...
Note | ||
---|---|---|
| ||
HTTP traffic files recorded in in Virtualize 99.10.x and later cannot be used with 9.9.x verions and earlier. |
In this section:
Table of Contents | ||
---|---|---|
|
...
Scroll Table Layout | ||
---|---|---|
|
Reverse Proxy | You can choose a Reverse Proxy HTTP Listener that you defined when creating the proxy (see Creating Proxies) from the |
---|
menu or use the default listener. You can also add Reverse Proxy HTTP Listeners from this dialog:
|
|
| |
Proxy listen path | Enter the path where the proxy should listen for incoming connections. To listen to all paths, select |
---|
[All] |
from the |
menu. No two message proxies can have HTTP proxy connections with the same proxy path or with a path that matches an existing virtual asset’s HTTP path. See Service Forward Path and Proxy Listen Path for more details. | |
Proxy URL | Displays the URL that should be given to the AUT.See Directing AUTs to Proxies for additional information. |
---|
Primary Connection (outgoing) & Secondary Connection (outgoing)
Service URL | Contains the full URL for the target application (comprising the service host, service port, and forward path). You can enter a complete URL here and/or edit specific components in the following fields. Updates made in one area will be propagated to the other (for example, if you modify the port in the URL, the value in the Service port field will be updated automatically). |
---|---|
Service host | Enter the host name of the machine where the service resides. This is the machine to which the proxy will send messages. If you want the proxy to forward to a virtual asset on the local server without consuming an HTTP connection, enter host.virt.internal, localhost, or 127.0.0.1 rather than the actual hostname. When using localhost or 127.0.0.1, the service port must match the port Virtualize is deployed on; when using host.virt.internal the service port is not used. For example, a virtual asset deployed on |
Service port | Enter the port where the service is listening. This is the port to which the proxy will send messages. |
Service forward path | (Optional) Enter the path to which the proxy should forward the messages that it receives. If blank, this defaults to the value in the Proxy listen path field. If the HTTP proxy is sending messages to localhost, you must enter a Service forward path because the proxy doesn't allow forwarding to itself. If the Service forward path sends a redirect, the proxy will follow the redirect and then respond back. It will not pass the redirect back to the client. See Service Forward Path and Proxy Listen Path for more details. |
Options
Mode: Allows you to set the active forwarding connection when a primary and secondary connection exist. For example, during a recording session, a message proxy may forward to the live service as the primary connection and fall back to a virtual service as a secondary connection. In this case, you can set the HTTP mode to Primary and enable Use other connection if selected mode fails.
...
Info | ||
---|---|---|
| ||
Message Responders can be configured to bypass this proxy failover for internally routed messages by enabling the "Skip message proxy failover" option option. |
If this option is not enabled, the active connection will be used for recording.
If this option is enabled, select a recording option from the Record dropdownmenu:
- Both connections: Records traffic for both the primary and secondary connections. Error messages from the active connection will not be recorded; instead, the messages will be sent to the backup connection and the responses will be recorded. Errors reported by the backup will be recorded.
- Primary connection only: Records traffic for the active connection. Does not record errors.
- Secondary connection only: Records traffic for the backup connection, including errors.
...
The Service SSL section needs to be completed only completed only if the service you are working with uses SSL.
the service the service being virtualized uses virtualized uses SSL and/or other authentication (basic/digest, Kerberos, NTLM), additional configuration may be required.For details on completing the Service SSL fields immediately below these fields, see Security Configuration.
If...
You can specify a server for the message proxy in this tab, which enables you to configure a different proxy server for traffic to and from different message proxies. This configuration provides control over which proxy server handles traffic between the application under test and a specific message proxy.
To specify proxy settings at this level, provide the appropriate details in the proxy’s Proxy Server tab.
...
You can use wildcard characters to specify dynamic path segments. For example, configuring the path as as /path/*/service
would enable the following paths to go to the same proxy:
...
- Set the service host and port to that of the Virtualize Server where the virtual asset is deployed. If you want the proxy to forward to a virtual asset on the local server without consuming an HTTP connection, enter, host.virt.internal, localhost, or 127.0.0.1 rather than the actual hostname. When using localhost or 127.0.0.1, the service port must match the port Virtualize is deployed on; when using host.virt.internal, the service port is not used.
