Configure the Standalone Index Search Server
If you have installed the index search server in standalone mode, complete the following steps.
|
|
Ensure that you are using Java 8 or higher. If not, set the SOLR_JAVA_HOME environment variable before executing the following commands:
• Windows: SET SOLR_JAVA_HOME=<PATH_TO_JAVA_8>
• Unix: export SOLR_JAVA_HOME=<PATH_TO_JAVA_8>
|
Solr Server: Start and Stop commands
To start or stop the solr server, execute the following commands:
• Start command
◦ Start Solr (Windows):
<INDEX_SEARCH_HOME>/bin/Index_Search_Server.bat start
◦ Start Solr (Unix):
sh <INDEX_SEARCH_HOME>/bin/Index_Search_Server.sh start
• Stop command
◦ Stop Solr (Windows):
<INDEX_SEARCH_HOME>/bin/Index_Search_Server.bat stop
◦ Stop Solr (Unix):
sh <INDEX_SEARCH_HOME>/bin/Index_Search_Server.sh stop
Create the Solr Cores (Standalone Mode)
1. Open a command prompt and start Solr using the following commands:
◦ Start Solr (Windows):
<INDEX_SEARCH_HOME>/bin/Index_Search_Server.bat start
◦ Start Solr (Unix):
sh <INDEX_SEARCH_HOME>/bin/Index_Search_Server.sh start
where <INDEX_SEARCH_HOME> is the installation directory in which the index search server is installed.
2. From the command prompt, navigate to <INDEX_SEARCH_HOME>/solr/bin and execute the following command to create the core for the required module:
Windchill Index Search
▪ Windows:
solr.cmd create -c wblib -n wblib -d D:\ptc\IndexSearchServer\SolrServer\solr_schemas\wblib
▪ Unix:
solr create -c wblib -n wblib -d /opt/ptc/IndexSearchServer/SolrServer/solr_schemas/wblib
Windchill PartsLink
▪ Windows:
solr.cmd create -c clfstructurelib -n clfstructurelib -d D:\ptc\IndexSearchServer\SolrServer\solr_schemas\clfstructurelib
▪ Unix:
solr create -c clfstructurelib -n clfstructurelib -d /opt/ptc/IndexSearchServer/SolrServer/solr_schemas/clfstructurelib
S1000D
▪ Windows:
solr.cmd create -c sisaadlib -n sisaadlib -d D:\ptc\IndexSearchServer\SolrServer\solr_schemas\sisaadlib
▪ Unix:
solr create -c sisaadlib -n sisaadlib -d /opt/ptc/IndexSearchServer/SolrServer/solr_schemas/sisaadlib
|
|
PTC recommends that you create cores for Windchill Index Search, Windchill PartsLink, and S1000D, even if the optional modules are not installed. Therefore, if you later decide to install these modules, you will not need to create the respective cores.
|
3. Open the Solr administrator interface and verify that Solr is running and the cores are available:
http://<SOLR_HOSTNAME>:<SOLR_PORT>/solr
Update the Solr Schema for Standalone Server (Optional)
To update the Solr schema, complete the following steps:
1. Navigate to <INDEX_SEARCH_HOME>/solr/server/solr and make the required updates.
2. Open the Solr administrator interface and select Core Admin.
3. Select the core for which schema has been updated and click Reload.
Configure Basic Authentication for Solr (Standalone Mode)
1. Stop Solr using the following commands:
◦ Windows
<INDEX_SEARCH_HOME>/bin/Index_Search_Server.bat stop
◦ Unix
sh <INDEX_SEARCH_HOME>/bin/Index_Search_Server.sh stop
2. Open the following file:
<INDEX_SEARCH_HOME>/solr/server/etc/webdefault.xml
And edit the content as follows (changes are highlighted):
3. Open the following file:
<INDEX_SEARCH_HOME>/solr/server/etc/jetty.xml
Add the following section at the end before the </Configure> tag:
4. Generate a password in encrypted format using the following utility provided by Jetty:
a. Open a command prompt and navigate to <INDEX_SEARCH_HOME>/solr/server.
b. Run the following command using the plain text password as your argument:
java -cp lib/jetty-util-9.2.13.v20150730.jar org.eclipse.jetty.util.security.Password <Username> <Password>
For example, running the following command:
java -cp lib/jetty-util-9.3.8.v20160314.jar org.eclipse.jetty.util.security.Password solr SolrRocks
Results in the following output:
| PTC recommends CRYPT as the most secure encryption option available when using this tool. |
5. Create a new file:
<INDEX_SEARCH_HOME>/solr/server/etc/realm.properties
Using the following format, add the encrypted password generated in the previous step:
<Username>: CRYPT:<Encrypted password>,<Role>
For example:
solr: CRYPT:so3oR2FANmQ4Y,admin
6. Start Solr using the following commands:
◦ Windows
<INDEX_SEARCH_HOME>/bin/Index_Search_Server.bat start
◦ Unix
sh <INDEX_SEARCH_HOME>/bin/Index_Search_Server.sh start
7. Open the Solr administrator interface and verify that you are prompted for a username and password:
http://<SOLR_HOSTNAME>:<SOLR_PORT>/solr
Changing the Solr User or Password
When you change the Solr user or password, you must update both the Windchill Index Search client and server.
