing request (CSR). You can obtain public keys from a variety of sources, in several different formats.

You must ensure that the encryption keys are correctly formatted, install them in the keystore, then configure them using the WebLogic server administration console.

Note. If you've already installed and configured a set of encryption keys for use with WebLogic 5.1 or 6.1 in a previous PeopleTools release, they're maintained by those earlier versions of WebLogic as external files. You must migrate them to the WebLogic 8.1 keystore so that they work correctly with the current release.

Click to jump to top of pageClick to jump to parent topicObtaining Encryption Keys

If you already have a set of existing encryption keys configured as external files, you don't need to obtain new ones. To find the existing keys, refer to the documentation for the PeopleTools and WebLogic releases for which those keys were installed.

The following procedure describes how to obtain new encryption keys, using as an example the 14-day free trial certificate available from Verisign.

To obtain new encryption keys:

  1. At a command prompt, change to the following directory:

    PS_HOME\webserv\domain_name

    Where domain_name is the name of the installed PeopleSoft Pure Internet Architecture domain for which you want to obtain encryption keys.

  2. Enter the following command:

    pskeymanager -create

    Note. Pskeymanager is a script wrapper to Java's keytool, provided by PeopleSoft to manage the WebLogic keystore. For usage information, enter pskeymanager -help.

  3. Follow the prompts and enter the requested information to create a new private key and a CSR for your web server.

    Pskeymanager creates the private key inside the keystore, and creates the CSR as a file called ServerABC_certreq.txt in the current directory. You use the CSR to obtain your signed public key certificate and a root certificate from a CA.

  4. Decide which trusted CA you want to sign your web server's public key.

    You can use any CA that's compatible with Sun's Java 1.4 JKS standard, such as Verisign.

  5. Open your CSR file in a text editor and copy its entire contents, including the first and last lines:

    -----BEGIN NEW CERTIFICATE REQUEST-----
...
...
-----END NEW CERTIFICATE REQUEST-----

  6. Access Verisign's test certificate enrollment site at https://www.verisign.com/products/srv/trial/intro.html.

    Verisign guides you through the CSR submission process, including:

    Verisign also provides its own digitally signed public key in a certificate, which is known as a trusted CA certificate, a root certificate, or a chain certificate.

  7. Download the VeriSign test CA root certificate from http://digitalid.verisign.com/cgi-bin/getcacert.

    When prompted, save getcacert.cer to PS_HOME\webserv\domain_name.

    Note. If you need to FTP your certificate to UNIX, you must FTP it in ASCII mode to PS_HOME/webserv/domain_name.

  8. Check your email.

    Verisign digitally signs your web server's public key, then returns it to you in a certificate, called the server certificate. Following is an example of the contents of a server certificate: 

    -----BEGIN CERTIFICATE-----
DMICHDCCAcYCEAHSeRkM2guFL+6OvHr4AS0wDQYJKoZIhvcNAQEEBQAwgakxFjAP
AANVBAoTDVZlcmlTaWduLCBLbAMxRzBFBgNVBAsTPnd3dy52ZXJpc2lnbi5jb20S
VcVwb3NpdG9yeS9UZXN0Q1ETIEluY29ycC4gQnkgUmVmLiBMaWFiLiBMVEQuMUYF
LIGEc3VyYW5jZXMgKEMpVRMxOSDFertdsfh67TIwNDAwMDAwMFoXDTAwMTIxODIA
ONT1LVoweTELMAkGA1UERhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExEzARBgNK
VBAUCOBsZWFzYW50b24BEzARBgNVBAoUClBlb3BsZVNvZnQxFDASBgNVBAsUC1BT
Eb3sZVVvb2xzMRUwEwADVQQDFAxEQlJPV04xMTE0MDAwXDANBgkqhkiG9w0BAQET
SAALADBEAkEAucfM/GOQhdkk4Q0ZD5i1l4gp6WTYMc4IaReoCYkEAmDKAVcYzY3R
Mdbp4RC8SABd3bjjDOHcoCak9U6oSwL+HQIDAQABMA0GCSqGSIb3DQEBBAUAA0EO
Arm3uf634Md0fqgNxhAL+e9rbY0ia/X48Axloi17+kLtVI1YPOp+Jy6Slp5iNIFC
DhskdDFH45AjSDAFhjruGHJK56SDFGqwq23SFRfgtjkjyu673424yGWE5Gw4576K
DosdDFG256EDHY45yTRH67i345314GQE356mjsdhhjuwbtrh43Gq3QEVe45341tS
YDY6d47lDmQxDs9wGt1bkQ==
-----END CERTIFICATE-----

