Share this page

# Integrating with a web server

To enhance the security of your OpenText Application Quality Management deployment, we recommend placing the server behind a secure reverse proxy, either an Apache or IIS web server. Such configuration is also required to support external authentication. If you are not using a secure reverse proxy, we recommend configuring SSL on the server itself. For details on configuring SSL, see Manage the application server.

In this topic:

## Configuring IIS as a reverse proxy

To integrate OpenText Application Quality Management with a web server, you configure the web server to redirect requests to the OpenText Application Quality Management Application Server. You configure the web server to work in proxy HTTP mode.

To configure IIS to work as a reverse proxy:

Note: The following instructions apply to IIS 7.0 and later.

1. Using Server Manager, install the IIS server using default settings. You do not need to enable any other extensions.

2. Install the URL rewrite package.

3. Install Application Request Routing (ARR) for IIS.

   Note: If you have no direct access to the internet from your server, you can obtain the ARR 3.0 standalone version that contains everything you need, including the URL rewrite package. Download ARR 3.0 to your client, copy it to the server, and install it on the server.

4. Make sure the IIS Web server is stopped.

5. Open IIS Manager and ensure you have an element named Server Farms under the relevant IIS server node.

   Note:

   - If there is no Server Farms element and you are using a Windows 2012 server, uninstall Microsoft Web Farm Framework and download the latest version.

   - If you fail to install a Web Farm for IIS 10, see this KB article.

6. Right click Server Farms and click Create Server Farm.

7. Enter a name for the farm and click Next.

8. Click Advanced settings and change the ports to match your OpenText Application Quality Management Jetty ports. The default ALM Jetty ports are 8080 for http and 8443 for https.

9. Under Server address, type the name or IP address of the OpenText Application Quality Management server you want to add to the farm.

10. Click Add to add the server.

    Note: Repeat steps 9 - 10 to add more ALM servers to use IIS as a load balancer in an ALM cluster.

11. Click Finish.

12. Click Yes in the Rewrite Rules dialog box that opens. This adds a URL rewrite rule that causes IIS to forward all incoming requests to the ALM Server.

13. Select the new Server farm element created.

14. Double-click Proxy.

15. Set Time-out (seconds) to 35.

16. Set Response buffer threshold to 0.

17. Click Apply.

    Note: This change is applied only to the Application Request Routing proxy.

18. Enable the proxy.

    1. Select the main tree node (the server name), click Application Request Routing Cache, and then click Server Proxy Settings in the Proxy section.

    2. Enable Enable proxy.

    3. Verify that HTTP version is valued with Pass Through.
    4. Verify that Reverse rewrite host in response headers is enabled.
    5. Click Apply.

19. Restart the IIS Web server.

    You can now connect to your OpenText Application Quality Management site using the following URL: http://<IIS server name>/qcbin.

20. If you are using IIS with multiple servers farms:

    1. Add another server farm for the other server group.

    2. Modify the URL Rewrite rule for the ALM server farm:

       1. Select the main tree node (the server name) and click URL Rewrite.
       2. Edit the Inbound Rule.
       3. Change Using from Wildcards to Regular Expressions.

       4. Change Pattern to (^qcbin(.*)).

       5. Click Apply.

    3. Modify the URL Rewrite rule for the other server farm:

       1. Select the main tree node (the server name) and click URL Rewrite.

       2. Edit the Inbound Rule.

       3. Change Using from Wildcards to Regular Expressions.

       4. Change Pattern to reflect the other server group.

       5. Click Apply.

    4. Restart the IIS Web server.

Back to top

## Configuring IIS as a Secure Reverse Proxy

To configure IIS to work as a secure reverse proxy:

Note: For detailed instructions, refer to the IIS documentation.

1. Ensure that you configured IIS to work as a reverse proxy.

2. Install the server certificate in IIS.

   Note: The server certificate must have a password protected private key.

   In IIS Manager:

   - Import your server certificate:

     Select Server > Certificates > Import.

   - Add a listener on a secure port:

     Select Default Website.

     Edit Bindings.

     Click Add.

     Select https and select your certificate.

3. In SSL Settings for your website, configure IIS to require an SSL connection.

4. Verify that you can access the OpenText Application Quality Management server through the IIS virtual IP using the https protocol.

## Configuring the IIS Web Server for SSL Offloading

SSL Offloading means that IIS is configured to connect to ALM over http and not https. In this case, perform the following configuration:

1. Edit the qcbin inbound rule and add the following server variable:

   Set name="HTTP_X_FORWARDED_PROTO" value="https".

2. In Action Properties, change the protocol from https to http.

3. Restart IIS so it will read the configuration.

Back to top

## Configuring Apache as a reverse proxy

To configure Apache to work as a reverse proxy:

Note:

- Windows: It is recommended that you use Apache HTTP Server version 2.2.

- Linux: It is recommended that you use Apache HTTP Server version 2.4.

