Copyright © Cloud Software Group, Inc. All Rights Reserved

Configure Apache HTTP Server as Reverse Proxy

TIBCO API Exchange Gateway supports the Apache HTTP server in reverse proxy mode. You can place the Apache HTTP server in front of the inner firewall accepting the requests from the clients, and forward those requests to TIBCO API Exchange Gateway residing behind the firewall.

The Apache HTTP server can be used as reverse proxy for the following purposes:

•	Provide users access to a server that is behind a firewall.

•	Balance the load among multiple instances of the TIBCO API Exchange Gateway.

•	Bring multiple instances of TIBCO API Exchange Gateway servers into the same URL space.

The Apache HTTP server in reverse proxy mode can be used for both SSL and non-SSL communication.

Directives

The following directives must be enabled to use Apache HTTP server as the reverse proxy:

•

ProxyPass

•	ProxyPassReverse

•	SSLCertificateFile (for SSL communication only)

•	SSLCertificateKeyFile (for SSL communication only)

Refer to Apache HTTP server documentation for the description of directives.

Setup Reverse Proxy Server for Non-SSL Commnication

To setup the Apache HTTP server as a reverse proxy, follow these steps:

1.	Navigate to the following directory of Apache HTTP server installation:

APACHE_HOME/conf

2.	Open the httpd.conf file for editing.

3.	Uncomment the following lines:

   LoadModule proxy_module modules/mod_proxy.so

   LoadModule proxy_ajp_module modules/mod_proxy_ajp.so

   LoadModule proxy_http_module modules/mod_proxy_http.so

4.	Add the following contents:

---

 

<VirtualHost *:ListenPort>

 

ProxyPreserveHost On

 

# Servers to proxy the connection, or;

# List of application servers:

# Usage:

# ProxyPass / http://[IP Addr.]:[port]/

# ProxyPassReverse / http://[IP Addr.]:[port]/

# Example:

   ProxyPass / http://APIExchangeGateway_Host:HTTP_PORT/

   ProxyPassReverse / http://APIExchangeGateway_Host:HTTP_PORT/

 

ServerName localhost

</VirtualHost>

---

 

where,

•	ListenPort is the port on which Apache HTTP server runs. The ListenPort must match the value specified by Listen directive.

•	APIExchangeGateway_Host is the machine on which TIBCO API Exchange Gateway runs.

•	HTTP_PORT is the HTTP port for TIBCO API Exchange Gateway.

• To forward a specific operation request, include the request URI in the ProxyPass and ProxyPassReverse directives. For example, define the directives for ping operation URI, as follows:    ProxyPass /ping http://APIExchangeGateway_Host:HTTP_PORT/ping    ProxyPassReverse /ping    http://APIExchangeGateway_Host:HTTP_PORT/ping

5.	Save the changes to the file.

Setup Reverse Proxy Server for SSL Commnication

To setup the Apache HTTP server as a reverse proxy using SSL, follow these steps:

1.	Navigate to the following directory of Apache HTTP server installation:

APACHE_HOME/conf

2.	Open the httpd.conf file for editing.

3.	Uncomment the following line:

LoadModule ssl_module modules/mod_ssl.so

4.	Add the following line to include the SSL configuration file:

Include conf/extra/httpd-ssl.conf

5.	Save changes to the httpd.conf file.

6.	Navigate to the following directory of Apache HTTP server installation:

APACHE_HOME/conf/extra

7.	Open the httpd-ssl.conf file for editing.

8.	Add the following contents:

---

 

<VirtualHost *:ListenSSLPort>

SSLEngine On

ProxyPreserveHost On

# Set the path to SSL certificate

# Usage: SSLCertificateFile /path/to/example.crt

# Usage: SSLCertificateKeyFile /path/to/example.key

# Example:

   SSLCertificateFile Name_of_Server_public_certificate

   SSLCertificateKeyFile Name_of_Server_private_key

 

# Servers to proxy the connection, or;

# List of application servers:

# Usage:

# ProxyPass / http://[IP Addr.]:[port]/

# ProxyPassReverse / http://[IP Addr.]:[port]/

# Example:

   ProxyPass / http://APIExchangeGateway_Host:HTTP_PORT/

   ProxyPassReverse / http://APIExchangeGateway_Host:HTTP_PORT/

</VirtualHost>

---

 

where,

•	ListenSSLPort is the SSL transport port on which Apache HTTP server runs. The ListenSSLPort must match the value specified by Listen directive.

•	APIExchangeGateway_Host is the machine on which TIBCO API Exchange Gateway runs.

•	HTTP_PORT is the HTTP port for TIBCO API Exchange Gateway.

•	Name_of_Server_public_certificate is the full path to the public certificate. For example, "C:\apache2\conf\server.crt".

•	Name_of_Server_private_key is the full path to the private key. For example, "C:\apache2\conf\server.key".

9.	Save the changes to the file.

10.	Configure the client certificate authentication as described in the Configuring Client Authentication with Digital Certificates on Apache HTTP Server section.

If you want to use the Apache HTTP server in reverse proxy mode to forward the client requests to multiple instances of the Core Engines, use a load balancer. Refer to the High Availability Deployment Of Runtime Components chapter.

Copyright © Cloud Software Group, Inc. All Rights Reserved