WebSphere AppServer Liberty: How to prevent from publishing system applications to plugin-cfg.xml

Question

When Admin Center is configured, ${server.config.dir}/logs/state/plugin-cfg.xml file contains uri routeing rules for system applications. I don't want to publish Admin Center via HTTP Server, and want to keep it in private access.

<UriGroup Name="default_host_neon1_default_node_Cluster_URIs">
  <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/Sample/*"/>
  <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/IBMJMXConnectorREST/*"/>
  <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/ibm/api/*"/>
  <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/ibm/adminCenter/explore-1.0/*"/>
  <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/ibm/adminCenter/serverConfig-1.0/*"/>
  <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/adminCenter/*"/>
</UriGroup>

I couldn't find any settings to eliminate urls from plugin-cfg.xml (e.g. <pluginConfiguration> in server.xml). How can I remove these routing rules from plugin-cfg.xml file ? Sould I edit the file manually?

score 0 · Accepted Answer · edited Jun 20 '20 at 09:12

There is a non-manual way to do this. You need to bind the Admin Center to a different port. This is a good thing to do anyway because it just adds that much more separation between the application and the admin traffic. To do this you would define two http endpoints:

<httpEndpoint id="defaultHttpEndpoint" host="*" httpPort="9080" />
<httpEndpoint id="appHttpEndpoint" host="*" httpPort="9081" />

Then define a virtual host for the applications (you can also bind the virtual host to a specific endpoint if you wish):

<virtualHost id="app_host">
   <hostAlias>your_host_name:9081</hostAlias>
</virtualHost>

you'll also want to make the default host only bind to the one port.

<virtualHost id="default_host">
   <hostAlias>your_host_name:9080</hostAlias>
</virtualHost>

Then bind the webApplication to the application host:

There is one final thing, you need to configure the plugin to use the appHttpEndpoint rather than the defaultHttpEndpoint:

<pluginConfiguration httpEndpointRef="appHttpEndpoint"/>

the default for the httpEndpointRef on the pluginConfiguration is defaultHttpEndpoint, so if you wanted to you could use defaultHttpEndpoint for application configuration and move the admin traffic to a different endpoint too.

Useful Knowledge Center references are:

WebSphere AppServer Liberty: How to prevent from publishing system applications to plugin-cfg.xml

1 Answers1