Customized output from:
The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
The information contained herein is subject to change without notice.
Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.
© Copyright 2010 - 2012 Hewlett-Packard Development Company, L.P.
Adobe™ is a trademark of Adobe Systems Incorporated.
Microsoft® and Windows® are U.S. registered trademarks of Microsoft Corporation.
UNIX® is a registered trademark of The Open Group.
Visit the HP Software Support Online web site at:
http://www.hp.com/go/hpsoftwaresupport
This web site provides contact information and details about the products, services, and support that HP Software offers.
HP Software online support provides customer self-solve capabilities. It provides a fast and efficient way to access interactive technical support tools needed to manage your business. As a valued support customer, you can benefit by using the support web site to:
Most of the support areas require that you register as an HP Passport user and sign in. Many also require a support contract. To register for an HP Passport ID, go to:
http://h20229.www2.hp.com/passport-registration.html
To find more information about access levels, go to:
http://h20230.www2.hp.com/new_access_levels.jsp
An interactive guide enables you to identify the tasks to deploy and configure Service Request Catalog. The initial dialogue helps you identify only the tasks that you need to complete for your environment. From those responses, you can create a customized guide that includes all the tasks that apply to your environment.
Answer the following questions to begin the process.
Make sure you are familiar with the method you choose and that you are knowledgeable about its configuration requirements.
The following steps are customized according to your selections. Check that your selections are correct.
If any selections are not correct, click Change.
Before you begin the Service Request Catalog installation, you must complete all the installation and configuration steps for Service Manager 9.31.
Service Request Catalog 1.40 new features work only with Service Manager 9.31. Service Manager 9.31 has enhancements that complement this version of Service Request Catalog. You must have both Service Manager server (RTE) and applications at version 9.31 to run Service Request Catalog 1.40 successfully.
You can return to the Service Request Catalog installation when you have the Service Manager 9.31 applications and server running successfully.
This guide is interactive and enables you to view the installation and configuration instructions that are relevant for your Service Request Catalog setup. You can change your selections any time by clicking the Change button at the top of the page. When you complete a step or task, click the check box to the left of the heading to collapse that section. To expand sections, clear the check box.
The bottom of the pages in the online version of this guide list the following identifying information:
Printing
This guide will not print correctly if you attempt to print it using the browser print function. If you decide that you want to print the guide, click Change at the top of this page, and then click Print at the bottom of the page where you made your selections.
The Service Request Catalog installation package contains:
Specified installation folder and path locations are generally relative to the location of the installed Tomcat instance and deployment location of the src-1.40.war file. When you see a path that includes a hard drive letter (C:\), the actual location always depends on the user's discretion. You can substitute the actual drive that you choose. When you see a path that includes an ellipsis (...), it represents the discretionary part of the path and folder structure on your local drive. Example: C:\...\apache-tomcat-7.0.x
The C:\...\ notation assumes that you chose the default installation path for Apache Tomcat. When you encounter this path notation in examples, you can always substitute your local path.
For Unix, the default folder structure is always represented with this convention: /opt/...
You can assume all tasks and steps are required unless they are marked Optional.
For detailed information on Service Request Catalog requirements, refer to the SRC Compatibility Matrix.
Important Notes:
If you also want to use LDAP together with Service Managerand Service Request Catalog, please refer to the Service Manager LDAP Best Practices Guide on the following Web site: http://support.openview.hp.com
To deploy the Service Request Catalog application and configure the authentication environment, you will complete these basic tasks.
If necessary, navigate to this download site to obtain the zipped installation files for Apache Tomcat 7.0.x: http://tomcat.apache.org/download-70.cgi
Download the zip version to deploy manually or the 32-bit/64-bit Windows Service Installer.
Do one of the following to install Tomcat as a Windows Service or as a manual deployment:
Windows Service: Run the apache-tomcat-7.0.x.exe installer. Specify a convenient location for Tomcat. Example:
C:\...\apache-tomcat-7.0.x
/opt/..../apache-tomcat-7.0.x
When prompted for the Java location, note the path to the \jre
folder.
You will need this information later when you configure authentication.
Manual Process: Unzip the files to a preferred location on the designated server. Example: Unzip the files to:
C:\...\apache-tomcat-7.0.x
/opt/..../apache-tomcat-7.0.x
After you install Tomcat, increase the Java Heap Space setting to prevent out of memory issues.
Example:
Follow these steps to deploy and configure the .war file.
Navigate to the Control Panel > Administrative Tools > Services dialog. Verify the Apache Tomcat service is stopped.
Run /opt/.../apache-tomcat-7.0.x/bin/shutdown.sh
Unzip the contents of the serviceRequestCatalog.zip file into an empty folder that you create to be the home location for this application.
Example: If you create a new folder named \src-1.40 where you plan to deploy the .war file, the result would look like this:
C:\...\src-
1.40\war_file_contents
/opt/.../src-
1.40/war_file_contents
Caution: Do not unzip the .war file into this folder
C:\...\apache-tomcat-7.0.x\webapps
/opt/.../apache-tomcat-7.0.x/webapps
Tip: Use a .war file extraction tool, or rename the file to src-1.40.zip and unzip it to the target location.
Open this file with a text editor:
C:\...\Apache\apache-tomcat-7.0.x\conf\server.xml
/opt/.../apache-tomcat-7.0.x/conf/server.xml
Navigate to the <Host></Host>
section and locate the Context parameter. If the section
is commented out, uncomment it. If it is missing, add the following.
<Context docBase=""
path=""
reloadable="false" />
Specify the complete path to the folder where you unzipped the src-1.40.war file in the docBase= parameter. Enclose the path in double quotation marks (" "). Example:
<Context docBase="C:\...\src-
1.40"
<Context docBase="/opt/.../src-
1.40"
The path=
parameter enables you to create a simplified path (in the URL) that maps to
the actual path where you deploy the src-1.40.war application. Enclose the path in
double quotation marks (" "). Example:
<Context docBase="C:\...\src-1.40"
path="/src"
<Context docBase="/opt/.../src-
1.40"
path="/src"
Tip: It is acceptable to create a multi-level context path for your deployment.
