Monday, December 17, 2012

Monitoring JDBC Datasource Runtime Attributes using WLST

In weblogic server , we can monitor the JDBC resources easly with WLST.

See how can ?
Step 1 :- Set the environment
C:\bea103\user_projects\domains\testdomain\bin>setDomainEnv.bat
Step 2:- Connect to server and browse to the JDBCDataSourceRuntime MBean
C:\bea103\user_projects\domains\testdomain>java weblogic.WLST
Initializing WebLogic Scripting Tool (WLST) …
Welcome to WebLogic Server Administration Scripting Shell
Type help() for help on available commands
wls:/offline> connect()
Please enter your username [weblogic] :
Please enter your password [weblogic] :
Please enter your server URL [t3://localhost:7001] :t3://localhost:7003
Connecting to t3://localhost:7003 with userid weblogic …
Successfully connected to managed Server ‘MS0′ that belongs to domain ‘testdomain′.
Warning: An insecure protocol was used to connect to the
server. To ensure on-the-wire security, the SSL port or
Admin port should be used instead.
wls:/testdomain/serverConfig> serverRuntime()
Location changed to serverRuntime tree. This is a read-only tree with ServerRunt
imeMBean as the root.
For more help, use help(serverRuntime)
wls:/testdomain/serverRuntime> cd(‘JDBCServiceRuntime’)
wls:/testdomain/serverRuntime/JDBCServiceRuntime> cd(‘MS0′)
wls:/testdomain/serverRuntime/JDBCServiceRuntime/MS0> cd(‘JDBCDataSourceRuntimeMBeans’)
wls:/testdomain/serverRuntime/JDBCServiceRuntime/MS0/JDBCDataSourceRuntimeMBeans> cd(‘MyDs’)
gaRules> cmo.getActiveConnectionsCurrentCount()
1
The other JDBC Datasource Runtime attributes that can be monitored are listed below.
wls:/testdomain/serverRuntime/JDBCServiceRuntime/MS0/JDBCDataSourceRuntimeMBeans/PegaRules> ls()
dr– JDBCDriverRuntime
dr– LastTask
dr– WorkManagerRuntimes
-r– ActiveConnectionsAverageCount 1
-r– ActiveConnectionsCurrentCount 0
-r– ActiveConnectionsHighCount 5
-r– ConnectionDelayTime 627
-r– ConnectionsTotalCount 5
-r– CurrCapacity 5
-r– CurrCapacityHighCount 4
-r– DeploymentState 2
-r– Enabled true
-r– FailedReserveRequestCount 0
-r– FailuresToReconnectCount 0
-r– HighestNumAvailable 5
-r– HighestNumUnavailable 0
-r– LastTask null
-r– LeakedConnectionCount 0
-r– ModuleId PegaRules
-r– Name PegaRules
-r– NumAvailable 5
-r– NumUnavailable 0
-r– PrepStmtCacheAccessCount 11852
-r– PrepStmtCacheAddCount 420
-r– PrepStmtCacheCurrentSize 50
-r– PrepStmtCacheDeleteCount 370
-r– PrepStmtCacheHitCount 11432
-r– PrepStmtCacheMissCount 420
-r– Properties {serverName=localhost, SID=prpc612, portNumber=1521, user=SYSTEM}
-r– ReserveRequestCount 11844
-r– State Running
-r– Type JDBCDataSourceRuntime
-r– VersionJDBCDriver oracle.jdbc.OracleDriver
-r– WaitSecondsHighCount 0
-r– WaitingForConnectionCurrentCount 0
-r– WaitingForConnectionFailureTotal 0
-r– WaitingForConnectionHighCount 0
-r– WaitingForConnectionSuccessTotal 4
-r– WaitingForConnectionTotal 0
-r– WorkManagerRuntimes null
-r-x clearStatementCache Void :
-r-x dumpPool Void :
-r-x dumpPoolProfile Void :
-r-x forceShutdown Void :
-r-x forceSuspend Void :
-r-x poolExists Boolean : String(name)
-r-x preDeregister Void :
-r-x reset Void :
-r-x resume Void :
-r-x shrink Void :
-r-x shutdown Void :
-r-x start Void :
-r-x suspend Void :
-r-x testPool String

