{"id":6169,"date":"2019-08-27T08:19:00","date_gmt":"2019-08-27T02:49:00","guid":{"rendered":"https:\/\/www.intellinum.com\/?p=6169"},"modified":"2023-07-24T13:00:13","modified_gmt":"2023-07-24T13:00:13","slug":"implementing-ssl-with-load-balancing-for-oracle-mwa","status":"publish","type":"post","link":"https:\/\/livemanager.in\/intel\/implementing-ssl-with-load-balancing-for-oracle-mwa\/","title":{"rendered":"Implementing SSL with Load Balancing for Oracle MWA"},"content":{"rendered":"<p>Over the years, there are many Oracle E-Business WMS and MSCA customers who are looking to enhance the security of communication between the mobile MWA users and <a href=\"https:\/\/www.intellinum.com\/express-server\/\"><strong>Oracle MWA server<\/strong><\/a>. As we know, the MWA server used in MSCA and WMS natively runs in Telnet protocol where all data including username and password are sent in cleartext. One of the ways to secure the communication is to encrypt the data between client and server and this can be done using SSL (Secure Sockets Layer).<\/p>\n<p>&nbsp;<\/p>\n<p>In a recent update, Oracle added SSL support in the MWA server. However, SSL is not supported by MWA Dispatcher, confirmed in \u201cDoes MWA Dispatcher (MWADIS) Accept SSL or TLS Connections? (Doc ID 2175344.1)\u201d.This is unfortunate as many customers are using MWA dispatchers to load balance their MWA users. In such case, to make SSL work customer has to either connect the device directly to the MWA port or use other types of load balancer which supports SSL passthrough.<\/p>\n<p>&nbsp;<\/p>\n<p>This document is written to help customers in two regards. First, it describes steps to enable SSL in the Oracle MWA server. For reference, please read the information in the note &#8220;<strong><a href=\"https:\/\/www.intellinum.com\/express-suite\/\">Oracle Mobile Supply Chain Application<\/a>s<\/strong> for Oracle E-Business Suite Release Notes (Doc ID 2108155.1)&#8221; to enable SSL in the standard Oracle MWA server. Second, it introduces a high-performing popular software load balancer called haproxy and shows how to use it to load balance multiple MWA ports running in SSL mode.<\/p>\n<p>&nbsp;<\/p>\n<h3>The high-level steps are as follows:<\/h3>\n<p>&nbsp;<\/p>\n<ul>\n<li>Generate an SSL certificate, we can either get this from a trusted provider (paid) or we can generate a self-signed certificate (free)<\/li>\n<li>Configure mwa.cfg to enable the SSL<\/li>\n<li>Restart MWA service<\/li>\n<li>Install and configure haproxy<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h3>To generate a self-signed SSL certificate using the keytool command on the Oracle EBS application node:<\/h3>\n<p>&nbsp;<\/p>\n<ul>\n<li>Open a command prompt or terminal<\/li>\n<li>Run this command<\/li>\n<li>keytool -genkey -keyalg RSA -alias tomcat -keystore mwassl.jks -validity &lt;days&gt; -keysize 2048<\/li>\n<li>Where &lt;days&gt; indicate the number of days for which the certificate will be valid.<\/li>\n<li>Enter a password for the keystore. Note this password as you require this for configuring the server<\/li>\n<li>When prompted for a first name and the last name, press Enter to keep it blank.<\/li>\n<li>Enter the other details, such as\u00a0Organizational Unit,\u00a0Organization,\u00a0City,\u00a0State, and\u00a0Country<\/li>\n<li>Confirm that the information entered is correct<\/li>\n<li>When prompted with the &#8220;Enter key&#8221; password for &lt;mwassl&gt;, press Enter to use the same password as the keystore password<\/li>\n<li>Run this command to verify the contents of the keystone<\/li>\n<li>keytool -list -v -keystore mwassl.jks<\/li>\n<li>When prompted, enter the keystore password\u00a0note in Step 3. The basic information about the generated certificate is displayed. Verify that the &#8220;Owner&#8221; and &#8220;Issuer&#8221; are the same. Also, you should see the information you provided in Step 5 and 6.<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<p>The certificate is now complete and ready to use. <strong>Move this file to $INST_TOP\/admin\/install. If you run in 12.2.X, please move to both RUN and PATCH.<\/strong><\/p>\n<p>&nbsp;<\/p>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-6173\" src=\"https:\/\/www.intellinum.com\/wp-content\/uploads\/2019\/08\/Self-Signed-Certificate.png\" alt=\"\" width=\"1400\" height=\"411\" \/><\/p>\n<h4>Screenshot of how we verify the self-signed certificate:<\/h4>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #000000;\"><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-6174\" src=\"https:\/\/www.intellinum.com\/wp-content\/uploads\/2019\/08\/Verified-Self-Signed-Certificate.png\" alt=\"\" width=\"1126\" height=\"663\" \/><\/span><\/p>\n<p>&nbsp;<\/p>\n<p>Next, we edit $INST_TOP\/admin\/install\/mwa.cfg file to enable the SSL. For 12.2.X, please update for both RUN and PATCH. In the file, there are four properties related to SSL.