| | 313 | |
|---|
| | 314 | <section> |
|---|
| | 315 | <title>JBoss AS listening ports customization</title> |
|---|
| | 316 | |
|---|
| | 317 | <para>The common task for JBoss users is making it to communicate over a |
|---|
| | 318 | single HTTP server. This is quite useful for network administration, |
|---|
| | 319 | making it easier to go through firewalls. This section describes the |
|---|
| | 320 | necessary steps to make JBoss communicate primarily over HTTP</para> |
|---|
| | 321 | |
|---|
| | 322 | <section> |
|---|
| | 323 | <title>Tomcat Web server</title> |
|---|
| | 324 | |
|---|
| | 325 | <para>JBoss is shipped with built-in Tomcat web server. This server is |
|---|
| | 326 | configured in 'deploy/jbossweb-tomcat55.sar/server.xml' By default |
|---|
| | 327 | only two connectors are enabled: HTTP connector (port 8080) and AJP |
|---|
| | 328 | connector (port 8009). Generally speaking you need only one of them. |
|---|
| | 329 | The former connector is needed if standalone HTTP server built in |
|---|
| | 330 | JBoss is used. You may want to configure it to listen the default HTTP |
|---|
| | 331 | port 80. The latter connector is needed only if you want to couple |
|---|
| | 332 | JBoss server with external web server like Apache, in this case it is |
|---|
| | 333 | reasonable, for security issues to change the binding address to |
|---|
| | 334 | 'localhost' (of course if Apache runs on the same host).</para> |
|---|
| | 335 | </section> |
|---|
| | 336 | |
|---|
| | 337 | <section> |
|---|
| | 338 | <title>HTTP invoker web application</title> |
|---|
| | 339 | |
|---|
| | 340 | <para>The JBoss default configuration deploys a special service that |
|---|
| | 341 | can be used to expose different JBoss services in the HTTP server. It |
|---|
| | 342 | is located in 'deploy/http-invoker.sar'. The configuration file |
|---|
| | 343 | 'deploy/http-invoker.sar/META-INF/jboss-service.xml' may be tweaked to |
|---|
| | 344 | tune the AS to specific needs. By default the service provides HTTP |
|---|
| | 345 | invoker MBean for EJB ('jboss:service=invoker,type=http') and two HTTP |
|---|
| | 346 | proxy MBeans that marshal the requests to the Naming service MBean |
|---|
| | 347 | ('jboss:service=invoker,type=http,target=Naming' and |
|---|
| | 348 | 'jboss:service=invoker,type=http,target=Naming,readonly=true'). If you |
|---|
| | 349 | need to provide HTTP interface to another MBeans, you also may specify |
|---|
| | 350 | the proxy services in |
|---|
| | 351 | 'deploy\http-invoker.sar\META-INF\jboss-service.xml'. For instance the |
|---|
| | 352 | SRP service for JBoss authentication may be exposed here.</para> |
|---|
| | 353 | |
|---|
| | 354 | <para>The service also deploys web application |
|---|
| | 355 | 'deploy/http-invoker.sar/invoker.war', that configures the servlets |
|---|
| | 356 | that convert HTTP requests into invocation of MBeans/EJB methods. If |
|---|
| | 357 | you add HTTP proxies to MBeans, you may need to add servlets that |
|---|
| | 358 | handle the corresponding URI.</para> |
|---|
| | 359 | |
|---|
| | 360 | <para>Important note. If HTTPS protocol is used the configuration |
|---|
| | 361 | should not use the default host name because the virtual host name |
|---|
| | 362 | used in the URL (say 'www.nuxeo.org') and exposed in SSL certificates |
|---|
| | 363 | usually differs from the computer name where JBoss is running. To |
|---|
| | 364 | accomplish this get rid of the following attributes: InvokerURLPrefix, |
|---|
| | 365 | InvokerURLSuffix, UseHostName, replacing them with a single InvokerURL |
|---|
| | 366 | attribute, like this:</para> |
|---|
| | 367 | |
|---|
| | 368 | <programlisting><mbean code="org.jboss.invocation.http.server.HttpProxyFactory" |
|---|
| | 369 | name="jboss:service=invoker,type=https,target=Naming"> |
|---|
| | 370 | <!-- Compose the invoker URL from the cluster node address --> |
|---|
| | 371 | <attribute name="InvokerURL"> |
|---|
| | 372 | https://www.nuxeo.org/invoker/JMXInvokerServlet |
|---|
| | 373 | </attribute> |
|---|
| | 374 | <attribute name="ExportedInterface"> |
|---|
| | 375 | org.jnp.interfaces.Naming |
|---|
| | 376 | </attribute> |
|---|
| | 377 | <attribute name="JndiName"></attribute> |
|---|
| | 378 | <attribute name="ClientInterceptors"> |
|---|
| | 379 | <interceptors> |
|---|
| | 380 | <interceptor>org.jboss.proxy.ClientMethodInterceptor</interceptor> |
|---|
| | 381 | <interceptor>org.jboss.proxy.SecurityInterceptor</interceptor> |
|---|
| | 382 | <interceptor>org.jboss.naming.interceptors.ExceptionInterceptor</interceptor> |
|---|
| | 383 | <interceptor>org.jboss.invocation.InvokerInterceptor</interceptor> |
|---|
| | 384 | </interceptors> |
|---|
| | 385 | </attribute> |
|---|
| | 386 | <depends>jboss:service=invoker,type=https</depends> |
|---|
| | 387 | </mbean> |
|---|
| | 388 | <!-- The rest MBeans should also use InvokerURL attribute only, |
|---|
| | 389 | make sure you specify the right host name |
|---|
| | 390 | --></programlisting> |
|---|
| | 391 | </section> |
|---|
| | 392 | |
|---|
| | 393 | <section> |
|---|
| | 394 | <title>JNDI service</title> |
|---|
| | 395 | |
|---|
| | 396 | <para>This is the core service of JBoss and should never be disabled. |
|---|
| | 397 | Nevertheless this service does not need own listening port |
|---|
| | 398 | (1099,1098), so just change the '1099' to '-1':</para> |
|---|
| | 399 | |
|---|
| | 400 | <programlisting><mbean code="org.jboss.naming.NamingService" |
|---|
| | 401 | name="jboss:service=Naming" |
|---|
| | 402 | xmbean-dd="resource:xmdesc/NamingService-xmbean.xml"> |
|---|
| | 403 | <!-- The call by value mode. true if all lookups are unmarshalled using |
|---|
| | 404 | the caller's TCL, false if in VM lookups return the value by reference. |
|---|
| | 405 | --> |
|---|
| | 406 | <attribute name="CallByValue">false</attribute> |
|---|
| | 407 | <!-- The listening port for the bootstrap JNP service. Set this to -1 |
|---|
| | 408 | to run the NamingService without the JNP invoker listening port. |
|---|
| | 409 | --> |
|---|
| | 410 | <attribute name="Port">-1</attribute> |
|---|
| | 411 | <!-- The bootstrap JNP server bind address. This also sets the default |
|---|
| | 412 | RMI service bind address. Empty == all addresses, use localhost to hide this from |
|---|
| | 413 | network |
|---|
| | 414 | --> |
|---|
| | 415 | <attribute name="BindAddress">localhost</attribute> |
|---|
| | 416 | <!-- The port of the RMI naming service, 0 == anonymous, you cannot use -1 here --> |
|---|
| | 417 | <attribute name="RmiPort">1098</attribute> |
|---|
| | 418 | <!-- The RMI service bind address. Empty == all addresses, use localhost to hide this from |
|---|
| | 419 | network |
|---|
| | 420 | --> |
|---|
| | 421 | <attribute name="RmiBindAddress">localhost</attribute> |
|---|
| | 422 | <!-- The thread pool service used to control the bootstrap lookups --> |
|---|
