Randy Stanley's Blog

Change vCAC Deployment to Use SSL and HTTPS

Thursday, March 28th, 2013 at 11:10 am

When you initially install the the vCloud Automation Center (vCAC) solution you have the option to install with communication on either HTTP or HTTPS. Since the install with HTTP is easier because you don’t need to generate SSL Certificates for IIS, this is often the route that is taken in lab or test environments. While not easy, you do have the option of converting your installation over to HTTPS by making the following changes to the vCAC server components.

Note: The lines below <!–HTTP–> designate the HTTP version of the line and the lines below <!–HTTPS–> designate the HTTPS version. Only one of the lines is necessary and the <!–HTTP–> / <!–HTTPS–> sections should not be included in the configuration files.

Stop all vCAC Services (manager service, DEMs, Agents)
Import SSL Certificate to the Model Manager and Web Portal IIS Servers
Set Bindings for HTTPS (443) and Select the newly imported SSL Certificate
Modify the web.config file located in C:\Program Files (x86)\DynamicOps\Self-Service Portal:

<appSettings>
...
  <!--HTTP-->
  <add key="repositoryAddress" value="http://VCAC-DEMO:80/repository/"/>
  <!--HTTPS-->
  <add key="repositoryAddress" value="https://VCAC-DEMO:443/repository/"/>
...
</appSettings>

<client>
...
  <!--HTTP-->
  <endpoint address="VCAC-DEMO:9003/VMPS" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IProvision" name="ProvisionProxy" bindingConfiguration="basicHttp" behaviorConfiguration="ProvisionServiceBehavior"/>
  <endpoint address="http://VCAC-DEMO:9003/VMPS/MachineEvents" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IMachineEvents" name=""/>
  <endpoint address="http://VCAC-DEMO:9003/VMPS/Administration" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IAdministration" name=""/>
  <!--HTTPS-->
  <endpoint address="https://VCAC-DEMO:443/VMPS" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IProvision" name="ProvisionProxy" bindingConfiguration="basicHttp" behaviorConfiguration="ProvisionServiceBehavior"/>
  <endpoint address="https://VCAC-DEMO:443/VMPS/MachineEvents" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IMachineEvents" name=""/>
  <endpoint address="https://VCAC-DEMO:443/VMPS/Administration" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IAdministration" name=""/>
...
</client>

Modify the web.config file located in C:\Program Files (x86)\DynamicOps\DCAC Server\Website\

<appSettings>
...
  <!--HTTP-->
  <add key="repositoryAddress" value="http://VCAC-DEMO:80/repository/"/>
  <!--HTTPS-->
  <add key="repositoryAddress" value="https://VCAC-DEMO:443/repository/"/>
...
</appSettings>

Modify the web.config file located in C:\Program Files (x86)\DynamicOps\DCAC Server\Report.Website\

<appSettings>
...
  <!--HTTP-->
  <add key="repositoryAddress" value="http://VCAC-DEMO:80/repository/"/>
  <!--HTTPS-->
  <add key="repositoryAddress" value="https://VCAC-DEMO:443/repository/"/>
...
</appSettings>

Modify the managerservice.exe.config file located in C:\Program Files (x86)\DynamicOps\DCAC Server

<appSettings>
...
  <!--HTTP-->
  <add key="repositoryAddress" value="http://VCAC-DEMO:80/repository/"/>
  <!--HTTPS-->
  <add key="repositoryAddress" value="https://VCAC-DEMO:443/repository/"/>
...
</appSettings>
 