How to a Create Active Directory Authentication Provider from WLST in Weblogic


Step 1 – Set the environment
C:\Oracle\Middleware\user_projects\domains\TestDomain\bin>setDomainEnv.cmd
Step 2 – Create a new Admin Account
C:\Oracle\Middleware\user_projects\domains\TestDomain>java weblogic.security.utils.AdminAccount weblogic welcome123 .
Note: Don’t forget to add a dot(.) at the end.
Step 3 – Verify the creation of a new DefaultAuthenticatorInit.ldift file.
C:\Oracle\Middleware\user_projects\domains\TestDomain>dirDirectory of C:\Oracle\Middleware\user_projects\domains\TestDomain
11/29/2010  10:27 AM    <DIR>          .
11/29/2010  10:27 AM    <DIR>          ..
10/27/2010  10:56 AM    <DIR>          autodeploy
10/27/2010  10:56 AM    <DIR>          bin
10/27/2010  10:56 AM    <DIR>          config
10/27/2010  10:56 AM    <DIR>          console-ext
11/29/2010  10:27 AM             3,380 DefaultAuthenticatorInit.ldift
10/29/2010  12:25 PM               156 edit.lok
10/27/2010  10:56 AM               472 fileRealm.properties
10/27/2010  10:56 AM    <DIR>          init-info
10/27/2010  10:56 AM    <DIR>          lib
10/29/2010  12:25 PM    <DIR>          pending
10/27/2010  10:56 AM    <DIR>          security
10/29/2010  12:11 PM    <DIR>          servers
10/27/2010  10:56 AM               318 startWebLogic.cmd
10/27/2010  10:56 AM               270 startWebLogic.sh
10/29/2010  12:25 PM    <DIR>          tmp
               5 File(s)          4,596 bytes
              12 Dir(s)  47,722,737,664 bytes free
You will see a DefaultAuthenticatorInit.ldift in the domain directory
Step 5 – Use the new DefaultAuthenticatorInit.ldift
Go to the following location
C:\Oracle\Middleware\user_projects\domains\TestDomain\security
Rename the existing DefaultAuthenticatorInit.ldift and place the DefaultAuthenticatorInit.ldift file in this directory that we just created.
Step 6 – Rename ldap directory
Now go to the following location.
C:\Oracle\Middleware\user_projects\domains\TestDomain\servers\AdminServer\data
Note:- This will delete all your existing users/groups so it is recomended to export the security realm data, or export the users.
Step 7 – Delete boot.properties file
Rename ldap directory to something else.
Delete the boot.properties file from the following location
C:\Oracle\Middleware\user_projects\domains\TestDomain\servers\AdminServer\security
Step 8- Start your Weblogic Server  using startWebLogic.cmd and provide the credentials at the prompt.
Enter username to boot WebLogic server: weblogic
Enter password to boot WebLogic server: welcome123
Step 9 - Log in to Weblogic Console using the new admin user.

How we can provide custom authentication for apache webserver

How we can achive ?
Create authen.txt with the username and password separated by colon
authen.txt
sampleuser : sampleuser
Then use the htpasswd to encrypt the password
Apache2\bin>htpasswd.exe -b authen.txt  sampleuser sampleuser 
Automatically using MD5 format.
Updating password for user testuser
Add the following in the httpd.conf file present in C:\Program Files\Apache Group\Apache2\bin
LoadModule weblogic_module modules/mod_wl128_20.so
<Location />
SetHandler weblogic-handler
WebLogicHost localhost
WebLogicPort 7001
Debug ALL
WLLogFile c:/Saple/wlproxy.log
WLTempDir c:/Saple
AuthUserFile C:/Saple/ authen.txt
AuthName “This is a protected area” 
AuthType Basic 
Require valid-user
</Location>
Also copy WL_HOME\server\plugin\win\32\mod_wl_22.so to C:\Program Files\Apache Group\Apache2\modules
Restart the Apache Server.
Now if we try to access any unprotected resource on Weblogic Server, a BASIC Authentication Window will be popped up for authentication against Apache.
If authentication is successful, the request will go through provided we set the following in the config.xml
<enforce-valid-basic-auth-credentials>false</enforce-valid-basic-auth-credentials>
Otherwise Weblogic Server will try to validate the BASIC authentication Header.

Configuring two way SSL between Client and Weblogic server with Apache proxying the request.


Configure Apache for SSL
Create the certificates using openssl (present in apache_home\bin) using the below steps:
openssl genrsa -des3 -out server.key 1024
openssl req -config ..\conf\openssl.cnf -new -key server.key -out localhost
openssl x509 -req -days 730 -in localhost -signkey server.key -out server.crt
Add the following in the httpd.conf file
<IfModule ssl_module>
SSLRandomSeed startup builtin
SSLRandomSeed connect builtin
</IfModule>
Listen 443
<VirtualHost *:443>
SSLEngine on
SSLCertificateFile “C:\Program Files\Apache Group\Apache2\conf\server.crt”
SSLCertificateKeyFile “C:\Program Files\Apache Group\Apache2\conf\server.key”
SSLCACertificateFile “C:\Documents and Settings\Administrator\Desktop\cert\IntermediateCA.cer”
#SSLLog “C:\Program Files\Apache Group\Apache2\conf\ssl.log”
#SSLLogLevel debug
</VirtualHost>
Configure SSL between Apache and Weblogic Server
Add the following in the Location Directive
SecureProxy ON
TrustedCAFile C:\bea101\wlserver_10.0\server\lib\CertGenCA.pem
RequireSSLHostMatch false
Configure Apache to Request for Client Certificate
Add the following in the Location Directive
SSLVerifyClient optional_no_ca
SSLOptions +ExportCertData
Configure Weblogic Server for 2-way SSL
mydomain> Servers> myserver>Keystores & SSL > Advanced Options
Hostname Verification: None
Two Way Client Cert Behavior: Client Certs Requested but not enforced
Apache_SSL> Domain Wide Security Settings> Realms> myrealm> Authentication Providers> DefaultIdentityAsserter
Trusted Client Principals: provide CN of the Client Certificate
Types: X509
Details:
Use Default User Name Mapper: Checked
Default User Name Mapper Attribute Type: CN
Base64Decoding Required: Checked
Go the security realm and create a user wih the username as CN of the certificate
Add the following in the config.xml
<Server ClientCertProxyEnabled=”true”
Configure the Web Application
The Web Application should require client cert authentication.
Add the following in the web.xml
<context-param>
<param-name>weblogic.httpd.clientCertProxy</param-name>
<param-value>true</param-value>
</context-param>
Add the following in the weblogic.xml
<principal-name> CN of the certificate</principal-name>

Don’t want to get prompted for confirmation in WebLgic Console?

If you are using WebLogic Admin console frequently to configure the services or to manage the life cycle of the servers, you might have seen a confirmation prompt before changes. 

This action prompt would not come up when you are running the domain in development mode. 
If you are running the domain in production mode they will ask confirmation for all the operations. 

There used to be no way to disable this confirmation page prior WebLogic Server 10.3. 

Now in WebLogic Server 10.3 and higher you can set a console user preference that can disable these confirmation pages.

Use the tool bar at the center (top) of the console to go to the "Preferences". 

Under the "User Preferences" tab you will find an option called "Ask for confirmation in operations". 

By default it will be enabled in production domains and you can disable it to avoid that annoying confirmation pages where will have to click either "Yes" or "No". 

While you are there explore the other useful preferences like "Show Inline Help" and "Show Advanced Sections" which can buy some real-estate space in the console and save you some clicks.






Change in WebLogic Server HTTP Session Failover Logic With Proxy Plug-ins

When using HTTP Sessions with WebLogic Cluster, you can ensure high availability for your session by configuring HTTP Session Replication. For the replication strategy, you have many options to select from like In-memory, file, JDBC, Cookie etc. 

When you are using in-memory replication with a web server to front WebLogic Server Cluster, the proxy plug-in must be configured on the web servers.

The proxy plug-ins are intelligent enough to stick the request from a client to the same server where the session is hosted. 

A secondary copy of the session will be sent to a backup server by the primary server. 

This information will be written to a cookie or encoded in the URL depending on the client's configuration to support cookies.



In the past, during failure of the primary server, the proxy plug-in on the web server will redirect the request to the secondary/backup server. This resulted in increased traffic to the secondary/backup server. So somewhere during the Weblogic Server 9.x the plug-ins are updated to do a random routing incase of failures. 

The proxy server will randomly distribute all the requests from the failed server to different servers that are still running in the cluster. When the request from the existing clients (with valid session id) gets redirected to servers that are not secondary server then that server will connect to the secondary server for that client and will pull the session to become primary server. 

This ensures that one server will not get overloaded when a server in a cluster fails.



The same exact strategy was used when you front a WebLogic cluster with a load balancing hardware as not all the load balancing hardware understand the WebLogic cluster configuration.

 Now the same strategy is applied to the WebLogic Cluster front by a proxy plug-in hosted on a web server. This make the failover strategy consistent whether you have hardware or a software based proxy in front a WebLogic Cluster.

WebLogic Server documentation is still not updated to reflect this change under the "Proxy Failover Procedure" section. If you are running WebLogic Cluster with 9.x and you are not seeing this behavior then you can contact Oracle Support to find out whether there is a patch that can you can apply for your current WebLogic implementation.

Easy Syntax with WLST

WLST is a powerful scripting solution for managing and administering WebLogic Server and resources deployed on them. WLST is built on the Java implementation of the scripting language Python called as Jython.

 All the commands in WLST are implemented as Jython functions and they require a set of parentheses for passing any arguments. Even any commands that do not require any arguments are supposed to be suffixed with parentheses. For example the command "ls" is used to list all the child MBeans and/or attributes of the current MBean you are at.

ls() - lists all the child MBeans and attributes
ls('a') - lists all the attribute names and values only
ls('c') - lists all the child MBeans only

So even if you want to invoke "ls" with no arugments you must use "ls()". This might not be an issue when you are building scripts that you might want to run many times. But while connected to a server and working with WLST in interactive mode, it might get a little frustated to type the parentheses everytime you want to run some simple commands with no arguments. To ease this pain there is a hidden option in WLST which can be used to ease the syntax for WLST commands - easeSyntax().



You can supply the "easeSyntax()" command to ease the syntax but this is not recommended for script mode and especially when using loop constructs. You can also use the regular Jython syntax with parentheses even after you enabled the easy syntax. To turn off the easy syntax mode simply issue the command again "easeSyntax".