Page Comparison

Step 6.1 - Configure the common configurations

        <JDBC>
            <Enabled>false</Enabled>
 			...
        </JDBC>

1. Open the <API-M_HOME>/repository/conf/axis2/axis2.xml file and comment out the following.

   Code Block
   language xml
   <transportSender name="ws" class="org.wso2.carbon.websocket.transport.WebsocketTransportSender"> <parameter name="ws.outflow.dispatch.sequence" locked="false">outflowDispatchSeq</parameter> <parameter name="ws.outflow.dispatch.fault.sequence" locked="false">outflowFaultSeq</parameter> </transportSender>

2. Delete the WebSocketInboundEndpoint.xml file from the <API-M_HOME>/repository/deployment/server/synapse-configs/default/inbound-endpoints directory.

3. Multiexcerpt include
   MultiExcerptName removejaggery PageWithExcerpt Product Profiles

4. If you are working with the WSO2 WUM update that was effective from the 13th February 2018 (2018-02-13), make the following changes.

   Note
   Note that you can deploy updates in a production environment only if you have a valid subscription with WSO2. Read more about WSO2 Updates. For more information on updating WSO2 API Manager, see Using WSO2 Update Manager.

1. Open the <API-M_HOME>/repository/conf/axis2/axis2.xml file and comment out the following.

   Code Block

   <!--transportSender name="wss" class="org.wso2.carbon.websocket.transport.WebsocketTransportSender"> <parameter name="ws.outflow.dispatch.sequence" locked="false">outflowDispatchSeq</parameter> <parameter name="ws.outflow.dispatch.fault.sequence" locked="false">outflowFaultSeq</parameter> <parameter name="ws.trust.store" locked="false"> <ws.trust.store.location>repository/resources/security/client-truststore.jks</ws.trust.store.location> <ws.trust.store.Password>wso2carbon</ws.trust.store.Password> </parameter> </transportSender-->

2. Delete the SecureWebSocketInboundEndpoint.xml file from the <API-M_HOME>/repository/deployment/server/synapse-configs/default/inbound-endpoints directory.

sh <PRODUCT_HOME>/bin/wso2server.sh -Dprofile=api-store

sh <PRODUCT_HOME>/bin/wso2server.sh -Dprofile=api-publisher

sh <PRODUCT_HOME>/bin/wso2server.sh -Dprofile=gateway-worker -DworkerNode=true 

sh <PRODUCT_HOME>/bin/wso2server.sh -Dprofile=api-key-manager

sh <PRODUCT_HOME>/bin/wso2server.sh -Dprofile=traffic-manager

Step 6.2 - Configure and start the Key Manager

This section involves setting up the Key Manager node and enabling it to work with the other components in a distributed deployment.

1. Open the <API-M_HOME>/repository/conf/api-manager.xml file in the Key Manager node and change the <ServerURL> element that appears under the <APIGateway> section, so that it points to the API Manager Gateway.  
   You need to add these configurations so that when a user is deleted or when the role of a user is updated in the Key Manager, it will update the Gateway cache by clearing the cache entries of a particular user. 
   • If you are working with a single Gateway in distributed set up, you need to replace [GATEWAY_SERVER_HOST] with the host of the Gateway node.
   • If you are working with Gateways in a High Availability (HA) setup that uses a shared file system (e.g., NFS), you need to replace [GATEWAY_SERVER_HOST] with the host of the Gateway load balancer node.
   • If you are working with Gateways in a High Availability (HA) setup that uses rsync, you need to replace [GATEWAY_SERVER_HOST] with the host of the Gateway Manager node.

   • You need to replace [port] with the management transport port. For more information, see Default Product Ports.

     Code Block
     <ServerURL>https://$[GATEWAY_SERVER_HOST]:[port]/services/</ServerURL>

2. Configure the API key validator in the Key Manager.
   The Thrift protocol is normally enabled by default. However, if you have disabled the Thrift protocol, enable it as follows in the <API-M_HOME>/repository/conf/api-manager.xml file. 

