You are here

Installing and configuring Alfresco Search and Insight Engine with mutual TLS using the distribution zip

Use this information to install Alfresco Search and Insight Engine on the same machine as Alfresco Content Services with mutual TLS.
Mutual TLS is used for authentication between the Repository and Alfresco Search and Insight Engine.
This task assumes you have:
Important: Alfresco strongly recommends you use firewalls and other infrastructure means to ensure that the Alfresco Search and Insight Engine server is not accessible from anything other than trusted hosts and/or users, and only on the ports needed for Alfresco Search and Insight Engine.
  1. Browse to the Alfresco Support Portal and download alfresco-insight-engine-distribution-1.4.x.zip.
  2. Extract the Alfresco Search and Insight Engine distribution.

    See Alfresco Search and Insight Engine directory structure for more details.

  3. To secure access to Alfresco Search and Insight Engine, you must create a new set of keystores and keys.
    1. Generate secure keys specific to your Alfresco installation.

      For more information, see Generating secure keys overview.

    2. Create a new keystore directory at alfresco-insight-engine/solrhome.
    3. In the production environment, copy your custom keystore and truststore to the alfresco-insight-engine/solrhome/keystore directory.
    4. Update the SSL-related system properties.

      If you are using a Windows-based platform, update the alfresco-insight-engine/solr.in.cmd file:

      set SOLR_SSL_KEY_STORE=<SOLR_HOME>\keystore\ssl.repo.client.keystore
      set SOLR_SSL_KEY_STORE_PASSWORD=password
      set SOLR_SSL_TRUST_STORE=<SOLR_HOME>\keystore\ssl.repo.client.truststore
      set SOLR_SSL_TRUST_STORE_PASSWORD=password
      set SOLR_SSL_NEED_CLIENT_AUTH=true
      set SOLR_SSL_WANT_CLIENT_AUTH=false

      If you are using a Linux-based platform, update the alfresco-insight-engine/solr.in.sh file:

      SOLR_SSL_KEY_STORE=<SOLR_HOME>/keystore/ssl.repo.client.keystore
      SOLR_SSL_KEY_STORE_PASSWORD=password
      SOLR_SSL_TRUST_STORE=<SOLR_HOME>/keystore/ssl.repo.client.truststore
      SOLR_SSL_TRUST_STORE_PASSWORD=password 
      SOLR_SSL_NEED_CLIENT_AUTH=true 
      SOLR_SSL_WANT_CLIENT_AUTH=false

      In the above examples, replace <SOLR_HOME> with alfresco-insight-engine/solrhome, and set your keystore and truststore passwords.

  4. Update the alfresco-insight-engine/solrhome/conf/shared.properties file.

    • If you use several languages across your organization, you must enable cross-language search support in all fields, by adding the following:
      alfresco.cross.locale.datatype.0={http://www.alfresco.org/model/dictionary/1.0}text
      alfresco.cross.locale.datatype.1={http://www.alfresco.org/model/dictionary/1.0}content
      alfresco.cross.locale.datatype.2={http://www.alfresco.org/model/dictionary/1.0}mltext 
  5. The following environment variables need to be set in the alfresco-insight-engine/solr.in.cmd file for Microsoft Windows systems and the alfresco-insight-engine/solr.in.sh file for Linux based systems.vironment variable, SOLR_PORT:

    Microsoft Windows

    set SOLR_PORT=8983
    (Optional) To install

    If you are using a Windows-based platform, update the alfresco-insight-engine/solr.in.cmd file:

    set SOLR_PORT=8983

    If you are using a Linux-based platform, update the alfresco-insight-engine/solr.in.sh file:

    SOLR_PORT=8983
  6. (Optional) If you want to install Alfresco Search and Insight Engine on a separate machine, see the following before starting Alfresco Search and Insight Engine:
    1. Set the environment variable, SOLR_SOLR_HOST, in the following file.

      (Windows):

      alfresco-insight-engine/solr.in.cmd

      (Linux):

      alfresco-insight-engine/solr.in.sh
    2. Set the values of environment variables, such as SOLR_ALFRESCO_HOST, in the following file.

      (Windows):

      alfresco-insight-engine/solr.in.cmd

      (Linux):

      alfresco-insight-engine/solr.in.sh

      See Alfresco Search and Insight Engine externalized configuration.

    3. KeyStore change Update the SSL-related system properties.

      If you are using a Windows-based platform, update the alfresco-insight-engine/solr.in.cmd file:

      set SOLR_SSL_KEY_STORE=<SOLR_HOME>\keystore\ssl.repo.client.keystore
      set SOLR_SSL_KEY_STORE_PASSWORD=password
      set SOLR_SSL_TRUST_STORE=<SOLR_HOME>\keystore\ssl.repo.client.truststore
      set SOLR_SSL_TRUST_STORE_PASSWORD=password
      set SOLR_SSL_NEED_CLIENT_AUTH=true
      set SOLR_SSL_WANT_CLIENT_AUTH=false

      If you are using a Linux-based platform, update the alfresco-insight-engine/solr.in.sh file:

      SOLR_SSL_KEY_STORE=<SOLR_HOME>/keystore/ssl.repo.client.keystore
      SOLR_SSL_KEY_STORE_PASSWORD=password
      SOLR_SSL_TRUST_STORE=<SOLR_HOME>/keystore/ssl.repo.client.truststore
      SOLR_SSL_TRUST_STORE_PASSWORD=password 
      SOLR_SSL_NEED_CLIENT_AUTH=true 
      SOLR_SSL_WANT_CLIENT_AUTH=false

      In the above examples, replace <SOLR_HOME> with alfresco-insight-engine/solrhome, and set your keystore and truststore passwords.

  7. (Optional) Update the alfresco-insight-engine/solrhome/conf/shared.properties file.

    • Suggestion is disabled by default for Alfresco Search and Insight Engine. If you want to enable suggestion, add the following:
      alfresco.suggestable.property.0={http://www.alfresco.org/model/content/1.0}name
      alfresco.suggestable.property.1={http://www.alfresco.org/model/content/1.0}title 
      alfresco.suggestable.property.2={http://www.alfresco.org/model/content/1.0}description 
      alfresco.suggestable.property.3={http://www.alfresco.org/model/content/1.0}content

    Note: The spell check functionality does not work with Alfresco Search and Insight Engine as suggestion is disabled for scalability purposes.
  8. To configure the Solr cores, set the following options:

    • Before creating the alfresco and archive cores:
      • Set alfresco.secureComms=https in alfresco-insight-engine/solrhome/templates/rerank/conf/solrcore.properties.
      • Copy the custom keystores to the alfresco-insight-engine/solrhome/templates/rerank/conf directory.
        ssl.repo.client.keystore
        ssl.repo.client.truststore
        ssl-keystore-passwords.properties
        ssl-truststore-passwords.properties
    • If the alfresco and archive cores already exist, ensure that alfresco.secureComms is set to https for both the cores. For example:
      • alfresco-insight-engine/solrhome/alfresco/conf/solrcore.properties
      • alfresco-insight-engine/solrhome/archive/conf/solrcore.properties
  9. Update the
  10. For running a single instance of Alfresco Search and Insight Engine (i.e. not sharded), use the following commands:

    cd alfresco-insight-engine
    ./solr/bin/solr start -a "-Djavax.net.ssl.keyStoreType=JCEKS -Djavax.net.ssl.trustStoreType=JCEKS -Dsolr.ssl.checkPeerName=false -Dcreate.alfresco.defaults=alfresco,archive"
    Note: The -Dcreate.alfresco.defaults=alfresco,archive command automatically creates the alfresco and archive cores. Therefore, you should only start Alfresco Search and Insight Engine with -Dcreate.alfresco.defaults=alfresco,archive the first time you run Alfresco Search and Insight Engine.
    Note: To ensure that Alfresco Search and Insight Engine connects using the IPv6 protocol instead of IPv4, add -Djava.net.preferIPv6Addresses=true to the startup parameters.
    Note: You should run this application as a dedicated user. For example, you can create a Solr user.

    The default port used is 8983.

    The command line parameter, -a passes additional JVM parameters, for example, system properties using -D.

    Once Alfresco Search and Insight Engine is up and running, you should see a message like:

    Waiting up to 180 seconds to see Solr running on port 8983 [\]  
    Started Solr server on port 8983 (pid=24289). Happy searching!
    To stop all instances of Alfresco Search and Insight Engine, use:
    ./solr/bin/solr stop

    The logs are stored in the alfresco-insight-engine/logs/solr.log file, by default. This can be configured in solr.in.sh (for Linux) or solr.in.cmd (for Windows) using SOLR_LOGS_DIR.

    You have successfully created an alfresco core and an archive core. To verify, in a browser, navigate to the Solr URL, https://localhost:8983/solr. In the Solr Admin UI, select the core selector drop-down list and verify that both the alfresco and archive cores are present.

    Allow a few minutes for Alfresco Search and Insight Engine to start indexing.

If you are not using sharded Alfresco Search and Insight Engine:
  • Access the Admin Console > Search Service Sharding page.
  • Deselect Dynamic Shard Instance Registration.
  • Select Purge at Startup.

Sending feedback to the Alfresco documentation team

You don't appear to have JavaScript enabled in your browser. With JavaScript enabled, you can provide feedback to us using our simple form. Here are some instructions on how to enable JavaScript in your web browser.