SSL configuration example for Developer VM with ATG 10/Weblogic 10/Spindrift Site Builder

Configuring Developer VM for SSL

SSL configuration example for Developer VM with ATG 10/Weblogic 10/Spindrift Site Builder

1) Open standard windows terminal cmd.exe

2) Environment variables
To be able to generate new certificate we should set two environment variables:

SET WL_HOME=C:\dev\Cosmote_ro\wl\wls103
SET CLASSPATH=%WL_HOME%\server\lib\weblogic.jar

3) Remove expired certificate

We have keystore in our VMs here C:/dev/Cosmote_ro/certs/rtc.keystore with pretty old certificate
So as the first step we should check and remove certificate if it's already expired.
To see list of certificates use command:

keytool -list -keystore C:/dev/Cosmote_ro/certs/rtc.keystore -storepass weblogic -v

Remove certificate if it's expired (if your VM is using certificate with different alias, please change it accordingly):

keytool -delete -alias rtc -keystore C:/dev/Cosmote_ro/certs/rtc.keystore -storepass weblogic

4) Generate new certificate and put it to the keystore:

keytool -genkey -v -alias rtc -keyalg RSA -keysize 2048 -sigalg MD5withRSA -dname "CN=wls-sysadm" -keypass weblogic -validity 3650 -keystore C:/dev/Cosmote_ro/certs/rtc.keystore -storepass weblogic

5) Make newly generated certificate trusted
Now we will put the same newly generated certificate as trusted with different alias to the keystore
For that we should export certificate from the keystore first:

keytool -export -alias rtc -file rtc_cert -keystore C:/dev/Cosmote_ro/certs/rtc.keystore -storepass weblogic

And then we should import this certificate as trusted back to the same keystore:

keytool -import -trustcacerts -alias rootcacert -file rtc_cert -keystore C:/dev/Cosmote_ro/certs/rtc.keystore -storepass weblogic

6) Weblogic 10 configuration
Open Environment > Servers > CosmoteStore-weblogic-prod, tab Configuration, subtab Keystores

Keystores: Custom Identity and Java Standard Trust
Custom Identity Keystore: C:/dev/Cosmote_ro/certs/rtc.keystore
Custom Identity Keystore Type: JKS
Custom Identity Keystore Passphrase: weblogic
Confirm Custom Identity Keystore Passphrase: weblogic

Save the changes pressing button "Save"

Now switch to "SSL" subtab:

Identity and Trust Locations: Keystores
Private Key Alias: rtc
Private Key Passphrase: weblogic
Confirm Private Key Passphrase: weblogic

Save the changes.

Then switch to "General" subtab and set:

SSL Listen Port: 8443
Make sure checkbox "SSL Listen Port Enabled" is checked.

Save your changes.

7) ATG 10 & SiteBuilder configuration
Below configuration is relevant for EAR built in development mode.
Since SSLv3 is considered as insecure by browsers we should change this in atg\dynamo\security\BasicSSLConfiguration
Also BasicSSLConfiguration refers to expired ATG certificate from atg-sample-keystore.jks keystore.
We will not generate another key but will use the same key we generated before.

So we should create properties file and override values as follows:

c:\dev\Cosmote_ro\ATG\ATG10.1.2\home\servers\CosmoteStore-prod\localconfig\atg\dynamo\security\BasicSSLConfiguration.properties

Put inside the file:

secureSocketProtocol=TLS
keyManagerAlgorithm=SunX509
keyStore=C:/dev/Cosmote_ro/certs/rtc.keystore
keyStoreType=JKS
keyStorePassword=weblogic

After this changes atg/dynamo/server/HttpsServer component will be able to create secure SSL socket with /atg/dynamo/service/socket/SSLServerSocketFactory.

