RE: Orion Client jar files for remote application client
Pedro, This is the minimum list: orion.jar activation.jar jndi.jar ejb.jar Its also a good idea to include a jar with the home and remote interfaces of the ejb's you will be using. With kind regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Pedro Garcia Lopez Sent: Tuesday, May 14, 2002 1:13 PM To: Orion-Interest Subject: Orion Client jar files for remote application client Hi all, Unlike many other application servers like jboss, Orion does not officially provide a list of jar files required to run remote Java Application clients. This enforces developers to include a lot of files found in the Orion root directory. Are there any plans to provide a minimum set of jar files required for remote applicacion clients ? orion-client.jar, orion-jndi.jar ... Thank you in advance Pedro
RE: Dynamic Proxies for remote interface wrapper?
The orion-ejb-jar has the wrapper class noted. You can replace this class with your own, as long as you forward to the wrapper. With kind regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Pletka, John Sent: Monday, May 13, 2002 12:25 PM To: Orion-Interest Subject: Dynamic Proxies for remote interface wrapper? I'm trying to integrate a third-party security product that allows rules like "can only call methodX on objectY between 9:00 am and 5:00 pm". It ties into Weblogic and WebSphere cleanly, but does not have a way to get into orion. What I would like to be able to do is either: 1) setup my ejb-jar.xml file to point to a Dynamic Proxy class that could do the security checks before forwarding the call on to the real class 2) or somehow override the wrappers that orion generates with my own code. Does anyone know of a way to do this? I can see the java code orion creates for the wrappers (RemoteInterfaceName_StatelessSessionBeanWrapperXXX.java.) That would be a perfect place to place the code if it was allowed. It looks like it uses a class "com.evermind.server.RuntimeSecurityRole" to test whether the call is allowed or not. I could probably hack this class and override the logic, but I would think there would be a legitimate way of accomplishing this.
RE: Linux + Orion + IBM DB2
Denis, Take a look at this message, it may help you. Specifically, you need to use a db2.xml schema in your config/data-base-schemas directory, and refer to this schema in your data-sources.xml file. I would also test out your network configuration by using a jdbc client (netbeans, for example, has an excellent client for jdbc in the netbeans ide). http://www.mail-archive.com/orion-interest%40orionserver.com/msg16991.html With kind regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Denis Litvinov Sent: Saturday, May 11, 2002 9:53 PM To: Orion-Interest Subject: Linux + Orion + IBM DB2 Hello! Can anyone describe in details a running configuration of the subject? I try to deploy an application which works on Windows perfectly. But on Linux Orion sometimes can't start up normally (it seems a deadlock), sometimes it gives out errors like SQL10007N (DB2) etc. I think the problem is in configuration, but don't know how to configure properly. The application with HSQL works fine. Denis
RE: XSL and Sitemesh on Orion
retry ... -Original Message-From: The elephantwalker [mailto:[EMAIL PROTECTED]]Sent: Monday, April 22, 2002 8:59 AMTo: Orion-Interest; [EMAIL PROTECTED]Subject: RE: XSL and Sitemesh on Orion Dear Peter, Theres a bug in sitemesh so that only jsp files work. I believe that xsl would have the same limitation. I reported this on sourceforge. There's an easy fix to this:http://sourceforge.net/tracker/index.php?func=detail&aid=534456&group_id=9890&atid=109890andhttp://sourceforge.net/tracker/index.php?func=detail&aid=534772&group_id=9890&atid=109890Of course you will need to make the changes in the sitemesh code, and re-build it, but that's a snap. I would attach the fix on elephantwalker, but I am unclear about the Opensymphony license...any way the links above give the exact changes necessary to make this work.Regards,the elephantwalkerwww.elephantwalker.com -Original Message-From: [EMAIL PROTECTED][mailto:[EMAIL PROTECTED]]On Behalf Of Peter BeckSent: Monday, April 22, 2002 5:11 AMTo: Orion-InterestSubject: XSL and Sitemesh on OrionI am using OpenSymphony Sitemesh on Orion Application Server 1.5.4.The Orion XSL servlet (default config in global-web-application.xml)is used to transform XML files to HTML.The transformation works fine, but the transformed HTML is no longerpassed to the sitemesh filter and is displayed without layout.What can I do to make this work?Does anybody have a hint, please?Peter--Peter Beck, JOANNEUM RESEARCH Forschungsges.m.b.H.[EMAIL PROTECTED]
RE: [orion-interest]CMP/BMP and standard JDBC, speed is of essence
>Entity bean caching I have found to be remarkably useless. First of >all, it depends on a pessimistic locking strategy, which is both hard to >use (gotta love those deadlock exceptions!) and not applicable to a >clustered environment or any environment in which the database table can >be modified from an external source. Furthermore, finder methods are >not cached - and with an eager loading strategy, I really have to wonder >what the great advantage of the caching is... bringing all the bean data >back usually isn't that much more expensive than bringing just the PK >data back, and if it is (because of large data fields) then your cache >is going to have size problems anyways. The latest oc4j release has four different load-locking strategies to choose from, and you can be sure these will make it into Orion. pessimistic, old-pessimistic, optimistic, and read-only. There are also stategies for timing out instances for ejb's. >Irrespective of who may be a smarter developer, I can guarantee you that >I know a *lot* more about *my* specific business logic than Karl or >Magnus. Furthermore, Karl and Magnus are for the most part just >implementing a specification produced by a committee of labcoats >dedicated to a lowest-common-denominator set of features that IBM, BEA, >Borland, Sybase, & the rest of the implementers can agree to. The >absence of ORDER BY in EJB-QL and the lack of a standard PK generation >mechanism make me seriously wonder if any of the people writing the EJB >spec have ever used it to implement a real-world application. I believe they are also on some of these committees. They have also implemented a far better finder language than ejb-ql, and you can use ORDER BY in the orion-ejb-jar.xml. Brett McLaughlin has published a truely excellent strategy for producing pk's. Go to flashline.com to see Brett's column on this. regards, the elephantwalker www.elephantwalker.com
RE: [orion-interest]CMP/BMP and standard JDBC, speed is of essence
You will find that if you want the _enterprise_ features offered by cmp with straight jdbc calls, your classes for jdbc calls will be slower than cmp, and _much more_ difficult to develop. I am not a smarter developer than Karl or Magnus. Their algorithms for caching, transaction management, pooling (connection, threads, objects, you name it), are among the best in the business. If I were to _attempt_ to reproduce these features, I would certainly _fail_ to reproduce these features in a reasonable time. There will always be a place for jdbc in an enterprise application. But in an enterprise application where the transaction is as important as the data, and the data structure itself may change from time to time, cmp ejbs are the way to go. A resultset relies on datastructure strings, and are closely coupled with the underlying database structure. All my experience indicates that the datastructure will change many times during a project, after the project is finished, and before the application is retired. jdbc is tightly linked with the datastructure. This link goes to a low level, as many text strings need to be modified when the datastructure changes. Argh! Don't get caught in the performance trap where you application performance increases by 2%, but its almost impossible to change your application without competely rewriting it. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jeff Schnitzer Sent: Saturday, April 06, 2002 10:41 PM To: Orion-Interest Subject: RE: [orion-interest]CMP/BMP and standard JDBC, speed is of essence > From: Hani Suleiman [mailto:[EMAIL PROTECTED]] > Sent: Saturday, April 06, 2002 6:20 PM > To: Orion-Interest > Subject: Re: [orion-interest]CMP/BMP and standard JDBC, speed is of > essence > > CMP will load in all the entities in one go (in orion at least). > > There will be a performance difference between straight JDBC and EJB, > since > there's more involved with an EJB query. Transactions, constructing > entities > and so on are extra overhead that just getting a resultset back will not > have. If you use JDBC from a connection obtained from a DataSource in a Session bean, all queries should have the transaction attributed defined for the Session bean method. You do not need entity beans to have transactions. > So if done right, CMP will be close in speed to straight JDBC, plus you > have > the potential for more goodies like container caching of finders and > entities and so on, that you'd get for 'free' in some new version of your > favourite container, if it doesn't do so already! There's that "if done right" problem. If Orion (or any other app server) backed the Collection returned by a finder with the ResultSet itself (instead of producing ArrayLists), then it seems like performance wouldn't be too much different from JDBC. Of course, you're going to have all the overhead of constructing entity bean objects and loading them with all the data (ok, maybe part of the data if you're using WebLogic or other container with field groups), but it shouldn't be too dramatic compared to the remote database call. I don't know if there is a technical problem with doing this or if other containers do this, but Orion doesn't seem to be that smart. So yeah, entities are going to be slower, especially if you're listing 1000's of them. EJB-QL, even if Orion supported it, is only going to make things worse. It's an abstraction above SQL. All the hints and other database-specific goodies that you can normally encode in a SQL statement cannot be used. And you can't order the result set with EJB QL, so sorting has to be done outside the database (yeah, right!). I have found that a good approach to data access is to model your data using CMP entity beans, use them for write access, and code in JDBC whenever you need listing behavior that CMP is too slow or too inflexible to support. By far the biggest problem is that "too inflexible" part, IMHO... modeling relationship attributes, performing aggregation queries, or querying for data that spans multiple objects simply does not fit into the world of entity beans. This criticism seems to apply to just about any O/R mapping scheme... which is why I think they are useful, but should not be taken too seriously. A good example of this "hybrid" approach is the Punk Image Gallery sample application for the Maverick MVC framework: http://mav.sourceforge.net/pig. It is a comprehensive sample J2EE application which runs on Orion. It's not a trivial sample; my friends and I actually use a live instance to archive (and annotate, wiki-like) our images. There is *no* way it could perform reasonably with pure entity beans. Jeff Schnitzer [EMAIL PROTECTED] Consu
RE: CMP 2.0 vs BMP - Which performes better?
See my earlier post on this thread. You can use custom finders with _extreme_ ease in Orion. I gave an example for Oracle (since Oracle does not _have_ the sql LIMIT statement). For other databases, you could use a LIMIT statement in your custom finder. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of prasanth sb Sent: Friday, April 05, 2002 7:20 AM To: Orion-Interest Subject: RE: CMP 2.0 vs BMP - Which performes better? Hi Jeff and other dear friends, I had this doubt in my mind very earlier. When we load very large amount of data from the database, how it can be handled? If we use result sets and iterate, this is going to take a long time? How can we limit the number of records that is present in the memory at a time? thanks, Prasanth. >From: "Jeff Schnitzer" <[EMAIL PROTECTED]> >Reply-To: Orion-Interest <[EMAIL PROTECTED]> >To: Orion-Interest <[EMAIL PROTECTED]> >Subject: RE: CMP 2.0 vs BMP - Which performes better? >Date: Thu, 4 Apr 2002 16:22:17 -0800 > > > From: Curt Smith [mailto:[EMAIL PROTECTED]] > > > > > There are several constraints to BMP beans which make them almost >always > > > perform slower than CMP beans. In particular, the inability to bulk > > > load beans from finder methods is a nearly fatal defect. > > > > I'd like to know more of the details? > > > > How does the container deal with the following finder in CMP > > differently than BMP? > > > > Collection remoteRefs = home.findSalaryGreaterThan ( "50,000"); > >Lets assume this produces 1000 results which you then iterate through. > >With BMP beans, this will require 1001 database queries. First the >finder, then 1000 selects to load each bean. > >With CMP, it's actually rather ambiguous what will happen. Last time I >checked, Orion will load all the beans into an ArrayList. Yes, lots of >memory consumed, but a *lot* better than 1001 database hits. Admittedly >a bigger problem with orders of magnitude more objects, but even with >BMP you're going to choke if the finder query returns a billion rows of >primary key data. > >Some containers (not Orion, I don't think) allow you to specify that >finders should lazy-load beans. But this brings you back to BMP >performance. Some containers allow you to define "field groups" to >minimize the amount of data brought back (especially useful if you store >blobs), but not Orion. > >Personally, I don't understand why containers don't implement >Collections backed by the ResultSet directly. 98% of the time, the >client just creates an iterator and walks the results. If the client >does something that the ResultSet can't support, build the full >Collection. > >Jeff Schnitzer >[EMAIL PROTECTED] > _ MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx
RE: CMP 2.0 vs BMP - Which performes better?
Curt, I don't know anybody that uses the vanilla findAll() in a cmp finder. In orion, it is _extremely_ easy to add a customer finder findAll that has a limit. Here is my findAll for Oracle(oracle doesn't have LIMIT): somebean findAll int int You could likewise use a stored procedure in the for even greater speed. With these finders, cmp _rocks_! regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Curt Smith Sent: Thursday, April 04, 2002 9:21 AM To: Orion-Interest Subject: Re: CMP 2.0 vs BMP - Which performes better? > There are several constraints to BMP beans which make them almost always > perform slower than CMP beans. In particular, the inability to bulk > load beans from finder methods is a nearly fatal defect. I'd like to know more of the details? How does the container deal with the following finder in CMP differently than BMP? Collection remoteRefs = home.findSalaryGreaterThan ( "50,000"); Or what was the scenario you where refering to? To me the finder returns a collection problem is but one of the damning EJB achilies heals, in that the spec left out setting the max row count to limit the find collection to. How does CMP help the huge memory and CPU and JNDI hit that a boundless findAll() causes? Thanks, curt
RE: Orion user management
Dear Randahl, To logout a user, you must have a session context associated with your application. For example, if your swing client is accessing ejb's, the swing client can access everything through a stateful session bean. Session beans have a session context associated with them... regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Randahl Fink IsaksenSent: Wednesday, April 03, 2002 1:08 AMTo: Orion-InterestCc: [EMAIL PROTECTED]Subject: Orion user management Hi Peter I was just wondering: In your search for user management methods have you ever come across a logout() method? It seems odd to me, that there is only a login method on the role-manager interface – if you are dealing with an application client (e.g. a Swing client) instead of a regular web client you log the user in using the role-manager login() method, but there seems to be no means for logging the user out again. Thanks for your time Randahl
RE: Orion EJB 2.0 final
Simon, An Oracle manager told me last November that they wouldn't have ejb-ql until the summer, but Oracle is saying this is out in the _latest_ jdeveloper version. Getting a handle on which version is actually released by Oracle and which is "early access" is a bit dodgy. IIOP is also supposed to be in the latest "early access" version of Oracle. The other vendors play similar games, as I don't believe weblogic 7.0 is yet _released_. Ironflare is much more clear on this point, since Ironflare's website clearly indicates that 1.5.2 only meets ejb 1.1 with some support for ejb 2.0 public draft (this is ancient in j2ee time, since the pd was out _two_ years ago), and the changes.txt of the 1.5.4 experimental version indicates conformance with "features" of ejb 2.0, but does not mention total compatibility with ejb 2.0. If you have a test ejb with ejb-ql (say from Ed Roman's book), why don't you test it out in this latest version from Oracle oc4j or 1.5.4. It may work. regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Simon Stewart Sent: Wednesday, March 27, 2002 9:20 AM To: Orion-Interest Subject: Re: Orion EJB 2.0 final Apologies, I probably didn't make myself sufficiently clear. With EJB 2.0, aren't finder queries meant to be specified in the ejb-jar.xml file using EJB-QL? Consequently, Orions's lack of support for EJB-QL means that it's currently not possible to write portable CMP EJBs. Yes, I realise that you can get the orion-ejb-jar.xml file and edit the finders in that, but one of the touted benefits of the latest release of J2EE is that CMP is now a lot more portable between app servers, and doing that destroys this benefit. Or have I missed something? Still finding my feet with J2EE programming, so if anyone wants to set me straight, I'd appreciate it. On Wed, Mar 27, 2002 at 04:07:43AM -0800, Ray Harrison wrote: > Simon - > No its not tricky, I write them all the time. Orion has always had a rather= > sophisticated finder > mechanism to provide (at least) some of the functionality of ejb-ql. And I = > haven't worked with the > JBoss 3.0 beta so I can't comment there. > > Cheers > Ray > --- Simon Stewart <[EMAIL PROTECTED]> wrote: > > On Tue, Mar 26, 2002 at 04:36:44PM -0800, The elephantwalker wrote: > > > sans ejb-ql, 1.5.4 is compatible. > > > > Silly question, but doesn't this make writing EJB 2.0 CMP beans a > > little tricky? And if it's not too far off topic, how does JBoss > > compare? Cheers, Simon -- Every little bit of seaweed kelps.
RE: Orion EJB 2.0 final
sans ejb-ql, 1.5.4 is compatible. I understand from some Oracle types that ejb-ql will be out later this summer. many-many is broken in 1.5.4, but Magnus et al indicate its fixed in bugzilla for 1.5.5 regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Michael Maurer Sent: Monday, March 25, 2002 9:18 AM To: Orion-Interest Subject: Orion EJB 2.0 final Hi, does anyone know when Orion will be 100% EJB 2.0 compatible including local/remote inerfaces EJB-QL ... Michael
RE: EJB failover/replication?
Michael, Orion has a loadbalancer for the web-tier, and this has failure detection, and is http session aware. If your application is deployed on several island's, your web-tier is virutally immortal. Likewise, entity beans and slsb ejb's deployed in the same vm's will be replicated. For beans which are deployed on remote machines, the Orion ormi has a built-in failover capability. If you provide a list of ormi servers in your rmi.xml file, Orion will try each one, in turn, if one is unavailable. So entity and slsb's have complete fail-over. However, most who use orion use ejb's in the same container as the web teir. Ormi can also be clustered using multi-casting. Oc4j has sfsb fail-over, as I have seen this demonstrated at Oracle Open World by Larry himself. I am still checking if this will work in 1.5.4. Key bit is the replication tag in the orion-ejb-jar.xml. Apparently, it only works for the default state. Oracle describes three different methods, vm shutdown replication, end of call replication and a homegrown method call replication. The EndOfCall replication attribute just blows up nicely, so it looks like they have broken this for orion 1.5.4. Still investigating, though. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Michael Crozier Sent: Thursday, March 21, 2002 2:07 PM To: Orion-Interest Subject: EJB failover/replication? Hello, I'm starting to evaluate Orion as a application server for a project and I'm trying to figure out if/how Orion supports EJB failover. Oracle/AS appears to, but I can't tell if thats a feature that they added on top of Orion. If EJB failover/replication is supported, could somebody point me to any documentation? Thanks, Michael
RE: Concurrent calls to Session bean methods
The sfsb has a _session_ which is bound to the client. So the client could be anywhere, irregardless of a cluster. oc4j has a last method state replication which makes sure that all sfsb's have the same _session_. A slsb wouldn't care, and doesn't have the same problem with concurrency, since they are not reentrant. regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Romen Law Sent: Thursday, March 21, 2002 2:33 PM To: Orion-Interest Subject: Re: Concurrent calls to Session bean methods ello, What if the application is deployed in a cluster (even the web tier)? Would that nullify the synchronised effect? cheers romen - Original Message ----- From: "The elephantwalker" <[EMAIL PROTECTED]> To: "Orion-Interest" <[EMAIL PROTECTED]> Sent: Thursday, March 21, 2002 3:47 PM Subject: RE: Concurrent calls to Session bean methods > John, > > Here is the offending class, compliments of the Sun Blueprint team: > > public class ShoppingClientControllerWebImpl implements WebClientController > { > > private ShoppingClientControllerLocal sccEjb; > private HttpSession session; > > public ShoppingClientControllerWebImpl() { > } > > // ... stuff... > // > > // the important bit ... > > public synchronized EventResponse handleEvent(Event ev) > throws EventException { > return sccEjb.processEvent(ev); > } > > } > > So you see that the webcontroller is the _only_ access to the sfsb. And the > only call is synchronized, thus preventing cocurrent calls to the stateful > session bean. > > regards, > > the elephantwalker > www.elephantwalker.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of > [EMAIL PROTECTED] > Sent: Wednesday, March 20, 2002 12:05 PM > To: Orion-Interest > Subject: RE: Concurrent calls to Session bean methods > > > > I haven't seen the history on this issue, but it interests me. I had a > quick look at the ShoppingClientControllerEJB class that is given as an > example by Sun in the Session Facade design pattern, but couldn't see where > they are synchronizing calls. Can you provide some more clues? > > Thanks, > > John H. > > > > "The elephantwalker" > <[EMAIL PROTECTED]> To: > [EMAIL PROTECTED] > Sent by: cc: > owner-orion-interest@orion Subject: RE: > Concurrent calls to Session bean methods > server.com > > > 03/19/02 10:31 PM > Please respond to > Orion-Interest > > > > > > > Vani, > > You can use the petstore trick. Use a facade class which sychronizes each > call to your session bean. That should do the trick. > > This is a _famous_ problem with session beans. > > regards, > > the elephantwalker > www.elephantwalker.com > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Vani H.S. > Sent: Wednesday, March 20, 2002 12:04 AM > To: Orion-Interest > Subject: Concurrent calls to Session bean methods > > > Hello All, > > I have been trying to deploy an application consisting of session beans > and mdbs onto orion1.5.4. > But I seem to run into deadlocks, because my session bean gets called > concurrently. Please can anybody can tell me if there is a setting to allow > concurrent calls so that, when a session bean method is called at one time, > the EJB container blocks the concurrent method call and allows it to > proceed > when the previous call has completed? > If not, how should this problem of concurrent calls be handled in orion? > Please help. > Thanks, > Vani > > > > > > The allow-concurrent-calls element specifies whether a stateful session > bean > instance allows concurrent method calls. By default, > allows-concurrent-calls > is false. However, when this value is set to true, the EJB container blocks > the concurrent method call and allows it to proceed when the previous call > has completed. > > > > > > _ > Join the world's largest e-mail service with MSN Hotmail. > http://www.hotmail.com > > > > > > > > >
RE: User Manager Questions
Anil, You might try looking at our tutorial on user security ... http://www.elephantwalker.com/rfa?id=404 You will need to get an account, but its free to join. Its important that bit in your applications is followed... META-INF/application.xml -->should have the j2ee roles, and java-application client. META-INF/orion-application.xml --> should have the group/role mapping META-INF/principals.xml ---> should have the groups listed which are in your user database, and permissions for their access ... regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Anil D Sent: Thursday, March 21, 2002 6:16 AM To: Orion-Interest Subject: User Manager Questions Hi all I have some questions regarding the use of UserManager I have implemented a custom User Manager in our application and specified it in the orion-application.xml. On server startup the init method of the UserManager is executed, but while trying to login from an Application Client(Swing) it wasnt going to any of the Methods in my Custom User Manager. It was only allowing the users in my principals.xml. Is it supposed to work this way? How do I allow the usernames in my databases to login? I also tried to use the RoleManager. But when I try to lookup RoleManager from the Client side it throws a name not found exception. TIA Anil
RE: Concurrent calls to Session bean methods
John, Here is the offending class, compliments of the Sun Blueprint team: public class ShoppingClientControllerWebImpl implements WebClientController { private ShoppingClientControllerLocal sccEjb; private HttpSession session; public ShoppingClientControllerWebImpl() { } // ... stuff... // // the important bit ... public synchronized EventResponse handleEvent(Event ev) throws EventException { return sccEjb.processEvent(ev); } } So you see that the webcontroller is the _only_ access to the sfsb. And the only call is synchronized, thus preventing cocurrent calls to the stateful session bean. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, March 20, 2002 12:05 PM To: Orion-Interest Subject: RE: Concurrent calls to Session bean methods I haven't seen the history on this issue, but it interests me. I had a quick look at the ShoppingClientControllerEJB class that is given as an example by Sun in the Session Facade design pattern, but couldn't see where they are synchronizing calls. Can you provide some more clues? Thanks, John H. "The elephantwalker" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Sent by: cc: owner-orion-interest@orion Subject: RE: Concurrent calls to Session bean methods server.com 03/19/02 10:31 PM Please respond to Orion-Interest Vani, You can use the petstore trick. Use a facade class which sychronizes each call to your session bean. That should do the trick. This is a _famous_ problem with session beans. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Vani H.S. Sent: Wednesday, March 20, 2002 12:04 AM To: Orion-Interest Subject: Concurrent calls to Session bean methods Hello All, I have been trying to deploy an application consisting of session beans and mdbs onto orion1.5.4. But I seem to run into deadlocks, because my session bean gets called concurrently. Please can anybody can tell me if there is a setting to allow concurrent calls so that, when a session bean method is called at one time, the EJB container blocks the concurrent method call and allows it to proceed when the previous call has completed? If not, how should this problem of concurrent calls be handled in orion? Please help. Thanks, Vani The allow-concurrent-calls element specifies whether a stateful session bean instance allows concurrent method calls. By default, allows-concurrent-calls is false. However, when this value is set to true, the EJB container blocks the concurrent method call and allows it to proceed when the previous call has completed. _ Join the world's largest e-mail service with MSN Hotmail. http://www.hotmail.com
RE: Concurrent calls to Session bean methods
Vani, You can use the petstore trick. Use a facade class which sychronizes each call to your session bean. That should do the trick. This is a _famous_ problem with session beans. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Vani H.S. Sent: Wednesday, March 20, 2002 12:04 AM To: Orion-Interest Subject: Concurrent calls to Session bean methods Hello All, I have been trying to deploy an application consisting of session beans and mdbs onto orion1.5.4. But I seem to run into deadlocks, because my session bean gets called concurrently. Please can anybody can tell me if there is a setting to allow concurrent calls so that, when a session bean method is called at one time, the EJB container blocks the concurrent method call and allows it to proceed when the previous call has completed? If not, how should this problem of concurrent calls be handled in orion? Please help. Thanks, Vani The allow-concurrent-calls element specifies whether a stateful session bean instance allows concurrent method calls. By default, allows-concurrent-calls is false. However, when this value is set to true, the EJB container blocks the concurrent method call and allows it to proceed when the previous call has completed. _ Join the worlds largest e-mail service with MSN Hotmail. http://www.hotmail.com
RE: AutoGen Primary Key for Entity Beans
Dear Michael, We answer this at: http://www.elepantwalker.com/rfa?id=327 You need an account, but its free to join. The Orion Counter is only useful if you have a single server. On a clustered set of orions, it won't hack it. We use a much better more portable way to generate keys. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Michael Shoemaker Sent: Saturday, March 16, 2002 6:57 AM To: Orion-Interest Subject: AutoGen Primary Key for Entity Beans I see on the orion support page the use of com.evermind.ejb.CounterUtils.getNextID(). Anyone use this? What does this method return? String? Long? Integer? http://www.orionsupport.com/articles/ejbuniquecounter.html _ Do You Yahoo!? Get your free @yahoo.com address at http://mail.yahoo.com
RE: Soap with Axis ?
Eddie, You might try the a recent thread on www.elephantwalker.com. We reproduced Bret McLaughlin's example (Java & XML, 2nd edition) with Orion and Apache SOAP 2.2. http://www.elephantwalker.com/rfa?id=399 Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Eddie Sent: Saturday, March 09, 2002 11:05 AM To: Orion-Interest Subject: Soap with Axis ? Hellu, Does anyone has an example descriptor of a web service to connect a client to a EJB through SOAP (Axis of Apache) ? Most os the examples I find are not based on Ejb connections and on the Atlassian site I saw a example for Apache Soap but I can't get it to work with Orion. Eddie
RE: Login username and password
Dear Prasanth, I have put together a simple set of lessons for user security...not to be confused with personalization. http://www.elephantwalker.com/rfa?id=404 You will need a password to see this, but its free to join the elephantwalker. I hope the lessons are easy to understand...after the first two lessons, you can configure your web application for login. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of prasanth sb Sent: Sunday, March 03, 2002 3:05 AM To: Orion-Interest Subject: Login username and password Dear friends, I have seen in many application servers a login username and password popping up for the entry allowing to the site. Will some one help in getting the informations regarding this with orion application server.Wish a good day. thanks, Prasanth _ MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx
RE: BigDecimal problem...
This could be your database-scheme. I notice that most of the database schemas that come with Orion (look at the config/database-schemas) do not include a field for java.math.BigDecimal. However, the SapDB.xml schema does. Copy this bit into your database schema, and this will probably fix your problem: Why aren't you using Long as the pk? Many who use orion use Long's. This could be why you found this problem, because you were the first to use a BigDecimal as a pk. If you are new to Orion, come join us at www.elephantwalker.com. We have the largest and oldest Orion forum on the web. regards, the elephantwalker www.elephantwalker.com .ps There is an excellent document on database schemas in Orion at: http://www.orionserver.com/docs/database-schema-configuration/database-schema-configuration.xml -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Nicolas Camut Sent: Saturday, March 02, 2002 5:47 AM To: Orion-Interest Subject: BigDecimal problem... Hi, I'm having a really annoying problem with Orion. I'm importing an application from Weblogic to Orion. It consists of basic CMP EntityBeans so that I can test whether I can port a much bigger application. Anyways, those Beans use BigDecimal as Primary keys. In the design of this application, some of those beans have a parenthood relationship as well as references to other beans. As the application should allow null parenthood for instance, the beans should store null value in the associated DB field. This being said, this test framework works fine with weblogic. As far as Orion is concerned, I get NullPointerExceptions when creating the beans, which by default have null references to other beans. As I found it weird I messed up with the automatically-generated classes -e.g. PersonBeanHome_EntityHomeWrapper14.java - and I found out that when a bean generates PreparedStatements and instanciates them, it checks whether String or Date fields are null and if so call the setNull(...) method, but does not for BigDecimal fields leading to the NullPointerException. Well, d'you have any idea how to walk round this? Thanks, Nicolas
RE: Database cursor in CMP/EJB
Yes, I'm doing this with cmps, no problem. See this post, somewhere down towards the middle, there's some code I use in the finder of orion-ejb-jar.xml: http://www.elephantwalker.com/rfa?id=383&page=2 regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Eddie Post Sent: Thursday, February 28, 2002 2:10 PM To: Orion-Interest Subject: RE: Database cursor in CMP/EJB >What are you trying to do? I want to scroll through data in the database, such that I only show a maximum of 50 items on the web page. I am using EJB CMP with a web part and Orion 1.5.2 with java 1.3.1 (trying 1.5.4 as well now) ;) Eddie >From: "The elephantwalker" <[EMAIL PROTECTED]> >Reply-To: Orion-Interest <[EMAIL PROTECTED]> >To: Orion-Interest <[EMAIL PROTECTED]> >Subject: RE: Database cursor in CMP/EJB >Date: Thu, 28 Feb 2002 08:38:56 -0800 > >Eddie, > >What are you trying to do? > >regards, > >the elephantwalker > > >-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]]On Behalf Of Eddie Post >Sent: Thursday, February 28, 2002 3:08 AM >To: Orion-Interest >Subject: Database cursor in CMP/EJB > > >Can someone please tell me how to implement a database cursor with EJB CMP >?? And if this isn't possible, how to do it with EJB EMP ? > >I was looking for info on the web but couldn't find any that can help me. > >Please some help ?? > >Eddie > > >_ >Chat with friends online, try MSN Messenger: http://messenger.msn.com > > > > _ MSN Photos is the easiest way to share and print your photos: http://photos.msn.com/support/worldwide.aspx
RE: Database cursor in CMP/EJB
Eddie, What are you trying to do? regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Eddie Post Sent: Thursday, February 28, 2002 3:08 AM To: Orion-Interest Subject: Database cursor in CMP/EJB Can someone please tell me how to implement a database cursor with EJB CMP ?? And if this isn't possible, how to do it with EJB EMP ? I was looking for info on the web but couldn't find any that can help me. Please some help ?? Eddie _ Chat with friends online, try MSN Messenger: http://messenger.msn.com
RE: jndi.properties and ApplicationClientInitialContextFactory
It was just pointed out to me that my link was bad...should be http://www.elephantwalker.com/rfa?id=178 regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of The elephantwalkerSent: Monday, February 25, 2002 1:05 PMTo: Orion-InterestSubject: RE: jndi.properties and ApplicationClientInitialContextFactory This question is answered here: http://www.elephantwalker.com/searchresult?id=178. Basically, you must have the orion.jar, plus the various j2ee helper libraries, to make your application client work with orion. regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Randahl Fink IsaksenSent: Monday, February 25, 2002 7:55 AMTo: Orion-InterestSubject: jndi.properties and ApplicationClientInitialContextFactory I noticed that when specifying the jndi properties in accordance with the orion documentation you include this line: java.naming.factory.initial=com.evermind.server.ApplicationClientInitialContextFactory Does this mean that the application client needs to have the mentioned class in its class path? If so, how do you make this class available to the client – I think having the client application include all of the huge orion.jar (which contains this class) seems a bit awkward, and if you can use this class on its own I wonder why it is located in orion.jar. Randahl
RE: jndi.properties and ApplicationClientInitialContextFactory
This question needs to be directed to Ironflare AB. However, the pricing seems to say "...per server" and not "...per client or server." regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Brendan McKenna Sent: Tuesday, February 26, 2002 1:06 AM To: Orion-Interest Subject: Re: jndi.properties and ApplicationClientInitialContextFactory Hi, Does the requirement to install orion.jar with every instance of the client application mean that you have to (in a commercial environment) purchase an Orion license for each seperate instance of the client you want to run. In other words, if I want to run 10 instances of my client, plus 1 of the server itself, how many licenses do I need to buy, 1 or 11? Brendan -- Brendan McKenna [EMAIL PROTECTED] Senior Partner Hallway Software Design Corp.
RE:
RoleManager is a facade interface to UserManager. It goes something like this: RoleManager <---> UserManager <> LDAP So when you add a role, it is added to the LDAP datastore, not just for the session. You can of course remove the role when you log the user out, and it has the effect of only adding the role during the session. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Min-Hua Luo Sent: Monday, February 25, 2002 2:09 PM To: Orion-Interest Subject: RE: Hi, Thanks a lot for your response. The username, password, and group information are stored in LDAP server for my project. Does roleManager.addToRole update LDAP server group information at the same time? Or it is just add this user to a role for current session only? (That is, once session is gone, this user still does not belongs to gold_account role). Thank you very much. --- The elephantwalker <[EMAIL PROTECTED]> wrote: > The addToRole() function will add a principal to > another role. For example, > if you have a gold_account role, and all your user > (principal) is only a in > the user_account role, you can add them to the > gold_account role with > something like this... > > roleManager.addToRole(principal,"gold_account"); > > you will get an error if the role "gold_account" > does not exist in your > web.xml or application.xml or ejb-jar.xml. > > Regards, > > the elephantwalker > www.elephantwalker.com > > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On > Behalf Of Min-Hua Luo > Sent: Friday, February 15, 2002 4:28 PM > To: Orion-Interest > Subject: > > > Hi, > > I am confused by RoleManager.addToRole() function. > It says "Adds a principal to the specified role, in > practice this usually implies adding the principal > to > the legacy groups the role encompasses". Since all > roles are defined in web.xml ( tag), > does addToRole() function will actually update my > web.xml file and add a new role to ? > If > not, what file(s) does addToRole() will update? > Thanks > a lot. > > __ > Do You Yahoo!? > Yahoo! Sports - Coverage of the 2002 Olympic Games > http://sports.yahoo.com > > > __ Do You Yahoo!? Yahoo! Sports - Coverage of the 2002 Olympic Games http://sports.yahoo.com
RE: jndi.properties and ApplicationClientInitialContextFactory
This question is answered here: http://www.elephantwalker.com/searchresult?id=178. Basically, you must have the orion.jar, plus the various j2ee helper libraries, to make your application client work with orion. regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Randahl Fink IsaksenSent: Monday, February 25, 2002 7:55 AMTo: Orion-InterestSubject: jndi.properties and ApplicationClientInitialContextFactory I noticed that when specifying the jndi properties in accordance with the orion documentation you include this line: java.naming.factory.initial=com.evermind.server.ApplicationClientInitialContextFactory Does this mean that the application client needs to have the mentioned class in its class path? If so, how do you make this class available to the client – I think having the client application include all of the huge orion.jar (which contains this class) seems a bit awkward, and if you can use this class on its own I wonder why it is located in orion.jar. Randahl
RE: [ANNOUNCE] Orion forums launched!
