Release Notes

     Previous  Next    Open TOC in new window    View as PDF - New Window  Get Adobe Reader - New Window
Content starts here

BEA AquaLogic Service Bus Release Notes

This document includes the following topics:

Note: Documentation for all BEA products, including BEA AquaLogic™ Service Bus documentation, is available on the BEA Product Documentation Web site.


About BEA AquaLogic Service Bus

BEA AquaLogic Service Bus is an Enterprise-class service bus that connects, manages, and mediates interactions between heterogeneous services. AquaLogic Service Bus accelerates service configuration, integration, and deployment, thus simplifying management of shared services across the SOA.

AquaLogic Service Bus is policy-driven and enables loose coupling between service clients (service consumers) and business services (service providers). It provides a point of security control, monitoring, and Service Level Agreement (SLA) enforcement. Changes to service integration relationships are implemented dynamically through configuration, not code, allowing you to evolve and customize your service architectures with respect to security, service location, availability, data formats, monitoring, transports, communications, and so on.

As part of an enterprise messaging fabric, AquaLogic Service Bus can be used horizontally across many applications and systems, potentially spanning service implementations built by different teams in different departments. AquaLogic Service Bus separates a set of management functions from the service implementations, thus allowing the implementations to evolve independently and dynamically as driven by the needs of the business without requiring costly infrastructure development efforts.

For more information about AquaLogic Service Bus concepts and architecture, see BEA AquaLogic Service Bus Concepts and Architecture.


What's New in AquaLogic Service Bus?

AquaLogic Service Bus 2.5 incorporates powerful new functionality in four key areas:

The following sections describe these and other innovations in AquaLogic Service Bus 2.5:

Dynamic Routing Simplifies Configuration and Increases Scalability

AquaLogic Service Bus distribution capabilities give you the power and the flexibility to configure autonomous, heterogeneous ESB instances that can communicate through a completely distributed peer-to peer network, where every ESB knows each other, or through a central ESB, which handles governance and central coordination for all ESBs.

AquaLogic Service Bus 2.5 simplifies configuration of the federated network with a new dynamic routing capability. When new services are provisioned with any department, only the routing table needs to be updated, as opposed to the proxy services within each calling ESB. The specification of services to which a proxy service routes messages can be achieved at run time, through the routing table. Individual departments do not need to know about services in other departments, and it is not necessary to configure individual routing policies to another department's services.

See Modeling Message Flow in AquaLogic Service Bus in the BEA AquaLogic Service Bus User Guide.

Alert Capabilities Refine Use Cases and Add SNMP Destinations

Whereas AquaLogic Service Bus previously based message alerts on aggregated Service Level Agreement (SLA) rules, with AquaLogic Service Bus 2.5 you can configure alerts based on message context, message identity, or message processing logic. You can build alerts within the proxy service pipeline itself, which gives you more flexibility and control to notify users of alert conditions as the message is being processed. See Monitoring in the BEA AquaLogic Service Bus User Guide.

This release of AquaLogic Service Bus also extends the alert feature to SNMP destinations, which enables service bus alerts to be propagated into Enterprise System Monitoring tools. (AquaLogic Service Bus 2.5 is certified with BMC Patrol.) See New Resources Are Reusable Across Services.

Services Automatically Published to UDDI Facilitate Reuse

UDDI integration significantly enhances reuse and governance of services in AquaLogic Service Bus 2.5. Services can be automatically published to UDDI once they are created or changed within AquaLogic Service Bus. If changes to these services occur in the UDDI registry, AquaLogic Service Bus users are notified and are prompted to resynchronize. As with AquaLogic Service Bus 2.1, services are also certified with AquaLogic Service Registry.

See UDDI in the BEA AquaLogic Service Bus User Guide and the AquaLogic Service Registry.

Customize ESB Configurations with Extensibility Options

AquaLogic Service Bus 2.5 extends customization capabilities with three new options: a Java exit mechanism, custom transport SDK, and an exposed JMX Monitoring API.

