Configure the web app server for a Teamcenter management console web tier component

If, when the Teamcenter management console was installed, in the JMX Configuration panel a Web Tier component was added, then the web application server for the component must be configured to allow authenticated remote JMX connection. Authentication is typically accomplished using LDAP. This procedure applies only to a Java-based web tier; the console does not support a .NET (IIS) web tier. Use the following procedures to enable remote JMX connection. The procedure steps vary depending on the web application server software, such as JBoss, Tomcat or WebSphere. JBoss JBOSS Enterprise Edition implements its own JMX connector with built-in security to allow JMX Remote Connection. This built-in security does not use the LDAP server used by the Teamcenter management console. Note Siemens Digital Industries Software certifies only JBoss Enterprise Application Platform versions of JBoss. Mapping to appropriate WildFly versions should work, but is not directly tested or certified. When running in stand-alone mode, the native management endpoint runs with the default port 9999. To access this native management securely, a management user in the ManagementRealm realm is required. Procedure Edit the JBoss standalone.xml configuration file. The file resides in the JBOSS_HOME/standalone/configuration directory. In the section interface, on the line for the inet-address, change the value from the default local host ip address (127.0.0.1) to the actual host name of the machine on which JBoss is running. In the section socket-binding-group, add the new socket binding: In the section management-interfaces, depending on JDK version, add native-interface socket binding. JDK version Earlier than JDK 17 JDK 17 or later Add a user by running the JBOSS_HOME/bin/add-user.sh script (Linux) or JBOSS_HOME\bin\add-user.bat script (Windows). This utility prompts you for the following information: For this parameter Do this Type Select Management User. Realm Enter the name of the realm used to secure the management interface. The default is ManagementRealm. Username Type the user name to be created. Password Type the password for the user. Groups Type the group names that the user should be part of. The default is leave blank, for no groups. User connects process to another process? Type no. Tip There is no management user created by default in JBoss. You can add the same user accounts in JBoss as those in the LDAP repository used by the Teamcenter management console. Teamcenter management console attempts to connect to JBoss Remote Management using its credentials. If the same user exists in JBoss Management, then a silent logon occurs in the Teamcenter management console. If not, then the Teamcenter management console prompts a logon challenge to connect JBOSS Enterprise Edition Remote Management. Restart JBoss. To allow the Teamcenter management console to connect to JBoss JMX Remote Management, JBoss Client Library is required. Stop the Teamcenter management console if it is running. Open the Teamcenter management console com.teamcenter.jeti.mgmt.jmx.jboss-[Teamcenter version].jar bundle that resides in the TC_ROOT/mgmt_console/container/bundles folder using any utility (for example, 7zip). Inside the bundle, add a new folder called lib and add the jboss-cli-client.jar to this new folder. The jboss-cli-client.jar file can be found in the JBOSS_HOME/bin/client directory. Remove all folders in the TC_ROOT\mgmt_console\container\data folder. Restart the Teamcenter management console. Tomcat Procedure Create an ldap.config file with the following content: Copy MgmtLdapConfig { com.sun.security.auth.module.LdapLoginModule REQUIRED userProvider="ldap://localhost:15389/ou=Users,ou=Management,ou=JETI, dc=Teamcenter,dc=PLM,o=Siemens" authIdentity="uid={USERNAME},ou=Users,ou=Management,ou=JETI, dc=Teamcenter,dc=PLM,o=Siemens" authzIdentity=controlRole useSSL=false debug=false; }; Note Ensure that the LDAP settings are configured properly (for example, the LDAP protocol, host, port, and so on.) Establish the ldap.config file depending on the web app server and operating system. For this combination Do this Tomcat on Red Hat Enterprise Linux Place the ldap.config file in your Tomcat root directory. For example, /apps/apache-tomcat-. Modify the Tomcat startup configuration (catalina.sh) to include the following JAVA_OPTS variable: Copy JAVA_OPTS="-Dcom.sun.management.jmxremote.port=8089 -Dcom.sun.management.jmxremote.login.config=MgmtLdapConfig -Djava.security.auth.login.config=/ldap.config -Dcom.sun.management.jmxremote.ssl=false" export JAVA_OPTS Tomcat on other than Red Hat Enterprise Linux Place the ldap.config file in your Tomcat root directory. Modify the Tomcat startup configuration to add the following JAVA_OPTS variable: Copy set "JAVA_OPTS=%JAVA_OPTS% -Dcom.sun.management.jmxremote.port=8089 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.login.config=MgmtLdapConfig -Djava.security.auth.login.config=Tomcat-root-directory\ldap.config" How you add the options varies depending on how Tomcat is installed. If Tomcat is installed as a Windows service, then the configuration changes can be made by using the configuration utility. Otherwise, you must locate the corresponding startup scripts and modify the JVM arguments shown in the preceding example. For example, add the Java arguments in doStart function of the catalina.bat file. Restart the web app server. WebSphere The Teamcenter management console does not support secured remote JMX connection to WebSphere due to vendor issues. However, it is possible to configure WebSphere for an unsecured JMX remote connection. Procedure Log on to the WebSphere administration console and navigate to the configuration tab of the server instance on which the Teamcenter web tier is deployed. In the Server Infrastructure setting group, expand Java and Process Management and click Process definition. In the Additional Properties setting group, click Java Virtual machine. Within the Generic JVM arguments input field, add the following JVM arguments: Copy -Djavax.management.builder.initial= -Dcom.sun.management.jmxremote.port=8089 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false Save and apply the changes and restart the server.