Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

9
Replies
916
Views
Nikhil_Agarwal Member since 2015 37 posts
Posted: Aug 22, 2016
Last activity: Jul 12, 2017
Closed

Rule level keystore vs Server level

Hi

We ran into an issue with Connect-SOAP where when we supplied keystore at App server (Websphere), then connect soap works fine in 7.1.7. However, the same SOAP call doesn't work fine in 7.1.9 in another app.

We tried supplying Keystore at rule level i.e. in Connect SOAP rule, by enabling WS-Security and creating a security profile containing keystore. And it worked fine.

a) Can someone explain this inconsistency in behaviour from 7.1.7 - 7.1.9..?

b) And which one is the preferred option - Rule level or Server level KS..?

Thanks

***Updated by moderator: Marissa to add SR Details***

To see attachments, please log in.
Data Integration
Support Case Exists

Posted: 8 years ago

I would like to get clarification on below queries.

the same SOAP call doesn't work fine in 7.1.9 in another app?

Are you using same application server for 7.1.9? If yes, keystore is present or not? Which application scope keystore is present like node,cell and cluster levels in WAS?

Regarding your 2nd question, rule level keystore would be applicable to that particular application only, whereas if you specify at application server level it should be applicable to other applications also.

Hope this helps!

 

To see attachments, please log in.
Posted: 8 years ago

the same SOAP call doesn't work fine in 7.1.9 in another app? 

- No it doesn't

Are you using same application server for 7.1.9? If yes, keystore is present or not? Which application scope keystore is present like node,cell and cluster levels in WAS?

- Same appserver. Keystore is at cell level.

Thanks

To see attachments, please log in.
Posted: 8 years ago

Can you cofirm that in 7.1.9 you did not "enable WS Security" and instead just used the WS Security profile to set the keystore/truststore information?

To answer one of your questions: as you have seen, the best option in the Pega versions you are using is the Rule-Level settings.

To see attachments, please log in.
Posted: 8 years ago

I have enabled WS Security and then supplied Security Profile.


Jeff - On a different note, say I have 60 connectors in my application, don't you think it's less maintainable solution if in future keystore or trustore changes..? 

To see attachments, please log in.
Posted: 8 years ago

Hi Nikhil,  

On WebSphere, cell, node and server level trust store support was broken in 7.1.9 and remains so in 7.2.1.  We are shipping a fix with 7.2.2.

We understand that trust stores are often managed by different teams and may change by environment (dev, test, prod, etc.).   Thus, managing these within Pega rules causes some operational headaches.

Thanks,

Charlie

 

 

 

To see attachments, please log in.
Posted: 8 years ago

Hi Charlie

Thanks a lot for clarifying this riddle.

Question : Is there any "one stop" alternative or workaround to store trustores/keystores for 7.1.9-7.2..? (I have 65 connectors in my application and it's a nightmare to change these in different envs.)

Thanks

To see attachments, please log in.
Posted: 7 years ago

HI Charlie,

We are using Pega 7.2.1 and trying to connect with Connect -Soap with keystore and truststore defined WAS cluster level. But Pega is not able to pick up the keystore and truststore from WAS cluster level. Is this because of support broken in 7.2.1 ? Is there any fix to resolve the issue?

Regards

Hari

 

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice