Administering Apache Geronimo 2.x

1
Administering Apache Geronimo 2.x

• Vamsavardhana Reddy Chillakuru a.k.a. Vamsi
• vamsic007_at_apache.org
• vamsic007_at_in.ibm.com

2
Who am I?

• Committer and Member of Apache Geronimo PMC
• Involved with ASF since 2005
• Over 11 years experience in software development
• Advisory Software Engineer at IBM
• Employed with IBM India since 1996

3
Geronimo in the making ?
Thats my son Susanth helping me with Geronimo ?
4
Agenda

• Introduction to Geronimo
• Securing Geronimo
• Administration Tasks
• Multiple Server Instances
• Summary
• Q A

5
Agenda

• Introduction to Geronimo
• Securing Geronimo
• Administration Tasks
• Multiple Server Instances
• Summary
• Q A

6
Introduction to Geronimo

• J2EE/Java EE Application Server from Apache
  Software Foundation
• Brings together the best-of-breed technologies
  from open source to support J2EE/Java EE
• Small foot print/Highly customizable
• Ease of use is foremost guiding principle
• V2.1 Java EE 5 Certified Feb/2008

7
Geronimo History and Progress

• Apache Geronimo Project formed

• V1.0-M5 released, J2EE 1.4 certification

• V2.2 Release

• V1.0 Released

• V1.1 Released

• V2.1 Released

• V2.0-M6 released, Java EE 5 certification

• V1.1.1 Released

• V2.0.1 Released

• V2.0.2 Released

August2003
Oct2005
Jan2006
June2006
Sep 2006
Jun 2007
Aug 2007
Oct 2007
Feb 2008
In Plan
8
Geronimo Architecture

• GBeans are the building blocks
• E.g. Containers, Connectors, Servlets
• Geronimo Kernel
• A container for GBeans
• Based on Inversion-of-Control/Dependency
  Injection
• Provides Life Cycle management for GBeans
• Loosely coupled system
• Start/stop/remove components on the fly
• Integrate new components on the fly
• Plugins
• Directory Server, Roller and many other

9
Geronimo Architecture
Ref http//www.ibm.com/developerworks/library/os
-ag-deploy/
10
What it contains?

• Apache Tomcat
• Jetty (Mort Bay)
• Apache Derby
• Apache OpenEJB
• Apache ActiveMQ
• Apache OpenJPA
• Apache Axis
• Apache Axis2
• Apache CXF
• Apache Yoko

• Apache Commons
• Apache jUDDI
• Apache Log4J
• HOWL
• TRANQL
• Castor
• WADI
• CGLIB
• And many more

11
Whats new in 2.1?

• Servers assembled out of plugins
• Custom server assemblies
• Assemble a server feature
• Flexible admin console
• Monitoring Console
• GShell
• WADI Clustering Support for Tomcat

12
How to get involved?

• Geronimo project web site
• http//geronimo.apache.org/
• Mailing lists
• user_at_geronimo.apache.org
• dev_at_geronimo.apache.org
• Wiki
• http//cwiki.apache.org/geronimo/

13
Geronimo Installation

• http//geronimo.apache.org/downloads.html
• Geronimo Tomcat or Geronimo Jetty distributions
• Extract the archive to any directory
• On windows, use a short directory name (for e.g.
  C\ or C\g) to avoid long-path problems.

14
Geronimo Startup/Shutdown

• Requires Sun J2SE 5.0 JDK/JRE
• Environment variables
• JAVA_HOME/JRE_HOME
• GERONIMO_OPTS
• JAVA_OPTS
• Run the server
• ltg_homegt/bin/geronimo start
• ltg_homegt/bin/geronimo jpda run
• Stop the server
• ControlC in server console
• ltg_homegt/bin/shutdown

15
(No Transcript)
16
Administration Console

• Web-based, Convenient, user-friendly
• Based on Apache Pluto (JSR-168)
• Access at http//localhost8080/console
• Portlets for administration
• Web Server, JMS Server, JMS Resources, DB
  Manager, Database Pools
• Application portlets Deploy New, Web App WARs,
  Plan Creator etc..
• Security Realms, Keystores
• Portlets for monitoring server status
• Information, Java System Info, Server Logs,
  Monitoring, etc.
• Dont forget the Help view in the portlets

17
(No Transcript)
18
Agenda

• Introduction to Geronimo
• Geronimo Console
• Securing Geronimo
• Administration Tasks
• Multiple Server Instances
• Dos Donts
• Q A

19
Geronimo directory structure

• -bin
• -deploy
• -etc
• -lib
• -repository
• -schema
• -var
• -config
• -derby
• -security
• -shared

• -i1instance-name
• -deploy
• -var
• -config
• -derby
• -security
• -keystores
• -shared
• -classes
• -lib

20
Important configuration files

• Located in ltg_homegt/var/config
• config.xml
• Overridden GBean attributes
• New GBeans and configurations
• config-substitutions.properties
• Properties used in confg.xml
• artifact_aliases.properties
• Substitute one artifact for another