<\/p>\n<pre><span style=\"color: #000000;\">mwa.Security.SSLSocket=TRUE<\/span>\r\n<span style=\"color: #000000;\">mwa.Security.KeyStore=mwassl.jks<\/span>\r\n<span style=\"color: #000000;\">mwa.Security.KeyStorePassword=mwasslpassword<\/span>\r\n<span style=\"color: #000000;\">mwa.Security.Protocols=TLSv1<\/span>\r\n<span style=\"color: #000000;\">mwa.Security.CipherSuites=SSL_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_DSS_WITH_AES_128_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA<\/span>\r\n\r\n<\/pre>\n<p>The mwa.Security.KeyStore should be the filename of the SSL certificate we generated earlier, and mwa.Security.KeyStorePassword should be the password we use when generating the certificate.<span class=\"Apple-converted-space\"><br \/>\n<\/span><\/p>\n<p>Once done, restart the MWA services and now we have the MWA server running in secure SSL!<\/p>\n<p>&nbsp;<\/p>\n<p>Please note that once the MWA server runs in SSL mode, we can no longer use non-secure MWA clients, like telnet clients, to connect. We have to use the MWA client that supports SSL mode to connect to the server. One such client is <a style=\"color: #0000ff;\" href=\"https:\/\/www.intellinum.com\/express-client\/\"><strong>Intellinum Express Client<\/strong><\/a>, a native GUI client that supports SSL, available for Android, Windows CE\/Mobile, and Windows PC.<\/p>\n<p>&nbsp;<\/p>\n<p>As mentioned earlier, once we enable SSL, we can\u2019t use the MWA dispatcher anymore as it does not decrypt\/encrypt SSL data. One good option that we have tested to work with the Oracle MWA server or with <a href=\"https:\/\/www.intellinum.com\/express-server\/\"><strong>Express Server<\/strong><\/a> is haproxy load balancer (www.haproxy.org).<span class=\"Apple-converted-space\">\u00a0This is a high-performing and reliable TCP\/HTTP software load balancer used by many large organizations in the world.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p>There are many good resources on the Internet on how to install and configure haproxy. Once installed and started, we can verify haproxy is running by using the command:<\/p>\n<pre><span style=\"color: #000000;\">sudo service haproxy status<\/span>\r\n\r\n\r\n<span style=\"color: #000000;\"><img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-6175\" src=\"https:\/\/www.intellinum.com\/wp-content\/uploads\/2019\/08\/haproxy.png\" alt=\"\" width=\"865\" height=\"103\" \/><\/span><\/pre>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #000000;\">Similar to MWA which has configuration file mwa.cfg, haproxy has a configuration file haproxy.cfg. The default location is \/etc\/haproxy\/haproxy.cfg. For reference, we have shown below a sample haproxy.cfg which runs the load balancer on port 10860 (think of this like MWA dispatcher port) and load balances to 3 MWA ports running on 192.168.1.232 port 10200, 10202, 10204 respectively.<span class=\"Apple-converted-space\">\u00a0<\/span><\/span><\/p>\n<pre><span style=\"color: #000000;\">global<\/span>\r\n\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>log \/dev\/log<span class=\"Apple-converted-space\">\u00a0 \u00a0 <\/span>local0<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>log \/dev\/log<span class=\"Apple-converted-space\">\u00a0 \u00a0 <\/span>local1 notice<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>chroot \/var\/lib\/haproxy<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>stats socket \/run\/haproxy\/admin.sock mode 660 level admin<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>stats timeout 30s<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>user haproxy<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>group haproxy<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>daemon<\/span>\r\n\r\n<span style=\"color: #000000;\">defaults<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>log <span class=\"Apple-converted-space\">\u00a0 \u00a0 <\/span>global<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>mode<span class=\"Apple-converted-space\">\u00a0 \u00a0 <\/span>tcp<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>timeout connect 30s<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>timeout client<span class=\"Apple-converted-space\">\u00a0 <\/span>1h<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>timeout