Customized output from:
Document Release Date: April 2015 Software Release Date: April 2015 |
|
The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
The information contained herein is subject to change without notice.
Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.
© 2010-2015 Hewlett-Packard Development Company, L.P.
Adobe® is a trademark of Adobe Systems Incorporated.
Java is a registered trademark of Oracle and/or its affiliates.
Microsoft® and Windows® are U.S. registered trademarks of Microsoft Corporation.
Oracle® is a registered US trademark of Oracle Corporation, Redwood City, California.
UNIX® is a registered trademark of The Open Group.
For a complete list of open source and third party acknowledgements, visit the HP Software Support Online web site and search for the product manual called HP Service Request Catalog Open Source and Third Party License Agreements.
The title page of this document contains the following identifying information:
To check for recent updates or to verify that you are using the most recent edition of a document, go to: https://softwaresupport.hp.com
This site requires that you register for an HP Passport and sign in. To register for an HP Passport ID, go to: http://h20229.www2.hp.com/passport-registration.html
Or click the New users - please register link on the HP Passport login page.
You will also receive updated or new editions if you subscribe to the appropriate product support service. Contact your HP sales representative for details.
The title page of this document contains the following identifying information:
To check for recent updates or to verify that you are using the most recent edition of a document, go to: www.hp.com/go/livenetwork. This site requires that you register for an HP Passport and sign in. To register for an HP Passport ID, go to: http://h20229.www2.hp.com/passport-registration.html
Or click the New users - please register link on the HP Passport login page.
Visit the HP Software Support Online website at: https://softwaresupport.hp.com
This website provides contact information and details about the products, services, and support that HP Software offers.
HP Software online support provides customer self-solve capabilities. It provides a fast and efficient way to access interactive technical support tools needed to manage your business. As a valued support customer, you can benefit by using the support website to:
Most of the support areas require that you register as an HP Passport user and sign in. Many also require a support contract. To register for an HP Passport ID, go to:
http://h20229.www2.hp.com/passport-registration.html
To find more information about access levels, go to:
http://h20230.www2.hp.com/new_access_levels.jsp
HP Software Solutions Now accesses the HPSW Solution and Integration Portal website. This site enables you to explore HP Product Solutions to meet your business needs, includes a full list of Integrations between HP Products, as well as a listing of ITIL Processes. The URL for this website is http://h20230.www2.hp.com/sc/solutions/index.jsp
This document describes HP Live Network Community Content. Hewlett Packard Software does not test, certify or support Community Content. Please use the Community Content discussion forums on HP Live Network or contact the original submitter of the Community Content directly if any support, configuration or usability questions arise. Please back up all appropriate Service Request Catalog files before applying Community Content in your environment.
An interactive guide enables you to identify the tasks to deploy and configure Service Request Catalog 9.35. The initial dialogue helps you identify only the tasks that you need to complete for your environment. From those responses, you can create a customized guide that includes all the tasks that apply to your environment.
Answer the following questions to begin the process.
Make sure you are familiar with the method you choose and that you are knowledgeable about its configuration requirements.
The following steps are customized according to your selections. Check that your selections are correct.
If any selections are not correct, click Change.
Before you begin the Service Request Catalog installation, you must complete all the installation and configuration steps for Service Manager 9.35.
Service Request Catalog 9.35 new features work only with Service Manager 9.35. Service Manager 9.35 has enhancements that complement this version of Service Request Catalog. You must have both Service Manager server (RTE) and applications at version 9.35 to run Service Request Catalog 9.35 successfully.
You can return to the Service Request Catalog installation when you have the Service Manager 9.35 applications and server running successfully.
This guide is interactive and enables you to view the installation and configuration instructions that are relevant for your Service Request Catalog setup. You can change your selections any time by clicking the Change button at the top of the page. When you complete a step or task, click the check box to the right of the heading. To collapse or expand sections, click the arrow icon to the left of the heading.
The bottom of the pages in the online version of this guide list the following identifying information:
Printing
This guide will not print correctly if you attempt to print it by using the browser print function. If you decide that you want to print the guide, click Print at the top of the page or at the bottom of the page where you made your selections.
The Service Request Catalog installation package contains:
A web application archive (src-9.35.war) file that creates the browser interface when you deploy it by using Apache Tomcat.
A simple encryption tool, (encryptor-9.35.zip) in a zip archive. The encryption tool encrypts the password of the Service Manager administrator.
An xml validation tool (validator-9.35.zip) to ensure that the manifest.xml file is configured properly.
A migration tool to assist in the moving your Service Request Catalog customizations to this version of Service Request Catalog. For details on how to use the migration tool, see the Service Request Catalog Customization Guide.
If you want to use Service Request Catalog on your tablet devices, you can download the HP Service Request Catalog app to your device from Google Play or the Apple Appstore. To locate these apps, search for "HP SRC" in the appropriate store.
The HP Service Request Catalog 9.35 tablet app supports Service Request Catalog 9.35, 9.34, and 9.33 (the SRC .war file).
Specified installation folder and path locations are generally relative to the location of the installed Tomcat instance and deployment location of the src-9.35.war file. When you see a path that includes a hard drive letter (C:\), the actual location always depends on the user's discretion. You can substitute the actual drive that you choose. When you see a path that includes an ellipsis (...), it represents the discretionary part of the path and folder structure on your local drive. Example: C:\...\apache-tomcat-7.0.x
The C:\...\ notation assumes that you chose the default installation path for Apache Tomcat. When you encounter this path notation in examples, you can always substitute your local path.
For Unix, the default folder structure is always represented with this convention: /opt/...
You can assume all tasks and steps are required unless they are marked Optional.
For detailed information on Service Request Catalog requirements, refer to the Service Manager Compatibility Matrix.
Important notes:
If you also want to use LDAP together with Service Manager and Service Request Catalog, refer to the Service Manager LDAP Best Practices Guide on the following Web site: https://softwaresupport.hp.com
To deploy the Service Request Catalog application and configure the authentication environment, you will complete these basic tasks.
If necessary, navigate to this download site to obtain the zipped installation files for Apache Tomcat 7.0.x: http://tomcat.apache.org/download-70.cgi
Download the zip version to deploy manually or the 32-bit/64-bit Windows Service Installer.
Do one of the following to install Tomcat as a Windows Service or as a manual deployment:
Windows Service: Run the apache-tomcat-7.0.x.exe installer. Specify a convenient location for Tomcat. Example:
C:\...\apache-tomcat-7.0.x
/opt/..../apache-tomcat-7.0.x
When prompted for the Java location, note the path to the \jre
folder.
You will need this information later when you configure authentication.
Manual Process: Unzip the files to a preferred location on the designated server. Example: Unzip the files to:
C:\...\apache-tomcat-7.0.x
/opt/..../apache-tomcat-7.0.x
After you install Tomcat, increase the Java Heap Space setting to prevent out of memory issues.
Example:
To deploy and configure the .war file, follow these steps:
Navigate to the Control Panel > Administrative Tools > Services dialog. Verify the Apache Tomcat service is stopped.
Run /opt/.../apache-tomcat-7.0.x/bin/shutdown.sh
Unzip the contents of the Service Request Catalog .zip file into an empty folder that you create to be the home location for this application.
Example: If you create a new folder named \src-9.35 where you plan to deploy the .war file, the result would look like this:
C:\...\src-
9.35\war_file_contents
/opt/.../src-
9.35/war_file_contents
Tip: Use a .war file extraction tool, or rename the file to src-9.35.zip and unzip it to the target location.
Open this file with a text editor:
C:\...\Apache\apache-tomcat-7.0.x\conf\server.xml
/opt/.../apache-tomcat-7.0.x/conf/server.xml
Navigate to the <Host></Host>
section and locate the Context parameter. If the section
is commented out, uncomment it. If it is missing, add the following.
<Context docBase=""
path=""
reloadable="false" />
Specify the complete path to the folder where you unzipped the src-9.35.war file in the docBase= parameter. Enclose the path in double quotation marks (" "). Example:
<Context docBase="C:\...\src-
9.35"
<Context docBase="/opt/.../src-
9.35"
The path=
parameter enables you to create a simplified path (in the URL) that maps to
the actual path where you deploy the src-9.35.war application. Enclose the path in
double quotation marks (" "). Example:
<Context docBase="C:\...\src-9.35"
path="/src"
<Context docBase="/opt/.../src-
9.35"
path="/src"
Tip: It is acceptable to create a multi-level context path for your deployment.
