I would like to use Capistrano to deploy our web application but we don't have direct access to the application server.
We now log in to the admin server and run the deploy script from there. The application server is not reachable from our developers machines:
+-------------+ +--------------+ +--------------------+
| Dev machine +---+ Admin server +---+ Application server |
+-------------+ +--------------+ +--------------------+
If I understand correctly Capistrano just uses SSH to run remote scripts. Is there a way to tell it to "proxy" through to the application server?
Yes, you can run cap from your Dev machine, tunneled through the Admin server. You just have to set Admin server as a "gateway", and ensure your dev ssh key is on both machines.
set :gateway, 'admin_server_ip'
See http://blog.codefront.net/2008/05/15/deploying-with-capistrano-via-a-gateway/ for more options.
Related
At first, my application was not SSO configured so I was able to run the application on my localhost server in protractor by the concept of creating proxy files.
But I cannot able to run my protractor scripts after the environment is configured to SSO. Do I need to any other setup to make my scripts work on localhost for SSO configured applications.
I'm trying to deploy a build to a VM using the Manage IIS App agent task on Visual Studio Team Services. However, when I attempt to connect via HTTP, it comes back with the following error:
The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain, then HTTPS transport must be used or the destination machine must be added to the TrustedHosts
Unfortunately, I don't have the ability to deploy over HTTPs for reasons beyond my control so I'm trying to get around this issue by setting the VM as a trusted host, but I can't figure out how to do this using VS Online.
You can’t add trusted host to Hosted build agent (Get access is denied result if add trusted host via winrm command during build)
You can setup a new build agent and configure it to add trusted host with winrm s winrm/config/client '#{TrustedHosts="RemoteComputer"} command, after that, using this build agent to build/release.
About how to setup a new build agent, you can refer to this article.
While running two app servers (which has mobilefirst servers hosted 7.1 version) from ibm http server, only one server runs successfully on keeping only one of the Route attribute active in the plugin-cfg.xml of the http server. In the server which is not running, the following error is seen in the messages.log.
CWWKS4001E: The security token cannot be validated. This can be for the following reasons
1. The security token was generated on another server using different keys.
2. The token configuration or the security keys of the token service which created the token has been changed.
3. The token service which created the token is no longer available.
Kindly guide in resolving the error above.
Thanks.
Sounds like your two servers have not exchanged/shared LTPA keys and IHS and the WAS Plugin are a red herring.
http://www.ibm.com/support/knowledgecenter/SSAW57_liberty/com.ibm.websphere.wlp.nd.doc/ae/twlp_sec_ltpa.html
http://www.ibm.com/support/knowledgecenter/SSAW57_liberty/com.ibm.websphere.wlp.nd.doc/ae/twlp_sec_sso.html
Note: For SSO to work across Liberty servers, full profile servers, or both, set the following resources:
The servers must use the same LTPA keys and share the same user registry.
Sounds like communication issue between two servers. Are the inbound ports opened on another server to communicate with HTTP server? if they are opened use telnet and test whether both servers (HTTP and app server) are communicating with each other.
On HTTP Server, open command prompt and enter below command.
telnet <app server ip> <app server port>
If this is not successful then you need to open ports on app server.
This article shows to how to secure the service fabric cluster in the Azure:
https://azure.microsoft.com/en-us/documentation/articles/service-fabric-visualstudio-configure-secure-connections/
But it makes no references as to how to configure developer's machine for the same. I tried to apply the same principles in the above link to see if I can make it work. It always fails to deploy services locally but works like a charm when I publish them to azure's service fabric cluster. If I remove the secure bindings, I can deploy services to local cluster successfully. But this becomes tedious whenever I want to publish the services to the azure's secure cluster.
Does any one have an idea as to how to go about creating a secure service fabric cluster on developer's machine?
I am using Service Fabric version 5.5.216.0 and it seems to be working. Run powershell command:
PS C:\Program Files\Microsoft SDKs\Service Fabric\ClusterSetup> .\DevClusterSetup.ps1 -PathToClusterDataRoot "C:\SfDevCluster\Data" -PathToClusterLogRoot "C:\SfDevCluster\Log" -AsSecureCluster
Then, open IE to browse "https://localhost:19080/Explorer/". You will see a popup asking you to choose which client certificate to connect. Use the one with name 'ServiceFabricDevClusterCert'. Chrome didn't work for me as it failed directly with no useful warning. Maybe somewhere in chrome I should enable popup window?
I'm using the Keycloak authorization server in order to manage my application permissions. However, I've found out the standalone server can be accessed locally only.
http://localhost:8080/auth works, but not it does http://myhostname:8080/auth. This issue doesn't permit accessing the server from the internal network.
The standalone Keycloak server runs on the top of a JBoss Wildfly instance and this server doesn't allow accessing it externally by default, for security reasons (it should be only for the administration console, but seems to affect every url in case of Keycloak). It has to be booted with the -b=0.0.0.0 option to enable it.
However, if your Wildfly is running on a remote machine and you try to
access your administrative page through the network by it’s IP address
or hostname, let’s say, at http://54.94.240.170:8080/, you will
probably see a graceful This webpage is not available error, in
another words, Wildfly said “No, thanks, I’m not allowing requests
from another guys than the ones at my local machine”.
See also:
Enable Wildfly remote access
Wildfly remotely access administration console doesnt work
you can start keycloak server with this command
standalone.bat -b 0.0.0.0
For anyone who happens by here now, I found this in the documentation for Keycloak 8:
Users can interact with Keycloak without SSL so long as they stick to
private IP addresses like localhost, 127.0.0.1, 10.0.x.x, 192.168.x.x,
and 172.16.x.x. If you try to access Keycloak without SSL from a
non-private IP address you will get an error.
This is how you can disable it from the admin console, just click on your realm, and make the mentioned option.
Note: Don't forget the following
standalone.bat -b 0.0.0.0