  9. Copy the entire certificate contents, and save it as a text file called ServerABC-cert.pem in PS_HOME\webserv\domain_name.

    Be sure to include the first and last lines.

    Note. If you need to FTP your certificate to UNIX, you must FTP it in ASCII mode.

Note. It's a good idea to make backup copies of the server certificate and the root certificate before proceeding.

Click to jump to top of pageClick to jump to parent topicPreparing Keys and Certificates for the Keystore

Your encryption keys must be in privacy enhanced mail (PEM) format, which is Base64-encoded data. Base64 encoding uses only ASCII characters. A PEM-formatted key or certificate file has an extension of either .pem or .cer. If the file is in the binary distinguished encoding rules (DER) format, it has a .der extension. Use the der2pem Java utility to convert DER-formatted keys and certificates to PEM format.

For SSL to work, your WebLogic 8.1 server must present its own public key to each client browser, along with the self-signed public key of a root CA that's also in the browser's keystore, as well as any keys necessary to establish a chain of trust between the two. All of these keys must be part of the same certificate file before you can import them into the WebLogic 8.1 keystore.

If you generated the private key using pskeymanager on a WebLogic 8.1 platform, it's automatically correctly formatted, password protected, and installed in the keystore with no additional steps required. However, if the private key was configured as an external file on an earlier WebLogic platform, you must properly format it and incorporate a password, before importing it into the WebLogic 8.1 keystore along with the public key certificates.

Converting DER Files to PEM Format

It's important to convert all DER-formatted key and certificate files to PEM format before you work with them further.

To convert DER-formatted key and certificate files to PEM format:

  1. At a command prompt, change to the following directory:

    PS_HOME\webserv\domain_name

    Where domain_name is the name of an installed PeopleSoft Pure Internet Architecture domain.

  2. Enter the following command: 

    setenv.cmd

    This sets the appropriate environment for java commands.

  3. For each DER-formatted key or certificate file, enter the following command:

    java utils.der2pem filename.der

    Make sure that you include the DER file's directory path. A new PEM file by the same name is created in the same location.

If you converted a private key file to PEM format, you must modify the header and footer to be compatible with WebLogic 8.1.

To modify the private key file header and footer:

  1. Open the PEM-formatted private key file in a text editor.

  2. Change the following line:

    -----BEGIN CERTIFICATE-----

    To this:

    -----BEGIN RSA PRIVATE KEY-----

  3. Change the following line:

    -----END CERTIFICATE-----

    To this:

    -----END RSA PRIVATE KEY-----

  4. Save and close the private key file.

Establishing the Server Certificate Chain of Trust

Your server certificate must contain, in addition to the web server's public key, any keys necessary to establish a chain of trust that culminates in the self-signed root certificate of a trusted root CA. That CA's root certificate must be in the keystore of any browser that's used to access your web server. Most browsers have an extensive set of trusted root certificates in their keystores.

