CSP Gateway Configuration Guide - InterSystems Documentation

More documents

Recommendations

Info

Introduction to the CSP Gateway 1.7 Enable Sticky Sessions on Hardware Load Balancer on High Availability Solutions For High Availability solutions running over CSP, InterSystems recommends that you use a hardware load balancer for load balancing and failover. InterSystems requires that you enable sticky session support in the load balancer; this guarantees that -- once a session has been established between a given instance of the gateway and a given application server -- all subsequent requests from that user run on the same pair. This configuration assures that the session ID and server-side session context are always in sync; otherwise, it is possible that a session is created on one server but the next request from that user runs on a different system where the session is not present, which results in runtime errors (especially with hyperevents, which require the session key to decrypt the request). See your load balancer documentation for directions on how to enable sticky session support. Note: It is possible to configure a system to work without sticky sessions but this requires that the CSP session global be mapped across all systems in the enterprise and can result in significant lock contention so it is not recommended. For more information on high availability and CSP, see the section “CSP Gateway Considerations” in the Caché High Availability Guide. 1.8 Conventions Used in this Document Where possible, the sample Web server configurations described in this document are based on the current default installation for both Caché and the CSP Gateway’s hosting Web server. The default paths to the Web Server and Gateway components are used in the configuration blocks. Change paths to these resources to suit your own installation where necessary. Lines terminated with a back-slash (\) are continued to the next line. For example, enter the following line, as shown in this document: Init fn=load-modules shlib=CSPn3.dll \ funcs=csp_term As: Init fn=load-modules shlib=CSPn3.dll funcs=csp_term The default installation directory for Caché is documented in the Default Caché Installation Directory section of the Caché Installation Guide. This guide refers to the default using the variable install-dir and in many examples uses C:\cache-install-dir\ as the installation directory. 1.8.1 Gateway components and physical installation paths Later sections in this guide describe how the Gateway components should be configured with all supported web servers. The installation paths for components should be regarded as examples rather than taken literally. Also, the InterSystems installers will create and maintain separate Gateway installations for the internal (private) web server and any third-party web server that might be present on the same host. In this context ‘third-party web server’ refers to a web server that is not part of the software installed by InterSystems. The precise installation location of Gateway components is not particularly critical provided: • The physical installation paths match those given in the hosting web server configuration where appropriate. 6 CSP Gateway Configuration Guide
Conventions Used in this Document • The security settings, in relation to required access for individual components, are adjusted appropriately. This is particularly important for Gateway components that are accessed directly by the web server since web servers are usually locked down to the extent that the files they are able to access (and executables that can be run) are carefully controlled. It should be borne in mind that security considerations will also be important for any Gateway configuration (and log) files that are accessed by Gateway binaries that are themselves bound to the web server core executable. • The security policy of the hosting web server is respected. Some web servers – notably those shipped with Secure Linux (SELinux) and OpenVMS (HPSWS) – are configured such that it is not possible for them to access files that lie outside their own file system. This restriction will clearly have an impact on where certain web-server-facing Gateway components can be installed. There are four types of Gateway component to consider. 1. Binaries to be loaded by the web server (API based extensions). This includes Windows DLLs, UNIX Shared Objects and OpenVMS Shareable Images: CSPms[Sys].dll CSPn3[Sys].(dll|so|exe) CSPa*[Sys].(dll|so) mod_csp*.(so|exe) The physical location where these are installed should match the corresponding configuration directives in the hosting web server configuration. This includes directives indicating which third-party modules should be loaded. The web server requires permission to read and load these modules. Modules named CSP* require permission to read and write to the Gateway configuration and log files (CSP.ini, CSP.log). These are usually created in the same location as the Gateway binaries. When considering access control for these modules, bear in mind that it is the web server worker processes that need to be able to access the modules together with any dependent configuration and log files. For example, in the case of Apache, the server is usually started with superuser permissions but the worker processes that actually serve web requests run with a much lower level of authority (as indicated by the User and Group directives in the Apache configuration file). It is the User and Group specified for the worker processes that should be granted permission to load the Gateway modules and (where appropriate) the ability to read and write to the configuration and log files (CSP.ini and CSP.log). 