Example:
path="/enterprise/xxx/src"
Save your changes and close the file.
Note: It is recommended to enable HTTPOnly cookies in your Apache Tomcat to help prevent malicious JavaScript injection.
<Context useHttpOnly="true">...</Context>
Encrypt the password used to connect to the Service Manager server.
Using the FIPS standard in SRC
FIPS (Federal Information Processing Standards) are a set of standards that describe document processing, encryption algorithms and other information technology standards for use within U.S. non-military government agencies and by U.S. government contractors and vendors who work with such agencies.
As of version 9.32, Service Manager supports the FIPS 140-2 approved Advanced Encryption Standard (AES) 256-bit data encryption algorithm. To use FIPS together with SRC you must first enable FIPS mode in Service Manager. For information on how to do this, see the following sections of the Service Manager Help Center:
"Configure FIPS mode in Service Manager"
SRC uses the encryption tool to generate the encrypted password. To support the FIPS standard encryption, this tool has been provided from SRC 9.32.
By default, the runme.bat script generates an encryption key that meets the FIPS standard. More specifically, the runme.bat script uses an Advanced Encryption Standard (AES) 256-bit data encryption algorithm. However, to remain compatible with previous versions of Service Request Catalog, an optional parameter (PBE) is now accepted by the runme.bat script, which uses the MD5 and DES encryption of earlier versions of Service Request Catalog. Therefore, you should choose one of the following options:
Note: To use this algorithm, you must install the Java Cryptography Extension (JCE). You can download the JCE from the Oracle web site.
To encrypt using the AES 256-bit algorithm,follow these steps:
From the location where you unzipped the Service Request Catalog .zip file, extract the contents of
...\files\encryptor-
9.35.zip
into a separate folder of your choice. Example:
C:\...\src-9.35\encrypt
/opt/.../src-9.35/encrypt
Run the executable file to start the encryptor application.
C:\...\src-9.35\encrypt\runme.bat
/opt/..../src-9.35/encrypt/runme.sh
Note: See the Using the FIPS standard in SRC section for additional details on using the run script.
To encrypt using the earlier MD5 and DES algorithms, follow these steps:
From the location where you unzipped the Service Request Catalog .zip file, extract the contents of
...\files\encryptor-
9.35.zip
into a separate folder of your choice. Example:
C:\...\src-9.35\encrypt
/opt/.../src-9.35/encrypt
Run the executable file to start the encryptor application.
C:\...\src-9.35\encrypt\runme.bat PBE
/opt/..../src-9.35/encrypt/runme.sh PBE
Follow the steps in the Password Encryption program to create an encrypted password. You will be asked to specify these user-defined values:
The name of a file that will contain the encryption key for your administrator password.
The number of bits in a random number to be used for the salt. Valid values range from 1 to 65535. The default value is 128 bits.
The encryption method. If you choose to use the earlier MD5 and DES algorithm instead of the FIPS compliant AES algorithm, you can choose from the following encryption methods:
PBEWithMD5AndDES (default)
PBEWithSHA1AndRC2_40
PBEWithSHA1AndDESede
PBEWithMD5AndTripleDES
The administrator's password.
The Password Encryption program returns an encrypted password.
Copy the encrypted password and save it. You will need this value plus the name of the file with the encryption key when you configure Service Request Catalog in the next task.
To configure the related properties, follow these steps:
C:\...\src-9.35\WEB-INF\classes\applicationContext.properties
/opt/.../src-9.35/WEB-INF/classes/applicationContext.properties
Note: A detailed list of the properties in this file is shown in the table following these steps.
In the # Service Connector Configuration section, specify the following properties as appropriate for your environment. For Trusted Sign-On and Single Sign-On, specify only https
.
sm.protocol=https
sm.hostname=hostname.domainName
sm.port=13443
Note: TLS/SSL creates an encrypted connection that allows private information to be transmitted without the risk of eavesdropping, data tampering, or message forgery. HP recommends enabling TLS/SSL communication between the Service Request Catalog web application server and the web browser. This may be implemented through the src.security.secureLogin
parameter in the Service Request Catalog configuration file (applicationContext.properties), and requires TLS/SSL be configured on the web application server (for example, Tomcat).
As of Service Request Catalog 9.35, the default value of src.security.secureLogin
is set as true to enable SSL connection between Service Request Catalog and the end user's client browser.
For information on configuring TLS/SSL for Service Request Catalog, please refer to the following information: http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html
For information on using an Appropriate Certification Authority, please refer to the OWASP Best Practice.
HP does not recommend using self-signed certificates, as self-signed certificates negate the benefit of end-point authentication and significantly decrease the ability of users to detect a man-in-the-middle attack.
For the # Service Manager URL parameter, make no changes. The properties that you specified in the last three steps will be the components of the final URL.
sm.target=${sm.protocol}://${sm.hostname}:${sm.port}
Note: Service Request Catalog also supports IPv6. To enable IPv6 support in Service Request Catalog (SRC) , follow these steps:
Enable IPv6 support in Tomcat. To do this, see the Tomcat section of the Configure the Web clients for IPv6 page in the Service Manager Help Center.
Enable IPv6 in Service Manager. To do this, see the Configure the Service Manager server for IPv6 page in the Service Manager Help Center.
In folder where SRC is deployed, set the sm.hostname
parameter in the applicationContext.properties
file to a Full Qualified Domain Name or to a valid IPv6 address
sm.hostname=[2620:0:a17:e006:4a8:91c1:c9cb:93dd]
You can access the SRC application by entering the valid IP address in your browser, as shown in the following example:
http://[2620:0:a17:e006:4a8:91c1:c9cb:93dd]:8080/src-9.35
In the # Encryption section, follow these steps:
Locate the following entry:
serviceManager.adminCredentials=LIST(userName,ENC(encryptedValue))
You will need the user name and encrypted password that you created in the earlier tasks to encrypt a password.
Replace userName
with the Service Manager administrator user name that is
associated with the password that you encrypted in the last task.
Replace encrypted Value
with the encrypted password text that you saved.
Note: If you configured Service Manager to operate in multi-company or multi-tenant mode, then you must specify a separate userName and encrypted password for each company. To enable more than one administrator, repeat the steps to encrypt a password for each additional administrator. Use the following syntax and separate each unique entry with a comma:
=LIST(userName,ENC(encryptedValue),userName,ENC(encryptedValue))
Edit the src.encryption.file.name
property to point to the file that contains the encryption key. The default location is c:\\a1.txt
.
src.encryption.file.name=c:\\a1.txt
You specified the name of this file in step 3.
If you used the PBE option in step 3, you must also set the following parameter to true:
src.encryption.pbe.enable=true
(Optional) In the # Miscellaneous Properties section, most properties are set to default values that work for most environments. Change them only if you want different behavior.
In the # Security section, the security mode is set as follows:
src.security.mode=default src.security.ssoEnabled=false
Do not change these settings if you do not want to configure authentication and secure communication now.
To specify Light Weight Single Sign-On (LWSSO), remove the comment symbol (#) that precedes #src.security.mode=lwsso
to specify LWSSO as your communication method
between Service Request Catalog and Service Manager.
Insert the comment symbol in front of the default value.
To enable Single Sign-On with LWSSO, set the src.security.ssoEnabled
property to true
.
You can skip the #Trusted Sign-On section.
To specify Trusted Sign-On (TSO), remove the comment symbol that precedes #src.security.mode=tso
to specify TSO as your communication method
between Service Request Catalog and Service Manager.
Insert the comment symbol in front of the default value.
To enable Single Sign-On with TSO, set the src.security.ssoEnabled
property to true
.
In the #Trusted Sign-On section, specify appropriate values for these parameters:
src.trustStore= src.trustStorePassword= src.keyStore= src.keyStorePassword=
In the # Performance section, the default values are acceptable for most environments. Changing them is optional. Make sure you understand the effect if you replace the default settings.
(Optional) In the # Knowledge Management (KM) section, configure the related parameters if you want to include Knowledge Management in search results.