...
<!--HTTP-->
<serviceConfiguration serviceUri="http://VCAC-DEMO:9003/VMPS" websiteUri="" authorizationStore="mssql://Driver={SQL Server};server=VCAC-DEMO\sqlexpress;/DCAC/Repository" authorizationStoreCacheRefreshInterval="00:00:00" connectionString="Data Source=VCAC-DEMO\sqlexpress;Initial Catalog=DCAC;Integrated Security=True;MultipleActiveResultSets=True;Connect Timeout=200; pooling=True; Max Pool Size=200" connectionStringConfig="Data Source=VCAC-DEMO\sqlexpress;Initial Catalog=DCAC;Integrated Security=True;MultipleActiveResultSets=True" workflowRuntimeSection="WorkflowRuntime" emailProvider="DynamicOps.VRM.ActiveDirectoryEmailPlugin.ActiveDirectoryEmailPlugin, DynamicOps.VRM.ActiveDirectoryEmailPlugin" VmpsMasterControl="false" EnterpriseAdminHasGroupAdminRights="true" attachmentFileShare="" licenseFilePath="lic.xml"/>
<!--HTTPS-->
<serviceConfiguration serviceUri="https://VCAC-DEMO:443/VMPS" websiteUri="" authorizationStore="mssql://Driver={SQL Server};server=VCAC-DEMO\sqlexpress;/DCAC/Repository" authorizationStoreCacheRefreshInterval="00:00:00" connectionString="Data Source=VCAC-DEMO\sqlexpress;Initial Catalog=DCAC;Integrated Security=True;MultipleActiveResultSets=True;Connect Timeout=200; pooling=True; Max Pool Size=200" connectionStringConfig="Data Source=VCAC-DEMO\sqlexpress;Initial Catalog=DCAC;Integrated Security=True;MultipleActiveResultSets=True" workflowRuntimeSection="WorkflowRuntime" emailProvider="DynamicOps.VRM.ActiveDirectoryEmailPlugin.ActiveDirectoryEmailPlugin, DynamicOps.VRM.ActiveDirectoryEmailPlugin" VmpsMasterControl="false" EnterpriseAdminHasGroupAdminRights="true" attachmentFileShare="" licenseFilePath="lic.xml"/>
...

NOTE: In the next section, please be aware of the change from mexHttpBinding to mexHttpsBinding and the change from httpGetUrl to httpsGetUrl and httpGetEnabled to httpsGetEnabled

<system.serviceModel>
  <services>
    ...
    <service name="DynamicOps.VMPS.Service.ProxyAgentService" behaviorConfiguration="ProxyAgentServiceBehavior">
      ...
      <!--HTTP-->
      <endpoint address="http://VCAC-DEMO/VMPS2" bindingConfiguration="ProxyAgentBinding" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IVMPSProxyAgent"/>
      <endpoint address="http://VCAC-DEMO:9001/VMPS2/mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
      <!--HTTPS-->
      <endpoint address="https://VCAC-DEMO:443/VMPS2" bindingConfiguration="ProxyAgentBinding" binding="basicHttpBinding" contract="DynamicOps.VMPS.Contracts.IVMPSProxyAgent"/>
      <endpoint address="https://VCAC-DEMO:443/VMPS2/mex" binding="mexHttpsBinding" contract="IMetadataExchange"/>
      ...
    </service>
    ...
    <service name="DynamicOps.Common.Tasks.TaskDispatcherServiceHost">
    ...
      <!--HTTP-->
      <endpoint binding="basicHttpBinding" contract="DynamicOps.Common.Tasks.ITaskDispatcher"/>
      <!--HTTPS-->
      <endpoint binding="basicHttpBinding" contract="DynamicOps.Common.Tasks.ITaskDispatcher" bindingConfiguration="TaskDispatcherBinding"/>
    ...
    </service>
    ...
  </services>
...
  <bindings>
    <basicHttpBinding>
      <binding name="ProxyAgentBinding" maxReceivedMessageSize="6553600">
        <readerQuotas maxStringContentLength="6553600"/>
        <!--Add Security Section For HTTPS-->
        <security mode="Transport">
          <transport clientCredentialType="None"/>
        </security>
      </binding>
      <binding name="ProvisionServiceBinding" maxReceivedMessageSize="6553600">
        <readerQuotas maxStringContentLength="6553600" maxArrayLength="104857600"/>
        <!--Add Security SectionFor HTTPS-->
        <security mode="Transport">
          <transport clientCredentialType="None"/>
        </security>
      </binding>
      <binding name="VrmApprovalServiceBinding" closeTimeout="00:10:00" openTimeout="00:10:00" receiveTimeout="00:10:00" sendTimeout="00:10:00">
      </binding>
      <binding name="VrmApprovalServiceEndPoint" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true">
        <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384"/>
        <security mode="None">
          <transport clientCredentialType="None" proxyCredentialType="None" realm=""/>
          <message clientCredentialType="UserName" algorithmSuite="Default"/>
        </security>
      </binding>
      <!--Add Binding Section For HTTPS-->
      <binding name="TaskDispatcherBinding">
        <security mode="Transport">
          <transport clientCredentialType="None"/>
        </security>
      </binding>
    </basicHttpBinding>
    <netTcpBinding>
      <binding name="ServiceBinding"/>
    </netTcpBinding>
  </bindings>
  <behaviors>
    <serviceBehaviors>
      ...
      <behavior name="ProxyAgentServiceBehavior">
        <!--HTTP-->
        <serviceMetadata httpGetUrl="http://VCAC-DEMO/VMPS2" httpGetEnabled="true"/>
        <!--HTTPS-->
        <serviceMetadata httpsGetUrl="https://VCAC-DEMO:443/VMPS2" httpsGetEnabled="true"/>
      </behavior>
      ...
    </serviceBehaviors>
  </behaviors>
</system.serviceModel>

