Sun Microsystems 820433510 manuale d’uso

Sun GlassF ish Enterprise Ser v er 2.1 A dministra tion Guide Sun Microsystems, Inc. 4150 Network Circle Santa Clara, CA 95054 U.S.A. Part N o: 820–4335–10 December 2008[...]

Copyright 2008 Sun Microsystems, Inc. 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved. Sun Microsystems, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. I n particular, and without limitation, these intellectual property rights may include one or more U.S[...]

Cont ents Preface ...................................................................................................................................................19 1 Enterprise Server Overview ............................................................................................................... 23 Enterprise Server Overview and C oncep[...]

Starting an Instance ..................................................................................................................... 35 Stopping an Instance ................................................................................................................... 35 Restarting an Instance .............................................[...]

IBM Informix Type 4 Driver ...................................................................................................... 61 CloudScape 5.1 Type 4 Driver .................................................................................................... 61 4 Conguring Ja va Message Service Resources .....................................[...]

Managing Security M aps ............................................................................................................. 87 ▼ To Delete a Connector C onnection P ool .................................................................................. 87 ▼ To Set Up EIS A ccess .........................................................[...]

Users ............................................................................................................................................ 105 Groups ......................................................................................................................................... 105 Roles ............................................[...]

A ctions of Request and Response P olicy Congurations ...................................................... 134 Conguring Other Security Facilities ...................................................................................... 135 Conguring a JCE Provider ............................................................................[...]

Viewing Deployed Web Services ............................................................................................. 156 Testing Web Services ................................................................................................................. 156 Web Services Security .............................................................[...]

Overview of Monitoring ........................................................................................................... 172 A bout the Tree Structure of Monitorable Objects ................................................................. 172 A bout Statistics for Monitored Components and Services ........................................[...]

CT h e asadmin Utility ............................................................................................................................ 231 The asadmin Utility ........................................................................................................................... 232 Common Options for Remote C ommands ..............[...]

12[...]

F igures FIGURE 1–1 Enterprise Server Instance ........................................................................................ 29 FIGURE 9–1 Role Mapping ........................................................................................................... 105 13[...]

14[...]

T ables T ABLE 1–1 Features A vailable for Each Prole .......................................................................... 27 T ABLE 1–2 Enterprise Server Listeners that Use Ports ............................................................. 30 T ABLE 6–1 JNDI Lookups and Their Associated References ..................................[...]

T ABLE 18–23 JVM Statistics for Java SE - Thread I nfo ............................................................... 190 T ABLE 18–24 JVM Statistics for Java SE - Threads ...................................................................... 191 T ABLE 18–25 Top Level .........................................................................[...]

Examples EXAMPLE 18–1 A pplications Node Tree Structure ......................................................................... 173 EXAMPLE 18–2 HTTP Service Schematic (DeveloperProle Version) ........................................ 173 EXAMPLE 18–3 HTTP Service Schematic (Cluster and Enterprise Prole Version) .................. 174 [...]

18[...]

P refac e The A dministration guide describes the administrative tasks of the Enterprise Server. This preface contains information about and conventions for the entire Sun GlassFish TM Enterprise Server documentation set. Sun GlassFish Ent erprise S erver Documentation Set T ABLE P–1 Books in the Enterprise Server Documentation Set Book Title Des[...]

T ABLE P–1 Books in the Enterprise Server D ocumentation Set (Continued) Book Title Description H igh A vailability Administration Guide Setting up clusters, working with node agents, and using load balancers. A dministration Reference Editing the Enterprise Server conguration le, domain.xml . Performance Tuning G uide Tuning the Enterprise[...]

T ypographic C onv entions The following table describes the typographic changes that are used in this book. T ABLE P–3 Typographic Conventions T ypeface Meaning Example AaBbCc123 The names of commands, les, and directories, and onscreen computer output Edit your .login le. Use ls -a to list all les. machine_name% you have mail. AaBbCc12[...]

T ABLE P–4 Symbol Conventions (Continued) Symbol Description Example Meaning → Indicates menu item selection in a graphical user interface. File → New → Templates From the F ile menu, choose New. From the N ew submenu, choose Templates. Documentation, Support, and T raining The Sun web site provides information about the following additiona[...]

Enterprise Ser ver Over view Sun GlassFish Enterprise Server administration includes many tasks such as deploying applications, creating and conguring domains, server instances and resources; controlling (starting and stopping) domains and server instances, managing proles and clusters, monitoring and managing performance, and diagnosing and [...]

Enterprise Server includes the M etro web services stack (http://metro.dev.java.net). Metro implements important WS-* standards and WS-I standardized interoperability proles in order to assure interoperability between J ava and .NET web services. Enterprise Server includes the implementation of J ava Business Integration (JBI) specications. J[...]

If your conguration includes remote server instances, create node agents to manage and facilitate remote server instances. I t is the responsibility of the node agent to create, start, stop, and delete a server instance. Use the command line interface (CLI) commands to set up node agents. Command-line Int er face ( asadmin Utility) The asadmin u[...]

Enterprise Ser v er Concepts The Enterprise Server consists of one or more domains. A domain is an administrative boundary or context. Each domain has an administration server (also called Domain A dministration Server or D AS) associated with it and consists of zero or more standalone instances and/or clusters. Each cluster has one or more homogen[...]

carry out the requests. The D AS is sometimes referred to as the admin server or default server. It is referred to as the default server because it is the only server instance that gets created on Sun GlassFish Enterprise Server installation and can be used for deployments. The D AS is simply a server instance with additional administration capabil[...]

T ABLE 1–1 Features A vailable for E ach Prole (Continued) Featur e Developer Prole Cluster Prole Enterprise Prole (not available with Sun GlassFish Communications Server) Security Manager Disabled Enabled Enabled H ADB Not available Not available A vailable Load balancing Not available A vailable A vailable Node agents Not available [...]

Ser v er Instance The server instance is a single J ava EE compatible J ava Virtual Machine hosting an Enterprise Server on a single node. Each server instance has a unique name in the domain. A clustered server instance is a member of a cluster and receives all of its applications, resources, and conguration from its parent cluster; ensuring th[...]

names, IP A ddresses, and some administration capabilities. For the users, it is almost as if they have their own web server, without the hardware and basic server maintenance. These virtual servers do not span application server instances. For more information about virtual servers, see Chapter 13, “Conguring the HTTP Service. ” In operatio[...]

Basic Enterprise Ser v er Commands A dministration of the Enterprise Server includes tasks such as creation, conguration, control and management of domains, clusters, node agents, and server instances. This section contains the following topics: ■ “Creating a Domain” on page 31 ■ “Deleting a Domain” on page 32 ■ “Listing Domains?[...]

Caution – Do not create an enterprise domain unless you have H ADB and the Network Security Services (NSS) keystore. You will not be able to start an enterprise domain unless you have H ADB and NSS. For the preceding create-domain example, the domain’ s log les, conguration les, and deployed applications now reside in the following dir[...]

Star ting the Default Domain on W indow s From the Windows Start M enu, select Programs -> Sun Microsystems -> Enterprise Server -> Start A dmin Server. Stopping the Domain Stopping a domain shuts down its administration server and application server instance. When stopping a domain, the server instance stops accepting new connections and [...]

For the full syntax, type asadmin help create-cluster . Star ting a Cluster A cluster is started using the start-cluster command. The following example starts the cluster named mycluster . The command prompts for the administrative passwords. $ asadmin start-cluster --host myhost --port 1234 --user admin mycluster For the full syntax, type asadmin [...]

For the full syntax, type asadmin help start-node-agent . Stopping a Node A gent A node agent is stopped using the stop-node-agent command and specifying the node agent name. For example, to stop the node agent mynodeagent , type the following: $ asadmin stop-node-agent mynodeagent For the full syntax, type asadmin help stop-node-agent . Star ting [...]

Recreating the Domain A dministration Ser v er For mirroring purposes, and to provide a working copy of the Domain A dministration Server (D AS), you must have: ■ One machine (machine1) that contains the original D AS. ■ A second machine (machine2) that contains a cluster with server instances running applications and catering to clients. The c[...]

Change domain-root-dir /domain1/generated/tmp directory permissions on the third machine to match the permissions of the same dir ector y on rst machine . The default permissions of this directory are: ?drwx------? (or 700). For example: chmod 700 domain-root-dir /domain1/generated/tmp The example above assumes you are backing up domain1 . If yo[...]

38[...]

Java Business Integration J ava Business Integration (JBI) is an implementation of the JSR 208 specication ( http://www.jcp.org/en/jsr/detail?id=208 ) for Java Business I ntegration, a standard developed under the J ava Community Process (JCP) as an approach to implementing a service-oriented architecture (SO A). JBI denes an environment for [...]

Binding Components Binding Components are proxies for consumers or providers that are outside the JBI environment. Binding components typically are based on a standard communications protocol, such as FTP , JMS, or SMTP , or a call to an external service, such as SAP or WebSphere M Q. JBI components have the following lifecyle states: ■ Started ?[...]