   Localtabgroup

   Localtab active true id single-Key-Manager-KM title Single Key Manager When you are using a single Key Manager, add ThriftClient for the <KeyValidatorClientType> element to use the Thrift protocol. Code Block language none <APIKeyValidator> <KeyValidatorClientType>ThriftClient</KeyValidatorClientType> <EnableThriftServer>true</EnableThriftServer> <ThriftServerHost>localhost</ThriftServerHost> <ThriftServerPort>10397</ThriftServerPort> ... </APIKeyValidator> Note The default Thrift server port is 10397. You need to only uncomment the following code to set the Thrift server port if you need to use a port that differs from the default value. <ThriftServerPort>[port]</ThriftServerPort> Localtab id HA-Key-Manager-KM title Key Manager with HA When you are using multiple Key Managers fronted by a load balancer, you need to add WSClient for the <KeyValidatorClientType> element to use the Web Service Client, and change <EnableThriftServer> to false to optimize performance. Code Block language none <APIKeyValidator> ... <KeyValidatorClientType>WSClient</KeyValidatorClientType> <EnableThriftServer>false</EnableThriftServer> <ThriftServerHost>localhost</ThriftServerHost> <ThriftServerPort>10397</ThriftServerPort> ... </APIKeyValidator>

   Tip
   If you wish to encrypt the Auth Keys (access tokens, client secrets, and authorization codes), see Encrypting OAuth Keys.

3. Disable the data publisher in the Key Manager.
   As the Key Manager does not need to publish to the Traffic Manager, you need to disable the data publisher as follows:
   Open the  <API-M_HOME>/repository/conf/api-manager.xml file in the Key Manager, and change value of the <Enabled> element that appears under the <DataPublisher> element to false.

   Code Block
   <ThrottlingConfigurations> ... <DataPublisher> <Enabled>false</Enabled> ... </DataPublisher> ... </ThrottlingConfigurations>

4. Optionally, configure High Availability (HA) for the Key Manager.

   Warning
   These steps are ONLY applicable if you need to configure HA for the Key Manager.

   1. Make a copy of the active instance configured above and use this copy as the second Key Manager active instance.

   2. Configure a load balancer to front the two Key Manager nodes.
      For information on configuring the load balancer, see Configuring the Proxy Server and the Load Balancer.

5. Start the WSO2 API-M Key Manager node(s) by typing the following command in the command prompt. For more information on starting a WSO2 server, see Starting the server.

   Multiexcerpt include
   MultiExcerptName startingserver PageWithExcerpt Configuring a Single Node

org.apache.solr.common.SolrException: 
SolrCore 'registry-indexing' is not available due to init failure: Index locked for write for core registry-indexing

Step 6.3 - Configure and start the API Publisher

This section involves setting up the API Publisher node and enabling it to work with the other components in the distributed deployment.

1. Open the <API-M_HOME>/repository/conf/api-manager.xml file in the API Publisher node and make the following changes.

   1. Configure the Publisher with the Key Manager.
      You need to update the following configuration ONLY when you do not wish to share the user stores with the WSO2 API-M instance.

      Warning
      This step is not applicable if you are enabling Single Sign-on (SSO).

      Localtabgroup

      Localtab active true id single-KM-Publisher title Single Key Manager Configure the Publisher with a single Key Manager as follows: Code Block <AuthManager> <ServerURL>https://[Key-Manager-host]:9443/services/</ServerURL> <Username>admin</Username> <Password>admin</Password> </AuthManager> Localtab id HA-KM-Publisher title Key Manager with HA Configure the Publisher with multiple Key Managers that are fronted by a load balancer as follows: Code Block <AuthManager> <ServerURL>https://[Key-Manager-LB-host]:9443/services/</ServerURL> <Username>admin</Username> <Password>admin</Password> </AuthManager>

   2. Configure the Publisher with the Traffic Manager.
      This configuration enables the publishing of throttling policies, custom templates, and block conditions to the Gateway node.

      Localtabgroup

      Localtab active true id single-TM-Publisher title Single Traffic Manager Configure the Publisher with a single Traffic Manager as follows: Code Block language xml <ThrottlingConfigurations>  <EnableAdvanceThrottling>true</EnableAdvanceThrottling> <DataPublisher> <Enabled>false</Enabled> …………………… </DataPublisher> <PolicyDeployer> <ServiceURL>https://[Traffic-Manager-Host]:9443/services/</ServiceURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> </PolicyDeployer> <BlockCondition> <Enabled>false</Enabled> ……………… </BlockCondition> <JMSConnectionDetails> <Enabled>false</Enabled> …………………… </JMSConnectionDetails> <JMSEventPublisherParameters> <java.naming.factory.initial>org.wso2.andes.jndi.PropertiesFileInitialContextFactory</java.naming.factory.initial> <java.naming.provider.url>repository/conf/jndi.properties</java.naming.provider.url> <transport.jms.DestinationType>topic</transport.jms.DestinationType> <transport.jms.Destination>throttleData</transport.jms.Destination> <transport.jms.ConcurrentPublishers>allow</transport.jms.ConcurrentPublishers> <transport.jms.ConnectionFactoryJNDIName>TopicConnectionFactory</transport.jms.ConnectionFactoryJNDIName> </JMSEventPublisherParameters> ……………………………… </ThrottlingConfigurations> Localtab id HA-TM-Publisher title Traffic Manager with HA Configure the Publisher with multiple Traffic Managers that are fronted by a load balancer as follows: Code Block language xml <ThrottlingConfigurations>  <EnableAdvanceThrottling>true</EnableAdvanceThrottling> <DataPublisher> <Enabled>false</Enabled> …………………… </DataPublisher> <PolicyDeployer> <ServiceURL>https://[Traffic-Manager-LB-Host]:9443/services/</ServiceURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> </PolicyDeployer> <BlockCondition> <Enabled>false</Enabled> ……………… </BlockCondition> <JMSConnectionDetails> <Enabled>false</Enabled> …………………… </JMSConnectionDetails> <JMSEventPublisherParameters> <java.naming.factory.initial>org.wso2.andes.jndi.PropertiesFileInitialContextFactory</java.naming.factory.initial> <java.naming.provider.url>repository/conf/jndi.properties</java.naming.provider.url> <transport.jms.DestinationType>topic</transport.jms.DestinationType> <transport.jms.Destination>throttleData</transport.jms.Destination> <transport.jms.ConcurrentPublishers>allow</transport.jms.ConcurrentPublishers> <transport.jms.ConnectionFactoryJNDIName>TopicConnectionFactory</transport.jms.ConnectionFactoryJNDIName> </JMSEventPublisherParameters> ……………………………… </ThrottlingConfigurations>

   3. Configure the Publisher with the Gateway.
      You need to add these configurations, because when creating an API, it calls the Gateway endpoint to create the actual Synapse file. 

      
      

      • If you are using a single Gateway node, configure the Publisher with the Gateway as follows:

        Code Block
        language xml
        <APIGateway> <Environments> <Environment type="hybrid" api-console="true"> <Name>Production and Sandbox</Name> <Description>This is a hybrid gateway that handles both production and sandbox token traffic.</Description> <ServerURL>https://[API-Gateway-Host-or-IP]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password>   <GatewayEndpoint>http://[API-Gateway-Host]:8280,https://[API-Gateway-Host]:8243</GatewayEndpoint> </Environment> </Environments> </APIGateway>

      • If you are using multiple Gateway nodes, configure the Publisher with the Gateway nodes as follows:

        Localtabgroup

        Localtab active true id gateway-with-NFS-Publisher title Gateway with Shared File System Configure the Publisher when working with multiple Gateways that are fronted by a load balancer when using a shared file system (e.g., NFS), to synchronize the data between your Gateway nodes as follows: Code Block language xml <APIGateway> <Environments> <Environment type="hybrid" api-console="true"> <Name>Production and Sandbox</Name> <Description>This is a hybrid gateway that handles both production and sandbox token traffic.</Description> <ServerURL>https://[API-Gateway-LB-Host-or-IP]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password>   <GatewayEndpoint>http://[API-Gateway-LB-Host]:8280,https://[API-Gateway-LB-Host]:8243</GatewayEndpoint> </Environment> </Environments> </APIGateway> Localtab id gateway-with-rsync-Publisher title Gateway with rsync Configure the Publisher with a multiple Gateways that are fronted by a load balancer when using Remote Synchronization (rsync), to synchronize the data between your Gateway nodes as follows: Code Block language xml <APIGateway> <Environments> <Environment type="hybrid" api-console="true"> <Name>Production and Sandbox</Name> <Description>This is a hybrid gateway that handles both production and sandbox token traffic.</Description> <ServerURL>https://[API-Gateway-Manager-Host-or-IP]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password>   <GatewayEndpoint>http://[API-Gateway-Manager-Host]:8280,https://[API-Gateway-Manager-Host]:8243</GatewayEndpoint> </Environment> </Environments> </APIGateway>

      Info
      To change the admin password, see Changing the super admin password. Furthermore, make sure to adhere to the note given under step 2 in the latter mentioned section if your password has special characters.