First append the root certificate of the CA who issued your server certificate to the server certificate file. If you determine that that root certificate is not likely to be in your users' browsers, you must also append to the certificate file a chain certificate that was issued to your CA by another CA, then a chain certificate issued to that CA, and so on,

For example, if your server certificate file is demo_cert.pem and the CA's root certificate is ca_cert.pem, you can open demo_cert.pem in a text editor, then insert the contents of ca_cert.pem after a newline at the end of the file. Make sure that each certificate follows the previous one on the next line, as follows: 

...
...
DosdDFG256EDHY45yTRH67i345314GQE356mjsdhhjuwbtrh43Gq3QEVe45341tS
YDY6d47lDmQxDs9wGt1bkQ==
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
DMICHDCCAcYCEAHSeRkM2guFL+6OvHr4AS0wDQYJKoZIhvcNAQEEBQAwgakxFjAP
...
...

The result is that demo_cert.pem, for example, now contains the data from both certificates.

If you determine that ca_cert.pem won't be recognized as a trusted root by all of your users' browsers, you must obtain the root certificate of the CA who issued ca_cert.pem and append that to demo_cert.pem as well, and so on, until you append a root certificate that was issued by a trusted CA to itself.

Note. You can also use the type command in Windows or the cat command in UNIX to combine the certificate files.

Password Protecting the Private Key

Private keys inside the WebLogic 8.1 keystore are password protected. You can't import an external private key file into the keystore without a password. If it isn't currently password protected, use the WebLogic wlkeytool utility to incorporate a password into the private key file.

To password-protect an external PEM-formatted private key file:

  1. At a command prompt, change to the following directory:

    WL81_HOME\server\bin

    Where WL81_HOME is the root directory of your installed WebLogic 8.1 server, for example, C:\bea\weblogic81.

  2. Enter the following command:

    wlkeytool insecure_privatekey.pem secure_privatekey.pem

    Where insecure_privatekey.pem is the name of the original private key file, and secure_privatekey.pem is the name of the resulting password-protected private key file.

    Note. Make sure that you include directory paths for the private key files.

    The following message appears:

    Enter password to unprotect private key:

  3. Press Enter.

    The following message appears:

    Private key not PKCS8 encoded, trying RSA key
Private key file opened successfully
Enter password to protect private key :

  4. Enter the password that you want to use for this key.

    The following message appears:

    Verify password to protect private key :

  5. Enter the password again to confirm it.

    The utility creates the password protected private key file that you specified. You can now import the key into the WebLogic 8.1 keystore.

Click to jump to top of pageClick to jump to parent topicImporting Keys and Certificates Into the Keystore

Each WebLogic domain maintains its own keystore in PS_HOME\webserv\domain_name\keystore\pskey, and all servers within a domain can share the same keystore.

Two tools are available for importing keys and certificates into the keystore:

Using Pskeymanager to Import the Server Certificate

To import the server certificate into the WebLogic 8.1 keystore:

  1. At a command prompt, change to the following directory:

    PS_HOME\webserv\domain_name

    Where domain_name is the name of the installed PeopleSoft Pure Internet Architecture domain.

  2. Enter the following command:

    pskeymanager -import

    Note. Pskeymanager is a script wrapper to Java's keytool, provided by PeopleSoft to manage the WebLogic keystore. For usage information, enter pskeymanager -help.

  3. Follow the prompts and enter the requested information to create a new private key and a CSR for your web server. Keep the following in mind:

    Pskeymanager imports the server certificate into the keystore.

Using ImportPrivateKey to Import an External Private Key File with the Server Certificate

To import a password-protected private key and the server certificate into the WebLogic 8.1 keystore:

  1. At a command prompt, change to the following directory:

    PS_HOME\webserv\domain_name

    Where domain_name is the name of an installed PeopleSoft Pure Internet Architecture domain.

  2. Enter the following command: 

    setenv.cmd

    This sets the appropriate environment for java commands.

