Forum OpenACS Q&A: How to use/configure Host Node Map

If you really want distinct sites, you can't do things like

1) mount notiifcations in the subsite
2) have the same email in more than one subsite

and other things I can't think of.

One other issue is force_host_p which should be modified for a list of canonical hosts for each mapping (or host not map should support it directly.

Otherwise it is simple to setup just go to admin/ for the Main subsite and click Host Node Map and fill out the form. You can actually map to any site node, but you really need a subsite so people can login etc.

I think this is an area where we should work through the issues and fix them.

Also added parameter UseHostnameDomainforReg to acs-tcl for easier management of host_node mapped domains that share the main domain's HTTPS connection for secure sessions and login. Revised ad_get_login_url accordingly. Default behavior is unchanged.

Still need a way to transfer session state between host_nodes (since the user account is shared between them). Any suggestions?

I have used virtual hosting a lot and over the years have read most of what there is to read about the options.

Leaving aside the outdated stuff, as you probably know Aolserver4.x has the ability to run multiple virtual host sites from a single config.tcl file. This represents a convenient method of keeping all servers within the master Aolserver process and conserves resources.

Advantages are that you can open pools to multiple databases which means that you can keep your clients' data separated at the database level. I think you can also implement logging at the server level. One downside is that you cannot bring any one server down independently without shutting down the whole shooting match.

The host-node map offered a means of mapping a subsite to a domain, but if I understand it correctly it relies on the request processor to do the redirecting. This means that all the reverse proxy logic and the security of the implementation is all taking place in the tcl layer. The only thing preventing a user of one subsite being able to see unrelated data from another subsite is the OpenACS code. Whilst this is probably extremely reliable, there is no backstop if you know what I mean.

Also, if the aolserver process hangs up, or is busy, or has maxed-out on requests for some reason, ALL your sites are down rather than just one. You can't re-start just one site without bringing everything down. If you suffer some data corruption it affects all sites. If you want to implement https listeners for every subsite, you'll have to hack the openssl code in OpenACS because at the moment it doesn't support multiple listeners as per the nsopenssl spec.

http://www.rubick.com/openacs/easy_virtual_hosting

I have had a look for some of the docs I have read in the past, and many of them have vanished!

Personally, I use Pound reverse proxying to seperate Aolserver processes to keep everything seperate for security reasons (every process runs under a different os user account and os permissions protect each server from the others). For a load of small static sites, or otherwise where security is not an issue, the built in host-node map should come in handy. I confess that the last time I tried it was in OpenACS 4.6.3 and it didn't work properly! :-|

I don't know if any of this is helpful but I thought I'd post anyway.

Regards
Richard

We developed a local hack to log you into multiple host node mapped sites with one login.

It basically uses a server side secret to redirect to the login page of the other subsite(s) when you login to one, to get multiple login cookies.

# packages/acs-subsite/www/register/hash-login.tcl      
# This allows logging a user into multiple host node mapped subsites using the auth token from a current login on one of the other host node mapped subsites                        
# TODO make sure the host is a valid host node mapped URL

ad_page_contract {

    auto-login using user_id, hash, time and token_id

    @author Deds Castillo
    @creation-date 2009-08-26
} {
    {user_id:optional,trim ""}
    {time:optional,trim ""}
    {hash:optional,trim ""}
    {return_url "/"}
    {host ""}
} -properties {
} -validate {
} -errors {
}

if { $user_id ne "" && \
         $time ne "" && \
         $hash ne "" } {

    set token [sec_get_user_auth_token $user_id]
    set computed_hash [ns_sha1 "$user_id$time$token"]

    set expiration_time 30
    if { [string compare $hash $computed_hash] != 0 || \
             $time < [ns_time] - $expiration_time } {
        # expired or wrong credentials                                          
    } else {
        ad_user_login $user_id
    }
}

if { [string match "http*" $return_url] } {
    set next_url $return_url
} else {
    set next_url "${host}${return_url}"
}

ad_returnredirect $next_url