eIDAS-Node Installation and Configuration Guide Version 2.0 Copyright European Commission — DIGIT Unit D3 eIDAS-Node Installation and Configuration Guide Version 2.0 Document history Version Date Reason for modification Modified by 1.0 26/11/2015 Modifications to align with the eIDAS technical DIGIT specifications. 1.1 09/09/2016 DIGIT Configuration improvements including support for Tomcat 8. Removal of Attribute Provider. Documentation of improvements included in Release 1.1 (see Release notes for eIDAS-Node version 1.1). 1.2 20/01/2017 DIGIT Configuration and stability improvements. Documentation of improvements included in Release 1.2.0 (see Release notes for eIDAS- Node version 1.2.0). 1.3 08/06/2017 DIGIT Modifications to align with changes in Technical Specifications version 1.1. Bug fixes and configuration improvements (for details please see the Version 1.3.0 Release Notes). Documentation improvements to remove eIDAS-Nodes error codes and place in separate document eIDAS Error Codes. 1.4 06/10/2017 DIGIT Restructuring of reference documentation Modifications to remove support for JBoss6. Support WebLogic 12.2 family of servers. Amend filename conventions to change '\' to '/'. 2.0 11/04/2018 DIGIT Changes in supported application servers; Configuration and stability improvements; Architectural changes (separation of Specific Connector and Specific Proxy Service). (for details see the Version 2.0 Release Notes and the eIDAS-Node Migration Guide) Copyright European Commission — DIGIT Page 1 of 61 eIDAS-Node Installation and Configuration Guide Version 2.0 Disclaimer This document is for informational purposes only and the Commission cannot be held responsible for any use which may be made of the information contained therein. References to legal acts or documentation of the European Union (EU) cannot be perceived as amending legislation in force or other EU documentation. The document contains information of a technical nature and does not supplement or amend the terms and conditions of any procurement procedure; therefore, no compensation claim can be based on the contents of this document. Copyright European Commission — DIGIT Page 2 of 61 eIDAS-Node Installation and Configuration Guide Version 2.0 Table of contents DOCUMENT HISTORY ........................................................................................ 1 TABLE OF CONTENTS ........................................................................................ 3 LIST OF FIGURES ............................................................................................. 5 LIST OF TABLES ............................................................................................... 6 LIST OF ABBREVIATIONS .................................................................................. 7 LIST OF DEFINITIONS....................................................................................... 8 REFERENCES ................................................................................................... 9 1. INTRODUCTION....................................................................................... 10 1.1. Document structure ......................................................................... 10 1.2. Purpose ......................................................................................... 10 1.3. Document aims ............................................................................... 11 1.4. Other technical reference documentation ........................................... 11 1.5. eIDAS Technical specifications and software provided .......................... 12 1.5.1. Further information .............................................................. 12 2. PRODUCT OVERVIEW ............................................................................... 13 2.1. Package ......................................................................................... 13 2.2. Modules ......................................................................................... 13 3. PREPARING THE INSTALLATION ................................................................ 15 3.1. Configuring the JVM ......................................................................... 15 3.1.1. Oracle Java JCE Unlimited Strength Jurisdiction Policy .............. 15 3.1.2. IBM SDK Java ..................................................................... 15 3.2. Configuring the application server ..................................................... 16 3.2.1. Configuring Tomcat 7 ........................................................... 16 3.2.2. Configuring Tomcat 8 ........................................................... 17 3.2.3. Configuring JBoss AS 7 ......................................................... 17 3.2.4. Configuring GlassFish V4 ...................................................... 17 3.2.5. Configuring GlassFish V5 ...................................................... 17 3.2.6. Configuring WebSphere ........................................................ 19 3.2.7. Configuring WebSphere Liberty Profile .................................... 19 3.3. Enabling logging.............................................................................. 19 3.3.1. Configuring audit logging ...................................................... 20 3.3.2. Organisation of logs ............................................................. 23 3.4. Configuring application server security ............................................... 24 3.4.1. Security constraints for WebSphere ....................................... 24 4. CONFIGURING THE SOFTWARE ................................................................. 25 4.1. Configuring the project .................................................................... 25 4.1.1. Setup configuration directory ................................................ 25 4.1.2. Setting up your Keystore ...................................................... 25 4.1.3. Configuring with Basic Setup ................................................. 26 4.2. eIDAS-Node configuration files .......................................................... 26 4.2.1. General purpose parameters ................................................. 26 Copyright European Commission — DIGIT Page 3 of 61 eIDAS-Node Installation and Configuration Guide Version 2.0 4.2.2. Attribute registry ................................................................. 27 4.2.3. eIDAS-Node Connector configuration ..................................... 28 4.2.4. eIDAS-Node Proxy Service configuration ................................ 30 4.2.5. Additional configuration — Security ........................................ 33 4.2.6. Specific properties ............................................................... 39 4.2.7. Demo Service Provider ......................................................... 39 4.2.8. Demo Identity Provider ........................................................ 39 5. BUILDING AND DEPLOYING THE SOFTWARE ............................................... 40 5.1. Tomcat/GlassFish server deployment ................................................. 40 5.2. JBoss7, WildFly 11.0.0 Server deployment ......................................... 41 5.3. WebLogic Server deployment ............................................................ 42 5.4. WebSphere Server deployment ......................................................... 43 5.5. Monolithic Deployment ..................................................................... 43 6. VERIFYING THE INSTALLATION ................................................................. 45 6.1. Tomcat 7, 8 .................................................................................... 45 6.2. JBoss 7 ......................................................................................... 45 6.3. WildFly 11.0 ................................................................................... 45 6.4. GlassFish V4.1, V5 .......................................................................... 45 6.4.1. GlassFish V4.1 .................................................................... 45 6.4.2. GlassFish V5 ....................................................................... 46 6.5. WebLogic ....................................................................................... 46 6.6. WebSphere Application Server .......................................................... 46 6.7. Configuration files ........................................................................... 46 7. ADVANCED CONFIGURATION FOR PRODUCTION ENVIRONMENTS ................. 48 7.1. Clustering environment .................................................................... 48 7.1.1. Load balancer ..................................................................... 48 7.1.2. Load balancer with Hazelcast ................................................ 49 7.2. Configuring Tomcat ......................................................................... 49 7.2.1. Setting AJP ports ................................................................. 49 7.2.2. Apache HTTPD .................................................................... 49 7.3. Set up Hazelcast ............................................................................. 50 7.4. Check your installation ..................................................................... 51 7.5. eIDAS-Node compliance ................................................................... 52 APPENDIX A. EIDAS LEVELS OF ASSURANCE .............................................