Differences

This shows you the differences between two versions of the page.

--- tutorial:adm:server_preparation [2019/10/04 12:30]
urbanl [Apache Tomcat configuration recommended for production usage] Fix issue with diacritics on tomcat 7
+++ tutorial:adm:server_preparation [2019/11/27 08:29]
fiserp [HTTPd installation and configuration]
@@ Line 199: / Line 199: @@
 ===== Tomcat =====
+<note warning>This version of Tomcat install guide is suspected not to work properly with newer versions of IdM (we are currently investigating the issue). Please use [[https://wiki.czechidm.com/tutorial/adm/server_preparation?rev=1550580216|this revision]] of the guide to install and configure Tomcat.</note>
 Installation - CentOS7:
 <code bash>
-yum install -y tomcat
+yum install -y tomcat java-1.8.0-openjdk-headless java-1.8.0-openjdk-devel
 </code>
@@ Line 637: / Line 639: @@
 To do so, add following lines to the virtualhost config file (ssl.conf):
 <code>
-  RewriteEngine On
+RewriteEngine On
-  RewriteRule "^/$"  "/idm/" [R]
+RewriteRule "^/$"  "/idm/" [R]
 </code>
-In the file ssl.conf we also have to disable SSLv3. Edit the line with SSLProtocol directive:
+We also have to secure the communication. **Edit** corresponding lines in ''ssl.conf'' so they look like this.
 <code>
-SSLProtocol all -SSLv2 -SSLv3
+SSLProtocol all -SSLv2 -SSLv3 -TLSv1 -TLSv1.1
+SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:!LOW:!RC4:!3DES+SHA:!IDEA
+SSLHonorCipherOrder on
 </code>
+<note>In some cases older clients (i.e. IE10 and older, Java6, etc.) will not be able to communicate with IdM. If this is your case, you may need to slacken the cipher settings a bit.</note>
 On Debian, create symlinks to sites-enabled: