We wanted to use the “closed by default, open by exception” approach, so we would start by blocking access to everything and then open the areas we needed access to URL by URL.  I suspected that the final ‘URL Whitelist’ might take many iterations to get right and as the Reverse Proxy in the DMZ was outside of my control I needed to trial it somewhere else first.

I commandeered one of our less frequently used environments and went about searching for a quick/free method of blocking access.  After trying a few different approaches I settled on Squid, the open-source forward-proxy / web-caching server.  Although it’s better known for running on Unix systems, there is a Windows implementation and it can operate perfectly well as a reverse-proxy.

Setting up Squid

Once I’d downloaded and unzipped the binaries, and installed it as a service (using this helpful write-up as a guide) it was just a case of setting the rules.

In the ACLs section I added my bad and good URLs:

acl bad_url urlpath_regex *DEV*
acl good_url urlpath_regex "c:\squid\etc\good-urls.squid"

This would block any URL with DEV in (my chosen environment was DEV), but then allow any URLs in the ‘good-urls.squid’ file.  I then had specify in the http_access section what to do with these ACL groups.

http_access allow good_url
http_access deny bad_url
http_access allow all

It took me a few goes to get this right as the last line confused me for a while, but luckily there are copious notes in the provided .conf file:

If none of the “access” lines cause a match, the default is the opposite of the last line in the list.  If the last line was deny, the default is allow. Conversely, if the last line is allow, the default will be deny.

I was happy leaving my PeopleSoft environment on port 80 and Squid on 3128 as this is just a temporary setup for my testing.  Obviously Squid would be on port 80 if this was a production setup.

I amended the default port line thus:

http_port 3128 defaultsite=xxx.yyy.com

(where xxx is the hostname and yyy is the domain name)

And finally I added this line:

cache_peer 127.0.0.1 parent 80 0 originserver default
 

I used 127.0.0.1 as Squid is on the same host as the PIA, and the rest is for forwarding.

Setup PeopleSoft

In the Web Profile ‘Virtual Addressing’ tab, add the reverse proxy details.  This willensure that PeopleSoft uses the reverse-proxy port number.  Bounce the PIA.

Custom Error Page

If you want a nice custom ‘Access Denied’ page instead of the default Squid one, they can be found in ‘C:\squid\share\errors\English’.  They have no file extension, but they’re HTML so a cinch to amend.

Building up the good-urls.squid file

This is largely going to vary depending upon what you want to expose to the external users.  A lot of what we opened up were custom pages so there isn’t a lot of value sharing the full file here.  Having said that, here is a snippet of our file:

*login*
*css
*/psp/ps/EMPLOYEE/HRMS/h/*
*/cs/ps/cache/*
*/ps/images/*
*/psc/ps/*viewattach*
*/psp/ps/EMPLOYEE/HRMS/c/ROLE_EMPLOYEE.GP_SS_EE_PSLP.GBL*
*/ps/ckeditor/*
*/psc/ps/EMPLOYEE/HRMS/c/HRS_HRAM.HRS_CE.GBL*
*/psp/ps/EMPLOYEE/HRMS/c/HRS_HRAM.HRS_CE.GBL*
*/psc/ps/EMPLOYEE/HRMS/s/WEBLIB_TIMEOUT.PT_TIMEOUTWARNING.FieldFormula.IScript_TIMEOUTWARNING
*/psc/ps/EMPLOYEE/HRMS/\?cmd=expire
*/psp/ps/EMPLOYEE/HRMS/\?cmd=expire
*/psp/ps/EMPLOYEE/HRMS/\?cmd=logout

Lines 1 and 2 sort out the signon page.

Line 3 is the Employee Portal homepage.

Lines 4 and 5 are for images.  Lines 6 and 8 are for viewing attachments and the Rich Text editor.

Lines 7, 9 and 10 are sample PeopleSoft pages/components.

The remainder deal with the timeout and signout links.

(Assuming that your PIA site is ‘ps’)

Gotchas

And you’re done.  There are a few little quirks to note.

Firstly, every time you change your URLs file you’ll need to restart the Squid service, but it’s a quick process so doesn’t hold you up too much.

Secondly, PeopleSoft frequently uses the ‘?’ special character as a URL delimiter so Squid only matches against the characters before this point.  There are several occasions when you need to match against the full URL which is why I’ve used url_path_regex in the ACL section above.  This allowed me to escape the special characters so that the log-out, time-out and view attachment links work ok.

As well as Automatic, Manual and Disabled, there is now an Automatic (Delayed) option.

David Kurtz has spoken about using service dependencies, but I just want my App Server and Process Scheduler to start after the intial flurry of start-up activity has finished and everything else has calmed down.

Services that have a delayed start still start automatically, they just wait until all the services that aren’t delayed to finish before firing up.

It works a treat!

If you do boot the App Server without changing the port you’ll get an error message:

exec PSRENSRV -A -- -C psappsrv.cfg -D PADMO -S PSRENSRV : CMDTUX_CAT:1685: ERROR: Application initialization failure

tmboot: CMDTUX_CAT:827: ERROR: Fatal error encountered; initiating user error handler


tmshutdown -qy

OK, you think. I know what that is, it must be a port clash. So you reconfigure the port in PSADMIN and then try to boot it again. Same error. Checking the REN Server log gives the following clue:

(ERROR) nssock: Cannot listen on port 7180. The port may already be in use.

It’s still looking on port 7180, not the new port!

The missing step is to update the database, as the port is stored there also:

UPDATE PSREN SET PORT_NUM = 7185, SSLPORT_NUM = 7148

You should then find you App Server and Ren Server boot fine.

Booting admin processes ...
exec BBL -A :
CMDTUX_CAT:1863: INFO: Process ID=2636 Assume failed (timeout).

At the time of writing, there is nothing in Customer Connection for this, and a google search wasn’t particularly helpful either. So I had to resort to a technique from pre-Google days – i.e. work it out myself. Thankfully it wasn’t too difficult.

The config setting we’re after is TM_BOOTTIMEOUT at by default it is 60 seconds. This can be changed in psappsrv.ubx (which serves as a template for the App Server config). Scroll to the bottom and look for:

# ----------------------------------------------------------------------
*PS_ENVFILE
TM_BOOTTIMEOUT=60
TM_RESTARTSRVTIMEOUT=60
TM_BOOTPRESUMEDFAIL=Y

The line in Red is the one which requires changing, I’ve set mine to 120 seconds. Reconfigure your App Server (you don’t have to make any changes, it just needs to re-read the UBX file) and you’re good to go. If you have doubts as to whether it’s picked up the altered value, look in the TUXLOG.xxxxxx file in your App Server logs directory. The TM_BOOTTIMEOUT is logged there every time you boot an App Server.

It looks like this:

Once you’ve done a little bit of config (no more than 15 minutes, and it’s just config, there’s nothing additional to install) you just point the web browser on your client PC to a URL and it loads up the above screen.

You drop down the Domain menu to choose which App Server or Process Scheduler to administer, then use it to start and stop the domain, or you can do individual processes if you prefer. (For example, on my current client site we have a developer who frequently hangs the domain by using all of the PSAPPSERV processes during debugging. Using this tool, we could change the Max App Servers setting and then boot a couple of extra App Servers, all in a few clicks and without rebooting the domain.)

These are the steps I took to get the Admin Console running (substitute your own machine names and ports where appropriate):

1. for each app server and process scheduler you wish to administer, edit the *.ubx file under either the app serv or proc sched directories. Go to the PS_ENVFILE section and add:
   PS_SERVDIR={$PS_SERVDIR}
PS_SERVER_CFG={$PS_SERVDIR}{FS}{CFGFILE}
2. locate the webgui.ini file under <tuxedo install directory>\udataobj\webgui\ and in the second section add a line for each domain you wish to administer (i.e. a line for each app server or process scheduler). There are instructions in file, but the line will look something like this.
   DOMAIN=HR9DMO;D:\pshome\appserv\HR9DMO\PSTUXCFG
3. Start the Tuxedo Web Server and Listener
   cd /d d:\bea\tux*
tuxwsvr -l //vm-hr9dmo:8080 -i D:\bea\Tuxedo8.1\udataobj\tuxwsvr.ini
Wlisten
4. From your client log on to ‘http://vm-hr9dmo:8080/webguitop.html’. The username and password will be that chosen when Tuxedo was installed (likely admin/password)
5. chose the domain you wish to admin from the drop down domain menu, then you can drill down and activate/inactivate (webgui terminology for start-up/shut-down) whatever you wish.

Hope that helps. If you have any issues, I found the tuxedo website more useful than Peoplebooks or customer connection, however your mileage may vary. Also, the tuxedo helpfile is here:
<bea_home>\Tuxedo8.1\help\guiguide\index.htm

This post was edited on 7th Nov ’07 to include corrections on the port number, as suggested by David Kurtz in his comment below.