Java Exit Mechanism Leverages Existing Java Implementations

This release of AquaLogic Service Bus implements a Java exit mechanism whereby you can invoke custom Java code from within proxy services, by using a Java Callout action to call out a Plain Old Java Object (POJO). The exit mechanism is completely configuration-driven, thus enabling you to describe and configure the Java objects to be called out during message processing. Static methods can be accessed from any POJO. The POJO and its parameters are visible in the AquaLogic Service Bus Console at design time, and the parameters can be mapped to message context variables. Return values from the exit mechanism can be used for further message processing within the pipeline. Transaction and security semantics are propagated through the call.

See Extensibility Using Java Callouts and POJOs in the BEA AquaLogic Service Bus User Guide.

Custom Transport SDK Completely Integrates Custom Connectivity Options

The Custom Transport SDK feature enables you to add custom connectivity options to AquaLogic Service Bus, as opposed to connecting through built-in transports within AquaLogic Service Bus. Custom transports that are implemented with the SDK get complete and seamless integration with AquaLogic Service Bus capabilities: design-time console (configuration), monitoring, and run-time (QoS, security, performance, monitoring, and transactions). A sample implementation that uses the Transport SDK, TCP/IP Sockets, is included as a reference.

For information about the Transport APIs, see the AquaLogic Service Bus Javadocs.

Exposed JMX Monitoring API Provides Metrics to Third-Party Consoles

The JMX Monitoring API is a polling interface for the retrieval of metrics. Exposing this API enables integration with management partners and enables customers who have their own monitoring consoles to display metrics that can be used for performance analysis.

Transports Extend Connectivity to More Endpoints

AquaLogic Service Bus 2.5 provides two new transports, EJB over RMI and Tuxedo, that help you leverage existing EJB and Tuxedo investments.

EJB over RMI Transport

EJB over RMI transport enables business services to be represented as an EJB. Services are completely configuration-driven and do not require coding. An option for automatic WSDL generation of an EJB facilitates promotion to SOA. The EJB over RMI transport, which implements RMI/IIOP protocol, is designed to support any J2EE EJB; however, current certification is for BEA WebLogic Server 8.x and 9.x EJBs only.

Note: Currently, this feature supports only outbound EJBs; that is, proxy services can call out to EJBs through this transport. Inbound EJB transport (exposing a proxy service as an EJB) is not supported.

See EJB Transport in the BEA AquaLogic Service Bus User Guide.

Tuxedo Transport

Tuxedo transport allows secure, guaranteed, high performance, bi-directional access to services between Tuxedo domains and the AquaLogic Service Bus. The transport lets you run and reuse thousands of legacy services on Tuxedo, while moving incrementally towards SOA. It allows intermediation of ATMI services in a remote Tuxedo domain for reuse across the enterprise and allows any Tuxedo ATMI service to be considered as a business service in an AquaLogic Service Bus pipeline. The Tuxedo transport is fully integrated into the AquaLogic Service Bus configuration, management, and monitoring console. The transport supports inbound and outbound services, QoS, identity propagation, transaction semantics, and transformation of Tuxedo FML and View buffer types.

See Interoperability Solutions for Tuxedo.

New Resources Are Reusable Across Services

AquaLogic Service Bus 2.5 supports the following new resource types.

JAR Resources

JAR files can be registered as reusable AquaLogic Service Bus resources. They are used in Java callout actions, EJB-based business services, and Tuxedo-based business services.

See Java Exit Mechanism Leverages Existing Java Implementations and Transports Extend Connectivity to More Endpoints. For detailed information about the role of JAR files in AquaLogic Service Bus, see JARs in Using the AquaLogic Service Bus Console.

Alert Destination Resources

An alert destination captures a list of recipients that can receive alert notifications from AquaLogic Service Bus. In typical system monitoring contexts, alerts generated by AquaLogic Service Bus bear significance to a finite set of users. You can configure each alert destination resource to include a set of recipients according to a given context. Alert destinations are used by alert actions configured in the message flow, and also by SLA alert rules. An alert destination can be reused for services across alert configurations and can include one or more of the following types of destinations: Console, Reporting Data stream, SNMP trap, e-mail, JMS queue, and JMS topic. In the case of e-mail and JMS destinations, a destination resource can include a list of e-mail addresses or JMS URIs, respectively.