Modify the DynamicOps.DEM.exe.config in C:\Program Files (x86)\DynamicOps\Distributed Execution Manager\<DEM_Name>\

<appSettings>
...
  <!--HTTP-->
  <add key="repositoryAddress" value="http://VCAC-DEMO:80/repository/"/>
  <!--HTTPS-->
  <add key="repositoryAddress" value="https://VCAC-DEMO:443/repository/"/>
...
</appSettings>

<system.serviceModel>
  <bindings>
    <basicHttpBinding>
      <binding name="BasicHttpBinding_Provision" closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:04:00" allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard" maxBufferSize="65536" maxBufferPoolSize="524288" maxReceivedMessageSize="65536" messageEncoding="Text" textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true">
        <readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384" maxBytesPerRead="4096" maxNameTableCharCount="16384"/>
        <!--Add Security Section For HTTPS-->
        <security mode="Transport">
          <transport clientCredentialType="None"/>
        </security>
      </binding>
    </basicHttpBinding>
  </bindings>
...
  <client>
    <!--HTTP-->
    <endpoint address="http://VCAC-DEMO:9003/VMPS" binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_Provision" contract="Provision" name="BasicHttpBinding_Provision"/>
    <!--HTTPS-->
    <endpoint address="https://VCAC-DEMO:443/VMPS" binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_Provision" contract="Provision" name="BasicHttpBinding_Provision"/>
  </client>
</system.serviceModel>

Modify the VRMAgent.exe.config file located in C:\Program Files (x86)\DynamicOps\DCAC Agents\<Agent_Name>\

<appSettings>
...
  <!--HTTP-->
  <add key="repositoryAddress" value="http://VCAC-DEMO/repository/"/>
  <!--HTTPS-->
  <add key="repositoryAddress" value="https://VCAC-DEMO:443/repository/"/>
...
</appSettings>