Dear Group, The www.elephantwalker.com Support Site has been available for free to the Orion community since August 2001. This forum allows users to attach files, edit reply's, and close responses as your questions are answered. The application which is used to power the forum had several innovations: 1. Completely j2ee based, with ejb's powering the back-end. Jives uses a jdbc architecture. 2. Loadbalanced across several servers...Jives only recently achieved loadbalancing. 3. Twice as fast as Jives under stressed conditions. 4. File attachments can be up to 2 MB. 5. The "bury" function which allows you to bury your thread. 6. A fast search function. 7. Free to all users. 8. And most of all, a strong user community to answer your Orion questions. We now have over 700 users who use the site, and were the first to provide a web forum for Orion users. We continue to provide the best Orion Support on the planet. Take a walk on the wild side and join the elephantwalker: www.elephantwalker.com/main/gstarted.html Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Scott Farquhar Sent: Thursday, February 21, 2002 8:11 PM To: Orion-Interest Subject: [ANNOUNCE] Orion forums launched! Atlassian and IronFlare are proud to announce the launch of the Orion forums at: http://forums.atlassian.com These forums will enable the community to post and answer questions, and will be an important resource for help into the future. There are 7 forums covering:installation & configuration, web applications, EJB, security and users, data sources, JMS and general questions. The forums are a free support resource for the community, but are actively patrolled by the Atlassian expert support team, the IronFlare development team and other Orion community leaders. The forums do not replace this mailing list, rather they are an additional location for questions and community discussion. However, the forums do have certain advantages over the mailing lists: - the forums are actively watched by Atlassian, IronFlare and the community - you can 'watch' threads that interest you, rather than subscribing to an entire mailing list - you do not need to subscribe to post or search for answers - the forums are updated in real time, rather than waiting hours for your post to appear Get posting today and join the broader Orion community! http://forums.atlassian.com Cheers, The Atlassian & IronFlare teams PS If you are interested in becoming a community leader/moderator, please email me off list - [EMAIL PROTECTED]
RE: orion-ejb-jar.xml, ejb-jar.xml and deployment
Vipul, Orion will not copy over an old orion-ejb-jar.xml file. So if you redeploy, if you don't blow away the previous deployment, you are still on the old file. This could be your problem. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Vipul Sagare Sent: Tuesday, February 19, 2002 8:58 AM To: Orion-Interest Subject: orion-ejb-jar.xml, ejb-jar.xml and deployment I have seen discussion on this topic but I was not able to get working solution for me. Here is my problem: I have OC4J. I have an application where I have deployed few CMP EJBS. At present, there are NO orion-xxx.xml deployment descriptors(DD). Now, I would like to introduce orion specific DDs where I can use Orion specific tags (example: EJBs. CMP field name- UserName and persistence name- user_name). What is recommended/or correct process? The process I followed and did NOT work for me. - Deploy application. - Copy orion-ejb-jar.xml from deployment and just keep the EJB tag which I want change. Put this xml file at the same place as ejb.jar.xml - Change the EJB code. - Use ant to build .ear file and deploy. The changes in orion-ejb.jar.xml do NOT get into the deployed DD. I also came across Xdoclet. But could not proceed without any luck. Your help is appreciated. Thank you. Vipul __ Do You Yahoo!? Yahoo! Sports - Coverage of the 2002 Olympic Games http://sports.yahoo.com
RE:
The addToRole() function will add a principal to another role. For example, if you have a gold_account role, and all your user (principal) is only a in the user_account role, you can add them to the gold_account role with something like this... roleManager.addToRole(principal,"gold_account"); you will get an error if the role "gold_account" does not exist in your web.xml or application.xml or ejb-jar.xml. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Min-Hua Luo Sent: Friday, February 15, 2002 4:28 PM To: Orion-Interest Subject: Hi, I am confused by RoleManager.addToRole() function. It says "Adds a principal to the specified role, in practice this usually implies adding the principal to the legacy groups the role encompasses". Since all roles are defined in web.xml ( tag), does addToRole() function will actually update my web.xml file and add a new role to ? If not, what file(s) does addToRole() will update? Thanks a lot. __ Do You Yahoo!? Yahoo! Sports - Coverage of the 2002 Olympic Games http://sports.yahoo.com
RE: Cascade delete for CMP set mapping?
Chris, I believe that cascade delete is fixed in the next release. Regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Chris TurnerSent: Tuesday, February 12, 2002 6:34 AMTo: Orion-InterestSubject: Cascade delete for CMP set mapping? Hi Everyone, I've got a CMP entity bean that manages a set of simple object via Orion's proprietary set-mapping features. It all works fine and the table holding the items in the set is updated and read correctly. The problem comes with deleting. If I delete the bean (by calling remove(pk) on the home interface) the data from the entity table goes, but the data in the table for the set items remains. Is this expected behaviour? I was expecting Orion to cascade delete this data! How do I make Orion do a cascade delete of the table for the managed set? Or do I need to add a rule to the database to force it to do the cascade delete? My Orion version is 1.52 Chris _Alison AssociatesThe information contained in this e-mail and any attached files is intended only for the use of the person(s) to whom it is addressed and may be privileged, confidential and exempt from disclosure under applicable law. The views of the author may not necessarily reflect the views of the Company. If you are not the intended recipient please do not copy or convey this message or any attached files to any other person but delete this message and any attached files and notify us of incorrect receipt via e-mail to [EMAIL PROTECTED] _This message has been checked for all known viruses by MessageLabs.
RE: Username and Password
Dear Joanne, String username = request.getRemoteUser(); That does the trick for me. As far as the password, this is what I do. Protect a servlet or jsp(lets say /login) where you want to get the vital information from within your web.xml. Since you have already used form-based authorization...you know how to do this. Lets say the servlet is /login, from within the post (because all processing of form-based stuff is post) processing, you can do this: String username = request.getRemoteUser(); String password = request.getParameter("j_password"); And then you can do stuff with this (for example, encrypt the password and username, and create some authorization cookies). After you do stuff, you can forward to other protected resources. This is all assuming you already have a user. If you want to programatically create a user, you use the roleManager interface to do this (by using roleManager, you can change your usermanager later without having to change any code). RoleManager manager = (RoleManager)new InitialContext().lookup("java:comp/RoleManager"); Principal principal = manager.createPrincipal(username,password,) you can also add principals to various roles with manager.addToRole(principal,role); or remove from role manager.removeFromRole(principal,role); You can even programatically log somebody in... manager.login(username,password); or even remove the user manager.remove(principal); Its really quite flexible. A little like JAAS, but easier to use. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Christian, Joanne Sent: Wednesday, February 06, 2002 9:30 AM To: Orion-Interest Subject: Username and Password HI All, I'm new to J2EE and Orion. I have set up form-based authorization using DataSourceUserManager. Super! >From my initial jsp and/or servlet (not the login page), I would like to access the username of the person who just logged in. How can I do this? I have tried to get attributes from the ServletContext an the session. I have also tried various other things I'd rather not mention . . . So: How can I access the values of j_username and j_password once the user has been logged in? Also, where and what is j_security_check? Thanks, Joanne
FW: Sharing session across web apps
resend...first one didn't catch. -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Friday, February 01, 2002 11:17 AM To: Orion-Interest; [EMAIL PROTECTED] Subject: RE: Sharing session across web apps >From my post on oracle otn: Session data is not shared between web applications. User data is definantly important to share between applications. The single-sign-on security option in 9i AS is an example of this. But that's kindof a black box. If you use single-sign-on, then simply getting the remote user from the request in your servlet can be used as a key to get user data from your persistance layer (ejb's or jdbc or even jms). If you don't want to use single-sign-on, you can use a filter. There's some url prestidigitation, but otherwise this approach is pretty simple: 1. Protect access to all of your web-app's urls with some naming convention /webappname/secure*. However, don't use these urls in any web page. All servlets and jsps you use should map names beginning with "secure". 2. Filter all access to your webapp (this is a new feature in servlet spec 2.3). Within the filter, use the session id as a key to find out if the user is already login to any other web application. You will need a stateless session bean to do this. The doFilter would be something like this: SecurityBean securitybean = Utilities.getSecurityBean(); HttpSession session = request.getSession(true); if (session.getAttribute("myuserdata") == null){ UserData userdata = securitybean.getUserdata(sessionid); if(userdata != null) session.setAttribute("myuserdata",userdata); } ... now forward the request to the "secure*" url in the filter. If the user was logged in with the slsb securitybean, then your web app will have all of your user data. If the user is not logged in by the securitybean, then the login prompt established in your web.xml will pop-up. The only extra work is to have a slsb securitybean. This can use the RoleManager in orion or it can use the jaas implementation in oc4j to log the user in, using the sessionid to get the username. The shared="true" attribute should be used for all application in the *-web-site.xml, so that the sessionid's are the same. regards, the elephantwalker www.elephantwalker.com .ps I you don't want to use the session id, you can use another more secure time dependent MD5 hash key which would be in a cookie or url tag. But then this would be the single-sign-on application ;). -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Nimmons, Buster Sent: Friday, February 01, 2002 6:34 AM To: Orion-Interest Subject: Sharing session across web apps I have one web-app which gathers a users information and place a userInfo object in the session. I set the sharing attribute for this and all other apps to true yet when I go to another webapp from this one the objects in the session are no longer there. the session ID between apps is the same but the creation time and attributes are different. Has anyone succesfully configured webapps to share sessions
RE: cgi question [EXPIRED TRIAL LICENCE]
If you look in the global-web-application.xml, you will see that there is a cgi servlet. If you want to use your own php engine, you will need to do something like this: php com.evermind.server.http.CGIServlet interpreter /usr/local/bin/php There are some issues, though, on how you would compile the php engine. Here is something that is proported to work: ./configure --with-mysql=/usr --disable-force-cgi-redirect --enable-force-cgi-redirect=/etc/openldap --without-gd --enable-calendar --e nable-discard-path --enable-trans-sid --with-openssl --with-imap --enable-inline-optimization This is from Andraas Mag. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of orionDummy Sent: Monday, January 28, 2002 7:36 PM To: Orion-Interest Subject: cgi question [EXPIRED TRIAL LICENCE] Does anyone know if orion can server cgi and what needs to be done if so. Thanks
RE: javax.ejb.EJBLocalHome and javax.ejb.EJBLocalObject
If you look at the interfaces in 1.5.3, the local interfaces are there. AFAIK, it doesn't work yet, though. In a previous thread, Magnus Rydin wrote about the "re-factoring" is happening now so that EJB 2.0 will work. Maybe this will be in 1.5.4, which isn't out yet. Another encouraging sign is that Oracle indicates that 9iAS will meet j2ee 1.3 soon. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Chris Boz Jennings Sent: Friday, January 25, 2002 12:43 PM To: Orion-Interest Subject: javax.ejb.EJBLocalHome and javax.ejb.EJBLocalObject Can Orion handle local interfaces, i.e., javax.ejb.EJBLocalHome and javax.ejb.EJBLocalObject ? I am going through Ed Roman's Mastering EJB 2nd edition and it uses these (as part of EJB 2.0, I assume.) ,boz
RE: Generating descriptors
Michael, The Orion assembler tools are not reliable on Orion. However, when you deploy an application, orion will automaticly generate the orion-ejb-jar.xml, orion-application.xml, and orion-web.xml files. These are orion-specific deployment descriptors which you can modify and use as you see fit. As for the j2ee ejb-jar.xml, application.xml, and web.xml files, you will need to generate those on your own, or use jdeveloper, forte for java, netbeans, sun's j2ee tools, or do it by hand (which is what I do). Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Michal Palicka Sent: Thursday, January 24, 2002 5:28 AM To: Orion-Interest Subject: Generating descriptors Hello, what tools do you use to generate various descriptors (beans, applications, etc.)? Do you prefer writing descriptors manualy? Could you give me any hints? I tried the EJB Assembler tool, which is a part of Orion, but I could not generate the EJB descriptor. I am able to generate the EJB jar file, but without the descriptor. When I try to save the descriptor I always get the following error: Couldn't save to that location: META-INF. Could you tell me, what are the correct steps to generate an EJB + the corresponding descriptor? Thanks in advance Michal Palicka, Cleverlance
RE: IronFlare bug fixing policy
Geoff, Magnus Rydin told me that what they need are good examples for each bug so that they are absolutely reproducible. If you look at some of the bugs that are still open, these bugs don't have iron clad examples that are reproducible. So each of these bugs needs to be cleared...which means Magnus R. has to work on reproducing them (if they aren't immediately reproducible), which of course takes time. What he didn't say but reported on the list is a major refactoring going on now in Orion to bring it into compliance with j2ee 1.3. This includes EJB 2.0, Servlet 2.3 (not just the draft), and JSP 1.2, Connections, etc. As we all know, fixing bugs which are going to disappear in a refactoring is a bit of a waste of time. Of course, if its a bug that affects you directly, you may feel differently. Which bug numbers did you report? regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Geoff Soutter Sent: Tuesday, January 15, 2002 4:55 PM To: Orion-Interest Subject: IronFlare bug fixing policy Hi there, I reported a bug on BugZilla a few days back. It's reasonably serious - basically the generated wrapper for the finder method of an EJB is throwing NullPointerException when the EJB throws an exception, hiding the real cause of the problem. (And I just found another bug - ServletExceptions constructed with (string, exception) are reported without the String originally passed.) I haven't heard anything and the bug has not been touched apparently. Does anyone know what IronFlare's policy is regards fixing bugs? Do they tend to fix them quickly, or are they likely to just ignore bug reports? The reason I ask is that I'm happy to use something without much support, but if they refuse to fix bugs then I think I'll have to give up and try elsewhere... Cheers Geoff
RE: IronFlare bug fixing policy
Geoff, Magnus Rydin told me that what they need are good examples for each bug so that they are absolutely reproducible. If you look at some of the bugs that are still open, these bugs don't have iron clad examples that are reproducible. So each of these bugs needs to be cleared...which means Magnus R. has to work on reproducing them (if they aren't immediately reproducible), which of course takes time. What he didn't say but reported on the list is a major refactoring going on now in Orion to bring it into compliance with j2ee 1.3. This includes EJB 2.0, Servlet 2.3 (not just the draft), and JSP 1.2, Connections, etc. As we all know, fixing bugs which are going to disappear in a refactoring is a bit of a waste of time. Of course, if its a bug that affects you directly, you may feel differently. Which bug numbers did you report? regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Geoff Soutter Sent: Tuesday, January 15, 2002 4:55 PM To: Orion-Interest Subject: IronFlare bug fixing policy Hi there, I reported a bug on BugZilla a few days back. It's reasonably serious - basically the generated wrapper for the finder method of an EJB is throwing NullPointerException when the EJB throws an exception, hiding the real cause of the problem. (And I just found another bug - ServletExceptions constructed with (string, exception) are reported without the String originally passed.) I haven't heard anything and the bug has not been touched apparently. Does anyone know what IronFlare's policy is regards fixing bugs? Do they tend to fix them quickly, or are they likely to just ignore bug reports? The reason I ask is that I'm happy to use something without much support, but if they refuse to fix bugs then I think I'll have to give up and try elsewhere... Cheers Geoff
RE: Multiply datasources for one application??
Mike, You can use different data-sources by using a different "location" name for each data-source. You need to make sure that each data-source within your data-sources file has a distinct location name. You apps can use different data-sources.xml by including the data-sources.xml path in your orion-application.xml of your ear. This way you can have more than one ear, each with its own data-sources.xml. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, January 15, 2002 10:57 AM To: Orion-Interest Subject: Multiply datasources for one application?? Hi everyone, if there is anyone that can give me a hand I would really appreciate it. My Problem is that I have an application developed using orion and I works great but we are trying to set up multiply test environments using different database instances. My questions is can you set up one application with multiply datasources and if so how do you go about setting it up. We tried to set it up with different datasource declarations in one datasource but it always reads the last datasource declaration into the driver manager. Please help if you can, Thanks. Mike
RE: Orion & JSDK2.3
1.5.3 uses the jsdk2.3 spec, not the pfd 2, which was in 1.5.2. You can check this by looking in the orion.jar distribution in 1.5.3, and see that the filter interface in javax.servlet.Filter uses the proper methods jsdk2.3 methods for Filter, destroy(), doFilter() and init(). The old pdf 2 spec had the methods doFilter(), setFilterConfig() and getFilterConfig(), which is what you find in the 1.5.2 distribution. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Daniel Lopez Sent: Monday, January 14, 2002 8:25 AM To: Orion-Interest Subject: Orion & JSDK2.3 Hi, There are two things that are quite annoying in the current version of Orion and that have been defined/changed in the final JSDK2.3 spec. First one is that the name of the methods defined in the servlet filters are now diferent, thus pure JSDK2.3 filters don't work in Orion. Second one is that classloader order/precedence has been more clearly specified and it is not necessary to hack XML parsers, for example anymore. Any news about when is the JSDK2.3 final spec going to be implemented in Orion? Does the OC4J version already implement it? I have some customers who are considering going to Resin, just for those very reasons, and I can't find any sound proof to confront their reasoning, as we are ourselves considering migrating to other containers. Even Tomcat 4 implements now a more current spec than Orion! >From the outside, nobody would say that Orion keeps going on, but just OC4J. regards, D.
RE: Trivial classpath problem ?
Yuval, In your orion-application.xml of your ear application, you can put this tag: This is after the persistance tag and before the principals tag. In your ear layout, include a directory lib, so now the layout should look like this: META-INF META-INF/application.xml META-INF/orion-application.xml mywarfiles.war myejbfiles.jar lib lib/mylibraryfiles.jar The reason orion was picking up your jar files from the lib directory in orion is that the config/application.xml (which is the orion-application.xml of the global-application, or default app as it is sometimes called) has a tag in it regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Saturday, January 12, 2002 11:36 PM To: Orion-Interest Cc: [EMAIL PROTECTED] Subject: Trivial classpath problem ? Hi, Although this is an oc4j question ( oracles wrapper for orion ), im sure some of you would be able to help me ( the engines are the same down there :). Ive tried adding a new jar to oc4js classpath. Our application depends on this jar. I couldnt. Ive tried adding the jar as a 'library-path' tag within the server.xml. Then added it to the command line running oc4j ( -cp = ). It didnt do the trick. Ive only made some progress when putting it straight into oc4js lib directory. Im confused. 1. What does the 'library-path' tab enable? 2. Whats the difference between using it and supplying jars to the oc4js runtime classpath ( -cp ). 3. What is the recommended way, to simply add a jar upon my application depends of? Any help would be apreceated, Yuval.
RE: does orionsupport startup and shut down classes
See answer at www.elephantwalker.com/rfa?id=301 Regards, the elephantwalker -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of meera krishnaraja bhatSent: Wednesday, January 09, 2002 5:03 PMTo: Orion-InterestSubject: does orionsupport startup and shut down classes hai Does ORION support startup and shutdown classes? Here is the scenario, in order to have access to the system resources (file system, legacy applications) from an EJB, it is the violation of EJB spec. However, one can write a java class that accesses system resources and deployed this class in the EJB Server. thanks meera MSN Photos is the easiest way to share and print your photos: Click Here
RE: Best way to add user records to EJBUserManager...