1. Open a Windchill shell and execute the following commands to change the password or user for the Windchill Index Search client:
xconfmanager -s wt.index.solrAdminUser=<New_User> -t codebase/WEB-INF/conf/index.solrAuth.properties -p
xconfmanager -s wt.index.solrAdminPassword=<New_Password> -t codebase/WEB-INF/conf/index.solrAuth.properties -p
2. Restart Windchill.
3. From a command prompt, navigate to <INDEX_SEARCH_HOME>/bin and execute the following commands to change the password or user for the Windchill Index Search server:
◦ Windows:
xconfmanager -s wt.index.server.solrAdminUser=<New_User> -t config/solrserver.properties -p
xconfmanager -s wt.index.server.solrAdminPassword=<New_Password> -t config/solrserver.properties -p
◦ Unix:
sh xconfmanager -s wt.index.server.solrAdminUser=<New_User> -t config/solrserver.properties -p
sh xconfmanager -s wt.index.server.solrAdminPassword=<New_Password> -t config/solrserver.properties -p
4. Follow the steps outlined above to update <INDEX_SEARCH_HOME>/solr/server/etc/realm.properties.
5. Restart Solr.
Configure SSL for Standalone Index Search Server (Solr)
Before you can begin, you must have a certificate and key converted into PEM format as a single file.
| If a certificate-only file is not available, you can optionally generate one from the certificate and key file: 1. Convert the JKS keystore into PKCS12 format using the keytool utility: keytool -importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.p12 -srcstoretype jks -deststoretype pkcs12 2. Convert the PKCS12-formatted keystore, including only the certificate and not the key, into PEM format using the openssl command: openssl pkcs12 -nokeys -in solr-ssl.keystore.p12 -out solr-ssl.cacert.pem |
Configure the Windchill Index Search Client.
1. Open a Windchill shell and execute the following command to set the protocol as HTTPS to be used by the index search client when it connects to the index search server:
xconfmanager -s wt.index.solrProtocol=https -t codebase/wt.properties -p
2. Restart Windchill.
Configure the Windchill Index Search Server
1. Copy the certificate (JKS) file to <Index_Search_Home>/solr/server/etc.
2. Set common SSL-related system properties.
To activate the SSL settings, uncomment and update the set of properties beginning with SOLR_SSL_* in the following file:
◦ Windows: bin\solr.in.cmd
For example:
set SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks
set SOLR_SSL_KEY_STORE_PASSWORD=secret
set SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks
set SOLR_SSL_TRUST_STORE_PASSWORD=secret
REM Require clients to authenticate
set SOLR_SSL_NEED_CLIENT_AUTH=false
REM Enable clients to authenticate (but not require)
set SOLR_SSL_WANT_CLIENT_AUTH=false
◦ Unix: bin/solr.in.sh
For example:
bin/solr.in.sh example SOLR_SSL_* configuration
SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_KEY_STORE_PASSWORD=secret
SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_TRUST_STORE_PASSWORD=secret
# Require clients to authenticate
SOLR_SSL_NEED_CLIENT_AUTH=false
# Enable clients to authenticate (but not require)
SOLR_SSL_WANT_CLIENT_AUTH=false
Where “secret” is the password given when creating the certificate.
If you wish to modify the default password of Solr keystore, perform the following steps to avoid Solr server startup issue:
a. Ensure that the password is correct either in solr.in.cmd for Windows or solr.in.sh for Unix.
b. Open the <INDEX_SEARCH_HOME>/solr/server/etc/jetty-ssl.xml file
c. Update the following property values with the correct password:
<Set name="KeyStorePassword"><Property name="solr.jetty.keystore.password"
default="<enter the correct password>"/></Set>
<Set name="TrustStorePassword"><Property name="solr.jetty.truststore.password"
default="<enter the correct password>"/></Set>
d. Save the jetty-ssl.xml file and start the Solr Server.
3. Add the certificate file to the JVM trust store (JDK/JVM of Windchill only).
a. Navigate to the Java location that is used by Windchill to verify the path of the cacerts file under <JAVA>/jre/lib/security.
b. Navigate to <JAVA>/jre/bin to import the new certificate. Run the keytool utility as a user who has permission to write to cacerts:
keytool -import -file <certificate file> -alias <unique name> -keystore <path to cacerts file>
For example:
keytool -import -file D:\SolrWithSSL\solr-5.4.1\server\etc\solr-ssl.cacert.pem -alias Key_Alias -keystore ../lib/security/cacerts
4. When Windchill is configured to use SSL, any Java client that is being used outside Windchill needs a certificate to connect.
As a result, you must import the certificate to the JVM that is being used by the index search server. This allows the index search server to connect to Windchill and download documents for indexing.
Add the certificate file to the JVM trust store (JDK/JVM of the Solr server):
a. Navigate to the Java location that is used by the Solr server to verify the path of the cacerts file under <JAVA>/jre/lib/security.
b. Navigate to <JAVA>/jre/bin to import the certificate. Run the keytool utility as a user who has permission to write to cacerts:
keytool -import -file <certificate file> -alias <unique name> -keystore <path to cacerts file>
For example:
keytool -import -file D:\SolrWithSSL\solr-5.4.1\server\etc\solr-ssl.cacert.pem -alias Key_Alias -keystore ../lib/security/cacerts
| The default password for the JVM keystore is “changeit.” |
5. Restart Windchill and the index search server, and then navigate to the Solr administrative interface to verify that Solr is running with SSL.
| For known issues with SSL, see the following site: |