2. Executables to be called by the web server (CGI modules). [nph-]CSPcgi[Sys][.exe] The physical location where these are installed should match the corresponding configuration directives in the hosting web server configuration. This will include directives indicating which web requests should be processed by these CGI modules. The worker processes of the hosting web server require execute permissions with respect to these modules. There are no further dependencies. 3. Static files to be returned by the web server. Note: With current CSP Gateway configurations, CSP is often configured to serve static files directly from Cache as opposed to having the web server return them. This section does not apply to such configurations. JavaScript modules (such as CSPBroker.js, CSPxmlhttp.js, and so on) Java applets (such as CSPBroker.class, CSPBroker.jar, and so on) Images (such as created-with-csp.gif, and so on) The worker processes of the hosting web server will require ‘read’ permissions with respect to these filed. 4. The CSP Network Service Daemon (NSD) CSP Gateway Configuration Guide 7
Page 1 and 2: CSP Gateway Configuration Guide Ver
Page 3 and 4: Table of Contents About this Book .
Page 5: 4.2.6 IIS Application Protection Le
Page 9 and 10: 1 Introduction to the CSP Gateway T
Page 11: Using the Network Service Daemon (N
Page 15 and 16: Minimal Apache Web Server or Privat
Page 17 and 18: 2 CSP Gateway Operation and Configu
Page 19 and 20: CSP Web Gateway Management Page You
Page 21 and 22: CSP Web Gateway Management Page •
Page 23 and 24: CSP Web Gateway Management Page 4.
Page 25 and 26: CSP Web Gateway Management Page Que
Page 27 and 28: CSP Web Gateway Management Page /op
Page 29 and 30: CSP Web Gateway Management Page Log
Page 31 and 32: CSP Web Gateway Management Page The
Page 33 and 34: CSP Web Gateway Management Page SSL
Page 35 and 36: CSP Web Gateway Management Page •
Page 37 and 38: CSP Web Gateway Management Page Par
Page 39 and 40: CSP Web Gateway Management Page 2.1
Page 41 and 42: CSP Gateway and Security • Key Ta
Page 43 and 44: CSP Gateway and Security space, the
Page 45 and 46: HTTP Response Headers Environment V
Page 47 and 48: Making a CSP Page the Home Page for
Page 49 and 50: Compressing the Response to Request
Page 51 and 52: CSP Page Output Caching 2.6.3 Speci
Page 53 and 54: CSP Page Output Caching Weather.csp
Page 55 and 56: CSP with Microsoft Active Server Pa
Page 57 and 58: Implementing HTTP authentication fo
Page 59 and 60: Load Balancing and Failover Class %
Page 61 and 62: Process Affinity and State-Aware Mo
Page 63:
Process Affinity and State-Aware Mo
Page 66 and 67:
Using Caché Server Pages with a Re
Page 68 and 69:
Page 70 and 71:
Page 73 and 74:
4 Web Servers for Microsoft Windows
Page 75 and 76:
Microsoft Internet Information Serv
Page 77 and 78:
Page 79 and 80:
Page 81 and 82:
Page 83 and 84:
Page 85 and 86:
Page 87 and 88:
Page 89 and 90:
Page 91 and 92:
Page 93 and 94:
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Apache Servers 4.3 Apache Servers A
Page 111 and 112:
Apache Servers persist in memory fr
Page 113 and 114:
Apache Servers by CSP since they ar
Page 115 and 116:
Apache Servers Finally, note that b
Page 117 and 118:
Apache Servers To invoke CSP for fi
Page 119 and 120:
Apache Servers nmake /f Makefile.nt
Page 121 and 122:
Operating the Network Service Daemo
Page 123 and 124:
Locked-down Apache environments htt
Page 125 and 126:
5 Web Servers for UNIX®, Linux, an
Page 127 and 128:
Sun Web Servers 3. HyperEvents Comp
Page 129 and 130:
Sun Web Servers To access the CSP W
Page 131 and 132:
Apache Servers 1. If you are using
Page 133 and 134:
Apache Servers /etc/Apache2/conf 1.
Page 135 and 136:
Apache Servers Notice the use of th
Page 137 and 138:
Apache Servers • MaxSpareThreads
Page 139 and 140:
Apache Servers As an example, consi
Page 141 and 142:
Apache Servers Note: For further in
Page 143 and 144:
Apache Servers with: AddHandler csp
Page 145 and 146:
Apache Servers For example, all the
Page 147 and 148:
Apache Servers These directives wor
Page 149 and 150:
Apache Servers For example, to add
Page 151 and 152:
Apache Servers 5.2.5.4 Registering
Page 153 and 154:
Page 155:
Page 158 and 159:
Web Servers for Hewlett-Packard (HP
Page 160 and 161:
Page 162 and 163:
Page 164 and 165:
Page 167 and 168:
A Building Apache for IBM AIX Note:
Page 169 and 170:
Building Apache for IBM AIX # Rule
Page 171 and 172:
Building Apache for IBM AIX @echo "
Page 173 and 174:
Page 175 and 176:
Page 177:
Building Apache for IBM AIX Having
show all

CSP Gateway Configuration Guide - InterSystems Documentation

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?