The best way to add users in Orion is with Orion's roleManager interface. This abstracts the usermanager, so that you can define your usermanager api with xml configuration. Check-out this trail the docs here: http://www.orionserver.com/docs/api/com/evermind/security/RoleManager.html At our site, we use the RoleManager to do all of our user management. If later we decided to migrate to an LDAP usermanager from EJBUserManager, aside from moving the database, all we need to do is change the orion-application.xml user-manager tag...with no changes to our application code. Nifty, eh! regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Alex Paransky Sent: Monday, January 07, 2002 9:44 PM To: Orion-Interest Subject: Best way to add user records to EJBUserManager... I am using EJBUserManager for security in Orion. What is the best way to update users? Should I directly use EJBUser EJB or use the API's in the UserManager. If UserManager is the answer, then how do I get access to it while running in Orion? Thanks -AP_
RE: Best way to add user records to EJBUserManager...
second try -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Tuesday, January 08, 2002 8:16 AM To: Orion-Interest; [EMAIL PROTECTED] Subject: RE: Best way to add user records to EJBUserManager... The best way to add users in Orion is with Orion's roleManager interface. This abstracts the usermanager, so that you can define your usermanager api with xml configuration. Check-out this trail the docs here: http://www.orionserver.com/docs/api/com/evermind/security/RoleManager.html At our site, we use the RoleManager to do all of our user management. If later we decided to migrate to an LDAP usermanager from EJBUserManager, aside from moving the database, all we need to do is change the orion-application.xml user-manager tag...with no changes to our application code. Nifty, eh! regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Alex Paransky Sent: Monday, January 07, 2002 9:44 PM To: Orion-Interest Subject: Best way to add user records to EJBUserManager... I am using EJBUserManager for security in Orion. What is the best way to update users? Should I directly use EJBUser EJB or use the API's in the UserManager. If UserManager is the answer, then how do I get access to it while running in Orion? Thanks -AP_
RE: JDBC error
Ian, Make sure that you are closing your connections properly. eg: try { // open connection } catch () { // do something } finally { try { // close connections } catch () { // do something } } This could be your problem. The try/catch/finally block MUST be used with Oracle...or you will run out of process resources as exceptions occur. You can check if the connections are being closed properly with a debug property: java -Djdbc.connection.debug=true -jar orion.jar This will remote where you are not closing your connections. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Ian S. Hagen Sent: Wednesday, January 02, 2002 5:53 AM To: Orion-Interest Subject: JDBC error Has anyone experienced instability when using Orion together with Oracle 9i? I am currently running an Orion 1.5.2 server on a Tru64 platform against a 9i database using the OCI driver. Everything works fine initially, but after a few hours of sending HTTP requests to Orion I find that performance degrades. Eventually, I start getting database errors. I have seen Oracle go into a state where it returns an SQL exception: java.sql.SQLException: ORA-00600: internal error code, arguments: [kksfbc-new-child-thresh-exceeded], [], [], [], [], [], [], [] I have also experienced the OCI driver core dumping when executing the same test: OCI-21503: program terminated by fatal error OCI-04030: out of process memory when trying to allocate 30056 bytes (Alloc environm,eoj_stmt_malloc) Obviously, I am running out of resources. The thing I don't understand is where! I have run Orion setting the JDBC debug parameters jdbc.connection.debug, datasource.verbose and jdbc.debug to true, and it seems as though the connections are being created and returned correctly (no connections leaked). Has this problem got anything to do with me running it on Tru64? The Orion FAQ doesn't mention Tru64 as a supported OS. My datasources.xml looks like this: http://xmlns.oracle.com/ias/dtds/data-sources.dtd";> Any suggestions are appreciated! Ian
RE: JNDI basics??
>From the orion documentation: JNDI When talking to the Orion JNDI tree from outside the container, you should specify the following JNDI properties (normally in a jndi-properties file): java.naming.factory.initial=com.evermind.server.ApplicationClientInitialCont extFactory java.naming.provider.url=ormi://localhost/ java.naming.security.principal= java.naming.security.credentials= Also see: http://www.orionserver.com/docs/remote-access/remote-access.xml regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Simon Kelly Sent: Friday, December 21, 2001 10:56 AM To: Orion-Interest Subject: JNDI basics?? Regarding the JNDI properties file, how do I determine what value to give for the "java.naming.provider.url"?
RE: Not allowed to lookup java:comp/ServerAdministrator ??????
You need this in your config/application.xml In addition, your config/principals.xml needs the admin account turned-on. You can do that by using the -install switch in orion: java -jar orion.jar -install This will prompt for a password... Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of korosh Sent: Wednesday, December 19, 2001 4:20 PM To: Orion-Interest Subject: Not allowed to lookup java:comp/ServerAdministrator ?? i get the below error when trying to stop orion through the admin interface. Any one any clues? orion-application.xml seems to be application specific and not anything to do with administrating orion. --- orion>java -jar admin.jar ormi://localhost:23791/ admin nqbeqs -shutdown Security error: Not allowed to look up java:comp/ServerAdministrator, check the namespace-access tag setting in orion-application.xml for details ---
RE: how does Orion finds classes ?
You need to put orion in development mode. In your global-web-application.xml, set development="true" in the first tag, the orion-web-app tag. This way each time you deploy an app, the war classes/jar's will be reloaded. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jose Mena Sent: Wednesday, December 19, 2001 4:00 AM To: Orion-Interest Subject: Re: how does Orion finds classes ? Hi, I'm using the default application with a jar and some war files. When i make a deploy on the applications directory it doesn't it automaticaly. Instead of it i got to restart the server(taking in account that the restart option from admin.jar DOESN'T WORK). What do i have to do to get it automaticaly deployed? thank you all. - Original Message - From: "The elephantwalker" <[EMAIL PROTECTED]> To: "Orion-Interest" <[EMAIL PROTECTED]> Sent: Wednesday, December 19, 2001 9:12 AM Subject: RE: how does Orion finds classes ? > Each application has its own class loader...so these are used first, after > these classes and jar's are searched, the parent class loader is used, and > so on. > > Same with the unloading. > > So its not so wasteful. > > > regards, > > the elephantwalker > www.elephantwalker.com > > -Original Message- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED]]On Behalf Of Yekesa Kosuru > Sent: Tuesday, December 18, 2001 4:19 PM > To: Orion-Interest > Subject: how does Orion finds classes ? > > > Hi, > > When a class needs to be loaded, how does Orion find > the class ?. > > My guess is it goes through all the jars file it is > configured with (manifest file, server.xml, > application.xml etc). But then isn't this expensive, > because for every single class, it has to go through > all the jars it knows about. > > Another questions is, once loaded, when will jars be > unloaded ?. The reason I am asking is if the server is > configured with bunch of jars, but then a given app > only needs few of them, if class finding ends up > loading all the jars, then they are taking up memory > (which is what I am seeing) for quite sometime until > they get unloaded. > > Can someone shed some light on this. Please cc me on > the reply. > > Thanks > > Vissu > > > > > > __ > Do You Yahoo!? > Check out Yahoo! Shopping and Yahoo! Auctions for all of > your unique holiday gifts! Buy at http://shopping.yahoo.com > or bid at http://auctions.yahoo.com > >
RE: how does Orion finds classes ?
Each application has its own class loader...so these are used first, after these classes and jar's are searched, the parent class loader is used, and so on. Same with the unloading. So its not so wasteful. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Yekesa Kosuru Sent: Tuesday, December 18, 2001 4:19 PM To: Orion-Interest Subject: how does Orion finds classes ? Hi, When a class needs to be loaded, how does Orion find the class ?. My guess is it goes through all the jars file it is configured with (manifest file, server.xml, application.xml etc). But then isn't this expensive, because for every single class, it has to go through all the jars it knows about. Another questions is, once loaded, when will jars be unloaded ?. The reason I am asking is if the server is configured with bunch of jars, but then a given app only needs few of them, if class finding ends up loading all the jars, then they are taking up memory (which is what I am seeing) for quite sometime until they get unloaded. Can someone shed some light on this. Please cc me on the reply. Thanks Vissu __ Do You Yahoo!? Check out Yahoo! Shopping and Yahoo! Auctions for all of your unique holiday gifts! Buy at http://shopping.yahoo.com or bid at http://auctions.yahoo.com
RE: Using UserTransaction from a standalone client
This was answered at www.elephantwalker.com/rfa?id=271 regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of [EMAIL PROTECTED] Sent: Tuesday, December 18, 2001 9:48 AM To: Orion-Interest Subject: Using UserTransaction from a standalone client Can someone tell me how to configure properly to lookup a UserTransaction? I have a standalone client that references a jndi.properties file to connect to our app server and make use of EJB's. When I try to add a UserTransaction lookup I get name not found. Do I have to add UserTransaction to an xml config file somewhere? What does the entry have to look like? Thanks.
RE: Very Long Deployment Time
It shouldn't take this long. So there is some problem. Make sure that you have enough memory, and you aren't paging during the deploy. I do not use jdeveloper to deploy applications during development. I use ant. It could be there is some hangup with jdeveloper during the deploy. Also, separate your ejb entity beans in ejb.jar's from your session ejb.jar's. The entity beans do not often change, but the session ejb.jar's do change all the time. you can copy the ejb.jar for your session beans directly to your enterprise deployment directory (created during the unjaring of the ear file), and oc4j/orion will redeploy this jar file, while leaving the other jar files alone. regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Gustavo CombaSent: Monday, December 17, 2001 8:34 AMTo: Orion-InterestSubject: Very Long Deployment Time Hello, I'm deploying a little project with a Client Application Module and a EJB Module with several EJB (about 30 Entity and 5 Session Beans). I'm using JDeveloper 9i Release Cantidate to develop/deploy my project. My project compiles very fast, but when I do the deployment, it take a very long time (about 10 minutes). I'm debugging now, and I'm deploying continously, and it's very anoying! There is something I can do to accelerate the deployment proccess? Can I copy the .ear file directly into the "applications" directory and start the server again? Help me please! Thanks in advance, Gustavo Comba
RE: Web Services and WSTK
I was just at Oracle OpenWorld, and saw Larry Ellison and friends demonstrate this before 10,000 people. They used apache soap, uddi, and jdeveloper linked with orion/oc4j. There were two appservers at two different companies. The small company had published its order session bean methods on uddi, which the big company used to integrate in their order fulfillment system. This demonstration was truly awesome. Take a look at the new docs on otn.oracle.com. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Namor Taror Sent: Saturday, December 08, 2001 4:47 PM To: Orion-Interest Subject: Web Services and WSTK Has anybody worked out ejb deployment as web services on orion? _ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
RE: Security Vulnerability?
Raph, Orion will return a 404 error if you request a resource which is not availble, for example, a non-existing html. If you request http:///c:|mydirectory/nonexistantfile.txt, orion will just return 404. I know, because there are many attacks on my website all the time with a similar strategy. Orion does not return the request, and javascript is not executed on the orion server. However, if you are using IIS as a web server front end to Orion, you are absolutely vulnurable to this attackbut its not orion, its IIS which is being hijacked. If you are using Apache as a front end, there should be no problem. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Raphael Gillett Sent: Friday, December 07, 2001 12:24 PM To: Orion-Interest Subject: Security Vulnerability? Dear Everyone, A recent security scan of a Windows 2000 network identified the following vulnerability on an Orion 1.5.2 server. "The remote host seems to be vulnerable to the Cross Site Scripting vulnerability. The vulnerability is caused by the result returned to the user when a non-existing file is requested (e.g. the result contains the JavaScript provided in the request). The vulnerability would allow an attacker to make the server present the user with the attacker's JavaScript/HTML code. Since the content is presented by the server, the user will give it the trust level of the server (for example, the trust level of banks, ) .. " I have 2 questions: 1. Is this information about Orion 1.5.2 actually correct ? 2. If yes, is the vulnerability resolved in 1.5.3 ? Regards, Raph
RE: Persistance between HTTP and HTTPS
resend, second one didn't catch... -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Friday, December 07, 2001 5:18 AM To: Orion-Interest Subject: RE: Persistance between HTTP and HTTPS resend, first one didn't catch... -Original Message----- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Friday, December 07, 2001 12:19 AM To: Orion-Interest Subject: RE: Persistance between HTTP and HTTPS To share information on the session, the web-app tag in the web-site.xml needs the shared="true" flag set. As far as dropping the sessions from time to time, this shared="true" flag should also solve that problem. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Steve Best Sent: Thursday, December 06, 2001 1:51 PM To: Orion-Interest Subject: Re: Persistance between HTTP and HTTPS We came up with a fix, not sure if it will help you. In the orion-web.xml config file, we added . We havent tested whether or not it will still work without the cookies="disabled", or the autojoin-session="true", but it works with both for the time being. Steve - Original Message - From: [EMAIL PROTECTED] To: Orion-Interest Sent: Thursday, December 06, 2001 8:44 AM Subject: RE: Persistance between HTTP and HTTPS Don't know if it's related, but we've found that while we're using HTTPS on Orion, the sesions would, seemingly at random, sometimes vanish on us. Reasons unknown, and we haven't tracked it down yet. - Geoffrey -Original Message- From: Steve Best [mailto:[EMAIL PROTECTED]] Sent: Wednesday, December 05, 2001 8:07 PM To: Orion-Interest Subject: Persistance between HTTP and HTTPS Greetings, we are currently experiencing what appears to be a lack of persistance between HTTP and HTTPS, when moving between the two on our site, and only in-frequently. Has anyone ever experienced this problem before? Thanks, Steve Best Systems Administrator Simple Devices 415-637-9651 (cell) "A little nonsense now and then, is relished by the wisest men." Willy Wonka _ This message has been checked for all known viruses by the MessageLabs Virus Scanning Service. For further information visit http://www.messagelabs.com/stats.asp _ This message has been checked for all known viruses by the MessageLabs Virus Scanning Service. For further information visit http://www.messagelabs.com/stats.asp
RE: Orion and basic authentication
Etieene, No coding is necessary. The XMLUserManager is used by default, or you can use the DataSourceUsermanager (a database store), or the EJBUserManager (a cmp bean), or an LDAP usermanager (this was developed outside of Orion, but is very useful addition). You do have to specify the proper j2ee security constraints in your web.xml file as well as select basic authentication in the web.xml file. If you aren't doing this, it won't work. Orion does not require any java coding for j2ee authentication for basic or form based methods. If you use a progammatic authentication in your application that involves manipulating the header response, this is not j2ee authentication, and I don't believe the servlet 2.3 spec supports manipulating the Auth part of the response header, since it would directly interfere with the j2ee authentication. For example, what if your header manipulation conflicts with the web.xml deployment descriptor for authentication? Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Etienne Giraudy Sent: Wednesday, December 05, 2001 7:13 AM To: Orion-Interest Subject: Orion and basic authentication Hi, I'm curious to know if there is any possibility to setup my webapp for using basic authentication without having to code a (simple) user manager (cf http://www.orionsupport.com/articles/usermanager.html). It seems that orion is the only app server needing some code to support basic authentication. Our application has built in support (decoding of http header authentication data) for basic authentication and it has been successfully tested under weblogic, websphere, tomcat, resin and jrun! But it seems that orion strip off the http header authentication data before passing it to the webapp... Any help appreciated. Etienne Giraudy
oracle/open world
resend, first didn't catch... -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Tuesday, December 04, 2001 9:49 PM To: Orion-Interest Subject: oracle/open world Dear Group, I have been at the Oracle/open world for two days...and there is some significant news about OC4J and likely Orion. I have filed two reports on www.elephantwalker.com, so take a look. Here is the link: http://www.elephantwalker.com/rfa?id=245 Regards, the elephantwalker www.elephantwalker.com
oracle/open world
Dear Group, I have been at the Oracle/open world for two days...and there is some significant news about OC4J and likely Orion. I have filed two reports on www.elephantwalker.com, so take a look. Here is the link: http://www.elephantwalker.com/rfa?id=245 Regards, the elephantwalker www.elephantwalker.com
FW: Using JDBC resource from application client
didn't take the first time...resend -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Monday, November 26, 2001 3:57 PM To: Orion-Interest Subject: RE: Using JDBC resource from application client Romen, In you application-client.xml file, you will need to put in the jdbc resource after any ejb resources...like this: description jdbc/MyDataSource javax.sql.DataSource Container <-- this can be container or application Then from your client app, you should be able to get the resource in the normal way: InitialContext ctx = new InitialContext(); DataSource ds = (DataSource) ctx.lookup("jdbc/MyDataSource"); etc. regards, the elephantwalker www.elephantwalker.com Take a walk on the wild side, and join us at the elephantwalker! -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Romen Law Sent: Monday, November 26, 2001 3:03 PM To: Orion-Interest Subject: Using JDBC resource from application client ello, I have seen the same question asked a few times in the mail archive, but no answers. Now I am faced with the same question. Am I supposed to access my datasource from an application client in J2EE/Orion? I have the following files setup with the correct values (I believe): * $orion/config/data-sources.xml (using class="com.evermind.sql.ConnectionDataSource" and Sybase driver "com.sybase.jdbc2.jdbc.SybDriver") * application-client.xml of the client app * jndi.properties file of the client app * manifest.mf of the client app When I do the following in my client app, a NullPointerException will be thrown when I try to prepare a statement or do anything useful with the connection: InitialContext ctx = new InitialContext(); DataSource ds = (DataSource) ctx.lookup("jdbc/MyDS"); Connection con = ds.getConnection("OpenBill","OpenBill"); // up to this point, nether ds or con are null, which is fine. con.prepareStatement("SELECT * FROM MyTable"); // NullPointerException happens here. The same code works fine in a servlet (my web.xml also setup correctly). cheers romen
RE: jdbc performance Orion vs. WL
