Enabling HTTPS in the Embedded Apache Tomcat¶

The Denodo Platform embeds the Apache Tomcat web container to host its web applications and web services. The communications between clients and the web applications running in the Apache Tomcat embedded in the Denodo Platform can be secured with HTTPS. The applications running in this web container are:

• Scheduler Administration Tool

• Web Services published using Virtual DataPort

• Data Catalog

• Diagnostic & Monitoring Tool

To enable HTTPS, do the following:

1. Stop all the Denodo servers of this installation. The goal is to stop the web container of Denodo. It is important to stop them all so the Denodo web container is stopped as well. If for example, you leave the Data Catalog started, the web container will not shut down and the changes in the file tomcat.properties will not take effect even if you restart the other components of Denodo.

2. Edit the file <DENODO_HOME>/resources/apache-tomcat/conf/tomcat.properties.

   Uncomment the following properties and set their value:

3. Edit the file <DENODO_HOME>/resources/apache-tomcat/conf/server.xml

   1. Uncomment the SSL connector. I.e. Search the “Connector” element that contains SSLEnabled="true" and remove the <-- and --> characters that surround it.

   2. To disable the access through HTTP and only allow HTTPs connections, comment the “Connector” element that contains port=”${com.denodo.tomcat.http.port}” with <-- and -->. For example,

<!--
  <Connector port="${com.denodo.tomcat.http.port}"
             protocol="HTTP/1.1"
             maxThreads="150"
             minSpareThreads="25"
             redirectPort="${com.denodo.tomcat.https.port}"
             connectionTimeout="20000"
             URIEncoding="UTF-8"
             compression="on"
             compressionMinSize="1024"
             noCompressionUserAgents="gozilla, traviata"
             compressableMimeType="text/html,text/xml,application/json,application/xml,text/css,text/javascript,application/javascript" />
-->

Check the documentation of Apache Tomcat to know how to change the default SSL/TLS settings of the web container: to limit the ciphers, enable client authentication, etc.

4. Check if the file <DENODO_HOME>/resources/apache-tomcat/conf/jmxssl.properties exists. If it does not, create it and leave it empty.

5. When enabling TLS/SSL on the Tomcat, a user that can connect to the host where the Denodo servers run, with the user account with which you launch the Denodo servers, will be able to see the password of the keystore, in the list of running processes. That is because by default, this password is passed as a parameter to the script that starts the web container.

   To avoid this (i.e. adding this password to the command line of Tomcat), follow these steps:

   1. Edit the file <DENODO_HOME>/resources/apache-tomcat/conf/tomcat.properties and uncomment the property com.denodo.security.management.jmxremote.ssl.config.file. Only uncomment the property, leave the default value as is (i.e. <DENODO_HOME>/resources/apache-tomcat/conf/jmxssl.properties).

   2. Change the privileges of the file <DENODO_HOME>/resources/apache-tomcat/conf/jmxssl.properties so it can only be read and written by the same user account that starts the Denodo servers.

      If you do not change these privileges, the web container will not start.

      If you are going to launch the Denodo components as Windows services, configure these services to run with the user account that is the owner of the file “jmxssl.properties”. The section Configure Windows Services explains how to do this.

      To change the privileges, execute these commands:

      • On Linux, run the following from the user account that starts the Denodo servers:

      chmod 600 <DENODO_HOME>/resources/apache-tomcat/conf/jmxssl.properties
      

      • On Windows, right-click the icon Command Prompt of the Windows menu and click Run as administrator. Then, execute these commands:

      cd <DENODO_HOME>\resources\apache-tomcat\conf\
      icacls jmxssl.properties /setowner <denodo user>
      icacls jmxssl.properties /reset
      icacls jmxssl.properties /inheritance:r /grant:r <denodo user>:(GR,GW)
      

      For example:

      icacls jmxssl.properties /setowner CONTOSO\jsmith
      icacls jmxssl.properties /reset
      icacls jmxssl.properties /inheritance:r /grant:r CONTOSO\jsmith:(GR,GW)
      

6. Start the Denodo servers you use.

7. To check that HTTPS was enabled successfully, open the URL https://denodo-server.acme.com:9443/denodo-restfulws/admin (9443 is the default value of the property com.denodo.tomcat.https.port).