  3. Enter the following command:

    java utils.ImportPrivateKey keystore\pskey store_pass privatekey_alias privatekey_pass servercert_file privatekey_file

    The parameters for this command are as follows:

    store_pass

    Specify the password for the WebLogic pskey keystore. The default password is password.

    privatekey_alias

    Specify an alias for the private key. This is the name by which the key will be accessible inside the keystore.

    privatekey_pass

    Specify the password for the private key.

    servercert_file

    Specify the path and name of the server certificate file that includes the issuing CA's root certificate.

    privatekey_file

    Specify the path and name of the private key file.

    The encryption keys are installed in the WebLogic 8.1 keystore, and you can now configure them using the WebLogic server administration console.

Click to jump to top of pageClick to jump to parent topicConfiguring WebLogic SSL Encryption Keys

This section describes how to configure the SSL encryption keys that you previously imported into the WebLogic 8.1 keystore in PS_HOME\webserv\domain_name\keystore\pskey, where domain_name is the name of an installed PeopleSoft Pure Internet Architecture domain.

The following procedure applies to a single server configuration of PIA. In a production environment, you would perform these steps for managed server instances of PIA, PIA1, PSOL, RPS, and so on, in a multi-server domain configuration.

To configure WebLogic SSL encryption keys for the PIA server:

  1. With the PIA server running, sign in to the WebLogic Server Administration Console.

    Access the WebLogic Server console at http://webservername/console (for example, http://localhost/console). When prompted for a user name and password, enter the WebLogic system ID and password, which you defined during the PIA install. The default user name and password are system and password, respectively.

  2. Access the keystore configuration pages.

    1. In the lefthand navigation tree, navigate to peoplesoft, Servers, PIA.

    2. Select Keystores & SSL.

    3. In the Keystore Configuration section, click Change.

    4. Select Custom Identity and Custom Trust, and click Continue.

    The Configure Keystore Properties page appears, with the configuration fields for the pskey keystore.

  3. Update the fields on the Configure Keystore Properties page as follows:

    Field

    Value

    Comment

    Custom Identity Key Store File Name

    keystore/pskey

    This should be the relative path and name of the keystore into which you imported your SSL keys.

    Custom Identity Key Store Type

    JKS

    Don't change this value.

    Custom Identity Key Store Pass Phrase

    password

    See the following note regarding passwords.

    Confirm Custom Identity Key Store Pass Phrase

    Same as the value of Custom Identity Key Store Pass Phrase.

    		  

    Custom Trust Key Store File Name

    keystore/pskey

    This should be the relative path and name of the keystore into which you imported your SSL keys.

    Custom Trust Key Store Type

    JKS

    Don't change this value.

    Custom Trust Key Store Pass Phrase

    password

    See the following note regarding passwords.

    Confirm Custom Trust Key Store Pass Phrase

    Same as the value of Custom Trust Key Store Pass Phrase.

    		  

    Note. The default keystore and private key password is password. This should never be used in a production environment. You can change a private key's password and a keystore's password using pskeymanager's change password options: -changeprivatekeypassword and -changekeystorepassword, respectively.

  4. Click Continue to access the Review SSL Private Key Settings page.

  5. Update the fields on the Review SSL Private Key Settings page as follows:

    Field

    Value

    Comment

    Private Key Alias

    Specify a unique identifier, such as the webserver's machine name.

    This is the alias that you specified for this server's private key.

    Passphrase

    password

    See the following note regarding passwords.

    Confirm Passphrase

    Same as the value of Passphrase.

    		  

    Note. The default keystore and private key password is 'password'. This should never be used in a production environment. A private key's password and a keystore's password can be changed via pskeymanager's change password options of –changekeystoreword and –changeprivatekeypassword.

  6. Save your keystore changes.

    You must click the 'Finish' button to save your changes. If you close your browser without clicking 'Finish', your changes will be lost.

  7. Restart the WebLogic PIA server.

Click to jump to top of pageClick to jump to parent topicRestricting Access to a Servlet

This section describes how to restrict access to a web resource for a single server configuration of PIA. When in production, a multi server configuration would be used to perform these steps to your managed server instance of PIA or PIA1, etc.