Egor, Did you use the ejb-location (this is the best)? Also, did you use the latest 9i jdbc drivers from Oracle? You need to repeat the test with updating and inserting. Also, create several connections at once to use the pooling feature. Drop the stuff about Metadata...not very useful or very real world...and known to be slow. I would also drop the i/o, not necessary for this type of test. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Savotchkin Egor Sent: Tuesday, October 23, 2001 11:05 PM To: Orion-Interest Subject: jdbc performance Orion vs. WL Hi all, decided to find out who is the fastest when working with DB using jdbc. I wrote a simple servlet that does the following: 1) acquires connection from the App. Server's JNDI tree and selects 7000 records from an Oracle table. 2) acquires connection using DriverManager (OracleDriver) and selects 7000 records from the same table. The results are 1) WL ~4000 ms vs. Orion ~7000 ms 2) WL ~4000 ms vs. Orion ~6600 ms I agree that WL outperforms Orion because it is using its own DB Driver. But why even standard OracleDriver on Orion is working ~3 sec slower than on Weblogic 6.1? May be it is possible to tune Orion so that it could outperform WL when using jdbc? Egor Savotchkin try { System.out.println(" *"); System.out.println("Init ctx ... "); start(); Context ctx = new InitialContext(); end(); System.out.println("Getting DS ..."); start(); DataSource ds = (DataSource) ctx.lookup(JNDI_NAME); end(); System.out.println("getting connection ..."); start(); Connection conn = ds.getConnection(); end(); System.out.println("Connection : " + conn.getClass()); System.out.println("creating statement ..."); start(); Statement st = conn.createStatement(); end(); String query = "SELECT * from logs"; DatabaseMetaData dbmd = conn.getMetaData(); System.out.println("executing : " + query); start(); ResultSet rs = st.executeQuery(query); end(); System.out.println("ResultSet : " + rs.getClass()); int i = 0; System.out.println("rs"); start(); while (rs.next()) { i++; } end(); rs.close(); st.close(); conn.close(); conn = null; System.out.println("i = " + i); System.out.println(""); System.out.println("getting connection ..."); start(); Class.forName("oracle.jdbc.driver.OracleDriver"); conn = DriverManager.getConnection( "url", "xxx", "xxx"); end(); System.out.println("Connection : " + conn.getClass()); System.out.println("creating statement ..."); start(); st = conn.createStatement(); end(); System.out.println("executing query : " + query); start(); rs = st.executeQuery(query); end(); System.out.println("ResultSet : " + rs.getClass()); i = 0; System.out.println("rs"); start(); while (rs.next()) { i++; } end(); } catch (Exception ex) { System.out.println("Exception : " + ex); }
mongoose advertisement
Donna, I am not sure what you are trying to do here, but I hazard to say there is not one single member of this interest group that is interested in your product at $35,000 per cpu. Orion is $1500 per server, and most of us have already created our own "enterprise" portal services for Orion. Good luck on the Weblogic interest listbut you have struck out on the Orion interest list. Regards, the elephantwalker www.elephantwalker.com
RE: security-constraint
Carlos, You can change these bits in the orion-web.xml. Also, there should be no need to change the security constraints, since the web.xml uses roles, and orion-web.xml uses groups. Why the difference? Well Karl and Magnus were smart enough to recognize that web modules and ejb modules would be written once, and deployed under many different enterprise applications. But each of these modules would have their own role names for security-constraints. The hard bit is how to re-use these components without rewritting the web.xml. Groups saved the day. So the usermanager (or the jndi access to the roleManager) uses Groups to control access. Normally this is transparant to the developer, since most groups have the same name as the role's in your web.xml or ejb-jar.xml. But when you don't have the same names, you can use group/role mapping in your orion-web.xml file to tell orion which roles in the web.xml file map to which groups used by the usermanager. roleManager has some great methods for managing your groups, as do the usermanager's. Use these methods to mangle your groups and users. I hope this helps. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Carlos Macías Sent: Tuesday, October 23, 2001 10:59 AM To: Orion-Interest Subject: security-constraint Hi everybody. I´ve a big problem: Somebody know how i can modify and manage the security-constraint (in web.xml) using the orion API? Thank you all. _ Descargue GRATUITAMENTE MSN Explorer en http://explorer.msn.es/intl.asp
jaas and usermanager
Group, Is anybody interested in a usermanager that uses jaas plugin's? This way we could just use the jaas properties files to control what kind-of login service is allowedand if jaas is used out of the box, NTLogin (or os login), Kerberos, SmartCard could be used. regards, the elephantwalker www.elephantwalker.com
RE: Orion Questions
Ed, 1. No...but that's just because they haven't submitted it. Oracle has submitted oc4j, which is orion 1.5.0...and this is certified. 2. Orion is about six times faster than most containers, and three times faster than weblogicfrom my personal experience. You can also check out Oracle's stats on oc4j at www.oracle.com, which reflects my own personal experience. 3. There is no difference between the developer version and the commercial version except that there is a "Licensed to " in the server log in the commercial version. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Ed Brown Sent: Monday, October 22, 2001 1:19 PM To: Orion-Interest Subject: Orion Questions 1. Is the app server J2EE certified? 2. Is there a comparison of performance of this app server against others? 3. Is the commericial version the same as the developer's version, or is the commercial version "beefed up" in some way? Ed Brown _ This mail sent via toadmail.com, web e-mail @ ToadNet - want to go fast? http://www.toadmail.com
RE: Yup, SSL question
use a virtual-hosts attribute in your web-site tag...I also use the EXACT ip address in host: regards, the elephantwalker www.elephantwalker.com .ps I am glad your Alteon loadbalancer works, because the orion loadbalancer.jar can't use ssl ;(...its broken in 1.5.2. My main question is ... aren't you using Alteon as you ssl accelerator...and if so, why are the backends in ssl? -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Steve BestSent: Thursday, October 18, 2001 11:36 AMTo: Orion-InterestSubject: Re: Yup, SSL question Nevermind, I have found the keystore and have imported the certificate. I believe my problems now have to do with our clustering/load balancing configuration. We are currently using an Alteon Acedirector 3 for our load balancer. We are also using clustering to maintain sessions. I think the error I have been getting: "Error listening to SSLServerSocket: No available certificate corresponds to the SSL cipher suites which are enabled." is because our certificate is for our virtual IP, and not for our local machine, and therefore Orion is unable to load the certificate correctly because it isnt for the local host. The question is, how do I configure Orion to load a certificate for our virtual site? Here is my configuration, with some entries modified to protect the innocent: load-on-startup="false" /> I have tried setting the web-site host="[ALL]", but I get an error saying I cannot cluster with that configuration. Though I no longer get the SSLServerSocket error. Thanks for any help, Steve - Original Message - From: Steve Best To: Orion-Interest Sent: Wednesday, October 17, 2001 3:43 PM Subject: Yup, SSL question So, I do not have the original keystore file generated during the certificate request, but I have the original certificate request private key file, as well as the certificate file from Thawte. How do I get them both into a working keystore? Steve
RE: Tunneling Question
I believe anything that can be done in the global, can be done in an app. The format is the same. So if you want an app to use tunneling, put the same tag in your orion-web.xml file (this is located in the WEB-INF directory of your war file: tunnel com.evermind.server.http.TunnelServlet targetRoot http://localhost:8080/ also add the appropriate mapping. You can copy the one orion already uses for your app...look in your application directory for your orion-web.xml file. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Sarathy Mattaparti Sent: Thursday, October 18, 2001 9:45 AM To: Orion-Interest Subject: Tunneling Question Hi, Is it possible to do tunneling in application leveal ?. cause i'm having 3 domain names but wanna do tunneling for one domain only. i went through docs but its for global. tunnel com.evermind.server.http.TunnelServlet targetRoot http://localhost:8080/ (This is assuming that Orion is running on port 80 and Apache on 8080.) Then you would add the mappings for the content you want the other web server to handle: tunnel /*.html tunnel /*.gif Thanks for your help, Sarathy _ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
RE: orion xml's
Morten, Thanks for forwarding this to the list...90% of my posts don't get through for some reason. This is one reason I created www.elephantwalker.com. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Morten Wilken Sent: Thursday, October 18, 2001 1:59 AM To: Orion-Interest Subject: Fw: orion xml's - Original Message - From: "Morten Wilken" <[EMAIL PROTECTED]> To: "The elephantwalker" <[EMAIL PROTECTED]> Sent: Thursday, October 18, 2001 10:58 AM Subject: Re: orion xml's > hi elephantwalker > > i see your point about gui's, but i really like the fact that you can go > down and mess with the xml files, i would just like to be sure i was the > only one messing with them :-) > > what i would envision is something like > ejb-jar.xml (as per specs) + custom-ejb-jar.xml = orion-ejb-jar.xml > > so that ejb-jar.xml and custom-ejb-jar.xml could be saely tucked away in > cvs, and orion managed orion-ejb-jar.xml all by itself (autorefreshing when > i changed anything in my xml files) > > but as you say, it's nice that orion even has xml files for configuration > :-) > > sincerely > morten wilken > - Original Message - > From: "The elephantwalker" <[EMAIL PROTECTED]> > To: "Orion-Interest" <[EMAIL PROTECTED]>; <[EMAIL PROTECTED]> > Sent: Thursday, October 18, 2001 10:32 AM > Subject: RE: orion xml's > > > > Morten, > > > > At least the dd's are in xml, when Orion started they were the only ones > > that used xml descriptors. The way to do this is with gui's that are > > integrated with orion. Orion does have some gui's for generating this > > configuration files...but my experience with them has been miserable. > > > > Most of us use auto-generated files as a start...its true that these have > > some things which aren't necessary for configuration (I mean who needs to > > know the wrapper class name?). > > > > My experience is that you can strip out the auto-generated bits which have > > nothing to do with configuration (version= , date= ,wrapper class =, > etc.), > > and this has no impact on the deployment...and in fact may hinder the > > deployment. For example, if you put in the version stuff, I have found > that > > the ejb will double-deploy > > > > What we need is a good gui for doing this...anybody good with jdom and > > swing? > > > > regards, > > > > the elephantwalker > > www.elephantwalker.com > > > > > > -Original Message- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED]]On Behalf Of Morten Wilken > > Sent: Thursday, October 18, 2001 1:00 AM > > To: Orion-Interest > > Subject: orion xml's > > > > > > Am i the only one who thinks that the idea that you have to edit the > > autogenerated files like orion-ejb-jar.xml etc. is a bit problematic? > > > > sure it can be done and it works, but i would be much happier if i could > > have 2 sets of xml files, the ones you edit (and you could put in your > > versioning system), and another set that orion generates, and that you > never > > have to fiddle with. > > > > it seems an odd mix the way it is right now, as if it was meant to be > > seperated, but somehow it wasn't followed through > > > > i could be wrong, and missing the point of the structure entirely > > > > comments appreciated > > sincerely > > morten wilken > > > > > > >
RE: orion xml's
Morten, At least the dd's are in xml, when Orion started they were the only ones that used xml descriptors. The way to do this is with gui's that are integrated with orion. Orion does have some gui's for generating this configuration files...but my experience with them has been miserable. Most of us use auto-generated files as a start...its true that these have some things which aren't necessary for configuration (I mean who needs to know the wrapper class name?). My experience is that you can strip out the auto-generated bits which have nothing to do with configuration (version= , date= ,wrapper class =, etc.), and this has no impact on the deployment...and in fact may hinder the deployment. For example, if you put in the version stuff, I have found that the ejb will double-deploy What we need is a good gui for doing this...anybody good with jdom and swing? regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Morten Wilken Sent: Thursday, October 18, 2001 1:00 AM To: Orion-Interest Subject: orion xml's Am i the only one who thinks that the idea that you have to edit the autogenerated files like orion-ejb-jar.xml etc. is a bit problematic? sure it can be done and it works, but i would be much happier if i could have 2 sets of xml files, the ones you edit (and you could put in your versioning system), and another set that orion generates, and that you never have to fiddle with. it seems an odd mix the way it is right now, as if it was meant to be seperated, but somehow it wasn't followed through i could be wrong, and missing the point of the structure entirely comments appreciated sincerely morten wilken
RE: Changing the default splash page?
Look in the default-web-app directory, there's a file there called index.html, this is the splash. You can control the default-web-app index by modifying the web.xml file in the default-web-app/WEB-INF directory. You could also point to another directory for you default-web-app from the config/application.xml file. regards, the elephatnwalker -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Steve BestSent: Monday, October 15, 2001 11:45 AMTo: Orion-InterestSubject: Changing the default splash page? Howdy folks, how would I go about changing the default splash page for Orion? Thanks Steve
RE: WebLogic To Orion
Some companies have too much money ;). wl is slower than orion (about three times slower), and costs 7 to 14 times more than orion. The ratio of software costs to hardware costs with Orion is about 1:1 to 1:2, whereas the ratio of software costs to hardware costs for wl is 7:1 or higher. While its true that you get all of that wonderful support from wl, you can take a walk on the wild side, and join the elephantwalker...and you get excellent, cost effective support. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of muthukumarasamy rajamanickam Sent: Thursday, October 11, 2001 6:55 PM To: Orion-Interest Subject: Re: WebLogic To Orion Why are you going to Orion from Weblogic? We are movin gto Weblogic from Orion hemmm Diffferent world? --- [EMAIL PROTECTED] wrote: > Do you have a server certificate for or Orion > server? > > Jonathan Bricker > Lilly Research Labs > Java ATG > > > > > Greg Flores <[EMAIL PROTECTED]> > Sent by: [EMAIL PROTECTED] > 10/11/01 09:18 AM > Please respond to Orion-Interest > > > To: Orion-Interest > <[EMAIL PROTECTED]> > cc: > Subject:WebLogic To Orion > > > > We have migrated a current production application > from Weblogic to Orion > in an test to come up with an alternative platform > and have come across > some issues. Most of the issues we have been able to > resolve except for > one involving ssl and I.E. When we bring our > application up in I.E. and > https Orion invalidates the session within a minute. > Our application > security relies on certain objects within the > session for enforcement > which results in the user being kicked out of the > application. We are > evaluating V1.3.8., has this issue been resolved, is > there a resolution or > workaround? > > > Thanks > Greg Flores > > = Regards Muthu Rajamanickam e-mail:[EMAIL PROTECTED] Phone:832-567-7859 __ Do You Yahoo!? Make a great connection at Yahoo! Personals. http://personals.yahoo.com
RE: Syntax of tag?
should be placed after the display name. What errors are you getting? All session context variables need to be serielizable ... is this the error you are getting? regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Steve BestSent: Thursday, October 11, 2001 4:49 PMTo: Orion-InterestSubject: Syntax of tag? What is the correct syntax for the tag, I have placed it in out web.xml file every way I can think of and I keep getting errors. Thanks Steve
RE: WebLogic To Orion
Greg, In your *web-site.xml files, you will need to set shared=true in your default-web-app and web-app tags. The bug you have encountered is an IE bug. Do not evaluate version 1.3.8, its too old. use version 1.5.2 Regards, the elephantwalker -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Greg FloresSent: Thursday, October 11, 2001 7:19 AMTo: Orion-InterestSubject: WebLogic To Orion We have migrated a current production application from Weblogic to Orion in an test to come up with an alternative platform and have come across some issues. Most of the issues we have been able to resolve except for one involving ssl and I.E. When we bring our application up in I.E. and https Orion invalidates the session within a minute. Our application security relies on certain objects within the session for enforcement which results in the user being kicked out of the application. We are evaluating V1.3.8., has this issue been resolved, is there a resolution or workaround? Thanks Greg Flores
RE: starting orion application server
Dear Yilmaz, I have seen this problem before in linux. If you used jar to unzip the Orion distribution, the directories created did not have the bit set for each orion directory. This prevents Orion from creating files in these directories. You need to do a chmod +d to all of these directories, and their sub directories. Its a pain in the arse (excuse my old english), but so it goes. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of yilmaz Sent: Sunday, October 07, 2001 6:44 PM To: Orion-Interest Subject: Re: starting orion application server hi Steve, thanks for your kind reply. I created the persistance directory, but the error is still persisting :) ( i already copied the tools.jar into the orion home directory, and i am using sun's jdk1.3.1 ) below is the log file i tried to start it up: 2001/10/8 ä¸å 9:41 1.5.2 Started 2001/10/8 ä¸å 9:41 1.5.2 Stopped (JVM termination) i am having the same error message saying that (persistance/transaction.state) doesn't exist.Obviously it can't find the transaction.state file. How should i create it , or do you have a sample one so that i can configure according to my environment.Thanks in advance. cheers :) - Original Message - From: "Stephen Davidson" <[EMAIL PROTECTED]> To: "Orion-Interest" <[EMAIL PROTECTED]> Sent: Saturday, October 06, 2001 11:05 PM Subject: Re: Orion-Interest subscription notification > Hi Yilmaz. > > You are obviously new here, or you would know that you do not need to > threaten in order to get help. > > On the topic of the persitance directory, there is an issue where this > directory is not created automatically under WinNT/Win2K. So you have > to create it manually yourself. You do NOT need to put the orion > directory into your classpath. > > The following command issued in the orion directory should fix your > issue with the transaction.state file. > > C:\orion>mkdir persistance > > I know about this because one of the developers on my team ran into this > issue yesterday when setting up Orion on his Win2K box. > > If you have not done so already, you also need to copy the tools.jar > file from your jdk directory into your c:\orion directory. > > FYI, our testing has indicated that orion works best on Bea's JDK, Sun's > JDK, or IBM's Hotspot JDK. On Microsoft's JVM, we sometimes get for no > apparent reason some rather funky errors that go away when we switch > JVM's. > > Regards, > Steve > > > yilmaz wrote: > > > > hi guys, > > i am new to orion, > > i already downloaded orion application server, and unzipped under c:\orion > > directory. > > according to instructions i also put the tools.jar under c:\orion > > Next on command window , i ran java -jar orion.jar -install > > which prompted me to enter a password, and it said installation was done > > though i was surprised to finish so fast, i tried running orion by > > java -jar orion.jar > > as i expected it didn't start , but gave me the following strange error: > > > > C:\orion>java -jar orion.jar > > Fatal Error: Transaction log file (/C:/orion/persistence/transaction.state) > > did > > not exist and was not possible to create, the most common reason for this is > > an > > invalid path or Orion lacking security to write to that path: > > /C:/orion/persiste > > nce/transaction.state (系統æ?¾ä¸?Ã¥^°æ??å®sçs?è·¯å¾?ã?,) >(the last part of the message > > says > > system couldn't find the path in chinese). > > can someone help me please with this, > > so far i have used tomacat3, tomcat 4, jsdk, etc.. > > i have never seen this kind of strange problem, and i don't have any idea > > how to solve it > > i tried several methods in vain. > > i put c:\orion in my path, it didn't help > > please give me some help, ( before i decide to switch to another one) > > thanks for your concern > > cheers :) > > -- > Stephen Davidson > Java Consultant > Delphi Consultants, LLC > http://www.delphis.com > Phone: 214-696-6224 x208 > > >
RE: Why can't orion respond to their customers? (was RE: FW: Logging in to server twice does not work.)
Yash and Christian, Obviously this works, because the OrionConsole app uses ormi, and if you put in the wrong password, you just remove the server, and add a server with the right password. They are a little clunky with the interface...but adding the wrong password doesn't prevent you from connecting. So lets look at your code. It looks like you left out one important bit in the properties. The dedicated.connection should be true. With the code below, you won't have to restart your server. Regards, the elephantwalker www.elephantwalker.com So here is the code: import javax.naming.*; import java.util.*; /** * InitialContext reconnection test. * @author Christian Tellefsen */ // Make sure you: // a) Have a META-INF/application-client.xml in the right place. // b) Replace the server name below. public class ContextTest { static void connect() { Hashtable env = new Hashtable(); env.put("dedicated.connection","true"); // <--- this makes it work! env.put( "java.naming.factory.initial", "com.evermind.server.ApplicationClientInitialContextFactory"); env.put( "java.naming.provider.url", "ormi://localhost/appit"); // replace with your server try{ // This will show the login box the first time, // but not the second time. new InitialContext(env); } catch(Exception e) {e.printStackTrace();} } public static void main(String[] s) { connect(); System.out.println("Once more unto the breach..."); connect(); } } -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Yashasree Sent: Thursday, October 04, 2001 10:48 PM To: Orion-Interest Cc: Orion-Interest Subject: Re: Why can't orion respond to their customers? (was RE: FW: Logging in to server twice does not work.) Hi Christian. We r in the same boat at u were and suffer from the same problem of logging in to the server twice not working. Did u find any workaround? Or did the orion guys respond Awaiting eagerly for a positive response Thanks in advance Yash - Original Message - From: <[EMAIL PROTECTED]> To: Orion-Interest <[EMAIL PROTECTED]> Sent: Wednesday, August 08, 2001 8:52 PM Subject: Why can't orion respond to their customers? (was RE: FW: Logging in to server twice does not work.) > My God, this is frustrating. > > I have tried reporting the bug in bugzilla. > I have tried mailing to the list. > I have tried mailing Orion directly. > > All I have received from Orion is complete and utter silence. I have not > even gotten a reply saying that the matter is being looked at, or even that > my mail has been received. If I had gotten any respnse at all I would not > have said this publicly, but since you refuse to acknowledge my mails, I > have to ask: > > Why do you not take your paying customers seriously? Your support is > extremely bad. We have production systems running on your server, and we > need to know when the bugs will be fixed. > > yours > Christian. > > Does anyone have any email address the Orion guys will respond to? > > -Original Message- > From: Mike Weissman [mailto:[EMAIL PROTECTED]] > Sent: 8. august 2001 15:34 > To: Orion-Interest > Subject: Re: FW: Logging in to server twice does not work. > > > Christian, > > We never found a way around this, we run from an applet. we were able > to use the RMIContextfactory and have repeated login attempts. We have > also abandoned rmi lookups due to performance and are going towards a > messaging paradigm for communication. > mike > > [EMAIL PROTECTED] wrote: > > > > In think the message was lost again, trying one more time. Sorry for the > > repost... > > > > > Does anyone know how to login again when the first attempt fails? > > > > > > Logging in twice seems to be impossible. How to reproduce: > > > > > > import javax.naming.*; > > > import java.util.*; > > > > > > /** > > > * InitialContext reconnection test. > > > * @author Christian Tellefsen > > > */ > > > > > > // Make sure you: > > > // a) Have a META-INF/application-client.xml in the right place. > > > // b) Replace the server name below. > > > > > > public class ContextTest { > > > static void connect() { > > > Hashtable env = new Hashtable(); > > > env.put( > > > "java.naming.factory.initial", > > > > "com.evermind.server.ApplicationClientInitialContextFactory"); > > >
RE: Orion Server with external webserver
its the port...the ormi port is 23791, not 80. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Fredrik Gusting (PAC) Sent: Thursday, October 04, 2001 12:38 AM To: Orion-Interest Subject: Orion Server with external webserver Hi all I've trouble with my connection from my Tomcat webserver to Orion server. In tomcat have set upp a servlet which takes a request from a browser and then do a lookup for my orionserver that contains a small example of an entitybean that simple returns the current time. I've setup everything onmy local machine. Tomcat port 8080, and Orion port 8000. When I try to create my Initialcontext I get LoginException or something. Her is a part of my code public class Dispatcher extends HttpServlet { /**Initialize global variables*/ private static final String CONTENT_TYPE = "text/html"; private Context context = null; public void init(ServletConfig config) throws ServletException { super.init(config); } /**Process the HTTP Get request*/ public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { try { Properties h = new Properties(); h.put(Context.INITIAL_CONTEXT_FACTORY,"com.evermind.server.ApplicationClient InitialContextFactory"); h.put(Context.PROVIDER_URL,"ormi://localhost:80/time"); h.put(Context.SECURITY_PRINCIPAL, "admin"); h.put(Context.SECURITY_CREDENTIALS, "123"); Context context = new InitialContext(h); // HERE IT CRASHES Object ref = (PerfectTimeHome)context.lookup("PerfectTimeHome"); Do I have to configure orion for login, how??? Has anybody got an external webserver to work with orion. Sample of that please! Regards Fredrik Fredrik Gusting(mailto: [EMAIL PROTECTED]) System Designer Ericsson Process & Application Consulting Kistagången 4 Phone: +46 8 568 63 189 SE-125 82 Kista Mobile: +46 70 52 63 189
RE: URGENT! JNI problem on Orion-Could Not Get Class for Java ....
YiYi, see my answer on www.elephantwalker.com, should fix your problem. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of YiYi Mao Sent: Wednesday, October 03, 2001 4:35 PM To: Orion-Interest Subject: URGENT! JNI problem on Orion-Could Not Get Class for Java Importance: High We're having a problem running JNI (C++) from Orion enviorment. The original error message is: "C++ CommIFCMSListener::processEvent - Could Not Get Class For Java CMSListener Object." The JNI method is called from a Java class, not EJB. The Java application is deployed into Orion Server. The JNI code runs fine outside of Orion, as well as on Borland AppServer. The problem seems to be, not able to find the call back Java enviornment from native to Java. From Java to native is fine. We're under pressure now to re-host our application on Orion. Please help as soon as you can Sincerely, YiYi
RE: I've screwed up a component DD???? NamingException: Cannot lookup java:comp/env attributes, not in a valid component
What happened when you deployed? Did you get any error messages? It looks like your datasource jndi name is wrong in the offending appalmost like it isn't even deployed. Check out the name of your datasource in your resource tag. This is where it is blowing up. For example, if this is in a servlet, there should be a resource tag in the web.xml file. If this is in an ejb, then there is a resource tag in the ejb-jar.xml file. We need a little more to go on, though. You can go to www.elephantwalker.com, and post a request. After you post a request, you can actually attach files to your request... regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Curt SmithSent: Wednesday, October 03, 2001 1:21 PMTo: Orion-InterestSubject: I've screwed up a component DD NamingException: Cannot lookup java:comp/env attributes, not in a valid component I've got two apps deployed as expaned directories. XML files are similar since they're similar apps. But one does not allow any context lookups and one does? orionconsole can't access the context and EJB's in the broken app but can in the other. It gets these naming exceptions in the orion console log. What could be off in my deployment descriptors ??? Thanks!! curt javax.naming.NamingException: Cannot lookup java:comp/env attributes, not in a valid component at com.evermind.server.Application.getEnvironmentContext(Application.java:1669) at com.evermind.server.ApplicationContext.lookup(ApplicationContext.java:104) at com.evermind.server.ApplicationContext.lookup(ApplicationContext.java:63) at javax.naming.InitialContext.lookup(InitialContext.java:350) at gov.ga.gdc.bm.security.dao.ValidateLoginManager.getDatasource(ValidateLoginManager.java:365) at gov.ga.gdc.bm.security.dao.ValidateLoginManager.getDBConnection(ValidateLoginManager.java:400) at gov.ga.gdc.bm.security.dao.ValidateLoginManager.checkPassword(ValidateLoginManager.java:227) at gov.ga.gdc.bm.security.dao.ValidateLoginManager$UserWrapper.authenticate(ValidateLoginManager.java:305) at com.evermind.server.rmi.RMIConnection.run(RMIConnection.java:346) at com.evermind.util.ThreadPoolThread.run(ThreadPoolThread.java:64)
RE: Displaying errors in JSP
for the terminal, you can use System.out.println(e.getMessage()) in the catch phrase for the jsp, you will need to initialize some string variable in the catch block and then use in the html ... <% String error = ""; try { } catch (Exception e){ error = e.getMessage(); } %> ...html stuff <%=error%> But this isn't really always necessary. Orion will spit out the error in the jsp if you don't catch it...since there is a try/catch built around every jsp page. Try it...do something silly in the jsp page to create a Null Pointer Error, and watch the fireworks in the browser. As long as you don't have a 500 error page, your jsp Null Pointer Error will be in the browser. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of EXT-Vaze, Vinay G Sent: Wednesday, October 03, 2001 9:09 AM To: Orion-Interest Subject: Displaying errors in JSP If I have a code block such as <% try { } catch (Exception e) { } %> inside a JSP, how do I output error to either the browser or to the server console ? -- Vinay Vaze M/S : 7H-80 Phone : (425)-865-2929 Email : [EMAIL PROTECTED]
RE: Form-based login
resend...fourth time didn't catch ;. -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 02, 2001 4:34 PM To: Orion-Interest Subject: RE: Form-based login resend...third time didn't catch ;(((. -Original Message----- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 02, 2001 3:09 PM To: Orion-Interest Subject: RE: Form-based login resend...resend, second time didnt catch ;((. -Original Message----- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 02, 2001 2:44 PM To: Orion-Interest Subject: RE: Form-based login resend...first time didn't catch ;(. -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 02, 2001 2:16 PM To: Orion-Interest Subject: RE: Form-based login Dear juha, Jan is correct. This little oversight in the servlet spec doesn't allow any built-in portlet type behaviour. There is a work around, however. Put in a little login form on every page (like with the jsp:include). Wrap the form with the ifInRole tag from the util tag library. If its in your role, display a logout, or change account link. Likewise, use the inInRole tag to switch out or in any protected content. For your little login form, choose an action to a login servlet. In the login servlet, use the roleManager to log the user in...and forward to the requesting page, which was a hidden input in your little login form. You have to bend over and scratch your back, but you can do this with j2ee and orion. Come join the www.elephantwalker.com web site, and join the discussions. We have many on user security. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Jan Heise Sent: Tuesday, October 02, 2001 10:38 AM To: Orion-Interest Subject: AW: Form-based login hi juha, regarding your last paragraph, i think this is the intention of the servlet-spec - and the only "real" usage. all other types of login should be done differently but not via j_security_check. jan -- Jan Heise / Tel: +49-163-4803237 / E-Mail: [EMAIL PROTECTED] -Ursprungliche Nachricht- Von: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]Im Auftrag von Juha Paananen Gesendet: Dienstag, 2. Oktober 2001 15:52 An: Orion-Interest Betreff: Form-based login Hi! In WebLogic 6, the j_security_check recognizes a parameter "j_target_url". I don't think this is part of the J2EE spec, but a WebLogic feature instead. Do you know if there's an equivalent to this in Orion? At least, this j_target_url doesn't seem to work. I need this in a website where there is always (at least, when user has not logged in) a small "login form" visible in the left column, and this form should be submitted to j_security_check and then a specific "welcome page" should be displayed. If I just post the form to j_security_check, I get an error message in the browser "You are not authorized to view this page".. The only way I've managed to make the form-based login to work, is by surfing to some page that has a security-constraint. In this case, Orion takes me to the login form and then to the originally requested page, just as it is supposed to do.. Thanks, Juha
RE: Equivalent to Apache's mod_usertrack?
Title: Equivalent to Apache's mod_usertrack? Larry, You can of course create a cookie, and put it into your client's machine. See the servlet spec and api...this is relatively easy to do with Orion and a filter. Regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Larry VelezSent: Tuesday, October 02, 2001 3:50 PMTo: Orion-InterestSubject: Equivalent to Apache's mod_usertrack? Hi all, I wanted to know if there is an equivalent to Apache's mod_usertrack for J2EE/Orion? I would hate to have to put Apache in front of Orion just for this but we are having issues trying to reflect a unique visitor in the weblogs. http://www.webtrends.com/support/Solution.asp?id=5689050555 thanx, Larry
RE: JSP Parsing error
Althought it doesn't look it, this needs a Tag Extra Info (TEI) stuff included. A tag can't use request time variables unless TEI is used. Here is the tutorial for this: http://www.orionserver.com/taglibtut/lesson5/ To get around this, just use the actual value for LaboratoryTag.ADD_LABORATORY. regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Marcin Jarzab Sent: Wednesday, February 28, 2001 1:09 PM To: Orion-Interest Subject: JSP Parsing error I'm using in my pages taglibs which get parameters during invoking them on JSP page like: and during parsing I get error: -- Error parsing JSP page /webcomp/admin/add_laboratory.jsp <%=LaboratoryTag.ADD_LABORATORY%> is a request-time attribute (invalid for this attribute) -- I'm using Orion 1.5.2 What I'm doing wrong? Thanks in advance Martin
RE: Transactions for stateless SessionBeans
Try ConnectionDataSource instead of DriverManagerDataSource...this fixed my transaction problems. Also, use the resource location from your ejb-jar.xml. This was the resource tag in your entity bean descriptor. You are looking up the plain vanilla datasource. If you lookup a datasource directly (I never do this) you must use the one that support transactions and pooling for an ejb (the ejb-location) which is not in your datasource. Here's a datasource for oracle: This is ok for a thin driver all the way, and no oci client. Notice that your lookup is MyDSCore...this wouldn't really support transactions or pooling. If you use the ejb-jar location, do a look on ServerDataSource (if that's the resource name you gave your datasource in the ejb-jar.xml)or whatever, and Orion pick the proper connection, the ejb-location. Regards, the elephantwalker www.elephantwalker.com come join us, we are having a lively discussion on pooling and transaction right now. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tommy Wassgren Sent: Wednesday, September 26, 2001 8:35 AM To: Orion-Interest Subject: Transactions for stateless SessionBeans I'm using a data-source (Oracle) from a stateless session bean. The session bean uses bean managed transactions (User transactions). Reading and writing data to the Oracle database works fine. The only problem is that when the ejb-transaction gets rolled back the database transaction does not roll back. Simplified example: // Get the connection Context context = new InitialContext(); ds = (DataSource)context.lookup("jdbc/MyDSCore"); Connection conn = ds.getConnection(); conn.setAutoCinnit(false); try { sessionContext.getUserTransaction().begin(); conn.createStatement(.); conn.executeUpdate(); // If a rollback occurs here the data still gets updated ... sessionContext.getUserTransaction().commit(); } catch(Exception e) { e.printStackTrace(); sessionContext.getUserTransaction().rollback(); } My data-sources.xml looks like this: Does anyone have any idea of why the transactions are not working properly???
RE: Orion 1.5.2 and Java 2 SDK 1.3.1
Vlad, Its tough to get linux to work on a laptop, but we get Orion an Sun jdk1.3.1 working together on a Windows 98 laptop all of the time. Works fine. I would have to say Sun jdk1.3.1 is better than the previous release on windows systems. There have been issues with the client and server hot spot vm's with earlier versions, but 1.3.1 seems to have cleared this up. regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Vlad Vinogradsky Sent: Friday, September 21, 2001 9:22 PM To: Orion-Interest Subject: Orion 1.5.2 and Java 2 SDK 1.3.1 Do they work together? Thanks, Vlad
RE: Questions about Orion
Vlad, see comments... regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Vlad Vinogradsky Sent: Friday, September 21, 2001 7:08 AM To: Orion-Interest Subject: RE: Questions about Orion Thanks for your response. Few follow-up questions. >By the way, Orion by itself can out do IIS by six to one!... In what scenario? Orion serving up jsp pages compared to asp pages from IIS. >... make sure you test the jdbc drivers with all necessary uses of sql including >things like LIMIT, CLOB, BLOB as well as 100's of open connections. These are the key >database needs for a appserver servicing the web. What about resource/connection pooling? Orion uses connection pooling for its ejbs, and you can specify connection pooling for your jdbc connections in orion with a DataSource configuration. >Like anything, if you run it on Windows, it will be compromised. I was asking more about known Orion vulnerabilities? AFAIK, there are none if you take the following steps: 1. Run orion as a non administor user. 2. Do not use any of the script based servlets, such as php. 3. User jdbc drivers that support encrypted network traffic. Oracle does this...I don't know about m$ sql server. However, Windows is known to have many security issues, and if your operating system security is compromised, the hackers will have access to the orion, and any other resources you have. I would recommend staying away from any windows system for any internet application because the windows record on security is so BAD. You should see my internet logs the last few days ;(...filled with requests for silly things on the c drive, something the frequently patched IIS is vulnerable to, but which orion justs sends back a 404. In the past two years, I have seen no similar failure of Orion, nor any complaints on the list. Thanks, Vlad -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of The elephantwalker Sent: Friday, September 21, 2001 1:08 AM To: Orion-Interest Subject: RE: Questions about Orion Vlad, Here are the answers as I know them: 1. SQL Server 2000 database --> That's a tough one. I don't know any IT managers recommending this beast. But if you got to live with it ... make sure you test the jdbc drivers with all necessary uses of sql including things like LIMIT, CLOB, BLOB as well as 100's of open connections. These are the key database needs for a appserver servicing the web. 2. Orion uses the Java 1.3 jvm from Sun, IBM or others. As they say, if it runs on one, it runs on all. 3. We use IBM's jvm with absolutely no problems. 4. Scalability is determined by your clustering needs. Orion clusters httpsessions in islands of two to four servers. Statefull Session Beans are not clustered, but entity beans and slsb's are easily set up in a clustered environment. Orion is easily the fastest jsp/servlet engine on the planet, and along with some very good performance numbers on the ejb side, you can out do other app servers by a factor of 3 to 1. By the way, Orion by itself can out do IIS by six to one! Oracle thought so much of the Orion performance, they licensed the software as the core of their j2ee application server. 5. j2ee security is used on Orion, you can implement your own user security, or link up with ldap, or use the builtin usermanagers for databases. SSL is also a feature of Orion, but I would recommend locking down your web server with SSL, or use a hardward accelerator, and proxying Orion outside the dmz. This is how most firms implement appservers. 6. Like anything, if you run it on Windows, it will be compromised. We have not had any security troubles with Linux RedHat 7.1 and orion. 7. Ironflare doesn't really provide the technical support that some need. With Ironflare's encouragement, companies like Flowsheet Technologies and others provide subscription based customer support for Orion. Join our site, www.elephantwalker.com, its free, and sign up for a subscription when you need some help. We also provide a course for Orion in the San Francisco Bay Area. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Vlad Vinogradsky Sent: Thursday, September 20, 2001 8:22 PM To: Orion-Interest Subject: Questions about Orion I am evaluating the Orion server for use in a production web site which would be hosted by a hosting services provider. It would run on a Windows 2000 box alongside other web sites serviced by IIS and will manage data in SQL Server 2000 database. I have a few questions I wasn't able to find answers to and I wonder if you can help me with them. 1. I wonder if anybody had any negative experience using Orion server on Windows 2000 or with SQL Server 2000? I-Net jdbc products are going to be used. 2. An
RE: HELP !!! SECURITY
David, The orionconsole application allows you to add and remove users, but it is VERY buggy, and not supported by IronFlare: java -jar orionconsole.jar Most of us write a admin web module to administer user's. Here are the relavent API's: 1. roleManager: This class can be instanced by using the following jndi lookup: RoleManager manager = (RoleManager)new InitialContext().lookup("java:comp/RoleManager"); It has things like addToRole, login, getPrincipal, and removePrincipal. This api is the class you should use to interact with a second api, usermanager. Check out the api here http://www.orionserver.com/docs/api/index.html. 2. UserManager: There are three of these builtin, - XMLUserManager. This one is used by the container for the global application, and users, and role/group mapping is stored in the principals.xml file of the orion/config directory. Since it is usually the parent of all other usermanagers, the principals.xml file should be included in each ear/META-INF directory with its own usersecurity. - DataSourceUserManager. This usermanager uses a database to store user information, groups, etc. - EJBUserManager. This usermanager uses an ejb to store user information, groups, etc. You can write your own user manager to interface with LDAP or any other security datastore. A good example is in http://www.orionsupport.com/articles/usermanager.html (or http://uk.orionsupport.com/articles/usermanager.html mirror). These security api's are specific to Orion, since there is no specification for how containers impement user security in j2ee. If you want to use user security, www.jollem.com has a draft tutorial on user security which talks about the specifics of configuring security for an application in orion. regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of David BonillaSent: Friday, September 21, 2001 8:23 AMTo: Orion-InterestSubject: HELP !!! SECURITY Ok... I have understand all about security but know, how and where can I activate a option to use a Orion-Based console or something else to control de User Name and Password ? __David Bonilla FuertesTHE BIT BANG NETWORKhttp://www.bit-bang.comProfesor Waksman, 8, 6º B28036 MadridSPAINTel.: (+34) 914 577 747Móvil: 656 62 83 92Fax: (+34) 914 586 176__
re: CMP and BLOB fields
didn't catch the first time around -Original Message- From: The elephantwalker [mailto:[EMAIL PROTECTED]] Sent: Friday, September 21, 2001 1:32 AM To: Orion-Interest Subject: RE: CMP and BLOB fields Juan, If you make your cmp field a byte[], the type in Oracle will be BLOB in version 1.5.0 and above. You are almost there, however, BLOB's are not stored in the same way as other fields, and are therefore limited to 4k in Oracle with a Thin Driver. There is a way, however, to use BLOB's in a cmp, and within the spec. We do this on our web site, www.elephantwalker.com. Users can attach up to 4 MB of files to the message board at a time, and all of these are stored with a cmp/ejb. How do we do it? The cmp has the standard fields for a file: mime-type, size, name, creation date, modified date (and whatever else you want). We have business methods in the cmp which are setAttachment, getAttachment. Within the business method, a stateless session bean is used to put the byte[] in and out of the ejb. The stateless session bean does the down and dirty with jdbc to break the 4k barrier for the BLOB. On remove, the slsb also removes the BLOB. The disadvantage is we have to limit the size of any one file, for memory reasons. But you could easily chunk up the byte[] to get around this problem. We will be putting this up on our tips page soon, but until then, you can take a peak at the CLOB version of the stateless session bean at www.elephantwalker.com/rfa?id=86, the BLOB version is very similar. You will have to join, to look at this, but its free. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Juan Fuentes Sent: Friday, September 21, 2001 12:34 AM To: Orion-Interest Subject: CMP and BLOB fields Hi list! I have a CMP with a BLOB field and it does not work. I've read in the list archives that the EJB specifications explain that a CMP cannot have BLOB fields. I've changed the BLOB by a LONG RAW, and it has started to work. What's the difference between a BLOB and a LONG RAW? If the correct one is LONG RAW, why the Serializable objects are mapped to BLOBs instead of LONG RAWs? I'm using orion 1.4.5 with Oracle Thanks -- ·· Juan Fuentes Nieto Essi Projects [EMAIL PROTECTED]t +34 977 221 182 http://www.essiprojects.com f +34 977 230 170 ··
RE: Questions about Orion
Vlad, Here are the answers as I know them: 1. SQL Server 2000 database --> That's a tough one. I don't know any IT managers recommending this beast. But if you got to live with it ... make sure you test the jdbc drivers with all necessary uses of sql including things like LIMIT, CLOB, BLOB as well as 100's of open connections. These are the key database needs for a appserver servicing the web. 2. Orion uses the Java 1.3 jvm from Sun, IBM or others. As they say, if it runs on one, it runs on all. 3. We use IBM's jvm with absolutely no problems. 4. Scalability is determined by your clustering needs. Orion clusters httpsessions in islands of two to four servers. Statefull Session Beans are not clustered, but entity beans and slsb's are easily set up in a clustered environment. Orion is easily the fastest jsp/servlet engine on the planet, and along with some very good performance numbers on the ejb side, you can out do other app servers by a factor of 3 to 1. By the way, Orion by itself can out do IIS by six to one! Oracle thought so much of the Orion performance, they licensed the software as the core of their j2ee application server. 5. j2ee security is used on Orion, you can implement your own user security, or link up with ldap, or use the builtin usermanagers for databases. SSL is also a feature of Orion, but I would recommend locking down your web server with SSL, or use a hardward accelerator, and proxying Orion outside the dmz. This is how most firms implement appservers. 6. Like anything, if you run it on Windows, it will be compromised. We have not had any security troubles with Linux RedHat 7.1 and orion. 7. Ironflare doesn't really provide the technical support that some need. With Ironflare's encouragement, companies like Flowsheet Technologies and others provide subscription based customer support for Orion. Join our site, www.elephantwalker.com, its free, and sign up for a subscription when you need some help. We also provide a course for Orion in the San Francisco Bay Area. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Vlad Vinogradsky Sent: Thursday, September 20, 2001 8:22 PM To: Orion-Interest Subject: Questions about Orion I am evaluating the Orion server for use in a production web site which would be hosted by a hosting services provider. It would run on a Windows 2000 box alongside other web sites serviced by IIS and will manage data in SQL Server 2000 database. I have a few questions I wasn't able to find answers to and I wonder if you can help me with them. 1. I wonder if anybody had any negative experience using Orion server on Windows 2000 or with SQL Server 2000? I-Net jdbc products are going to be used. 2. Any comments on performance, scalability and availability of the Orion server on Windows 2000? 3. What VM is best to use to run Orion server? 4. Does it have auto start and restart features? Do you have to have an interactive logon session to start it? 5. What security context does it run in? 6. What is Orion server security track record? Has it ever been compromised or taken out by DOS attacks? 7. Any comments on IronFlare's technical support? It looks like there is no live tech support - just email. All input is welcome. Thanks, Vlad
RE: Stupid CLASSPATH and Oracle JDBC drivers. Need help!