Now we should also disable default behaviour of the SiteBuilderRequestServlet. By default it's checking if page should be served with secure or non-secure protocol and performs redirects.
Since it should serve all pages with secure protocol we will just disable this to avoid incorrect redirection loop
Create the next properties file:
c:\dev\Cosmote_ro\ATG\ATG10.1.2\home\servers\CosmoteStore-prod\localconfig\spindrift\sitebuilder\SiteBuilderConfiguration.properties

Put inside the file:

enableSslRedirects=false

Restart CosmoteStore-weblogic-prod server and try to access storefront using your VM IP (or network hostname) and 8443 port

https://< VM IP> :8443

The first time you will see browser warning since we have self-signed certificate.

8) Optional steps
When Secure port configuration is OK - we could disable insecure port in Weblogic admin console.

Open Environment > Servers > CosmoteStore-weblogic-prod, tab Configuration, subtab General and uncheck Listen Port Enabled

Also we could force Weblogic to serve all connections to our ATG application with secure protocol.
To do so put the next fragment of XML into your CosmoteStorefront.war\WEB-INF\web.xml under web-app tag

<security-constraint>
<web-resource-collection>
<web-resource-name>SecureResource</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

Rebuild and restart production server if necessary.

Command file for Windows to generate SSL certificate and also BasicSSLConfiguration.properties and SiteBuilderConfiguration.properties files attached

Export BCC Deployment Topology

Sometimes you need to store deployment topology - for example before applying new DB dump to your DB

To be able to do this use component /atg/epub/deployment/TopologyManager/
You will find Primary Topology - the one is live now. Just press button "Download XML" for topology export.



Troubleshooting: if you will see security exception please enable /atg/dynamo/servlet/adminpipeline/AuthenticationServlet/ and login into dyn/admin

When you need to import Deployment Topology use:
Content Administration -> Admin console -> Configuration



Thanks

Loooking up repository item with QueryBuilder

For example, if we should find a banner which has given keyword and it's visible and it's also belongs to the certain site. By the way banner has a priority - zero is the highest.

So we should use code like below for this kind of lookup:

    private static final String PRIORITY_PROPERTY_NAME = "priority";

    private RepositoryItem findByKeyword(final String currentTerm) throws RepositoryException {

        RepositoryItem result = null;

        RepositoryView view = getCatalogTools().getCatalog().getItemDescriptor(getBannerItemDescriptorName()).getRepositoryView();

        QueryBuilder qb = view.getQueryBuilder();

        String descriptionPropName = getCatalogTools().getPropertyManager().getDescriptionPropertyName();

        QueryExpression descriptionPropExpression = qb.createPropertyQueryExpression(descriptionPropName);

        QueryExpression termExpression = qb.createConstantQueryExpression(currentTerm);

        QueryExpression isVisiblePropExpression = qb.createPropertyQueryExpression(getCatalogTools().getPropertyManager().getIsVisiblePropertyName());

        QueryExpression trueExpression = qb.createConstantQueryExpression(Boolean.TRUE);

        QueryExpression siteIdExpression = qb.createPropertyQueryExpression("siteIds");

        QueryExpression currentSiteExpression = qb.createConstantQueryExpression(SiteContextManager.getCurrentSite());

        Query isVisibleQuery = qb.createComparisonQuery(isVisiblePropExpression, trueExpression, QueryBuilder.EQUALS);

        Query teaserQuery = qb.createPatternMatchQuery(descriptionPropExpression, termExpression, QueryBuilder.CONTAINS, true);

        Query siteQuery = qb.createIncludesQuery(siteIdExpression, currentSiteExpression);

        Query andQuery = qb.createAndQuery(new Query[] { teaserQuery, isVisibleQuery, siteQuery });

        String[] precachedPropertyNames = { PRIORITY_PROPERTY_NAME };

        SortDirectives sortDirectives = new SortDirectives();

        sortDirectives.addDirective(new SortDirective(PRIORITY_PROPERTY_NAME, SortDirective.DIR_ASCENDING));