Note – The logging levels for JBI Components are often inherited from a parent logger such as the JBI logger. To view and set parent logging levels, in the Admin Console, select Common Tasks and then A pplication Server. Then, in the Enterprise Server panel, select Logging and then Log Levels. L ook for the drop-down list for the JBI module to vi[...]

Shared Libraries A Shared Library provides Java classes that are not private to a single component and is typically shared by more than one JBI Component. For example, the J ava EE Service Engine requires the WSDL Shared Library. You can do the following operations on Shared Libraries. For detailed steps, log on to the A dmin Console, navigate to t[...]

JDBC Resourc es This chapter explains how to congure JDBC resources, which are required by applications that access databases. This chapter contains the following sections: ■ “JDBC Resources” on page 43 ■ “JDBC C onnection P ools” on page 44 ■ “How JD B C Resources and Connection Pools Work Together” on page 44 ■ “Setting U[...]

When creating a JDBC resource, you must identify: 1. The JNDI N ame. By convention, the name begins with the jdbc/ string. For example: jdbc/payrolldb . Don’t forget the forward slash. 2. Select a connection pool to be associated with the new JDBC resource. 3. Specify the settings for the resource. 4. Identify the targets (clusters and standalone[...]

Behind the scenes, the application server retrieves a physical connection from the connection pool that corresponds to the database. The pool denes connection attributes such as the database name (URL), user name, and password. 3. Now that it is connected to the database, the application can read, modify, and add data to the database. The applic[...]

W orking with JDBC Connection Pools A JDBC connection pool is a group of reusable connections for a particular database. When creating the pool with the A dmin Console, the Administrator is actually dening the aspects of a connection to a specic database. Before creating the pool, you must rst install and integrate the JDB C driver. When b[...]

Click OK. ▼ Creating a JDBC C onnec tion P ool and JDBC Resource Using the CLI Use the asadmin create-jdbc-connection-pool command to creat e a JDBC connection pool. Sample command to create a JDBC connection pool: asadmin create-jdbc-connection-pool --datasourceclassname oracle.jdbc.pool.OracleDataSource --restype javax.sql.DataSource --property[...]

Editing a JDBC Connection P ool The Edit JDBC C onnection P ool page provides the means to change all of the settings for an existing pool except its name. 1. Change general settings. The values of the general settings depend on the specic JDBC driver that is installed. These settings are the names of classes or interfaces in the J ava programmi[...]

Optionally, the application server can validate connections before they are passed to applications. This validation allows the application server to automatically reestablish database connections if the database becomes unavailable due to network failure or database server crash. Validation of connections incurs additional overhead and slightly red[...]

Parameter Description Non-transactional Connections Click the check box if you want A pplication Server to return all non-transactional connections. Transaction Isolation Makes it possible to select the transaction isolation level for the connections of this pool. If left unspecied, the connections operate with default isolation levels provided [...]

A ttribute Description Validate A tmost Once Amount of time, in seconds, after which a connection is validated at most once. This will help reduce the number of validation requests by a connection. The default value 0 implies that connection validation is not enabled. Leak Timeout Amount of time, in seconds, to trace connection leaks in a connectio[...]

Match Connections Use this option to switch on/o connection matching for the pool. I t can be set to false if the administrator knows that the connections in the pool will always be homogeneous and hence a connection picked from the pool need not be matched by the resource adapter. Default value is false. Max Connection Usage Specify the number [...]

Note – An Oracle database user running the capture-schema command needs AN AL YZE ANY TABLE privileges if that user does not own the schema. These privileges are granted to the user by the database administrator. For information about capture-schema , see Sun GlassF ish Enterprise Server 2.1 Reference M anual . Jav a DB T ype 4 Driver The J ava D[...]

Sun GlassFish JDBC Driv er for DB2 Databases The J AR les for this driver are smbase.jar , smdb2.jar , and smutil.jar . Congure the connection pool using the following settings: ■ Name: Use this name when you congure the JD B C resource later. ■ Resource Type: Specify the appropriate value. ■ Database Vendor: DB2 ■ DataSource Class[...]

Sun GlassFish JDBC Driv er for Microsoft SQL Ser ver Databases The J AR les for this driver are smbase.jar , smsqlserver.jar , and smutil.jar . Congure the connection pool using the following settings: ■ Name: Use this name when you congure the JD B C resource later. ■ Resource Type: Specify the appropriate value. ■ Database Vendor: [...]

IBM DB2 8.1 T ype 2 Driver The J AR les for the DB2 driver are db2jcc.jar , db2jcc_license_cu.jar , and db2java.zip . Set environment variables as follows: LD_LIBRARY_PATH=/usr/db2user/sqllib/lib:${Java EE.home}/lib DB2DIR=/opt/IBM/db2/V8.1 DB2INSTANCE=db2user INSTHOME=/usr/db2user VWSPATH=/usr/db2user/sqllib THREADS_FLAG=native Congure the c[...]

■ password - Set as appropriate. ■ databaseName - Set as appropriate. Do not specify the complete URL, only the database name. ■ BE_AS_JDBC_COMPLIANT_AS_POSSIBLE - Set to true . ■ FAKE_METADATA - Set to true . MySQL T ype 4 Driver The J AR le for the MySQL driver is mysql-connector-java- version -bin-g.jar , for example, mysql-connector-[...]

■ DataSource Classname: com.inet.ora.OraDataSource ■ Properties: ■ user - Specify the database user. ■ password - Specify the database password. ■ serviceName - Specify the URL of the database. The syntax is as follows: jdbc:inetora: server : port : dbname For example: jdbc:inetora:localhost:1521:payrolldb In this example, localhost is th[...]

■ password - Set as appropriate. Inet Sybelux JDBC Driv er for S ybase Databases The J AR le for the Inet Sybase driver is Sybelux.jar . Congure the connection pool using the following settings: ■ Name: Use this name when you congure the JD B C resource later. ■ Resource Type: Specify the appropriate value. ■ Database Vendor: Sybas[...]

For example: jdbc:oracle:thin:@localhost:1521:customer_db ■ xa-driver-does-not-support-non-tx-operations - Set to the value true . Optional: only needed if both non-XA and XA connections are retrieved from the same connection pool. Might degrade performance. As an alternative to setting this property, you can create two connection pools, one for [...]

■ xa-driver-does-not-support-non-tx-operations - Set to the value true . Optional: only needed if both non-XA and XA connections are retrieved from the same connection pool. Might degrade performance. As an alternative to setting this property, you can create two connection pools, one for non-XA connections and one for XA connections. IBM Informi[...]

62[...]

C onguring Java Message Ser vice Resourc es The Enterprise Server implements the J ava M essage Service (JMS) API by integrating the M essage Queue software into the Enterprise Server. For basic JMS API administration tasks, use the Enterprise Server A dmin Console. For advanced tasks, including administering a M essage Queue cluster, use the to[...]

■ TopicConnectionFactory objects, used for publish-subscribe communication ■ ConnectionFactory objects, which can be used for both point-to-point and publish-subscribe communications; these are recommended for new applications There are two kinds of destinations: ■ Queue objects, used for point-to-point communication ■ Topic objects, used f[...]

JMS C onnec tion F ac tories JMS connection factories are objects that allow an application to create other JMS objects programmatically. These administered objects implement the ConnectionFactory , QueueConnectionFactory , and TopicConnectionFactory interfaces. Using the Enterprise Server A dmin Console, you can create, edit, or delete a JMS C onn[...]

To create a physical destination from the A dmin Console, select C onguration >Physical Destinations. In the Create Physical Destinations page, specify a name for the physical destination and choose the type of destination, which can be topic or queue. For more details about the elds and properties in the Physical Destinations page, refer [...]

■ In the MQ Scheme and M Q Service elds, type the Message Queue address scheme name and the M essage Queue connection service name if a non-default scheme or service is to be used. Values of all these properties can be updated at run time too. H owever, only those connection factories that are created after the properties are updated, will get[...]

Conguring the Generic Resour ce A dapter Prior to deploying the resource adapter, JMS client libraries should be made available to the Enterprise Server. For some JMS providers, client libraries may also include native libraries. I n such cases, these native libraries should also be made available to the JVM(s). 1. Deploy the generic resource ad[...]

Property Name Valid V alues Default Value Description TopicConnectionFactory ClassName Name of the class available in the application server classpath , for example: com.sun.messaging. TopicConnectionFactory None Class name of javax.jms.TopicConnectionFactory implementation of the JMS client. Used if ProviderIntegrationMode is specied as javabea[...]

Property Name Valid V alues Default Value Description JndiProperties Name value pairs separated by comma None Species the JNDI provider properties to be used for connecting to the JMS provider's JNDI. Used only if ProviderIntegrationMode is jndi . CommonSetter MethodName Method name None Species the common setter method name that some JM[...]

