Installing MobileFirst Server in graphical mode

• Run install.exe to install Installation Manager as administrator. Root is needed on Linux or UNIX. On Windows, the administrator privilege is needed. In this mode, the information about the installed packages is placed in a shared location on the disk and any user that is allowed to run Installation Manager can update the applications.
• Run userinst.exe to install Installation Manager in user mode. No specific privilege is needed. However, in this mode, the information about the installed packages are placed in the user's home directory. Only that user can update the applications that are installed with Installation Manager.

1. Go to File > Preferences and click Add Repositories....
2. Browse for the repository.config file of diskTag.inf file in the directory where the installer is extracted.
3. Select the file and click OK.
4. Click OK to close the Preferences panel.

1. Select IBM WebSphere Application Server Liberty Core and click Next.
2. Accept the terms in the license agreements, and click Next.

• If the installation is successful, the program displays a message indicating that installation is successful. The program might also display important postinstallation instructions.
• If the installation is not successful, click View Log File to troubleshoot the problem.

If you install Liberty with Installation Manager in administrator mode, the files are in a location where non-administrator or non-root users cannot modify the files. For the scope of this tutorial, move the usr directory that contains the servers in a place that does not need specific privileges. In this way, the installation operations can be done without specific privileges.

1. Go to the installation directory of Liberty.
2. Create a directory named etc. You need administrator or root privileges.
3. In etc directory, create a server.env file with the following content:

   WLP_USER_DIR=<path to a directory where any user can write>

   For example, on Windows:

   WLP_USER_DIR=C:\LibertyServers\usr

1. Start a command line.
2. Go to liberty_install_dir/bin, and enter server create mfp1.

   This command creates a Liberty server instance named mfp1. You can see its definition at liberty_install_dir/usr/servers/mfp1 or WLP_USER_DIR/servers/mfp1 (if you modify the directory as described in step 6).

1. Go to File > Preferences and click Add Repositories....
2. Browse for the repository file in the directory where the installer is extracted.

   If you decompress the IBM MobileFirst Platform Foundation V8.0 .zip file for MobileFirst Server in mfp_installer_directory folder, the repository file can be found at mfp_installer_directory/MobileFirst_Platform_Server/disk1/diskTag.inf.

   You might also want to apply the latest fix pack that can be downloaded from IBM Support Portal. Make sure to enter the repository for the fix pack. If you decompress the fix pack in fixpack_directory folder, the repository file is found in fixpack_directory/MobileFirst_Platform_Server/disk1/diskTag.inf.

   Note: You cannot install the fix pack without the repository of the base version in the repositories of Installation Manager. The fix packs are incremental installers and need the repository of the base version to be installed.
3. Select the file and click OK.
4. Click OK to close the Preferences panel.

In this tutorial, it is assumed that token licensing is not needed and the steps to configure MobileFirst Server for token licensing are not included. However, for production installation, you must determine whether you need to activate token licensing or not. If you have a contract to use token licensing with Rational® License Key Server, select Activate token licensing with the Rational License Key Server option. After you activate token licensing, you must do extra steps to configure MobileFirst Server. For more information, see Installing and configuring for token licensing.

By default, this user is a user declared on the operating system of the computer that runs DB2. That is, a user with a login for that computer. If such user exists, the next action in step 3 is not needed. In the later part of the tutorial, the Server Configuration Tool creates all the tables that are required by the product under a schema in that database.

1. Open a session with a user that has SYSADM or SYSCTRL permissions. For example, use the user db2inst1 that is the default admin user that is created by the DB2 installer.
2. Open a DB2 command line processor:
   • On Windows systems, click Start > IBM DB2 > Command Line Processor.
   • On Linux or UNIX systems, go to ~/sqllib/bin (or db2_install_dir/bin if sqllib is not created in the administrator's home directory) and enter ./db2.
3. Enter the following SQL statements to create a database that is called MFPDATA:

   CREATE DATABASE MFPDATA COLLATE USING SYSTEM PAGESIZE 32768
   CONNECT TO MFPDATA
   GRANT CONNECT ON DATABASE TO USER mfpuser
   GRANT CREATETAB ON DATABASE TO USER mfpuser
   GRANT IMPLICIT_SCHEMA ON DATABASE TO USER mfpuser
   DISCONNECT MFPDATA
   QUIT

   If you defined a different user name, replace mfpuser with your own user name.

   Note: The statement does not remove the default privileges granted to PUBLIC in a default DB2 database. For production, you might need to reduce the privileges in that database to the minimum requirement for the product. For more information about DB2 security and an example of the security practices, see DB2 security, Part 8: Twelve DB2 security best practices.

• On Linux, from application shortcuts Applications > IBM MobileFirst Platform Server > Server Configuration Tool.
• On Windows, click Start > Programs > IBM MobileFirst Platform Server > Server Configuration Tool.
• On Mac OS, open a shell console. Go to mfp_server_install_dir/shortcuts and type ./configuration-tool.sh.

  The mfp_server_install_dir directory is where you installed MobileFirst Server.

In this tutorial, the environment ID is not used. It is a feature for advanced deployment scenario.

1. Enter the host name that runs your DB2 server. If it is running on your computer, you can enter localhost.
2. Change the port number if the DB2 instance you plan to use is not listening to the default port (50000).
3. Enter the path to the DB2 JDBC driver. For DB2, the file that is named as db2jcc4.jar is expected. It is also needed to have the db2jcc_license_cu.jar file in the same directory. In a standard DB2 distribution, these files are found in db2_install_dir/java.
4. Click Next.

1. Enter mfpuser as DB2 user name and its password. Use your own DB2 user name if it is not mfpuser.
2. Enter MFPDATA as the name of the database.
3. Leave MFPDATA as the schema in which the tables will be created. Click Next. By default, Server Configuration Tool proposes the value MFPDATA.

This pane is used when the database that is entered in the previous pane does not exist on the DB2 server. In that case, you can enter the user name and password of the DB2 administrator. The Server Configuration Tool opens an ssh session to the DB2 server and runs the commands as described in Creating a database to create the database with default settings and the correct page size.

1. Enter the installation directory for WebSphere Application Server Liberty.
2. Select the server where you plan to install the product in the server name field. Select mfp1 server that is created in step 7 of Installing WebSphere Application Server Liberty Core.
3. Leave the Create a user option selected with its default values.

   This option creates a user in the basic registry of the Liberty server, so that you can sign in to MobileFirst Operations Console or to the administration service. For a production installation, do not use this option and configure the security roles of the applications after the installation as described in Configuring user authentication for MobileFirst Server administration.

4. Select the Server farm deployment option for the deployment type.
5. Click Next.

When the push service is installed, HTTP or HTTPS flows are needed from the administration service to the push service, and from the administration service and the push service to the runtime component.

When this option is selected, the Server Configuration Tool configures the applications to connect to the applications installed on the same server. When you use a cluster, enter the URL that is used to connect to the services from your HTTP load balancer. When you install on WebSphere Application Server Network Deployment, it is mandatory to enter a URL manually.

A client ID and a password are needed to register the push service and the administration service as the confidential OAuth clients for the authorization server (which is by default, the runtime component). The Server Configuration Tool generates an ID and a random password for each of the service, that you can keep as-is for this getting started tutorial.

To enable the connection to the Analytics server, you need to first install MobileFirst Analytics. However, the installation is not in the scope of this tutorial.

Go to http://localhost:9080/mfpconsole. By default, the server runs on port 9080. However, you can verify the port in the element <httpEndpoint> as defined in the server.xml file.

By default, the Liberty server generates a default certificate that is not known by your web browser, you need to accept the certificate. Mozilla Firefox presents this certification as a security exception.

The login and password are encrypted between your web browser and MobileFirst Server. In production, you might want to close the HTTP port.

1. Start a command line.
2. Go to liberty_install_dir/bin, and enter server create mfp2.

1. Go to the second server directory.

   The directory is liberty_install_dir/usr/servers/mfp2 or WLP_USER_DIR/servers/mfp2 (if you modify the directory as described in step 6 of Installing WebSphere Application Server Liberty Core).

2. Edit the server.xml file. Replace

   <httpEndpoint id="defaultHttpEndpoint"
       httpPort="9080"
       httpsPort="9443" />

   with

   <httpEndpoint id="defaultHttpEndpoint"
       httpPort="9081"
       httpsPort="9444" />

   The HTTP and HTTPS ports of the server mfp2 do not conflict with the ports of the server mfp1 with this change. Make sure to modify the ports before you run the installation of MobileFirst Server. Otherwise, if you modify the port after the installation is made, you also need to reflect the change of the port in the JNDI property: mfp.admin.jmx.port.

1. Create a configuration Hello MobileFirst 2.
2. Do the same installation procedure as described in Running the Server Configuration Tool but select mfp2 as the application server. Use the same database and same schema.
   Note:

   • If you use an environment ID for server mfp1 (not suggested in the tutorial), the same environment ID must be used for server mfp2.
   • If you modify the context root for some applications, use the same context root for server mfp2. The servers of a farm must be symmetric.
   • If you create a default user (admin/admin), create the same user in the server mfp2.

[configuredatabase] Checking connectivity to MobileFirstAdmin database MFPDATA with schema 'MFPDATA' and user 'mfpuser'...
[configuredatabase] Database MFPDATA exists.
[configuredatabase] Connection to MobileFirstAdmin database MFPDATA with schema 'MFPDATA' and user 'mfpuser' succeeded.
[configuredatabase] Getting the version of MobileFirstAdmin database MFPDATA...
[configuredatabase] Table MFPADMIN_VERSION exists, checking its value...
[configuredatabase] GetSQLQueryResult => MFPADMIN_VERSION = 8.0.0
[configuredatabase] Configuring MobileFirstAdmin database MFPDATA...
[configuredatabase] The database is in latest version (8.0.0), no upgrade required.
[configuredatabase] Configuration of MobileFirstAdmin database MFPDATA succeeded.

1. Open a web browser.
2. Enter the following URL: http://localhost:9080/mfpconsole. The console is served by server mfp1.
3. Log in with admin/admin.
4. Open a tab in the same web browser and enter the URL: http://localhost:9081/mfpconsole. The console is served by server mfp2.
5. Log in with admin/admin. If the installation is done correctly, you can see the same welcome page in both tabs after login.
6. Return to first browser tab and click Hello, admin > Download Audit Log. You are logged out of the console and see the login screen again.
   This logout behavior is an issue. The problem happens because when you log on to server mfp2, a Lightweight Third Party Authentication (LTPA) token is created and stored in your browser as a cookie. However, this LTPA token is not recognized by server mfp1. Switching between servers is likely to happen in a production environment when you have an HTTP load balancer in front of the cluster. To resolve this issue, you must ensure that both servers (mfp1 and mfp2) generate the LTPA tokens with the same secret keys. Copy the LTPA keys from server mfp1 to server mfp2.

   1. Stop both servers with these commands:

      server stop mfp1
      server stop mfp2

   2. Copy the LTPA keys of server mfp1 to server mfp2.
      From liberty_install_dir/usr/servers or WLP_USER_DIR/servers, run the following command depending on your operating system.

      • On UNIX: cp mfp1/resources/security/ltpa.keys mfp2/resources/security/ltpa.keys
      • On Windows: copy mfp1/resources/security/ltpa.keys mfp2/resources/security/ltpa.keys
7. Restart the servers. Switch from one browser tab to another other does not require you to relogin. In a Liberty server farm, all servers must have the same LTPA keys.

1. In WLP_USER_DIR/servers/mfp1/resources/security, enter keytool -list -keystore key.jks. The command shows the certificates in the keystore. There is only one named default. You are prompted for the password of the keystore (mobilefirst) before you can see the keys. This is the case for all the next commands with Keytool utility.
2. Export the default certificate of server mfp1 with the command: keytool -exportcert -keystore key.jks -alias default -file mfp1.cert.
3. In WLP_USER_DIR/servers/mfp2/resources/security, export the default certificate of server mfp2 with the command: keytool -exportcert -keystore key.jks -alias default -file mfp2.cert.
4. In the same directory, import the certificate of server mfp1 with the command: keytool -import -file ../../../mfp1/resources/security/mfp1.cert -keystore key.jks The certificate of server mfp1 is imported into the keystore of server mfp2 so that server mfp2 can trust the HTTPS connections to server mfp1. You are asked to confirm that you trust the certificate.
5. In WLP_USER_DIR/servers/mfp1/resources/security, import the certificate of server mfp2 with the command: keytool -import -file ../../../mfp2/resources/security/mfp2.cert -keystore key.jks. After this step, the HTTPS connections between the two servers are possible.