Download

The System Administrator should have set up a linked directory structure like [c:]/opt/tomcat. The details of this may differ between installations so from this point on, the “root” Tomcat tomcat directory will be referred to as $TOMCAT.

Download the appropriate version of Tomcat 8.0 from tomcat.apache.org and unpack (unzip/uncompress) into the $TOMCAT. (Refer to Compatibility Guide and Upgrade Planning for supported versions).

Install

Installing on Unix / Linux

Tomcat login scripts

Install the login scripts in Appendix A into the tomcat user home directory. These scripts are correct as of Tomcat 8.0 but the PhixFlow consultant should confirm that no changes are needed because of environment differences or because of different version of Tomcat.

Installing on Windows

Run the tomcat installation program.

server.xml: Port Specification

Modify Some instructions are given here for installing tomcat, and making it run as a service. You should ensure that any installation meets with your company standards.

Installing on windows

Follow these instructions.

Installing on unix/ linux

Follow these instructions.

Anchor
configureTomcat configureTomcat

Configure tomcat

Having completed the basic tomcat installation, stop the tomcat service then make the following changes:

conf/context.xml: cache settings

The default Tomcat cache settings are insufficient for PhixFlow:

Edit $TOMCAT/conf/context.xml:

Add <Resources ... /> to at the end of the <Context/> block so that the file looks something like this:

<Context>
    <!-- lines omitted -->
	<Resources allowLinking="true" cachingAllowed="true" cacheMaxSize="1000000" />
</Context>

conf/server.xml: Connector settings

Edit $TOMCAT/conf/server.xml to specify the port that PhixFlow will use (usually 8081). Find the following lines and change as needed:

...

:

Find the line starting <Connector port="8080"

Edit the <Connector block to

• Use the required port number (port="8080"). Tomcat defaults to port 8080 for HTTP, but you may need to use a different port if you are running other web servers on the same host.
• Enable compression (compression="on"). Compressing responses from the server is particularly important if you are going to access the PhixFlow server over a slow connection (e.g. a mobile data connection).

After editing, the <Connector/> block should look like this:

<!-- Define a non-SSL HTTP/1.1 Connector on port 8080 -->

...

<Connector

...

port="8081"

...

 port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443"
           compression="on"/>

Remember to enable this port in the server’s firewall (if enabled).

web.xml: Session timeout

Modify The default session timeout period is 30 minutes.

We recommend that you change this to a longer period, e.g. 12 hours (720 minutes).

Edit $TOMCAT/conf/web.xml to change the Tomcat

Find the line containing <session-timeout.

Change the session timeout period from its default value (30 mins). Find the following lines and change as needed:). Once changed, it should look something like this (this example shows a 12-hour timeout).

<session-config>

...

	<session-

...

timeout>720</session-timeout>

...

</session-config>

Update <session-timeout> to the value you need, e.g. to 1440 (minutes i.e. 1 day).

Java and JVM Options

Download and install Java from java.com. Java JDK 1.8 is required (and version 1.8.0_74 or greater is recommended). The following JVM (Java Virtual Machine) options should be set to control (amongst other things) the amount of memory reserved for Tomcat and therefore made available for PhixFlow. The options are:

To set JVM options:

...

Windows

...

Run the Tomcat Monitor

Open the Tomcat Monitor system tray Configure … menu

Select the Java tab

Set the Initial memory Pool (see table above)

Set the Max Memory Pool (see table above)

Add the following lines to the Java Options scrollable field:

-XX:MaxPermSize=150m

-verbose:gc

-Djava.awt.headless=true

...

Unix/Linux

If you have installed the scripts in Appendix A, these option will already be set however for clarity, these options are defined in the JAVA_OPTS environment variable set in the tomcat user’s shell startup file (e.g. .profile / .bash_profile / .cshrc in the user’s home directory – the actual startup file is determined by the user’s default shell settings).

...

Pre-installed Web Applications

These are the pre-installed web apps, in more detail.

Database JDBC Drivers

The drivers needed to connect to PhixFlow’s own database are now included in within the release and do not have to be downloaded separately.

Drivers used to connect to external databases may still have to be downloaded.

For information on using SQLServer with Integrated Authentication, see Appendix B

Start Tomcat

To start Tomcat:

...

Windows

...

Run the Tomcat Monitor.

Click on Right mouse menu -> Start Service

...

Unix

...

Login to the unix server as user tomcat.

unix> cd  $TOMCAT
unix> startup.sh

To make Tomcat start automatically when the server boots:

...

Windows

...

Run the Tomcat Monitor.

Right click on the Apache Tomcat icon in the system tray and select Configure …

On the ‘General’ tab:

Set Startup Type to Automatic.

...

Unix

...

As the root user, install the “tomcat” script listed in in Appendix A and create a softlink to it from the appropriate run-level directory. The actual run-level directories are specific to the particular unix variant.

...

You may wish to install tomcat to support secure connections over SSL.

This is described in the standard tomcat documentation - for example https://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html - but some notes are given here to get you started.

Type of certificate

If access to PhixFlow is only intended for people in your organisation, you may wish to create a self-signed certificate. This still provides a secure connection, but this will generate security warnings when users first connect, and they will not see a padlock in the address bar of their browser. If this is not acceptable to your users or by your company policy, or if you are going to provide access to people outside your organisation, you should obtain your certificate from a certificate authority (CA).

A list of certificate authorities is given on https://en.wikipedia.org/wiki/Certificate_authority.

Overview

All installations process will contain the steps:

1. Obtain a certificate - whether self-signed or from a certificate authority
2. Create a keystore
3. Tell tomcat where to find the keystore

Obtain certificate and create keystore

Using the Java tool keytool you can create a self-signed certificate and a keystore in one step.

U

Windows

"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA -keystore <path to keystore file>

E.g.

"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA -keystore C:\app\secure\keystore

Linux

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore <path to keystore file>

E.g.

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/secure/keystore

Enter a keystore password when prompted - <keystorePasswd>

Enter data about your company, contact name, etc - this information will be displayed when users access PhixFlow

Enter a private key password when prompted - <privateKeyPasswd>

Edit the tomcat configuration file

<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443         This connector uses the NIO implementation that requires the JSSE
         style configuration. When using the APR/native implementation, the
         OpenSSL style configuration is required as described in the APR/native
         documentation -->
    <!--
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />
    -->

 <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443         This connector uses the NIO implementation that requires the JSSE
         style configuration. When using the APR/native implementation, the
         OpenSSL style configuration is required as described in the APR/native
         documentation -->
    <!--
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />
    -->

 pack and no action is needed.

If you want to connect, via a Datasource, to an external database, you can rely on the bundled drivers to connect to any database that is one of PhixFlow's supported technologies and versions for its own connection - see Compatibility Guide and Upgrade Planning. If the external database is not covered by these, you will need to install a JDBC driver to support these connections. These JDBC drivers are available from the database suppliers, and must be placed in:

[tomcat home]/lib

For information on using SQLServer with Integrated Authentication, see SQLServer Integrated Authentication.