got it...you need to be in the orion directory, the lib directory is pointed to by a relative directory, so its looking at your starting directory/lib instead of orion/lib. I always navigate to the orion directory to start it... 'cause it always works. That could be it. Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Fontenot Sent: Wednesday, September 19, 2001 11:41 AM To: Orion-Interest Subject: RE: Stupid CLASSPATH and Oracle JDBC drivers. Need help! Using: java -server -Xincgc -Xms70m -Xmx128m -jar ./orion.jar -out ./orion.log -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of The elephantwalker Sent: Wednesday, September 19, 2001 11:56 AM To: Orion-Interest Subject: RE: Stupid CLASSPATH and Oracle JDBC drivers. Need help! How do you start orion? should be java -jar orion.jar anything else may defeat the orion.jar class loader, which actually loads the *.jar and *.zip from the orion/lib directory. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Fontenot Sent: Wednesday, September 19, 2001 10:34 AM To: Orion-Interest Subject: RE: Stupid CLASSPATH and Oracle JDBC drivers. Need help! We had to put the Oracle jar/zip file into the JRE/lib/ext directory to be recognized on Win2K and solaris. We never figured out why this is the case. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Lee Sent: Wednesday, September 19, 2001 10:44 AM To: Orion-Interest Subject: Stupid CLASSPATH and Oracle JDBC drivers. Need help! Hi All, I simply trying to get Orion to see my Oracle JDBC drivers!! I've placed my classes12.zip in the [ORION_HOME]/lib directory but it cannot see it. I've also tried previous posted suggestions of modifying the shell $CLASSPATH variable and the library path located in the application.xml file. I have no problems on my Intel Win 2000 platform running Java 2 SDK 1.3.1-b24 and Orion 1.5.2. My problems are occurring on a PA-RISC platform running: Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.1.01-release-010816-12:37) Java HotSpot(TM) Server VM (build 1.3.1 1.3.1.01-release-010816-13:34-PA_RISC2.0 PA2.0, mixed mode). I'm also using the same classes12.zip on both machines. I get the following error upon server startup: Error initializing data-source 'jdbc/OracleDSCore': DriverManagerDataSource driver 'oracle.jdbc.driverd.' Upon a login attempt to my app, which tries to use the Oracle Datasource, I get the following: 2001-09-17 17:18:12,498 [ApplicationServerThread] ERROR java.lang.Class - SQL Exception during getting userinfo java.sql.SQLException: No suitable driver at java.sql.DriverManager.getConnection(DriverManager.java:537) at java.sql.DriverManager.getConnection(DriverManager.java:177) at com.evermind.sql.DriverManagerDataSource.getConnection(Unknown Source) at com.sprint.framework.rdbms.RDBMSUtility.getConnection(RDBMSUtility.java:297) at com.sprint.nsp.auth.UserManager.getUserInfo(UserManager.java:41) at com.sprint.nsp.auth.LoginController.isValid(LoginController.java:94) at __jspPage1_Authenticate_jsp._jspService(__jspPage1_Authenticate_jsp.java:84) at com.orionserver.http.OrionHttpJspPage.service(Unknown Source) at com.evermind._ah._rad(Unknown Source) at com.evermind.server.http.JSPServlet.service(Unknown Source) at com.evermind._cxb._abe(Unknown Source) at com.evermind._cxb._uec(Unknown Source) at com.evermind._io._twc(Unknown Source) at com.evermind._io._gc(Unknown Source) at com.evermind._if.run(Unknown Source) Database error, Please try again. If problem persist please contact administrator. Everything works OK if I unzip the JDBC drivers into the /lib directory...but this is a hack would like to know why it won't pick up my ZIP file. It works with other JARs I put inarghhg! Any help is MUCH appreciated. --Dan
RE: Stupid CLASSPATH and Oracle JDBC drivers. Need help!
How do you start orion? should be java -jar orion.jar anything else may defeat the orion.jar class loader, which actually loads the *.jar and *.zip from the orion/lib directory. regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Mike Fontenot Sent: Wednesday, September 19, 2001 10:34 AM To: Orion-Interest Subject: RE: Stupid CLASSPATH and Oracle JDBC drivers. Need help! We had to put the Oracle jar/zip file into the JRE/lib/ext directory to be recognized on Win2K and solaris. We never figured out why this is the case. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dan Lee Sent: Wednesday, September 19, 2001 10:44 AM To: Orion-Interest Subject: Stupid CLASSPATH and Oracle JDBC drivers. Need help! Hi All, I simply trying to get Orion to see my Oracle JDBC drivers!! I've placed my classes12.zip in the [ORION_HOME]/lib directory but it cannot see it. I've also tried previous posted suggestions of modifying the shell $CLASSPATH variable and the library path located in the application.xml file. I have no problems on my Intel Win 2000 platform running Java 2 SDK 1.3.1-b24 and Orion 1.5.2. My problems are occurring on a PA-RISC platform running: Java(TM) 2 Runtime Environment, Standard Edition (build 1.3.1.01-release-010816-12:37) Java HotSpot(TM) Server VM (build 1.3.1 1.3.1.01-release-010816-13:34-PA_RISC2.0 PA2.0, mixed mode). I'm also using the same classes12.zip on both machines. I get the following error upon server startup: Error initializing data-source 'jdbc/OracleDSCore': DriverManagerDataSource driver 'oracle.jdbc.driverd.' Upon a login attempt to my app, which tries to use the Oracle Datasource, I get the following: 2001-09-17 17:18:12,498 [ApplicationServerThread] ERROR java.lang.Class - SQL Exception during getting userinfo java.sql.SQLException: No suitable driver at java.sql.DriverManager.getConnection(DriverManager.java:537) at java.sql.DriverManager.getConnection(DriverManager.java:177) at com.evermind.sql.DriverManagerDataSource.getConnection(Unknown Source) at com.sprint.framework.rdbms.RDBMSUtility.getConnection(RDBMSUtility.java:297) at com.sprint.nsp.auth.UserManager.getUserInfo(UserManager.java:41) at com.sprint.nsp.auth.LoginController.isValid(LoginController.java:94) at __jspPage1_Authenticate_jsp._jspService(__jspPage1_Authenticate_jsp.java:84) at com.orionserver.http.OrionHttpJspPage.service(Unknown Source) at com.evermind._ah._rad(Unknown Source) at com.evermind.server.http.JSPServlet.service(Unknown Source) at com.evermind._cxb._abe(Unknown Source) at com.evermind._cxb._uec(Unknown Source) at com.evermind._io._twc(Unknown Source) at com.evermind._io._gc(Unknown Source) at com.evermind._if.run(Unknown Source) Database error, Please try again. If problem persist please contact administrator. Everything works OK if I unzip the JDBC drivers into the /lib directory...but this is a hack would like to know why it won't pick up my ZIP file. It works with other JARs I put inarghhg! Any help is MUCH appreciated. --Dan
RE: finder parameters
Sergey, AFAIK order of the method params is the order of the wild cards $1 $2 etc. I do this all of the time. Go to the finder-method partial="false" query="do the down an dirty with sql and my $1 card and $2 card" should read "do the down and dirty with sql an my asc card and desc card" if the arguments to the method were "asc" and "desc", respectively. Of course this isn't really good sql, but I'm just having some fun. Regards, the elephantwalker www.elephantwalker.com -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of sergey Sent: Wednesday, September 19, 2001 7:04 AM To: Orion-Interest Subject: finder parameters Please help me!!! Is there any possibility to pass order direcrtion as parameter of a finder? That is parameter string ("asc" or "desc") is added to the end of SQL? Ex.: findAllSortedByState("asc"); In orion-ejb-jar.xml: SomeTable findAllSortedByState In SomeTableHome.java: public Collection findAllSortedByState(String direction) throws RemoteException, FinderException; public static final String findAllSortedByStatec_query="full: select * from SomeTable order by state $1";
RE: session bug
We had exactly the same problem. If you click on a link to a servlet (thats a get method), and the servlet cleans up the session (session.invalidate(), session = request.getSession(true),) and then forwards to a logout.html or logout.jsp...no problem, the new session is created. If you click on a form submit, with the method post, and the servlets does its form thing, and then does a session.invalidate(), session.getSession(true), and then forwards to the logout.html our logout.jsp...the session is not invalidated. We know this, because if you check the getRemoteUser, its still the old bastard, and not the new guest. However, if you put a double pump in the jsp, that is a ifInRole("old bastards") response.redirect("/logout"), where the /logout servlet again tries to session.invalidate(), session.getSession(true) and back to the logout.jsp...it works. The only difference between the two methods in the spec is how cookies are handled. The redirect garantees that the cookie is reloaded. Get works with a forward after you invalidate a session Post only works with a redirect after you invalidate a session. This sounds like either a bug, or the spec treats cookies under Get and Post differently, since Orion uses cookie's to keep session id's by default (url rewritting is only used when cookies are not used by the client). regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Tom Bruser Sent: Tuesday, September 18, 2001 5:24 PM To: Orion-Interest Subject: RE: session bug I have reported an instance of this bug on Orion's bugzilla Bug #566 which still remains marked as 'New' well after 1 month, so I still have no feedback as to whether this is a bug or not. My login_form.jsp file has the purpose of invalidating the current session (to effectively logout any existing session), creating a new session, retrieving a 'brand' bean, and displaying an appropriate login form which utilizes some of the fields in the 'brand' bean (to determine colors and logo image location, etc). I use a JSP custom tag to handle the brand bean retrieval: HttpServletRequest request = (HttpServletRequest)pageContext.getRequest(); HttpSession session = request.getSession(); session.invalidate(); HttpSession newsession = request.getSession(true); // code to retrieve the brandbean omitted to reduce the clutter session.setAttribute("brand",brandbean); My JSP code for login_form.jsp contains this excerpt: The resulting output when trying to access the page is as follows: java.lang.IllegalStateException: Session was invalidated at com.evermind[Orion/1.5.2 (build 10460)].server.http.EvermindHttpSession.getAttribute(Unknown Source) at /login_form.jsp._jspService(/login_form.jsp.java:58) // additional inconsequential stacktrace omitted. It is obvious here that the object reference used to access the session scope from the useBean tag has grown stale and is not effected by calls to the request object's getSession(boolean) method. A secondary issue is that the actual Session ID does not change when a new session is requested. I would like this to take place as well if it is possible. Does anyone have any suggestion of what I can implement without creating nasty scriptlet code or otherwise significantly altering my control flow? -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of The elephantwalker Sent: Tuesday, September 18, 2001 3:11 PM To: Orion-Interest Subject: RE: session bug Rafael, This won't work reliably on a post request, because the session management also depends on cookies. In order to make sure you get a new session, you will need to put in something like this (only for post request): session.invalidate() session = request.getSession(true); if(!session.getNew()) response.sendRedirect("/logout"); This will work about 99% of the time...whereas if you just do session.invalidate(), session=request.getSession(true) it won't work in a post request. Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Rafael Alvarez Sent: Tuesday, September 18, 2001 11:00 AM To: Orion-Interest Subject: Re: session bug Hello Denis, Try doing this: session = request.getSession(true); System.out.println("session = request.getSession(false);\t" + session.hashCode()); System.out.println("session = " + session); session.invalidate(); System.out.println("session.invalidate();\t" + session.hashCode()); System.out.println("session = " + session); session = request.getSession(true); System.out.println("session = request.getSession();\t" + session.hashCode()); System.out.println("session = " + session); That way you'll get a new session after the session is invalidated. The proble
RE: session bug
Rafael, This won't work reliably on a post request, because the session management also depends on cookies. In order to make sure you get a new session, you will need to put in something like this (only for post request): session.invalidate() session = request.getSession(true); if(!session.getNew()) response.sendRedirect("/logout"); This will work about 99% of the time...whereas if you just do session.invalidate(), session=request.getSession(true) it won't work in a post request. Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Rafael Alvarez Sent: Tuesday, September 18, 2001 11:00 AM To: Orion-Interest Subject: Re: session bug Hello Denis, Try doing this: session = request.getSession(true); System.out.println("session = request.getSession(false);\t" + session.hashCode()); System.out.println("session = " + session); session.invalidate(); System.out.println("session.invalidate();\t" + session.hashCode()); System.out.println("session = " + session); session = request.getSession(true); System.out.println("session = request.getSession();\t" + session.hashCode()); System.out.println("session = " + session); That way you'll get a new session after the session is invalidated. The problem arises because the session object that is associated with the request object is the invalidated one until you create a new session, either by a new hit in the page/servlet or by using request.getSession(true). Tuesday, September 18, 2001, 9:44:52 AM, you wrote: DK> Hello everyone! DK> I think I have found bug in orion 1.5.2. DK> There is problem with sessions. When I invalidate session and then get new DK> session, sometimes (not always) I get same invalidated session. DK> Does anybody have same problem? Any solution except that I remove all data DK> from session? DK> Thanks in advance. DK> Here is code that demonstrates bug: DK> session = request.getSession(true); DK> System.out.println("session = request.getSession(false);\t" + DK> session.hashCode()); DK> System.out.println("session = " + session); DK> session.invalidate(); DK> System.out.println("session.invalidate();\t" + session.hashCode()); DK> System.out.println("session = " + session); DK> session = request.getSession(); DK> System.out.println("session = request.getSession();\t" + DK> session.hashCode()); DK> System.out.println("session = " + session); DK> Orion's output: DK> session = request.getSession();2935133 DK> session = HTTP Session AKAEMHOGAJOD DK> session.invalidate(); 2935133 DK> session = HTTP Session AKAEMHOGAJOD DK> session = request.getSession(); 2935133 DK> session = HTTP Session AKAEMHOGAJOD DK> Exception is DK> java.lang.IllegalStateException: Session was invalidated DK> at com.evermind.server.http.EvermindHttpSession.setAttribute(Unknown DK> Source) DK> at DK> isvu.kadrovska.web.command.LoginCommand.execute(LoginCommand.java:161) DK> at isvu.kadrovska.web.Kadrovska.doPost(Kadrovska.java:183) DK> at javax.servlet.http.HttpServlet.service(HttpServlet.java:211) DK> at javax.servlet.http.HttpServlet.service(HttpServlet.java:309) DK> at javax.servlet.http.HttpServlet.service(HttpServlet.java:336) DK> at com.evermind._cxb._abe(Unknown Source) DK> at com.evermind._cxb._uec(Unknown Source) DK> at com.evermind._io._twc(Unknown Source) DK> at com.evermind._io._gc(Unknown Source) DK> at com.evermind._if.run(Unknown Source) Best regards, Rafaelmailto:[EMAIL PROTECTED]
RE: Is this fixed yet?