BEA WebLogic Server provides an optional level of security to restrict access to resources on the web server. The steps below describe how to restrict access via a WebLogic ID and password to the PeopleSoft Portal servlet:

To restrict access to a servlet:

  1. Start the PIA server either through startPIA.cmd(.sh) or, if installed, as a Microsoft Windows service, NET START peoplesoft-PIA.

  2. Log in to the BEA WebLogic Server console (http://localhost/console).

  3. (Optional) Define the BEA WebLogic users that you want to use.

    If you want to use one of the WebLogic provided user accounts, system, operator and monitor, you can skip this step. Otherwise create a new BEA WebLogic user account by performing the following from the navigation window on the left of the WebLogic console:

    1. Expand peoplesoft, Security, Realms, myrealm.

    2. Select Users.

    3. Select Configure a Nrew User.

    4. Enter the new user information and click Apply.

  4. (Optional) Create a user group.

    If you want to create a user group, add your users to that group and in the following steps select Caller is Member of group instead of User name of caller. To create a group, perform the following from the navigation window on the left of the WebLogic console.

    1. Expand peoplesoft, Security, Realms, myrealm.

    2. Select Groups.

    3. Select Configure a new Group.

    4. On the Create Group - General tab, enter a new group name.

      To add a new user to this group, select the Users folder from the navigation on the left, select your new user, then click the Groups tab and add the user to your newly created group.

    5. Click Apply.

  5. Link security roles to security policies.

    In the navigation window on the left, perform the following to enable security policy checks for web applications:

    1. Expand peoplesoft, Security, Realms.

    2. Select myrealm.

    3. On the myrealm - General tab, select All Web applications and EJBs from the Check Roles and Policies fordrop down list.

    4. Click Apply.

    This doesn't mean that all web applications require authorization. That's controlled with the following steps.

  6. Define a security policy for the PeopleSoft Portal web application.

    To restrict access to the Portal web application, perform the following in the navigation window on the left:

    1. Expand peoplesoft, Deployments, applications, peoplesoft.

    2. Right click the PORTAL web application and select Define Security Policy.

      Note. To apply a security policy to a different web application, substitute that web application name.

    3. Specify the URL which requires authentication.

      In this case simply specify /* and click Define Security Policy.

    4. To restrict access to a specific user, select the Policy condition of User name of caller, click Add, and when prompted specify the user name.

      Repeat this step for additional users, groups, or access times. For access times, the server's local time is used.

  7. Exit the console, shut down WebLogic to apply your changes, then restart WebLogic.

  8. Test the configuration.

    Test your new security policy by accessing the URL you defined in step 6. If the security policy is active, you'll be prompted to sign in using a user ID that you added in step 3.

See Also

http://edocs.bea.com/wls/docs81/secwlres/index.html

Click to jump to top of pageClick to jump to parent topicAdjusting the JVM Heap Size

The Java options including the JVM heap size, VM mode, such as HotSpot Server, used by the WebLogic server are stored in your WebLogic domain's setEnv script (for example, PS_HOME\webserv\peoplesoft\setEnv.cmd). These options are specified in the script using the JAVA_OPTIONS_OSplatform environment variable. If you need to adjust any of the java options, including changing the JVM heap size, you must manually edit the script.

The Microsoft Windows setEnv.cmd script contains the following default setting:

JAVA_OPTIONS_WIN32="-server -Xms32m -Xmx200m -XX:MaxPermSize=128m"

The UNIX standard setEnv.sh script contains the following default settings for supported Linux and UNIX platforms:

JAVA_OPTIONS_AIX="-Xms32m -Xmx200m"
JAVA_OPTIONS_HPUX="-server -Xms32m -Xmx200m -XX:MaxPermSize=128m"
JAVA_OPTIONS_LINUX="-Xms128m -Xmx256m"
JAVA_OPTIONS_TRU64="-Xms32m -Xmx200m"
JAVA_OPTIONS_SOLARIS="-server -Xms32m -Xmx200m -XX:MaxPermSize=128m"

You modify the –Xms parameter to adjust minimum heap size, and modify the –Xmx parameter to adjust maximum heap size.