Service Manager Connector Configuration |
||
Service Manager Protocol: |
sm.protocol=http | This value can be http or https. |
Domain Name: |
sm.hostname=localhost |
Use a fully qualified domain name that can be resolved from this machine. To make sure the query hash feature works properly, you must set sm.hostname as same as the hostname portion of queryhashcode in sm.ini. |
Service Manager Port: | sm.port=13080 | The default values are 13080 for http and 13443 for https. |
Service Manager URL: | sm.target=${sm.protocol}://${sm.hostname}:${sm.port} | Points to your Service Manager, using the previously configured values. Do not change. |
Encryption |
||
Encryption: |
sm.adminCredentials=LIST(falcon,ENC(SucYgJrpriPZxejBHtF9HyW4RxcYiues)) |
Configure a comma-separated list of all the Administrator user names and passwords to optimize catalog caching at startup. For multiple administrators, separate each userName and encrypted password combination with a comma. For example: sm.adminCredentials=LIST(userName,ENC(encryptionValue),userName,ENC(encryptionValue)) |
Encryption Key Location: |
src.encryption.file.name= | Point to the file that contains the encryption key. The default location is c:\\a1.txt. |
Encryption Mode: |
src.encryption.pbe.enable=true |
Changes the encryption method used to generate the encryption key
If this parameter is commented out, the default value is used: |
Miscellaneous Properties |
||
Data Integrity: | src.stopWhenUpdateFailed=true | Stop SRC when it fails to update the catalog from the service connector. |
Web Services: | sm.wsURL=/SM/7/ws | This property verifies the web services exposed by Service Manager. |
Display Name: | sm.rootCategoryDisplayName=ITSM | This property sets the display name of the top level category when you enable multiple catalog providers. For example: The SM Catalog/Hardware Bundles/itemA |
Case Sensitive Queries: | src.sm.contactLookupsToUpper=false | Convert all contact search queries to upper case. Contact search case insensitive. |
Contact Display Property: | src.sm.contactListDisplayPattern=${C} |
The default value for the contact name search result list is If you want to display a different format, you can set a different value. For example, you can specify Pattern for contact search result list ${N} -: Name ${C} -: ContactName ${U} -: FullName ${F} -: FirstName ${L} -: LastName |
Data Source Provider: | src.enabledProviders=sm | For Service Manager, do not change this parameter value. |
Support Catalog: | src.sm.canRequestGenericSupport=true | Change true to false if you want to prevent users from requesting support for an item that is not in the Support Catalog. |
Subscriptions: | src.sm.enableSubscription=true | A value of true enables the Subscriptions tab. Change the value to false to hide the Subscriptions tab. |
Support: | src.sm.enableSupport=true | A value of true enables the Support tab. Change the value to false to hide the Supports tab. |
Services: | src.sm.enableService=true | A value of true enables the Services tab. Change the value to false to hide the Services tab. |
Search Sort Order: | src.search.itemsearch.sortby=HIT_DESC |
|
RequestFor Editable: | src.requestedFor.editable=false | Disables the RequestFor field of a Service item checkout panel. The default value is false. To enable the RequestFor field in the checkout panel, set this property to true. |
Use price for service | src.service.enablePrice=true | A value of true enables the price for service (include the field of cost/recurringPrice/recurringPer) Change the values to false to hide all of price information. |
Use Journal Updates for service | src.sm.service.journalUpdatesEnabled=false | A value of true enables the Journal Updates for service. Change the value to false to hide Journal Updates information. |
Use Journal Updates for support | src.sm.support.journalUpdatesEnabled=false | A value of true enables the Journal Updates for support. Change the value to false to hide Journal Updates information. |
Your Service Requests menu for the Request Inbox |
src.ui.service.enablePendingInbox=true src.ui.service.enableApprovedInbox=true src.ui.service.enableClosedInbox=true src.ui.service.enableDeniedInbox=true |
A value of |
Service menu of the "Your Requests" widget |
src.ui.service.enablePendingOnWidget=true src.ui.service.enableApprovedOnWidget=true src.ui.service.enableClosedOnWidget=false src.ui.service.enableDeniedOnWidget=false |
A value of Note: As widget layout design and widget height limitation, you can not set more than two menu items |
Request button visibility for Service |
src.ui.service.enableDirectRequest=true | A value of false hides the Request buttons in the Search and Browse list views of the Service section.
|
Request button visibility for Support |
src.ui.support.enableDirectRequest=true | A value of false hides the Request buttons in the Search and Browse list views of the Support section. |
Enable Line Items status |
src.ui.service.enableLineItemStatus=true | A value of false hides the Line Items status. |
Enable Auto-complete |
src.ui.enableAutoComplete=false | Enables or disables the auto complete feature in the search box. |
Enable Recurring Cost Indicator |
src.cost.enableRecurringCostIndicator=false |
Enables the indicator for the recurring cost flag on the Request Inbox list. Tip: If you encounter any performance issue in retrieving approval the Request or Interaction Inbox,
set this parameter to |
Additional Contact Information | src.sm.additionalContactInfo=N,F,L,E |
You can specify addition contact info which should display under the contact name as follows: N -: FullName
If you do not wish to use any additional info, you can comment out this line by using the preceding pound (#) character. |
enableFrame | src.enableFrame=false | Specify whether to enable or disable embedding of SRC within standard HTML Web pages by using the FRAME html tag. |
Disable custom field cache | src.disableCustomFieldCache=false |
Enable or disable custom fields cache. The default value is false which means the cache is enabled and custom fields are pre-loaded when the SRC server starts up. Note: Disabling the cache may impact SRC performance. |
Disable catalog item detail cache | src.disableCatalogItemDetailCache=false |
Enable or disable catalog item details cache. The default value is false which means the cache is enabled and item details (including user selection) are cached and shared after the first use by a user. Note: Disabling the cache may impact SRC performance. |
Enable queryHash | src.enableQueryHash=true |
Enable or disable the optional hash key used to encode the URL query. The hash key prevents users from modifying the URL query to view other portions of SRC. The default value is true which means the hash key is enabled. |
Security |
||
Security Mode: | src.security.mode=default |
Choose your security method from the following list to define the communication method between SRC and SM. To specify the security mode, remove the pound sign (#) from the security mode that you want to use, and make sure that a pound sign (#) precedes the other security modes. See the following example, which specifies LW-SSO as the security mode: #src.security.mode=default
src.security.mode=lwsso
#src.security.mode=tso
|
SSO Enabled: | src.security.ssoEnabled=false |
Specify whether SSO (Single Sign-On) is enabled. Note: If you change this flag to true, the src.security.mode value must be either LW-SSO or TSO. If you specified |
Secure Login: | src.security.secureLogin=true | Control the encryption of network communication between the browser and the application server. Set to false if you do not use SSL connection to the web server. |
SSL Port: | src.security.sslPort=8443 | Set the correct value according to your current web server configurations. |
Remember Login User Name: | src.enableRememberLoginUserName=false | Specify whether the "remember login" feature is enabled or disabled in user login panel. |
Trusted Sign-On |
||
Trust Store: | src.trustStore= |
A valid path entry for Windows servers cannot contain blank spaces. For example, Note: Separate each segment of the path with a double backslash (\\), as shown in the following example:
|
Trust Store Password: | src.trustStorePassword= |
Specify the trust store password: src.trustStorePassword=changeit |
Key Store: | src.keyStore= |
Specify the correct path to the key store:
|
Key Store Password: | src.keyStorePassword= |
Specify the keyStorePassword. src.keyStorePassword=password
|
CAC |
src.security.cac=false | Specifies whether Common Card Access is enabled (CAC) |
Native upload |
src.ui.security.nativeUpload=true |
When this parameter is set to true, you can:
Note: This loading progress bar animation is no longer displayed properly if this parameter is set to |
Performance |
||
Refresh: | src.refreshCatalogAfterEvery=1800 | Specify the delay in seconds between each full catalog refresh. For example, 1800 is equivalent to 30 minutes (60 * 30 = 1800). |
Fallback: | src.sm.fallbackToDefaultUserCatalog=true | Use the logged in user catalog if the Request For user has no contact record. HP recommends that you do not change this value to false. |
Max Connections per Host: | src.sm.defaultMaxConnectionsPerHost=25 | Specify a value between 25 to 60 depending on the projected user traffic. Increase this value by 10 for each additional Service Manager node. Do not exceed 60 regardless of the number of Service Manager nodes. For example, if there are more than six Service Manager nodes supported by a load balancer, set this value to 60. |