AFAIK, still broken. regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Steve Best Sent: Tuesday, September 18, 2001 9:14 AM To: Orion-Interest Subject: Is this fixed yet? Just wondering if anyone has fixed SSL load balancing in Orion yet. Thanks Steve Best Unix Systems Administrator www.simpledevices.com
elephantwalker.com
Dear Group, Thanks for all of you who have joined the site. We have well over 150 clients now, and are experiencing growth of over 50% per week. We have updated the site with some of your suggestions. Some improvements include: 1. Automatic login in the site. Next time you login, check the "Save my login information on this computer". We use a 3DES encryption cipher for the cookie data, so don't worry that your password will be stolen. You can zero out this information on a computer by clicking the logout button. If you don't click the logout button, the information will stay current for two weeks. 2. We have incorporated HTML filters in the messages so you don't have to use complete HTML now. You can still use HTML, although we don't allow things like table which would mess up the view of the message. 3. We have Next and Previous buttons on the Request display, so you can also scroll through a list without going to the page view of the Request list. 4. We have a bread-crumbs navigator from each Request view so you can easily go back to your list. 5. You can change your password now in the My Account tab. 6. We have several simple preferences now which allow you to control whether or not others see your name, email address, company and phone number. Don't worry, the default is nobody sees this stuff. We have more coming in the future such as a Search feature, List-Server view (so you can see those Threads), Ignore and Friends lists, a Tips and Hints application, and a News Application. Please make comments. To find good hints before the Tips and Hints application hits the site, check out the Closed list, as this has Requests which have been solved. Recent hits for everyone have been the CLOB request, and several User Security requests. Regards, the Elephantwalker www.elephantwalker.com
RE: ServletContextAttributesListener
unless you map two different url addresses to your servlet. -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Dave Ford Sent: Monday, September 17, 2001 12:32 PM To: Orion-Interest Subject: ServletContextAttributesListener I have a class which implements the ServletContextAttributesListener interface. It has been registered as a listener in web.xml. The problem is, Orion is creating two instances. Shouldn't there only be ONE instance of an application level object? Here is the class: import javax.servlet.*; public class Foo implements ServletContextAttributesListener { public void attributeAdded(ServletContextAttributeEvent ev) { System.out.println(this + " - Foo.servletContextAttributeAdded: " + ev.getName()); } public void attributeReplaced(ServletContextAttributeEvent event) {} public void attributeRemoved(ServletContextAttributeEvent event) {} public void test(){ System.out.println(this + " - Foo.test"); } } Here is a JSP that uses the class: (line 1) <% f.test(); %> (line 2) Here is the output: Foo@7808b9 - Foo.servletContextAttributeAdded: f Foo@4da23 - Foo.test If you look at the memory addresses, you'll see that there are two instances. Is this a bug or am I misunderstanding something? Dave Ford Smart Soft - The Java Training Company http://www.smart-soft.com
RE: Restricting access to only Session Manager ?
The point was to use the facade pattern. Only access the entity bean in the slsb, and use slsb methods from the servlet or client to mutate date AND get data. You can also use authentication role's on your slsb methods to restrict or prevent access. This is what we on our www.elephantwalker.com site. We never access an entity bean directly from a servlet, but use a slsb to do this. This way we are sure that the correct business methods are be used and coordinated. Even if we tried to access an entity bean method, we wouldn't be able to look up the context of the entity bean in the servlet. Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Eddie Post Sent: Saturday, September 15, 2001 1:33 PM To: Orion-Interest Subject: RE: Restricting access to only Session Manager ? Elephantwalker, Thanks (see below) >an ejb reference. This means that your container will not allow you to get >the context for your entity ejb, so you won't be able to call any methods >from the client. But then I also can't call the entity get methods ??, or can I ?. Which is what I want. Eddie >From: "The elephantwalker" <[EMAIL PROTECTED]> >Reply-To: Orion-Interest <[EMAIL PROTECTED]> >To: Orion-Interest <[EMAIL PROTECTED]> >Subject: RE: Restricting access to only Session Manager ? >Date: Sat, 15 Sep 2001 09:31:55 -0700 > >Eddie, > >Use your slsb or sfsb (the session manager) as your facade to the ejb for >all access. In your web.xml or client.xml, only refer to the slsb or sfsb >as >an ejb reference. This means that your container will not allow you to get >the context for your entity ejb, so you won't be able to call any methods >from the client. > >You can control security on your session manager by creating security >constraints for each method, or for method name patterns. This way, you can >allow the "client" role access to methods which get*, and "mutator" role >access to methods change*. > >In orion, you map the roles to groups (role is a j2ee idea, whereas groups >is an Orion deployment specification). The groups are defined in the >principals.xml file of the META-INF directory for the ear file. The group >to >role mapping is defined in all of the orion-*.xml files such as >orion-ejb-jar.xml, orion-web.xml, orion-application.xml. This allows the >same group to be assigned to different roles in different applications...a >good idea when you think that various jar/war/ear files may be from >different vendors, and have different names for their j2ee roles. > > >regards, > >the elephantwalker > > >-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]]On Behalf Of Ed Bras >Sent: Saturday, September 15, 2001 3:09 AM >To: Orion-Interest >Subject: Restricting access to only Session Manager ? > > >Hellu, > >How can I configure Orion and my J2EE application such that client >applications are only able to call the get methods of the entity beans ? >I want that all modification are done throw the Session Manager. The >Session manager functiones as an intermediate to the entity beans. >I am using CMP on Orion 1.5.1 with Java 1.3. > >Eddie > > _ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp
RE: Restricting access to only Session Manager ?
Eddie, Use your slsb or sfsb (the session manager) as your facade to the ejb for all access. In your web.xml or client.xml, only refer to the slsb or sfsb as an ejb reference. This means that your container will not allow you to get the context for your entity ejb, so you won't be able to call any methods from the client. You can control security on your session manager by creating security constraints for each method, or for method name patterns. This way, you can allow the "client" role access to methods which get*, and "mutator" role access to methods change*. In orion, you map the roles to groups (role is a j2ee idea, whereas groups is an Orion deployment specification). The groups are defined in the principals.xml file of the META-INF directory for the ear file. The group to role mapping is defined in all of the orion-*.xml files such as orion-ejb-jar.xml, orion-web.xml, orion-application.xml. This allows the same group to be assigned to different roles in different applications...a good idea when you think that various jar/war/ear files may be from different vendors, and have different names for their j2ee roles. regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Ed Bras Sent: Saturday, September 15, 2001 3:09 AM To: Orion-Interest Subject: Restricting access to only Session Manager ? Hellu, How can I configure Orion and my J2EE application such that client applications are only able to call the get methods of the entity beans ? I want that all modification are done throw the Session Manager. The Session manager functiones as an intermediate to the entity beans. I am using CMP on Orion 1.5.1 with Java 1.3. Eddie
RE: install ssl on Orion
Looks like you have some problem with the key. Just try creating another one. Which ca are you using? Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Akbari Hamid Reza Sent: Friday, September 14, 2001 9:20 PM To: Orion-Interest Subject: install ssl on Orion dear . i have a big prblem with ssl on orion . i do all of work that suggested in document orion in page ssl-tips.html but while start orion error : unrecoverable Key Error i need help. __ Terrorist Attacks on U.S. - How can you help? Donate cash, emergency relief information http://dailynews.yahoo.com/fc/US/Emergency_Information/
RE: Oracle questions (Slightly OT)
Bob, This won't work. It may for a day or so, but the server will soon choke under heavy load. You need to have the finally also close the statement, the result set, AND the connection. Also, you need to take care with the update, because clobs will need a new empty clob in the column or the old and new text will mix. You not doing that in your code. Go to www.elephantwalker.com , join if you haven't (its free). Go to this request: http://www.elephantwalker.com/rfa?id=86 It has a stateless session bean and some oracle dao (the facade/dao pattern) which you can download...just click on the files. The code is bullet proof and tested with many large strings (we tested it with over 20,000 messages, all over 30k) ...and is used to power the messages on the site. We use the slsb with a cmp/ejb for our messages...it saved us a lot of time and effort on developing our forum application. The oracle otn stuff is a good start, but leaves out the finally and the update issues. These are well known omissions in the oracle documentation (check out the jdbc forum). regards, the elephantwalker www.elephantwalker.com -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Robert S. SfeirSent: Friday, September 14, 2001 2:39 PMTo: Orion-InterestSubject: Re: Oracle questions (Slightly OT)You can't insert large data into Oracle directly. If you want to use a CLOB to store your large amount of data you CAN do it with a bean, but you have to use some of the procedures imbeded in Oracle to deal with LOB data. An example would be something like this:public int insertClob( int idColumn, String clobData ) throws SQLException { Connection conn = getConnection(); try { // insert empty CLOB String theSql = "INSERT INTO theTable (id, clobColumn) VALUES (" + idColumn + ", EMPTY_CLOB())"; Statement stmt = conn.createStatement(); stmt.executeUpdate( theSql ); // get CLOB locator theSql = "SELECT clobColumn FROM theTable WHERE id = " + idColumn + " FOR UPDATE"; OracleResultSet rs = (OracleResultSet)stmt.executeQuery( theSql ); rs.next(); CLOB clob = rs.getCLOB( 1 ); clob.putChars( 1, clobData.toCharArray() ); // cleanup clob = null; rs.close(); rs = null; stmt.close(); stmt = null; } finally { returnConnection(); } return 1; }Gregory Scott wrote: [EMAIL PROTECTED]" type="cite"> You can also look at the 8.1.7 online docs for java examples or now the 9i online docs. Sign up with Otn.oracle.com, and get a free account, get tons of examples. If you are always going to use an Oracle database, then optimal performance will come from the thick driver. However, the thin driver is the most frequently used.>From: "The elephantwalker" >Reply-To: Orion-Interest >To: Orion-Interest >Subject: RE: Oracle questions (Slightly OT) >Date: Thu, 13 Sep 2001 09:27:28 -0700 > >You will have to use clob's to store large strings in oracle. > >Go to www.elephantwalker.com and login. If you don't have an account, create >one...its free. > >Go to this request http://www.elephantwalker.com/rfa?id=86 > >There you can download a stateless session bean and oracle dao to store >large strings in oracle. A version of this bean is used on the site, and we >have tested it with EXTREMELY large strings. > >I would not use any odbc bridge to do thisa real waste of time. > >Regards, > >the elephantwalker > > > > >-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]]On Behalf Of Lachezar >Dobrev >Sent: Thursday, September 13, 2001 8:51 AM >To: Orion-Interest >Subject: Oracle questions (Slightly OT) > > > Hello group. > I have urgent need of advise. > I use an Oracle DB. And I have problems. > > 1. When using a ThinDriver I can not save large strings, and it is a must >for me. > 2. When using Oracle-Odbc-Jdbc-Ejb I can save the large strings, but... >Orion gets a lot of SQL exceptions, because of 'invalid character'. My >research shows, that while Oracle uses a DOT to express float numbers >(123.456) the jdbc-odbc bridge happens to use the COMMA for the delimiter, >because of my LOCAL settings. Then it just blows up steam. > > So. My question is like is there any non-ODBC-using
RE: orion-application.xml
Prashant, Go to www.elephantwalker.com, and join, its free. Post your server.xml and default-web-site.xml. If you deploy with the admin tool, get these files from the config directory after you have deployed your app. Also post your web.xml from your war, your ejb-jar.xml from your ejb.jar, and your application.xml from your ear. This sounds like a simple deployment issue. Only way to figure out where you've gone south is to check the files. Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Prashant Gaikwad Sent: Thursday, September 13, 2001 11:39 PM To: Orion-Interest Cc: '[EMAIL PROTECTED]' Subject: RE: orion-application.xml Hi Oisin, For deploying bean, I'm using approach similar to you. A session bean has been deployed on Orion and I want to access it from a servlet with the desired result passed by the bean to servlet. Problem is :- The servlet is not getting access to the bean with the browser showing message "You are not authorised to use this page" I'm using ANT for bean development(with proper dir struct proposed for ANT users) and deployment. Also the servlet(.war) file is in the .EAR file. Both the bean and servlet are deployed in Orion's environment using its admin tool. I'm also associating .war file (for servlet) to default website using admin tool so that servlet can be invoked from the browser. Orion auto deployment creates orion-application,orion-web.xml,orion-ejb-jar.xml files in its default /applications-deployment dir. Also Orion shows successful bean deployment in the default /application dir where I'm going wrong or missing any tag entry in any of the discriptor files. My requirment is to access bean and get result on the servlet page. Are there any alternative/diffrent approach to what I'm following. Or are there any links that would saught my problem.Its very urgent. Thanks & Regards Prashant -Original Message- From: OMurchu, Oisin [mailto:[EMAIL PROTECTED]] Sent: Thursday, September 13, 2001 5:28 PM To: Orion-Interest Subject: orion-application.xml I'm having a problem deploying to Orion, which causes the deployment time to increase over time, and eventually the jvm orion is in to run out of memory. Basically, I'm using ANT to deploy, calling the Orion admin tool (com.evermind.client.orion.OrionConsoleAdmin) and passing the relevant parameters into it. The EAR file I'm deploying includes a lib directory, with all of the required extra jar files in it (utilities, etc). In order for orion to use these when loading a bean, I put the line into orion-application.xml, between the and tag. Orion does indeed load up the jar files as expected, so that works. The problem is that each time I deploy, the number of tags at least doubles, and at one stage I was left with over 500 tags in the orion-application.xml file. At this stage, the server slowed to a crawl, and either took several minutes to load up the beans, or else crashed. Has anybody come across this behaviour? And what can I do about it? And does anybody know of a good source of documentation on the various configuration options available for Orion, as I find it is poorly documented in all areas. Maybe the people at IronFlare could get their act together from counting all the money from Oracle, and produce a decent, (even semi-)professional set of documentation. Regds., Oisín.
RE: Oracle questions (Slightly OT)
Greg, The online docs for Oracle are where I got my start...got something running in a couple hours. However, the server choked on the clobs in about 24 hours of operation. These oracle examples are actually just a little wrong. If you look at the otn forum on jdbc, you will see numerous complaints about why the clob and blob examples don't work. If you go to elephantwalker.com (its free to join), and look at http://www.elephantwalker.com/rfa?id=86 you will see some bullet proof code on how to use clobs/blobs in oracle with a stateless session bean. regards, the elephantwalker -Original Message-From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Gregory ScottSent: Thursday, September 13, 2001 10:07 PMTo: Orion-InterestSubject: RE: Oracle questions (Slightly OT) You can also look at the 8.1.7 online docs for java examples or now the 9i online docs. Sign up with Otn.oracle.com, and get a free account, get tons of examples. If you are always going to use an Oracle database, then optimal performance will come from the thick driver. However, the thin driver is the most frequently used. >From: "The elephantwalker" <[EMAIL PROTECTED]> >Reply-To: Orion-Interest <[EMAIL PROTECTED]> >To: Orion-Interest <[EMAIL PROTECTED]> >Subject: RE: Oracle questions (Slightly OT) >Date: Thu, 13 Sep 2001 09:27:28 -0700 > >You will have to use clob's to store large strings in oracle. > >Go to www.elephantwalker.com and login. If you don't have an account, create >one...its free. > >Go to this request http://www.elephantwalker.com/rfa?id=86 > >There you can download a stateless session bean and oracle dao to store >large strings in oracle. A version of this bean is used on the site, and we >have tested it with EXTREMELY large strings. > >I would not use any odbc bridge to do thisa real waste of time. > >Regards, > >the elephantwalker > > > > >-Original Message- >From: [EMAIL PROTECTED] >[mailto:[EMAIL PROTECTED]]On Behalf Of Lachezar >Dobrev >Sent: Thursday, September 13, 2001 8:51 AM >To: Orion-Interest >Subject: Oracle questions (Slightly OT) > > > Hello group. > I have urgent need of advise. > I use an Oracle DB. And I have problems. > > 1. When using a ThinDriver I can not save large strings, and it is a must >for me. > 2. When using Oracle-Odbc-Jdbc-Ejb I can save the large strings, but... >Orion gets a lot of SQL exceptions, because of 'invalid character'. My >research shows, that while Oracle uses a DOT to express float numbers >(123.456) the jdbc-odbc bridge happens to use the COMMA for the delimiter, >because of my LOCAL settings. Then it just blows up steam. > > So. My question is like is there any non-ODBC-using driver for Oracle, >that can handle large strings? > > I'm in an urgent need for help, because the LOCAL settings change is not >an option. > > Please any advice. PLEASE! > > Lachezar > > > > Get your FREE download of MSN Explorer at http://explorer.msn.com
RE: Oracle questions (Slightly OT)
You will have to use clob's to store large strings in oracle. Go to www.elephantwalker.com and login. If you don't have an account, create one...its free. Go to this request http://www.elephantwalker.com/rfa?id=86 There you can download a stateless session bean and oracle dao to store large strings in oracle. A version of this bean is used on the site, and we have tested it with EXTREMELY large strings. I would not use any odbc bridge to do thisa real waste of time. Regards, the elephantwalker -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Lachezar Dobrev Sent: Thursday, September 13, 2001 8:51 AM To: Orion-Interest Subject: Oracle questions (Slightly OT) Hello group. I have urgent need of advise. I use an Oracle DB. And I have problems. 1. When using a ThinDriver I can not save large strings, and it is a must for me. 2. When using Oracle-Odbc-Jdbc-Ejb I can save the large strings, but... Orion gets a lot of SQL exceptions, because of 'invalid character'. My research shows, that while Oracle uses a DOT to express float numbers (123.456) the jdbc-odbc bridge happens to use the COMMA for the delimiter, because of my LOCAL settings. Then it just blows up steam. So. My question is like is there any non-ODBC-using driver for Oracle, that can handle large strings? I'm in an urgent need for help, because the LOCAL settings change is not an option. Please any advice. PLEASE! Lachezar