21
Replace Default Realm

• Default security realm - geronimo-admin
• Used by JMX server, Admin Console,
  Online-deployer, MEJB application
• Change default credentials
• Edit var/security/users.properties
• Users and Groups portlet
• Replace default realm
• Deploy desired realm with name geronimo-admin
• Database or LDAP Realm recommended for production
• Delete the realm gbean in server-security-config

22
Protecting passwords

• Pluggable Encryption Mechanism

ltgbean name"org.apache.geronimo.configs/rmi-namin
g/2.1/car?nameConfiguredEncryption,j2eeTypeGBea
n" gbeanInfo"o.a.g.system.util.ConfiguredEncrypti
on"gt ltattribute name"path"gt
var/security/ConfiguredSecretKey.ser
lt/attributegt ltreference name"ServerInfo"gt
ltpatterngtltnamegtServerInfolt/namegtlt/patterngt
lt/referencegtlt/gbeangt
23
Securing Derby

• ltg_homegt/var/derby/derby.properties

derby.connection.requireAuthenticationtrue derby.
authentication.providerBUILTIN derby.user.userNam
e1password1 derby.user.userName2password2

• Other authentication methods
• LDAP, application-defined
• o.a.d.authentication.UserAuthenticator
• Users at database level too
• http//db.apache.org/derby/binaries/jta-WE15.pdf

24
Update database pools

• Update credentials used by database pools
• Using Admin Console
• Update before enabling Derby security. Otherwise
  Geronimo server will not start.
• By editing config.xml (xml shown next)
• Database pools to update
• MonitoringClientDS
• NoTxDatasource
• SystemDatasource
• jdbc/ActiveDS
• jdbc/ArchiveDS
• jdbc/juddiDB
• Any other database pools that use Embedded Derby

25
Update DB pools - config.xml

• ltmodule name"org.apache.geronimo.configs/system-d
  atabase/2.1/car"gt
• ltgbean name"o.a.g.c/system- database/2.1/car?..
  .,nameSystemDatasource"gt
• ltattribute name"UserName"gtuserName1lt/attribut
  egt
• ltattribute name"Password"gtpassword1lt/attribut
  egt
• lt/gbeangt
• ltgbean name"o.a.g.c/system-database/2.1/car?...,
  nameNoTxDatasource"gt
• ltattribute name"UserName"gtuserName1lt/attribut
  egt
• ltattribute name"Password"gtpassword1lt/attribut
  egt
• lt/gbeangt
• lt/modulegt

26
Agenda

• Introduction to Geronimo
• Securing Geronimo
• Administration Tasks
• Multiple Server Instances
• Summary
• Q A

27
A typical scenario

• Setup the web server
• Create user database and DB Pools
• Create Security Realms
• Create JMS Factories and Queues
• Deploy Applications
• Manage Applications
• Server Logs
• Monitoring

28
Administering Tomcat

• WebServers portlet for connectors
• Connector protocol HTTP, HTTPS, AJP
• BIO/NIO/APR
• add/delete/edit/stop/start/restart
• Configuring HTTPS
• Server Authentication only
• ClientAuth

29
Virtual hosts

• Add HostGBeans to Tomcat config
• Specify virtual host in deployment plan
• ltcontainer-configgt
• lttomcatgt
• lthostgtvirtualhost1.comlt/hostgt
• lt/tomcatgt
• lt/container-configgt

30
Single Sign-On

• Login to one application maintains login across
  all applications on the server
• Create a SingleSignOn valve and connect to the
  valve chain
• Edit config.xml

31
Managing Keystores

• Add keystores
• Lock/unlock keystores
• Create/delete private keys
• Change keystore/key passwords
• Add/delete trust certificates
• Manage private keys/certificates
• Support for all keystore types in v2.1

32
Administering Derby

• DB Info portlet
• DB Manager portlet
• Create/delete databases
• View tables, table content
• Run SQL
• Derby Log Viewer portlet

33
Database Pools

• Database pools portlet
• Create/edit database pool
• J2EE Connectors portlet
• Stop/start/delete connector configurations

34
Security Realms

• Add security realms
• Properties File Realm
• Database (SQL) Realm
• LDAP Realm
• Custom Realm
• Edit security realms
• Configure Auditing, Lockout

35
Administering ActiveMQ

• JMS Server portlet
• Add/delete/start/stop connectors
• Stopped connectors started at next run
• JMS Resources portlet
• Add connection factories, queues, topics for
  ActiveMQ or any other JMS provider
• J2EE Connectors portlet
• Stop/start/delete connector configs

36
Deploy Applications

• Command Line Deployer
• bin\deploy
• Offline deployment bin\deploy -o
• inPlace deployment
• Deploy to different target stores
• Start/stop/restart/deploy/undeploy
• Deploy New portlet
• Deploy and redeploy operations only