Max Total Connections: | src.sm.maxTotalConnections=25 | Specify the maximum number of total connections. |
Retry: | src.sm.numberOfRetry=2 | Specify the number of times to try to connect to SM. |
Timeout: | src.sm.connectionTimeout=5 | Specify the value before a connection times out (in seconds). |
Initialization: | src.initCatalogDelay=15 | Specify the delay before the catalog is initialized (in seconds). |
Task Delay: | src.scheduledTaskInitialDelay=30 | Specify the delay before scheduled tasks begin running (in seconds). |
Exchange Rate Delay: | src.refreshExchangeRatesAfterEvery=21600 |
Configure the delay between each scheduled run to refresh exchange Rate (in seconds). Note: The default value is 6 hours * 60 seconds * 60 minutes = 21600 seconds. |
Disable the Delivery Targets drop-down list | src.hideDeliverySLA=false | Hide or display the Delivery Targets drop-down list globally in SRC. The default value is false, which means the Delivery Targets drop-down list is displayed. |
Enable queryHash | src.enableQueryHash=true | Enable or disable queryHash for SRC link. The default value is true which means queryHash is enabled. You can set the parameter to false to disable queryHash. |
Knowledge Management |
||
KM Enabled: | src.km.enabled=false | Specify whether Knowledge Management is enabled. The default value is false . Change to true to enable KM. |
KM Connections Per Host: | km.defaultMaxConnectionsPerHost=1 | The default value is 1 . The number must be greater than 0. |
Total Number of KM Connections: | km.maxTotalConnections=2 |
The default value is |
Refresh KM Stop Words: | sm.km.stopword.expireDuration=600 |
Stop words are words that KM ignores during searches, such as the word "the." SRC caches KM stop words and refreshes that cache at specified intervals (in seconds). The default value is 600 seconds. |
Refresh KM Attachments | sm.km.attachment.refreshKMAttachmentAfterEvery=600 |
SRC caches attachments and refreshes that cache at specified intervals (in seconds). Example: 6 hours * 60 seconds * 60 minutes = 21600 seconds. The default value is 600 seconds. |
KM Configuration: | src.search.results.main.section=service |
The search results page displays results by type. Specify which results pane should appear in the center of the page. You may set this value as shown in the following: Service Catalog=service Support Catalog=support Knowledge Management=knowledge The default behavior is to display the Service Catalog results in the center of the page. |
KM Doctype cache refresh: | sm.km.doctype.expireDuration=1800 | Specify the duration to wait to refresh the KM doctype cache (in seconds). |
Note: The following only provides you one of the methods to configure the Java options. For more methods, refer to the Apache Tomcat site: http://tomcat.apache.org/.
To configure the Java options, follow these steps:
C:\...\apache-tomcat-7.0.x\bin
C:\...\apache-tomcat-7.0.x\bin\tomcat7w.exe
-XX:MaxPermSize=128m
1024
.Navigate to this Apache Tomcat installation directory by running the following command:
cd opt/.../apache-tomcat-7.0.x/bin
Create a new shell script file named setenv.sh:
vi setenv.sh
Copy the following settings to the file:
JAVA_OPTS='-XX:MaxPermSize=128m -Xmx1024m '
Note: You can increase the amount if you have some other applications running in this container.
There are a variety of authentication scenarios that require additional tasks. The number of tasks depend on the configuration settings you specified.
The difference among these scenarios is your preferred authentication method:
Another consideration is whether you want encryption using SSL. The following tables describe each scenario and the remaining configuration steps.
Method | Communication | Remaining steps |
---|---|---|
External Authentication | TSO | Configure basic authentication |
SSL is required | ||
Configure TSO Properties |
Method | Communication | Remaining steps |
---|---|---|
External Authentication | LW-SSO | Configure basic authentication |
SSL is Optional | ||
Configure LWSSO Properties |
Method | Communication | Remaining steps |
---|---|---|
LW-SSO Compatible Authentication | LW-SSO | Configure basic authentication |
SSL is optional | ||
Configure LWSSO Properties |
External authentication
HP customers often use external methods, such as SiteMinder or Active Directory, to authenticate their users. The typical scenario is to authenticate the user once (pre-authentication) and then enable that user to access resources or other applications without additional login or authentication procedures. For example, an employee would log in one time to the corporate intranet and then be able to access Service Request Catalog to request services and support. If you are an HP customer, consultant, or partner, read this document to learn how to implement a single sign-on solution for Service Request Catalog using a pre-authentication method with a REMOTE_USER HTTP header value.
Before you begin
Verify that you completed all steps to deploy and configure Service Request Catalog. There are common tasks that you need to complete for all supported authentication scenarios.
Unix
All commands are shown in Windows format. For Unix installations, convert them to match your local Unix path conventions.
OpenSSL is an open source toolkit for the SSL protocol that contains a variety of utility functions. You can obtain the OpenSSL toolkit from a variety of sources. You will need it to complete required tasks.
You can obtain OpenSSL if you install Cygwin, which is available at
http://www.cygwin.com/
Although Cygwin has multiple components, you need only the following:
Install it in a directory that you can easily navigate to at the command line. Example: C:\cygwin.
You need OpenSSL on both the Service Request Catalog and Service Manager servers. You can simplify running openssl commands if you create an environment variable that specifies the openssl location: cygwin\bin\openssl.
Cygwin is governed by the GNU General Public License.
Verify: Open the Cygwin Command Prompt window by double-clicking C:\cygwin\Cygwin.bat. You will need this window later. Confirm that you have OpenSSL available by typing this command:
openssl -help
Tip: If a command fails when you run openssl commands that reference files in various locations, the problem may be that you are not running the command from the file directory, or you do not have an environment variable defined for openssl that enables you to run from any directory.
Make sure there is a JAVA_HOME environment variable configured on the Service Manager server and on the Service Request Catalog server. Service Manager installs a complete JRE in this location:
C:\Program Files\HP\Service Manager 9.30\Server\RUN\jre\bin
.
Verify: Open a Windows Command Prompt window. Confirm that you have the keytool application available by typing this command at the prompt:
keytool -help
If an error message appears, confirm that you have JAVA_HOME configured correctly and that it includes the \bin folder in that path.
On the Service Request Catalog server, JAVA_HOME should point to the same Java instance used by Tomcat.
Note: Each instance of a Java Runtime or Java Developer’s Kit contains a ...\lib\security\cacerts file. Some test or production servers could have more than one version installed. It is important that you consistently reference the same Java instance that is used by Tomcat.
During the configuration process, you need to access certain folders and files. Create a separate Windows Explorer window for each.
C:\Program Files\HP\Service Manager 9.30\Server\RUN
C:\Program Files\Java\jdk1.6.0_20\jre\lib\security\cacerts
Example: C:\...\src-9.35\_TSO\
.war
file. You will need to access these files:
C:\...\src-9.35\WEB-INF\classes\applicationContext.properties
C:\...\src-9.35\WEB-INF\classes\lwssofmconf.properties
Tip: Set up separate windows for each of these folders and files ahead of time to speed up the configuration process. Arranging them side by side will make it easy to switch from one to the other.
HP recommends that you verify that the Service Request Catalog server and the Service Manager server can communicate. From the Service Request Catalog server, open a Command Prompt window and ping the Service Manager server using its fully qualified domain name.
If you have any communications failures, add the fully qualified domain name and IP of the other server to the local Hosts file.
Note: Keep both Command Prompt windows open. You will need them to complete subsequent steps.
These tasks support the transfer of encrypted data between Service Request Catalog and the Service Manager server. To configure SSL for Service Request Catalog, follow these steps:
Follow these steps only if you do not have a digital security certificate issued by a certificate authority provider, such as Verisign, Thawte, or your corporate certificate authority. The digital certificate contains a public key, the identity of the owner, and a matching private key. The certificate is required to encrypt data sent and received in a “trusted” environment. If you do not have a digital certificate from an external provider, you must create your own certificate to enable encrypted data transfer between the Service Manager server and the trusted Service Request Catalog application.
