Java / Oracle SOA blog

JSF 2.0 Managed Bean Annotations and CDI on WebLogic 12c

2012-01-01T18:18:00.000+01:00

WebLogic 12c now supports Java 6 so we can now try out the JSF 2.0 Managed Bean annotations together with CDI JSR-299. In this blogpost I will use OEPE 12c as my IDE and deploy everything on WebLogic 12c. Off course I will tell you my experiences to get all this working in Eclipse and WebLogic 12c.

First let's start with the JSF 2.0 Managed Bean Annotations.

We need to remove the managed bean definitions from the faces-config.xml file. Then make sure that you don't use the metadata-complete attribute ( metadata-complete="true" ) on the faces-config element, this will disable the search for JSF Managed Beans.

Then we can add the JSF Managed Bean annotations to the java class. We can use @ManagedBean ( javax.faces.bean ) together with the right scope annotation like RequestScoped, SessionScoped or ViewScoped ( CDI does not have this View Scope ). You will see this bean in the Faces Configuration View.

Next part of this blog is about CDI, this will be more tricky, it is possible but does not work so well in OEPE and WebLogic. I didn't have these problems with the same OEPE, Code and using Glassfish 3.11.

So to enable CDI we need to add a beans.xml file to the WEB-INF folder. Like this with a empty beans element, this will trigger CDI.

When we try to run the JSF application again then you probably will hit this NPE in the jboss Weld framework.

<javax.enterprise.resource.webcontainer.jsf.renderkit> <BEA-000000> <javax.faces.FacesException
javax.faces.FacesException
at com.sun.faces.context.ExceptionHandlerImpl.handle(ExceptionHandlerImpl.java:142)
at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:119)
at com.sun.faces.lifecycle.LifecycleImpl.render(LifecycleImpl.java:139)
at org.apache.myfaces.extensions.validator.core.startup.ExtValLifecycleWrapper.render(ExtValLifecycleWrapper.java:79)
at javax.faces.webapp.FacesServlet.service(FacesServlet.java:594)
Truncated. see log file for complete stacktrace
Caused By: java.lang.NullPointerException
at org.jboss.weld.el.ELCreationalContextStack.getCreationalContextStore(ELCreationalContextStack.java:33)
at org.jboss.weld.el.WeldValueExpression.getValue(WeldValueExpression.java:47)

The solution is to remove the JSP entries and rename your files from jspx to xhtml.

From this.

<?xml version="1.0" encoding="iso-8859-1"?>

<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.0"

xmlns:f="http://java.sun.com/jsf/core"

xmlns:h="http://java.sun.com/jsf/html"

xmlns:trh="http://myfaces.apache.org/trinidad/html"

xmlns:tr="http://myfaces.apache.org/trinidad">

<jsp:directive.page contentType="text/html;charset=utf-8"/>

<f:view>

<tr:document title="Bean and ExtVal validation">

<tr:form>

To this, where we define the used jsf namespaces on the html element.

Next we can try to create a new managed bean where we will use the Named annotation together with the SessionScoped annotation of javax.enterprise.context

We can also inject an EJB or a Managed Bean with the Inject annotation.

I can also replace @EJB with @Inject but then I should move my EJBs to my Dynamic Web Project else I will get an Weld error. Probably with OEPE you have an different JPA project and this ejb.jar will be deployed together with the WAR in an EAR.

I didn't test this but you need to enable CDI on this ejb project or EAR.

That's not all you also need to change the WebLogic Publishing mode of OEPE. This should be Publish as an exploded archive else Inject won't work. ( Thanks to Steve Button for the tip. ).

This is the error I got WELD-001408 Unsatisfied dependencies for type [DataBeanCDI] with qualifiers [@Default] at injection point [[field] @Inject private nl.amis.web.beans.DataBean.dataBeanCDI]

And now the most annoying bug, the CDI managed beans will work only once on WebLogic 12c. When you deploy or run your application the second time then the CDI Managed bean can't be found. The solution is you need to restart the WebLogic Server. This makes development with CDI almost impossible.

In Glassfish 3.11 I didn't have all these problems so I hope Oracle will update OEPE & WebLogic 12c very soon.

Here you can find my example code.

https://github.com/biemond/OEPE_examples/tree/master/cdi_jsf2_managedbeans

Using Bean Validation together with ExtVal in JPA and JSF

2011-12-27T21:23:00.003+01:00

With the release of WebLogic 12c we can finally try out the native support for Bean Validation ( JSR-303) in JPA & JSF. With JSR-303 we can use this validation framework on the back-end side ( EJB Session Bean ) and on the managed bean of the JSF Web applications, so one framework which can do it all. It will save us a lot of time in making business rules and no need for validators on our JSF UI Components.
To make this even better I will combine this with Apache MyFaces Extensions Validator. This framework can be used with JSF ( there is a generic library and a special one for Trinidad ) and its supports the Bean Validation. ExtVal also has some extra features.

Type-safe group validation
Model validation
Severity aware validation
Client-side validation
Sorted violation messages
Dependency injection support for constraint validators
Mapped constraint source (e.g. for using DTO's with BV)
Support of @Valid

In this blog I won't give you all the possible validations options you can have in the Bean Validation or in ExtVal framework but I will try to give you a jumpstart, how to setup this up and get everything working.

Before I start I got this working with WebLogic 12c and use OEPE 12c as my IDE. For the JSF part I use Apache MyFaces Trinidad 2.0.0 which support JSF 2.0.

Let's start with the JPA part.

Here I have created a department entity which is based on the department table of the HR demo schema in the Oracle database.

On the departmentName attribute I added some validation annotations like NotNull , Size and Pattern.

On the Pattern annotation I added a custom resource bundle message ( use {} ), I only do it for pattern annotation because Size or NotNull will have it's own default message in JSF.

Bean validation is the default now so we would see the Eclipselink error anymore. So when we try to persist an entity which violates these annotations we get an error like this.

With a javax.validation.ConstraintViolationException on a prePersist callback event. This error won't give you a lot of information about the error.

You got the option to disable the Bean Validation in Eclipselink by setting the validation-mode to NONE. This way you will get the constraint error.

Like this.

So how we can retrieve these validations errors. For example I can do this on the client side before I invoke the EJB Session bean or do it inside the Session Facade methods.

We need to use the resource annotation to retrieve the Validator.
(@Resource Validator validator; )
In the department persist we can pass on the department entity to the validatior.
Set<ConstraintViolation<Department>> violations = validator.validate(department);
And loop through the violations with this as result.

error size: 2
invalid value for: 'departmentName': Name must between 2 and 30 characters
invalid value for: 'departmentName': {departmentNameValidation}

Now we can go the JSF part.
Here I do the same but then from a managed bean which is called from a commandButton.

I changed the violations to Faces Messages and skip the persist part.

This is all standard Bean Validation stuff so let's check out the ExtVal part.

I added the following libraries to the lib folder of the WEB-INF

The jsr303-tck and the validation-api jars are from Hibernate Validator and the rest is from MyFaces ExtVal. Where I remove the myfaces-extval-generic-support-2.0.5.jar because I could use the trinidad one.

To test the validation I made a simple JSF Trinidad page where you can see there are no validator or convertors defined.

In the Trinidad table I show all the departments and change for example the department Name to 1 char which violates the Size annotation.

When I use invalid characters for the department Name then I get the resource bundle message.

To make this resourcebundle work I need to set a context parameter in the web.xml which points to our own resourcebundle.

<context-param>
<param-name>org.apache.myfaces.extensions.validator.CUSTOM_MESSAGE_BUNDLE</param-name>
<param-value>resources.application</param-value>
</context-param>

The last part is to show you the ExtVal part. I used this managed bean which are used in the JSF page.

departmentName use the Bean Validation framework and departmentLocation use the ExtVal framework.
With this as result.

When you want to know more about ExtVal or Bean Validation you definitely should read this example chapter of Bart Kummel's Book about MyFaces Development.

Here is the example project on github. https://github.com/biemond/OEPE_examples/tree/master/beanValidation

WebLogic SCA with WebLogic 12c and OEPE 12.1

2011-12-18T16:36:00.001+01:00

Fusion Middleware Software like OSB or SOA Suite is not yet available on WebLogic 12c but this does not mean you can't develop SCA Applications. With the help of the Oracle Enterprise for Eclipse 12.1.1 ( OEPE ) we can build WebLogic SCA application and deploy it on WebLogic 12c. This allows you to write Java applications using POJOs and, through different protocols, expose components as SCA services and access other components via references. You do this using SCA semantics configured in a Spring application context. In SCA terms, a WebLogic Spring SCA application is a collection of POJOs plus a Spring SCA context file that wires the classes together with SCA services and references.

In this blogpost I will show you all the steps so you can try it yourself.

Before we start, we need to install WebLogic 12c, configure a new domain and startup the AdminServer.
The first step is to install the WebLogic SCA shared library and target it to the AdminServer.

Log in to the WebLogic Console and go to deployments windows.
Install this war located at wlserver_12. 1\common\deployable-libraries\weblogic-sca-1.1.war as a shared library and target it to the AdminServer.

Next step is to download OEPE 12.1.1, extract it and create a new workspace.

In this workspace we need to create a new Dynamic Web Project.
Use wls 12 as Target runtime and also create an Ear project which will include the war.

Open the project options of your Dynamic Web Project and go to Project Facets.
Here we need to enable Oracle WebLogic SCA and Spring.
Click on Further configuration required.

Next step is to download the Spring library. Click on the download button and select Spring Framework 2.5.6 of Oracle.

Click on Next.

We need to add the WebLogic SCA Shared Library, this will be added to the weblogic.xml deployment descriptor of your Web Project.

You can open the weblogic.xml file of your Web project and in the Shared Libraries you should see the reference.

When you are in the Web Perspective then you can open the spring-context.xml in the beans section of the Spring Elements.

Or in the java perspective this is located in the jsca folder of the META-INF folder.

In the Spring-context.xml we will add some spring beans which have an EJB & Web Service SCA service and we also add some SCA references.

In this demo I will start with a SCA service with has a ws binding , this service has a target to a spring bean. This spring has a property to a SCA reference which an EJB binding.
The SCA reference calls a SCA Service which off course also has an EJB binding. The service target the next spring bean which the calls the last spring bean.

We start with the last spring bean and end with the first SCA service.
This the LoggerOutput class which just do a system out.
Because we want to expose the next spring bean as a SCA service we need to have an interface which we can use in the SCA service.
And now the implementation which calls the last spring bean LoggerOutput
Now we have everything to make our first SCA application. This is how the spring-context will look like.
This SCA service will be invoked in the second part of this blogpost where we will call this EJB from a web service. We can use the same ILoggerComponent interface for the SCA Service ( this time a web service ) and the SCA reference will call the already created EJB SCA service. We only need a new spring bean which pass on the message to the EJB. For this I use this LoggerPassThrough class.
Here is the total spring-context.xml
We are ready to deploy it and do a test run. Select your EAR project, right click and do run on Server.
Provide the details of your WebLogic 12c domain.

You can use soapUI to invoke the SCA Web Service http://localhost:7001/WebLogicSCA/LoggerService_Uri?WSDL
or invoke the SCA EJB Service
ILoggerComponent logEJB = (ILoggerComponent)context.lookup("LoggerService_EJB30_JNDI");

WebLogic also has an extension for WebLogic SCA , in the Console , go to the Preferences , Extensions and enable weblogic-sca-console. You need to restart your WebLogic Server.

After this you can click on your SCA deployment and see your SCA Services and references.

Download the code at github
https://github.com/biemond/OEPE_examples/tree/master/wls12cSCA

Solving __OAUX_GENXSD_.TOP.XSD with BPEL

2011-11-21T21:43:00.001+01:00

When you use an external web service in combination with a BPEL service component in an Oracle SOA Suite 11g composite and you follow this great AIA blog about Best Practices for Decoupling Services and Avoiding Invalid Composites at Server Startup then you can get this __OAUX_GENXSD_.TOP.XSD error in

JDeveloper, when you build the composite.
On the SOA Suite when the service is invoked for the second time, probably on your test or acceptance environment.

Before we start with the possible fixes, first why do you get this error.

You can only get this error when you use BPEL in your composite. With the mediator service component I don't get this error.

In my test composite I have a simple OSB proxy and use this as a reference. So I provide the WSDL url to the WS adapter and enabled the option to download the WSDL to your project.

Because I don't want any deployment problems ( invalid composites at deployment time or at a soa server reboot when the OSB proxy is down ). I downloaded the XSDs of the WSDL, fixed the WSDL imports. Now we can put the WSDL and the XSDs in our project folder or add them to a central place like the MDS.

When we take a look at the reference part in the composite.xml you will see the following.

The endpoint is loaded from the Customer.wsdl ( location attribute of the binding.ws element ) and uses the port attribute to find the endpoint in the Customer.wsdl.

Here is the wsdl with the endpoint.

This works great in development ( cause you don't need to change anything) but when you have to deploy to test or acceptance you will generate a config plan where you override the location attribute of the binding.ws (reference) with the Test OSB Proxy WSDL url, so it will use that endpoint for test or acceptance.

On the SOA Suite you can invoke this service once and after that you can get this __OAUX_GENXSD_.TOP.XSD error. Somehow the second time the SOA Suite will retrieve the test OSB Proxy WSDL and it's XSDs from the cache and it compares it with the local XSDs of your project or MDS. When there is a difference in one of the XSDs you will get this error ( can be something minor like an element annotation ).

This can also happen in the JDeveloper SOA Composite builder when you load the same XSDs local and remote.

So the solution is to keep the XML schemas in sync ( remote and local ) but this is almost impossible or you need to build everything with Maven or ANT and always replace the XSDs in every project. This also requires a lot of unit testing.

Even then you probably don't have much influence on remote services.

So the best solution is to avoid the loading of remote WSDL. You only need to update the endpoint for the Test or acceptance environment, not to load the whole WSDL. So don't try to replace the location attribute of the binding.ws element in the composite.xml but try to update the endpoint in the WSDL located in your project or in the MDS.

And if you use contract first Java (EJB) Web Services in Oracle Suite then you should always use the WSDL and the XSDs in your Java Web Services else you will get different schema imports then the original WSDL & XSDs.

I tested this with the Patch Set 3 version of SOA Suite 11g.

Changing a navigation model on a page in WebCenter

2011-11-08T20:14:00.000+01:00

WebCenter has a default navigation model (menu) which is located in the navigations folder and is defined as portal preference in the adf-config.xml file. But this menu is used in every page of the portal. I want to change this, so when you are not authenticated you will see the normal website links. But when you go to the internal page the menu will be switched to the application navigation model.
Special thanks for Maiko Rocha of the WebCenter A-Team for helping me solving this requirement.

First I create a new jspx page based on the global template called Internal.jspx and add a navigation reference to this page in the default-navigation-model.xml.

Now we can create a navigation model which will be used in the internal page. This menu has a link to the home page so the user can go back to the default menu.

Open the global template called pageTemplate_globe.jspx and go the menu part. Here we will change the default navigation model.

from
#{navigationContext.defaultNavigationModel.listModel['startNode=/, includeStartNode=false']}

to
#{navigationContext.navigationModel[ menuSwitcher.menu ] .listModel['startNode=/, includeStartNode=false']}

Where menuSwitcher is a request bean.

To determine what navigation model I need to use I will check the current page and return the right navigation reference.

The request bean

You can also use EL instead of a request bean.

<af:forEach var="node" varStatus="vs"

items="#{navigationContext.navigationModel[

controllerContext.currentViewPort.viewId eq '/oracle/webcenter/portalapp/pages/Internal.jspx' ?

'/oracle/webcenter/portalapp/navigations/navigationModelInternal.xml' :

'/oracle/webcenter/portalapp/navigations/default-navigation-model.xml'

].listModel['startNode=/, includeStartNode=false']}">

Here some pictures of the home page

After being authenticated, some extra menu links appears

And at last, the internal page with the new navigation model.

Playing with ADF Task Flows in OEPE 11.1.1.8

2011-10-28T00:22:00.000+02:00

Oracle released the Oracle Enterprise Pack for Eclipse 11g R1 (11.1.1.8, New October 2011 ) which supports ADF Rich Faces with ADF Task Flow development. To see all the new features you can go this page for all the ADF or Oracle Cloud feature list.

In this blogpost I will show you some steps how to make your own ADF Web application in OEPE.

Before you can start you should know that the ADF application in OEPE uses JPA as model ( eclipselink), ADF BC can be used but only on runtime and you should already have WebLogic PS3 or higher installed ( together the ADF runtime option).

This OEPE release does not have ADF wizard for ADF BC or for ADF Datacontrols but the support for ADF Task Flows is a big step forward.

Let's start.
Start with a new Oracle ADF Application

Add a new WebLogic runtime, define your WebLogic home and run the domain wizard to create a new ADF enabled domain. Make sure you add the JRF option to the domain.

You should use JPA as a model project with Oracle ADF 11g JPA Project as the configuration.

This will create 2 projects, Model and AdfGuiWeb and 1 ear deployment called AdfGui.

Create a JSP File which will be our start page.

Select the location for the JSPX page

Choose for ADF Rich Faces Page , Basic xhtml

Open the adfc-config.xml and drag the jspx page to the diagram, this will create a new view.

Create a new ADF Fragment Task Flow which will hold the department fragments

Select the location.

The fragment option should be enabled.

Create a new JSP page which will be our fragment page, called department.jsff

Now choose ADF Rich Faces Page Fragment

Open the departments TF and drag this fragment to this Bounded Task Flow.

Now we can go the model project and delete the model project. OEPE does not support ADF Datacontrol generation, so we will skip this for the demo.

Now you are able to run the JSPX page. Select the startView.jspx and right click Run As -> Run on server.

After a successful run we can add an outputtext to the page and the fragment

Now drag the department Task Flow to the jspx start page and select Region. This will create the ADF binding pagedef file.

We can open the pagedef file and add your own bindings.

Or open the Data Palette window which shows you the available bindings

At last open the project options to enable the adf.oracle.domain.webapp shared libraries

Now you can run the start page with the Bounded Task Flow fragment.

As an extra you can also add some data to the page by fixing the Model project.
First add a database connection to the model project
Add JPA entitities from tables
Add a connection to the persistence.xml

Add Data Model Components to the Model project. This will create a managed bean for the JSF page and an EJB Session bean for the entities

EJB Session Bean

JSF bean

the managed bean code

The Data Pallette, drag and drop the FindAll method to the fragment page

And the result.

Using FMW IdentityStore for your User management

2011-10-23T20:31:00.001+02:00

In Fusion Middleware you can use IdentityStore framework to do all your user, role and password management. This IDM and JPS frameworks will give you a lot options which you don't have with the standaard JAAS framework of WebLogic ( you need to create your authentication provider and add a private principal to the subject). IDM framework works really great with LDAP identity providers like the default WebLogic internal LDAP, OpenLDAP, Oracle Internet Directory ( OID ) or Microsoft Active Directory.
With this you don't need to make your own software to do some user management on a particular LDAP provider, IDM can do it for you and IDM will detect the right LDAP provider. So you just need to implement this and IDM will do all the work.

This is what you can do with IDM.

Retrieving and changing LDAP attributes of a user.
User management, search, create users in a particular LDAP provider.
Role management, search, create etc.
Retrieve a username and password from the credential store and use it in your own application.

I will try to explain the different use cases in this blogpost.

Before we begin, is good to know how the IdentityStore will work with LDAP providers. Default it only works with the internal WebLogic LDAP. If you also want to use AD or OID, then you need to add it to WebLogic authentication provider of the myrealm security realm ( no need to add it to the jps-config.xml located at domain/config/fmwconfig ,this is only necessary when you don't use WebLogic ).
The jps serviceInstance called idstore.ldap can detect all the LDAP providers which are configured in WebLogic.
But when you have more then one LDAP providers then you got two options.

Add the virtualize property with value true to the idstore.ldap serviceInstance ( in jps-config.xml located at domain/config/fmwconfig ) . This will switch IDM from WebLogic to Oracle Virtual Directory mode. This will make sure that FMW applications will see all the users and roles. When you use Webcenter or SOA Suite / BPM Human worklist application then you need to add this property when you have more then one LDAP provider. In this OVD mode you can't retrieve the LDAP attributes of a user, OVD did not implement this option.
Re-order the LDAP authentication providers. The first authenticator provider will be used and the other will be ignored, ( WebLogic will still use all it's authenticators for JAAS but FMW will not ). That's why in some forums or blogposts talk about re-ordering of the authentications providers. In most cases is setting the virtualize a better approach.

Let's start with retrieving all the things we know about a user. Here I will retrieve its roles and all the LDAP attributes. ( this will not work with virtualize property on true and only on the first authentication provider )
Using LDAP attributes can be very handy for retrieving particular information which you can use in your application, like location information else you need to create a lot of roles to achieve the same. You can retrieve for example the location attribute and pass this value to the database ( Use it in Virtual Private Database VPD what Larry said it is a false cloud feature :-) ) or use it to disable some region screens.

Here I need to create JpsContext and lookup the IdentityStore. After that I can lookup the User with its UserProfile and retrieve the LDAP attributes by retrieving the PropertySet.

Important to know that these user operations will use the account defined in the authentication provider, there is no check if your normal user should be able to do so. So test this for a possible abuse.

These are the steps to create a new Role in your LDAP repository. Lookup the RoloManager and use the createRole method.

We can also create a user and assign a role to this new user. In this case also need to provide a AD property called samaccountname. After that I can retrieve the UserManager and use the createUser method. Lookup the role and assign to this user.

The last part is about how you can store your passwords in a safe way on the WebLogic Server. Every environment can have its own passwords and this can be managed by your Administrators.

To store a password in the credential store you can use the following wlst script.

start wlst.cmd from oracle_common\common\bin not from the the weblogic server home

connect('weblogic','weblogic1','t3://localhost:7101')
createCred(map="JPS",key="AD_ldap",user="CN=Administrator,CN=Users,DC=alfa,DC=local",password="Welcome02" ,desc="Windows LDAP user")
exit()

To allow FMW to retrieve this password I need to give the authenticated role some permissions on this map.

Open the jazn-data.xml of your FMW application, lookup the authenticated role and add the following entries
oracle.security.jps.service.credstore.CredentialAccessPermission with read permission for context=SYSTEM,mapName=JPS,keyName=AD_ldap.

Somehow I also need to do this for mapName=j2ee-app#V2.0. The WebLogic will provide some logging to say what you are missing.

And here the code to retrieve it.

You can download my sample application at github https://github.com/biemond/jdev11g_examples/tree/master/ADFSecurity

Working with the Human WorkList api and create your own WorkList application

2011-10-16T21:36:00.000+02:00

In this blogpost I will explain what is possible with the IWorkflowServiceClient ( HumanTask java client ) so you can integrate this in your own Custom WorkList application. This way you don't need to use the standard BPM worklist application, add some extra functionality and also don't need to create HumanTask ADF Task Flow and deploy this to the SOA Suite server.

This demo shows you the power of Fusion Middleware where you can combine SOA Suite workflow to your own ADF applications.

At the end of this blogpost I will show you the link for this demo application which also contains the BPEL to create the HumanTasks.

Here are some pics of the demo application. You will get an overview of the tasks assigned to the weblogic user ( normally this will be replaced by the user of the application ). The user can search on certain field, change the ordering and control the maximum rows.

And in combination with the ADF UIShell template of Oracle you can make a multi task handling application. Every task you click on will have its own Tab. Here you can also lookup the extra information which is necessary to the user so it can handle this task.

Time to go back to the code.

I will start with a BPEL which invokes a HumanTask and to make my life easy I will use the flexible text , date or url fields of the HumanTask for my own important data so I don't need to examine payload.
This way you can search on these fields and use it in your own task entity.

And map the payload fields to the flex fields in a Assign activity. These fields are located in the systemMessageAttributes element.

Next is to retrieve these tasks from the java / ejb client. Todo so I need two libraries bpm-infra.jar and bpm-services.jar. Copy these jars from the soa server so you don't get serial id versioning errors.

I will use on behalf of so I don't need to have the password of the user and I can do all the actions of behalf of this user.

Start with a property file or you can set some java parameters

soa.properties
soaserver=soaps3.alfa.local:8001
humantask.user=weblogic
humantask.password=weblogic1

or set these java parameters on the project
-Dhumantask.url
-Dhumantask.user
-Dhumantask.password

For the tasks I will connect to the HumanTask EJB and for the Identities I need to connect the Identity SOAP Service.

We need to have an IWorkflowContext which I can use for the query operation on the Task bean. I will first authenticate with the superuser and then on behalf of the user of my application.

In this query on the human task I can control which attributes I want to use in my application.

List<String> queryColumns = new ArrayList<String>(); queryColumns.add(TableConstants.WFTASK_TITLE_COLUMN.getName());

And if I want to have the payload or the comments, I need to do this.
List<ITaskQueryService.OptionalInfo> optionalInfo =
new ArrayList<ITaskQueryService.OptionalInfo>(); optionalInfo.add(ITaskQueryService.OptionalInfo.COMMENTS); optionalInfo.add(ITaskQueryService.OptionalInfo.PAYLOAD);

Do ordering on the tasks.

Ordering taskOrdering = null;
if ( "PRIO".equalsIgnoreCase(orderBy) ) {
taskOrdering = new Ordering(TableConstants.WFTASK_PRIORITY_COLUMN, true,false);
taskOrdering.addClause(TableConstants.WFTASK_TASKNUMBER_COLUMN, true,false);
} else if ("ID".equalsIgnoreCase(orderBy) ) {
taskOrdering = new Ordering(TableConstants.WFTASK_TASKNUMBER_COLUMN, false,true);
} else if ("ESC_DESC".equalsIgnoreCase(orderBy) ) {
taskOrdering = new Ordering(TableConstants.WFTASK_EXPIRATIONDATE_COLUMN, false, false);
} else if ("ESC_ASC".equalsIgnoreCase(orderBy) ) {
taskOrdering = new Ordering(TableConstants.WFTASK_EXPIRATIONDATE_COLUMN, true, false); }
}

It is also possible to do a search and add a fixed where condition. For this we need to have a Predicate where we can add the states we want to see.

List<String> correctStates = new ArrayList<String>(); correctStates.add(IWorkflowConstants.TASK_STATE_ALERTED); correctStates.add(IWorkflowConstants.TASK_STATE_ASSIGNED);

Predicate predicateBasic = new Predicate(
TableConstants.WFTASK_STATE_COLUMN,
Predicate.OP_IN,
correctStates);

predicateBasic.addClause(Predicate.AND,
TableConstants.WFTASK_STATE_COLUMN,
Predicate.OP_NEQ,
IWorkflowConstants.TASK_STATE_STALE);

This Predicate can be combined to an other Predicate with an other AND / OR and finally added to the queryTasks method of the workflowServiceClient.getTaskQueryService()

To make your life easier try to convert the tasks to your own entity so you can use your own attributes instead of using text1 etc.

You can download, fork or improve the Demo application at github https://github.com/biemond/soa11g_examples/tree/master/HumanTaskListApp

Calling an OWSM protected service with Axis2 and Rampart

2011-10-06T22:44:00.000+02:00

In a previous blogpost I used Axis 1.4 in combination with WSS4J 1.5 and because Axis 1.4 is getting old so I tried the same with Axis 2 and Rampart which uses WSSJ. For all the security details like the username and how to generate certificates you can check see my previous post.

Just like the Axis 1.4 post I will call a OSB service which has an oracle/wss10_username_token_with_message_protection_service_policy OWSM server policy.

Before we start we need to download axis2 and the matching Rampart version, I use in this blogpost the 1.60 versions of axis2 and Rampart. Copy the Rampart jars to the axis lib folder and the Rampart modules to the axis2 modules folder.

Download the WSDL with it's XSDs from the Web Service.

After that use this ANT build file to generate a ADB web service proxy client. The wsdl I used has the Customer.wsdl as name.
This OWSM policy have different signing and encryption options on the message of the request / response. So we need to move the right WS security policies / assertions from the Customer WSDL to a Request and Response policy file.

Here is the Request Policy which matches with the oracle/wss10_username_token_with_message_protection_service_policy Server policy. I also added the Rampart Configuration which contains references to the keystore and the username I used. Add the sp:AsymmetricBinding, sp:SignedSupportingTokens and the sp:SignedParts & sp:EncryptedParts of the request from the customer wsdl to this policy file.
We also need to do this for the Response. Add the sp:AsymmetricBinding and the sp:SignedParts & sp:EncryptedParts of the response from the customer wsdl to this policy file.
Because we are using a keystore and a username token ( which got passwords ) we need to add a Password Callback class.
And here the test client which loads the Axis2 configuration with the Addressing and Rampart modules and also loads the Request and Response policy.
Here you can download my code at https://github.com/biemond/soa11g_examples/tree/master/OWSM_AXIS

Base64 encoding in Oracle BPEL 11g

2011-09-27T21:12:00.000+02:00

Sometimes in SOA Suite 11g you need to pass binary data to a web service reference. In SOA Suite 11g there is no standard XSLT or XPATH function which you can use. But in BEPL you can use embedded java, like Sudheer already blogged about. He used the com.collaxa.common.util.Base64Encoder class which does not exists in 11g so I will use the new oracle.soa.common.util.Base64Encoder class.

As input I will retrieve some xml from the inputVariable, get the xml as a string, encode this and set the value to a base64Binary variable.

Virtual Users with SAML in WebLogic

2011-09-22T22:53:00.000+02:00

A small blogpost how you can use virtual users on your SAML Service Provider WebLogic Server. A virtual user is a user who is authenticated on the SAML Identity Provider and this user is transfered ( with all his attributes and roles ) in a SAML Token to the Service Provider, this user does not need to exists on the WebLogic server of the Service Provider.
Before you can use this feature you need to setup SAML 2.0 SSO on your WebLogic Domain. You can follow this blogpost for all the instructions. You can also do this with Web Services but then you need to follow this guide.

First we need to enable Generate Attributes on the Identity Provider Side.
Go to the myrealm security realm -> Providers -> Credentials Mapping -> your SAML 2.0 Credential Mapping Provider -> Provider Specific.
Also do this on the imported Service Provider Partner located at the Management tab of your SAML 2.0 Credential Mapping Provider. Open the Service Provider Partner and also enable here Generate Attributes.

Next step is to configure the SAML Service Provider.
Go to the myrealm security realm -> Providers -> Authentication -> your SAML 2.0 Identity Assertion Provider -> Management Tab.
Open your imported Identity Provider Partner configuration.

Enable Virtual User and also enable Process Attributes.

Now we need to add an extra WebLogic SAML Authentication Provider. This provider will process the virtual user SAML token with all its attributes and roles.

Set the Control Flag to Sufficient also change the other authentication provider from Required to Sufficient.

That's all.

Calling an OWSM protected service with Axis 1.4 and WSS4J

2011-09-12T22:07:00.001+02:00

Not the whole world uses Fusion Middleware so sometimes it is necessary to call an Oracle Web Service Manager protected Web Service from a different java framework like Apache Axis 1.4 combined with WSS4J 1.5. In this blogpost I will show you the steps how to do this.

First you can't use every OWSM policy with Axis. Oracle made an interoperability documentation page what is possible with Axis 1.4 and OWSM 11g, please check this first.

In this post I will use the oracle/wss10_username_token_with_message_protection_service_policy OWSM server policy on a protected OSB proxy service and will call this from axis / wss4j and these frameworks will use the following policies UsernameToken, Timestamp, Signature and Encrypt.

In this demo I will used self signed keys and these are generated by the keytool of java 1.6. Basically I create two keystores and exchange the public keys. The server keystore is imported in the OWSM configuration page and the client keystore will be used in Axis.

keytool -genkey -alias serverKey -keyalg "RSA" -sigalg "SHA1withRSA" -dname "CN=server, C=US" -keypass welcome -keystore c:\temp\server.jks -storepass welcome -validity 3650

keytool -genkey -alias clientKey -keyalg "RSA" -sigalg "SHA1withRSA" -dname "CN=client, C=US" -keypass welcome -keystore c:\temp\client_2.jks -storepass welcome -validity 3650

keytool -exportcert -alias serverKey -storepass welcome -keystore c:\temp\server.jks -file c:\temp\server.cer

keytool -exportcert -alias clientKey -storepass welcome -keystore c:\temp\client_2.jks -file c:\temp\client.cer

keytool -import -alias serverKey -file c:\temp\server.cer -storepass welcome -keystore c:\temp\client_2.jks keytool -import -alias clientKey -file c:\temp\client.cer -storepass welcome -keystore c:\temp\server.jks

keytool -list -storepass welcome -keystore c:\temp\client_2.jks
keytool -list -storepass welcome -keystore c:\temp\server.jks

For this policy we also need to create a user called osbbook and with password weblogic1 in the myrealm security realm of WebLogic.

The next step is to check if all is fine by creating an OWSM client in Jdeveloper 11g and using the oracle/wss10_username_token_with_message_protection_client_policy OWSM client policy . First generate a web service client and use the following code to check if it works.

If all is fine we can go to the Axis and WSS4J part.
We need to download the following software frameworks from Apache.

Axis 1.4, not Axis2
WSS4J 1.5, Not the 1.6 version
Apache XML Security for Java 1.4.5

Download the WSDL and it's XML Schemas of the remote service and fix the schema imports of the WSDL. Put these files in your project folder.

The first step is to generate a Web Service Proxy client based on this WSDL, for this we don't use JAX-WS but we will use the AXIS libraries.
Here is the ANT build file to generate the Java classes from WSDL with Axis 1.4, I put the build.xml in my project folder of JDeveloper.

Add the following libraries to the project. Wss4j-1.5.12.jar, Axis.jar, Jaxrpc.jar, Saaj.jar, Wsdl4j-1.5.1.jar, Commons-discovery-0.2.jar, Commons-logging-1.0.4.jar, Log4j-1.2.8.jar, Javax.activation_1.1.0.0_1-1.jar, Javax.mail_1.1.0.0_1-4-1.jar ,Xmlsec-1.4.5.jar, Xml-apis-1.3.03.jar, Serializer-2.7.1.jar, Xalan-2.7.1.jar, XercesImpl-2.9.1.jar

We also need to create a security property file called crypto.properties and put this in the src folder. This file contains the keystore path with its keystore password.

Create a Password callback class for all the password used in this ws client ( the password of the usernametoken and the keystore passwords )
We also need an Axis deployment file WSDD with the WSS4J configuration, put this file called client_deployment.wsdd in your project folder.

For the response I need to do the following policies Signature, Timestamp and then Encrypt , this is wrong in the documentation

Use the log4j.properties to see all the messages, else you won't see the debug information of WSS4J and Axis 1.4.
Put this file in the src folder.

And at last the Axis test client where we load the client_deployment.wsdd file.

Using OWSM Kerberos policies

2011-09-06T22:19:00.001+02:00

In this blogpost I will explain how you can use the OWSM ( Oracle Web Service Manager) Kerberos policies in Fusion Middleware 11g. Some of these kerberos policies are compatible with the Window Active Directory KDC and these kerberos tokens can be used for authentication and message protection. It basically works the same as I described in my blog about Windows Single Sign On with web applications deployed on WebLogic. If you want to use OWSM SAML policies instead then you can use this blogpost and for username tokens or certificates protection you can use this blogpost.

OWSM support the following Kerberos server policies.

oracle/wss11_kerberos_token_service_policy, this can be used for authentication just like the username token policies. It does not encrypt the message and can be used with AD and MIT
oracle/wss11_kerberos_token_with_message_protection_basic128_service_policy, besides the authentication it also encrypts the message. This policy works with AD.
oracle/wss11_kerberos_token_with_message_protection_service_policy, this policy does the same but only works with MIT.

For Windows AD we can only use the first two policies.

Before we can start you need to know or do the following

Know the supported encryption types of your Windows Environment. For example Windows XP or Windows 2003 Domain Controller ( not SP1 ) does not support every encryption type.

I got this working with a Windows 7 client and a Windows 2008 R2 Domain Controller and my encryption type is RC4-HMAC-NT, which is also supported in Java 1.6

My Active Directory domain = ALFA.LOCAL ( always use it in uppercase )
Make sure that all server can be found in the DNS ( and reverse ) and that the time is synchronized on all machines.

In my test environment I will use 3 servers, The first is my AD 2008 server, second is the OWSM server called soaps3.alfa.local on which we will deploy a kerberos protected JAX-WS service and third is the Web Service Proxy client machine called win7.alfa.local and this has the OWSM kerberos client policy.

We need to create 2 unique service account in Active Directory. In this case soaps3_kerb and win7_kerb and make sure that the passwords of these accounts never expires.

On the Windows 2008 DC server I did the following to generate a service account called HTTP/soaps3.alfa.local and map this to soaps3_kerb AD account. Soaps3 is the server hostname of the WebLogic Server.

First generate a keytab file for the HTTP/soaps3.alfa.local@ALFA.LOCAL account, HTTP is a container ( IIS also uses this convention ) and ALFA.LOCAL is my AD domain.

ktpass -princ HTTP/soaps3.alfa.local@ALFA.LOCAL -pass Welcome01 -mapuser soaps3_kerb@ALFA.LOCAL -out c:\soaps3.keytab -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT

copy the generated soaps3.keytab file to the WebLogic machine ( soaps3 )
I put it in the c:\oracle folder.

Now we need to modify the Service Principal Names with the SPN utility ( Do this on the AD server )
setSpn -A HTTP/soaps3.alfa.local@ALFA.LOCAL soaps3_kerb

Now we can do the same for the win7 machine, which will be used as ws client.
ktpass -princ HTTP/win7.alfa.local@ALFA.LOCAL -pass Welcome01 -mapuser win7_kerb@ALFA.LOCAL -out c:\win7.keytab -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT

copy the win7.keytab to the oracle folder of the win7 machine
setSpn -A HTTP/win7.alfa.local win7_kerb

On the win7 and soapss3 machine we need to create krb5.ini textfile and put this in c:\windows

ALFA.LOCAL is my AD domain and soaps3 is my WebLogic server and it exists in the alfa.local dns domain.
ad-win2008r2.alfa.local is my domain controller.
the krb5.ini for the soaps3 machine
-------------------
[libdefaults]
default_realm = ALFA.LOCAL
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
permitted_enctypes = rc4-hmac

[domain_realm]
.soaps3.alfa.local = ALFA.LOCAL
soaps3.alfa.local = ALFA.LOCAL

[realms]
ALFA.LOCAL = {
kdc = ad-win2008r2.alfa.local
admin_server = ad-win2008r2.alfa.local
default_domain = alfa.local }

[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true

---------------

and the win7 machine version.
-----------------

[libdefaults]
default_realm = ALFA.LOCAL
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
permitted_enctypes = rc4-hmac

[domain_realm]
.win7.alfa.local = ALFA.LOCAL
win7.alfa.local = ALFA.LOCAL

[realms]
ALFA.LOCAL = {
kdc = ad-win2008r2.alfa.local
admin_server = ad-win2008r2.alfa.local
default_domain = alfa.local
}

------------------

Go to the JVM bin folder of the the WebLogic server. This is the soaps3 machine. Here we generate a token.

cd c:\oracle\jrockit-jdk1.6.0_26-R28\bin
kinit HTTP/soaps3.alfa.local@ALFA.LOCAL
Provide the password of HTTP/soaps3.alfa.local and the ticket will be stored in your user profile.

Do the same on the win7 machine but then with the use HTTP/win7.alfa.local account.
cd c:\oracle\jrockit-jdk1.6.0_26-R28\bin
kinit HTTP/win7.alfa.local@ALFA.LOCAL

That's all for the kerberos configuration on the windows machines. Now we need to do some configuration in the Enterprise Manager and the WebLogic Console.

First we need to configure the kerberos Login module.
Go the Enterprise Manager (EM) application of the WebLogic server. Open the WebLogic Domain treenode and select your WebLogic domain. In the Domain menu (right window) go to Security -> Security Provider Configuration

Select the krb5.loginmodule and click on the Edit button.

Here we need to provide the principal name HTTP/soaps3.alfa.local@ALFA.LOCAL and its keyTab file.

Save and restart the WebLogic server.

After that we need to create a user on the WebLogic domain or configure an AD ldap authenticator.
The user HTTP/win7.alfa.local must exists on the domain. The password does not matter because it is already authenticated against the AD.

For the server side you can enable the kerberos debugging by adding the following parameter to the EXTRA_JAVA_PROPERTIES parameter in the setDomainEnv.bat of your domain. -Dsun.security.krb5.debug=true

Deploy the following JAX-WS service on the soaps3 server.

That's all for the server part, now we can test the web service proxy client on the win7 machine.

On the client you can also set the following project options -Dsun.security.krb5.debug=true to see all the debug information. And off course you can use the HTTP analyzer to see all the traffic.

This is my test client code.

When you run the test client you should be authenticated and see the output.

Using the EJB adapter in SOA Suite 11g

2011-09-01T20:56:00.001+02:00

In Oracle SOA Suite 11g you can use the EJB adapter to expose a Remote interface as a Service or use it in a Reference Service. From PS2 you only need to have an interface jar for the EJB adapter. The interface jar only contains the entities and the Session Bean interfaces (local and remote ) and does not contains the bean or the persistence unit. Off course you can still generate an SDO interface on the EJB Session and use that in the EJB adapter like I did in this blogpost but this is not necessary.

In this blogpost I will focus on how to use the EJB adapter as a reference service. With this you can think of replacing your database adapters. Off course you can make some composites in which you expose some database adapters for optimal reuse but maybe it is easier to use an EJB Session Bean deployed on a model tier which can cache your data, is cluster aware and can be also used by your Java (Web) applications.

We start by dropping an EJB adapter on the reference side of the composite. Lookup the interface jar and provide the remote interface class. Add some text to the JNDI Name, we need to delete this entry and replace it with the right value ( a jdeveloper bug)

Choose for the JAVA interface else you need to have an EJB Session Bean with a SDO interface.

After the creation of the EJB adapter you can select the adapter and optional add some properties( in the property window ) like the java.naming.provider.url in case when the EJB Session Bean is not deployed on the SOA Suite server.

Now go the source mode of your composite where we fix the JNDI url. Delete the uri attribute of the binding.ejb element.

Now we need to add the JNDI name of your EJB Session Bean to the ejb binding. You can select the binding.ejb element and add the jndi url in the property window.

It need to have the jndiName attribute and not the uri attribute.

That's all for the EJB adapter but to use it in a Service Component we need to follow the rules of exposing a java class as a web service. The bottom up approach with JAX-WS like I describe in this blogpost. This is also necessary when you use the EJB transport in the OSB.

We start with the Remote Interface of the EJB Session bean. With the JAX-WS annotations like WebParam, WebMethod or WebResult we can control and influence the WSDL generation. This WSDL will be used by the Service Components.

If we don't do this you will get arg0 as argument name and return as Response element.

With JPA you can have a reference entity attribute between two entities. For example the employee entity has a department attribute and department has a collection of employees. With this you can create a loop in loading employee and department entities. JPA don't allow this and you can control it with eager of lazy loading.
For JAX-WS and the EJB adapter you need to decide where you want to stop this loading by adding the XmlTransient attribute to a getter. So in this example you can add this to the getDepartment method of the employee entity or add this to the getEmployees of the department entity.

In the WSDL you can see that the employee does not have the department element.

The last important thing is, to avoid the use of java.util.Date, Timestamp or java.sql.Date. This will be ignored by the EJB adapter. You need to use Calendar as java type.

Single Sign On with windows / kerberos on WebLogic

2011-08-26T23:40:00.004+02:00

In this blogspot I will show you the steps I did to achieve SSO kerberos windows authentication on an ADF or a Web Application deployed on a WebLogic application server.

Before we can start you should know the supported encryption types of your Windows Environment. For example Windows XP or Windows 2003 Domain Controller ( not SP1 ) does not support every encryption type.

I got this working with a Windows 7 client and a Windows 2008 R2 Domain Controller and my encryption type is RC4-HMAC-NT, which is also supported in Java 1.6

My Active Directory domain = ALFA.LOCAL ( always use it in uppercase )

Make sure that all server can be found in the DNS ( and reverse ) and that the time is synchronized on all machines.

We start by creating a unique service account ( it must not exists, not as computer and not as an user ), in my case is that soaps3_kerb.

I used Welcome01 as password and make sure that the password never expires.

On the Windows 2008 DC server I did the following to generate a service account called HTTP/soaps3.alfa.local and map this to soaps3_kerb AD account. soaps3 is the server name of the WebLogic Server.

First generate a keytab file for the HTTP/soaps3.alfa.local@ALFA.LOCAL account, HTTP is a container ( IIS also uses this convention ) and ALFA.LOCAL is my AD domain.

ktpass -princ HTTP/soaps3.alfa.local@ALFA.LOCAL -pass Welcome01 -mapuser soaps3_kerb@ALFA.LOCAL -out c:\soaps3.keytab -ptype KRB5_NT_PRINCIPAL -crypto RC4-HMAC-NT

my output
Targeting domain controller: AD-WIN2008R2.alfa.local

Using legacy password setting method
Successfully mapped HTTP/soaps3.alfa.local to soaps3_kerb.Key created.
Output keytab to c:\soaps3.keytab:
Keytab version: 0x502
keysize 68 HTTP/soaps3.alfa.local@ALFA.LOCAL ptype 1 (KRB5_NT_PRINCIPAL) vno 3 etype 0x17 (RC4-HMAC) keylength 16 (0x1d863479e1ab3bd62a2bfafa1abaa2dd)

copy the generated soaps3.keytab file to the WebLogic machine. I put it in the c:\oracle folder.

Now we need to modify the Service Principal Names with the SPN utility.
setSpn -A HTTP/soaps3.alfa.local@ALFA.LOCAL soaps3_kerb

my output
Registering ServicePrincipalNames for CN=soaps3_kerb,CN=Users,DC=alfa,DC=local
HTTP/soaps3.alfa.local@ALFA.LOCAL
Updated object

Now we can continue with the WebLogic Server configuration.

Start by making create a text file called krb5.ini and put it in c:\windows
ALFA.LOCAL is my AD domain and soaps3 is my WebLogic server and it exists in the alfa.local dns domain. ad-win2008r2.alfa.local is my domain controller.
-------------------

[libdefaults]
default_realm = ALFA.LOCAL
default_tkt_enctypes = rc4-hmac
default_tgs_enctypes = rc4-hmac
permitted_enctypes = rc4-hmac

[domain_realm]
.soaps3.alfa.local = ALFA.LOCAL
soaps3.alfa.local = ALFA.LOCAL
.alfa.local = ALFA.LOCAL
alfa.local = ALFA.LOCAL

[realms]
ALFA.LOCAL = {
kdc = ad-win2008r2.alfa.local
admin_server = ad-win2008r2.alfa.local
default_domain = alfa.local
}
[appdefaults]
autologin = true
forward = true
forwardable = true
encrypt = true

---------------

On the soaps3 WebLogic machine we need to create a new Kerberos ticket which will be used by WebLogic.

First let's flush the current ones
go to c:\ ( not in the java bin folder )
klist purge

go to the bin folder of your java home ( jdk )
cd c:\oracle\jrockit-jdk1.6.0_26-R28\bin

kinit HTTP/soaps3.alfa.local@ALFA.LOCAL

My output
Password for HTTP/soaps3.alfa.local@ALFA.LOCAL:
New ticket is stored in cache file C:\Users\admin\krb5cc_admin

This should work and it will use the krb5.ini located at c:\windows.

Create or change an application with ADF Security or a normal Web Application which got security enabled. Open the web.xml and change the auth-method to CLIENT-CERT

<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>

Deploy the application to the WebLogic Server.

Open the WebLogic console application and go to myrealm security realm -> providers -> authentication.

create a NegotiateIdentityAsserter called Microsoft.

Open the NegotiateIdentityAsserter and go to Provider Specific and de-select Form Based Negotiation Enabled.

Next step is to create a kerberos login configuration which will be read by WebLogic.
Create a text file called kerberos.login located in the c:\oracle. This is the content which will work with Java 1.6
-------

com.sun.security.jgss.krb5.initiate {
com.sun.security.auth.module.Krb5LoginModule required
principal="HTTP/soaps3.alfa.local@ALFA.LOCAL"
useKeyTab=true
keyTab="c:/oracle/soaps3.keytab"
storeKey=true
debug=true;
};

com.sun.security.jgss.krb5.accept {
com.sun.security.auth.module.Krb5LoginModule required
principal="HTTP/soaps3.alfa.local@ALFA.LOCAL"
useKeyTab=true
keyTab="c:/oracle/soaps3.keytab"
storeKey=true
debug=true;
};
-------

Add the following parameters to the EXTRA_JAVA_PROPERTIES in the setDomainEnv.bat of your domain.
-Dsun.security.krb5.debug=true
-Djavax.security.auth.useSubjectCredsOnly=false
-Djava.security.auth.login.config=C:/oracle/kerberos.login
-Djava.security.krb5.realm=ALFA.LOCAL
-Djava.security.krb5.kdc=ad-win2008r2.alfa.local

We are finished with the WebLogic and the AD configuration.

Just add the login name of the window user and its groups to the myrealm security realm, so you can test the Web Application.

Log on a machine which is part of your AD domain.

use Internet Explorer and trust the weblogic site and enable authentication in the advanced options of IE.
or
use Google Chrome and start chrome.exe with the following parameter --args --auth-server-whitelist="*alfa.local" This allows SSO with chrome.

Do SAML with OWSM

2011-08-22T23:35:00.001+02:00

In this blogpost I will explain the different SAML options and the advanced configurations you can do when you use the SAML client and server policies of Oracle Web Service Manager FMW 11gR1.
The following will be explained and configured in this blogpost.

A basic SAML authentication with 2 OWSM Servers.
Change the default SAML issuer name.
Allow only trusted SAML clients.
SAML Identity switching.
Virtual Users with User roles.

Creating a working SAML setup.
For this we need two WebLogic domains and both have at least the Enterprise Manager web application and enabled the OWSM option. For this demo I will have one domain with SOA Suite and one with only a WebLogic Adminserver where we will deploy a JAX-WS Web Service which has an OWSM server policy. You can replace the SOA Suite with a OSB server ( it works in the same way ) . For OWSM, every domain need to have it's own MDS repository to store all the OWSM policies and for SOA Suite you also need a soa-infra database repos.

This will be our setup.

A client ( soapUI or WS client proxy ) calls an exposed web service of a SOA Suite composite and the client needs to provide a username token.
The exposed service has oracle/wss_username_token_service_policy as OWSM Server policy. The username token will be validated by WebLogic and the username will be passed on by SAML and signed with the signing certificate of the SOA Suite OWSM. The exposed service has a wire to a Mediator with a simple routing rule.
The Mediator has a wire to the Reference Web Service. This reference WS binding has oracle/wss11_saml_token_with_message_protection_client_policy as OWSM client policy.
The Reference WS binding calls a JAX-WS Web Service deployed on the other WebLogic Domain and this Web Service has oracle/wss11_saml_token_with_message_protection_service_policy as OWSM server policy. OWSM will validate the SAML issuer and check if it knows the username ( the password does not matter, because it is trusted )

The SOA Composite I used.

The JAX-WS service

Before we can test this SAML service, we need to generate some keystores, configure OWSM and add some users to WebLogic.
Execute the following commands to generate some self signed private keys and exchange the public keys ( this will trust each other certificates )

Go to the bin folder of your JDK.
cd c:\oracle\jrockit-jdk1.6.0_26-R28\bin

Generate a certificate for SOA ( server.jks ) and one for the JAX-WS server ( saml.jks )
keytool -genkey -alias serverKey -keyalg "RSA" -sigalg "SHA1withRSA" -dname "CN=server, C=US" -keypass welcome -keystore c:\temp\server.jks -storepass welcome -validity 3650
keytool -genkey -alias samlKey -keyalg "RSA" -sigalg "SHA1withRSA" -dname "CN=saml, C=US" -keypass welcome -keystore c:\temp\saml.jks -storepass welcome -validity 3650

Export the public key
keytool -exportcert -alias serverKey -storepass welcome -keystore c:\temp\server.jks -file c:\temp\server.cer
keytool -exportcert -alias samlKey -storepass welcome -keystore c:\temp\saml.jks -file c:\temp\saml.cer

Import the keys in each other keystore ( for the trust (
keytool -import -alias serverKey -file c:\temp\server.cer -storepass welcome -keystore c:\temp\saml.jks
keytool -import -alias samlKey -file c:\temp\saml.cer -storepass welcome -keystore c:\temp\server.jks

Show the certificates in each keystore.
keytool -list -storepass welcome -keystore c:\temp\server.jks
keytool -list -storepass welcome -keystore c:\temp\saml.jks

Copy the server.jks to the config\fmwconfig folder of your SOA Suite domain. Do the same for the saml.jks keystore but then to fmwconfig of the JAX-WS server domain.

Go the Enterprise Manager (EM) application of the SOA Suite. Open the WebLogic Domain treenode and select your SOA domain. In the Domain menu (right window) go to Security -&gt; Security Provider Configuration. Click on the Configure button in the keystore section.

Use ./server.jks in the Keystore Path field and serverKey in the Key and Crypt Alias. Use welcome for all the password fields.

We need to do the same at the JAX-WS server but then use the following values.

Use ./saml.jks in the Keystore Path field and samlKey in the Key and Crypt Alias. Use welcome for all the password fields.

Add a user with client as name and with weblogic1 as password in the myrealm security realm of the SOA Suite server. Do the same at the JAX-WS server but now use welcome1 as password.

Do a restart of the all the servers.

We can test the SAML setup by generating a Web Service Client proxy in JDeveloper. Here is an example how I add the client credentials.

that is all for the basic SAML test.

How to change the SAML issuer name.
The default SAML issuer name is www.oracle.com , We can change this at the JAX-WS server. For this we need to go the EM application of the JAX-WS Server. Open the WebLogic Domain treenode and select your JAX-WS domain. In the Domain menu (right window) go to Security -> Security Provider Configuration. Click on the Configure button in the Advanced section.

Here we can change the name attribute of saml.trusted.issuers.1 property to www.amis.nl and click on Ok. This way you will change the default trusted issuer for all the SAML login modules, if you only want to change this for SAML1.1 and not for SAML2 then you can open the saml.loginmodule instead (located at the Security Provider Configuration) and change it there. This will add an extra saml property name beside the one of www.oracle.com
You will need to restart the WebLogic server.

We also need to change an attribute on the reference web service binding of the SOA Composite. Select the reference binding and right click, to open the Configure WS Policies menu.

Click on the pencil to override the saml.issuer.name and use www.amis.nl

Deploy the composite and re-test it with the jdeveloper ws proxy client.

Allow only trusted SAML clients
In the current setup each public key found in the saml.jks keystore can sign a SAML token. In this part we can restrict this to only "CN=server, C=US", this is the DN of the signing certificate located at the SOA Suite server.

Go the Enterprise Manager (EM) application of the JAX-WS Server. Open the WebLogic Domain treenode and select your JAX-WS domain. In the Domain menu (right window) go to Web Services -> Platform Policy Configuration.

Go to the Trusted SAML clients Tab and add a new Trusted Issuer called www.amis.nl .
Select the just created Trusted Issuer and add a Trusted SAML Client and use CN=server, C=US as value.

Restart the JAX-WS Server and now only CN=server, C=US can sign the SAML token.

SAML Identity switching
In the last part of this blogpost we will change the identity of the SAML token. In the previous examples we used client as username and this is passed on to the JAX-WS server. We will override this on the SOA Suite server. In our test client we can now use weblogic as username and override to client in the SOA Composite.
Open the Mediator of the SOA Composite where we will add an Assign to the request part of the Routing Rule.

Here we need to add the javax.xml.ws.security.auth.username property with client as value.

We also need to change the OWSM client policy to oracle/wss11_saml_token_identity_switch_with_message_protection_client_policy on the reference web service binding.

Deploy your composite.

Too bad, this is not enough we also need to give my SOA Composite the right permissions to do identity switching. Go the Enterprise Manager (EM) application of the SOA Suite. Open the WebLogic Domain treenode and select your SOA domain. In the Domain menu (right window) go to Security -> System Policies.

Select Codebase as Type and search. Select a Codebase policy and do Create Like.

Use file:${common.components.home}/modules/oracle.wsm.agent.common_11.1.1/wsm-agent-core.jar as value in the Codebase field and click on Edit.

Enter oracle.wsm.security.WSIdentityPermission in the Permission Class field. The action is always assert. The Resource Name is your Composite Name which does the identity switching.

Virtual Users with User roles
The last part is virtual users, in this section will we add some roles and change some attributes on the SOA Suite client user. Change the policy back on the composite reference ( oracle/wss11_saml_token_with_message_protection_client_policy ) and also use client as username in the web service proxy client.

First change some client user attributes. We can do this in the security realm of the SOA Suite WebLogic Domain.

Normally the user is only mapped to the user located at the JAX-WS server. To make virtual servers work we need to add a property to the saml.loginmodule located at the JAX-WS server. For this we need to go the EM application of the JAX-WS Server. Open the WebLogic Domain treenode and select your JAX-WS domain. In the Domain menu (right window) go to Security -> Security Provider Configuration.

Click on Edit and add a custom property oracle.security.jps.assert.saml.identity with value true.

Restart the JAX-WS WebLogic server.

We also need to do something in the SOA Composite.

Override the following properties

user.attributes with value displayname,employeenumber ( use , to separate ldap attributes you want to pass on )
user.roles.include with value true
subject.precedence with value true

Deploy the composite and when you test your test client. You will see the following output on the JAX-WS Server.

virtual found
saml issuer: www.amis.nl

SAML attribute: employeenumber
value: 100

SAML attribute: Roles
value: Operators
value: AdminChannelUsers
value: IntegrationOperators
value: IntegrationMonitors
value: Monitors

SAML attribute: displayname
value: SAML client

Contract First web service with JDeveloper

2011-08-13T22:49:00.000+02:00

In this blogpost I will explain the options you have when you use JDeveloper to generate a web service based on a WSDL, so called top down or contract first. In my previous blogpost I showed you the bottom up approach. This works great but it can lead to a ugly WSDL which it is not so great for interoperability. Off course you can control it all with some web service annotations but then you really need to know what you are doing.

Here is an example of a bottom up WSDL. It matches with the java methods

Let's change it to this and use this WSDL in JDeveloper.

Before we can start lets copy the WSDL and its XSD to the project folder. This way JDeveloper can detect it.

In JDeveloper we can choose for Java Web Service from WSDL.

We can select our WSDL from the listbox and in this dialog we can choose for some important options.

First we can choose Java or for EJB 3.0 as Service Type. With Java as Service Type JDeveloper will add the Web Service as servlet to the web.xml. This is not the case with EJB.
With EJB as Service Type you will get transaction, security support, can use interceptors and the timer service. If you enable the Add Service Endpoint Interface option and add an Remote annotations to this interface you can call the Remote interface of this EJB with RMI (t3:) besides invoking this Web Service with HTTP.

The Service Endpoint Interface (SEI) is a Java interface that declares the methods that a client can invoke on the service. It provides the client's view of the web service and hiding the implementation from the client.

Provide the package names for the web service and the java types.

This will generate the following code. We need this JAXB code in completing the service implementation.

The generated service interface.

The service implementation.

To complete the service we can for example inject an EJB and include the JAXB ObjectFactory.

And the contract first web service is finished.

Expose your Session Bean as a Web Service with JAX-WS and Eclipselink

2011-08-10T22:55:00.004+02:00

In this blogpost I will show you how you can expose your EJB Session Bean as a Web Service, also tell you everything what I encountered and how I solved my issues. I will do this in JDeveloper and I will use the following frameworks: Eclipselink, JAX-WS and test it on WebLogic.

First let's start with the JPA part. In my project I generated some entities based on the Emp &amp; Dept tables of the Scott schema.

In this demo I want to retrieve one department so I need to add a NamedQuery. I added Dept.findByPK to the NamedQueries annotation. Normally you only need to add the following JQL statement select o from Dept o where o.deptno = :deptid
In this case I didn't want to set the OneToMany relation between Emp and Dept to eager. This can cause a fetch loop, so let's use the default value ( lazy ). I still need to fetch the employees on a department so I can return the department with all its employees in the Web Service response. To also fetch the employees I can add join fetch o.empList to the JQL statement.

The Emp entity also got some important adjustments.
This entity got an attribute called hiredate with timestamp as java type. First I added the Temporal annotation with a Date value and also change the java type to Calendar else it will be ignored by the Web Service.
Because this entity has a getter to the Dept entity and Dept got one to Emp we need to break the loop for the Web Service response. You can do this by adding the XmlTransient annotation to the getDept() method. Else you will get an empty response or this error
javax.xml.stream.XMLStreamException: Premature end of file encountered

This is my Session Bean where I added the WebService, WebMethod and WebParam annotation to the session bean to control the WSDL.

When you change one of these annotations you can get an deployment compiler error like

weblogic.utils.AssertionError: ***** ASSERTION FAILED ***** Caused by: java.lang.ClassNotFoundException: nl.amis.model.services.ScottSessionBean_esxgzy_WSOImpl
at weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:297).

To fix this you need to remove the EJBCompilerCache folder located in MiddlewareJDevPS5\jdeveloper\system11.1.1.5.37.60.13\DefaultDomain\servers\DefaultServer\cache

Also in Eclipselink I used getResultList() and return a list instead of using GetSingleResult(). With GetSingleResult you get an error when there is no result. So you need to handle that when you use it.
At last we can also remove the Web Service annotations from the Session Bean, create a new class and maybe do Contract first . ( this will fix the EJBcompiler errors and keeps it more clean.) In this class I inject the Session Bean to a private variable and call it's ejb methods.
Now you can run it and test the EJB Web Service.

Change the log files location of a WebLogic Domain

2011-07-05T19:55:00.000+02:00

In a default WebLogic Domain you can have various WebLogic logfiles located at different locations. For administrators it can be hard to find them all and these log files can have and grow to a large file size which can lead to a full file system. In this blogpost we will move these log files to one location.

For example when we take a look at the logs folder of the AdminServer you will see off course the WebLogic server log called AdminServer.log , the domain log in this case base_domain.log, access.log for the HTTP request logging and the FMW log called AdminServer-diagnostic.log.

At a managed server logs folder location you can also see the server1.out and server1.out00001 log files. These files are created by the NodeManager when we start the Managed servers from the WebLogic Console.

First let's move the Domain log.

Then change the General log file for all the WebLogic Servers.

Also do this for the HTTP access.log and rename the logfile to servername_access.log else it will conflict with the other servers.

To control the NodeManager standard and error output of the Managed Servers you need set the following weblogic.Stdout weblogic.Stderr parameters. Add these parameters to the argument field of all the managed server which will be started by the NodeManager.

When you enable at least the JRF or the Enterprise Manager option on your domain you need to change the location of the FMW log files. Go the Enterprise Manager Application and select all the Managed Servers.

Click on odl-handler and press the Edit Configuration.

Change the path of the log file.

Now you have one location which contains all the log files.

Publish to EDN from java & OSB with JMS

2011-06-21T12:39:00.000+02:00

My previous blogpost was about how to configure the SOA Suite EDN for JMS ( EDN-JMS ) instead of AQ (EDN-DB) and in this blogpost I will show you how you can publish events from Java and OSB.

Before we start you should know that we can only make Remote Event Connections because you are running the Java or OSB process in a different JVM then the SOA Suite. And only asynchronous subscriptions will be supported for remote event connections.

First let's create a Java Client which publish the events directly to the SOA Suite Server. I will use the jars of the SOA Suite. This is not necessary. You can just publish a JMS text message and set some JMS Header properties (MessageType and SideCar )

Make a new JDeveloper project which contains the following libraries.

Here is my test class.
And this will produce the following event on the EDN Queue.

The second part of this blogpost is how to do this in OSB.
Before we can work on the Proxy or Business Service we need to create a Foreign JNDI Provider on the WebLogic Service. ( You can also use a JNDI Provider of the OSB Configuration project )

Provide the SOA Server details.

Provide the local and remote EDN-JMS JNDI Link names. The Remote JNDI Names are fixed but you can change your local ones.

Restart the OSB Server and open OEPE or the SBConsole.

Create a new Business Service and choose for Messaging Service as Service Type.

Event is an One Way Operation so only need to set the Request Message Type to text.

Use the Local JNDI names of the Foreign JNDI Provider in the Endpoint URI

Select Text as Message Type.

Create a Proxy Service which call this Business Service, where we will replace the Body contents with the event data and set some JMS Headers in the Transport Header.

Replace the body contents in a Replace Action.

My test event, the values of Id and ecid element contains unique UUID values.

And the last part is to set the Messagetype and SideCar JMS Headers

MessageType is always Remote
SideCar in my case

<business-event-sidecar xmlns:ns="http://schemas.oracle.com/events/edl/EmployeeEventEDL"
xmlns="http://oracle.com/fabric/sideCar">
<name xmlns="http://oracle.com/fabric/businessEvent">ns:EmployeeEvent-sidecar</name>
</business-event-sidecar>

You can test the Proxy Service in the SBConsole.

Configure and test JMS based EDN in SOA Suite 11g

2011-06-21T00:27:00.001+02:00

Beside the default AQ implementation it is also possible to use a JMS Queue for EDN. When you use the JMS implementation in SOA Suite 11g instead of AQ, it can be easier to publish an event from a Java Web application, WebLogic SAF, MDB or from OSB. In this blogpost I will show you how to configure EDN-JMS and how to publish an Event to this JMS Queue.

When you take a look at the SOAJMSModule located at the JMSModules of WebLogic you can see that the module already contains an EDN Queue and an EDN ConnectionFactory.

So you only need to configure SOA Suite so it uses this Queue and Connection Factory. To do so open the enterprise manager application | SOA | soa-infra and open the Common Properties Menu item of the SOA-Infrastructure menu. Click on More SOA-Infra Advanced Configuration Properties

This will open the System MBean Browser. In this we can change the EdnJmsMode and set this to true.

Restart the SOA Server and take a look at the monitoring of the EDN Queue. Here you must see there are some Queue Consumers

Second part of this blog is to publish a event. For this I made a simple Employee Id XSD which can be published.

Create a SOA Project and add a Mediator with a One Way Operation which uses this XSD. Also expose this Mediator so you can invoke this operation from the Enterprise Manager.

Add a routing rule and choose for an Event.

Define an Employee Event.

Add a transformation and map the source and destination elements

Your composite will look like this. Deploy the composite to the SOA Server.

To see the event you need to pause the consumption of the EDNQueue.

Open the Enterprise Manager and test the service of the EDN composite.

Go back to the EDNQueue and look at the JMS Message. It contains some SOA instance tracing elements and has a MessageType JMS Header which defines the EDN mode.

In the following documentation you can read about, how to create a Foreign JNDI provider on your ADF server so you can publish JMS EDN events from an ADF Client.

38.3.6 How to Configure JMS-based EDN Implementations

In one of the future blogposts I will publish an JMS event from a Java Client.

Building with Maven in JDeveloper 11gR2

2011-06-13T01:10:00.002+02:00

With JDeveloper 11gR2 you can use Maven 2 as your build engine, before 11gR2 you could download a plugin which did not work great because all the required Oracle libraries which were not available in a public repository. So you had no choice to add them manually to a Maven Repository before you can use Maven. With 11gR2 Oracle fixed that by adding your projects libraries to the local Maven Repository when you add a Pom.xml to your projects.

Using Maven in JDeveloper is not that simple and I hope that this blogpost can help you to use maven as your buidtool.

First check if you have in your user profile a folder called .m2 . This folder must contain a settings.xml file ( you can copy it from jdeveloper\apache-maven-2.2.1\conf ) And also add a sub folder called repository.

Select for example your model project and add a Maven POM for Project to this project

You will get a POM overview which matches with your project.

This will add the libraries of the model project to your local Maven repository.

Now you can do the same for the ViewController project.

The only thing missing is the application workspace POM.xml which build all workspace projects. Add the Application POM to your workspace.

Don't enable Generate POM for Projects in this Application because we already did that.

This Application POM is located in the Application Resources window and only contains the Model and ViewController references,

In the project options or when you select the POM.xml you can change the Maven settings

Add some extra Maven goals to your project.

or add some extra Maven Repositories, like your company one.

Too bad indexing the Maven repositories ends in a error. Even when I use my own repository. You can ignore this error.

This is fixed in the 11gR2 patch and now it is working fine.

Now its time to build your project by running the Maven Package Goal.

The Model project was no problem.

The ViewControler project was different.

First I got a Apacle Trinidad error ( the ADF Faces Runtime needs a Trinidad pom )
Cannot find parent: org.apache.myfaces.trinidad:trinidad for project: null:trinidad-api:jar:null for project null:trinidad-api:jar:null

You can try to add and remove the right dependency ( oracle.jdeveloper.library:ADF-Faces-Runtime-11:pom:11.1.2.0.0 ), maybe this will fix it.

This is fixed in the 11gR2 patch and now it is working fine.

In the Maven setting you can Add or Remove the library dependency.

You will get a message that the local repository will be updated.

In case of the Apache Trinidad error. I need to update the trinidad pom in my local repository and remove the missing parent and move the groupId and version element,

This is fixed in the 11gR2 patch and now it is working fine.

<groupId>org.apache.myfaces.trinidad</groupId>
<version>2.0.0.1-SNAPSHOT</version>
<artifactId>trinidad-impl</artifactId>
<packaging>jar</packaging>

and so it goes on and on. Also need to do this for the 2 RichClient Faces POMs located in .m2\repository\oracle\adf\view\faces
Somehow the parent POM of the Oracle and Apache POMs are not added to the local repository.

And it would be great if Oracle made a option to force the synchronization of all the Jdeveloper libraries ( disc space is not a problem anymore and make it complete ) and even a option to export these POMs to your own Maven Repository.

The ViewController project has a dependecy with the model project so you need to make sure that the ViewController project can find the Model jar. To do so I will add my own Maven Repository to all the projects.

Change the Settings.xml of Apache Maven or of your local Maven repository and the add the username password which can upload the model artifact.

In the Model POM add a Distribution so Maven can upload the model artifact.

The ViewController can now find the Model dependency and you can create the WAR. This is a big one (130) because it adds all the reference jar to the web-inf/lib. You need to control this by deselecting the export option in the Maven project dependency.

To solve the Apache Trinidad dependency you need to add the Apache repository on the ViewController maven repositories. Add https://repository.apache.org/content/repositories/snapshots/ as url
Open the ADF-Faces-Runtime-11-11.1.2.0.0.pom located in .m2\repository\oracle\jdeveloper\library\ADF-Faces-Runtime-11\11.1.2.0.0\ and change the Trinidad dependency from 2.0.0.1-SNAPSHOT to 2.0.0.3-SNAPSHOT
The 2.0.0.1-SNAPSHOT does not exists in the Apache repository anymore.

This is fixed in the 11gR2 patch and now it is working fine.

Do the same for Trinidad-Runtime-11-11.1.2.0.0.pom located at .m2\repository\oracle\jdeveloper\library\Trinidad-Runtime-11\11.1.2.0.0

This is fixed in the 11gR2 patch and now it is working fine.

Also got a Maven Package Goal error when I run this Package Goal twice. It is solved when I do a clean first.
Cannot construct org.apache.maven.plugin.war.util.WebappStructure as it does not have a no-args constructor

message : Cannot construct org.apache.maven.plugin.war.util.WebappStructure as it does not have a no-args constructor
cause-exception : com.thoughtworks.xstream.converters.reflection.ObjectAccessException
cause-message : Cannot construct org.apache.maven.plugin.war.util.WebappStructure as it does not have a no-args constructor
class : org.apache.maven.plugin.war.util.WebappStructure
required-type : org.apache.maven.plugin.war.util.WebappStructure
path : /webapp-structure
line number : 1

Using the EJB or Java Datacontrol in ADF Rich Faces

2011-06-08T23:17:00.000+02:00

In my previous blogspot I showed you the new JDeveloper 11gR2 EJB and ADF DataControl features and in this blogpost I will use this EJB or Java DataControl in a JSF page.

I made a simple EJB model project which uses the dept and emp tables of the Scott schema. This project also contains with a Session Bean on which I generated an ADF DataControl.

When you open the DataControls.dcx in your model project and select one of your DataControl entries you can click on the edit button. This will open and generate an ADF entity xml in which you can change some properties.
We will add a new Named Criteria in which you can search on a particular location of the department. This criteria can be used in a Query Panel.

The criteria dialog, where I add the location attribute of the dept entity and compare it with a bind variable.

When we switch to the ViewController project, you will see this criteria in the DataControl Window.

Drag All Queriable Attributes on the JSF Page and choose for ADF Query Panel with Table.

You can run this page and in the top right Combobox you can select your criteria, next the bind variable will be shown on the query panel.

The saving of your own custom queries in the MDS store is not working (yet) with this DataControl. You will get a viewobject error. And I can't define a list of values on an attribute, so no nice combobox in the query panel.

The second part of this blogpost will show you, how you can change a department of a employee. Here you can see that the employee entity has the department entity as attribute( no dept_id attribute).

Drag the empFindAll operation on the page and choose for ADF Form

You can see that there is no combobox option for the department entity but you can include its attributes.

On runtime it will look like this.

I removed the entity attributes of Dept and drag the dept attribute from the DataControl on the Form and choose for ADF Select One Choice.

The Base Data Source is the dept entity inside the Employee entity and add a new other department operation as List Data Source

Add the data mapping and display some department attributes.

This time a combobox is displayed and you can change the department on the employee

That's all for now.

EJB and ADF Java or EJB DataControl features in JDeveloper 11gR2

2011-06-07T23:16:00.001+02:00

Today Oracle released JDeveloper 11gR2 and it's time to do a testdrive on the new EJB, JPA and ADF JAVA or EJB Datacontol R2 features. Last Open World I had a great meeting about these features with Frank Nimphius and one of the developer who made this happen. So I am very curious about this new release.

We start with the Model project and do Create Entities from Tables to add some entities to the model project.

In the wizard you can disable the discovering of Foreign Keys and generate a toString method on the entity

An overview of the entity attributes with it's types.

You can define and change the entity mappings, no need to do it in the persistence.xml wizard.

The persistence.xml entity editor has some extra configuration windows like the locking, Caching, Installation, Converters and the Advanced window

The generation of a SDO Service Interface on the Bean used to go very wrong ( start it by generating service interface on the session bean). Now I only have to fix the response elements of the SessionBean XSD with the right types ( but this is so easy because the property editor of jdeveloper can see the imported types).

Next step is to add an EJB Session Bean and generate an ADF DataControl on the remote interface.
Here you can see that there are no ADF xml Entity files.

Unless you want to change the default values. Select one of the methods and press the edit button

The editor is much better and the attribute windows contains a lot of new options like Validations Rules, Add a Transiet Attribute.

You can add Attribute Checks or Rules just like ADF BC

Add your own View Criteria ( like in a viewobject of ADF BC ) which you can use in a Query Panel

And the last feature for now, is the JNDI url for the remote EJB in the web.xml of your Web application. before 11gR2 you should use a foreign JNDI provider or change with ANT the provider-url in the ejb-definition. Now when you drag the EJB DataControl into your web application then JDeveloper adds a ejb-ref entry to the web.xml but also add a new env-entry with the EJB DataControl name so you can provide the t3 url in the web.xml. The web.xml can be changed in a weblogic deployment plan.

<env-entry>
<env-entry-name>ScottSessionEJB-provider-url</env-entry-name>
<env-entry-type>java.lang.String</env-entry-type>
<env-entry-value>t3://127.0.0.1:7101</env-entry-value>
</env-entry>
<ejb-ref>
<ejb-ref-name>ejb/ScottSessionEJB</ejb-ref-name>
<ejb-ref-type>Session</ejb-ref-type>
<remote>nl.whitehorses.ejbdc.model.services.ScottSessionEJB</remote>
<ejb-link>ScottSessionEJB</ejb-link>
</ejb-ref>

That's all for Part 1, next time we can gonna use the ADF EJB DataControl in a JSF Page.

OSB Endpoint monitoring and SLA alert rules

2011-05-01T18:16:00.000+02:00

The Oracle Service Bus got some nice features to monitor its endpoints, see if they are still online and you can enable these Proxy and Business Service endpoints in the Operations view of the SBConsole. In OSB you can also make a SLA alert rule to reports these endpoint changes to the SBConsole, send a mail , SNMP trap or publish on a JMS queue.

These options are not enabled by default, you need to do the steps, I describe in this blogpost..

When you create or deployed some new Proxy and Business Services you won't see these endpoints in the Service Health Tab of the Operations View.

When you open the Operation Settings of the Business or Proxy Service you will see that monitoring is not activated by default.

Create a new Session and change the monitoring setting.

When you go back to the Service Health Tab of the Operations view you will now see that the Endpoint of this Business Service is still Online.

Click on the Online link and you will see that the Action link is not enabled.

If you work with the OEPE workshop you can also enable monitoring by opening the Business or Proxy Service in a text editor and change this setting manually.

When you disable the endpoint and take a look at the Service Health, you will now see that the endpoint is Offline

Click on the Offline link

When you know the endpoint is active again you can press the Action link and the OSB will check it for you and enable it again.

Next step is to make a SLA alert rule so can monitor and report the endpoints changes.
Open the SLA Alert Rules Tab of the Proxy and Business Service.

Create a new Rule and assign an alert Destination

Select Status for the endpoints monitoring. Make a rule for online and offline Endpoints.

You will now see these alerts in the SLA Alerts Tab of the Operations window of the SBConsole.