Example:
path="/enterprise/xxx/src"
Save your changes and close the file.
Encrypt the password. used to connect to the Service Manager server.
From the location where you unzipped serviceRequestCatalog.zip, extract the contents of ...\files\encryptor-1.40.zip into a separate folder of your choice. Example:
C:\...\src-1.40\encrypt
/opt/.../src-1.40/encrypt
Run the executable file to start the encryptor application.
C:\...\src-1.40\encrypt\runme.bat
/opt/..../src-1.40/encrypt/runme.sh
Follow the steps in the Password Encryption program to create an encrypted password. You will be asked to specify these user-defined values:
Copy the encrypted password and save it. You will need this value plus the name of the file with the encryption key when you configure Service Request Catalog in the next task.
Follow these steps to configure the related properties.
C:\...\src-1.40\WEB-INF\classes\applicationContext.properties
/opt/.../src-1.40/WEB-INF/classes/applicationContext.properties
Note: A detailed list of the properties in this file is shown in the table following these steps.
In the # Service Connector Configuration section, specify the following properties as appropriate for your environment. For Trusted Sign-On and Single Sign-On, specify only https
.
serviceManager.protocol=https
serviceManager.hostname=hostname.domainName
serviceManager.port=13443
In the # Service Manager URL section, make no changes. The properties that you specified in the last three steps will be the components of the final URL.
serviceManager.target=${serviceManager.protocol}://${serviceManager.hostname}:${serviceManager.port}
In the # Encryption section, follow these steps:
Locate the following entry:
serviceManager.adminCredentials=LIST(userName,ENC(encryptedValue))
You will need the user name and encrypted password that you created in the earlier tasks to encrypt a password.
Replace userName
with the Service Manager administrator user name that is
associated with the password that you encrypted in the last task.
Replace encrypted Value
with the encrypted password text that you saved.
Note: If you configured Service Manager to operate in multi-company or multi-tenant mode, then you must specify a separate userName and encrypted password for each company. To enable more than one administrator, repeat the steps to encrypt a password for each additional administrator. Use the following syntax and separate each unique entry with a comma:
=LIST(userName,ENC(encryptedValue),userName,ENC(encryptedValue))
Edit the src.encryption.file.name
property to point to the file that contains the encryption key. The default location is c:\\a1.txt
.
src.encryption.file.name=c:\\a1.txt
You specified the name of this file in step 3.
(Optional) In the # Miscellaneous Properties section, most properties are set to default values that work for most environments. Change them only if you want different behavior.
In the # Security section, the security mode is set as follows:
src.security.mode=default src.security.ssoEnabled=false
Do not change these settings if you do not want to configure authentication and secure communication now.
To specify Light Weight Single Sign-On (LWSSO), remove the comment symbol (#) that precedes #src.security.mode=lwsso
to specify LWSSO as your communication method
between Service Request Catalog and Service Manager.
Insert the comment symbol in front of the default value.
To enable Single Sign-On with LWSSO, set the src.security.ssoEnabled
property to true
.
You can skip the #Trusted Sign-On section.
To specify Trusted Sign-On (TSO), remove the comment symbol that precedes #src.security.mode=tso
to specify TSO as your communication method
between Service Request Catalog and Service Manager.
Insert the comment symbol in front of the default value.
To enable Single Sign-On with TSO, set the src.security.ssoEnabled
property to true
.
In the #Trusted Sign-On section, specify appropriate values for these parameters:
src.trustStore= src.trustStorePassword= src.keyStore= src.keyStorePassword=
In the # Performance section, the default values are acceptable for most environments. Changing them is optional. Make sure you understand the effect if you replace the default settings.
(Optional) In the # Knowledge Management (KM) section, configure the related parameters if you want to include Knowledge Management in search results.
Service Manager Connector Configuration | |||
---|---|---|---|
Service Manager Protocol: |
sm.protocol=http |
This value can be http or https | |
Domain Name: |
sm.hostname=127.0.0.1 |
Use a fully qualified domain name that can be resolved from this machine. | |
Service Manager Port: |
sm.port=13080 |
The default values are 13080 for http and 13443 for https. | |
Service Manager URL: | sm.target=${sm.protocol}://${sm.hostname}:${sm.port} | Points to your Service Manager, using the previously configured values. Do not change. | |
Encryption | |||
Encryption: | sm.adminCredentials=LIST(falcon,ENC(SucYgJrpriPZxejBHtF9HyW4RxcYiues)) |
Configure a comma-separated list of all the Administrator user names and passwords to optimize catalog caching at startup. For multiple administrators, separate each userName and encrypted password combination with a comma.For example: sm.adminCredentials=LIST(userName,ENC(encryptionValue),userName,ENC(encryptionValue)) |
|
Encryption Key Location: |
src.encryption.file.name= |
Point to the file that contains the encryption key. The default location is c:\\a1.txt. | |
Miscellaneous Properties | |||
Data Integrity: | src.stopWhenUpdateFailed=true | Stop SRC when it fails to update the catalog from the service connector. | |
Web Services: | sm.wsURL=/SM/7/ws | This property verifies the web services exposed by Service Manager. | |
Display Name: | sm.rootCategoryDisplayName=ITSM | This property sets the display name of the top level category when you enable multiple catalog providers. For example: The SM Catalog/Hardware Bundles/itemA | |
Case Sensitive Queries: | src.sm.contactLookupsToUpper=false | Convert all contact search queries to upper case. Contact search case insensitive. | |
Contact Display Property: | src.sm.contactListDisplayPattern=${C} |
The default value for the contact name search result list is ContactName ${C}. If you want to display a different format, you can set a different value. For example, you can specify src.sm.contactListDisplayPattern=${C}( ${F}.${L}) if you want to display ContactName( FirstName.LastName) Pattern for contact search result list ${N} -: Name ${C} -: ContactName ${U} -: FullName ${F} -: FirstName ${L} -: LastName |
|
Data Source Provider: | src.enabledProviders=sm | For Service Manager, do not change this parameter value. | |