From the Cygwin Command Prompt window, change directories and navigate to the new folder you created to contain Trusted Sign-On files.
Example: cd "C:\...\src-
9.35\_TSO\"
From this directory, run the following openssl commands to generate a private key for the certificate authority.
Command | Description |
---|---|
genrsa | Generate an RSA private key |
-des3 | A cipher methodology |
-passout pass: | Specify a password for the created file |
-out filename.pem | Create an output file |
Copy and paste this command into your Cygwin Command Prompt window:
openssl genrsa -des3 -passout pass:changeit -out certificateAuthorityKey.pem 1024
Caution: Copy and paste is a shortcut to reduce typing errors and improve efficiency. However, the commands may be long with many parameters. Make sure you copy the entire command, even when it wraps over multiple lines. When you paste it into the Command Prompt window, it will appear as a single line.
Verify: This folder should contain a new file named certificateAuthorityKey.pem.
The following openssl commands generate a self-signed certificate for the certificate authority.
Command | Description |
---|---|
req | Request a certificate |
-new | The certificate is new |
-x509 | x509 is a self-signed certificate utility (For more information, see www.openssl.org) |
-days | 365 Expires after one year |
-key certificateAuthorityKey.pem | Specify the certificate file name name |
-passin pass: | Specify a password for the certificate file |
-subj "/CN=www.xxx.com" | If you were using an external certificate authority, this would be their domain name. Because we are creating our own, the domain is not relevant but the command must have some reference. |
-out filename.pem | Create this certificate file |
Copy and paste this command into your Cygwin Command Prompt window:
openssl req -new -x509 -days 365 -key certificateAuthorityKey.pem -passin pass:changeit -subj "/CN=www.xxx.com" -out certificateAuthorityCert.pem
Verify: This folder should contain a new file named certificateAuthorityCert.pem
From the Windows Command Prompt window, navigate to the new folder you created to contain Trusted Sign-On files.
Example: C:\...\src-
\_TSO\
The following keytool commands generate a public/private key pair for Service Request Catalog. The trusted certificate entry is stored in an entity known as a keystore. For more information about keytool, see www.oracle.com.
Command | Description |
---|---|
-genkey | Generate a key pair, which contains a public key and associated private key pair |
-dname "CN=fqdn" | Specify the fully qualified domain name of the Service Request Catalog server |
-validity 365 | Expires after one year |
-alias alias_name | Creates a unique name, or alias, for a new trusted certificate entry. In this case, use src as the alias_name. |
-keypass | Specify a password for the certificate file. |
-keystore | Specify the name of the Service Manager keystore file. |
-storepass | Specify a password for the keystore file. |
Copy and paste this command into your Windows Command Prompt window:
keytool -genkey -dname "CN=fqdn" -validity 365 -alias src -keypass changeit -keystore srcKeystore.jks -storepass changeit
Tip: Copy it into a plain text file first, substitute your fully qualified domain name for fqdn, and then copy and paste it into the command line. Make sure you use the fully qualified domain name, not an IP address. A fully qualified domain name looks like this: server.name.qualifier.
Verify: This folder should contain a new file named srcKeystore.jks.
The following keytool commands generate a Certificate Signing Request (CSR) for Service Request Catalog.
Command | Description |
---|---|
-certreq | Generate a Certificate Signing Request (CSR) |
-alias alias_name | src is the alias name |
-file | The file name is srcCSR.pem |
-keypass | Specify a password for the .pem file |
-keystore | Specify the name of the Service Request Catalog keystore file. |
-storepass | Specify a password for the keystore file. |
Copy and paste this command into your Windows Command Prompt window:
keytool -certreq -alias src -file srcCSR.pem -keypass changeit -keystore srcKeystore.jks -storepass changeit
Verify: This folder should contain a new file named srcCSR.pem.
Return to your Cygwin Command Prompt window.
Run the following openssl commands to sign the CSR that you created in step 6.
Command | Description |
---|---|
x509 | x509 is a self-signed certificate utility (For more information, see www.openssl.org) |
-req | Request a certificate |
-in filename.pem | CSR file name |
-CA filename.pem | File name of the certificate to be signed |
-CAkey filename.pem | File that contains the private key |
-passin pass: | Specify the password for the key file |
-days 365 | Expires in one year |
-set_serial | Optional. Serial number of the file (Can replace the -CA parameter) |
-out filename.pem | Create an output file for the signed certificate |
Copy and paste this command into your Cygwin Command Prompt window:
openssl x509 -req -in srcCSR.pem -CA certificateAuthorityCert.pem -CAkey certificateAuthorityKey.pem -passin pass:changeit -days 365 -set_serial 1 -out srcCert.pem
Verify: You should see these messages display in the command window:
Signature ok
subject=/CN=yourFQDN
Getting CA Private Key
This folder should contain a new file named srcCert.pem.
Return to your Windows Command Prompt window.
The following keytool commands import the Certificate Authority certificate into the Service Request Catalog keystore file.
Command | Description |
---|---|
-importcert | Read the certificate (or certificate chain) from the file and put it in the alias keystore |
-noprompt | No user input required |
-alias alias_name | certificateAuthority is the alias name for the certificateAuthorityCert.pem file |
-keypass | Specify the password for the certificateAuthorityCert.pem file |
-file | The file name is certificateAuthorityCert.pem |
-keystore | Specify the name of the Service Request Catalog keystore file |
-storepass | Specify the password for the Service Request Catalog keystore file |
Copy and paste this command into your Windows Command Prompt window:
Keytool -importcert -noprompt -alias certificateAuthority -keypass changeit -file certificateAuthorityCert.pem -keystore srcKeystore.jks -storepass changeit
Verify: You should see the following message display in the command window.
Certificate was added to keystore
The following keytool commands import the signed certificate file for Service Request Catalog into the Service Request Catalog keystore file.
Command | Description |
---|---|
-importcert | Read the certificate (or certificate chain) from the file and put it in the alias keystore |
-alias alias_name | src is the alias for the srcCert.pem |
-keypass | Specify the password for srcCert.pem file |
-file | The file name is certificateAuthorityCert.pem |
-keystore | Specify the name of the Service Request Catalog keystore file |
-storepass | Specify the password for the Service Request Catalog keystore file |
Copy and paste this command into your Windows Command Prompt window:
keytool -importcert -alias src -keypass changeit -file srcCert.pem -keystore srcKeystore.jks -storepass changeit
Verify: You should see the following message display in the command window.
Certificate reply was installed in keystore
If you support Trusted Sign-On authentication, these steps are required. Use either a digital security certificate issued by a certificate authority provider or a self-signed certificate to complete the task.
Complete these steps in the Windows Command Prompt window on the Service Request Catalog server.
Navigate to your JAVA_HOME location where the cacerts file resides.
Example: C:\...\jre\lib\security\cacerts
Navigate to the folder that you created to store new security files related to Trusted Sign-On.
Example: C:\...\src-\_TSO\
Copy the following file:
C:\...\src-\_TSO\certificatAuthoritycert.pem
Paste the file from step 3 in the JAVA_HOME location where the cacerts file resides:
Example: C:\...\jre\lib\security\certificatAuthoritycert.pem
Copy the following file:
C:\...\src-\_TSO\certificatAuthorityKey.pem
Verify: The result should be two new files in the same folder that contains the cacerts file.
C:\...\jre\lib\security\cacerts
C:\...\jre\lib\security\certificatAuthoritycert.pem
C:\...\jre\lib\security\certificatAuthorityKey.pem
Import the signing certificate authority's public certificate into the cacerts file to establish a chain of trust. To do this, execute the following command:
keytool -importcert -noprompt -alias certificateAuthority -keypass changeit -file certificateAuthorityCert.pem -keystore cacerts -storepass changeit
Verify: The keytool application displays the following confirmation message:
Certificate was added to the keystore.
Copy the files in the following steps from the Service Request Catalog server to the Service Manager server before you start the next task.
From your JAVA_HOME location on the Service Request Catalog server, copy the following file:
C:\...\jre\lib\security\cacerts
On the Service Manager server, paste the file into the following folder:
C:\Program Files\HP\Service Manager 9.30\Server\RUN
On the Service Request Catalog server, copy the following self-signed certificate and key files:
certificateAuthorityCert.pem
certificateAuthorityKey.pem
Paste the files from step 3 into the following folder:
C:\Program Files\HP\Service Manager 9.30\Server\RUN
If you support Trusted Sign-On authentication, and you do not have a digital security certificate issued by a certificate authority provider, such as Verisign, Thawte, or your corporate certificate authority, the following steps are required. You will need the same certificate authority that you used to create your own keystore and certificate for Service Request Catalog.
Complete this task on the Service Manager server to enable encrypted data transfer between the Service Manager server and the trusted Service Request Catalog application.
In a Windows Command Prompt window, navigate to the following folder:
C:\Program Files\HP\Service Manager 9.30\Server\RUN
From this directory, run keytool.exe to generate a public/private key pair for Service Manager. To do this, copy and paste the following command into your Windows Command Prompt window:
keytool -genkey -dname "CN=fqdn" -validity 365 -alias sm -keypass changeit -keystore smKeystore.jks -storepass changeit
Tip: Copy it into a plain text file first, substitute your fully qualified domain name, and then copy and paste it into the command line.
Verify: The C:\Program Files\HP\Service Manager 9.30\Server\RUN directory contains a new file named smKeystore.jks.
Run keytool.exe again to generate a Certificate Signing Request (CSR) for Service Request Catalog. Copy and paste this command into your Windows Command Prompt window:
keytool -certreq -alias sm -file smCSR.pem -keypass changeit -keystore smKeystore.jks -storepass changeit
Verify: The C:\Program Files\HP\Service Manager 9.30\Server\RUN directory contains a new file named smCSR.pem.
Open a Cygwin Command Prompt window on the Service Manager server and navigate to the following folder:
C:\Program Files\HP\Service Manager 9.30\Server\RUN
Run openssl with the following commands to sign the CSR. To do this, copy and paste the following command into your Cygwin Command Prompt window:
openssl x509 -req -in smCSR.pem -CA certificateAuthorityCert.pem -CAkey certificateAuthorityKey.pem -passin pass:changeit -days 365 -set_serial 1 -out smCert.pem
Verify: You should see these messages display in the command window, and the folder should contain a new file named smCert.pem:
Signature ok
subject=/CN=<yourFQDN>
Getting CA Private Key
Run keytool.exe again to import the Certificate Authority certificate into the Service Manager keystore file. To do this, copy and paste the following command into your Windows Command Prompt window:
keytool -importcert -noprompt -alias certificateAuthority -keypass changeit -file certificateAuthorityCert.pem -keystore smKeystore.jks -storepass changeit
Verify: You should see the following message displayed in the command window:
Certificate was added to keystore
Run keytool.exe again to import the signed certificate file for Service Manager into the Service Manager keystore file. To do this, copy and paste this command into your Windows Command Prompt window:
keytool -importcert -alias sm -keypass changeit -file smCert.pem -keystore smKeystore.jks -storepass changeit
Verify: You should see the following message displayed in the command window:
Certificate reply was installed in keystore
On the Service Request Catalog server, copy the Service Request Catalog self-signed certificate file:
srcCert.pem
Paste the srcCert.pem file into the following folder on the Service Manager server:
C:\Program Files\HP\Service Manager 9.30\Server\RUN
Run keytool.exe with the following commands to import the Service Request Catalog certificate as a trusted client of Service Manager:
keytool -importcert -noprompt -alias src -keypass changeit -file srcCert.pem -keystore clientcerts.keystore -storepass changeit
Verify: The keytool application should display the following confirmation message:
Certificate was added to the keystore
If Lightweight Single Sign-On (LW-SSO) is enabled in Service Request Catalog, integrations from other HP products will bypass Service Manager authentication when launching Service Request Catalog, provided that the HP product user is already authenticated and a proper token is used.
Note:
http://<mySrcHostName>.<myDomain>:<port>/src/
The following procedure is provided as an example, and assumes Service Request Catalog is deployed on a Tomcat Web application server.
To configure LW-SSO in the Service Request Catalog, follow these steps:
<!-- LWSSO listener for integrations using HP lightweight single sign-on. --> <!-- <listener> <listener-class>com.hp.sw.bto.ast.security.lwsso.conf.LWSSOContextListener</listener-class> </listener> <context-param> <param-name>com.hp.sw.bto.ast.security.lwsso.conf.fileLocation</param-name> <param-value>lwssofmconf.xml</param-value> </context-param> --> <!-- LWSSO filter for integrations using HP lightweight single sign-on. --> <!-- <filter> <filter-name>LWSSO</filter-name> <filter-class>com.hp.sw.bto.ast.security.lwsso.LWSSOFilter</filter-class> </filter> <filter-mapping> <filter-name>LWSSO</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> -->
<initString>: Password used to connect HP products (minimum length: 12 characters). For example, smintegrationlwsso. Make sure that this value is the same as those used in the LW-SSO configurations of the other HP products (such as Operations Orchestration, and Business Service Management), which you want to connect via LW-SSO.
<multiDomain>: The <multiDomain> element should include the domain names (DNSDomain), server names (NetBiosName), IP addresses (IP), fully-qualified domain names (FQDN) of the Service Manager web tier server and other product servers (for example, the Release Control server).
Note: The multi-domain functionality is relevant only for UI LW-SSO (not for web services LW-SSO). In addition, you must set the multiDomain element in each product for which you want to support LW-SSO. The multi-domain functionality is based on the HTTP referrer. Therefore, LW-SSO supports links from one application to another and does not support typing a URL into a browser window, except when both applications are in the same domain.
The following is an example of a configured lwssofmconf.xml file:
<?xml version="1.0" encoding="UTF-8"?>
<lwsso-config xmlns="http://www.hp.com/astsecurity/idmenablmentfw/lwsso/2.0">
<enableLWSSO enableLWSSOFramework="true"
enableCookieCreation="true"
enableAutoCookieCreation="true"
cookieCreationType="LWSSO"
enableSAML2Support="false" />
<webui>
<validation>
<in-ui-lwsso>
<lwssoValidation id="ID000001">
<domain>hp.example.net</domain>
<!-- lw -->
<crypto cipherType="symmetricBlockCipher"
engineName="AES" paddingModeName="CBC" keySize="256"
encodingMode="Base64Url"
initString="This is a shared secret passphrase"> </crypto>
……
</lwssoValidation>
</in-ui-lwsso>
<in-lwssoAutoCreate enableAutoCookieCreation="true" enableUserReplacement="true" refid="ID000002"/>
<validationPoint
enabled="false"
refid="ID000002"
authenicationPointServer="http://psinghal2.americas.hpqcorp.net:8080/bsf"/>
</validation>
<creation>
<lwssoCreationRef id="ID000002" useHTTPOnly="true">
<lwssoValidationRef refid="ID000001"/>
<expirationPeriod>30</expirationPeriod>
</lwssoCreationRef>
</creation>
<logoutURLs>
<url>.*logout.jsp</url>
</logoutURLs>
<multiDomain>
<trustedHosts>
<DNSDomain>hp.example.net</DNSDomain>
<DNSDomain>emea.example.net</DNSDomain>
</trustedHosts>
</multiDomain>
</webui>
<lwsso-plugin type="SpringSecurity">
<roleIntegration rolePrefix="ROLE_"
fromLWSSO2Plugin="internal"
fromPlugin2LWSSO="disabled"
caseConversion="upperCase"/>
</lwsso-plugin>
</lwsso-config>
Your applications.Context properties files should resemble the following:
#src.security.mode=default
src.security.mode=lwsso
#src.security.mode=tso
To enable Single Sign-On with LWSSO, set the src.security.SSOenabled property to true.
To set up Trusted Sign-On between Service Request Catalog and the Service Manager server, follow these steps:.
Make sure the Certificates have been created. Please reference “Configure SSL” section to create Certificates and make sure the following Certificates have been created for Service Request Catalog and Service Manager.