Property Name Valid V alues Default Value Description RMPolicy ProviderManaged or OnePerPhysicalConnection Provider Managed The isSameRM method on an XAResource is used by the Transaction Manager to determine if the Resource Manager instance represented by two XAResources are the same. When RMPolicy is set to ProviderManaged (the default value), th[...]

Property Name Valid V alue Default V alue Description ClientId A valid client ID None ClientID as specied by JMS 1.1 specication. ConnectionFactory JndiName JNDI N ame None JNDI name of the connection factory bound in the JNDI tree of the JMS provider. The administrator should provide all connection factory properties (except clientID ) in th[...]

Property Name Valid V alue Default V alue Description MaxPoolSize An integer 8 Maximum size of server session pool internally created by the resource adapter for achieving concurrent message delivery. This should be equal to the maximum pool size of MDB objects. MaxWaitTime An integer 3 The resource adapter will wait for the time in seconds speci?[...]

Property Name Valid V alue Default V alue Description RedeliveryAttempts integer N umber of times a message will be delivered if a message causes a runtime exception in the MDB. RedeliveryInterval time in seconds Interval between repeated deliveries, if a message causes a runtime exception in the MDB. SendBadMessages ToDMD true/false False I ndicat[...]

C onguring JavaMail Resour ces The Enterprise Server includes the J avaMail API. The J avaMail API is a set of abstract API s that model a mail system. The API provides a platform-independent and protocol-independent framework to build mail and messaging applications. The J avaMail API provides facilities for reading and sending electronic messa[...]

To create a J avaMail session using the A dmin C onsole, select Resources —> J avaMail Sessions. Specify the J avaMail settings as follows: ■ JNDI N ame: The unique name for the mail session. Use the naming sub-context prex mail/ for J avaMail resources. F or example: mail/MySession . ■ Mail H ost: The host name of the default mail serv[...]

JNDI Resourc es The J ava N aming and Directory Interface (JNDI) is an application programming interface (API) for accessing dierent kinds of naming and directory services. J ava EE components locate objects by invoking the JNDI lookup method. JNDI is the acronym for the J ava Naming and Directory Interface API. B y making calls to this API, app[...]

application component's environment allows the application component to be customized without the need to access or change the application component's source code. A J ava EE container implements the application component's environment, and provides it to the application component instance as a JNDI naming context. The application co[...]

T ABLE 6–1 JNDI Lookups and Their Associated References JNDI Lookup Name Associated Referenc e java:comp/env A pplication environment entries java:comp/env/jdbc JDBC DataSource resource manager connection factories java:comp/env/ejb EJB References java:comp/UserTransaction UserTransaction references java:comp/env/mail JavaM ail Session C onnectio[...]

-- and jndi-lookup-name refers to the JNDI name to lookup to fetch the -- designated (in this case the java) object. --> <external-jndi-resource jndi-name= " test/myBean " jndi-lookup-name= " cn=myBean " res-type= " test.myBean " factory-class= " com.sun.jndi.ldap.LdapCtxFactory " > <property name[...]

C onnec t or Resourc es This chapter explains how to congure connectors, which are used to access enterprise information systems (EISs). This chapter contains the following sections: ■ “An Overview of C onnectors” on page 81 ■ “Managing Connector Connection Pools” on page 82 ■ “Managing Connector Resources” on page 88 ■ “Ma[...]

Managing C onnec tor C onnec tion P ools ■ “To Create a Connector C onnection P ool” on page 82 ■ “To Edit a Connector C onnection P ool” on page 83 ■ “To Edit Connector C onnection P ool Advanced A ttributes” on page 85 ■ “To Edit Connection Pool P roperties” on page 87 ▼ T o Creat e a Connector C onnec tion P ool Before [...]

c. In the Additional Properties table, add an y required pr operties. In the previous Create Connector Connection Pool page, you selected a class in the Connection Denition combo box. If this class is in the server’ s classpath, then the A dditional Properties table displays default properties. Click Finish. Equivalent asadmin command create-c[...]

On Any Failure If you select the checkbox labelled Close All Connections, if a single connection fails, then the application server will close all connections in the pool and then reestablish them. If you do not select the checkbox, then individual connections will be reestablished only when they are used. Transaction Support Use the Transaction Su[...]

Using the asadmin commands to change c onnec tion pool properties. You can use the asadmin get and set commands to view and change the values of the connection pool properties. To list all the connector connection pools in the server: asadmin list domain.resources.connector-connection-pool.* To view the properties of the connector connection pool, [...]

Lazy Association Connections are lazily associated when an operation is performed on them. Also, they are disassociated when the transaction is completed and a component method ends, which helps reuse of the physical connections. Default value is false. Lazy Connection Enlistment Enable this option to enlist a resource to the transaction only when [...]

▼ T o Edit Connection P ool Properties Use the Additional P roper ties tab to modify the properties of an existing pool. The properties specied depend on the resource adapter used by this pool. The name-value pairs specied by the deployer using this table can be used to override the default values for the properties dened by the resource[...]

Equivalent asadmin command delete-connector-connection-pool ▼ T o Set Up EIS Acc ess Deploy (install) a connector . Create a c onnection pool for the connector . Create a c onnector resource that is associa ted with the connection pool. Managing C onnec tor Resour ces ■ “To Create a Connector Resource” on page 88 ■ “To Edit a Connector [...]

d. Do one of the following: ■ If you are using the clust er prole, y ou will see the T argets section of the page. in the T argets section of the page, select the domain, cluster , or server instances where the connector resource will r eside, from the Av ailable eld and click Add. If y ou do not want to deploy the connector resour ce to on[...]

On the Connector Resources page , selec t the checkbox f or the resource t o be deleted. Click Delete. Equivalent asadmin command delete-connector-resource ▼ T o Congur e the C onnec tor Service Use the Connector Service screen to congure the connector container for all resource adapters deployed to this cluster or server instance. Select C[...]

To create, edit, and delete Connector C onnection P ools, click Resources —> Administered Object Resources in the A dmin Console. C onsult the A dmin C onsole Online H elp for detailed instructions on managing connector connection pools. ■ “To Create an A dministered Object Resource” on page 91 ■ “To Edit an A dministered Object Reso[...]

g. Click Finish. Equivalent asadmin command create-admin-object ▼ T o Edit an Administer ed Objec t Resource In the tree component, e xpand the Resource node and then the Connectors node. Expand the Administer ed Object Resources node. Select the node for the administered object resource to be edited . On the Edit Administer ed Objec t Resources [...]

W eb and E JB Containers Containers provide runtime support for application components. A pplication components use the protocols and methods of the container to access other application components and services provided by the server. The Enterprise Server provides an application client container, an applet container, a Web container, and an EJB co[...]

Editing the Properties of the SIP Container The sub-elements of the SIP container are session-manager and session-properties . store-properties , manager-properties are sub-elements of session-manager . For a complete list of SIP container properties, see TBDlink. To change the properties of the SIP container using the A dmin Console, select the Co[...]

Editing SIP Container Session Manager Pr oper ties To view the sub-elements of the SIP container session manager properties, use the following command: list server.sip-container.session-config.session-manager.* The two sub-elements are store-properties , manager-properties . To view the attributes of store-properties , use the following command: ge[...]

96[...]

C onguring Securit y Security is about protecting data: how to prevent unauthorized access or damage to it in storage or transit. The Enterprise Server; has a dynamic, extensible security architecture based on the J ava EE standard. Built in security features include cryptography, authentication and authorization, and public key infrastructure. [...]

■ In declarative security , the container (the Enterprise Server) handles security through an application's deployment descriptors. You can control declarative security by editing deployment descriptors directly or with a tool such as deploytool . B ecause deployment descriptors can change after an application is developed, declarative secur[...]

For more information on using certutil , pk12util , and other NSS security tools, see NSS Security Tools at http://www.mozilla.org/projects/security/pki/nss/tools . Managing Security of Passw ords In the Enterprise Server, the le domain.xml , which contains the specications for a particular domain, initially contains the password of the M ess[...]

Note – Enclose the alias password in single quotes as shown in the example. 3. Restart the Enterprise Server for the relevant domain. Prot ec ting Files with Enc oded Passw ords Some les contain encoded passwords that need protecting using le system permissions. These les include the following: ■ domain-dir /master-password This le [...]

Caution – A t this point in time, server instances that are running must not be started and running server instances must not be restarted until the SMP on their corresponding node agent has been changed. If a server instance is restarted before changing its SMP , it will fail to come up. 3. Stop each node agent and its related servers one at a t[...]

About Authentication and A uthorization A uthentication and authorization are central concepts of application server security. The following topics are discussed related to authentication and authorization: ■ “A uthenticating Entities” on page 102 ■ “A uthorizing Users” on page 103 ■ “Specifying J ACC Providers” on page 103 ■ ?[...]

