When you are setting up WSO2 API manager fronted with a load balancer, you have the option of terminating SSL for HTTPS requests. So the load balancer will be decrypting incoming HTTPS messages and forwarding them to the Carbon servers as HTTP. So basically the APIM should be working with HTTP requests, after surpassing the load balancer. This is useful when you want to reduce the load on your Carbon servers due to encryption. To achieve this, the load balancer should be configured with TLS termination and the Tomcat RemoteIpValve should be enabled for Carbon servers.
I am going to describe the steps you have to follow for your exact requirement, from the beginning so that you can follow.
In these steps, note the below facts.
Configure the /etc/nginx/sites-enabled/default file as below.
Certificate generation for nginx has to be done. Follow https://docs.wso2.com/display/AM210/Adding+a+Reverse+Proxy+Serve for it.
And then start nginx server.
Next file configurations are related to configuring WSO2 API Manager.
a) Enabling RemoteIpValve for Carbon servers
Configure RemoteIPValve in <CARBON_HOME>/repository/conf/tomcat/catalina-server.xml as below.
Configure <APIM-HOME>/repository/conf/carbon.xml file as below.
I am going to describe the steps you have to follow for your exact requirement, from the beginning so that you can follow.
In these steps, note the below facts.
- I am using “localhost” as the hostname.
- Proxy url context path for publisher is “/apimanager/publisher”
So the publisher url can be used through the LB is https://localhost/apimanager/publisher/ - Proxy url context path for store is “/apimanager/store”
So the store url can be used through the LB is https://localhost/apimanager/store - Token generatoin url is https://localhost/token
1. Configuring Load balancer
I am using nginx as the load balancer. As we are not competent with the F5 which you use as the load balancer, we will not be able to provide guidance/scripts to configure F5. I am providing the following guide with Nginx so that you can have the basic understanding on what has to be done via the load balancer for this task. You may use this knowledge to configure F5.
Configure the /etc/nginx/sites-enabled/default file as below.
server {
listen 443;
ssl on;
ssl_certificate /etc/nginx/ssl/nginx.crt;
ssl_certificate_key /etc/nginx/ssl/nginx.key;
location /apimanager/carbon {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:9763/carbon;
proxy_redirect http://localhost:9763/carbon https://localhost/apimanager/carbon;
proxy_cookie_path / /apimanager/carbon/;
}
location ~ ^/apimanager/store/(.*)registry/resource/_system/governance/apimgt/applicationdata/icons/(.*)$ {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:9763/$1registry/resource/_system/governance/apimgt/applicationdata/icons/$2;
}
location ~ ^/apimanager/publisher/(.*)registry/resource/_system/governance/apimgt/applicationdata/icons/(.*)$ {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:9763/$1registry/resource/_system/governance/apimgt/applicationdata/icons/$2;
}
location /apimanager/publisher {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:9763/publisher;
proxy_redirect http://localhost:9763/publisher https://localhost/apimanager/publisher;
proxy_cookie_path /publisher /apimanager/publisher;
}
location /apimanager/store {
index index.html;
proxy_set_header X-Forwarded-Host $host;
proxy_set_header X-Forwarded-Server $host;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:9763/store;
proxy_redirect http://localhost:9763/store https://localhost/apimanager/store;
proxy_cookie_path /store /apimanager/store;
}
location / {
proxy_pass http://localhost:8280;
}
}
Certificate generation for nginx has to be done. Follow https://docs.wso2.com/display/AM210/Adding+a+Reverse+Proxy+Serve for it.
And then start nginx server.
Next file configurations are related to configuring WSO2 API Manager.
2. tomcat/catalina-server.xml file configuration
Do the following configs in <CARBON_HOME>/repository/conf/tomcat/catalina-server.xml
a) Enabling RemoteIpValve for Carbon servers
Configure RemoteIPValve in <CARBON_HOME>/repository/conf/tomcat/catalina-server.xml as below.
<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="X-Forwarded-For" protocolHeader="X-Forwarded-Proto" />
b) Set proxy port and hostname
<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
port="9443"
proxyPort="443"
hostname="localhost"
bindOnInit="false"
sslProtocol="TLS"
---
--
/>
3. carbon.xml configuration
- Uncomment following element,
<HttpAdminServices>*</HttpAdminServices>
- Set,
<EnableHTTPAdminConsole>true</EnableHTTPAdminConsole>
Set hostname,
<HostName>localhost</HostName>
<MgtHostName>localhost</MgtHostName>
4. site.json files of web apps
a)- Edit the <APIM_HOME>/repository/deployment/server/jaggeryapps/store/site/conf/site.json file with the context and request URL as shown below.
- This is done to configure the reverse proxy server for WSO2 API Store, so that you can route the requests that come to the store through a proxy server.
"reverseProxy" : {
"enabled" : true,
"host" : "localhost", // If the reverse proxy does not have a domain name use the IP
"context":"/apimanager/store",
"regContext":"" // Use this only if a different path is used for the registry
}
b) - Edit the <APIM_HOME>/repository/deployment/server/jaggeryapps/publisher/site/conf/site.json file with the context and host as shown below.
- This is done to configure the reverse proxy server for WSO2 API Publisher, so that you can route the requests that come to the publisher through a proxy server.
"reverseProxy" : {
"enabled" : true,
"host" : "localhost",//If the reverse proxy does not have a domain name use the IP
"context":"/apimanager/publisher",
"regContext":"" // Use this only if a different path is used for the registry
}
5. Configuring api-manager.xml file.
- Change the value of KeyValidatorClientType to WSClient in the <APIM_HOME>/repository/conf/api-manager.xml file.
- You need to make this change when you change the value of the host, because requests that are made to the Key Manager will also start getting routed through the reverse proxy; therefore, this needs to be over HTTP instead of TCP, which is Thrifts underlying protocol.
<KeyValidatorClientType>WSClient</KeyValidatorClientType>
Change gateway endpoint urls displayed on store,<GatewayEndpoint>http://localhost,https://localhost</GatewayEndpoint>- Set Store URL to be linked and from publisher,
<APIStore> <URL>https://localhost/apimanager/store</URL> --- </APIStore>This is it..!- Set Store URL to be linked and from publisher,