Support Catalog: | src.sm.canRequestGenericSupport=true | Change true to false if you want to prevent users from requesting support for an item that is not in the Support Catalog. | |
Subscriptions: | src.sm.enableSubscription=true | A value of true enables the Subscriptions tab. Change the value to false to hide the Subscriptions tab. | |
Support: | src.sm.enableSupport=true | A value of true enables the Support tab. Change the value to false to hide the Supports tab. | |
Services: | src.sm.enableService=true | A value of true enables the Services tab. Change the value to false to hide the Services tab. | |
Search Sort Order: | src.search.itemsearch.sortby=HIT_DESC |
HIT_ASC displays results by relevance in ascending order. HIT_DESC displays results by relevance in descending order. ALPH_ASC displays results in ascending alphabetic order. |
|
RequestFor Editable: | src.requestedFor.editable=false | Disables the RequestFor field of a Service item checkout panel. The default value is false. To enable the RequestFor field in the checkout panel, set this property to true. | |
Use price for service | src.service.enablePrice=true | A value of true enables the price for service (include the field of cost/recurringPrice/recurringPer) Change the values to false to hide all of price information | |
Use Journal Updates for service | src.sm.service.journalUpdatesEnabled=false | A value of true enables the Journal Updates for service. Change the value to false to hide Journal Updates information | |
Use Journal Updates for support | src.sm.support.journalUpdatesEnabled=false | A value of true enables the Journal Updates for support. Change the value to false to hide Journal Updates information. | |
Security | |||
Security Mode: |
src.security.mode=default |
Choose your security method from the following list to define the communication method between SRC and SM. To specify the security mode, remove the pound sign (#) from the security mode that you want to use, and make sure that a pound sign (#) precedes the other security modes. See the following example, which specifies LW-SSO as the security mode: #src.security.mode=default src.security.mode=lwsso #src.security.mode=tso |
|
SSO Enabled: | src.security.ssoEnabled=false |
Specify whether SSO (Single Sign-On) is enabled. Note: If you change this flag to true, the src.security.mode value must be either LW-SSO or TSO. If you specified src.security.mode=default, do not change this parameter value to true. |
|
Secure Login: | src.security.secureLogin=false | Control the encryption of network communication between the browser and the application server. Set "secureLogin" to false if you do not use SSL connection to the web server. | |
SSL Port: | src.security.sslPort=8443 | Set the correct value for "sslPort" according to your current web server configurations. | |
Trusted Sign-On | |||
Trust Store: | src.trustStore= |
A valid path entry for Windows servers cannot contain blank spaces. For example, C:\\Program Files\\... is an invalid path notation, and C:\\PROGRA~1\\... is valid path notation. Note: Separate each segment of the path with a double backslash (\\), as shown in the following example: slash.src.trustStore=F:\\apps\\ServiceManager931\\Client\\plugins\\com.hp.ov.sm.client.common_9.30.xxx\\cacerts |
|
Trust Store Password: | src.trustStorePassword= |
Specify the trust store password: src.trustStorePassword=changeit |
|
Key Store: | src.keyStore= |
Specify the correct path to the key store: src.keyStore=F:\\apps\\ServiceManager930\\Client\\plugins\\com.hp.ov.sm.client.common_9.30.xxx\\xxx.yyy.zzz.net.client.keystore. |
|
Key Store Password: | src.keyStorePassword= |
Specify the keyStorePassword. src.keyStorePassword=password |
|
Performance | |||
Refresh: | src.refreshCatalogAfterEvery=1800 | Specify the delay in seconds between each full catalog refresh. For example, 1800 is equivalent to 30 minutes (60 * 60 = 1800). | |
Fallback: | src.sm.fallbackToDefaultUserCatalog=true | Use the logged in user catalog if the Request For user has no contact record. HP recommends that you do not change this value to false. | |
Max Connections per Host: | src.sm.defaultMaxConnectionsPerHost=25 | Specify a value between 25 to 60 depending on the projected user traffic. Increase this value by 10 for each additional Service Manager node. Do not exceed 60 regardless of the number of Service Manager nodes. For example, if there are more than six Service Manager nodes supported by a load balancer, set this value to 60. | |
Max Total Connections: | src.sm.maxTotalConnections=25 | Specify the maximum number of total connections. | |
Retry: | src.sm.numberOfRetry=2 | Specify the number of times to try to connect to SM. | |
Timeout: | src.sm.connectionTimeout=5 | Specify the value before a connection times out (in seconds). | |
Initialization: | src.initCatalogDelay=15 | Specify the delay before the catalog is initialized (in seconds). | |
Task Delay: | src.scheduledTaskInitialDelay=30 | Specify the delay before scheduled tasks begin running (in seconds). | |
Exchange Rate Delay: | src.refreshExchangeRatesAfterEvery=21600 | Configure the delay between each scheduled run to refresh exchange Rate (in seconds). Note: The default value is 6 hours * 60 seconds * 60 minutes = 21600 seconds. |
|
Knowledge Management (KM) | |||
KM Enabled: | src.km.enabled=false | Specify whether Knowledge Management is enabled. The default value is false. Change to true to enable KM. | |
KM Connections Per Host: | km.defaultMaxConnectionsPerHost=1 | The default value is 1. The number must be greater than 0. | |
Total Number of KM Connections: | km.maxTotalConnections=2 | The default value is 2. The number must be greater than 0. | |
Refresh KM Stop Words: | sm.km.stopword.expireDuration=600 |
Stop words are words that KM ignores during searches, such as the word "the." SRC caches KM stop words and refreshes that cache at specified intervals (in seconds). The default value is 600 seconds. |
|
Refresh KM Attachments | sm.km.attachment.refreshKMAttachmentAfterEvery=600 | SRC caches attachments and refreshes that cache at specified intervals (in seconds) Example: 6hours * 60seconds * 60minutes = 21600 seconds The default value is 600 seconds. | |
KM Configuration: | src.search.results.main.section=service |
The search results page displays results by type. Specify which results pane should appear in the center of the page. You may set this value as shown in the following: Service Catalog=service Support Catalog=support Knowledge Management=knowledge The default behavior is to display the Service Catalog results in the center of the page. |
|
KM Doctype cache refresh: | sm.km.doctype.expireDuration=1800 | Specify the duration to wait to refresh the KM doctype cache (in seconds). |
Follow these steps to configure the Java options.
C:\...\apache-tomcat-7.0.x\bin
opt/.../apache-tomcat-7.0.x/bin
C:\...\apache-tomcat-7.0.x\bin\tomcat7w.exe
opt/.../apache-tomcat-7.0.x/bin/tomcat7w.exe
-XX:MaxPermSize=128m
1024
.There are a variety of authentication scenarios that require additional tasks. The number of tasks depend on the configuration settings you specified.
The difference among these scenarios is your preferred authentication method:
Another consideration is whether you want encryption using SSL. The following tables describe each scenario and the remaining configuration steps.
Method | Communication | Remaining Steps |
---|---|---|
External Authentication | TSO | Configure basic authentication |
SSL is required | ||
Configure TSO Properties |
Method | Communication | Remaining Steps |
---|---|---|
External Authentication | LW-SSO | Configure basic authentication |
SSL is Optional | ||
Configure LWSSO Properties |
Method | Communication | Remaining Steps |
---|---|---|
LW-SSO Compatible Authentication | LW-SSO | Configure basic authentication |
SSL is optional | ||
Configure LWSSO Properties |
External Authentication
HP customers often use external methods, such as SiteMinder or Active Directory, to authenticate their users. The typical scenario is to authenticate the user once (pre-authentication) and then enable that user to access resources or other applications without additional login or authentication procedures. For example, an employee would log in one time to the corporate intranet and then be able to access Service Request Catalog to request services and support. If you are an HP customer, consultant, or partner, read this document to learn how to implement a single sign-on solution for Service Request Catalog using a pre-authentication method with a REMOTE_USER HTTP header value.
Before You Begin
Verify that you completed all steps to deploy and configure Service Request Catalog. There are common tasks that you need to complete for all supported authentication scenarios.
Unix
All commands are shown in Windows format. For Unix installations, convert them to match your local Unix path conventions.
OpenSSL is an open source toolkit for the SSL protocol that contains a variety of utility functions. You can obtain the OpenSSL toolkit from a variety of sources. You will need it to complete required tasks.
You can obtain OpenSSL if you install Cygwin, which is available at
http://www.cygwin.com/
Although Cygwin has multiple components, you need only the following:
Install it in a directory that you can easily navigate to at the command line. Example: C:\cygwin.
You need OpenSSL on both the Service Request Catalog and Service Manager servers. You can simplify running openssl commands if you create an environment variable that specifies the openssl location: cygwin\bin\openssl.
Cygwin is governed by the GNU General Public License.
Verify: Open the Cygwin Command Prompt window by double-clicking C:\cygwin\Cygwin.bat. You will need this window later. Confirm that you have OpenSSL available by typing this command:
openssl -help
Make sure there is a JAVA_HOME environment variable configured on the Service Manager server and on the Service Request Catalog server. Service Manager installs a complete JRE in this location:
C:\Program Files\HP\Service Manager 9.30\Server\RUN\jre\bin
.
Verify: Open a Windows Command Prompt window. Confirm that you have the keytool application available by typing this command at the prompt:
keytool -help
If an error message appears, confirm that you have JAVA_HOME configured correctly and that it includes the \bin folder in that path.
On the Service Request Catalog server, JAVA_HOME should point to the same Java instance used by Tomcat.
Important: Each instance of a Java Runtime or Java Developer’s Kit contains a ...\lib\security\cacerts file. Some test or production servers could have more than one version installed. It is important that you consistently reference the same Java instance that is used by Tomcat.
During the configuration process, you need to access certain folders and files. Create a separate Windows Explorer window for each.
C:\Program Files\HP\Service Manager 9.30\Server\RUN
C:\Program Files\Java\jdk1.6.0_20\jre\lib\security\cacerts
Example: C:\...\src-1.40\_TSO\
.war
file. You will need to access these files:
C:\...\src-1.40\WEB-INF\classes\applicationContext.properties
C:\...\src-1.40\WEB-INF\classes\lwssofmconf.properties
Tip: Set up separate windows for each of these folders and files ahead of time to speed up the configuration process. Arranging them side by side will make it easy to switch from one to the other.
HP recommends that you verify that the Service Request Catalog server and the Service Manager server can communicate. From the Service Request Catalog server, open a Command Prompt window and ping the Service Manager server using its fully qualified domain name.
If you have any communications failures, add the fully qualified domain name and IP of the other server to the local Hosts file.
Tip: Keep both Command Prompt windows open. You will need them to complete subsequent steps.
These tasks support the transfer of encrypted data between Service Request Catalog and the Service Manager server. To configure SSL for Service Request Catalog, follow these steps:
Follow these steps only if you do not have a digital security certificate issued by a certificate authority provider, such as Verisign, Thawte, or your corporate certificate authority. The digital certificate contains a public key, the identity of the owner, and a matching private key. The certificate is required to encrypt data sent and received in a “trusted” environment. If you do not have a digital certificate from an external provider, you must create your own certificate to enable encrypted data transfer between the Service Manager server and the trusted Service Request Catalog application.
From this directory, run the following openssl commands to generate a private key for the certificate authority.