   4. Configure the Store URL to appear in the Publisher UI.
      For this purpose you need to set the <DisplayURL> to true and provide the URL of the Store.

      Localtabgroup

      Localtab active true id single-Store-Publisher title Single Store Configure the Publisher with a single API Store as follows: Code Block title Example <APIStore> <DisplayURL>true</DisplayURL> <URL>https://[Store-hostname]:9443/store</URL> </APIStore> Localtab id HA-Store-Publisher title Store with HA Configure the Publisher with multiple API Stores that are fronted by a load balancer as follows: Code Block title Example <APIStore> <DisplayURL>true</DisplayURL> <URL>https://[Store-LB-hostname]:9443/store</URL> </APIStore>

2. Configure the blocked apps and API notifications to go to the Topic.
   Open the <API-M_HOME>/repository/conf/jndi.properties file and make the following changes.

   Note
   The following configuration is related to the Admin App in WSO2 API-M. In this guide it is assumed that the WSO2 API-M Admin App is configured in the Publisher node. If you change the default username (i.e., admin) and password (i.e., admin) in the user-mgt.xml file, that username and password should be changed at the broker connection URL as well.

   Code Block
   language xml
   connectionfactory.TopicConnectionFactory = amqp://admin:admin@clientid/carbon?brokerlist='tcp://[Traffic-Manager-host]:5672' topic.throttleData = throttleData

3. Disable the Thrift Server to optimize performance.
   You need to configure this in the Publisher <API-M_HOME>/repository/conf/api-manager.xml file.

   Code Block
   <APIKeyValidator> ... <EnableThriftServer>false</EnableThriftServer> </APIKeyValidator>

4. Optionally, configure High Availability (HA) for the Publisher.

   Warning
   These instructions are ONLY applicable if you need to configure HA for the Publisher.

   1. Make a copy of the active Publisher instance configured above and use this copy as the second active Publisher instance.

   2. Configure a load balancer to front the two Publisher nodes.
      For information on configuring the load balancer, see Configuring the Proxy Server and the Load Balancer.

5. Start the WSO2 API-M Publisher node(s) by typing the following command in the command prompt.
   For more information on starting a WSO2 server, see Starting the server.

   Multiexcerpt include
   MultiExcerptName startingserver PageWithExcerpt Configuring a Single Node

Step 6.4 - Configure and start the API Store

This section involves setting up the API Store node and enabling it to work with the other components in the distributed deployment.

1. Open the  <API-M_HOME>/repository/conf/api-manager.xml  file in the API Store node and make the following changes.

   1. Configure the API Store with the Key Manager.

      Localtabgroup

      Localtab active true id single-Key-Manager-Store title Single Key Manager Configure the API Store with a single Key Manager as follows: Configure the API key validator. When you are connecting the API Store directly to the Key Manager, add ThriftClient for the <KeyValidatorClientType> element to use the Thrift protocol. Code Block language none <APIKeyValidator> <ServerURL>https://[Key-Manager-host]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> <KeyValidatorClientType>ThriftClient</KeyValidatorClientType> <ThriftClientConnectionTimeOut>10000</ThriftClientConnectionTimeOut> <!--ThriftClientPort>10397</ThriftClientPort--> <EnableThriftServer>true</EnableThriftServer> <ThriftServerHost>[Key-Manager_host]</ThriftServerHost> <!--ThriftServerPort>10397</ThriftServerPort--> ... </APIKeyValidator> Configure the Authentication Manager, so that the API Store can connect to the Key Manager. You need to update the following configuration ONLY when you do not wish to share the user stores with the WSO2 API-M instance. Warning This step is not applicable if you are enabling Single Sign-on (SSO). Code Block <AuthManager> <ServerURL>https://[Key-Manager-host]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> </AuthManager> Localtab id HA-Key-Manager-Store title Key Manager with HA Configure the Store with multiple Key Managers that are fronted by a load balancer as follows: Configure the API key validator. When you are using multiple Key Managers fronted by a load balancer, you need to add WSClient for the <KeyValidatorClientType> element to use the Web Service Client. Code Block language none <RevokeAPIURL>https://[Gateway-host]:8243/revoke</RevokeAPIURL>   <APIKeyValidator> <ServerURL>https://[Key-Manager-LB-host]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> <KeyValidatorClientType>WSClient</KeyValidatorClientType> <ThriftClientConnectionTimeOut>10000</ThriftClientConnectionTimeOut> <!--ThriftClientPort>10397</ThriftClientPort--> <EnableThriftServer>false</EnableThriftServer> <ThriftServerHost>localhost</ThriftServerHost> <!--ThriftServerPort>10397</ThriftServerPort--> ... </APIKeyValidator> Configure the Authentication Manager, so that the API Store can connect to the Key Manager. You need to update the following configuration ONLY when you do not wish to share the user stores with the WSO2 API-M instance. Warning This step is not applicable if you are enabling Single Sign-on (SSO). Code Block <AuthManager> <ServerURL>https://[Key-Manager-LB-host]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> </AuthManager>

