3 General Management and Security Issues

This chapter describes management and security issues associated with Oracle Application Server. It includes the following topics:

• Section 3.1, "General Issues and Workarounds"

• Section 3.2, "Clustering and Replication Issues"

• Section 3.3, "Documentation Errata"

3.1 General Issues and Workarounds

This section describes general management and security issues. It includes the following topics:

• Section 3.1.1, "Deploying an Application Hangs During File Upload"

• Section 3.1.2, "Limited Management Support for Multiple-JVM OC4J Instances"

• Section 3.1.3, "Problem Removing a Property from a Native Data Source"

• Section 3.1.4, "Use the Command-Line to Restart Standalone OC4J Instances"

• Section 3.1.5, "TopLink Sessions Not Available in Application Server Control Console"

• Section 3.1.6, "Unable to Receive MBean Notification Using OPMN to Start or Stop OC4J"

• Section 3.1.7, "Using the Java Server Pages Standard Tag Libraries"

• Section 3.1.8, "RMD Conditional Does Not Fully Evaluate"

• Section 3.1.9, "Cannot Browse System MBeans If Application Server and OC4J Instance Share the Same Name"

• Section 3.1.10, "Application Server Control Does Not Check for Multibyte Characters in Routing ID Text Fields"

• Section 3.1.11, "Application Server Control Does Not Check for All Invalid Characters in the Context Root Field When Deploying an Application"

3.1.1 Deploying an Application Hangs During File Upload

When you deploy an application using Application Server Control, the upload page may keep showing the "upload in progress" message until you manually refresh the page. In the ASControl.log file, you may see these messages:

WARN  util.MultipartRequestUtil _getMultiPartRequestParameter.263 -
 java.io.IOException: Cannot create temp directory: The system cannot find the
 path specified

You get this message if the temporary directory specified by the java.io.tmpdir system property does not exist.

To determine the value of the java.io.tmpdir system property, go to the Application Server Control's System Property page, which lists the values of system properties. If the directory specified by the java.io.tmpdir system property does not exist, create the directory and restart the server.

3.1.2 Limited Management Support for Multiple-JVM OC4J Instances

With Oracle Application Server 10g Release 3 (10.1.3.2), you can configure any OC4J instance to use multiple Java Virtual Machines (JVMs). You can perform this configuration change by using the Application Server Control Console or by setting the numprocs argument in the opmn.xml file to a number greater than one (1).

The opmn.xml file is located in the following directory in your Oracle Application Server Oracle home:

To set the number JVMs in the Application Server Control Console, see "Creating Additional JVMs for an OC4J Instance" in the Application Server Control online help.

To set the number of JVMs by editing the numprocs argument in the opmn.xml file, refer to the following example, which shows the numprocs entry you must modify:

<ias-component id="OC4J">
  <process-type id="home" module-id="OC4J" status="enabled">
        .
        .
        .
      <process-set id="default_group" numprocs="2"/>
   </process-type>
</ias-component>

Note, however, that this feature is not supported by Application Server Control. Specifically, Application Server Control (represented by the ascontrol application) cannot run on an OC4J instance that is running multiple JVMs. As a result, be sure that you do not configure multiple JVMs for the administration OC4J instance (the OC4J instance that is hosting the active ascontrol).If you choose to configure the number of JVMs for the administration OC4J to more than one (1), then you must use command line tools to manage your Oracle Application Server environment. For example, you must use:

• admin_client.jar for deployment, re-deployment, undeployment, start and stop applications, and shared library management

• Apache Ant for deployment, redeployment, and undeployment of your applications

• opmnctl commands for starting, stopping, and other life cycle operations on the Oracle Application Server

Further, if you are using multiple JVMs on the administration OC4J and, as a result, the Application Server Control Console is not available, then you must make any Oracle Application Server instance configuration changes manually. Manual configuration changes often require you to shut down the Oracle Application Server instance, manually configure the relevant XML files, and then restart Oracle Application Server.

3.1.3 Problem Removing a Property from a Native Data Source

If you use the Application Server Control Console to remove a property from a native data source, Enterprise Manager does not remove the property from the underlying connection factory. As a result, the property (and its current value) is not changed.

This is expected behavior. To set a value on the underlying connection factory, use the setProperty operation of the JDBCDataSource MBean for the native Data Source to do this. You can use the MBean Browser, which is available in the Application Server Control Console, to invoke an MBean operation.

See Also:

"About the MBean Browser" in the Application Server Control online help

3.1.4 Use the Command-Line to Restart Standalone OC4J Instances

Some OC4J configuration pages in the Application Server Control Console (including the JTA Administration and Oracle Internet Directory Association pages) require a restart of the OC4J instance for changes to take affect. Users are notified of this with on screen warnings during configuration operations on these components.

If are using the Application Server Control Console in a standalone OC4J environment, and you use the Restart link, which is displayed after applying changes to one of these pages, the operation may take a few minutes because it performs an internal restart of the OC4J instance. As a result, instead of using the Restart link, Oracle recommends that OC4J standalone users use the command line to restart the OC4J instance.

3.1.5 TopLink Sessions Not Available in Application Server Control Console

If the TopLink Sessions for a TopLink-enabled application are not available in Application Server Control Console, check to be sure the TopLink session is configured to create the MBeans at login time. This is done by ensuring that the application has a serverPlatform class defined, and that the ServerPlatform class has its is RuntimeServicesEnabled flag enabled.

For Oracle Application Server 10g Release 3 (10.1.3.2), you should be using the following platform class, which can be set in the sessions.xml or through the session API:

oracle.toplink.platform.server.oc4j.Oc4j_10_1_3_Platform

When developing a TopLink-enabled application using Oracle JDeveloper, make sure to use version 11 or higher.

See Also:

"Configuring the Server Platform" in the Oracle TopLink Developer's Guide

3.1.6 Unable to Receive MBean Notification Using OPMN to Start or Stop OC4J

You will not be able to receive notification from the ias:j2eeType=J2EEServer,name... MBean entity if you start or stop Oracle Containers for J2EE (OC4J) using OPMN. This happens using either the Application Server Control or the opmnctl stop or opmnct start command from the command line.

There is presently no workaround for this issue.

3.1.7 Using the Java Server Pages Standard Tag Libraries

The Java Server Pages Standard Tag Library (JSTL) makes use of Jaxp 1.2 classes that are packaged with Java Developer Kit 1.4.

Oracle Application Server 10g Release 3 (10.1.3.2) makes use of JDK 1.5 which uses Jaxp 1.3 classes. However, the JSTL still requires the Jaxp1.2 classes. If you run the JSTL with XML related tags in JDK 1.5 you may receive an error message similar to:

: missing class org.apache.xpath.encounter failure.

To avoid JSTL failure, include the xalan.jar file in the required .war file. Add the xalan.jar file into your /WEB-INF/lib directory with the .war file and then re-package.

For more information refer to the JSTL release notes at:

http://java.sun.com/webservices/docs/1.6/jstl/ReleaseNotes.html.

3.1.8 RMD Conditional Does Not Fully Evaluate

As documented in the Oracle Process Manager and Notification Server Administrator's Guide and functional specifications for Dynamic Resource Management (DRM), a Resource Management Directive (RMD) conditional can have a fully qualified path. However, the conditional may not evaluate at all. It may fail to trigger any action or exception even though the opmn.xml file is valid.

RMD definitions can be either:

• Hierarchical: if defined at the ias-instance level or lower. Hierarchical RMDs assume an association within the OPMN configuration components in which they are defined.

• Global: if defined at the process-manager level. Global RMDs require explicit OPMN component specifications.

If you are referencing a hierarchical RMD, instead of a fully qualified path use a hierarchical relative reference.

For example, if the average request time is greater than 500 milliseconds for at least 60 seconds and there are less then 4 processes running for the process-set at which the hierarchical RMD was configured for OC4J, you would use the following in the opmn.xml file:

([process].avgReqTime > 500 {duration(60)})&([process-set].numProcs < 4)

If you are referencing a global RMD use a global absolute reference.

