Prerequisites

• You must already have your SSL certificate on your server (chain.pem and privkey.pem / .crt and .rsa files). You can buy an SSL certificate from a reputable source for your Pyramid site or create a self-signed one (not recommended).
  If you have only pfx file, please refer to the following article on how to extract the private key and chains from the pfx file.
• Port 443 must be open inwards on both the server (that you Nginx is installed on), firewall and any external firewalls.

1) Install Nginx as follows (we assume the install is being done on Ubuntu but any Linux version that Nginx supports can be used.)

sudo apt-get update
sudo apt-get install nginx

2) Create the folder called "certs" and then copy across your two certificate files to this folder.

cd /etc/nginx/
sudo mkdir certs

3) Configure Nginx by running the following commands:

sudo unlink /etc/nginx/sites-enabled/default
cd /etc/nginx/sites-available/
sudo nano reverse-proxy.conf

The last command will open a text file, and the below should be pasted into it.
(Edit the names of the "chain.pem" and "privkey.pem" to the names of your certificate files.)
If the Pyramid web server is not running on the same server, then change localhost to the name of the server on which the Pyramid web service is running.
Update the "yourServername.mycompany.com" to the DNS site name that will be used to browse Pyramid

upstream backend{
      server <pyramid_server_1>:8181;
      server <pyramid_server_2>:8181;
   }

   # This server accepts all traffic to port 80 and passes it to the upstream.
   # Notice that the upstream name and the proxy_pass need to match.

   server {
  listen 443 ssl;
    ssl_certificate /home/master/fullchain.crt;
    ssl_certificate_key /home/master/privkey.key;
    server_name yourServername.mycompany.com;
    access_log /var/log/nginx/nginx.vhost.access.log;
    error_log /var/log/nginx/nginx.vhost.error.log;

      location / {
          proxy_pass https://backend;
      }
   }

4) Enable the site 

sudo ln -s /etc/nginx/sites-available/reverse-proxy.conf /etc/nginx/sites-enabled/reverse-proxy.conf

5) Test to make sure there are no errors and restart Nginx 

sudo nginx -t
sudo service nginx restart

6) Test to see if you can browse to your site using SSL and if relevant that any Pyramid Pulse servers can connect to your Pyramid instance. 

Please refer to the following commands to extract the key and chain from the certificate:

Create an encrypted key file:

openssl pkcs12 -in certificate.pfx -nocerts -out privkey.key

Extract the server certificate:
 

openssl pkcs12 -in certificate.pfx -clcerts -nokeys -out cert.crt

Extract the CA chain:
 

openssl pkcs12 -in certificate.pfx -cacerts -nokeys -out chain.crt

Create a full chain file:
 

cat cert.crt chain.crt > fullchain.crt

Prerequisites

• You must already have your SSL certificate on your server (chain.pem and privkey.pem / .crt and .rsa files). You can buy an SSL certificate from a reputable source for your Pyramid site or create a self-signed one (not recommended).
  If you have only pfx file, please refer to the following article on how to extract the private key and chains from the pfx file.
• Port 443 must be open inwards on both the server (that you Nginx is installed on), firewall and any external firewalls.
• You have purchased a public DNS record which is pointing to your Public IP address which in turn is pointing to the server that will have Nginx install on.

1) Install Nginx as follows (we assume the install is being done on Ubuntu but any Linux version that Nginx supports can be used.)

sudo apt-get update
sudo apt-get install nginx

2) Create the folder called "certs" and then copy across your two certificate files to this folder.

cd /etc/nginx/
sudo mkdir certs

3) Configure Nginx by running the following commands:

sudo unlink /etc/nginx/sites-enabled/default
cd /etc/nginx/sites-available/
sudo nano reverse-proxy.conf

The last command will open a text file, and the below should be pasted into it.
(Edit the names of the "chain.pem" and "privkey.pem" to the names of your certificate files.)
If the Pyramid web server is not running on the same server, then change localhost to the name of the server on which the Pyramid web service is running.
Update the "yourServername.mycompany.com" to the DNS site name that will be used to browse Pyramid

server {
  listen 443 ssl;
    ssl_certificate /etc/nginx/certs/chain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;
    server_name yourServername.mycompany.com;
    access_log /var/log/nginx/nginx.vhost.access.log;
    error_log /var/log/nginx/nginx.vhost.error.log;
    client_max_body_size 300M;
    location / {
proxy_pass http://localhost:8181;
    }
location /events {
proxy_pass http://localhost:8181/events;
                proxy_http_version 1.1;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
        }
}

4) Enable the site 

sudo ln -s /etc/nginx/sites-available/reverse-proxy.conf /etc/nginx/sites-enabled/reverse-proxy.conf

5) Test to make sure there are no errors and restart Nginx 

service nginx configtest
sudo service nginx restart

6) Test to see if you can browse to your site using SSL and if relevant that any Pyramid Pulse servers can connect to your Pyramid instance. 

These logs can provide information about the client-side script that runs the application.

First - open the DevTools window of Chrome by pressing F12 or:

To get the console logs:
If it’s a client-side error then it's important to see the console errors as shown.
Click on the Console and you will see the errors. Click on "Save as" for each row and save it + send a screenshot showing the console.

To generate the HAR file:

1. Open the Network tab in the browser Developer Tools.

2. Click the Clear button

3. Enable the Preserve log and Disable cache checkboxes

4. Reproduce the issue. Once the issue occurs, click the Download / Export HAR icon (down arrow) to save the HAR file.

These instructions apply to Microsoft Edge, Google Chrome, and Mozilla Firefox on Windows.

1. Open Windows Internet Options (Microsoft Edge and Google Chrome)

Microsoft Edge and Google Chrome use Windows security settings for Integrated Windows Authentication. You do not need to open Internet Explorer to configure these settings.

1. Press Windows + R to open the Run dialog.
2. Enter the following command and press Enter:

inetcpl.cpl

This opens the Internet Properties window.

2. Add the Pyramid website to the Local intranet or Trusted sites zone

1. In Internet Properties, select the Security tab.
2. Select Local intranet (recommended for internal Pyramid websites).
3. Click Sites, then Advanced.
4. Enter your Pyramid website address, for example https://pyramid.company.com, and click Add.
5. Click Close, then OK.

Alternatively, the website can be added to Trusted sites if required by your organization's configuration.

3. Enable automatic login using Windows credentials

1. In Internet Properties > Security, select the zone where you added the Pyramid website (Local intranet or Trusted sites).
2. Click Custom level.
3. Scroll to User Authentication > Logon.
4. Select Automatic logon with current user name and password.
5. Click OK to save the changes.

Note: For the Local intranet zone, the default Automatic logon only in Intranet zone setting can also be used.

4. Verify Integrated Windows Authentication is enabled

1. In Internet Properties, select the Advanced tab.
2. Scroll down to the Security section.
3. Verify that Enable Integrated Windows Authentication is checked.
4. Click Apply, then OK.
5. Close and reopen your browser, then try accessing Pyramid again.

5. Mozilla Firefox configuration

Unlike Microsoft Edge and Google Chrome, Firefox uses its own configuration settings for Integrated Windows Authentication.

If Firefox continues to prompt for credentials, follow these steps:

1. Open Mozilla Firefox.
2. Enter about:config in the address bar and press Enter.
3. If prompted, click Accept the Risk and Continue.
4. Search for network.negotiate-auth.trusted-uris.
5. Edit the preference and enter your Pyramid server hostname, for example pyramid.company.com.
6. Search for network.automatic-ntlm-auth.trusted-uris.
7. Edit this preference and enter the same Pyramid server hostname.
8. Save the changes and restart Firefox.

Note: If multiple hostnames are required, separate them with commas. These settings may also be managed centrally by your organization's IT department using Group Policy.

6. Verify the HTTP Service Principal Name (SPN)

If users are still prompted for credentials, verify that the correct HTTP Service Principal Name (SPN) is registered in Active Directory for the Pyramid website.

SPNs are required for Kerberos authentication and must be associated with the correct account running the HTTP service.

Open Command Prompt on a domain-connected machine and check for an existing SPN:

setspn -Q HTTP/pyramid.company.com

If the required SPN does not exist, an authorized Active Directory administrator can register it using the following commands:

setspn -S HTTP/pyramid.company.com ServerName$
setspn -S HTTP/pyramid ServerName$

Replace:

• pyramid.company.com with the fully qualified hostname used to access Pyramid.
• pyramid with the short hostname, if users access Pyramid using that name.
• ServerName$ with the appropriate Active Directory computer account.

Important: If the HTTP service runs under a dedicated Active Directory service account, register the SPN against that account instead of the server computer account.

SPNs must be unique in Active Directory. The setspn -S option checks for duplicates before registration. Do not create or modify SPNs without confirming the correct service account.

7. Additional troubleshooting

If Windows Authentication still does not work:

• Verify that Windows Authentication is correctly configured and enabled in Pyramid.
• Confirm that the client computer is connected to the corporate network or VPN and can communicate with the required Active Directory services.
• Verify that the Pyramid website is listed in the correct Windows security zone, or in Firefox's authentication preferences.
• Check that the HTTP SPN is correctly registered and does not have duplicates.
• Check whether browser policies managed by your IT department override local authentication settings.
• Close and reopen the browser, then test again.

If the issue persists, please contact Pyramid Support for further assistance.

The reason might be that your LDAP address sometimes returns Domain Controllers (DC) that do not work. To check what domain controller is being returned by the LDAP address at the time of the login issue, ping the LDAP address from the Pyramid server(s) to see what IP address is returned. With the IP it is then possible to know which domain controller it is that might not be working correctly.

To resolve the problem, use ONE of the following three suggested solutions.

1. The preferred option is to get your LDAP DNS fixed so that it only returns good working domain controllers.
    
2. The next best option is to add an entry to the local Host file of the Pyramid server(s) that points your LDAP address to one good known domain controller* that works.
   The host entry would look like the example below:
   
   If my LDAP address is LDAP://DC=TEST,DC=EXAMPLE,DC=COM
   And one of the Domain Controllers IP = 172.29.3.211
   
   Then you would add the following to the host file:
   172.29.3.211 TEST.EXAMPLE.COM
   
   the host file can be found at:
   C:\Windows\System32\drivers\etc

* to get a list of domain controllers the below command can be run from the command prompt.

nslookup -type=all _ldap._tcp

3. The third but unrecommended option is to log in to the Admin console and point Pyramid directly to one of your Domain Controllers without the need to edit the local host file on each Pyramid machine.
The disadvantage to this is that if this one domain controller fails there will be no way to login to the Pyramid application in order to update it to another one. Please see below on how you would point to one domain controller:

Under Admin>Access>domain settings - the bold text is where the domain controller would be specified followed by the LDAP address.
LDAP://TESTDC1.TEST.EXAMPLE.COM/DC=TEST,DC=EXAMPLE,DC=COM

Note that support for configuring a DC in the LDAP path was only introduced in version 2018.05.163. 

• Pyramid File Server - 12150**
• Pyramid Agent - 12190**
• Pyramid Task Engine  - 12110
• Pyramid Runtime Engine - 12100,12101
• Pyramid Router Server - 12120
• Pyramid Windows Connector (Windows Cx) -12140,12141 
• Pyramid Web Server - 8181 *
• Pyramid Web Server (internal communication) - 8282
• Pyramid In-memory Database - 12170
• Internal PostgreSQL Database Repository - 12130
• Augmented Analytics server ("AI") (DS/ML) - 12200
• Pyramid NLP (Natural Language Query) - 12300

All Pyramid services must be able to communicate with each other directly so all the ports must be open between all the servers in the Pyramid install.

NOTE:
If the designated port is in use when the service starts up, it will try to use the next available port.
This is why you should allow a range of ports and not specific ones.
You should allow a range between 12100–12310, PLUS the web server ports.
The ports that are being used can be confirmed by looking at the diagnostic page found at http://MyPyramidSite.com/Diagnostic
 

For disabling the port incrementation behavior to prevent a situation when an incremented port is not available, add into the table [dbo].[admin_tbl_settings] in the Pyramid repository a row called "autoAdvancePort" and set its value to false. This option is available only from version 2020.23.120.

* The web servers are accessible through port 8181. In production, reverse proxies are usually setup to communicate with the web servers on this port only. Then, the proxies typically expose ports 80 (HTTP) or 443 (HTTPS) to users. So, port 8181 need only be accessible inside the firewall.

**The agent and file server are installed on each Pyramid server where one of the other services have been installed.

First, you need to install the following IIS modules :

To install "IIS URL Rewrite Module 2" and "Microsoft Application Request Routing 3.0" please download and install them using the links below:
Note, that before installing them, you'll need to close IIS first.

• Microsoft Application Request Routing 3.0: 
  https://www.iis.net/downloads/microsoft/application-request-routing
• IIS URL Rewrite Module 2: https://www.iis.net/downloads/microsoft/url-rewrite
  NOTE: The Application Request Routing should include the IIS URL Rewrite Module, but if it's not, here is the URL to install it.

Once the above two IIS add-on's have been downloaded, run the installer and follow the on-screen prompts.

Once the above two models have been installed, activate the proxy as shown below:
Open IIS >Double click on the server name(1)>Double Click on "Application Request Routing Cache"(2)
 
Click on "Server Proxy Settings..."(3)

Then Tick the box "Enable proxy"(4)>Click on Apply(5)

Secondly, create a new website and point it to the following location:

C:\program files\pyramid 2018\repository\iis

For the site name call it "pyramid2018", for the Physical path point it to C:\program files\pyramid 2018\repository\iis, for the hostname it can be anything but please note that you must add this to your DNS or local host file.

Then double click on the newly created site >URL Rewite. Double click on the first rule and make sure the Rewrite URL is: http://localhost:8181/{R:1}

Once the above steps have been done, please do an IISRESET and then try to access Pyramid 2018 again using the newly created IIS website.

NOTE: Ensure that the relevant ports are open on the firewall: 80 for HTTP and 443 for HTTPS.

These instructions apply to Microsoft Edge, Google Chrome, and Mozilla Firefox on Windows.

1. Open Windows Internet Options (Microsoft Edge and Google Chrome)

Microsoft Edge and Google Chrome use Windows security settings for Integrated Windows Authentication. You do not need to open Internet Explorer to configure these settings.

1. Press Windows + R to open the Run dialog.
2. Enter the following command and press Enter:

inetcpl.cpl

This opens the Internet Properties window.

2. Add the Pyramid website to the Local intranet or Trusted sites zone

1. In Internet Properties, select the Security tab.
2. Select Local intranet (recommended for internal Pyramid websites).
3. Click Sites, then Advanced.
4. Enter your Pyramid website address, for example https://pyramid.company.com, and click Add.
5. Click Close, then OK.

Alternatively, the website can be added to Trusted sites if required by your organization's configuration.

3. Enable automatic login using Windows credentials

1. In Internet Properties > Security, select the zone where you added the Pyramid website (Local intranet or Trusted sites).
2. Click Custom level.
3. Scroll to User Authentication > Logon.
4. Select Automatic logon with current user name and password.
5. Click OK to save the changes.

Note: For the Local intranet zone, the default Automatic logon only in Intranet zone setting can also be used.

4. Verify Integrated Windows Authentication is enabled

1. In Internet Properties, select the Advanced tab.
2. Scroll down to the Security section.
3. Verify that Enable Integrated Windows Authentication is checked.
4. Click Apply, then OK.
5. Close and reopen your browser, then try accessing Pyramid again.

5. Mozilla Firefox configuration

Unlike Microsoft Edge and Google Chrome, Firefox uses its own configuration settings for Integrated Windows Authentication.

If Firefox continues to prompt for credentials, follow these steps:

1. Open Mozilla Firefox.
2. Enter about:config in the address bar and press Enter.
3. If prompted, click Accept the Risk and Continue.
4. Search for network.negotiate-auth.trusted-uris.
5. Edit the preference and enter your Pyramid server hostname, for example pyramid.company.com.
6. Search for network.automatic-ntlm-auth.trusted-uris.
7. Edit this preference and enter the same Pyramid server hostname.
8. Save the changes and restart Firefox.

Note: If multiple hostnames are required, separate them with commas. These settings may also be managed centrally by your organization's IT department using Group Policy.

6. Verify the HTTP Service Principal Name (SPN)

If users are still prompted for credentials, verify that the correct HTTP Service Principal Name (SPN) is registered in Active Directory for the Pyramid website.

SPNs are required for Kerberos authentication and must be associated with the correct account running the HTTP service.

Open Command Prompt on a domain-connected machine and check for an existing SPN:

setspn -Q HTTP/pyramid.company.com

If the required SPN does not exist, an authorized Active Directory administrator can register it using the following commands:

setspn -S HTTP/pyramid.company.com ServerName$
setspn -S HTTP/pyramid ServerName$

Replace:

• pyramid.company.com with the fully qualified hostname used to access Pyramid.
• pyramid with the short hostname, if users access Pyramid using that name.
• ServerName$ with the appropriate Active Directory computer account.

Important: If the HTTP service runs under a dedicated Active Directory service account, register the SPN against that account instead of the server computer account.

SPNs must be unique in Active Directory. The setspn -S option checks for duplicates before registration. Do not create or modify SPNs without confirming the correct service account.

7. Additional troubleshooting

If Windows Authentication still does not work:

• Verify that Windows Authentication is correctly configured and enabled in Pyramid.
• Confirm that the client computer is connected to the corporate network or VPN and can communicate with the required Active Directory services.
• Verify that the Pyramid website is listed in the correct Windows security zone, or in Firefox's authentication preferences.
• Check that the HTTP SPN is correctly registered and does not have duplicates.
• Check whether browser policies managed by your IT department override local authentication settings.
• Close and reopen the browser, then test again.

If the issue persists, please contact Pyramid Support for further assistance.

Once Pyramid is installed, configure an HTTPS binding in IIS using the following steps:

1. Open Internet Information Services (IIS) Manager.
2. Expand Sites, right-click the Pyramid website, and select Edit Bindings (1).
3. Click Add (2).
4. Set the binding type to https (3).
5. Enter the required hostname (4), if applicable.
6. Select the appropriate SSL certificate (5).
7. Click OK to save the binding.

Once the HTTPS binding is configured, open the Pyramid website using its HTTPS address, for example:

https://pyramid.example.com

Ensure that the hostname matches the SSL certificate and that TCP port 443 is accessible.

Note: No changes to Pyramid's web.config file are required solely to add an HTTPS binding in IIS.