Command | Description |
---|---|
genrsa | Generate an RSA private key |
-des3 | A cipher methodology |
-passout pass: | Specify a password for the created file |
-out filename.pem | Create an output file |
Copy and paste this command into your Cygwin Command Prompt window:
openssl genrsa -des3 -passout pass:changeit -out certificateAuthorityKey.pem 1024
Warning: Copy and paste is a shortcut to reduce typing errors and improve efficiency. However, the commands may be long with many parameters. Make sure you copy the entire command, even when it wraps over multiple lines. When you paste it into the Command Prompt window, it will appear as a single line.
Verify: This folder should contain a new file named certificateAuthorityKey.pem.
The following openssl commands generate a self-signed certificate for the certificate authority.
Command | Description |
---|---|
req | Request a certificate |
-new | The certificate is new |
-x509 | x509 is a self-signed certificate utility (For more information, see www.openssl.org) |
-days | 365 Expires after one year |
-key certificateAuthorityKey.pem | Specify the certificate file name name |
-passin pass: | Specify a password for the certificate file |
-subj "/CN=www.xxx.com" | If you were using an external certificate authority, this would be their domain name. Because we are creating our own, the domain is not relevant but the command must have some reference. |
-out filename.pem | Create this certificate file |
Copy and paste this command into your Cygwin Command Prompt window:
openssl req -new -x509 -days 365 -key certificateAuthorityKey.pem -passin pass:changeit -subj "/CN=www.xxx.com" -out certificateAuthorityCert.pem
Verify: This folder should contain a new file named certificateAuthorityCert.pem
From the Windows Command Prompt window, navigate to the new folder you created to contain Trusted Sign-On files.
Example: C:\...\src-1.40\_TSO\
The following keytool commands generate a public/private key pair for Service Request Catalog. The trusted certificate entry is stored in an entity known as a keystore. For more information about keytool, see www.oracle.com.
Command | Description |
---|---|
-genkey | Generate a key pair, which contains a public key and associated private key pair |
-dname "CN=fqdn" | Specify the fully qualified domain name of the Service Request Catalog server |
-validity 365 | Expires after one year |
-alias alias_name | Creates a unique name, or alias, for a new trusted certificate entry. In this case, use src as the alias_name. |
-keypass | Specify a password for the certificate file. |
-keystore | Specify the name of the Service Manager keystore file. |
-storepass | Specify a password for the keystore file. |
Copy and paste this command into your Windows Command Prompt window:
keytool -genkey -dname "CN=fqdn" -validity 365 -alias src -keypass changeit -keystore srcKeystore.jks -storepass changeit
Tip: Copy it into a plain text file first, substitute your fully qualified domain name for fqdn, and then copy and paste it into the command line. Make sure you use the fully qualified domain name, not an IP address. A fully qualified domain name looks like this: server.name.qualifier.
Verify: This folder should contain a new file named srcKeystore.jks.
The following keytool commands generate a Certificate Signing Request (CSR) for Service Request Catalog.
Command | Description |
---|---|
-certreq | Generate a Certificate Signing Request (CSR) |
-alias alias_name | src is the alias name |
-file | The file name is srcCSR.pem |
-keypass | Specify a password for the .pem file |
-keystore | Specify the name of the Service Request Catalog keystore file. |
-storepass | Specify a password for the keystore file. |
Copy and paste this command into your Windows Command Prompt window:
keytool -certreq -alias src -file srcCSR.pem -keypass changeit -keystore srcKeystore.jks -storepass changeit
Verify: This folder should contain a new file named srcCSR.pem.
Return to your Cygwin Command Prompt window.
Run the following openssl commands to sign the CSR that you created in step 6.
Command | Description |
---|---|
x509 | x509 is a self-signed certificate utility (For more information, see www.openssl.org) |
-req | Request a certificate |
-in filename.pem | CSR file name |
-CA filename.pem | File name of the certificate to be signed |
-CAkey filename.pem | File that contains the private key |
-passin pass: | Specify the password for the key file |
-days 365 | Expires in one year |
-set_serial | Optional. Serial number of the file (Can replace the -CA parameter) |
-out filename.pem | Create an output file for the signed certificate |
Copy and paste this command into your Cygwin Command Prompt window:
openssl x509 -req -in srcCSR.pem -CA certificateAuthorityCert.pem -CAkey certificateAuthorityKey.pem -passin pass:changeit -days 365 -set_serial 1 -out srcCert.pem
Verify: You should see these messages display in the command window:
Signature ok subject=/CN=yourFQDN Getting CA Private Key
This folder should contain a new file named srcCert.pem.
Return to your Windows Command Prompt window.
The following keytool commands import the Certificate Authority certificate into the Service Request Catalog keystore file.
Command | Description |
---|---|
-importcert | Read the certificate (or certificate chain) from the file and put it in the alias keystore |
-noprompt | No user input required |
-alias alias_name | certificateAuthority is the alias name for the certificateAuthorityCert.pem file |
-keypass | Specify the password for the certificateAuthorityCert.pem file |
-file | The file name is certificateAuthorityCert.pem |
-keystore | Specify the name of the Service Request Catalog keystore file |
-storepass | Specify the password for the Service Request Catalog keystore file |
Copy and paste this command into your Windows Command Prompt window:
Keytool -importcert -noprompt -alias certificateAuthority -keypass changeit -file certificateAuthorityCert.pem -keystore srcKeystore.jks -storepass changeit
Verify: You should see the following message display in the command window.
Certificate was added to keystore
The following keytool commands import the signed certificate file for Service Request Catalog into the Service Request Catalog keystore file.
Command | Description |
---|---|
-importcert | Read the certificate (or certificate chain) from the file and put it in the alias keystore |
-alias alias_name | src is the alias for the srcCert.pem |
-keypass | Specify the password for srcCert.pem file |
-file | The file name is certificateAuthorityCert.pem |
-keystore | Specify the name of the Service Request Catalog keystore file |
-storepass | Specify the password for the Service Request Catalog keystore file |
Copy and paste this command into your Windows Command Prompt window:
keytool -importcert -alias src -keypass changeit -file srcCert.pem -keystore srcKeystore.jks -storepass changeit
Verify: You should see the following message display in the command window.
Certificate reply was installed in keystore
If you support Trusted Sign-On authentication, these steps are required. Use either a digital security certificate issued by a certificate authority provider or a self-signed certificate to complete the task.
Complete these steps in the Windows Command Prompt window on the Service Request Catalog server.
Example: C:\...\jre\lib\security\cacerts
Example: C:\...\src-1.40\_TSO\
C:\...\src-1.40\_TSO\certificatAuthoritycert.pem
Example: C:\...\jre\lib\security\certificatAuthoritycert.pem
C:\...\src-1.40\_TSO\certificatAuthorityKey.pem
Verify: The result should be two new files in the same folder that contains the cacerts file.
C:\...\jre\lib\security\cacerts C:\...\jre\lib\security\certificatAuthoritycert.pem C:\...\jre\lib\security\certificatAuthorityKey.pem
keytool -importcert -noprompt -alias certificateAuthority -keypass changeit -file certificateAuthorityCert.pem -keystore cacerts -storepass changeit
Verify: The keytool application displays the following confirmation message:
Certificate was added to the keystore.
Copy the files in the following steps from the Service Request Catalog server to the Service Manager server before you start the next task.
C:\...\jre\lib\security\cacerts
C:\Program Files\HP\Service Manager 9.30\Server\RUN
certificateAuthorityCert.pem certificateAuthorityKey.pem
C:\Program Files\HP\Service Manager 9.30\Server\RUN
If you support Trusted Sign-On authentication, and you do not have a digital security certificate issued by a certificate authority provider, such as Verisign, Thawte, or your corporate certificate authority, the following steps are required. You will need the same certificate authority that you used to create your own keystore and certificate for Service Request Catalog.
Complete this task on the Service Manager server to enable encrypted data transfer between the Service Manager server and the trusted Service Request Catalog application.
C:\Program Files\HP\Service Manager 9.30\Server\RUN
keytool -genkey -dname "CN=fqdn" -validity 365 -alias sm -keypass changeit -keystore smKeystore.jks -storepass changeit
Tip: Copy it into a plain text file first, substitute your fully qualified domain name, and then copy and paste it into the command line.
Verify: The C:\Program Files\HP\Service Manager 9.30\Server\RUN directory contains a new file named smKeystore.jks.
keytool -certreq -alias sm -file smCSR.pem -keypass changeit -keystore smKeystore.jks -storepass changeit
Verify: The C:\Program Files\HP\Service Manager 9.30\Server\RUN directory contains a new file named smCSR.pem.
C:\Program Files\HP\Service Manager 9.30\Server\RUN
openssl x509 -req -in smCSR.pem -CA certificateAuthorityCert.pem -CAkey certificateAuthorityKey.pem -passin pass:changeit -days 365 -set_serial 1 -out smCert.pem
Verify: You should see these messages display in the command window, and the folder should contain a new file named smCert.pem:
Signature ok subject=/CN=<yourFQDN> Getting CA Private Key
keytool -importcert -noprompt -alias certificateAuthority -keypass changeit -file certificateAuthorityCert.pem -keystore smKeystore.jks -storepass changeit
Verify: You should see the following message displayed in the command window:
Certificate was added to keystore
keytool -importcert -alias sm -keypass changeit -file smCert.pem -keystore smKeystore.jks -storepass changeit
Verify: You should see the following message displayed in the command window:
Certificate reply was installed in keystore
srcCert.pem
C:\Program Files\HP\Service Manager 9.30\Server\RUN
keytool -importcert -noprompt -alias src -keypass changeit -file srcCert.pem -keystore clientcerts.keystore -storepass changeit
Verify: The keytool application should display the following confirmation message:
Certificate was added to the keystore
If Lightweight Single Sign-On (LW-SSO) is enabled in Service Request Catalog, integrations from other HP products will bypass Service Manager authentication when launching Service Request Catalog, provided that the HP product user is already authenticated and a proper token is used.
Notes:
http://<mySrcHostName>.<myDomain>:<port>/src/
The following procedure is provided as an example, and assumes Service Request Catalog is deployed on a Tomcat Web application server.
To configure LW-SSO in the Service Request Catalog, follow these steps:
<!-- LWSSO listener for integrations using HP lightweight single sign-on. --> <!-- <listener> <listener-class>com.hp.sw.bto.ast.security.lwsso.conf.LWSSOContextListener</listener-class> </listener> <context-param> <param-name>com.hp.sw.bto.ast.security.lwsso.conf.fileLocation</param-name> <param-value>lwssofmconf.xml</param-value> </context-param> --> <!-- LWSSO filter for integrations using HP lightweight single sign-on. --> <!-- <filter> <filter-name>LWSSO</filter-name> <filter-class>com.hp.sw.bto.ast.security.lwsso.LWSSOFilter</filter-class> </filter> <filter-mapping> <filter-name>LWSSO</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> -->
<initString>: Password used to connect HP products (minimum length: 12 characters). For example, smintegrationlwsso. Make sure that this value is the same as those used in the LW-SSO configurations of the other HP products (such as Operations Orchestration, and Business Service Management), which you want to connect via LW-SSO.
<multiDomain>: The <multiDomain> element should include the domain names (DNSDomain), server names (NetBiosName), IP addresses (IP), fully-qualified domain names (FQDN) of the Service Manager web tier server and other product servers (for example, the Release Control server).
Note: The multi-domain functionality is relevant only for UI LW-SSO (not for web services LW-SSO). In addition, you must set the multiDomain element in each product for which you want to support LW-SSO. The multi-domain functionality is based on the HTTP referrer. Therefore, LW-SSO supports links from one application to another and does not support typing a URL into a browser window, except when both applications are in the same domain.