| | 423 | <depends optional-attribute-name="LookupPool" |
|---|
| | 424 | proxy-type="attribute">jboss.system:service=ThreadPool</depends> |
|---|
| | 425 | </mbean></programlisting> |
|---|
| | 426 | </section> |
|---|
| | 427 | |
|---|
| | 428 | <section> |
|---|
| | 429 | <title>Default JBoss EJB invokers</title> |
|---|
| | 430 | |
|---|
| | 431 | <para>You may deinstall the JRMP and Pooled invokers completely. Just |
|---|
| | 432 | comment out the MBeans that provide the corresponding services in |
|---|
| | 433 | 'conf/jboss-service.xml'.</para> |
|---|
| | 434 | |
|---|
| | 435 | <para>Important note. The JBoss specifies the invokers for EJB in |
|---|
| | 436 | 'conf/standardjboss.xml' file. The default is |
|---|
| | 437 | 'jboss:service=invoker,type=jrmp' invoker. To change it to HTTP |
|---|
| | 438 | invoker you need to add invoker bindings for all EJB types deployed in |
|---|
| | 439 | your applications. Generally it means you need to copy all |
|---|
| | 440 | "*-rmi-invoker" bindings into "*-http-invoker" bindings, replacing |
|---|
| | 441 | "<invoker-mbean>jboss:service=invoker,type=jrmp</invoker-mbean>" |
|---|
| | 442 | with |
|---|
| | 443 | "<invoker-mbean>jboss:service=invoker,type=http</invoker-mbean>" |
|---|
| | 444 | for the new bindings. Also you will need to make the HTTP invoker |
|---|
| | 445 | default for all EJB container configurations replacing |
|---|
| | 446 | "<invoker-proxy-binding-name>*-rmi-invoker</invoker-proxy-binding-name>" |
|---|
| | 447 | with |
|---|
| | 448 | "<invoker-proxy-binding-name>*-http-invoker</invoker-proxy-binding-name>" |
|---|
| | 449 | correspondingly.</para> |
|---|
| | 450 | |
|---|
| | 451 | <para>The easiest (but probably not the right) way for JBoss 4.0.x is |
|---|
| | 452 | to replace the string 'jboss:service=invoker,type=jrmp' with |
|---|
| | 453 | 'jboss:service=invoker,type=http' in this file by any text editor. It |
|---|
| | 454 | may be not correct if you want to mix both invokers for your |
|---|
| | 455 | EJBs.</para> |
|---|
| | 456 | </section> |
|---|
| | 457 | |
|---|
| | 458 | <section> |
|---|
| | 459 | <title>JBoss EJB3 invoker</title> |
|---|
| | 460 | |
|---|
| | 461 | <para>The EJB3 invoker which is specified in |
|---|
| | 462 | 'deploy/ejb3.deployer/META-INF/jboss-service.xml' uses JBoss remoting |
|---|
| | 463 | mechanism. By default it is bound to socket with a connector listening |
|---|
| | 464 | TCP/IP port 3873. This should be changed to the servlet |
|---|
| | 465 | locator:</para> |
|---|
| | 466 | |
|---|
| | 467 | <programlisting><mbean code="org.jboss.remoting.transport.Connector" |
|---|
| | 468 | name="jboss.remoting:type=Connector,name=DefaultEjb3Connector,handler=ejb3"> |
|---|
| | 469 | <depends>jboss.aop:service=AspectDeployer</depends> |
|---|
| | 470 | <attribute name="InvokerLocator"> |
|---|
| | 471 | servlet://${jboss.bind.address}/invoker/Ejb3InvokerServlet |
|---|
| | 472 | </attribute> |
|---|
| | 473 | <attribute name="Configuration"> |
|---|
| | 474 | <handlers> |
|---|
| | 475 | <handler subsystem="AOP">org.jboss.aspects.remoting.AOPRemotingInvocationHandler</handler> |
|---|
| | 476 | </handlers> |
|---|
| | 477 | </attribute> |
|---|
| | 478 | </mbean></programlisting> |
|---|
| | 479 | |
|---|
| | 480 | <para>The corresponding servlet should be added to invoker web |
|---|
| | 481 | application descriptor |
|---|
| | 482 | ('http-invoker.sar/invoker.war/WEB-INF/web.xml'):</para> |
|---|
| | 483 | |
|---|
| | 484 | <programlisting><servlet> |
|---|
| | 485 | <servlet-name>Ejb3InvokerServlet</servlet-name> |
|---|
| | 486 | <description> |
|---|
| | 487 | The ServerInvokerServlet receives requests via HTTP protocol |
|---|
| | 488 | from within a web container and passes it onto the |
|---|
| | 489 | ServletServerInvoker for processing. |
|---|
| | 490 | </description> |
|---|
| | 491 | <servlet-class> |
|---|
| | 492 | org.jboss.remoting.transport.servlet.web.ServerInvokerServlet |
|---|
| | 493 | </servlet-class> |
|---|
| | 494 | <init-param> |
|---|
| | 495 | <param-name>locatorUrl</param-name> |
|---|
| | 496 | <param-value> |
|---|
| | 497 | servlet://${jboss.bind.address}/invoker/Ejb3InvokerServlet |
|---|
| | 498 | </param-value> |
|---|
| | 499 | <description> |
|---|
| | 500 | The servlet server invoker locator url |
|---|
| | 501 | </description> |
|---|
| | 502 | </init-param> |
|---|
| | 503 | <load-on-startup>1</load-on-startup> |
|---|
| | 504 | </servlet> |
|---|
| | 505 | <servlet-mapping> |
|---|
| | 506 | <servlet-name>Ejb3InvokerServlet</servlet-name> |
|---|
| | 507 | <url-pattern>/Ejb3InvokerServlet/*</url-pattern> |
|---|
| | 508 | </servlet-mapping></programlisting> |
|---|
| | 509 | </section> |
|---|
| | 510 | </section> |
|---|
| | 511 | |
|---|
| | 512 | <section> |
|---|
| | 513 | <title>Affected JBoss services</title> |
|---|
| | 514 | |
|---|
| | 515 | <para>As JRMP invoker is used in many other JBoss services, so it should |
|---|
| | 516 | be replaced. The affected MBeans are |
|---|
| | 517 | "jboss:service=ClientUserTransaction" (conf/jboss-service.xml), |
|---|
| | 518 | "jboss.jmx:type=adaptor,name=Invoker,protocol=jrmp,service=proxyFactory".</para> |
|---|
| | 519 | |
|---|
| | 520 | <section> |
|---|
| | 521 | <title>Client User Transaction</title> |
|---|
| | 522 | |
|---|
| | 523 | <para>The Client User Transaction service depends on two JRMP Proxy |
|---|
| | 524 | Factories described in the nested MBeans. Every JRMP proxy factory |
|---|
| | 525 | should be replaced with HTTP proxy factory:</para> |
|---|
| | 526 | |
|---|
| | 527 | <programlisting><mbean |
|---|
| | 528 | code="org.jboss.tm.usertx.server.ClientUserTransactionService" |
|---|
| | 529 | name="jboss:service=ClientUserTransaction" |
|---|
| | 530 | xmbean-dd="resource:xmdesc/ClientUserTransaction-xmbean.xml"> |
|---|
| | 531 | <depends> |
|---|
| | 532 | <mbean code="org.jboss.invocation.http.server.HttpProxyFactory" |
|---|
| | 533 | name="jboss:service=proxyFactory,target=ClientUserTransactionFactory"> |
|---|
| | 534 | <attribute name="InvokerName">jboss:service=invoker,type=http</attribute> |
|---|
| | 535 | <attribute name="JndiName">UserTransactionSessionFactory</attribute> |
|---|
| | 536 | <attribute name="ExportedInterface"> |
|---|
| | 537 | org.jboss.tm.usertx.interfaces.UserTransactionSessionFactory |
|---|
| | 538 | </attribute> |
|---|
| | 539 | <attribute name="ClientInterceptors"> |
|---|
| | 540 | <interceptors> |
|---|
| | 541 | <interceptor>org.jboss.proxy.ClientMethodInterceptor</interceptor> |
|---|
| | 542 | <interceptor>org.jboss.invocation.InvokerInterceptor</interceptor> |
|---|
| | 543 | </interceptors> |
|---|
| | 544 | </attribute> |
|---|
| | 545 | <depends>jboss:service=invoker,type=http</depends> |
|---|
| | 546 | </mbean> |
|---|
| | 547 | </depends> |
|---|
| | 548 | <depends optional-attribute-name="TxProxyName"> |
|---|
| | 549 | <mbean code="org.jboss.invocation.http.server.HttpProxyFactory" |