<!--HTTP-->
<serviceConfiguration workitemTimerInterval="00:00:02" agentName="Test" stateTimerInterval="00:01:00" pingTimerInterval="00:01:00" workitemThreadCount="50" workitemRetrievalCount="500" vrmUrl="http://VCAC-DEMO/VMPS2" activeQueueSize="500" executeState="false" executePing="true" executeWorkitemRetrieval="true" WorkItemCacheFile="C:\Program Files (x86)\DynamicOps\DCAC Agents\Test\temp\WorkItems.bin"/>
<!--HTTPS-->
<serviceConfiguration workitemTimerInterval="00:00:02" agentName="Test" stateTimerInterval="00:01:00" pingTimerInterval="00:01:00" workitemThreadCount="50" workitemRetrievalCount="500" vrmUrl="https://VCAC-DEMO:443/VMPS2" activeQueueSize="500" executeState="false" executePing="true" executeWorkitemRetrieval="true" WorkItemCacheFile="C:\Program Files (x86)\DynamicOps\DCAC Agents\Test\temp\WorkItems.bin"/>

<applicationSettings>
  <DynamicOps.Vrm.Agent.Core.Properties.Settings>
    <setting name="DynamicOps_Vmps_Agent_Core_VMPSAgentService_ProxyAgentService" serializeAs="String">
      <!--HTTP-->
      <value>http://VCAC-DEMO/VMPS2</value>
      <!--HTTPS-->
      <value>https://VCAC-DEMO:443/VMPS2</value></setting>
  </DynamicOps.Vrm.Agent.Core.Properties.Settings>
</applicationSettings>

<system.serviceModel>
  <client>
    <!--HTTP-->
    <endpoint name="Tasks" binding="basicHttpBinding" contract="DynamicOps.Common.Tasks.ITaskDispatcherClient"/>
    <!--HTTPS-->
    <endpoint name="Tasks" binding="basicHttpBinding" contract="DynamicOps.Common.Tasks.ITaskDispatcherClient" bindingConfiguration="AgentBinding"/>
  </client>
  ...
  <!--Add Bindings Section For HTTPS-->
  <bindings>
    <basicHttpBinding>
      <binding name="AgentBinding">
        <security mode="Transport">
          <transport clientCredentialType="None"/>
        </security>
      </binding>
    </basicHttpBinding>
  </bindings>
</system.serviceModel>

(If Necessary) Modify the CloudUtil.exe.config file for Design Center installations

<appSettings>
...
  <!--HTTP-->
  <add key="repositoryAddress" value="http://localhost:80/repository/"/>
  <!--HTTPS-->
  <add key="repositoryAddress" value="https://localhost:443/repository/"/>
...
</appSettings>

Run IISReset on all web component servers
Restart the vCAC Manager Service
Restart the vCAC DEMs

The Unofficial vCloud Automation Center (vCAC) FAQs

Friday, December 21st, 2012 at 4:55 pm

Comments (3)

I created this unofficial FAQ list around the VMware vCloud Automation Center (vCAC) product to try and help answer some common questions that we run into or that might impact planning, design and/or operation. If anything here is incorrect or needs to be updated, please leave me a comment.

Question:	Is vCAC available as a virtual appliance?
Answer:	No, the vCAC product is a Windows installable solution. Windows 2008 R2 Server is preferred.

Question:	Does vCAC support other database platforms besides Microsoft SQL?
Answer:	No, vCAC currently requires a version of Microsoft SQL to be available. SQL Express is acceptable for non-production.

Question:	Can the vCAC product be installed on a single server?
Answer:	Yes, but this would not be a deployment architecture sufficient for a production environment and should only be used for testing or evaluation.

Question:	Where is the logout button on the vCAC Portal?
Answer:	vCAC utilizes an integrated Windows authorization process by default. This can be changed in the browser to always prompt for username & password. Thus, no logout button.

Question:	Why does vCAC use the AzMan Authorization Store? Is it caching user credentials?
Answer:	No, vCAC is not caching user credentials. The AzMan Authorization Store is utilized for role-based access control and as a tool to connect vCAC roles to Active Directory users or security groups.

Question:	Does vCAC require Active Directory?
Answer:	Yes, due to the architecture and use of AzMan, vCAC currently requires Active Directory.

Question:	Do I need Visual Studio to do workflow creation or modification?
Answer:	No, you can utilize a tool called Design Center included with vCAC to complete many of the necessary workflow changes for your environment.