The following is an example of a configured lwssofmconf.xml file:
<?xml version="1.0" encoding="UTF-8"?>
<lwsso-config xmlns="http://www.hp.com/astsecurity/idmenablmentfw/lwsso/2.0">
<enableLWSSO enableLWSSOFramework="true"
enableCookieCreation="true"
enableAutoCookieCreation="true"
cookieCreationType="LWSSO"
enableSAML2Support="false" />
<webui>
<validation>
<in-ui-lwsso>
<lwssoValidation id="ID000001">
<domain>hp.example.net</domain>
<!-- lw -->
<crypto cipherType="symmetricBlockCipher"
engineName="AES" paddingModeName="CBC" keySize="256"
encodingMode="Base64Url"
initString="This is a shared secret passphrase"> </crypto>
……
</lwssoValidation>
</in-ui-lwsso>
<in-lwssoAutoCreate enableAutoCookieCreation="true" enableUserReplacement="true" refid="ID000002"/>
<validationPoint
enabled="false"
refid="ID000002"
authenicationPointServer="http://psinghal2.americas.hpqcorp.net:8080/bsf"/>
</validation>
<creation>
<lwssoCreationRef id="ID000002" useHTTPOnly="true">
<lwssoValidationRef refid="ID000001"/>
<expirationPeriod>30</expirationPeriod>
</lwssoCreationRef>
</creation>
<logoutURLs>
<url>.*logout.jsp</url>
</logoutURLs>
<multiDomain>
<trustedHosts>
<DNSDomain>hp.example.net</DNSDomain>
<DNSDomain>emea.example.net</DNSDomain>
</trustedHosts>
</multiDomain>
</webui>
<lwsso-plugin type="SpringSecurity">
<roleIntegration rolePrefix="ROLE_"
fromLWSSO2Plugin="internal"
fromPlugin2LWSSO="disabled"
caseConversion="upperCase"/>
</lwsso-plugin>
</lwsso-config>
Your applications.Context properties files should resemble the following:
#src.security.mode=default
src.security.mode=lwsso
#src.security.mode=tso
To enable Single Sign-On with LWSSO, set the src.security.SSOenabled property to true.
To set up Trusted Sign-On between Service Request Catalog and the Service Manager server,follow these steps:.
CA Certificate: cacerts
Client Key Store: srcKeystore.jks
Server Key Store: smKeystore.jks
Trusted Client Key Store: clientcerts.keystore
C:\...\src-1.40\WEB-INF\classes\applicationContext.properties
sm.protocol=https
sm.hostname=xxx.xxx.xxx.xxx
sm.port=13443
# src.security.mode=default # src.security.mode=lwsso src.security.mode=tso
To enable TSO, set the src.security.SSOenabled property to true.
Note: Assume that the Certificate files are saved in Directory c:\_TSO
src.trustStore=C:\\_TSO \\cacerts src.trustStorePassword=changeit src.keyStore=C:\\ _TSO \\ srcKeystore.jks src.keyStorePassword=changeit
<Connector port="8009" enableLookups="false" protocol="AJP/1.3" redirectPort="8443" tomcatAuthentication="false" />
After you install the Service Request Catalog 1.40 application, there are tasks to refine your Service Manager environment.
Service Manager best practices recommend assigning user roles that carry all the required capability words to be successful at their tasks. The required capability word for Service Request Catalog is service catalog. The service catalog capability word allows a user to request items from the service catalog. Other capability words may be required for role-based scenarios.
Related Capability Words
To use SRC a user must have the SOAP API Capability word plus at least one of the other capability words from the following table.
Capability Word | Description |
---|---|
SOAP API (Required) | |
svcCatDeptRequester (Optional) | An employee can request items from the catalog on behalf of a department. |
svcCatEmployeeRequester (Optional) | An employee can request items from the catalog. |
svcCatManagerRequester (Optional) | A manager can request items from catalog. |
svcCatRequestOnBehalf (Optional) | A user can request items on for another employee. |
Request For Another Person
You can order catalog items and services for another person only if the svcCatRequestOnBehalf
capability word is part of your user profile.
Mass Update
As an administrator, you can apply new capability words to a large group of users in a single operation. Follow the steps in Service Manager documentation that describes the mass update feature to apply a capability word to the user profile of a group of users.
Service Manager administrators should make sure Service Request Catalog and Service Manager timeout settings match.
C:\Program Files\HP\Service Manager n.nn\Server\RUN\sm.ini
/opt/..../HP/Service Manager n.nn/Server/RUN/sm.ini
C:\...\src\WEB-INF\web.xml
/opt/..../src/WEB-INF/web.xml
The sm.ini file should have a setting for webservices_sessiontimeout. Example:
webservices_sessiontimeout:1800
This value is expressed in seconds. (1800 seconds = 30 minutes)
<session-config>
<session-timeout>30</session-timeout>
</session-config>
Note: This value is expressed in minutes. (30 minutes = 1800 seconds). The minimum value allowed is 3 minutes (180 seconds).
When you complete all the basic configuration tasks, you are ready to start Service Request Catalog. Make sure the Service Manager server is running before you start Service Request Catalog.
Start Apache Tomcat:
Go to the Control Panel > Administrative Tools > Services dialog to start the Apache Tomcat service.
Run /opt/...../apache/-tomcat-7.0.x/bin/startup.sh
Type this URL into a supported browser window:
http://hostname.domainName:nnnn/src/
In this URL, hostname.domainName
is a placeholder for the fully qualified domain name of the Tomcat server, and :nnnn
is the Tomcat port number on that server. The exact format of the URL depends on how you configured the path parameter when you installed Service Request Catalog.
Before a user creates a support request, you may want to encourage them to search an external knowledge database to find a documented solution or recommendation. This feature is optional, but can be useful to help your user community resolve problems quickly without opening formal support requests.
Before you try to enable Knowledge Management from Service Request Catalog, verify the following:
When you enable the Knowledge Management link, the interface displays a Search Knowledgebase window where the user can type a search phrase.