1. Make sure the Apache Web server is stopped.

2. Navigate to the <Apache Home directory>\conf directory.

3. Create a backup copy of the httpd.conf file.

4. Open the httpd.conf file.

5. Uncomment or add the following load module commands:

       LoadModule proxy_module modules/mod_proxy.so

       LoadModule proxy_http_module modules/mod_proxy_http.so

       LoadModule rewrite_module modules/mod_rewrite.so

       LoadModule headers_module modules/mod_headers.so

6. Add the following section to the end of the file:

       # Turn off support for true Proxy behavior as we are acting as
       # a reverse proxy
       ProxyRequests Off
       # Turn off VIA header as we know where the requests are proxied
       ProxyVia Off
       # Set the permissions for the proxy
       <Proxy *>
       AddDefaultCharset off
       Order deny,allow
       Allow from all
       </Proxy>
       # Turn on Proxy status reporting at /status
       # This should be better protected than: Allow from all
       ProxyStatus On
       <Location /status>
       SetHandler server-status
       Order Deny,Allow
       Allow from all
       </Location>
       # Configuring mod_proxy_http
       # To connect to servlet container with HTTP protocol, the ProxyPass
       # directive can be
       # used to send requests received on a particular URL to a Jetty instance.
       ProxyPreserveHost off
       ProxyPass /qcbin http://<ALM server name>:8080/qcbin
       ProxyPassReverse /qcbin http://<ALM server name>:8080/qcbin
       # For OpenText Enterprise Performance Engineering deployments, add the following:
       ProxyPass /loadtest http://<LoadRunner Enterprise server name>/loadtest
       ProxyPass /LoadTest http://<LoadRunner Enterprise server name>/LoadTest
       ProxyPass /Loadtest http://<LoadRunner Enterprise server name>/Loadtest
       ProxyPassReverse /loadtest http://<LoadRunner Enterprise server name>/loadtest
       ProxyPassReverse /LoadTest http://<LoadRunner Enterprise server name>/LoadTest
       ProxyPassReverse /Loadtest http://<LoadRunner Enterprise server name>/Loadtest
       # Rewrite rule trailing slash must be used in the VirtualHost section
       RewriteEngine On
       # Add trailing slash if was not present in the original request
       RewriteRule ^/qcbin$ /qcbin/ [R]

7. Save the changes to the file.

8. Run httpd -t from the Apache bin folder to check the syntax of the file.

9. Restart the Apache Web server.

   You can now connect to your OpenText Application Quality Management site using the following URL: http://<ALM virtual server name>[:<apache port number>]/qcbin.

Back to top

## Configuring Apache as a Secure Reverse Proxy

To configure Apache to work as a secure reverse proxy:

1. Open the httpd.conf file.

2. Uncomment ssl_module:

       LoadModule ssl_module modules/mod_ssl.so

3. Uncomment the httpd-ssl.conf file:

       # Secure (SSL/TLS) connections
       Include conf/extra/httpd-ssl.conf

4. Close the httpd.conf file and open the httpd-ssl.conf file. By default it is in /<apache-directory>/conf/extra.

5. In the httpd-ssl.conf file, activate the SSL port 443:

       Listen 443

6. Add the SSLProtocol parameter:

       SSLProtocol -SSLv2 -SSLv3 +TLSv1

7. Change the cache settings:

       LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
       SSLSessionCache "shmcb:<apacheAbsoluteFolder>/logs/ssl_scache(512000)"

8. Modify the VirtualHost and ServerName parameters:

       <VirtualHost <fully qualified server name>:443>
       ServerName <fully qualified server name>:443

9. Add the SSL certificates to the VirtualHost section:

       # Server Certificate
       SSLCertificateFile " /<apache-directory>/conf/WebServerPublicCert.pem"
       # Server Private Key:
       SSLCertificateKeyFile " /<apache-directory>/conf/WebServerPrivateCert.pem"

10. Restart Apache so it will read the new configuration.

    Run <apache-directory>/bin/apachectl -k restart

11. Verify that Apache works as a secure proxy server.

    Go to https://webserver/qcbin. Make sure the OpenText Application Quality Management home page is displayed.

    Note: The web server name must be in FQDN (fully qualified domain name) format when using a secure connection.

12. After verifying that Apache works as a secure proxy server, close the non-secure port.

    1. Open the httpd.conf file.

    2. Comment out the Listen parameter:

           #Listen 80

Back to top

## Configuring the Apache Web Server for SSL Offloading

SSL Offloading means that Apache is configured to connect to ALM over http and not https. In this case, perform the following configuration:

1. Navigate to the <Apache Home directory>\conf directory.

2. Create a backup copy of the httpd.conf file.

3. Open the httpd.conf file.

4. Add the following section if encrypted communication terminates on the Apache server:

       ###############################################################
       # add the following line if SSL is terminated/offloaded on Apache server
       ###############################################################
       RequestHeader set X-Forwarded-Proto https

5. Save the httpd.conf file.

6. Restart Apache so it will read the configuration.

Back to top

https://admhelp.microfocus.com Application Quality Management 8942
Tips to improve your search results... OpenText™ Application Quality Management Help Center OpenText™ Application Quality Management Help Center OpenText™ Application Quality Management Help 26.1 All View Local Help Center View Online Help Center Version: