SSL configurations are not working for httpd ModJk redirection to jboss Web Application that is integrated with OpenAM through fedlet saml2 approach for Single Sign On.
Since i am doing this for the first time, i am requesting for some help on this. I am trying to enable SSL configuration for Java web application that integrated with OpenAM(version 11) through fedlet saml2 approach for Single Sign On. SSL Configuration done and then request redirect to JBOSS with httpd, modjk and openAM Fedlet for Single Sign On. In OpenAM(version 11) server console, I generated the fedlet by configuring https application URL and used the same conf folder inside our application for communicating with openAM ldap authentication. When i hit the app URL in browser, request is redirecting to OpenAM for ldap authentication and after verifying LDAP credentials, it is not logging into application.
Steps Followed:
1 OpenAM deployed tomcat server is configured with SSL certificate using connector tag. 2 By accessing openAM console, created IDP server name (https://auth.test.app.com:443). 3 After that, i created fedlet in OpenAM for my web application by giving URL (https://auth.test.app.com:443/MyWebApplication) 4 Web Application is configured with conf folder of fedlet that was generated and deployed into jboss servers 5 openssl installed into apache httpd server and ssl configurations are made for ssl.conf,httpd.conf and modjk.conf files as specified in below (plz refer all configurations section provided below) 6 I am able to access app URL(https://auth.test.app.com/MyWebApplication/) in browser only when i did put entry into my local machine /etc/hosts/ file but i am doing all these changes in unix box server(I should access URL in public internet but Not sure if i miss anything i am not able to access until i register in my local machine hosts file. With http option, i am able to access without registering domain in my local machine hosts file, when try to configure https, URLs is not accessible until I register domain in local hosts file). 7 When i browse app URL https://auth.test.app.com/MyWebApplication/, It is redirecting to OpenAM server URL(https://auth.test.app.com/Signin/UI/Login) for ldap authentication. 8 After entering ldap credentials in OpenAM login URL, THEN it is not logging into my application using https protocol, it is breaking and no logs observed. The whole process is working fine when using HTTP protocol but it is failing when trying to configure HTTPS.
Process Flow Diagram:
Click Here To See Flow Diagram
Server Details:
APP URLs --> https://auth.test.app.com/MyWebApplication/, https://auth.test.app.com
MOd jk server --> 10.xx.xxx.143
OpenAM server --> 10.xx.xxx.152 (openAM console can be accessed using URL https://auth.test.app.com)
Jboss_servers --> 10.xx.xxx.111, 10.xx.xxx.222
All Configuration Files
##----SSL.conf------##
default values
-------
----
Listen 443 https
<VirtualHost _default_:443>
ServerName auth.test.app.com
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA
SSLCertificateFile "/etc/apache2/2.2/server.crt"
SSLCertificateKeyFile "/etc/apache2/2.2/server.pem"
#My Web application using ajp protol
ProxyPass /* ajp://10.xx.xxx.111:443/MyWebApplication/
ProxyPassReverse /* ajp://10.xx.xxx.111:443/MyWebApplication/
<Proxy *>
AddDefaultCharset off
Order deny,allow
Allow from all
</Proxy>
#mounting jk property file
JkMount /* worker
</VirtualHost>
##----httpd.conf--------##
default values
-------
----
IncludeOptional conf.d/SSL.conf
##------modjk.conf--------##
default values
-------
----
JkMountFile conf/UriWorkerMap.properties
JkWorkersFile /etc/httpd/conf/worker.properties
<Location /jkstatus/>
JkMount statusmanager
Order deny,allow
Allow from all
</Location>
##----UriWorkerMap.proeperties---------##
#APP Load Balancer
/MyWebApplication=applb
/MyWebApplication/*=applb
#OpenAM Server
/Signin=Signlb
/Signin/*=Signlb
##----worker.properties-----------------##
#Log
workers.apache_log=/var/log/httpd
#Worker List
worker.list=applb,approute1,approute2,Signlb,status
worker.status.type=status
worker.approute1.type=lb
worker.approute1.sticky_session=True
worker.approute1.balance_workers=node1
#Jboss Node1
worker.node1.port=8009
worker.node1.host=10.xx.xxx.111
worker.node1.redirect=node2
worker.node1.type=ajp13
worker.node1.lbfactor=1
#Jboss Node 2
worker.approute2.type=lb
worker.approute2.sticky_session=True
worker.approute2.balance_workers=node2
worker.node2.port=8009
worker.node2.host=10.xx.xxx.222
#OpenAM Server Route
worker.node4.port=8009
worker.node4.host=10.xx.xxx.152
worker.node4.type=ajp13
worker.node4.lbfactor=1
worker.Signlb.type=lb
worker.Signlb.sticky_session=True
worker.Signlb.balance_workers=node4
##----OpeanAM-Tomcat Connector----##
<Connector SSLEnabled="true" acceptCount="100" clientAuth="false"
disableUploadTimeout="true" enableLookups="false" maxThreads="25"
port="443" keystoreFile="/path/jksfile/keystorefile.jks" keystorePass="Password"
protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https"
secure="true" sslProtocol="TLS" redirectPort="8443"/>
##---JBOSS -connector--------------##
<connector name="https" protocol= "org.apache.coyote.http11.Http11NioProtocol" scheme="https" socket-binding="https" secure="true">
<ssl name="jboss7_ssl" password="Password" certificate-key-file="/path/jksfile/keystorefile.jks" protocol="TLSv1+TLSv1.1+TLSv1.2"/>
</connector>