CA Certificate: cacerts
Client Key Store: srcKeystore.jks
Server Key Store: smKeystore.jks
Trusted Client Key Store: clientcerts.keystore
applicationContext.properties
file settings on the Service Request Catalog server are correct. To do this, follow these steps:Open the applicationContext.properties
in a text editor. You can find this file in the following directory:
C:\...\src-
\WEB-INF\classes\applicationContext.properties
Locate the # Service Manager Connector Configuration settings and then verify that the http security protocol is used.
sm.protocol=https
Verify that the hostname is correct.
sm.hostname=xxx.xxx.xxx.xxx
Verify that the port is responding to https.
sm.port=13443
Locate the # Security Mode: settings and remove the a comment symbol (#) and space that precedes TSO if present, and there is a comment symbol (#) and space before the default mode parameter:
# src.security.mode=default
# src.security.mode=lwsso
src.security.mode=tso
To enable TSO, set the src.security.SSOenabled property to true
.
Note: Assume that the Certificate files are saved in Directory c:\_TSO.
src.trustStore=C:\\_TSO \\cacerts
src.trustStorePassword=changeit
src.keyStore=C:\\ _TSO \\ srcKeystore.jks
src.keyStorePassword=changeit
server.xml
file on Tomcat are set to get REMOTE_USER from the HTTP Header. To do this, follow these steps:Locate # Define an AJP 1.3 Connector on port 8009 settings.
Verify that the property tomcatAuthentication
is set to false
.
<Connector port="8009" enableLookups="false" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false" />
Configure Service Request Catalog for Tablets to use a TSO-enabled Service Manager
Service Request Catalog does not support Trusted Sign On (TSO) through a tablet. Service Request Catalog can only work for a tablet under basic authentication mode.
For desktop Service Request Catalog users whose Service Manager is already configured to use TSO, you can continue to use TSO after you upgrade the Service Request Catalog to this version. However, the administrator must configure a new web application instance of Service Request Catalog specifically for use with tablets as follows and all tablets must connect to this application instance:
Make sure the following Certificates have been created for Service Request Catalog and Service Manager:
CA Certificate: cacerts
Client Key Store: srcKeystore.jks
Server Key Store: smKeystore.jks
Trusted Client Key Store: clientcerts.keystore
For more information on how to create Certificates, see the “Configure SSL” section in the Service Request Catalog 9.33 Installation Guide.
Locate the # Service Manager Connector Configuration settings section and then verify that the https security protocol is used:
sm.protocol=https
Verify that the hostname is correct:
sm.hostname=<full domain name>
Example:
sm.hostname=SRC36.xxxx.hp.net
Verify that the port is set to https:
sm.port=13443
Use “default” as Security Mode:
src.security.mode=default
#src.security.mode=lwsso
#src.security.mode=tso
Disable the SSO Mode:
src.security.SSOenabled=false
Locate # Trusted Sign-On settings section and then verify that the Certificate path and password are set correctly for your environment:
src.trustStore=C:\\ cert \\cacerts
src.trustStorePassword=changeit
src.keyStore=C:\\ cert \\ srcKeystore.jks
src.keyStorePassword=changeit
Note: Assume that the Certificate files are saved in Directory c:\cert.
Set the Service Request Catalog Server URL port to the port number defined in conf/server.xml in the Tomcat folder. By default, the port number is 8080.
For example, set the Service Request Catalog Server URL to http://<SRC Server Address>:8080/<SRC App Server Name> in the Service Request Catalog client on the tablet before you connect to the Service Request Catalog server. Note that the client will not connect to a pre-authentication server where SSO is enabled. Instead, the client connects to the Service Request Catalog web server directly by using the basic authentication mode (that is, a pop-up login page appears, and the user must log in with a user name and password).
To enable Common Access Cards (CAC) for SRC, follow these steps:
Enable CAC in Service Manager. To do this, use the cacsign on parameter from a Service Manager command line, or specify it in the sm.ini file.
Command line: sm -httpPort:13080 -cacsignon:1 Initialization file: cacsignon:1
For more information on this parameter, see the following section of the Service Manager Help Center:
Complete the following tasks from the "Example: enabling CAC sign-on" section of the Service Manager Help Server.
Task 1. Enable required SSL encryption and trusted clients. Task 2. Enable CAC sign-on in the SM server. Task 5. Connect your web application server to the web server. Task 6. Configure your web application server to use SSL. Task 7. Configure the web server to use SSL. Task 8. Create operator records for CAC users Task 9. Configure web browsers to enable web client users to use CAC. Task 10. Test your CAC sign-on setup.
Note:
The following tables show a summary of how your property files should be configured after you have enabled CAC:
Configure these properties | Comments | |
---|---|---|
sm.protocol= sm.hostname= sm.port=13443 src.trustStore= src.trustStorePassword= src.keyStore= src.keyStorePassword= |
Enables two-way SSL between SRC and Service Manager. Note: The keys are generated when you complete "Task 1. Enable required SSL encryption and trusted clients." See the previous note for details. sm.protocol=https sm.hostname=[FQDN] sm.port=13443 src.trustStore=C:\\client\\cacerts src.trustStorePassword=changeit src.keyStore=C:\\client\\src.keystore src.keyStorePassword=clientkeystore |
|
src.security.mode=cac src.security.cac=true |
Enables CAC. | |
src.security.secureLogin=true src.security.sslPort=8443 |
Enables SSL Connection between SRC and the end user's client browser. |
Configure these properties | Comments | |
---|---|---|
certificateFieldExtractDN=Subject.CN |
This parameter is used to get the field in the certificate that stores the login name. If the DN is from one of the fields in the Subject, set this parameter using the following format: Subject.CN Subject.CN means extracting the DN from the Common Name field in Subject. |
|
validationStrategy=1 |
Client Certificate Verification Sequence is as follows:
|
|
RootCertPath= |
Specifies file path to the issuer CA certificate. This is a mandatory property. Example: RootCertPath=C:/client/CAC/hp_ca_for_cac.cer |
|
CRLRefreshScheduler= |
Specifies a schedule in minutes for CRL refresh, if CRL check is enabled. Example: CRLRefreshScheduler=1440 |
|
CRLDownloadURL= |
The URL that identifies the location of the CRL. If it is not specified, the CRL Distribution Point from the certificate being validated will be used. This behavior will slow performance dramatically. CRLDownloadURL=http://onsitecrl.example.com/LatestCRL.crl |
|
CRLStoreLocation= |
Specifies the CRL file path. |
|
OCSPResponderURL= |
The URL that identifies the location of the OCSP responder. By default, the location of the OCSP responder is determined implicitly from the certificate being validated. This property is used when the Authority Information Access extension (defined in RFC 3280) is absent from the certificate or when it requires overriding. OCSPResponderURL=http://ocsp.example.net:80 |
After you install the Service Request Catalog 9.35 application, there are tasks to refine your Service Manager environment.
Service Manager best practices recommend assigning user roles that carry all the required capability words to be successful at their tasks. The required capability word for Service Request Catalog is service catalog. The service catalog capability word allows a user to request items from the service catalog. Other capability words may be required for role-based scenarios.
Related capability words
To use SRC a user must have the SOAP API Capability word plus at least one of the other capability words from the following table.
Capability word | Description |
---|---|
SOAP API (Required) | The capability word must be added to enable the user to log in to SRC. Otherwise, a “invalid user” error message may pop up. |
svcCatDeptRequester (Optional) | An employee can request items from the catalog on behalf of a department. |
svcCatEmployeeRequester (Optional) | An employee can request items from the catalog. |
svcCatManagerRequester (Optional) | A manager can request items from catalog. |
svcCatRequestOnBehalf (Optional) | A user can request items on for another employee. |
Request for another person
You can order catalog items and services for another person only if the svcCatRequestOnBehalf
capability word is part of your user profile.
Mass update
As an administrator, you can apply new capability words to a large group of users in a single operation. Follow the steps in Service Manager documentation that describes the mass update feature to apply a capability word to the user profile of a group of users.
Service Manager administrators should make sure Service Request Catalog and Service Manager timeout settings match.
C:\Program Files\HP\Service Manager n.nn\Server\RUN\sm.ini
/opt/..../HP/Service Manager n.nn/Server/RUN/sm.ini
C:\...\src\WEB-INF\web.xml
/opt/..../src/WEB-INF/web.xml
The sm.ini file should have a setting for webservices_sessiontimeout. Example:
webservices_sessiontimeout:1800
This value is expressed in seconds. (1800 seconds = 30 minutes)
<session-config>
<session-timeout>30</session-timeout>
</session-config>
Note: This value is expressed in minutes. (30 minutes = 1800 seconds). The minimum value allowed is 3 minutes (180 seconds).