T ABLE 9–1 Enterprise Server A uthentication Methods (Continued) DIGEST HTTP and SIP Server authenticates the client based on an encrypted response. SSL and TLS V erifying Single Sign-On Single sign-on enables multiple applications in one virtual server instance to share the user authentication state. With single sign-on, a user who logs in to on[...]

C onguring Message Security M essage Security enables a server to perform end-to-end authentication of web service invocations and responses at the message layer. The Enterprise Server implements message security using message security providers on the SO AP layer. The message security providers provide information such as the type of authentica[...]

Note – Users and groups are designated for the entire Enterprise Server, whereas each application denes its own roles. When the application is being packaged and deployed, the application species mappings between users/groups and roles, as illustrated in the following gure. Users A user is an individual (or application program) identity [...]

Roles A role denes which applications and what parts of each application users can access and what they can do. In other words, roles determine users' authorization levels. For example, in a personnel application all employees might have access to phone numbers and email addresses, but only managers would have access to salary information. [...]

In the JDBC realm, the server gets user credentials from a database. The Enterprise Server uses the database information and the enabled JDBC realm option in the conguration le. For digest authentication, a JDBC realm should be created with jdbcDigestRealm as the J AAS context. In the solaris realm the server gets user credentials from the So[...]

Assign a security role to users in the realm. To assign a security role to a user, add a security-role-mapping element to the deployment descriptor that you modied in Step 4 . The following example shows a security-role-mapping element that assigns the security role Employee to user Calvin . <security-role-mapping> <role-name>Employe[...]

M ost importantly, a certicate binds the owner's public key to the owner's identity. Like a passport binds a photograph to personal information about its holder, a certicate binds a public key to information about its owner. In addition to the public key, a certicate typically includes information such as: ■ The name of the hol[...]

When a Web browser (client) wants to connect to a secure site, an SSL handshake happens: ■ The browser sends a message over the network requesting a secure session (typically, by requesting a URL that begins with https instead of http ). ■ The server responds by sending its certicate (including its public key). ■ The browser veries that[...]

If all virtual hosts on a single IP address need to authenticate against the same certicate, the addition of multiple virtual hosts probably will not interfere with normal SSL operations on the server. Be aware, however, that most browsers will compare the server's domain name against the domain name listed in the certicate, if any (appl[...]

In the Developer Prole, on the server side, the Enterprise Server uses the JSSE format, which uses keytool to manage certicates and key stores. In the Clusters and Enterprise Prole, on the server side, the Enterprise Server uses NSS, which uses certutil to manage the NSS database which stores private keys and certicates. In both prol[...]

■ Create a self-signed certicate in a keystore of type JKS using an RSA key algorithm. RSA is public-key encryption technology developed by RSA Data Security, Inc. The acronym stands for Rivest, Shamir, and A delman, the inventors of the technology. keytool -genkey -noprompt -trustcacerts -keyalg RSA -alias ${cert.alias} -dname ${dn.name} -key[...]

keytool -delete -noprompt -alias ${cert.alias} -keystore ${keystore.file} -storepass ${keystore.pass} Another example of deleting a certicate from a keystore is shown in “Deleting a Certicate Using the keytool Utility” on page 115 Genera ting a Certicate Using the keytool Utility Use keytool to generate, import, and export certicate[...]

6. If you have changed the keystore or private key password from their default, then substitute the new password for changeit in the above command. The tool displays information about the certicate and prompts whether you want to trust the certicate. 7. Type yes , then press Enter. Then keytool displays something like this: Certificate was ad[...]

keytool -delete -alias keyAlias -keystore keystore-name -storepass password Using Netw ork Security S ervices (NSS) T ools In the Clusters and Enterprise Prole, use N etwork Security Services (NSS) digital certicates on the server-side to manage the database that stores private keys and certicates. For the client side (appclient or stand-a[...]

Using the certutil Utility Before running certutil , make sure that LD_LIBRARY_PATH points to the location of the libraries required for this utility to run. This location can be identied from the value of AS_NSS_LIB in asenv.conf (product wide conguration le). The certicate database tool, certutil , is an NSS command-line utility that [...]

■ Import an RFC text-formatted certicate into an NSS certicate database. certutil -A -a -n ${cert.nickname} -t ${cert.trust.options} -f ${pass.file} -i ${cert.rfc.file} -d ${admin.domain.dir}/${admin.domain}/config ■ Export a certicate from an NSS certicate database in RFC format. certutil -L -a -n ${cert.nickname} -f ${pass.file} -[...]

pk12util -o -n ${cert.nickname} -h ${token.name} -k ${pass.file} -w ${cert.pass.file} -d ${admin.domain.dir}/${admin.domain}/config ■ Convert a PK CS12 certicate into JKS format (requires a J ava source): &lt;target name= " convert-pkcs12-to-jks " depends= " init-common " > &lt;delete file= " ${jks.file} &qu[...]

Using Har dware Cr ypt o Ac celerat or W ith Enterprise Ser v er You can use hardware accelerator tokens to improve the cryptographic performance and to furnish a secure key storage facility. A dditionally, you can provide end users with mobile secure key storage through smart cards. Sun J ava System A pplication Server supports the use of PKCS#11 [...]

For the M icrosoft Windows environment, add the location of NSS libraries AS_NSS and the NSS tools directory, AS_NSS_BIN to the P A TH environment variable. For simplicity, the procedures described in this section use UNIX commands only. You should replace the UNIX variables with the Windows variables, where appropriate. Conguring the hardware c[...]

Using database directory /var/opt/SUNWappserver/domains/domain1/config ... Listing of PKCS#11 Modules ----------------------------------------------------------- 1. NSS Internal PKCS#11 Module slots: 2 slots attached status: loaded slot: NSS Internal Cryptographic Services token: NSS Generic Crypto Services slot: NSS User Private Key and Certificat[...]

Listing Key s and Certic a tes ■ To list the keys and certicates in the congured PK CS#11 tokens, run the following command: certutil -L -d AS_NSS_D B [-h tokenname ] For example, to list the contents of the default NSS soft token, type: certutil -L -d AS_NSS_D B The standard output will be similar to the following: verisignc1g1 T,c,c ve[...]

W orking With P rivat e Key s and Certic a tes Use certutil to create self-signed certicates and to import or export certicates. To import or export private keys, use the pk12util utility. For more details, see “Using N etwork Security Services (NSS) Tools” on page 116 Caution – In Enterprise Server, do not modify the NSS password di[...]

To create a custom conguration le: 1. Create a conguration le called as-install /mypkcs11.cfg with the following code and save the le. name=HW1000 library=/opt/SUNWconn/crypto/lib/libpkcs11.so slotListIndex=0 disabledMechanisms = { &#9;CKM_RSA_PKCS &#9;CKM_RSA_PKCS_KEY_PAIR_GEN } omitInitialize=true 2. Update the NSS database[...]

126[...]

C onguring Message Securit y Some of the material in this chapter assumes a basic understanding of security and web services concepts. This chapter describes the conguration of message layer security for web services in the Enterprise Server. This chapter contains the following topics: ■ “Overview of Message Security” on page 127 ■ ?[...]

Understanding Message Security in the Enterprise Ser ver The Enterprise Server oers integrated support for the WS-Security standard in its web services client and server-side containers. This functionality is integrated such that web services security is enforced by the containers of the Enterprise Server on behalf of applications, and such that[...]

Application Deploy er The application deployer is responsible for: ■ Specifying (at application assembly) any required application-specic message protection policies if such policies have not already been specied by upstream roles (the developer or assembler). ■ M odifying Sun-specic deployment descriptors to specify application-speci?[...]

About Digital Signatures The Enterprise Server uses XML Digital signatures to bind an authentication identity to message content . Clients use digital signatures to establish their caller identity, analogous to the way basic authentication or SSL client certicate authentication have been used to do the same thing when transport layer security is[...]

Glossar y of Message Security T erminology The terminology used in this document is described below. The concepts are also discussed in “Conguring the Enterprise Server for Message Security” on page 133 . ■ A uthentication L ayer The authentication layer is the message layer on which authentication processing must be performed. The Enterpr[...]

The response policy denes the authentication policy requirements associated with response processing performed by the authentication provider. P olicies are expressed in message sender order such that a requirement that encryption occur after content would mean that the message receiver would expect to decrypt the message before validating the s[...]

C onguring Application-Specic W eb S ervices Security A pplication-specic web services security functionality is congured (at application assembly) by dening message-security-binding elements in the Sun-specic deployment descriptors of the application. These message-security-binding elements are used to associate a specic provi[...]

Actions of Request and Response P olic y C ongurations The following table shows message protection policy congurations and the resulting message security operations performed by the WS-Security SO AP message security providers for that conguration. T ABLE 10–1 Message protection policy to WS-Security SO AP message security operation map[...]