server<span class=\"Apple-converted-space\">\u00a0 <\/span>1h<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 \u00a0 \u00a0 \u00a0 <\/span>option tcplog<\/span>\r\n\r\n<span style=\"color: #000000;\">frontend mwaproxy<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>mode tcp<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>bind *:10860<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>default_backend mymwaservers<\/span>\r\n\r\n<span style=\"color: #000000;\">backend mymwaservers<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>mode tcp<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>server mwa1 192.168.1.232:10200 check<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>server mwa2 192.168.1.232:10202 check<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>server mwa3 192.168.1.232:10204 check<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>stick-table type ip size 1m expire 30m<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>stick on src<\/span>\r\n<span style=\"color: #000000;\"><span class=\"Apple-converted-space\">\u00a0 <\/span>option redispatch<\/span><\/pre>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #000000;\">The important relevant sections in haproxy.cfg are the frontend and backend. The frontend has the port it should listen for incoming connection and the backend lists all the mwa ports we want to load balance. The stick-table and stick are used for sticky sessions so in case a client gets disconnected from the server (due to WiFi interruption for example), the client can be forwarded to the same server it was connected to before the disconnection.<span class=\"Apple-converted-space\">\u00a0<\/span><\/span><\/p>\n<p>&nbsp;<\/p>\n<p>Notice that we do not do anything special to implement TLS passthrough. It&#8217;s enough to pass the traffic to the backend servers and let them handle the encryption and decryption. That&#8217;s all there is to TLS passthrough.<\/p>\n<p>&nbsp;<\/p>\n<p>Don\u2019t forget to restart haproxy after any changes in haproxy.cfg with the following command:<\/p>\n<pre>sudo service haproxy restart\r\n\r\n\r\n<img decoding=\"async\" loading=\"lazy\" class=\"alignnone size-full wp-image-6176\" src=\"https:\/\/www.intellinum.com\/wp-content\/uploads\/2019\/08\/haproxy-restart.png\" alt=\"\" width=\"1123\" height=\"66\" \/>\r\n\r\n\r\n<\/pre>\n<p>Now we can connect the MWA client to the host\/port where haproxy is running and it should forward the connection to the MWA server. We have verified that all features in <a href=\"https:\/\/www.intellinum.com\/express-server\/\"><strong>warehouse management software<\/strong><\/a> (Express Server)\u00a0such as transaction personalization, voice interface, e-signature, and quick reconnect are working in SSL stand-alone or SSL with haproxy.<\/p>\n<p>&nbsp;<\/p>\n<p>Hope this article has been useful for you. If there are any questions or you would like to try our products <a href=\"https:\/\/www.intellinum.com\/express-client\/\"><strong>Express Client<\/strong><\/a> or <a href=\"https:\/\/www.intellinum.com\/express-server\/\"><strong>Express Server<\/strong><\/a>, feel free to reach out to <strong><a style=\"color: #0000ff;\" href=\"mailto:inquiry@intellinum.com\">inquiry@intellinum.com<\/a>.<\/strong><\/p>\n<pre><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Over the years, there are many Oracle E-Business WMS and MSCA customers who are looking to enhance the security of communication between the mobile MWA users and Oracle MWA server. As we know, the MWA server used in MSCA and WMS natively runs in Telnet protocol where all data including username and password are sent <\/p>\n","protected":false},"author":1,"featured_media":35783,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[60,64],"tags":[],"_links":{"self":[{"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/posts\/6169"}],"collection":[{"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/comments?post=6169"}],"version-history":[{"count":1,"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/posts\/6169\/revisions"}],"predecessor-version":[{"id":35784,"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/posts\/6169\/revisions\/35784"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/media\/35783"}],"wp:attachment":[{"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/media?parent=6169"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/categories?post=6169"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/livemanager.in\/intel\/wp-json\/wp\/v2\/tags?post=6169"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}