close

Filter

Close X
loading table of contents...

Operations Basics / Version 2010

Table Of Contents

4.4.2 Communication Through a Firewall

In order to communicate with the CoreMedia Server or Workflow Server, two open ports are required:

  • The HTTP port to fetch the IOR

  • The CORBA port for communication

In the default configuration, the CORBA port changes with every restart of the application server which is inconvenient in case of an intermediate firewall. In this case, the port can be set to a fixed value through the property com.coremedia.corba.server.port. In the following example, the ORB is configured to listen on port 55555, by setting a system property:

  • -Dcom.coremedia.corba.server.port=55555

If you want to access the Server from "outside" a firewall and the server IP address is not directly accessible (due to network address translation for example), it is possible to establish an SSH tunnel. The tunnel forwards all traffic from the client to the server. Of course, the endpoint of the tunnel must be able to reach the server. Figure 4.2, “Schema of the SSH tunnel” shows the scenario:

Schema of the SSH tunnel

Figure 4.2. Schema of the SSH tunnel


Four parties are involved in the tunneling:

  • A client <CMSClient> which cannot access the server directly.

  • The client-side SSH client <SSHClient> which cannot access the Content Server.

  • The server-side SSH server <SSHServer> which can access the Content Server.

  • The CoreMedia Server <CMSServer>.

<CMSClient>/<SSHClient> and <CMSServer>/<SSHServer> can reside on the same machine respectively.

Two ports must be configured:

  • <HTTPPort> is the HTTP port for the IOR.

  • <CORBAPort> is the port for CORBA communication.

For this scenario you must do the following:

  • Establish the tunnel

  • Redirect client requests to the tunnel endpoint SSHClient instead of CMSServer

Proceed as follows:

  1. Configure the HTTP port of the server as usual, for example, in application.properties.

  2. Configure the HTTP address where to fetch the IOR of the server in the capclient.properties file as follows:

  • cap.client.server.ior.url=http://<SSHClient>:<HTTPPort>/ior

  1. Start a SSH server on <SSHServer>. No particular configuration is necessary.

  2. Start the SSH client on <SSHClient>.

  3. On a UNIX system, open the tunnel on the SSHClient with 

    ssh -g -L<CORBAPort>:<CMSServer>:<CORBAPort> \
       -L<HTTPPort>:<CMSServer>:<HTTPPort> \
       <SSHServer>

    . Replace the values in angle brackets with the appropriate settings.

  4. For the Windows SSH client SSH Secure Shell choose Edit|Settings|Profile Settings|Tunneling|Incoming. You need to make two entries. Insert as follows:

    • Type: TCP

    • Listen Port: <HTTPPort>

    • Destination Host: <CMSServer>

    • Destination Port: <HTTPPort>

    and

    • Type: TCP

    • Listen Port: <CORBAPort>

    • Destination Host: <CMSServer>

    • Destination Port: <CORBAPort>

    This will instruct ssh to forward all requests on <SSHClient>:<Port> via <SSHServer> to <CMSServer>:<Port>.

  1. In order to instruct a client to contact <SSHClient> instead of <CMSServer>, you need to configure its client-side ORB with system properties.

    For command line tools, you can set system properties in the JPIF file.

    You need to set the following properties, replacing <CMSServer> and <SSHClient> with the names of the appropriate computers and <CorbaPort> with the port number of the ends of the SSH tunnel:

Property Type Property Name Property Value
System com.coremedia.corba.client.redirect.original-host <CMSServer>
System com.coremedia.corba.client.redirect.redirect-host <SSHClient>
System com.coremedia.corba.client.redirect.original-port <CorbaPort>
System com.coremedia.corba.client.redirect.redirect-port <CorbaPort>

Table 4.1. Properties for SSH configuration


An alternative to setting up a SSH tunnel might be the use of a VPN, or SSL.

Search Results

Table Of Contents