- Set the proxy connection’s Service forward path to the virtual asset’s path (found in the virtual asset’s Transports> Transports > HTTP tab, under HTTP endpoint).
...
- Create a plain text file and specify the properties you want to set (see Reverse Proxy HTTP Listener Message Proxy Performance Properties and Reverse Proxy HTTP Listener Message Proxy SSL Properties).
Save the file to the VirtualAssets directory in your workspace the VirtualAssets directory in your workspace and name it it "embeddedServer.properties".
The file will be read every time a proxy with a Reverse Proxy HTTP Listener is enabled.
...
Scroll Table Layout | ||
---|---|---|
|
embedded.connector.maxHttpHeaderSize | Specify the maximum size of the request and response HTTP header (bytes). If not specified, this attribute is set to 8192 (8 KB). |
---|---|
embedded.connector.parseBodyMethods | Specify HTTP methods to use when parsing |
embedded.connector.relaxedPathChars | Specify characters that should be allowed in URI paths in unencoded form. The value may be any combination of the following characters:
Any other characters present in the value will be ignored. If this property is not included, Tomcat will reject unencoded forms of the above characters in URI paths. Refer to the Tomcat documentation for additional information: https://tomcat.apache.org/tomcat-8.5-doc/config/http.html. |
embedded.connector.relaxedQueryChars | Specify characters that should be allowed in URI queries in unencoded form. The value may be any combination of the following characters:
Any other characters present in the value will be ignored. If this property is not included, Tomcat will reject unencoded forms of the above characters in URI queries. Refer to the Tomcat documentation for additional information: https://tomcat.apache.org/tomcat-8.5-doc/config/http.html. |
Reverse Proxy HTTP Listener Message Proxy Performance Properties
...
Scroll Table Layout | ||
---|---|---|
|
embedded.connector.maxThreads | Specify the maximum number of request-processing threads the connector should create. This property determines the maximum number of simultaneous requests that can be handled. Default is 200. |
---|---|
embedded.connector.minThreads | Specify the minimum number of threads that should always be running. Default is |
embedded.connector.acceptors | Specify the number of threads that should be used to accept connections. Increase this value on machines with multiple CPUs or when you are using several non-keep-alive connections. 1 or 2 is adequate in most cases. Default is 1. |
embedded.connector.idleTimeout | Specify how many milliseconds the connector should wait for another HTTP request before closing the connection. Specify -1 to allow the connector to wait indefinitely. Default is use connectTimeout. |
embedded.connector.soLingerTime | Specify how many milliseconds the sockets used by the connector should linger when the sockets are closed. Lingering is disabled by default. |
embedded.connector.acceptorPriorityDelta | Specify the priority of the acceptor threads used to accept new connections. See the java.lang.Thread JavaDoc for additional details. Default is 5. |
embedded.connector.acceptQueueSize | Specify the maximum queue length for incoming connection requests when all possible request processing threads are in use. Any requests received when the queue is at capacity will be refused. Default is 100. |
embedded.connector.connectTimeout | Specify how many milliseconds the connector should wait for the request URI line to be presented after accepting a connection. Enter -1 to allow the connector to wait indefinitely. Default is 60000. |
Reverse Proxy HTTP Listener Message Proxy SSL Properties
Scroll Table Layout | ||
---|---|---|
|
embedded.ssl.includeProtocols | Comma-separated list of SSL protocols to support for HTTPS connections. If specified, only the protocols in the list will be supported by the SSL implementation in the JVM. If this property is not set, the protocols supported by the JVM are used (excluding SSLv2 and SSLv3 if the JVM enables either or both of them by default). |
---|---|
embedded.ssl.includeCipherSuites | Comma-separated list of encryption ciphers to support for HTTPS connections. Use the JSSE cipher naming convention to specify the ciphers. If the property is set, only the ciphers in the list will be supported by the SSL implementation. If this property is not set, the JVM's default cipher suites, except for suites that are not considered secure, will be supported. As a result, a very limited set of ciphers will be available by default for older JVMs. |
embedded.ssl.useCipherSuitesOrder | Set to |
embedded.ssl.maxCertPathLength | The maximum number of intermediate certificates that will be allowed when validating client certificates. Default is 5. |
embedded.ssl.crlPath | Sets the path to the file containing the certificate revocation list used for verifying client certificates. If not defined, client certificates will not be checked against a certificate revocation list. |
embedded.ssl.keyManagerAlgorithm | Sets the certificate encoding algorithm to be used. By default, KeyManagerFactory.getDefaultAlgorithm() is used, which returns SunX509 for Sun JVMs. IBM JVMs return IbmX509 . |
embedded.ssl.truststoreAlgorithm | Sets the algorithm used for truststore. If not specified, the default value returned by javax.net.ssl.TrustManagerFactory.getDefaultAlgorithm() is used. |
embedded.ssl.useKeyManagerAlgorithmForTruststore | If set to true , the key manager algorithm is used as the truststore algorithm. This takes precedent over the embedded.ssl.truststoreAlgorithm property. Default is |
false
False. |
Example: Sending Traffic to a Service
Assume that we want to create a message for a service that is normally accessed at http://example.parasoft.com:9080/BookStore
. We could create an HTTP Reverse proxy with the settings:
- Proxy listen path: /BookStore
- Service host: example.parasoft.com
- Service port: 9080
- Service forward path: [empty]
This configuration will listen on /BookStore
and forward all traffic to the actual book store bookstore service.