T ABLE 10–1 Message protection policy to WS-Security SO AP message security operation mapping (Continued) Message Protection Policy Resulting WS-Security SOAP message protection operations auth-recipient= " before-content " OR auth-recipient= " after-content " The content of the SO AP message B ody is encrypted and replaced wi[...]

If you are running the Enterprise Server on version 1.5 of the J ava SDK, the JCE provider is already congured properly. If you are running the Enterprise Server on version 1.4.x of the J ava SDK, you can add a JCE provider statically as part of your JDK environment, as follows. 1. Download and install a JCE provider J AR ( J ava ARchive) le.[...]

6. Restart the Enterprise Server. Message Security Setup M ost of the steps for setting up the Enterprise Server for using message security can be accomplished using the A dmin Console, the asadmin command-line tool, or by manually editing system les. In general, editing system les is discouraged due to the possibility of making unintended ch[...]

■ To specify the default server provider: asadmin set --user admin-user --port admin-port server-config.security-service.message-security-config.SOAP. default_provider=ServerProvider ■ To specify the default client provider: asadmin set --user admin-user --port admin-port server-config.security-service.message-security-config.SOAP. default_clie[...]

Crea ting a Message Security Pro vider To congure an existing provider using the A dmin Console, select C onguration node > the instance to Congure> Security node > Message Security node > SO AP node > Providers tab. For more detailed instructions on creating a message security provider, see the A dmin Console online help. E[...]

<log-service file= "" level= " WARNING " /> <message-security-config auth-layer= " SOAP " default-client-provider= " ClientProvider " > <provider-config class-name= " com.sun.enterprise.security.jauth.ClientAuthModule " provider-id= " ClientProvider " provider-type= " c[...]

C onguring the Diagnostic Ser vice The Diagnostic Service provides more visibility into and control of the runtime performance of a server and its applications, allowing you to diagnose and isolate faults as they occur. This chapter contains the following sections: ■ “What is the Diagnostic Framework?” on page 141 ■ “Diagnostic Service[...]

Installation specic details are collected only for le-based installations. ■ Capture System Information: The following system information is collected by default: ■ Network Settings ■ OS details ■ Hardware information Data collected using native code is not available on the Platform Edition of A pplication Server. ■ Capture Applicat[...]

T r ansac tions By enclosing one or more steps in an indivisible unit of work, a transaction ensures data integrity and consistency. This chapter contains the following sections: ■ “A bout Transactions” on page 143 ■ “A dmin Console Tasks for Transactions” on page 145 About T ransactions ■ “What is a Transaction?” on page 143 ■ [...]

See Also: ■ “Transactions in J ava EE Technology” on page 144 ■ “Conguring Transactions” on page 145 T ransactions in Java EE T echnology Transaction processing involves the following ve participants: ■ Transaction Manager ■ Enterprise Server ■ Resource Manager(s) ■ Resource A dapter(s) ■ User A pplication. Each of these[...]

W ork arounds f or Specic Databases The Enterprise Server provides workarounds for some known issues with the recovery implementations of the following JDBC drivers. These workarounds are used unless explicitly disabled. ■ Oracle thin driver - The XAResource.recover method repeatedly returns the same set of in-doubt Xids regardless of the inpu[...]

When the transaction spans across servers, the server that started the transaction can contact the other servers to get the outcome of the transactions. If the other servers are unreachable, the transaction uses the H euristic Decision eld to determine the outcome. In the tree component select the Congura tions node. Select the instance to co[...]

Select the instance to congure: ■ T o congure a particular instance, select the instance’ s cong node . For e xample, the default instance, server , select the server-config node. ■ T o congure the default settings for all instances , select the default-config node. Select the T ransaction Ser vice node . Enter the number of secon[...]

Restart the Enterprise Ser ver . ▼ T o set the ke ypoint interval Keypoint operations compress the transaction log le. The keypoint interval is the number of transactions between keypoint operations on the log. Keypoint operations can reduce the size of the transaction log les. A larger number of keypoint intervals (for example, 2048) resul[...]

C onguring the HT TP S er vice The HTTP service is the component of the Enterprise Server that provides facilities for deploying web applications and for making deployed web applications accessible by HTTP clients. These facilities are provided by means of two kinds of related objects, virtual servers and HTTP listeners. This chapter discusses t[...]

http://www.aaa.com:8080/web1 http://www.bbb.com:8080/web2 http://www.ccc.com:8080/web3 The rst URL is mapped to virtual host www.aaa.com , the second URL is mapped to virtual host www.bbb.com , and the third is mapped to virtual host www.ccc.com . On the other hand, the following URL results in a 404 return code, because web3 isn’ t registered[...]

However, if an HTTP listener uses the 0.0.0.0 IP address, which listens on all IP addresses on a port, you cannot create HTTP listeners for additional IP addresses that listen on the same port for a specic IP address. For example, if an HTTP listener uses 0.0.0.0:8080 (all IP addresses on port 8080), another HTTP listener cannot use 1.2.3.4:8080[...]

The Keep-Alive subsystem periodically polls such idle connections and queues those connections with activity into the connection queue for future processing. From there, a request processing thread again retrieves the connection and processes its request. The Keep-Alive subsystem is multi-threaded, as it manages potentially tens of thousands of con[...]

Managing W eb S er vices This chapter describes web services management with Enterprise Server. A dmin Console and the asadmin tool enable you deploy, test, and manage web services. You can quickly visualize, understand, monitor, and manage complex web services. You can see all web services deployed in a domain just as you see J ava EE applications[...]

simple, exible, text-based markup language. XML data is marked using tags enclosed in angled brackets. The tags contain the meaning of the data they mark. Such markup allows dierent systems to easily exchange data with each other. A Document Type Denition (DTD) or XML Schema Denition (XSD) describes the structure of an XML document. I t[...]

service endpoints, along with corresponding WSDL descriptions, and clients. A J AX-RPC based web service can interact with clients that are not based on J ava. Similarly, a J AX-RPC based client can interact with a non-J ava-based web service implementation. J ava API for XML registries (JAXR), a J ava API for accessing business registries, has a ?[...]

V iewing Deploy ed W eb Ser vices To test a web service with A dmin Console, select Applications > Web Services > web-service-name | General. Admin Console displays t the attributes of the web service: ■ N ame: the name of the web service. ■ Endpoint A ddress URI: the URI of the web service endpoint. ■ A pplication: Click on the link to[...]

Adding a Registry A dd or remove a web services registry with Admin Console at A pplication Server > Web Services | Registry. Use this page to create a Registry A ccess P oint (RAP). When you add a registry, specify the following paramters: ■ JNDI N ame: the connection resource pool ( JNDI) name of the registry. The JNDI N ame of this connecto[...]

T ransf orming Messages with XSL T Filters You can apply XSL T transformation rules to a web service end point. This enables ne-grained control of web service requests and responses. You can apply multiple XSL T rules to a web service end point method, and you can congure the order in which you apply the transformations. All the XSL T les [...]

■ OFF - Disables monitoring. Enter a value for the M essage History. The default is 25. Click the Reset button to clear all statistics and the running averages are restarted. V iewing W eb Ser vice Sta tistics Enterprise Server provides capabilities to track and graphically display the operational statistics of a web service. View monitoring stat[...]

160[...]

C onguring the Objec t Request Br oker This chapter describes how to congure the Object Request Broker (ORB) and II OP listeners. I t has the following sections: ■ “An Overview of the Object Request Broker” on page 161 ■ “Conguring the ORB” on page 162 ■ “Managing II OP Listeners” on page 162 An Over vie w of the Objec t [...]

What is the ORB? The Object Request Broker (ORB) is the central component of CORB A. The ORB provides the required infrastructure to identify and locate objects, handle connection management, deliver data, and request communication. A CORB A object never talks directly with another. Instead, the object makes requests through a remote stub to the OR[...]

Thr ead P ools The J ava Virtual Machine (JVM) can support many threads of execution at once. To help performance, the Enterprise Server maintains one or more thread pools. I t is possible to assign specic thread pools to connector modules and to the ORB . One thread pool can serve multiple connector modules and enterprise beans. Request threads[...]

W orking with Thread P ools To create a thread pool using the A dmin Console, go to C onguration > Thread P ools > Current P ools > New. ■ Enter the name of the thread pool in the Thread P ool ID eld. ■ Enter the minimum number of threads in the thread pool servicing requests in this queue in the Minimum Thread P ool Size eld.[...]

C onguring L ogging This chapter briey describes how to congure logging and view the server log. I t contains the following sections: ■ “A bout L ogging” on page 165 ■ “Conguring Logging” on page 168 About Logging ■ “Log Records” on page 165 ■ “The Logger Namespace H ierarchy” on page 166 Log Rec ords The Enterpr[...]

[#|2006-10-21T13:25:53.852-0400|INFO|sun-appserver9.1|javax.enterprise. system.core|_ThreadID=13;|CORE5004: Resource Deployed: [cr:jms/DurableConnectionFactory].|#] In this example, ■ [# and #] mark the beginning and end of the record. ■ The vertical bar ( | ) separates the record elds. ■ 2006-10-21T13:25:53.852-0400 species the date an[...]

T ABLE 17–1 Enterprise Server Logger Namespaces (Continued) Module Name Namespace Group Management Service (cluster and enterprise proles only) javax.ee.enterprise.system.gms JavaM ail javax.enterprise.resource.javamail J AXR javax.enterprise.resource.webservices.registry J AXRPC javax.enterprise.resource.webservices.rpc J AXWS javax.enterpris[...]

C onguring Logging This section contains the following topics: ■ “Conguring General L ogging Settings” on page 168 ■ “Conguring Log L evels” on page 168 ■ “Viewing Server Logs” on page 169 C onguring General Logging Settings To congure the general logging settings using the A dmin Console: ■ For the developer pro?[...]

V iewing Ser ver L ogs To view the log les: ■ In the developer prole, go to A pplications Server → Logging → View Log Files. ■ In the cluster and enterprise proles, go to Congurations → Conguration → Logger Settings → General, and click View Log Files. Use the options provided in the Search Criteria area to display log [...]

A window labeled Log Entry Detail appears, with a formatted version of the message. A t the end of the list of entries, click the buttons to view earlier or later entries in the log le. Click A dvanced Search in the Search Criteria area to make additional renements to the log viewer. Use the A dvanced Options elds as follows: ■ L ogger ?[...]

Monitoring C omponents and S er vices This chapter contains information about monitoring components using the Enterprise Server A dmin Console. This chapter contains the following sections: ■ “A bout Monitoring” on page 171 ■ “Enabling and Disabling M onitoring” on page 191 ■ “Viewing M onitoring Data” on page 193 ■ “Using JCo[...]

Overview of Monitoring To monitor the Enterprise Server, perform these steps: 1. Enable the monitoring of specic services and components using either the A dmin Console or the asadmin tool. For more information on this step, refer to “Enabling and Disabling M onitoring” on page 191 . 2. View monitoring data for the specied services or com[...]

EXAMPLE 18–1 Applications N ode Tree Structure applications |--- application1 | |--- ejb-module-1 | | |--- ejb1 * | | |--- cache (for entity/sfsb) * | | |--- pool (for slsb/mdb/entity) * | | |--- methods | | |---method1 * | | |---method2 * | | |--- stateful-session-store (for sfsb)* | | |--- timers (for s1sb/entity/mdb) * | |--- web-module-1 | | [...]

EXAMPLE 18–3 HTTP Service Schematic (Cluster and Enterprise Prole Version) http-service * |---connection-queue * |---dns * |---file-cache * |---keep-alive * |---virtual-server-1* | |--- request * |---virtual-server-2* | |--- request * The Resources T ree The resources node holds monitorable attributes for pools such as the JDBC connection pool[...]

EXAMPLE 18–6 JMS Service Schematic jms-service |-- connection-factories [AKA conn. pools in the RA world] | |-- connection-factory-1 (All CF stats for this CF) |-- work-management (All work mgmt stats for the MQ-RA) The ORB T ree The ORB node holds monitorable attributes for connection managers. The following schematic shows the top and child nod[...]

■ “Thread P ools Statistics” on page 186 ■ “Transaction Service Statistics” on page 186 ■ “J ava Virtual Machine (JVM) Statistics” on page 187 ■ “JVM Statistics in J ava SE” on page 187 E JB C ontainer Statistics The EJB container statistics are described in the following tables: ■ Table 18–1 ■ Table 18–2 ■ Table 1[...]

T ABLE 18–2 EJB Method Statistics Attribute Name Data T ype Description methodstatistic TimeStatistic N umber of times an operation is called; the total time that is spent during the invocation, and so on. totalnumerrors CountStatistic N umber of times the method execution resulted in an exception. This is collected for stateless and stateful ses[...]

T ABLE 18–3 EJB Session Store Statistics (Continued) Attribute Name Data T ype Description activationErrorCount CountStatistic Time (ms) spent executing the method for the last successful/unsuccessful attempt to execute the operation. This is collected for stateless and stateful session beans and entity beans, if monitoring is enabled on the EJB [...]

T ABLE 18–4 EJB P ool Statistics Attribute Name Data T ype Description numbeansinpool BoundedRangeStatistic N umber of EJB’ s in the associated pool, providing an idea about how the pool is changing. numthreadswaiting BoundedRangeStatistic N umber of threads waiting for free beans, giving an indication of possible congestion of requests. totalb[...]

T ABLE 18–5 EJB Cache Statistics (Continued) Attribute Name Data T ype Description numpassivationsuccess CountStatistic N umber of times passivation completed successfully. A pplies only to stateful session beans. The statistics available for Timers are listed in the following table. T ABLE 18–6 Timer Statistics Statistic Data T ype Description[...]

T ABLE 18–8 Web Container (Web Module) Statistics Statistic Data T ype Comments jspcount CountStatistic N umber of JSP pages that have been loaded in the web module. jspreloadcount CountStatistic N umber of JSP pages that have been reloaded in the web module. sessionstotal CountStatistic Total number of sessions that have been created for the web[...]

T ABLE 18–9 HTTP Service Statistics (Developer Prole) Statistic Units Data T ype Comments bytesreceived Bytes CountStatistic The cumulative value of the bytes received by each of the request processors. bytessent Bytes CountStatistic The cumulative value of the bytes sent by each of the request processors. currentthreadcount N umber CountStati[...]

The statistics available for the JDBC connection pool are shown in the following table. T ABLE 18–10 JDBC C onnection P ool Statistics Statistic Units Data T ype Description numconnfailedvalidation N umber CountStatistic The total number of connections in the connection pool that failed validation from the start time until the last sample time. n[...]

T ABLE 18–10 JDBC C onnection P ool Statistics (Continued) Statistic Units Data T ype Description numconnacquired N umber CountStatistic N umber of logical connections acquired from the pool. numconnreleased N umber CountStatistic N umber of logical connections released to the pool. JMS/Connector Ser vic e Statistics The statistics available for [...]

T ABLE 18–11 Connector C onnection P ool Statistics (Continued) Statistic Units Data T ype Description numconndestroyed N umber CountStatistic N umber of physical connections that were destroyed since the last reset. numconnacquired N umber CountStatistic N umber of logical connections acquired from the pool. numconnreleased N umber CountStatisti[...]

T ABLE 18–13 C onnection M anager (in an ORB) Statistics (Continued) Statistic Units Data T ype Description totalconnections N umber BoundedRangeStatistic Total number of connections to the ORB. Thread P ools Statistics The statistics available for the thread pool are shown in the following table. T ABLE 18–14 Thread P ool Statistics Statistic [...]

T ABLE 18–15 Transaction Service Statistics (Continued) Statistic Data Type Description committedcount CountStatistic Number of transactions that have been committed. rolledbackcount CountStatistic Number of transactions that have been rolled back. state StringStatistic Indicates whether or not the transaction has been frozen. Jav a Virtual Machi[...]

T ABLE 18–17 JVM Statistics for Java SE- Class Loading (Continued) Statistic Data T ype Description totalloadedclasscount CountStatistic Total number of classes that have been loaded since the JVM began execution. unloadedclasscount CountStatistic Number of classes that have been unloaded from the JVM since the JVM began execution. The statistics[...]

T ABLE 18–20 JVM Statistics for Java SE- M emory (Continued) Statistic Da ta T ype Description committedheapsize CountStatistic Amount of memory (in bytes) that is committed for the JVM to use. initnonheapsize CountStatistic Size of the non-heap area initially requested by the JVM. usednonheapsize CountStatistic Size of the non-heap area currentl[...]

T ABLE 18–22 JVM Statistics for Java SE - Runtime (Continued) Statistic Data T ype Description managementspecversion StringStatistic Management spec. version implemented by the JVM. classpath StringStatistic Classpath that is used by the system class loader to search for class les. librarypath StringStatistic Java library path. bootclasspath S[...]

T ABLE 18–23 JVM Statistics for Java SE - Thread Info (Continued) Statistic Data T ype Description lockownerid CountStatistic ID of the thread that holds the monitor lock of an object on which this thread is blocking. lockownername StringStatistic Name of the thread that holds the monitor lock of the object this thread is blocking on. stacktrace [...]

C onguring Monitoring Le vels Using the A dmin C onsole To congure monitoring in the A dmin Console: ■ For the developer prole, go to Conguration → M onitoring ■ For the cluster and enterprise proles, go to Congurations → Conguration → M onitoring By default, monitoring is turned o for all components and services. [...]

