How to update Tomcat configuration for required HTTPS connections in DPA 2023.2

4/26/2023 4:33 PM

4/29/2026 3:06 PM

As part of SolarWinds' Secure by Design initiative, the following security enhancements have been included in DPA 2023.2:

• HTTPS connections are now required.

  To improve security, DPA 2023.2 accepts only HTTPS connections. You can redirect attempts to connect using the HTTP connector port  to use the HTTPS connector port.

  If you are upgrading from a previous version, additional tomcat configuration is required to ensure that all users can access DPA and that DPA Central can connect to all DPA servers.

• Tomcat and MS JDBC Driver are upgraded.

  DPA now includes Tomcat 8.5.85 and MS JDBC Driver 12.2.0.

These fixes might require changes to your DPA deployment. Before you upgrade, determine if you need to make the following changes:

• If users access DPA using HTTP (instead of HTTPS), redirect connection attempts using the HTTP connector port.

• If DPA Central is configured to access any DPA servers using HTTP, update the connection definitions.

• If you monitor Db2 instances, update the permissions of the DPA monitoring user for each Db2 instance.

You can make these changes either before or after an upgrade. However, to ensure DPA availability and avoid any gaps in monitoring Db2 instances, SolarWinds recommends making them before you upgrade to 2023.2.

Database Performance Analyzer

Note: The steps below are for environments with DPA 2023.2 and newer. Please upgrade DPA to at least 2023.2 before performing the steps below.

Redirect connection attempts that use the HTTP connector port

To ensure that DPA is available to users who previously connected over HTTP, update the server.xml file to redirect traffic to the HTTP connector port (8123 by default) to the HTTPS/SSL connector port (8124 by default).

If the redirect is not added and users attempt to connect over HTTP after the upgrade, they will receive a message that the site can't be reached.

1. Open the following file in a text editor:

   DPA-install-dir\iwc\tomcat\conf\server.xml

2. Locate the Connector property below <!--HTTPS/SSL connector>, and note the port value. (By default, this is 8124.)

   

3. Locate the Connector property below <!--HTTP connector>. Within the Connector property, add the following, where httpsPortNumber is the port value noted in the previous step:

   redirectPort="httpsPortNumber"

   For example:

   redirectPort="8124"

   

4. If you make these changes after the upgrade, restart DPA for the changes to take effect.

Update DPA Central connections to DPA servers

If you use DPA Central, ensure that it is configured to connect to all DPA servers over HTTPS.

1. Determine if DPA Central is configured to connect to any DPA servers over HTTP:

   1. From the DPA menu in the upper-right corner, click Central.

   2. Click Manage Central.

   3. Verify that every server has a lock in the SSL column. If a server's SSL column does not display a lock, DPA Central is configured to connect to that server over HTTP.

2. If one or more servers are configured to use HTTP, update each server's connection properties:

   1. In the Registered Servers list, click the server's display name to open the Edit Server dialog.

   2. Change the Port value to the port used for HTTPS connections (8124 by default).

   3. Select SSL.

   4. Click Save.

Update the permissions of the DPA monitoring user for each Db2 instance

DPA 2023.2 replaces six of the deprecated SNAP* functions that previous DPA versions used to monitor Db2 database instances. Because of this change, the DPA monitoring user requires additional privileges to monitor a Db2 instance. In addition to SYSADM permissions, the user requires EXECUTE privileges on certain tables. To monitor Db2 instances with DPA 2023.2 and later versions, modify the monitoring user's permission on each Db2 instance.

The required permissions can be granted in Db2 10.1 and later. DPA does not support monitoring earlier versions of Db2.

1. Run the following commands to grant the DPA monitoring user EXECUTE privileges on the required tables:

   -- Scripts are not supported under any SolarWinds support program or service.
   -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
   -- disclaims all warranties including, without limitation, any implied warranties
   -- of merchantability or of fitness for a particular purpose. The risk arising
   -- out of the use or performance of the scripts and documentation stays with you.
   -- In no event shall SolarWinds or anyone else involved in the creation,
   -- production, or delivery of the scripts be liable for any damages whatsoever
   -- (including, without limitation, damages for loss of business profits, business
   -- interruption, loss of business information, or other pecuniary loss) arising
   -- out of the use of or inability to use the scripts or documentation.
   
   grant execute on function SYSPROC.MON_GET_DATABASE to userName;
   grant execute on function SYSPROC.MON_SAMPLE_WORKLOAD_METRICS to userName;
   grant execute on function SYSPROC.MON_GET_ACTIVITY to <USER_NAME>;
   grant execute on function SYSPROC.MON_GET_BUFFERPOOL to <USER_NAME>;
   grant execute on function SYSPROC.MON_GET_TABLESPACE to <USER_NAME>;
   grant execute on function SYSPROC.MON_GET_TRANSACTION_LOG to <USER_NAME>;

2. To verify that the permissions were applied correctly, run the following command:

   -- Scripts are not supported under any SolarWinds support program or service.
   -- Scripts are provided AS IS without warranty of any kind. SolarWinds further
   -- disclaims all warranties including, without limitation, any implied warranties
   -- of merchantability or of fitness for a particular purpose. The risk arising
   -- out of the use or performance of the scripts and documentation stays with you.
   -- In no event shall SolarWinds or anyone else involved in the creation,
   -- production, or delivery of the scripts be liable for any damages whatsoever
   -- (including, without limitation, damages for loss of business profits, business
   -- interruption, loss of business information, or other pecuniary loss) arising
   -- out of the use of or inability to use the scripts or documentation.
   
   select substr(authid,1,20) as authid
       , authidtype
       , privilege
       , grantable
       , substr(objectschema,1,12) as objectschema
       , substr(objectname,1,30) as objectname
       , objecttype
   from sysibmadm.privileges
   where objectschema ='SYSPROC' AND AUTHID='<USER_NAME>';

For additional information on fixes included in DPA 2023.2, please see the DPA 2023.2 Release Notes.