37
Deploy Applications (contd.)

• Hot deployer
• Copy to ltg_homegt/deploy directory
• Plan should be part of archive
• Plan Creator
• Lets you create a deployment plan in a series of
  steps.
• Web Apps only as of v2.1
• EJB, EAR etc under development

38
Manage Applications

• System Modules portlet
• Web App WARs portlet
• EJB Jars portlet
• Application EARs portlet
• App Clients
• J2EE Connectors

39
Logging

• var/log/server-log4j.properties
• org.apache.geronimo.log.ConsoleLogLevel system
  property to change console log level
• org.apache.geronimo.log4jservice.configuration to
  change the default config file
• ServerLogs portlet
• Update config file temporarily

40
Web Access logs

• Server LogsWeb Access Log Viewer
• Log rotation rotated daily
• NOTE Logs not deleted by Geronimo
• Changing log configuration

ltgbean name"AccessLogValve"gt ltattribute
name"initParams"gtprefixServerHostname_access_
log. suffix.txt patterncommon
fileDateFormatyyyy-MMlt/attributegt lt/gbeangt
41
Monitoring

• Servers - Local and remote servers
• EJB and JMX protocols
• Graphs
• Select MBean and statistic
• Based on two statistics from the MBean
• Views
• Compose multiple graphs into views

42
Debug Views

• JMX Viewer
• LDAP Viewer
• ClassLoader Viewer
• JNDI Viewer
• Dependency Viewer

43
Plugins

• Plugins portlet
• Add plugin repositories
• Search for plugins
• Install plugins
• Export config as plugin
• Assemble a server
• Command Line Deployer
• Search-plugins

44
Agenda

• Introduction to Geronimo
• Securing Geronimo
• Administration Tasks
• Multiple Server Instances
• Summary
• Q A

45
Running multiple instances

• Shared directories
• bin, lib, repository
• Instance home ltinst_homegt directory
• Create ltg_homegt/ltinst_namegt dir
• Copy ltg_homegt/var to ltinst_homegt/var
• Change PortOffset to resolve port conflicts
• ltinst_homegt/var/config/config-substitutions.proper
  ties
• Set org.apache.geronimo.server.name system
  property.
• Use GERONIMO_OPTS

46
Geronimo directory structure

• -bin
• -deploy
• -etc
• -lib
• -repository
• -schema
• -var
• -config
• -derby
• -security
• -shared

• -i1instance-name
• -deploy
• -var
• -config
• -derby
• -security
• -keystores
• -shared
• -classes
• -lib

47
Deploying to an instance

• Offline Deployment
• org.apache.geronimo.server.name property with
  GERONIMO_OPTS
• Online deployment
• Host and port deployer options
• Deploy New portlet
• Deploy to specific target config stores
• target deployer option
• bin/deploy list-targets

48
Individual Repositories

• Maven2Repository GBean
• RepositoryConfigurationStore GBean
• Deploy to the specific instance
• Use target option to deploy to the new store.

49
New Repository plan.xml

• lt!--Repository--gt
• ltgbean name"newRepo" class"org.apache.geronimo.s
  ystem.repository.Maven2Repository"gt
• ltattribute name"resolveToServer"gttruelt/attribut
  egt
• ltreference name"ServerInfo"gt
• ltnamegtServerInfolt/namegt
• lt/referencegt
• lt/gbeangt
• lt!--Configuration Store service--gt
• ltgbean name"Local2" class"org.apache.geronimo.sy
  stem.configuration. RepositoryConfigurationStore"gt
  
• ltreference name"Repository"gtltnamegtnewRepolt/name
  gt lt/referencegt
• lt/gbeangt

50
Agenda

• Introduction to Geronimo
• Securing Geronimo
• Administration Tasks
• Multiple Server Instances
• Summary
• Q A

51
Summary

• Introduction to Geronimo
• Replace default-realm
• Protect passwords
• Enable Derby security
• Secure default keystore
• Administration Console for most tasks
• config.xml to add new GBeans
• Running multiple server instances

52
Dos

• Secure ltg_homegt
• Use Database/LDAP realm
• Use digested passwords
• Use schema names with table names
• E.g. AUTH.USERTABLE
• Use config-substitutions.properties for attribute
  values in config.xml

53
Donts

• Do not enable logging to console when running in
  background in Linux
• Do not direct console output to file
• Do not use passwords in the command line with
• bin\deploy
• bin\shutdown

54
Agenda

• Introduction to Geronimo
• Securing Geronimo
• Administration Tasks
• Multiple Server Instances
• Summary
• Q A

55
Administering Apache Geronimo 2.x

• Q A
• Question/Comments?
• Vamsi
• vamsic007_at_apache.org
• vamsic007_at_in.ibm.com

56
Resources

• http//geronimo.apache.org
• http//cwiki.apache.org/geronimo/
• Geronimo Mailing lists
• user_at_geronimo.apache.org
• dev_at_geronimo.apache.org
• IBM developerWorks
• http//www.ibm.com/developerworks/opensource/top-p
  rojects/geronimo.html

57

• Thank you