See Alert Destinations in Using the AquaLogic Service Bus Console.

JNDI Provider Resources

You can configure a JNDI provider resource and make it available in AquaLogic Service Bus as a system resource. The JNDI provider defines communication protocols and security credentials for accessing remote servers and can be reused from numerous proxy services within AquaLogic Service Bus.

See the JNDI sections under System Administration in Using the AquaLogic Service Bus Console.

SMTP Server Resources

An SMTP server resource is a global resource that specifies the address of the SMTP server corresponding to your e-mail destination, port number, and, if required, authentication credentials.

See the SMTP sections under System Administration in Using the AquaLogic Service Bus Console.

New Actions Improve Message Flow Design

You use actions to design and configure the message flow in the pipelines and route nodes of a proxy service. New actions introduced in AquaLogic Service Bus 2.5 function as follows:

See Proxy Services: Actions in Using the AquaLogic Service Bus Console.

New Design Patterns Supported for JMS Request/Response

You can use one of two design patterns, JMS Message ID or JMS Correlation ID (the default), to define a JMS request/response business or proxy service. The message flow, except for $outbound transport-specific data, does not distinguish between JMS request/response and HTTP request/response.

With JMS Message ID, the responses dynamically go to the queue indicated by the JMSReplyTo property. The request and response are correlated using the Message ID property. The queue is specific to the client's server, thus responses to different clients will go to different queues. If you have multiple WebLogic client domains invoking a target WebLogic domain through JMS request/response, the MessageID pattern allows you to set up both the request and response queues as store-and-forward (SAF) queues.

With Correlation ID, the service that is invoked responds to a fixed queue. The request and response are correlated by the Correlation ID property. The response always arrives on the same queue regardless of how many clients send a message.

See Understanding Message ID and Correlation ID for JMS Request/Response Patterns in Interoperability Solutions for JMS and WebSphere.

Security Updates Expand Configuration Options

AquaLogic Service Bus 2.5 introduces the following updates and enhancements to its security features:

Updates for Service Accounts and Proxy Service Providers

This release of AquaLogic Service Bus includes these enhancements to service accounts and proxy service providers:

Updates for Proxy Services, Business Services, and Pipelines

Proxy services, business services, and pipelines have been updated as follows:

Miscellaneous Security Updates

Additional security updates in AquaLogic Service Bus 2.5 include the following:

Deprecated Security Features

The following security features are deprecated in AquaLogic Service Bus 2.5:

Why AquaLogic Service Bus 2.5 Removes X.509 Credentials for WS-Security Authentication

In previous releases of AquaLogic Service Bus, you could add key-pair credentials to proxy service providers that could be used to support any of the following types of security requirements:

If the WSDL documents for your proxy services or business services contained WS-Policy statements with identity assertions that accepted X.509 tokens, AquaLogic Service Bus 2.1 accepted SOAP messages with an X.509 token in the security header without a digital signature. AquaLogic Service Bus 2.1 then mapped the certificate encoded in the token to an AquaLogic Service Bus user as part of establishing a security context. This action opened a security vulnerability because it is not possible to prove that the client is the owner of the certificate (certificates are public). A malicious user or application could impersonate another party by sending its public certificate in a WS-Security X.509 token. BEA released a security advisory to describe this vulnerability.

In AquaLogic Service Bus 2.5, proxy service providers can no longer contain an X.509 credential that is used only for WSS authentication. Proxy service providers can still contain credentials for digital signatures, encryption, and SSL client authentication. If a request includes an X.509 token for authentication purposes, the request must also be signed with the certificate's private key. AquaLogic Service Bus 2.5 rejects requests with an X.509 token if the accompanying digital signature is missing.

When producing SOAP messages for outbound communication, AquaLogic Service Bus 2.5 uses the digital signature credential to satisfy the identity assertion.


Supported Configurations and System Requirements

The following sections summarize the supported configurations for AquaLogic Service Bus 2.5:

Supported Software and Hardware Configurations

For information about supported operating systems, databases, drivers, browsers, plug-ins, and other hardware and software requirements, see Supported Configurations for AquaLogic Service Bus.

