Enabling SSL/TLS in Solution Manager Servers¶

Follow these steps to secure with SSL/TLS the incoming connections to the servers of a Solution Manager installation and https on the web container.

By doing this, the communications between the Solution Manager servers and their administration tools, and between the Solution Manager servers and its clients will be encrypted.

1. Stop all the components of the Solution Manager. The goal is to stop the web container. It is important to stop them all so the Denodo web container is stopped as well. If for example, you leave the Diagnostic & Monitoring Tool started, the web container will not shut down and the changes in the file tomcat.properties will not take effect.

2. Edit the file <SOLUTION_MANAGER_HOME>/conf/vdp/VDBConfiguration.properties. Uncomment the following properties and change their values:

3. Edit these files:

   1. <SOLUTION_MANAGER_HOME>/conf/solution-manager/SMConfigurationParameters.properties

   2. <SOLUTION_MANAGER_HOME>/conf/license-manager/LMConfigurationParameters.properties

   In these files, uncomment the following properties and change their values:

4. Edit the file <SOLUTION_MANAGER_HOME>/resources/apache-tomcat/conf/tomcat.properties. Uncomment the following properties and set their value:

5. Edit the file <SOLUTION_MANAGER_HOME>/resources/apache-tomcat/conf/server.xml

1. Uncomment the SSL connector. I.e. Search the “Connector” element that contains SSLEnabled="true" and remove the <-- and --> characters that surround it.

2. To disable the access through HTTP and only allow HTTPs connections, comment the “Connector” element that contains port=”${com.denodo.tomcat.http.port}” with <-- and -->. For example,

<!--
  <Connector URIEncoding="UTF-8"
   compressableMimeType="text/html,text/xml,application/json,application/xml,text/css,text/javascript,application/javascript"
   compression="on"
   compressionMinSize="1024"
   connectionTimeout="20000"
   maxThreads="150"
   minSpareThreads="25"
   noCompressionUserAgents="gozilla, traviata"
   port="${com.denodo.tomcat.http.port}"
   redirectPort="${com.denodo.tomcat.https.port}"
   relaxedQueryChars="[]"
   sendReasonPhrase="true"/>
-->

Check the documentation of Apache Tomcat to know how to change the default SSL/TLS settings of the web container: to limit the ciphers, enable client authentication, etc.

6. When enabling TLS/SSL on Tomcat, a user that can connect to the host where the Solution Manager servers run, with the user account with which you launch the Solution Manager servers, will be able to see the password of the keystore, in the list of running processes. That is because by default, this password is passed as a parameter to the script that starts the web container.

   To avoid this (i.e. adding this password to the command line of Tomcat), follow these steps:

   Important

   This is mandatory if in step 1, you set the property com.denodo.security.ssl.keyStorePassword.encrypted to true; otherwise Tomcat will not start. If this property is false, this step is optional.

   1. Edit the file <SOLUTION_MANAGER_HOME>/resources/apache-tomcat/conf/tomcat.properties and uncomment the property com.denodo.security.management.jmxremote.ssl.config.file. Only uncomment the property, leave the default value as is (i.e. <SOLUTION_MANAGER_HOME>/resources/apache-tomcat/conf/jmxssl.properties).

   2. Change the privileges of the file <SOLUTION_MANAGER_HOME>/resources/apache-tomcat/conf/jmxssl.properties so it can only be read and written by the same user account that starts the Denodo servers.

      To do this, execute these commands:

      • On Linux, run the following from the user account that starts the Denodo servers:

      chmod 600 <SOLUTION_MANAGER_HOME>/resources/apache-tomcat/conf/jmxssl.properties
      

      • On Windows, right-click the icon Command Prompt of the Windows menu and click Run as administrator.

        Run the following commands (replace <denodo_user> with the user account with which the Denodo servers are started):

      cd <SOLUTION_MANAGER_HOME>\resources\apache-tomcat\conf\
      icacls jmxssl.properties /setowner <denodo_user>
      icacls jmxssl.properties /grant <denodo_user>:(GR,GW)
      icacls jmxssl.properties /inheritance:r
      

      If you do not change these privileges, the web container will not start.

7. Edit the file <SOLUTION_MANAGER_HOME>/resources/apache-tomcat/webapps/solution-manager-web-tool/WEB-INF/classes/ConfigurationParameters.properties.

   Change the value of the property com.denodo.solutionmanager.security.ssl.enabled to true

8. Start the Denodo Platform servers.

   It is important to stop them all before any change (step #1) so the Denodo web container is stopped as well.

9. To check that HTTPs was enabled successfully, start the Solution Manager Administration Tool and all the other modules. Then, go to https://denodo-solution-manager.acme.com:19443/solution-manager-web-tool and log in. (19443 is the recommended value of the property com.denodo.tomcat.https.port).

Additional Information about the TrustStore (cacerts file)

By leaving the properties com.denodo.security.ssl.trustStore, com.denodo.security.ssl.trustStorePassword and com.denodo.security.ssl.trustStorePassword.password commented on these files, these modules will use the default TrustStore of the installation (<SOLUTION_MANAGER_HOME>/jre/lib/security/cacerts).

If the certificate is not signed by a trusted authority (i.e. one that is not registered in the JRE’s TrustStore), you have to import it into the default TrustStore (<SOLUTION_MANAGER_HOME>/jre/lib/security/cacerts). Note that you did that already when following the instructions of the previous section, to obtain the certificate.

It is possible to configure the Denodo servers to use a TrustStore that is not the default one. However, we do not recommend doing so and that you go to the next section. The main reason to use the default TrustStore is that it makes the configuration of the Denodo servers easier.

In case you want to do it, uncomment the following properties in the file <SOLUTION_MANAGER_HOME>/conf/solution-manager/SMConfigurationParameters.properties:

1. com.denodo.security.ssl.trustStore = Path to the TrustStore. For example,

   com.denodo.security.ssl.trustStore=c:/settings/my_external_cacerts_file
   

   Even if the Denodo servers run on Windows, the path separator has to be the forward slash (/).

2. com.denodo.security.ssl.trustStorePassword = Password of the TrustStore. The default password of the default TrustStore of Java (i.e. <SOLUTION_MANAGER_HOME>/jre/lib/security/cacerts) is changeit. The value of the password can be stored as clear text or encrypted. To obtain a valid encrypted value, use the {<DENODO_HOME>}/bin/encrypt_password script.

3. com.denodo.security.ssl.trustStorePassword.encrypted = Set it to true if the password of the TrustStore is encrypted.

   If you set this property to true, you have to do step #6 (see above). Otherwise, Tomcat will not start.

4. In the file <SOLUTION_MANAGER_HOME>/conf/solution-manager/denodo-monitor/ConfigurationParametersGeneral.template, uncomment the property com.denodo.security.ssl.trustStore and set it to the TrustStore you want to use. For example,

   com.denodo.security.ssl.trustStore=c:/settings/my_external_cacerts_file