To enable the Knowledge Management link, follow these steps:
Open this file with a text editor:
C:\...\WEBINF\classes\applicationContext.properties
Locate and then set the src.km.enabled property to true.
After enabling Knowledge Management you must re-index the SRC Knowledge Base index. To do this, follow these steps:
If you are a system administrator, read this section to discover how to troubleshoot some common problems that you might encounter when you use Service Request Catalog.
Lucene is an open source Java search engine that Service Request Catalog uses to create indexes from downloaded catalog data. Luke is a diagnostic tool that enables you to view or modify the Lucene indexes in the catalog. For more information, see the Luke project site at http://code.google.com/p/luke/.
To use Luke, follow these steps.
lukeall-3..0.jar
..jar
file to run Luke. The Luke Toolbox appears.C:\src
, the path index would be C:\src\secure\luceneIndexedData
You can view catalog items and fields within an index. You can also search for a specific item. Use this tool to troubleshoot catalog download problems.
Charles enables you to monitor Internet requests and responses, including the internet traffic between Service Request Catalog and Service Manager. Use Charles to troubleshoot communication issues. For more information, see the Charles project site at www.charlesproxy.com.
To use Charles, follow these steps.
charles_setup.exe
..exe
file to install Charles.Charles functions as a play/record mechanism to track and troubleshoot internet activity.
You can set the log4j properties to provide more log information.
Navigate to this location
src-1.40\WEB-INF\classes
log4j.properties
with a text editor. Log4j parameters typically have these settings. Locate this property and change the logging level to increase (or decrease) the amount of log information captured during communication between Service Request Catalog and Service Manager.
log4j.rootLogger=TRACE, stdout, rolling
You can also change the log level for packages to increase or decrease the log size. For more information about additional settings, see the documentation for the Apache Software Foundation log4j logging utility.
If you have upgraded from a previous version of Service Manager or if you import some catalog items from a .unl file in Service Manager, the svcCatalogMix script must be run in Service Manager before you start SRC.
This script updates the Service Catalog records in older versions of Service Manager as one of the following types:
To execute the script, follow these steps:
Not enough memory to load the catalog.
If you see one of these messages:
java.lang.OutOfMemoryError: PermGen space at java.lang.Throwable.getStackTraceElement(Native Method)
java.lang.OutOfMemoryError
Follow these steps to fix index problems:
Service Request Catalog installation directory\secure\luceneIndexedData
folder. For example, if you deploy the Service Request Catalog application in a folder named C:\src
, the path index would be C:\src\secure\luceneIndexedData
luceneIndexedData
folder.C:\src\secure\attachments
directoryDelete files that begin with "version" as shown in the following example:
C:\src\secure\attachments\version*.*
Connection errors occur when the Service Manager server is unavailable or your connection information is invalid
I/O error: Connection refused: connect; nested exception
Unable to authenticate and therefore load the catalog
If you receive one of these messages, follow these steps to resolve:
Make sure the Service Manager server is running and you can access the Service Manager server wsdl from the browser by typing:
http://fqdn:portnumber/SM/7/ServiceCatalogAPI.wsdl
For example: http://myserver:13088/SM/7/ServiceCatalogAPI.wsdl
Verify the Service Manager server connection information is correct in the applicationContext.properties
file. You can locate this file in the Service Request Catalog installation directory. For example:
C:\src\WEB-INF\classes\applicationContext.properties
Verify these properties are accurate:
serviceManager.hostname=<IP or hostname>
serviceManager.port=<PortNumber>
serviceManager.adminCredentials=LIST (username, ENC(EncryptedPassword))
If a user logs into Service Request Catalog and then logs out, the session may still appear to be active on the Service Manager server. This may happen if there is a Load Balancer managing traffic between the Service Request Catalog and Service Manager nodes. In this case the Load Balancer is not able to maintain session stickiness between the Service Request Catalog and Service Manager nodes.
The solution is to configure the Load Balancer for session stickiness using the http cookie value JSESSIONID
and assign it to the Service Manager node.
Best Practices
applicationContext.properties
file while Tomcat is still running.Login Problems
The title page of this document contains the following identifying information:
To check for recent updates or to verify that you are using the most recent edition of a document, go to:
http://h20230.www2.hp.com/selfsolve/manuals
This site requires that you register for an HP Passport and sign in. To register for an HP Passport ID, go to:
http://h20229.www2.hp.com/passport-registration.html
Or click the New users - please register link on the HP Passport login page.
You will also receive updated or new editions if you subscribe to the appropriate product support service. Contact your HP sales representative for details.
Visit the HP Software Support Online web site at:
http://www.hp.com/go/hpsoftwaresupport
This web site provides contact information and details about the products, services, and support that HP Software offers.
HP Software online support provides customer self-solve capabilities. It provides a fast and efficient way to access interactive technical support tools needed to manage your business. As a valued support customer, you can benefit by using the support web site to:
Most of the support areas require that you register as an HP Passport user and sign in. Many also require a support contract. To register for an HP Passport ID, go to:
http://h20229.www2.hp.com/passport-registration.html
To find more information about access levels, go to:
http://h20230.www2.hp.com/new_access_levels.jsp
The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.
The information contained herein is subject to change without notice.
Confidential computer software. Valid license from HP required for possession, use or copying. Consistent with FAR 12.211 and 12.212, Commercial Computer Software, Computer Software Documentation, and Technical Data for Commercial Items are licensed to the U.S. Government under vendor's standard commercial license.
© Copyright 2010 - 2012 Hewlett-Packard Development Company, L.P.
Adobe™ is a trademark of Adobe Systems Incorporated.
Microsoft® and Windows® are U.S. registered trademarks of Microsoft Corporation.
UNIX® is a registered trademark of The Open Group.
We welcome your comments!
To open the configured email client on this computer, open an email window.
Otherwise, copy the information below to a web mail client, and send this email to jenny.quimpo@hp.com.