Enabling VuGen For Quality Center For Load Testing With

enabling vugen for quality center for load testing with loadrunner & production monitoring with bac 1.

Enabling VuGen for Quality Center
For Load Testing with LoadRunner
& Production Monitoring with BAC
1.
Overview
========
When organizations adopt Quality Center to manage their quality
management processes and assets it becomes an indispensable tool for
all testing activity. Non availability and poor performance will
impact productivity and progress. Delays in testing will result in
delays in product release or products being released with less testing
coverage and depth, resulting in a greater risk to the business.
HP Best practices promote performance load testing business critical
systems before these systems are released into production. This is
accomplished using HP LoadRunner technologies which simulate real user
loads, by executing user emulation scripts, based on the VuGen tool.
It is also recommended that the QC operations team monitor
availability and performance with HP Business Availability Center,
which also uses scripts based on the VuGen tool.
2.
QC’s default session security
=============================
Starting with Quality Center version 9.0, an extra security feature is
enabled by default. This is designed to prevent the theft and reuse of
active QC session Ids. When this security feature is enabled, it is
not possible to create VuGen scripts for the Quality Center client.
The VuGen script excerpt below represents the user clicking the
“Authenticate” button. This user action results in 4 HTTP Posts to the
QC Server. The following script was recorded and the QC Login Session
ID was correctly parameterized so that the following transactions
execute correctly. Regardless of whether this security feature is
enabled, the script recording would be identical.
*
User name and password are sent to the server and, if valid, a QC
login session id is returned.
*
A QC Server ping is sent (QC login session id required)
*
A request for all domains for which the user is enabled (QC login
session id required)
*
A request for all projects for which the user is enabled (QC login
session id required)
// Capture QC Session ID
web_reg_save_param("QC_Session_ID",
"LB=LOGIN_SESSION_ID:","RB=\r\n",LAST); // LOGIN_SESSION_ID:223146\r\n
web_add_header("X-TD-ID", "00005DE0");
web_custom_request("TDAPI_GeneralWebTreatment",
"URL=http://SHOGUN1:8080/qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment",
"Method=POST",
"RecContentType=text/html",
"Snapshot=t4.inf",
"Mode=HTML",
"EncType=text/html; charset=UTF-8",
"BodyBinary={\r\n0: \"0:conststr:Login\",\r\n1: \"0:int:2\",\r\n2:
\"0:int:-1\",\r\n3: \"0:int:-1\",\r\n4:
\\x5C00000093\\x5C0:conststr:{\r\nUSER_NAME:QCAdmin,\r\nPASSWORD:\\x5C0000002a\\x5CENRCRYPTED193!159!219!156!210!206!188!133!,\r\nCLIENTTYPE:\\x5C00000018\\x5CQuality
Center Client UI\r\n}\r\n,\r\n5:
\\x5C00000015\\x5C0:conststr:LAB99,\r\n6: \"65536:str:0\",\r\n7:
\"0:pint:0\",\r\n8: \"0:pint:0\",\r\n9: \"0:pint:0\"\r\n}\r\n",
LAST);
web_add_header("X-TD-ID", " 00002804");
web_custom_request("TDAPI_GeneralWebTreatment_2",
"URL=http://SHOGUN1:8080/qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment",
"Method=POST",
"RecContentType=text/html",
"Snapshot=t5.inf",
"Mode=HTML",
"EncType=text/html; charset=UTF-8",
"BodyBinary={\r\n0: \\x5C00000017\\x5C0:conststr:PingToServer,\r\n1:
\"0:int:0\",\r\n2: \"0:int:{QC_Session_ID}\",\r\n3:
\"0:int:-1\",\r\n4: \"0:int:0\",\r\n5: \"65536:str:0\"\r\n}\r\n",
LAST);
web_add_header("X-TD-ID", " 000026CF");
web_custom_request("TDAPI_GeneralWebTreatment_3",
"URL=http://SHOGUN1:8080/qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment",
"Method=POST",
"RecContentType=text/html",
"Snapshot=t6.inf",
"Mode=HTML",
"EncType=text/html; charset=UTF-8",
"BodyBinary={\r\n0:
\\x5C0000001C\\x5C0:conststr:GetVisibleDomains,\r\n1:
\"0:int:3\",\r\n2: \"0:int:{QC_Session_ID}\",\r\n3:
\"0:int:-1\",\r\n4: \"65536:str:0\"\r\n}\r\n",
LAST);
web_add_header("X-TD-ID", " 00003086");
web_custom_request("TDAPI_GeneralWebTreatment_4",
"URL=http://SHOGUN1:8080/qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment",
"Method=POST",
"RecContentType=text/html",
"Snapshot=t7.inf",
"Mode=HTML",
"EncType=text/html; charset=UTF-8",
"BodyBinary={\r\n0:
\\x5C0000001D\\x5C0:conststr:GetVisibleProjects,\r\n1:
\"0:int:4\",\r\n2: \"0:int:{QC_Session_ID}\",\r\n3:
\"0:int:-1\",\r\n4: \\x5C00000012\\x5C0:conststr:DEFAULT,\r\n5:
\"65536:str:0\"\r\n}\r\n",
LAST);




When security is enabled each request to the TDAPI_GeneralWebTreatment
servlet must contain a Quality Center authentication code which is
generated by a HP proprietary algorithm. This code is sent in X-TD-ID
header as shown above. The server also validates this authentication
code for every request. This code is dynamic and can not be reused. If
this code is incorrect, the server rejects the request. Examples of
this rejection are shown below.
Action2.c(52): t=17681ms: 247-byte response headers for
"http://shogun1:8080/qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment"
(RelFrameId=1)
Action2.c(52): HTTP/1.1 403 Forbidden\r\n
Action2.c(52): Server: Apache-Coyote/1.1\r\n
Action2.c(52): X-Powered-By: Servlet 2.4; JBoss-4.0.2 (build:
CVSTag=JBoss_4_0_2 date=200505022023)/Tomca
Action2.c(52): t-5.5\r\n
Action2.c(52): Content-Type: text/html;charset=utf-8\r\n
Action2.c(52): Content-Length: 962\r\n
Action2.c(52): Date: Fri, 27 Apr 2007 22:15:51 GMT\r\n
Action2.c(52): \r\n
Action2.c(52): Error -26628: HTTP Status-Code=403 (Forbidden) for
"http://shogun1:8080/qcbin/servlet/tdservlet/TDAPI_GeneralWebTreatment"
[MsgId: MERR-26628]


Action2.c(67): t=2372ms: 247-byte response headers for
"http://shogun1:8080/qcbin/serv
Action2.c(67): HTTP/1.1 200 OK\r\n
Action2.c(67): Server: Apache-Coyote/1.1\r\n
Action2.c(67): X-Powered-By: Servlet 2.4; JBoss-4.0.2 (build:
CVSTag=JBoss_4_0_2 d
Action2.c(67): t-5.5\r\n
Action2.c(67): Content-Type: text/html;charset=UTF-8\r\n
Action2.c(67): Transfer-Encoding: chunked\r\n
Action2.c(67): Date: Fri, 27 Apr 2007 18:01:57 GMT\r\n
Action2.c(67): \r\n
Action2.c(67): t=2411ms: 5-byte chunked response overhead for
"http://shogun1:8080/qcb
Action2.c(67): ccb\r\n
Action2.c(67): t=2418ms: 3275-byte chunked response body for
"http://shogun1:8080/qcb
Action2.c(67): {\r\n
Action2.c(67): 0:"1:str:0",\r\n
Action2.c(67): 1:"7:str:SHOGUN1",\r\n
Action2.c(67): 2:\\00000c6e\\3173:str:The session authentication has
failed.[ERR_
Action2.c(67): Unexpected failure while trying to ping user session
#127;\n
Action2.c(67): The session authentication has failed.;\n
Action2.c(67): \n
Action2.c(67): Error Code: 1077\n
Action2.c(67): \n
Action2.c(67): Stack Trace:\n
Action2.c(67): com.mercury.optane.core.CTdException: The session
authentication ha
Action2.c(67): at
com.mercury.td.tdserver.authentication.CLoginContextDirectory.ge
Action2.c(67): ctory.java:113)\r\n
Action2.c(67): at
com.mercury.td.tdserver.api.logics.CMiscLogic.pingSession(CMiscL
Action2.c(67): \twrapped in
com.mercury.optane.core.exception.CPingSessionExceptio
Action2.c(67): hile trying to ping user session #127\r\n
Action2.c(67): at
com.mercury.td.tdserver.api.logics.CMiscLogic.pingSession(CMiscL
Action2.c(67): at
m.mercury.td.web.server.CTdServlet.redirectPingToServer(CTdServlet.java:418)\r\n
Action2.c(67): at sun.reflect.GeneratedMethodAccessor77.invoke(Unknown
Source)\r\n
Action2.c(67): at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)\r
Action2.c(67): \n


Subsequent requests will result in similar responses and response
bodies that are either around 70 or 0 bytes, lacking the requested QC
data.
3.
Disabling security
==================
The only way for VuGen to be used successfully is to disable this QC
Session security feature. The highest security is achieved by enabling
industry standard SSL, which will protect QC data as it travels
between the QC Client and the QC Server. The QC Session security
feature is designed to protect QC sessions on computers that are
compromised by virus software or session ids intercepted on the
network when SSL is not utilized.
The following Java option is used to disable this security for a
Windows JBoss deployment.
set JAVA_OPTS=%JAVA_OPTS% -Dcom.mercury.td.http.authentication=false
1.
To make this flag permanent it should be put in place in the
startup and service installation batch file. The service will
need to uninstalled and reinstalled for this to be permanent.
This is the most robust method and it ensures the security
feature is disabled if QC is started with run.bat or from an
automatically launch service. The above option needs to be added
to the files found in the directory
Program Files\Mercury\Quality Center\jboss\bin
*
run.bat
*
InstallJbossService.bat
Take caution when uninstalling and reinstalling the service. Use the
same user privileges and the user that did the initial install.
Execute on one of the QC servers, taken out of the load balancer, and
take necessary steps to enable a full restore of the server. Stop the
current Quality Center service and execute the InstallJBossServer.bat
with the arguments “-uninstall” followed by “-install”, before adding
the new flag. When successful edit the files and repeats.
2.
When the change is only needed temporarily for a LoadTest on the
production servers, an option is to create a new service that
has the security disabled. The following command creates a new
copy of the current “Quality Center” called “Mercury Quality
center for VuGen”. Then properly installed one stops the default
QC service and starts this new service, which will support
record and replay by VuGen.
QCJavaService.exe -install "Mercury Quality Center for VuGen"
"\_jvm\jre\bin\client\jvm.dll" -Dprogram.name=run.bat
-Djetty.port=8060 -Xms512m -Xmx1024m -XX:SurvivorRatio=10
-Djava.class.path=".;\_jvm\lib\tools.jar;\jboss\bin\run.jar"
-Dcom.mercury.td.http.authentication=false -start org.jboss.Main -stop
org.jboss.Main -method systemExit -params %1 %2 -out
"\_jvm\..\InstallInfo\ServiceOut.txt"
3.
A third approach is to update the Windows Registry to include
the Java Option for the QC Service. The advantage is that the QC
service will not require being uninstalled and reinstalled and
it is easy to undo. A minus is that this change will not persist
if the Quality center service is ever reinstalled. The Add the
new option string and update the value of the “Counter” registry
key to reflect its addition, which stores the hex counter for
the next key that is ever added.