For information about installing BEA products, see BEA Products Installation and Configuration Documentation.

Data Transformation Tools

Two data transformation tools are installed when you install AquaLogic Service Bus 2.5: the BEA XQuery Mapper plug-in for Eclipse 3.1 and Format Builder. Eclipse 3.1 and Format Builder are supported on Windows platforms only.


Known and Resolved Issues

The following sections describe known problems in AquaLogic Service Bus 2.5, as well as problems that were resolved in 2.5. Entries include a description of the problem and a workaround or solution where appropriate. A notation in the Fixed In column indicates that the problem has been resolved:

Runtime Environment

Problem ID
Found In
Fixed In
Recursive XQueries are not supported.
Do not write recursive XQuery statements when you design your proxy services.
Do Not Use the Default System Prefix (soap-env) when Constructing a Non-System Fault in AquaLogic Service Bus
When you create a non-system fault in AquaLogic Service Bus, you cannot use the default system prefix (soap-env) for the namespace. You must declare a new namespace prefix and use it in the faultcode.
Workaround: To construct a non-system fault in AquaLogic Service Bus:
  1. Assign the SOAP body with the desired fault format to the body context variable ($body).
  2. When creating <faultcode>, you must declare a new namespace prefix for
    and use the new prefix in the faultcode. For example:
Keep the path of proxy services short for successful deployment on Windows machines because of a system path length limitation on Windows machines.
This limitation applies to both JMS proxy services and business services with responses. Because the generated proxy service EAR file is created in the domain directory, you should keep the path to the domain directory short. It is not necessary to keep the name of the proxy service or business service short.
The limit for the generated EAR file is 50 characters and the null terminator is 1 character. Therefore, in a single server domain, the domain directory path (including the following slash) may not exceed 209 characters. In a cluster domain, the domain directory path plus the name of any Managed Server may not exceed 142 characters.

Note: To learn about maximum path lengths, see the following information: "Maximum Path Length" at the following URL:

An AquaLogic Service Bus domain cannot boot and generates weblogic.transaction.loggingresource.LoggingResourceException if the domain is a new domain using the same database, schema, and LLR table as an existing domain.
When you move a domain template to a different machine and use the template to create the new domain, the new domain is not able to boot and weblogic.transaction.loggingresource.LoggingResourceException is thrown. The following details outline the scenario:
  1. Create the original domain.
  2. Start the server for the original domain. At this point, the domain is now "used"—a domain is considered used once you have started the server for a domain after you have created it.
  3. Create the domain template. You can create it in several different ways—use the Domain Template Builder tool and the Configuration Wizard, the pack/unpack command, or the Weblogic Scripting Tool in offline mode.
  4. Move the domain template to a different machine.
  5. Create a new domain using the template. Again, you can create it in several different ways—use the Domain Template Builder tool and Configuration Wizard, the pack/unpack command, or the Weblogic Scripting Tool in offline mode.
  6. Start the server for the domain. If the new domain does not have the same name as the initial domain, the new domain cannot be started. This is because the JMS Reporting Provider provided with AquaLogic Service Bus uses the Logging Last Resources (LLR) option. The new domain is attempting to use the same database, schema, and LLR table name to store LLR transaction records. LLR does not allow this to prevent different domains from corrupting each other's tables. To learn more about the LLR feature, see Configuring JDBC Data Sources in Configuring and Managing WebLogic JDBC.

Note: You can access the Domain Template Builder, Configuration Wizard, and the WebLogic Scripting Tool from the BEA ProductsArrow symbolTools menu on your machine. The tools and the pack and unpack commands are located in the BEA_HOME/weblogic90/common/bin directory.

CR231843 (continued)
Workaround: You must use the same domain name when you create the new domain using the same template on a different machine. Alternatively, change the name of the LLR table that the new domain uses. You can configure this on the WebLogic Server Administration Console on a per Server basis, using the JDBCLLRTableName attribute on the ServerMBean.