For example, if the heap size of a Java Virtual Machine (JVM) has exceeded 500 MBs, you would use the following in the opmn.xml file:

[process-set=home][process].heapSize > 500000

Note that the opmn.xml file is located in the following directory in your Oracle Application Server Oracle home:

ORACLE_HOME\opmn\conf\

3.1.9 Cannot Browse System MBeans If Application Server and OC4J Instance Share the Same Name

When you install Oracle Application Server 10g Release 3 (10.1.3.2) and specify a name for the default OC4J instance, do not use a name that matches the name of the Oracle Application Server instance or the first few characters of the Oracle Application Server instance name; otherwise, you will be unable to browse the system or applications MBeans using the Application Server Control MBean Browser.

For example, you will not be able to browse the MBeans for the instance if the name of your OC4J instance and the name of your Oracle Application Server instance are as follows:

Oracle Application Server instance name: instance1_as10132.node1.acme.com OC4J instance name: instance1

Similarly, keep this restriction in mind when you are creating additional OC4J instances. Do not use a name that matches the name of the Oracle Application Server that is hosting the OC4J instance.

3.1.10 Application Server Control Does Not Check for Multibyte Characters in Routing ID Text Fields

From the Application Server Control Console, you can modify the routing IDs assigned to the various components of your Oracle Application Server cluster topology.

See Also:

"Changing Routing IDs" in the in the Application Server Control online help

However, when you enter a unique identifier for a Routing ID, be sure to use only alphanumeric characters and underscores. If you attempt to create a routing ID using multibyte characters, you will be unable to stop or start Oracle Process Manager and Notification Server (OPMN).

If you inadvertently use multibyte characters in a routing ID field, you can remedy the problem by editing the opmn.xml file and replacing the multibyte characters with regular ASCII characters.

The opmn.xml file is located in the following directory in your Oracle Application Server Oracle home:

ORACLE_HOME\opmn\conf\

The routing ID for each component is defined within a data element similar to the following:

<category id="start-parameters">
    <data id="routing-id" value="g_rt_id"/>
</category>

3.1.11 Application Server Control Does Not Check for All Invalid Characters in the Context Root Field When Deploying an Application

When you deploy an application from Application Server Control, you are prompted to specify the context root for the application. Application Server Control verifies the text you enter in the Context Root field to prevent you from entering invalid characters.

However, Application Server Control does not check for all invalid characters, such as some Western European characters. As a result, if you enter a context root that contains these types of characters, Application Server Control allows you to proceed with the deployment of the application, but after deployment, you will not be able to access the application using the Web server URL that contains the context root.

Only alphanumeric characters and the underscore (_), plus sign (+), and dash (-) characters are allowed when specifying a context root.

If you inadvertently enter an invalid character, such as a Western European character, in the Context Root field, you can remedy the problem by redeploying the application using a context root that contains only ASCII alphanumeric characters and underscores.

3.2 Clustering and Replication Issues

This section describes clustering and replication issues. It includes the following topic:

• Section 3.2.1, "Using Oracle Universal Installer Provided Sample Cluster Discovery Address May Inadvertently Cluster Servers"

3.2.1 Using Oracle Universal Installer Provided Sample Cluster Discovery Address May Inadvertently Cluster Servers

Oracle Universal Installer provides an example cluster discovery address as part of the advanced installation option. The provide example discovery address is 225.0.0.1:6789. This is not a recommended address; rather it is an example intended to provide the type of cluster discovery address users may ask for from their network administrator.

Because the cluster configuration of Oracle Application Server is fully dynamic it is possible for installations using the example cluster discovery address (225.0.0.1:6789) to be inadvertently clustered with other servers installed with the same example cluster discovery address.

The cluster discovery address of a specific Oracle Application Server instance can be set from the command line using the following opmnctl command:

> $ORACLE_HOME/opmn/bin/opmnctl config topology update discover=<cluster config address> 

For example, to update a cluster discovery address in a specific Oracle Application Server instance to be 225.0.0.1:9876, the command would be:

> $ORACLE_HOME/opmn/bin/opmnctl config topology update discover="*225.0.0.1:9876" 

Details on configuring topologies and the cluster discovery address can be found in Chapter 8, "Configuring and Managing Clusters" of the Oracle Containers for J2EE Configuration and Administration Guide.