If we wanted to listen on a path other than the service path, we would change the configuration of the proxy as follows:
...
This would route traffic from /SomeOtherPath
on the proxy to the actual book store bookstore service.
In both cases, all traffic that goes to those paths (including sub paths) is sent to the service. In the second example, traffic sent to /SomeOtherPath/SubPath
would be sent to /BookStore/SubPath
. Because queries are preserved, /SomeOtherPath?param=value
would be sent to /BookStore?param=value
.
Forwarding Requests to Services that Require Case-sensitive Header Names
If you are using the desktop's server, your message proxy headers will be lowercased and may fail to function properly when requests are forwarded to a service that requires case-sensitive HTTP header names.
You can create a _global.headers file in the /VirtualAssets/
directory and add the headers using the specific capitalization you want to pass. Right-click the server in the UI and re-deploy all virtual assets to begin using this file in your environment.
You can also address HTTP header capitalization issues for specific message proxies. Create a <proxy<PROXY-name>NAME>.headers file in the /VirtualAssets/
directory and add the headers using the specific capitalization you want to pass for the specific proxy. This file will apply to specific proxy and override the global file. Right-click the server in the UI and re-deploy all virtual assets to begin using this file in your environment.
...
Code Block |
---|
X-AUTHORIZATION ANOTHER-HEADER HEADER3 |
Example: Sending Traffic to a Virtual Asset
A proxy can also send traffic to a virtual asset. In that case, enter the host and port information for the Virtualize Server as if were just another service.
...
- Proxy listen path: /proxyPath
- Service host: server.parasoft.com
- Service port: 9080
- Service forward path: /assetPath
...
Anchor | ||||
---|---|---|---|---|
|
Proxy-level security configuration—which configuration, which is relevant if the service to which you are forwarding the traffic uses SSL and/or access authentication—coversauthentication, covers:
...
For SSL, additional settings are required. In the lower part of the configuration panel, you need to specify whether to:
- Enable trust for self-signed certificates.
- Enable trust for all certificatecertificates.
- Set a trust store to validate server certificates.
Additionally, you need to provide the information needed to use a specific key store and certificate so Parasoft can determine which certificate to present to a server (e.g.for example, for 2-way SSL).
SSL Configuration Panel Fields
Scroll Table Layout | ||
---|---|---|
|
Option | Description |
---|---|
Use SSL when connecting to the service | Enables the SSL. |
Trust all server certificates | If enabled, any certificate will be accepted. No validation will be performed. This option disables trust validation when the message proxy establishes the connection with the service; it makes it accept the connection with any certificate that is presented by the service.In general, this option should be enabled if certificate trust is not a focus for the environment |
where Virtualize is deployed. | |
Accept self-signed certificates | If enabled, certificates will be accepted as long as the validation method java.security.cert.X509Certificate.checkValidity() returns true on them, which effectively checks if the current date and time are within the validity period given in the certificate. The certificate trust path will not be evaluated and the provided Trust-store configuration will not be applied. This option determines if certificates presented by the service and are not signed by a trusted certificate authority are trusted.In general, this option should be enabled if certificate trust is not a focus for the environment |
where Virtualize is deployed. |
Note that the Truststore configuration (described below) is applicable only if Trust all server certificates and Accept self-signed certificates are both unselecteddisabled.
Keystore Configuration Panel Fields
Scroll Table Layout | ||
---|---|---|
|
Option | Description |
---|---|
Key store file | Specifies the path to the key store file. The keystore determines the certificates and keys that are presented by the message proxy to the service during the SSL handshake. |
Key store password | Specifies the password to access the key store. |
Key store type | Specifies the type of the key store. |
Certificate | Specifies the alias of the certificate to use when authenticating to a server. |
After completing the keystore detail, click the Load and choose the certificate alias to present to the server from the Certificate drop-down menu. If the Certificate dropdown menu is not populated when you click Load, you may have entered the incorrect password or keystore type.
Truststore Configuration Panel Fields
These fields are applicable only if Trust all and Accept self-signed certificates (described above) are both unselecteddisabled.
Scroll Table Layout | ||
---|---|---|
|
Option | Description |
---|---|
Key store file | Specifies the path to the truststore file. The truststore determines the certificates that the message proxy should trust when |
handshaking with the service. If the service presents a certificate that is not included in this store, the connection will be refused. If no truststore is provided, the default JRE truststore will be used. This option is only applicable if |
Trust all server certificates is |
disabled. | |
Key store password | Specifies the password to access the truststore. |
Key store type | Specifies the type of the truststore. |
NTLM Settings Panel Fields
Scroll Table Layout | ||
---|---|---|
|
Option | Description |
---|---|
Use NTLM | Specifies whether the service requires NTLM authentication. |
Username | Specifies the username for NTLM authentication. |
Password | Specifies the password for NTLM authentication. |
Kerberos Panel Fields
Scroll Table Layout | ||
---|---|---|
|
Option | Description |
---|---|
Kerberos service principal | Specifies the service principal to authenticate the request. |
Anchor | ||||
---|---|---|---|---|
|
...
Server-level Configuration
Server-level security configuration—which configuration, which is relevant if the AUT uses SSL and/or access authentication—can authentication, can involve:
- Configuring the Virtualize Server
- Using NTLM with WAFFLE
- Using Unsupported Configurations (Kerberos with WAFFLE, JAAS)
...
You can change the default port number (9080), enable SSL, and configure other server settings. See Configuring Virtualize Server for details.
Anchor | ||||
---|---|---|---|---|
|
...
- Copy the following jar files into tomcat's
lib
directory: jna.jar, platform.jar, wafflejna.jar. Add the following to the server.xml file in the
tomcat/conf/server
directory.xml.Code Block <Context> <Valve className="waffle.apache.NegotiateAuthenticator" principalFormat="fqn" roleFormat="both"/> <Realm className="waffle.apache.WindowsRealm" /> </Context>
Info title Where is server.xml? If you installed SOAtest but not Virtualize: Launch SOAtest, ensure that at least one responder has been created, then modify the server.xml file at <INSTALL>
<INSTALL-DIR>/plugins/com.parasoft.ptest.libs.web_<VERSION>/root/tomcat/conf/
server.xmlIf you installed Virtualize but not SOAtest: Launch Virtualize, ensure that at least one responder has been created, then modify the server.xml file at <INSTALL>
<INSTALL-DIR>/plugins/com.parasoft.ptest.libs.web_<VERSION>/root/tomcat/conf/
server.xmlIf you installed Virtualize and SOAtest together: Launch Virtualize, ensure that at least one responder has been created, then modify the server.xml file at <INSTALL>
<INSTALL-DIR>/plugins/com.parasoft.ptest.libs.web_<VERSION>/root/tomcat/conf/
server.xmlAdd the following to the web.xml file in the
tomcat/conf/web.xml
directory.Code Block <security-role> <role-name>Everyone</role-name> </security-role> <security-constraint> <display-name>Waffle Security Constraint</display-name> <web-resource-collection> <web-resource-name>Protected Area</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <auth-constraint> <role-name>Everyone</role-name> </auth-constraint> </security-constraint>
- Restart the server.
...