Question:	Do I need to have vCloud Director available in order to use vCAC?
Answer:	No, however in many environments the use of vCloud Director provides key and foundational cloud architecture and functionality necessary to achieve a Software Defined Datacenter. vCAC does have the ability to connect directly to vCenter as well as several other physical, virtual and cloud-based resources.

Question:	All I need is a simple, clean provisioning service for my end users, can vCAC do this?
Answer:	Yes, this is exactly what vCAC was designed to do. It gives you a clean, workflow-driven provisioning portal to simplify the experience for end users.

Question:	I know vCAC will connect with VMware products, but can it connect with other 3rd party products?
Answer:	Yes, the vCAC product is very powerful out of the box, however it is architected as a framework which is extensible to other applications and data models.

Question:	Do vCAC services communicate over SSL?
Answer:	Yes, all vCAC services can be setup to utilize SSL, however the certificates whether self-signed or CA-signed will need to be generated manually and installed on each server prior to installing the product.

Question:	Does vCAC support SSO?
Answer:	No, the vCAC application does not currently support SSO.

Question:	Can vCAC utilize vCenter or vCloud Director resources in different data centers?
Answer:	Yes, the vCAC product is designed to integrate with resources that are distributed and disparate.

Question:	vCAC installs to the C:\Program Files (x86) folder, is it a 32-bit application? NEW
Answer:	No, the software packager/installer used with vCAC is the 32-bit WiX toolset, however the vCAC core application services are running in native 64-bit.

Question:	Are all workflows in vCAC based upon Microsoft .NET 4 Workflow Foundation (WF)? NEW
Answer:	No, currently the main workflow referred to as the Master Workflow is executing with .NET 3.5. All other workflows and those executed by the Distributed Execution Managers (DEMs) are executing with .NET 4.0.

VMware vCAC 5.1 Install Process – Overview

Friday, December 21st, 2012 at 11:31 am

Comments (4)

I have heard of some who have experienced issues with installing the new VMware vCloud Automation Center 5.1 product. While the application does have multiple roles and services you must plan and account for, it actually isn’t too difficult to get up and running once you know the order of operation.

I’ll try to summarize the steps here for running the product as an evaluation without going into the step-by-step instructions, so as to keep the post to 1-page. The thing to keep in mind with this product is that it is leveraging the Microsoft OS, the .NET 3.5 & 4.0 frameworks, IIS, and MSDTC. I have also provided some prerequisite scripts in another post here which will help in preparing a Windows 2008 R2 Server VM for the vCAC 5.1 product. If the installation fails be sure to check the c:\vcacLog directory, you’ll find the install error in that log. Also, if you need to start the install again, dump the database to make life easier.

Warning: These steps are only for product evaluation and are not intended as a production deployment. Production deployments require the separation of roles for availability, scalability and performance.

General Guidance:

If doing an evaluation, then one server works fine for all roles and then use a locally installed SQLExpress database.
If doing lab or production environment, then consider placing:
- The Manager Service and Orchestrator DEM on Server #1
- The Web Components: Model Manager, Self-Service Portal and Reports on Server #2
- The Worker DEM and Agents on Server #3
- The Database on a separate, dedicated SQL 2008 R2 database server
If doing a highly available environment, inclusion of a load balancer will be needed and multiples of the service roles above will be necessary, but that is for another post.

Installation overview for an evaluation environment:

Start with a clean Windows 2008 R2 Server VM attached to your AD domain
Install Microsoft SQL Express
Install Microsoft .NET Framework 4.0/4.5
Install and run the vCAC Prerequisite Checker (DCACPrereqCheckerInstaller.msi)
Complete all of the requirements manually or grab my vCAC_PrereqSetup.ps1 script

Note: This involves setting up IIS, configuring some authentication settings, and modifying MSDTC and the firewall. Also, if you plan on using security certificates for component communication, generate and install them now, because once you start the install you’ll need to restart to add them later. Keep in mind, this is not necessary or required for a working evaluation, but should be done in production.