V iewing Monitoring Data ■ “Viewing M onitoring Data in the Admin Console” on page 193 ■ “Viewing M onitoring Data With the asadmin Tool” on page 193 V iewing Monitoring Data in the A dmin Console In the developer prole, to view monitoring data, go to A pplication Server → M onitor. In the cluster and enterprise proles, to view [...]

servlet , connection , connectorpool , endpoint , entitybean , messagedriven , statefulsession , statelesssession , httpservice ,o r webmodule . For example, to view data for jvm on server , enter the following: asadmin>monitor --type jvm --user adminuser server JVM Monitoring UpTime(ms) HeapSize(bytes) current min max low high count 327142979 0[...]

T o display monitoring statistics for an application c omponent or subsystem for which monitoring has been enabled, use the asadmin get command . To get the statistics, type the asadmin get command in a terminal window, specifying a name displayed by the list command in the preceding step. The following example attempts to get all attributes from a[...]

Another example, application , is a valid monitorable object type and is not a singleton. To address a non-singleton child node representing, for example, the application PetStore , the dotted name is: server.applications.petstore The dotted names can also address specic attributes in monitorable objects. For example, http-service has a monitora[...]

Examples for the list --user admin-user --monitor C ommand The list command provides information about the application components and subsystems currently being monitored for the specied server instance name. Using this command, you can see the monitorable components and subcomponents for a server instance. For a more complete listing of list ex[...]

When an attribute is requested that does not exist for a particular component or subsystem, an error is returned. Similarly, when a specic attribute is requested that is not active for a component or subsystem, an error is returned. Refer to “Expected Output for list and get Commands at All Levels” on page 202 for more information on the use[...]

Example 3 A ttempt to get a specic attribute from a subsystem: asadmin> get --user admin-user --monitor server.jvm.uptime-lastsampletime Returns: server.jvm.uptime-lastsampletime = 1093215374813 Example 4 A ttempt to get an unknown attribute from within a subsystem attribute: asadmin> get --user admin-user --monitor server.jvm.badname Retu[...]

server.http-service server.resources server.thread-pools The list of monitorable components includes thread-pools , http-service , resources , and all deployed (and enabled) applications . List the monitorable subcomponents in the PetStore applica tion ( -m can be used instead of --monitor ): asadmin> list -m server.applications.petstore Returns[...]

Returns: Nothing to list at server.applications.petstore.signon-ejb_jar. UserEJB.bean-methods.getUserName. To get the valid names beginning with a string, use the wildcard " * " character. For example, to list all names that begin with " server " , use " list server* " . There ar e no monitorable subcomponents f or met[...]

server.applications.petstore.signon-ejb_jar.UserEJB.bean-methods. getUserName.totalnumerrors-count = 0 server.applications.petstore.signon-ejb_jar.UserEJB.bean-methods. getUserName.totalnumerrors-description = Provides the total number of errors that occured during invocation or execution of an operation. server.applications.petstore.signon-ejb_jar[...]

T ABLE 18–25 Top L evel Command Dotted Name Output list -m server server.applicationsserver.thread-poolsserver. resourcesserver.http-serviceserver.transaction- serviceserver.orb.connection-managersserver.orb. connection-managers.orb.Connections.Inbound. AcceptedConnectionsserver.jvm list -m server.* Hierarchy of child nodes below this node. ge[...]

T ABLE 18–27 Applications - Enterprise A pplications and Standalone Modules Command Dotted Name Output list -m server.applications.app1 or *app1 Note: this level is only applicable if an enterprise application has been deployed. I t is not applicable if a standalone module is deployed. ejb-module1_jarweb-module2_warejb- module3_jarweb-module3_war[...]

T ABLE 18–27 Applications - Enterprise A pplications and Standalone M odules (Continued) Command Dotted Name Output list -m server.applications.app1. ejb-module1_jar.bean1 Note: I n standalone modules, the node containing the application name ( app1 in this example) will not appear. List of child nodes: bean-poolbean-cachebean-method list -m serv[...]

T ABLE 18–27 Applications - Enterprise A pplications and Standalone M odules (Continued) Command Dotted Name Output list -m server.applications.app1. ejb-module1_jar.bean1.bean-cache Note: I n standalone modules, the node containing the application name ( app1 in this example) will not appear. No attributes, but a message saying “Use get comman[...]

T ABLE 18–28 HTTP-Service Level Command Dotted Name Output list -m server.http-service List of virtual servers. get -m server.http-service.* N o output except message saying there are no attributes at this node. list -m server.http-service.server List of HTTP Listeners. get -m server.http-service.server.* N o output except message saying there ar[...]

T ABLE 18–30 Resources L evel Command Dotted Name Output list -m server.resources List of pool names. get -m server.resources.* No output except message saying there are no attributes at this node. list -m server.resources.jdbc-connection-pool-pool. connection-pool1 No attributes, but a message saying “Use get command with the --monitor option [...]

T ABLE 18–32 ORB Level (Continued) Command Dotted Name Output get -m server.orb.connection-managers.* No output except message saying there are no attributes at this node. list -m server.orb.connection-managers. orb.Connections.Inbound .AcceptedConnections No attributes, but a message saying “Use get command with the --monitor option to view[...]

To view all the MBeans, Enterprise Server provides a conguration of the Standard JMX Connector Server called System JMX C onnector Server. A s part of Enterprise Server startup, an instance of this JMX Connector Server is started. Any compliant JMX connector client can connect to the server using this Connector Server. J ava SE also provides too[...]

The security-enabled ag for the JMX Connector is false . If you are running the cluster or enterprise prole, or if you have turned on security for the JMX Connector in the developer prole, this ag is set to true . <!- – The JSR 160 " system-jmx-connector " –– > <jmx-connector accept-all= " false " addr[...]

In the Connect to Agent tab of JC onsole, enter user name , password, host name and port (8686, by default). The user name refers to the administration user name and password refers to the administration password of the domain. Click Connect. In the JConsole window you will see all your MBeans, VM information etc., in various tabs. ▼ C onnec ting[...]

Start JConsole by running JDK_HOME /bin/jconsole In the Connect to Agent tab of JC onsole, enter user name , password, host name and port (8686, by default). The user name refers to the administration user name and password refers to the administration password of the domain. Click Connect. In the JConsole window you will see all your MBeans, VM in[...]

214[...]

C onguring Management Rules This section contains information about setting administration policies to automate routine administration tasks, congure self-tuning of the application server for diverse runtime conditions and improve availability by preventing failures. This section also contains information on the self-management templates, whi[...]

notications and take appropriate action. For details on developing a custom MBean and deploying it, see Chapter 14, “Developing Custom MBeans, ” in Sun GlassFish E nterprise Server 2.1 Developer’ s Guide . The Enterprise Server provides some useful events, which you can further extend by writing custom MBeans to emit notications. E ach [...]

In addition, to enable a individual management rule, you must enable the rule on this page by clicking the box next to the rule and clicking Enable. A rule's MBeans must also be enabled on a target. To enable MB eans, go to Custom MBeans → MBean. On the Edit Custom MBean page, click the Target tab to access the Custom MBean Targets page, whe[...]

218[...]

Java Vir tual Machine and A dvanced S ettings The J ava Virtual Machine (JVM) is an interpretive computing engine responsible for running the byte codes in a compiled J ava program. The JVM translates the J ava byte codes into the native instructions of the host machine. The Enterprise Server, being a J ava process, requires a JVM in order to run a[...]

■ Debug Options: Specify the JPD A options passed to the JVM when the debugging is enabled. ■ RMI Compile Options: Enter the command-line options for the rmic compiler. The Enterprise Server runs the rmic compiler when EJB components are deployed. ■ Bytecode Preprocessor: Enter a comma separated list of class names. Each class must implement [...]

Aut omatically Restar ting a Domain or Node Agent If your domain or node agent is stopped unexpectedly (for example, if you need to restart your machine), you can congure your system to automatically restart the domain or node agent. This A ppendix contains the following topics: ■ “Restarting A utomatically on Solaris 10” on page 221 ■ ?[...]

To determine if a user has the net_privaddr privilege, log in as that user and type the command ppriv -l | grep net_privaddr . To run the asadmin create-service command, you must have solaris.smf.* authorization. See the useradd and usermod man pages to nd out how to set the authorizations. You must also have write permission in the directory tr[...]

Restar ting A utomatically U sing inittab on S olaris 9 and Linux Platf orms To restart your domain on the Solaris 9 or Linux platform, add a line of text to the /etc/inittab le. If you use /etc/rc.local, or your system’ s equivalent, place a line in /etc/rc.local that calls the desired asadmin command. For example, to restart domain1 for an E[...]

C:winntsystem32sc.exe create service-name binPath= " fully-qualied-path-to-appservService.exe " fully-qualied-path-to-asadmin.bat start-command " " fully-qualied-path-to-asadmin.bat stop-command "" start= auto DisplayName= " display-name " Note – There is no space between binpath and t[...]

Pre venting the Ser vice F rom Shutting Down When a User L ogs O ut By default, the J ava VM catches signals from Windows that indicate that the operating system is shutting down, or that a user is logging out, and shuts itself down cleanly. This behavior causes the Enterprise Server service to shut down when a user logs out of Windows. To prevent [...]

If the “interact with desktop” option is not set, the service stays in a “start-pending” state and appears to hang. Kill the service process to recover from this state. ■ On Windows or UNIX, create a domain using the --savemasterpassword=true option and create a password le to store the admin password. When starting the component, use [...]

Dotted Name A ttributes for domain.xml This appendix describes the dotted name attributes that can be used to address the MBean and its attributes. Every element in the domain.xml le has a corresponding MBean. Because the syntax for using these names involves separating names between periods, these names are called dotted names . This appendix c[...]

Element Name Dotted Name Prex clusters domain.clusters Every cluster contained in this element is accessible as cluster-name . Where cluster-name is the value of the name attribute for the cluster subelement. node-agents domain.node-agents lb-congs domain.lb-configs A pplicable only for Sun GlassFish Enterprise Server system-property domain.s[...]

Dotted Name Aliased to target .admin-service cong-name .admin-service target .web-container cong-name .web-container target .sip-container cong-name .sip-container A pplicable only for Sun GlassFish Communications Server target .ejb-container cong-name .ejb-container target .mdb-container cong-name .mdb-container target .jms-service [...]

230[...]

The asadmin Utilit y The A pplication Server includes a command-line administration utility known as asadmin . The asadmin utility is used to start and stop the A pplication Server, manage users, resources, and applications. This chapter contains the following sections: ■ “Common Options for Remote C ommands” on page 234 ■ “The M ultimode[...]

The asadmin Utility Use the asadmin utility to perform any administrative tasks for the A pplication Server. You can use this asadmin utility in place of using the A dministrator interface. The asadmin utility invokes subcommands that identify the operation or task you wish to perform. Subcommands are case-sensitive. Short option arguments have a s[...]

■ -s --secure if true, uses SSL/TLS to communicate with the domain application server. ■ -t --terse indicates that any output data must be very concise, typically avoiding human-friendly sentences and favoring well-formatted data for consumption by a script. Default is false. ■ -e --echo setting to true will echo the command line statement on[...]

To use the --secure option, you must use the set command to enable the security --enabled ag in the admin http-listener in the domain.xml . When you use the asadmin subcommands to create and/or delete, you must restart the server for the newly created command to take aect. Use the start-domain command to restart the server. To access the manp[...]

T ABLE C–1 Remote Commands Required Options (Continued) Option Denition --passwordfile The --passwordfile option species the name of a le containing the password entries in a specic format. The entry for the password must have the AS_ADMIN_ prex followed by the password name in uppercase letters. For example, to specify the domain [...]

invoke multimode from within a multimode session; once you exit the second multimode environment, you return to your original multimode environment. The Get, Set , and List C ommands The asadmin get , set and list commands work in tandem to provide a navigation mechanism for the A pplication Server's abstract hierarchy. There are two hierarchi[...]

■ The list command treats this complete dotted name as the complete name of a parent node in the abstract hierarchy. Upon providing this name to list command, it simply returns the names of the immediate children at that level. For example, list server.applications.web-module will list all the web modules deployed to the domain or the default ser[...]

T ABLE C–2 Server Lifecycle Commands (Continued) Command Denition start-domain Starts a domain. If the domain directory is not specied, the domain in the default install_dir /domains directory is started. If there are two or more domains, the domain_name operand must be specied. stop-domain Stops the Domain Administration Server of the s[...]

T ABLE C–3 List and Status C ommands (Continued) list-components Lists all deployed Java EE 5 components. I f the --type option is not specied, all components are listed. list-sub-components Lists EJBs or Servlets in a deployed module or in a module of the deployed application. If a module is not identied, all modules are listed. enable Ena[...]

V ersion Commands The version commands return the version string, display a list of all the asadmin commands, and allow you to install the license le. T ABLE C–5 Version C ommands Command Denition version Displays the version information. If the command cannot communicate with the administration server with the given user/password and host/[...]

Resourc e Management Commands The resource commands allow you to manage the various resources used in your application. T ABLE C–7 Resource Management Commands Command Denition create-jdbc-connection-pool Registers a new JDBC connection pool with the specied JDBC connection pool name. delete-jdbc-connection-pool Deletes a JDBC connection po[...]

T ABLE C–7 Resource Management Commands (Continued) Command Denition delete-custom-resource Removes a custom resource. list-custom-resources Lists the custom resources. create-connector-connection-pool Adds a new connector connection pool with the specied connection pool name. delete-connector-connection-pool Removes the connector connectio[...]

C ongura tion C ommands The conguration commands allow you to construct IIOP listeners, lifecycle modules, HTTP and IIOP listeners, prolers, and other subsystems. This section contains the following topics: ■ “HTTP and IIOP Listener Commands” on page 243 ■ “Lifecycle and A udit Module Commands” on page 243 ■ “Proler and [...]

T ABLE C–9 Lifecycle Module Commands Command Denition create-lifecycle-module Creates a lifecycle module. The lifecycle modules provide a means of running short or long duration Java-based tasks within the application server environment. delete-lifecycle-module Removes the specied lifecycle module. list-lifecycle-modules Lists the existing [...]

T ABLE C–11 JVM Options and Virtual Server Commands Command Denition create-jvm-option Creates JVM options in the Java conguration or proler elements of the domain.xml le. If JVM options are created for a proler, they are used to record the settings needed to get a particular proler going. You must restart the server for newly c[...]

T ABLE C–13 Transaction C ommands Command Denition freeze-transaction Freezes the transaction subsystem during which time all the inight transactions are suspended. Invoke this command before rolling back any inight transactions. Invoking this command on an already frozen transaction subsystem has no eect. unfreeze-transaction Resumes[...]

T ABLE C–15 User Management Commands (Continued) Command Denition update-file-user Updates an existing entry in the keyle using the specied user_name , user_password and groups. M ultiple groups can be entered by separating them, with a colon ( : ). list-file-users Creates a list of le users supported by le realm authentication. li[...]

T ABLE C–17 D atabase Commands Command Denition start-database Starts the Java D B server that is available with the Application Server. Use this command only for working with applications deployed to the A pplication Server. stop-database Stops a process of the Java DB server. J ava DB server is available with the A pplication Server. Diagnos[...]

T ABLE C–19 Web Service Commands (Continued) Command Denition delete-transformation-rule Deletes an XSL T transformation rule of a given web service. list-transformation-rules Lists all the transformation rules of a given web service in the order they are applied. publish-to-registry Publishes the web service artifacts to registries. unpublish[...]

T ABLE C–20 Security Commands (Continued) Command Denition delete-message-security-provide Enables administrators to delete a provider-config sub-element for the given message layer ( message-security-config element of domain.xml , the le that species parameters and properties to the A pplication Server). list-message-security-providers [...]

V erify Command The XML verier command veries the content of the domain.xml le. T ABLE C–22 Verify C ommand Command Denition verify-domain-xml Veries the content of the domain.xml le. Cust om MBean Commands The MBean commands allow you to manage and register custom MB eans. The commands are supported in remote mode only. T ABLE [...]

Pr oper ty C ommand Shared server instances will often need to override attributes dened in their referenced conguration. Any conguration attribute in a server instance can be overridden through a system property of the corresponding name. Use the system property commands to manage these shared server instances. T ABLE C–25 Property C om[...]

Index A AC C See containers application client, 93 acceptor threads, in HTTP listeners, 151 A dmin Console, 24 applets, 93 asadmin utility, 25 B bean-cache, monitoring attribute names, 179-180 Binding Components, overview, 40 C cache-hits, 179 cache-misses, 179 CloudScape Type 4 JDBC driver, 61 connection factories, JMS, overview, 63-64 connector c[...]

external repositories, accessing, 79 F Foreign P roviders, JMS, 67-74 G get command, monitoring data, 197 H high availability, 28 HTTP listeners acceptor threads, 151 default virtual server, 151 overview, 150-152 HTTP service HTTP listeners, 150-152 Keep-Alive subsystem, 152 request processing threads, 151 virtual servers, 149-150 I IBM DB2 JDBC dr[...]

logging (Continued) viewing the server log, 169-170 M man pages, 25 monitoring bean-cache attributes, 179-180 container subsystems, 172-173 ORB service, 185-186 transaction service, 186-187 using get command, 197 using list command, 197 MSSQL Inet JD B C driver, 58-59 MSSQL/SQL Server2000 Data Direct JDBC driver, 55 M ySQL Type 4 JDBC driver, non-X[...]

T thread pools, 163 performance, 163 thread starvation, 163 threads, See thread pools, 163 topics, JMS, 63-64 total-beans-created, 179 totalbeansdestroyed, 179 totalnumerrors, 177 totalnumsuccess, 177 Transaction Manager See transactions managers, 144 transaction service, monitoring, 186-187 transactions, 143 associating, 144 attributes, 144 commit[...]