|---|
| | 550 | name="jboss:service=proxyFactory,target=ClientUserTransaction"> |
|---|
| | 551 | <attribute name="InvokerName">jboss:service=invoker,type=http</attribute> |
|---|
| | 552 | <attribute name="JndiName"></attribute> |
|---|
| | 553 | <attribute name="ExportedInterface"> |
|---|
| | 554 | org.jboss.tm.usertx.interfaces.UserTransactionSession |
|---|
| | 555 | </attribute> |
|---|
| | 556 | <attribute name="ClientInterceptors"> |
|---|
| | 557 | <interceptors> |
|---|
| | 558 | <interceptor>org.jboss.proxy.ClientMethodInterceptor</interceptor> |
|---|
| | 559 | <interceptor>org.jboss.invocation.InvokerInterceptor</interceptor> |
|---|
| | 560 | </interceptors> |
|---|
| | 561 | </attribute> |
|---|
| | 562 | <depends>jboss:service=invoker,type=http</depends> |
|---|
| | 563 | </mbean> |
|---|
| | 564 | </depends> |
|---|
| | 565 | </mbean></programlisting> |
|---|
| | 566 | |
|---|
| | 567 | <para>Note that JRMP Proxy factory attributes differ from attributes |
|---|
| | 568 | of HTTP proxy factory.</para> |
|---|
| | 569 | </section> |
|---|
| | 570 | |
|---|
| | 571 | <section> |
|---|
| | 572 | <title>JMX adaptor</title> |
|---|
| | 573 | |
|---|
| | 574 | <para>The JMX adaptor is adapted for HTTP as following |
|---|
| | 575 | ('deploy/jmx-invoker-service.xml'):</para> |
|---|
| | 576 | |
|---|
| | 577 | <programlisting><mbean code="org.jboss.invocation.http.server.HttpProxyFactory" |
|---|
| | 578 | name="jboss.jmx:type=adaptor,name=Invoker,protocol=http,service=proxyFactory"> |
|---|
| | 579 | <attribute name="InvokerURL">https://www.nuxeo.org/invoker/JMXInvokerServlet</attribute> |
|---|
| | 580 | <depends optional-attribute-name="InvokerName">jboss.jmx:type=adaptor,name=Invoker</depends> |
|---|
| | 581 | <attribute name="ExportedInterface">org.jboss.jmx.adaptor.rmi.RMIAdaptor</attribute> |
|---|
| | 582 | <attribute name="JndiName">jmx/invoker/HttpAdaptor</attribute> |
|---|
| | 583 | </mbean></programlisting> |
|---|
| | 584 | |
|---|
| | 585 | <para>and ('deploy/console-mgr.sar/META-INF/jboss-service.xml'):</para> |
|---|
| | 586 | |
|---|
| | 587 | <programlisting><mbean code="org.jboss.console.manager.PluginManager" |
|---|
| | 588 | name="jboss.admin:service=PluginManager"> |
|---|
| | 589 | <depends>jboss.jmx:type=adaptor,name=Invoker,protocol=http,service=proxyFactory</depends> |
|---|
| | 590 | <!-- the rest stays intact --> |
|---|
| | 591 | </mbean></programlisting> |
|---|
| | 592 | </section> |
|---|
| | 593 | |
|---|
| | 594 | <section> |
|---|
| | 595 | <title>Datasource adaptors</title> |
|---|
| | 596 | |
|---|
| | 597 | <para>You need to set the invoker explicitly for all deployed data |
|---|
| | 598 | sources. The element <jmx-invoker-name> should be added to all |
|---|
| | 599 | <local-tx-datasource> and <xa-datasource> elements. Otherwise the server will |
|---|
| | 600 | complain about missing JRMP invoker which is used by default:</para> |
|---|
| | 601 | |
|---|
| | 602 | <programlisting><datasources> |
|---|
| | 603 | ... |
|---|
| | 604 | <local-tx-datasource> |
|---|
| | 605 | <!-- specify explicitly the invoker to use --> |
|---|
| | 606 | <jmx-invoker-name>jboss:service=invoker,type=https</jmx-invoker-name> |
|---|
| | 607 | <!-- the rest stays intact --> |
|---|
| | 608 | ... |
|---|
| | 609 | </local-tx-datasource> |
|---|
| | 610 | ... |
|---|
| | 611 | </datasources></programlisting> |
|---|
| | 612 | </section> |
|---|
| | 613 | </section> |
|---|
