Using IBM HTTP Server as a reverse proxy for application on WebSphere?

[o***@yahoo.com]

Hi,

We are trying to configure IBM HTTP Server and our web application running on WebSphere application server. We are using the IBM Web Server Plug-in. The versions are the latest 6.0.2.x versions for all products.

The goal is to have the application servers behind the web servers, and the deployed web applications expose user-friendly urls to the public users.


We configured the user friendly URLs using mod_rewrite in IHS for INITIAL application access. For illustration, here are the configuration entries:

RewriteRule ^/$ /app/ [R]
RewriteRule ^/app/(.*)$ /webapp/public/$1 [PT]
RewriteRule ^/admin$ /admin/ [R]
RewriteRule ^/admin/(.*)$ /webapp/admin/$1 [PT]

This is because we have 2 Struts modules (public and admin) within one web application named webapp.


The problem with this configuration is that the web page served to the user still has all the application server URLs. For example, some link on the web page will look like:
http://www.example.com/webapp/public/some_link.do
, instead of:
http://www.example.com/app/some_link.do

For this, in Apache world, there is mod_proxy_html. This module would replace the 'old' URLs (/webapp/public/) with the 'new' ones (/app/). However, for this to work, one needs to use the other Apache mod_proxy modules (mod_proxy, mod_proxy_http).

In one of the postings, someone mentioned that mod_proxy modules should not be used, which makes sense, since that's the role of the IBM Web Server Plug-in.


Has anyone here had any experience with this type of configuration?

Thanks for the help.

[Sunit Patke]

mod_rewrite does not change URLs to "friendly" URL.

Sunit

Post by o***@yahoo.com
Hi,
We are trying to configure IBM HTTP Server and our web application running
on WebSphere application server. We are using the IBM Web Server Plug-in.
The versions are the latest 6.0.2.x versions for all products.
The goal is to have the application servers behind the web servers, and
the deployed web applications expose user-friendly urls to the public
users.
We configured the user friendly URLs using mod_rewrite in IHS for INITIAL
RewriteRule ^/$ /app/ [R]
RewriteRule ^/app/(.*)$ /webapp/public/$1 [PT]
RewriteRule ^/admin$ /admin/ [R]
RewriteRule ^/admin/(.*)$ /webapp/admin/$1 [PT]
This is because we have 2 Struts modules (public and admin) within one web
application named webapp.
The problem with this configuration is that the web page served to the
user still has all the application server URLs. For example, some link on
http://www.example.com/webapp/public/some_link.do
http://www.example.com/app/some_link.do
For this, in Apache world, there is mod_proxy_html. This module would
replace the 'old' URLs (/webapp/public/) with the 'new' ones (/app/).
However, for this to work, one needs to use the other Apache mod_proxy
modules (mod_proxy, mod_proxy_http).
In one of the postings, someone mentioned that mod_proxy modules should
not be used, which makes sense, since that's the role of the IBM Web
Server Plug-in.
Has anyone here had any experience with this type of configuration?
Thanks for the help.

[o***@yahoo.com]

Post by Sunit Patke
mod_rewrite does not change URLs to "friendly" URL.

Thanks for the quick reply, Sunit.

Yes, mod_rewrite does not change URLs to friendly ones. I provided mod_rewrite configuration entries for an illustration of what we are trying to achieve.

I should have posed a more detailed question:

When using IBM HTTP Server WebSphere plugin, what should we use to rewrite URLs in our application to be more user friendly?

We would have tried to use mod_proxy_html (and the rest of the mod_proxy family plugins) for changing the URLs, but it's not considered a good practice when using the IBM HTTP Server WebSphere plugin.

Thanks for the help.

[Sunit Patke]

This is what I do for my applications. The only URL that has to be user
friendly is that starting URL, e.g. http://myserver/myapp
Once user starts from here I do not care what the URL is in the browsers URL
bar.

There are couple of things that can be done to hide the long "unfriendly"
URLs. One requires a portal server. Portal servers can convert URLs to more
friendly easy to remember URLs. The other option is to modify the
application to use a frameset and display all the pages in a frame.
Regardless of where the user is in the application s/he will see only the
framesets URL.

Sunit

Post by o***@yahoo.com

Post by Sunit Patke
mod_rewrite does not change URLs to "friendly" URL.

