webMethods Cloud tenant connections

In hybrid integration, an on-premises Integration Server uses a tenant connection to share account and application information with IBM® webMethods Integration. Specifically, the tenant connection enables communication between the on-premises Integration Server and the tenant in IBM webMethods Integration.

A tenant alias contains the location and login details that are needed for the on-premises Integration Server to establish a connection with IBM webMethods Integration. An on-premises Integration Server can have multiple tenant aliases.

Each account on an on-premises Integration Server is associated with one tenant alias. A single tenant alias can be associated with multiple accounts. An on-premises Integration Server contains a pre-defined tenant alias named default. The default tenant alias can be edited to specify different credentials and a different URL for IBM webMethods Integration. However, the default tenant alias cannot be deleted. Note that when an on-premises Integration Server is registered as a webMethods Edge Runtime, IBM webMethods Integration creates a tenant alias that is named EdgeRuntime_EdgeRuntimeName on the on-premises Integration Server.

The tenant alias specifies the credentials that are used to listen for requests and the URL for IBM webMethods Integration with which the on-premises Integration Server shares applications and accounts.

To create a tenant alias, open Integration Server Administrator, go to webMethods Cloud > Tenant connections, and click Create Tenant Connection.

Under Settings, enable the tenant.

Provide a name for the tenant, specify the username for the user account on IBM webMethods Integration, the password identified in the user account for the username, and the URL of IBM webMethods Integration with which to share accounts and applications created on the on-premises Integration Server.

The URL is of the following format: https://sub-domain.domain-name, for example, https://sample.prod-int-aws-us.webmethods.io. To set up a two-way SSL communication, add port 8443 in the URL, for example, https://sub-domain.domain-name:8443

Under Certificate Settings (optional), complete the fields only if you want to set up a two-way SSL communication with IBM webMethods Integration. If you do not configure certificate settings, at a minimum, Integration Server uses one-way SSL communication with IBM webMethods Integration. Integration Server relies on the truststore information in the JVM truststore to establish a connection. Ensure that the JVM truststore contains the CA certificates that are needed to establish a connection to IBM webMethods Integration. If the JVM is configured to use a keystore and key alias, then Integration Server attempts to establish two-way SSL with IBM webMethods Integration.

If you click Update Settings, Integration Server connects to IBM webMethods Integration specified in the webMethods Cloud URL and downloads the configuration information that is required to receive any incoming requests.

Note:

  • If you are using hybrid connectivity and when you update the on-premises settings for the first time after the IBM webMethods Integration upgrade, restart the on-premises webMethods Integration Server. After restart, upload the on-premises account to resume hybrid connectivity. This is applicable for all the on-premises Integration Servers connecting to IBM webMethods Integration.

  • If you have allowed the Cloud Universal Messaging (UM) hostname in the firewall, you must also allow the new UM hostname along with the old one.

  • If IBM has provisioned dedicated UMs for your tenants, and the shared UM queues, if applicable, are imported to the new dedicated UMs, ensure that you update the settings so that hybrid integrations work with the newly provisioned dedicated UMs.

  • If you change the tenant password, you must update the tenant password in IBM webMethods Integration and in the on-premises Integration Server. If you update the tenant password in IBM webMethods Integration, you must update the tenant information in the on-premises Integration Server that connects to IBM webMethods Integration. You can update the tenant password on the on-premises Integration Server when it is not connected to the tenant on IBM webMethods Integration. When you enable the tenant, Integration Server attempts to establish the tenant connection with the new password. After changing the tenant password on the on-premises Integration Server, you must disable and then re-enable the cloud accounts for the affected on-premises servers. If you have changed the webMethods Cloud URL, disable and then re-enable the accounts that use the tenant alias to ensure that information is sent to and received from the new destination. Further, the pre-defined default tenant alias cannot be deleted. Also, a tenant alias that is associated with an account cannot be deleted.

  • At times, Integration Server disables a tenant alias automatically. It will need to be enabled after resolution of the problem that caused the tenant alias to be disabled. For example, when an on-premises Integration Server receives an authorization failure when attempting to connect to IBM webMethods Integration, the on-premises Integration Server does not make repeated attempts to connect to IBM webMethods Integration. Instead, Integration Server disables the tenant alias. This prevents the on-premises Integration Server and other clients from being locked out of the tenant. Disabling a tenant alias does not disable the accounts that are associated with the alias. An enabled account can still process and respond to service execution requests from IBM webMethods Integration even if the associated tenant alias is disabled. To stop an account from processing requests from IBM webMethods Integration, disable the account.

Updating IBM webMethods Integration Server's Password

You can update the IBM webMethods Integration Server's password by using one of the following approaches:

  • Approach 1: Pausing IBM webMethods Integration Flow services

  • Approach 2: Without pausing IBM webMethods Integration Flow services

Note:

  • Approach 1 is the recommended method.

  • In both approaches, the on-premises Integration server need not be restarted.

Approach 1: Pausing IBM webMethods Integration Flow services

It is recommended to use Approach 1 to ensure that the running Flow services do not encounter an error.

  1. Suspend the running IBM webMethods Integration Flow services.

  2. Update the tenant password in IBM webMethods Integration.

  3. Update the on-premises server tenant password (tenant configuration under WmCloud in Integration Server Admin portal) to match with the new IBM webMethods Integration server's password. This step must be repeated for every affected on-premises server.

  4. Disable and re-enable the cloud accounts for the affected on-premises servers.

  5. Resume IBM webMethods Integration Flow services. 

Approach 2: Without pausing IBM webMethods Integration Flow services

Perform all of these steps immediately before the current running service calls to the on-premises server times out. The default timeout value is 60 seconds. Otherwise, there is a chance that the IBM webMethods Integration Flow services might encounter errors due to service timeout.

  1. Disable the cloud accounts used in IBM webMethods Integration to prevent Flow services from using on-premises services. The accounts are configured in the WmCloud configuration menu for each on-premises server that connects to IBM webMethods Integration.

  2. Update the tenant password in IBM webMethods Integration.

  3. Update the on-premises server tenant password (tenant configuration under WmCloud in Integration Server Admin portal) to match with the new IBM webMethods Integration server's password. This step must be repeated for every affected on-premises server.

  4. Re-enable the cloud accounts.