   2. Make the following throttling related changes that correspond to the Traffic Manager.

      Code Block
      language xml
      <ThrottlingConfigurations> <EnableAdvanceThrottling>true</EnableAdvanceThrottling> <DataPublisher> <Enabled>false</Enabled> …………………… </DataPublisher> ………………… <BlockCondition> <Enabled>false</Enabled> ……………………… </BlockCondition> <JMSConnectionDetails> <Enabled>false</Enabled> ………………………………… </JMSConnectionDetails> ……………………………… </ThrottlingConfigurations>

   3. Configure the Store with the Gateway. 

      • If you are using a single Gateway node, configure the Store with the Gateway as follows:

        Code Block
        <APIGateway> <Environments> <Environment type="hybrid"> ... <ServerURL>https://[API-Gateway-host-or-IP]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> <GatewayEndpoint>http://[API-Gateway-host]:8280,https://[API-Gateway-host]:8243</GatewayEndpoint> </Environment> </Environments> ... </APIGateway>

      • If you are using multiple Gateway nodes, configure the Store with the Gateway nodes as follows:

        Localtabgroup

        Localtab active true id gateway-with-NFS-Store title Gateway with Shared File System Configure the Store when working with multiple Gateways that are fronted by a load balancer, and when using a shared file system (e.g., NFS), to synchronize the data between your Gateway nodes as follows: Code Block <APIGateway> <Environments> <Environment type="hybrid"> ... <ServerURL>https://[API-Gateway-LB-Host-or-IP]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> <GatewayEndpoint>http://[API-Gateway-LB-Host]:8280,https://[API-Gateway-LB-Host]:8243</GatewayEndpoint> </Environment> </Environments> ... </APIGateway> Localtab id gateway-with-rsync-Store title Gateway with rsync Configure the Store with multiple Gateways that are fronted by a load balancer, and when using Remote Synchronization (rsync), to synchronize the data between your Gateway nodes as follows: Code Block <APIGateway> <Environments> <Environment type="hybrid"> ... <ServerURL>https://[API-Gateway-Manager-host]:9443/services/</ServerURL> <Username>${admin.username}</Username> <Password>${admin.password}</Password> <GatewayEndpoint>http://[API-Gateway-Manager-host]:8280,https://[API-Gateway-Manager-host]:8243</GatewayEndpoint> </Environment> </Environments> ... </APIGateway>

   4. Configure the Token Revoke endpoint to point to Gateway.

      Localtabgroup

      Localtab active true id tokenRevoke-GW title Single Gateway Configure the Token Revoke endpoint with a single Gateway as follows: Code Block <OAuthConfigurations> ... <RevokeAPIURL>https://[API-Gateway-host]:8243/revoke</RevokeAPIURL> </OAuthConfigurations> Localtab id tokenRevoke-2GW title Gateway with HA Configure the Token Revoke endpoint with multiple Gateways, which are fronted by a load balancer as follows: Code Block <OAuthConfigurations> ... <RevokeAPIURL>https://[API-Gateway-Worker-LB-host]:8243/revoke</RevokeAPIURL> </OAuthConfigurations>

   Disable the Thrift Server to optimize performance.
   You need to configure this in the Store <API-M_HOME>/repository/conf/api-manager.xml file.