3.3 Documentation Errata

The section describes documentation errata in management documentation. It includes the following topics:

• Section 3.3.1, "Default Ping Timeout Value in OPMN Is 30 Seconds, Not 20"

• Section 3.3.2, "Incorrect Gateway Example in Oracle Process Manager and Notification Server Administrator's Guide"

• Section 3.3.3, "Valid Range of Multicast Addresses is Incorrect in the Application Server Control Online Help"

• Section 3.3.4, "Additional Information About Cloning"

• Section 3.3.5, "Enabling and Disabling Components Is Supported"

• Section 3.3.6, "Incorrect request Attribute Description"

• Section 3.3.7, "Incorrect Title"

3.3.1 Default Ping Timeout Value in OPMN Is 30 Seconds, Not 20

The Oracle Process Manager and Notification Server Administrator's Guide incorrectly states that the default ping timeout value is 20 seconds. It is actually 30 seconds.

3.3.2 Incorrect Gateway Example in Oracle Process Manager and Notification Server Administrator's Guide

In chapter 6, "opmn.xml Common Configuration", of the Oracle Process Manager and Notification Server Administrator's Guide, the last example shown in the <gateway> section may produce a validation error. The example shows these two lines:

<gateway list="host1a.subA.com:6200&host2a.subA.com:6200/host1b.subB.com:6200&host2b.subB.com:6200"/>
<gateway list="host1b.subB.com:6200&host2b.subB.com:6200/host1a.subA.com:6200&host2a.subA.com:6200"/>

You may get the following error if you use the lines above:

In line 9 of /scratch/aime1/10133/ohs/opmn/conf/opmn.xml:
LPX-00241: entity reference is not well formed
XML parse failed: error 241.
opmnctl: opmn.xml validation failed.

To fix this, you should merge the two lines into a single line, as follows:

<gateway
 list="host1a.subA.com:6200&
 host2a.subA.com:6200/host1b.subB.com:6200&host2b.subB.com:6200,
 host1b.subB.com:6200&host2b.subB.com:6200/host1a.subA.com:6200&
 host2a.subA.com:6200"/>

3.3.3 Valid Range of Multicast Addresses is Incorrect in the Application Server Control Online Help

The following topics in the Application Server Control online help incorrectly state the valid range of addresses you can use for a multicast address when configuring an Oracle Application Server 10g Release 3 (10.1.3.2) cluster topology:

• "Tips When Configuring the Cluster Topology"

• "Summary of the Supported Cluster Topologies"

The multicast address must be within the following range: 224.0.1.0 to 239.255.255.255.

3.3.4 Additional Information About Cloning

Note the following points about cloning:

• If ORACLE_HOME/portal/conf/javacache.xml is present in the source environment, you must manually modify this file in the cloned environment

  In this file, change the following:

  • In the <location> element, replace the value of the source ORACLE_HOME with the value of the cloned ORACLE_HOME.

  • In the <coordinator discovery-port> element, change the value to the new port number.

• The cloned instance will use the hostname of the machine, rather than the virtual hostname, even if you set the VIRTUAL_HOST_NAME environment variable during installation of the source instance and before performing the cloning operation.

• Oracle recommends that you stop the source instance completely before you run the prepare_clone.pl script.

3.3.5 Enabling and Disabling Components Is Supported

The Oracle Application Server Administrator's Guide incorrectly states that enabling and disabling components is not supported. Although it is not supported in Application Server Control Console, it is supported by OPMN. For more information on enabling and disabling components, see the Oracle Process Manager and Notification Server Administrator's Guide.

3.3.6 Incorrect request Attribute Description

In Oracle Process Manager and Notification Server Administrator's Guide, section 6.2, "opmn.xml Element and Attribute Descriptions", the request attribute description contains the following incorrect statement:

"The request attribute is for the IP address or host name to which ONS will bind its remote port."

The correct statement is:

"The request attribute is for the IP address or host name to which ONS will bind its request port."

3.3.7 Incorrect Title

In Section 7.6, "Generic Apache (Linux only)", of the Oracle Process Manager and Notification Server Administrator's Guide the title is incorrect. The listed configuration for the Oracle HTTP Server process module to manage generic Apache processes is valid for Linux and Microsoft Windows operating systems.