        RepositoryItem[] repositoryItems = view.executeQuery(andQuery, new QueryOptions(0, 1, sortDirectives,

                precachedPropertyNames));

        if ((repositoryItems != null) && (repositoryItems.length > 0)) {

            result = repositoryItems[0];

        }

        return result;

    }

How to extend repository item for multisite use

So in my case I'm extending media repository item
1) all new property into your repo item xml:
        <table name="cos_adv_search_banner_sites" id-column-names="media_id" type="multi" shared-table-sequence="1">
<property name="siteIds" expert="true" category-resource="categoryGeneral" display-name-resource="sites" data-type="set"  column-names="site_id" component-item-type="siteConfiguration" repository="/atg/multisite/SiteRepository" cascade="update" writable="true" hidden="false" required="false" queryable="true">
       <attribute name="propertySortPriority" value="15"/>
</property>
   </table>

2) then create new tables to hold this property values:
for SWITCHING schemes:

  CREATE TABLE cos_adv_search_banner_sites
   ( MEDIA_ID VARCHAR2(40 BYTE) NOT NULL,
   SITE_ID VARCHAR2(40 BYTE) NOT NULL
   );

  CREATE UNIQUE INDEX adv_search_banner_sites_pk ON cos_adv_search_banner_sites (MEDIA_ID, SITE_ID);
  CREATE INDEX adv_search_banner_sites_idx ON cos_adv_search_banner_sites (SITE_ID) ;

  ALTER TABLE cos_adv_search_banner_sites ADD CONSTRAINT adv_search_banner_sites_pk PRIMARY KEY (MEDIA_ID, SITE_ID)  ENABLE;
  ALTER TABLE cos_adv_search_banner_sites ADD CONSTRAINT adv_search_banner_sites_f1 FOREIGN KEY (MEDIA_ID)
 REFERENCES dcs_media (MEDIA_ID) ENABLE;


and for PUBLISHING scheme we put additional field - asset_version:

CREATE TABLE cos_adv_search_banner_sites
   (  ASSET_VERSION   NUMBER(19,0) NOT NULL,
      MEDIA_ID        VARCHAR2(40 BYTE) NOT NULL,
 SITE_ID         VARCHAR2(40 BYTE) NOT NULL
   );

  CREATE UNIQUE INDEX adv_search_banner_sites_pk ON cos_adv_search_banner_sites (MEDIA_ID, SITE_ID, ASSET_VERSION);
  CREATE INDEX adv_search_banner_sites_idx ON cos_adv_search_banner_sites (SITE_ID) ;

  ALTER TABLE cos_adv_search_banner_sites ADD CONSTRAINT adv_search_banner_sites_pk PRIMARY KEY (MEDIA_ID, SITE_ID, ASSET_VERSION)  ENABLE;

Thanks for reading

How to debug ATG Web Application in Eclipse

If you need debug ATG web application follow the instruction below.
Add next variables in atg files:

(Note: In our case we use server EC_Dynamo_Server, find or create the same file for your's)

File c:\ATG\ATG2007.1\home\servers\EC_Dynamo_Server\localconfig\postEnvironment.bat

set JAVA_ARGS=-Xdebug -Djava.compiler=NONE -Xbootclasspath:%JAVA_HOME%\jre\lib\r
t.jar;%JAVA_HOME%\lib\tools.jar -Xnoagent -unjdwp:transport=dt_socket,address=8000,server=y,suspend=n %JAVA_ARGS%

File startWeblogic.bat script add following line:
set JAVA_OPTIONS=-Xdebug -Xrunjdwp:transport=dt_socket,address=8000,server=y,suspend=n %JAVA_OPTIONS%

Now you need restart your Weblogic Application Server

Start Eclipse and open your ATG project.
Mouse right click on your project name will open popup menu -
choose Debug As -> Debug Configurations...
In a new Debug Configurations Dialog tree you will see "Remote Java Application".
Double click it. A new default debug configuration for remote application will be created.

Thats it! You may press button "Debug" and eclipse start debugging process.