Next, right-click and run the vCAC Manager Service installer (DCAC-Manager-Setup.exe) as Administrator and have your XML License file ready
Since this is an evaluation environment and not production, you can choose to install all components including the database
The first setting will be the database, be sure to specify as ServerName\InstanceName, for example: SERVER01\SQLExpress
Test access, if access fails then the account you are running the installer as does not have dbo or sysadmin rights or you may have forgotten the instance name.
Select an AzMan authorization store. For an evaluation the File based XML store or the MSSQL Server store work fine, I would probably just use the File based XML.

Note: If interested, you can use the AzMan.msc management console plugin to review the data within the store. Just point it at the Security.xml file or the database after installation.

You have the option to have vCAC services communicate over either HTTP (port 80) or HTTPS (port 443). If you decide to go HTTPS, then you will need to generate manually a certificate either self-signed or CA-signed. The vCAC product does not create one for you. In an evaluation, it is easiest to choose HTTP.

Note: Which ever protocol you choose, HTTP or HTTPS, you will need to use it for all components for all installs going forward. Choose wisely, because it is not easy to change it later.

For each of the next components, the easiest thing to use is the administrator account you are installing with or a service account with local admin rights.

Note: if using an account different than the one you’re installing with, make sure that account has Sysadmin rights to the SQLExpress database server. Running the command, SQLCMD -S localhost\sqlexpress -Q “SP_ADDSRVROLEMEMBER ‘domain\ServiceAccount‘,’SYSADMIN’” should do the trick. Grab the SQLCMD utility from here if you don’t have it.

Always specify the username in the DOMAIN\USER format and be patient, the installer takes awhile.
Next, install the DEM Worker service using the DEM installer (DCAC-DEM-Setup.exe) as Administrator.
DEM names can be whatever you choose and makes sense, sometimes relative to location or usage or role.
Again utilize the same user account or service account utilized above.
Next, run the DEM installer again, but this time installing the DEM Orchestrator role
Finally, deploy the vCAC Self-Service Portal (DCAC-SelfService-Setup.exe) possibly located in the Extensibility folder
Same settings as above and don’t forget the instance name on the database
The core product installation is done, now for configuration, endpoint and agent setup, and wherever your cloud journey may lead. The application UIs are in the format of http(s)://servername/DCAC/ and http(s)://servername/DCACSelfService/

Hopefully this helps some out there and if I missed anything, please share and I’ll fix.

vCAC – Running Manager and DEM Service in Console Mode

Wednesday, December 19th, 2012 at 12:34 pm

Leave your comment

As part of the VMware vCloud Automation Center (vCAC) product, it is possible to run several key application services like the Manager Service and the Distributed Execution Manager Services in console mode for debug or observation purposes. For example, this will allow you to see when workflows have been assigned and/or executed. In order to run it this way:

Stop the Manager Service or the Distributed Execution Manager Service on the server
Open a command prompt on the server
Manually launch the Manager Service or the Distributed Execution Manager Service with the -console flag

Manager Service Example:

“C:\Program Files (x86)\DynamicOps\DCAC Server\ManagerService.exe” -console

Distributed Execution Manager Example:

“C:\Program Files (x86)\DynamicOps\Distributed Execution Manager\[DEM Name]\DynamicOps.dem.exe” -console

Note: Each DEM is unique to your installation, so please change the [DEM Name] to your specific folder name.

vCAC_Console

Page 1 of 3 1 2 3 »

Randy Stanley's Blog

Change vCAC Deployment to Use SSL and HTTPS

The Unofficial vCloud Automation Center (vCAC) FAQs

VMware vCAC 5.1 Install Process – Overview

vCAC – Running Manager and DEM Service in Console Mode

About Me

Topics

Recent Posts

Categories

Archives