When you complete all the basic configuration tasks, you are ready to start Service Request Catalog. Make sure the Service Manager server is running before you start Service Request Catalog.
Start Apache Tomcat:
Go to the Control Panel > Administrative Tools > Services dialog to start the Apache Tomcat service.
Run /opt/...../apache-tomcat-7.0.x/bin/startup.sh
Type this URL into a supported browser window:
http://hostname.domainName:nnnn/src/
In this URL, hostname.domainName
is a placeholder for the fully qualified domain name of the Tomcat server, and :nnnn
is the Tomcat port number on that server. The exact format of the URL depends on how you configured the path parameter when you installed Service Request Catalog.
There are a large number of optional task you may also wish to perform. The steps for these optional tasks are detailed in the Service Request Catalog Customization Guide. Therefore, for specific instructions on how to perform the following tasks, you should review that guide.
The following list shows some of the most important tasks you may wish to consider after you have installed Service Request Catalog. Note that some tasks may require you to restart Service Request Catalog:
There are many other potential customizations that are described in the Customization Guide.
If you are a system administrator, read this section to discover how to troubleshoot some common problems that you might encounter when you use Service Request Catalog.
Lucene is an open source Java search engine that Service Request Catalog uses to create indexes from downloaded catalog data. Luke is a diagnostic tool that enables you to view or modify the Lucene indexes in the catalog. For more information, see the Luke project site at http://code.google.com/p/luke/.
To use Luke, follow these steps.
lukeall-3..0.jar
..jar
file to run Luke. The Luke Toolbox appears.C:\src
, the path index would be C:\src\secure\luceneIndexedData
You can view catalog items and fields within an index. You can also search for a specific item. Use this tool to troubleshoot catalog download problems.
Charles enables you to monitor Internet requests and responses, including the internet traffic between Service Request Catalog and Service Manager. Use Charles to troubleshoot communication issues. For more information, see the Charles project site at www.charlesproxy.com.
To use Charles, follow these steps.
charles_setup.exe
..exe
file to install Charles.Charles functions as a play/record mechanism to track and troubleshoot internet activity.
You can set the log4j properties to provide more log information. To do so, follow these steps:
Navigate to this location
src-9.35\WEB-INF\classes
log4j.properties
with a text editor. Log4j parameters typically have these settings. Locate this property and change the logging level to increase (or decrease) the amount of log information captured during communication between Service Request Catalog and Service Manager.
log4j.rootLogger=TRACE, stdout, rolling
You can also change the log level for packages to increase or decrease the log size. For more information about additional settings, see the documentation for the Apache Software Foundation log4j logging utility.
If you have upgraded from a previous version of Service Manager or if you import some catalog items from a .unl file in Service Manager, the svcCatalogMix script must be run in Service Manager before you start SRC.
This script updates the Service Catalog records in older versions of Service Manager as one of the following types:
To execute the script, follow these steps:
Not enough memory to load the catalog.
If you see one of these messages:
java.lang.OutOfMemoryError: PermGen space at java.lang.Throwable.getStackTraceElement(Native Method)
java.lang.OutOfMemoryError
Follow these steps to fix index problems:
Service Request Catalog installation directory\secure\luceneIndexedData
folder. For example, if you deploy the Service Request Catalog application in a folder named C:\src
, the path index would be C:\src\secure\luceneIndexedData
luceneIndexedData
folder.C:\src\secure\attachments
directoryDelete files that begin with "version" as shown in the following example:
C:\src\secure\attachments\version*.*
Connection errors occur when the Service Manager server is unavailable or your connection information is invalid
I/O error: Connection refused: connect; nested exception
Unable to authenticate and therefore load the catalog
If you receive one of these messages, follow these steps to resolve:
Make sure the Service Manager server is running and you can access the Service Manager server wsdl from the browser by typing:
http://fqdn:portnumber/SM/7/ServiceCatalogAPI.wsdl
For example: http://myserver:13088/SM/7/ServiceCatalogAPI.wsdl
Verify the Service Manager server connection information is correct in the applicationContext.properties
file. You can locate this file in the Service Request Catalog installation directory. For example:
C:\src\WEB-INF\classes\applicationContext.properties
Verify these properties are accurate:
serviceManager.hostname=<IP or hostname>
serviceManager.port=<PortNumber>
serviceManager.adminCredentials=LIST (username, ENC(EncryptedPassword))
If a user logs into Service Request Catalog and then logs out, the session may still appear to be active on the Service Manager server. This may happen if there is a Load Balancer managing traffic between the Service Request Catalog and Service Manager nodes. In this case the Load Balancer is not able to maintain session stickiness between the Service Request Catalog and Service Manager nodes.
The solution is to configure the Load Balancer for session stickiness using the http cookie value JSESSIONID
and assign it to the Service Manager node.
Best practices
applicationContext.properties
file while Tomcat is still running.Do not set the max logins value in a user's operator record in Service Manager below the default value of 2.
Note: When you close the browser tab or browser window without logging out SRC, the current session is terminated in 15 to 30 seconds instead of being terminated immediately. When you log in to SRC again during this period, the following error message may occur:
<Message: Login failed. Maximum active logins for this user exceeded.>
To prevent this from happening, you can set the value of max logins to 3 or a bigger number.
applicationcontext.properties
.
Login problems
Send documentation feedback to HP
We welcome your comments!
To open the configured email client on this computer, open an email window.
Otherwise, copy the information below to a web mail client, and send this email to ovdoc-itsm@hp.com.
© 2010-2015 Hewlett-Packard Development Company, L.P.
The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
The information contained herein is subject to change without notice.
Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.
© 2010-2015 Hewlett-Packard Development Company, L.P.
Adobe® is a trademark of Adobe Systems Incorporated.
Java is a registered trademark of Oracle and/or its affiliates.
Microsoft® and Windows® are U.S. registered trademarks of Microsoft Corporation.
Oracle® is a registered US trademark of Oracle Corporation, Redwood City, California.
UNIX® is a registered trademark of The Open Group.
For a complete list of open source and third party acknowledgements, visit the HP Software Support Online web site and search for the product manual called HP Service Request Catalog Open Source and Third Party License Agreements.
About this document:
To check for recent updates or to verify that you are using the most recent edition of a document, go to:
https://softwaresupport.hp.com
This site requires that you register for an HP Passport and sign in. To register for an HP Passport ID, go to:
http://h20229.www2.hp.com/passport-registration.html
Or click the New users - please register link on the HP Passport login page.
You will also receive updated or new editions if you subscribe to the appropriate product support service. Contact your HP sales representative for details.
About this document:
To check for recent updates or to verify that you are using the most recent edition of a document, go to: www.hp.com/go/livenetwork. This site requires that you register for an HP Passport and sign in. To register for an HP Passport ID, go to: http://h20229.www2.hp.com/passport-registration.html
Or click the New users - please register link on the HP Passport login page.
Visit the HP Software Support Online website at: https://softwaresupport.hp.com
This website provides contact information and details about the products, services, and support that HP Software offers.
HP Software online support provides customer self-solve capabilities. It provides a fast and efficient way to access interactive technical support tools needed to manage your business. As a valued support customer, you can benefit by using the support website to:
Most of the support areas require that you register as an HP Passport user and sign in. Many also require a support contract. To register for an HP Passport ID, go to:
http://h20229.www2.hp.com/passport-registration.html
To find more information about access levels, go to:
http://h20230.www2.hp.com/new_access_levels.jsp
HP Software Solutions Now accesses the HPSW Solution and Integration Portal website. This site enables you to explore HP Product Solutions to meet your business needs, includes a full list of Integrations between HP Products, as well as a listing of ITIL Processes. The URL for this website is http://h20230.www2.hp.com/sc/solutions/index.jsp
This document describes HP Live Network Community Content. Hewlett Packard Software does not test, certify or support Community Content. Please use the Community Content discussion forums on HP Live Network or contact the original submitter of the Community Content directly if any support, configuration or usability questions arise. Please back up all appropriate Service Request Catalog files before applying Community Content in your environment.