In a multi-server domain, the platform-specific versions of the JAVA_OPTIONS environment variable that are shown in the setEnv script apply only to managed servers. The administration server doesn't use any of these variables, but it assumes default JVM heap size values of "-Xms32m -Xmx64m".

To adjust the JVM heap size for the administration server, add the environment variable JAVA_OPTIONS_ADMINSERVER following the last entry for JAVA_OPTIONS_OSplatform, and set it to your own minimum and maximum values, for example: 

JAVA_OPTIONS_ADMINSERVER="-Xms64m -Xmx128m"

Note. If you're running BEA WebLogic as a Microsoft Windows service and you modify setEnv.cmd, you must reinstall the service by running installNTservicePIA.cmd or InstallNTservice.cmd from the WebLogic domain directory again.

See Also

Managing JVM Heap Size and Execute Thread Usage

Click to jump to top of pageClick to jump to parent topicDetermining the Service Pack Level

A summary of installed products, their versions and service pack levels, is maintained in the BEA_HOME\registry.xml file. However, to confirm version information, it's more accurate to check the BEA WebLogic log. A failed service pack install may be indicated in the log, but not found at runtime.

This section discusses how to:

Checking the Log

In the BEA WebLogic log (PS_HOME\webserv\peoplesoft\logs\weblogic_server_weblogic.log), look for an entry similar to this: 

WebLogic Temporary Patch 1 CR110692 for PeopleSoft 10/17/2003 18:11:35
WebLogic Server 8.1 SP1  Fri Jun 20 23:06:40 PDT 2003 271009

Querying BEA WebLogic

You can query BEA WebLogic at the command line or by using the BEA WebLogic Server console.

Perform a query at the command line as shown in this example (for UNIX, use setEnv.sh):

PS_HOME\webserv\peoplesoft\setenv.cmd java weblogic.Admin VERSION -url t3://localhost:80

WebLogic Temporary Patch 1 CR110692 for PeopleSoft 10/17/2003 18:11:35
WebLogic Server 8.1 SP1  Fri Jun 20 23:06:40 PDT 2003 271009

Perform a query by using the BEA WebLogic Server console (http://localhost/console) by right-clicking Console. Select View Server & Browser info as shown in this example:

Click to jump to top of pageClick to jump to parent topicEnabling or Disabling HTTP Access Log

This section describes how to change HTTP logging for a single server configuration of PIA. When in production, a multi server configuration would be used to perform these steps to your managed server instance of PIA or PIA1, etc.

To enable or disable HTTP access log:

  1. Start the PIA server.

    Start the PIA server either via startPIA.cmd(.sh) or if installed as a Windows service, " NET START peoplesoft-PIA".

    See Starting BEA WebLogic.

    See Stopping BEA WebLogic.

  2. Log on to the WebLogic Server Administrative Console.

    In a new browser access the WebLogic Server console at http://localhost/console and specify the WebLogic administrative ID that you specified during the PIA installation. The default ID and password are 'system' and 'password', respectively.

  3. Open Server's Logging configuration page.

    In the navigation window on the left, navigate to the following to open the PIA server's HTTP configuration settings. (If you are using a custom server name, substitute that name where appropriate.)

    1. Expand 'peoplesoft'.

    2. Expand 'Servers'.

    3. Double click 'PIA' .

    4. Select 'Logging'.

    5. Select 'HTTP'.

    6. Select the 'Enable HTTP Logging' check box to turn on the access.log. Change the Logfile name if desired.

    7. Click the 'Apply' button on the bottom of the page.

  4. Restart the WebLogic Server.