Thanks for the quick reply, Sunit.
Yes, mod_rewrite does not change URLs to friendly ones. I provided
mod_rewrite configuration entries for an illustration of what we are
trying to achieve.
When using IBM HTTP Server WebSphere plugin, what should we use to rewrite
URLs in our application to be more user friendly?
We would have tried to use mod_proxy_html (and the rest of the mod_proxy
family plugins) for changing the URLs, but it's not considered a good
practice when using the IBM HTTP Server WebSphere plugin.
Thanks for the help.

[MattyB]

Ovidovic,

Out of curiosity, are you using SSL between the client -> reverse proxy and reverse proxy -> web application? If so, did you run into any issues with this configuration? That is something I am attempting and have not been able to get it to work yet.

Thanks,

Matt

[Sunit Patke]

Matt,

IBM Tivoli Access Manager is a product that will do what you are looking
for. WebSEAL, the reverse proxy component of Tivoli Access Manager supports
SSL between browser and WebSEAL as well as WebSEAL and web application.

If you have a web application deployed on WebSphere then you can easily
configure SSL between IHS and browser as well as IHS and WAS web container.

Sunit

Post by MattyB
Ovidovic,
Out of curiosity, are you using SSL between the client -> reverse proxy
and reverse proxy -> web application? If so, did you run into any issues
with this configuration? That is something I am attempting and have not
been able to get it to work yet.
Thanks,
Matt

[MattyB]

Thanks Sunit!

[MattyB]

I am just getting back to try this again (i.e., using IHS as a reverse proxy to a web app hosted on WAS 6.0 with SSL between the client & reverse proxy and SSL between the reverse proxy & IHS deployed on the internal WAS server).

Can any one offer some guidance? Will this work? WebSEAL is not an option for me.

Thanks,

-Matt

Post by Sunit Patke
Matt,
IBM Tivoli Access Manager is a product that will do
what you are looking
for. WebSEAL, the reverse proxy component of Tivoli
Access Manager supports
SSL between browser and WebSEAL as well as WebSEAL
and web application.
If you have a web application deployed on WebSphere
then you can easily
configure SSL between IHS and browser as well as IHS
and WAS web container.
Sunit

[Sunit Patke]

Use IBM HTTP server with WAS plugin installed and SSL configured on IHS as
well as WAS.

- Sunit

Post by MattyB
I am just getting back to try this again (i.e., using IHS as a reverse
proxy to a web app hosted on WAS 6.0 with SSL between the client & reverse
proxy and SSL between the reverse proxy & IHS deployed on the internal WAS
server).
Can any one offer some guidance? Will this work? WebSEAL is not an option for me.
Thanks,
-Matt

Post by Sunit Patke
Matt,
IBM Tivoli Access Manager is a product that will do
what you are looking
for. WebSEAL, the reverse proxy component of Tivoli
Access Manager supports
SSL between browser and WebSEAL as well as WebSEAL
and web application.
If you have a web application deployed on WebSphere
then you can easily
configure SSL between IHS and browser as well as IHS
and WAS web container.
Sunit

[MattyB]

Post by Sunit Patke
Use IBM HTTP server with WAS plugin installed and SSL
configured on IHS as
well as WAS.
- Sunit

Thanks Sunit. So you are saying use the IHS on my internal server with the WAS plug-in? I did that and SSL is supported on WAS as well as IHS as I can access them both seperately over 443. I also "attempted" to setup the keystores between the reverse proxy and the internal IHS, but when I try to connect to the application through the reverse proxy, I get errors.

Do you know of any whitepapers or documentation that can help me walk through this? I gleaned as much as I can from the IHS online help but I am still unable to resolve the issues.

Thanks,

-Matt

[Sunit Patke]

This is how the stuff works:

client browser -------> IHS with plugin --------> WAS
SSL SSL

This is all explained in the infocenetr.

-Sunit

Post by MattyB

Post by Sunit Patke
Use IBM HTTP server with WAS plugin installed and SSL
configured on IHS as
well as WAS.
- Sunit

Thanks Sunit. So you are saying use the IHS on my internal server with
the WAS plug-in? I did that and SSL is supported on WAS as well as IHS as
I can access them both seperately over 443. I also "attempted" to setup
the keystores between the reverse proxy and the internal IHS, but when I
try to connect to the application through the reverse proxy, I get errors.
Do you know of any whitepapers or documentation that can help me walk
through this? I gleaned as much as I can from the IHS online help but I
am still unable to resolve the issues.
Thanks,
-Matt