| Installing on GlassFish Server | ||
|---|---|---|
| Previous | ||
| Installing on Oracle WebLogic Server | ||
Installation on GlassFish Server has the following tasks:
Run a normal installation of GlassFish.
Configure a domain containing
To run iKnowBase under GlassFish, you need to add the required jdbc driver, a connection pool and a data source:
First, install the Oracle JDBC Driver:
${GLASSFISH_HOME}/glassfish/lib/ or
${GLASSFISH_HOME}/glassfish/domain/domain1/lib/
Next, create a connection pool:
Finally ,create a data source:
The availability service for the cluster and web container must be enabled (enabled by default).
Single-sign-on-state for web container availability should also be enabled to support replicating the authenticated user.
ikbInstant requires that support for Comet and/or Websockets is enabled on the HTTP listener.
For each of the application archives, deploy using the GlassFish console:
The easiest mechanims is to deploy the iknowbase-resources-VERSION.war file, which will automatically expose the resources.
If you want to have the /ressurs-directory (or other directories) available from the file system, unzip them to a directory and configure a reverse proxy in front of GlassFish to server this content for requests starting with “/ressurs”. As a standard deployment of ikbViewer and ikbWebdav will use context root /, the GlassFish docroot cannot be used.
iKnowBase is a Java Enterprise Edition web application, and uses the security contracts defined in the JEE specification. In particular, the following must be true:
GlassFish supports pluggable security providers, and the configuration of them is outside the scope of the iKnowBase product. However, as long as they support the requirements above, you may use any GlassFish security provider.
GlassFish supports a global setting that makes groups the equivalent of roles. Then, the security provider needs only to provide the groups (IKB_USERS et al), and not worry about mapping groups into roles. This is called “Default principal to role mapping”, and is configured as shown below. Note that this particular feature must be enabled before deploying applications; otherwise, you need to redeploy the applications.
Out of the box, GlassFish is configured with a file-based security provider. To use this with iKnowBase, use the following configuration below. Note that this configuration must be set before deploying applications.
It is supposed to be possible to configure LDAP-based security with GlassFish, for integration with directory servers such as Oracle Internet Directory and others. Read the GlassFish documentation for more details. Also, tips may be found on various blogs, such as http://weblogs.java.net/blog/tchangu/archive/2007/01/ldap_security_r.html. Note that this particular blog does in fact perform group-to-role mapping, which is not required if you choose to enable “Default principal to role mapping”.
It is supposed to be possible to configure GlassFish with single sign-on from active Directory. Use the plugin available at https://spnego.dev.java.net/.
Spnego is an SPNEGO and Kerberos plugin for Glassfish. SPNEGO stands for Simple and Protected GSSAPI Negotiation Mechanism. SPNEGO is a standard GSSAPI pseudo-mechanism for peers to determine which GSSAPI mechanisms are shared, select one and then establish a security context with it. Kerberos is a computer network authentication protocol, which allows individuals communicating over an insecure network to prove their identity to one another in a secure manner
We strongly recommend using SSL (https) for all production sites.
The procedures for terminating SSL directy in the application server can be found in the glassfish documentation.
If you terminate SSL in an external proxy, that proxy will typically use HTTP (an unsecured connection) to talk to the application server. Then, the application server will not be aware that the browser sees a secure connection, and will by default generate links to an unsecure site. To avoid this, note the following items:
If using Apache httpd for ssl-termination, the following configuration in httpd.conf should set the required header:
<Virtualhost ...>
...
RequestHeader set X-Forwarded-Proto "https"
...
</Virtualhost>
Use the following example from the glassfish domain.xml:
<network-config>
<protocols>
<protocol name="http-listener-1">
<http default-virtual-server="server" max-connections="250" scheme-mapping="X-Forwarded-Proto">
...
NOTE GlassFish 4: GlassFish 4 (build 89) does not support scheme-mapping=“X-Forwarded-Proto”, as reported in https://java.net/jira/browse/GLASSFISH-20842.
If you have changed the passwords on GlassFish’s java truststore (cacerts.jks) and keystore (keystore.jks) during the setup and plan to deploy the iKnowBase Batch Server, the passwords for accessing the keystores must be set using JVM options
-Djavax.net.ssl.keyStorePassword=<your_new_password>
-Djavax.net.ssl.trustStorePassword=<your_new_password>
The Batch Server will fail to start (
SSLInitializationException: Failure initializing default system SSL context) if the passwords are not set.
The following log statements in server.log is related to activiti enabled applications
The issue can occur while reloading / redeploying one of the activiti enabled applications (viewer, batch or activitiexplorer). The activiti job executor thread is busy looking for asynchronous tasks and might not shut down within the time used for reloading or redeploying the application.
This error results in a non-functioning activiti job executor and asynchronous tasks will not be loaded by this application.
To resolve the issue, restart the application server.
Issue reference: IKBR-1124
GlassFish 4 (build 89) does not support scheme-mapping=“X-Forwarded-Proto”, as reported in https://java.net/jira/browse/GLASSFISH-20842, and iKnowBase will not operate correctly behind an SSL terminating reverse proxy until this issue is resolved.
Available workarounds are
We strongly recommend using SSL and GlassFish 4 (build 89) is not recommended for production unless the issue is resolved or a suitable workaround is applied.
Session replication and failover does not work properly in GlassFish 4 (build 89). The release notes states:
Note:
The main thrust of the GlassFish Server Open Source Edition 4.0 release is to provide an application server for developers to explore and begin exploiting the new and updated technologies in the Java EE 7 platform. Thus, the follow ing features of GlassFish Server were not a focus of this release:
* Clusters and standalone instances
* High availability features
* Upgrade
* Embedded Server
These features are included in the release, but they may not function properly with some of the new features added in support of the Java EE 7 platform.
| Previous | Top | |
| Installing on Oracle WebLogic Server |