Setting up the mobile proxy server

The Mobile Proxy Service may be installed using the setup-mobproxy.sh installation script.

The dependencies for the httpd or apache2 web server will be checked and any additional required modules will be automatically installed.

Usage:

setup-mobproxy.sh proxy-url (syntax: scheme://host[:port]/company/instance)

The authkey parameter may be optionally passed in to specify the authentication key. This is used for the value for Proxy server authentication key in the Mobile Worker Service configuration. If a value is not specified then it will be auto-generated by the install script.

The loglevel parameter may be optionally passed in to specify the log level for the mobile proxy log messages on the Linux server. If this is not specified then the default is to set it to warning. These are the available log levels:

The proxy URL that is passed in is what is specified for the value for Proxy server URL in the Mobile Worker Service configuration. The host and port are for the mobile proxy server. The default port is 443 if it is omitted.

Example installation command for setup-mobproxy.sh:

authkey="authkeyvalue" loglevel=debug ./setup-mobproxy.sh https://mobile.bravurasecurity.com/hid/pm

The mobproxy-<company>-<instance>.conf configuration file for the mobile proxy is added to /etc/httpd/conf.d on CentOS or /etc/apache2/sites-enabled on Debian.

This file also contains the rewrite rule for configuration parameters used by the Mobile Worker Service.

Optional: Adjust the maximum time difference between the proxy and instance servers in seconds by configuring the MAX_TIME_DIFF CGI environment variable. The default is 3600 seconds.

RewriteRule ^/<company>/<instance>/(.⋆)$ /cgi-bin/logid-<instance>-<company> [L,PT,E=MAX_TIME_DIF:<new_value_sec>,...]

The following is a CentOS example for the mobproxy-<company>-<instance>.conf configuration file added by setup-mobproxy.sh:

<VirtualHost <:443> 
  ServerName <servername.example.com> 
  Timeout 600 
  ScriptAlias "/cgi-bin/" "/var/www/cgi-bin/" 
  # Enable FollowSymLinks 
  <Directory "/var/www/cgi-bin/"> 
    AllowOverride None 
    Options FollowSymLinks 
    Require all granted 
  </Directory> 
  #LogLevel dumpio:trace8 cgi:trace8 
  CustomLog "/var/log/httpd/mobproxy-<instance>-<company>-access_log" combined 
  ErrorLog "/var/log/httpd/mobproxy-<instance>-<company>-error_log" 
  RewriteEngine On 
  SSLEngine on 
  SSLCertificateFile /etc/httpd/ssl/certs/<servername.example.com>/selfsigned-<servername.example.com>.pem 
  SSLCertificateKeyFile /etc/httpd/ssl/private/<servername.example.com>/selfsigned-<servername.example.com>.key 
  RewriteRule ^/<company>/<instance>/(.⋆)$ /cgi-bin/logid-<instance>-<company> [L,PT,E=BYPASSAUTH:.+\\.(woff|woff2|htm|html|jpg|gif|png|js|css)$,E=DEBUGDUMPENVS:0,E=HTTP_AUTHORIZATION:%{HTTP:Authorization},E=HTTP_MOBPROXY_KEY:<proxyauthenticationkey>] 
</VirtualHost>

The following is a Debian example for the mobproxy-<company>-<instance>.conf configuration file added by setup-mobproxy.sh:

<VirtualHost ⋆:443> 
  ServerName <servername.example.com> 
  Timeout 600 
  ScriptAlias "/cgi-bin/" "/usr/lib/cgi-bin/" 
  # Enable FollowSymLinks 
  <Directory "/usr/lib/cgi-bin/"> 
    AllowOverride None 
    Options FollowSymLinks 
    Require all granted 
  </Directory> 
  #LogLevel dumpio:trace8 cgi:trace8 
  CustomLog "/var/log/apache2/mobproxy-<instance>-<company>-access.log" combined 
  ErrorLog "/var/log/apache2/mobproxy-<instance>-<company>-error.log" 
  RewriteEngine On 
  SSLEngine on 
  SSLCertificateFile /etc/apache2/ssl/certs/<servername.example.com>/selfsigned-<servername.example.com>.pem 
  SSLCertificateKeyFile /etc/apache2/ssl/private/<servername.example.com>/selfsigned-<servername.example.com>.key 
  RewriteRule ^/<company>/<instance>/(.⋆)$ /cgi-bin/logid-<instance>-<company> [L,PT,E=BYPASSAUTH:.+\\.(woff|woff2|htm|html|jpg|gif|png|js|css)$,E=DEBUGDUMPENVS:0,E=HTTP_AUTHORIZATION:%{HTTP:Authorization},E=HTTP_MOBPROXY_KEY:<proxyauthenticationkey>] 
</VirtualHost>

In the mobproxy-<company>-<instance>.conf configuration file:

If you installed for https and SSL and chose a self-signed certificate during installation, obtain the necessary SSL/TLS certificate for the mobile proxy server and add them into the mobproxy-<company>-<instance>.conf configuration file.

Syslog configuration is also added to the /etc/rsyslog.d/mobproxy-<instance>-<company>.conf configuration file.

Custom log files are also generated:

CentOS:

/var/log/httpd/mobproxy-<instance>-<company>-access_log 
/var/log/httpd/mobproxy-<instance>-<company>-error_log 
/var/log/mobproxy-<instance>-<company>.log

Debian:

/var/log/apache2/mobproxy-<instance>-<company>-access.log 
/var/log/apache2/mobproxy-<instance>-<company>-error.log 
/var/log/mobproxy-<instance>-<company>.log

Bravura Security requires that you configure the site for HTTPS to secure communications between the Bravura One mobile proxy server and Bravura Security Fabric server. It is suggested that you use a "Modern" configuration with HSTS enabled for the SSL configuration, although to increase device backwards compatibility, "Intermediate" configuration is suggested.

An SSL certificate from a trusted Certificate Authority must be used. A self-signed certificate may not be used for the Mobile Proxy Service.

Before you begin, ensure the following steps are done:

Try the following steps to diagnose and recover from faults that may occur on a Bravura One mobile proxy server:

Troubleshooting: Error "You configured HTTP(80) on the standard HTTPS(443) port"

When configuring the mobile cloud proxy according to our documentation, the following error may be logged: You configured HTTP(80) on the standard HTTPS(443) port.

Root cause

This can happen on certain Linux systems (like CentOS 6) based on how the default configuration of Apache is setup.

Symptoms

The mobile cloud proxy will not be available, and the error above will be in the /var/log/httpd/error_log file.

Solution

Make sure that the configuration:

If the server is making only one site available, do not use VirtualHost statements and instead have a single Listen command.

Troubleshooting integrations that use psunix files

When the correct permissions on *nix systems are not granted to the psunix files copied from the Connector Pack (from the instance's unix\ directory), the integration will fail.

For example, when integrating with an LDAP, syslog may show the following:

May 28 09:16:22 rhds2-idp-master-1-work-es-1 psldap[5486]: [Line: 38, Pos: 1]: Parse error: expected ';' in kvgroup option file [/usr/local/psunix/default/psunix.d/idapi].
   
May 28 09:16:22 rhds2-idp-master-1-work-es-1 ns-slapd: [28/May/2020:09:16:22.810271756
      +0000] - ERR - plugin_setup - Init function "prepasswd_init" for "Psynch Check Password"
      plugin in library "/usr/local/psunix/default/64/psldap-sunldap.so" failed
   
May 28 09:16:22 rhds2-idp-master-1-work-es-1 psldap[5486]: Failed to load configuration information

Solution

Grant permissions on the psunix files to the account that has to run them or access them: