This tutorial shows you how to prepare the server for test or production use of CzechIdM. If you are looking for a much quicker way of installing CzechIdM, use the demo setup described here getting-started

Basic system setup

• 1 server (can be virtualized) for everything: backend, frontend and database. 
• OS Windows, ideally W2016 and newer
• PostgreSQL - installed from EnterpriseDB
• Java - OpenJDK
• Apache Tomcat - installed by Tomcat .exe installer
• Services start via system services (services.msc)

Instalation and software configuration

Prerequisities - Basic installation of Windows Server 2016.

• Install the Telnet Client system feature through Programs and Features. This is optional but greatly helps with debugging network problems.
• Install Firefox. Also optional, but greatly helps with debugging IdM webapp problems.
• Install Git Bash. This will be essential when configuring IdM and checking its logs.
  • Use checkout-windows, commit unix style endings. It does not really matter, we will not use the git command for anything.
  • Do not enable integration with windows cmd.
• Disable unnecessary windows services.
• Disable Microsoft IIS if installed.

PostgreSQL

On Windows, we use EnterpriseDB PostgreSQL distribution. Recommended version is 12.x.

• For installation, basically follow the official guide.
• Set location for binaries to C:\PostgreSQL\12.
• Set location for database to C:\PostgreSQL\12\data.
• Install all components (pgAdmin, StackBuilder, etc.).
• Leave the locale at [Default locale], we will set locale explicitly when creating a database.
• After installation, check the Windows services - the postgresql-x86_64 service should be there, configured with autostart.
  • To enter services menu, get to the Start->Run and invoke services.msc.

Edit the PostgreSQL configuration file C:\PostgreSQL\12\data\postgresql.conf to make it listen on 127.0.0.1 only. Adjust the database sizing as necessary. The following example is for 6GB RAM. Do not hasten to overwrite your PgSQL configuration out of hand! When in doubt, use a calculator.

Configure the authentication in the C:\PostgreSQL\12\data\pg_hba.conf to accept passwords. The basic configuration file should then look like this:

Java

Install the openjdk (preferred version is 11.0.2, for CzechIdm 13.1.0+ Java 21 is needed). You can download it from here. Be sure to download the JDK, and not only JRE.

OpenJDK Installation

Crete directory C:\Program Files\Java\ and extract there downloaded zip. Then set path and JAVA HOME:

• Open the sysdm.cpl (Win+r ant type sysdm.cpl) dialogue and navigate to > Advanced > Environment Variables
• Add this line to PATH variable.

• Add new variable JAVA_HOME with value C:\Program Files\Java\jdk-11.0.2
• Then run java -version from the windows cmd to check if it is working properly.

Tomcat

Download and install the latest 9.0 branch of Apache Tomcat from here. Use the Windows installer.

• Agree with licence agreement
• Deselect Manager from components and click Next
• Set shutdown port to "-1" and connector port to "8080" and click Next
• Modify the JRE path to make it point to installed openjde JDK and click Next
• Leave the installation path on default and click Install
• When it's done deselect option "start tomcat" and click finish.

You can also use Tomcat 9.0.45 and newer, those installers set the service account to Local Service themselves.

After installation, run the Monitor Tomcat application from the Start menu (or run Tomcat9w.exe from the Tomcat bin directory - usually C:\Program Files\Apache Software Foundation\Tomcat 9.0\bin). Configure following settings:

• initial memory pool: 512MB (example for about 5GB RAM).
• maximum memory pool: 4096MB (example for about 5GB RAM).
• Add C:\CzechIdM\etc;C:\CzechIdM\lib;C:\CzechIdM\lib\*; to the beginning of theCLASSPATH.

Configure addresses the server will listen on. Open the C:\Program Files\Apache Software Foundation\Tomcat 9.0\conf\server.xml configuration file in the Tomcat installation. Make these changes:

• Add address="127.0.0.1" to the 8080/tcp and 8009/tcp connectors. This will make Tomcat listen only on localhost.
• Change port number 8005 to -1 at the Shutdown Port setting. This will effectively turn off the shutdown port.
• In the section for Connector protocol="HTTP/1.1" on port 8080, add the maxSwallowSize="-1" property.
• Uncomment the section Connector protocol="AJP/1.3" for the port 8009 and adjust the address parameter: address="127.0.0.1",secretRequired="true" and secret="password for ajp port" . It should look like this:

Use the services.msc dialogue to set the Apache Tomcat StartupType to Automatic (Delayed Start). This will make the application container start after the PostgreSQL database.

For roles and advanced management configuration, please see the relevant chapters in the Server Preparation - Linux tutorial.

Change Tomcat logging properties

In order to set-up log rotation we need stop logging to stdout and start logging to catalina.log .

After change of these tomcat setting and setting-up logback-spring.xml in create_czechidm_configuration IdM will log into catalina.out and after day rotate it into catalina.YYYY-MM-DD.log. Tomcat engine will log into tomcat.log and no totate because there are only log of tomat start. Tomcat will log logs of IdM connectors into tomcat-stdout tomcat9-stdout.YYYY-MM-DD.log - it's well knows bug with workaround to make manual log rotation.

Make these changes in file C:\Program Files\Apache Software Foundation\Tomcat 9.0\conf\logging.properties: Comment out console handler. We don't want tomcat to log to stdout or stderr and other unnesesary logs.

In 1catalina file handler change log level to "INFO" and prefix from "catalina" to "tomcat". Also set property rotable to "false". Tomcat write to this file only when starting or shutting down.

Then in file C:\Program Files\Apache Software Foundation\Tomcat 9.0\conf\server.xml remove creation of access logs. Coment out org.apache.catalina.valves.AccessLogValve. 

Apache httpd as a reverse proxy

It is possible to open Apache Tomcat to the network directly, but somewhat inconvenient. You want the users to access CzechIdM on user-friendly ports 80/tcp or 443/tcp. So we use Apache httpd as a reverse proxy and add a few security features along the way. Apache httpd will allow access to data via https on port 443/tcp and http on port 80/tcp. Communication via http protocol is enabled, but we redirect all communication to https. Communication between Apache httpd and Tomcat takes place on local machine via AJP protocol. In httpd, there will be mod_security installed (optional but recommended), which serves as an application firewall.

The configuration example is written for the server which allows access to its services under the name "demo.czechidm.com".

HTTPd installation and configuration

First, install necessary VCredist library.

Download Apache HTTPd from the apachelounge distribution and unpack it into C:\apache24 folder.

Fire up an elevated shell and install the Apache HTTPd service:

Open the services.msc and reconfigure "Apache2.4" service:

• To have StartupType=Automatic (Delayed start).
• To execute under Local Service user. (On the "Log On" card, set user to Local Service, delete contents of password fields and click Apply.)

Configure the HTTPd in its core config file C:\Apache24\conf\httpd.conf.

Configure the HTTP→HTTPS redirect in the C:\Apache24\conf\extra\httpd-vhosts.conf. Replace demo.czechidm.com with the name of your server. Comment other template vhost which you don't need:

Configure the HTTPS virtual host in the C:\Apache24\conf\extra\httpd-ssl.conf file. Change demo.czechidm.com to the name of your server.

Supply SSL certificate and key in x509 PEM form to c:/Apache24/conf/server.key and c:/Apache24/conf/server.crt files. Apache HTTPd will not start without those files. If you need to generate some ad-hoc certificates, use for example this guide. You can easily invoke the openssl tool from the Git Bash prompt.

Self-signed cert and key for testing purposes can be created like this:

mod_security installation

Download the mod\_security module v 2.x from the Apache Lounge project. Unpack the zip and perform following actions:

• Copy the mod\_security2.so int C:\Apache24\modules directory.
• Copy yajl.dll into C:\Apache24\bin directory.

Create general mod\_security configuration file C:\Apache24\conf\extra\modsec.conf:

Create empty directories C:\Apache24\modsec\_tmp and C:\Apache24\modsec\_lib for mod_security working data.

Mod\_security will become operational but will have no filtering rules. To obtain filtering rules, please visit Mod Security project git. Remember to obtain 2.x version of rules, not the newest 3.x version!

Create directory C:\Apache24\conf\modsecurity\_win.d\activated\_rules. From downloaded zip copy all rules from coreruleset-2.2.9.zip\coreruleset-2.2.9\base\_rules to C:\Apache24\conf\modsecurity\_win.d\activated\_rules. Then downloaded zip copy rule configuration coreruleset-2.2.9.zip\coreruleset-2.2.9\modsecurity\_crs\_10\_setup.conf.example to C:\Apache24\conf\modsecurity\_win.d\modsecurity\_crs\_10\_config.conf.

Now in file C:\Apache24\conf\modsecurity\_win.d\modsecurity\_crs\_10\_config.conf change rule 900012 to look like this: 

Now you can start the Apache HTTPd using its service. If it fails to start, check the Windows EventLog for errors.