Note: There is no protection mechanism similar to LLRs for standard WebLogic JDBC store tables. Therefore, if you replicate a domain that has WebLogic JDBC stores configured without renaming the store tables or without using a different database user and schema for the new store's connection pool, data corruption occurs if both the old and the new domains remain active. Similarly, corruption (without warnings) may occur if same-named WebLogic file stores share the same directory.

If the Administration Server crashes when a session activation is in progress, a WebLogic Server change lock prevents further session activations.
When a session is activated, AquaLogic Service Bus acquires a WebLogic Server lock that is held throughout the activation, and then released when the activation completes, regardless of whether the activation is successful. However, if the Administration Server crashes before the session activation completes, the lock is not released automatically when you restart the server. This lock prevents further session activations.
Workaround: Log on to the WebLogic Server Administration Console, and release the lock held by WebLogic Server.
The Reporting module may display service names in the $ format.
In AquaLogic Service Bus 2.0, the Reporting module stores and displays the proxy service and business service name in the global service name format:
  • Proxyservice$project$service
  • BusinessService$project$service
In AquaLogic Service Bus 2.5, the JMS Reporting Provider also stores the service name in the global service format in the database. However, it displays the service name in the project/service format to make it consistent with other AquaLogic Service Bus Console service display formats.
When you copy large files into an input directory in Windows, misleading errors are logged to the server log file.
In the Windows operating system, when you copy large files (for example, 100MB) into the input directory of a file transport proxy service, errors are logged in the server log file that state "File cannot be moved from location <filename> to the stage directory. Current Process may not have permission to do this operation". These errors may occur while the file is being copied. However, the file is processed successfully on the next polling cycle after the copy completes.
A single stand-alone JMS client cannot consume all messages on uniform distributed queues (UDQs) when the default ForwardDelay is set.
The default ForwardDelay on Uniform Distributed Queues is set as -1. Consequently a single stand-alone JMS client is unable to consume all the messages on the UDQs.
Workaround: Manually set ForwardDelay to a positive number; for example, set it to 1.
The Get All Headers checkbox for a proxy service is ignored under certain conditions.
The Get All Headers checkbox for a proxy service is ignored in two cases:
  • When the proxy service is calling another proxy service
  • When the test console is calling the proxy service
In both these cases, the headers are passed regardless of the checkbox selection.
A UIControlException occurs for users of the monitor role when they attempt to access the WebLogic Server Roles portlet from the AquaLogic Service Bus Console.
AquaLogic Service Bus uses the WebLogic Server Roles portlet for creating, viewing, and editing roles. However, WebLogic Server does not allow a user to view the portlet if the user is not a member of the WebLogic Server Administrator role. Because there is no filtering mechanism to disable the navigation portlet based on the role of the user logged in, AquaLogic Service Bus allows a user to view the WebLogic Server Roles portlet but generates a UIControlException.
Publishing to UDDI intermittently returns an error when you publish a service to AquaLogic Service Registry.
When you publish proxy services, you may receive an error on one or more of them with the message: CannotCreate Premature end of file encountered. However, the proxy services are correctly published, even though the error is reported.
Workaround: Use the AquaLogic Service Registry Business Service Console to confirm that the proxy services have been successfully published.
The first time an alert is fired, it may fire before the end of the time period specified in that alert rule's aggregation interval.
JMS transport provider does not support certain valid URLs.
It is possible for more than one hostname to use the same port; the following example specifies a list of WebLogic Server instances using the same port:
However, the JMS transport provider currently assumes that each hostname is followed by a port number.
Workaround: You can explicitly list the port number following the hostname.
The endpoint URL of a service on AquaLogic Service Registry is incorrect when the endpoint URI of a proxy service does not begin with a forward slash character.
The access point for a proxy service published to UDDI is malformed and looks like this: http://machinename:7001myProxyURI; it is missing the delimiter between the host:port and the path.
Workaround: When you create the proxy service, ensure that the value entered in the EndPoint URI field begins with the slash (/) character; for example: /myProxyURI.
Under certain conditions, trying to import or publish services from or to a registry causes an exception on the Console page that lists the business entities.
If a business entity has a category bag with no keyed references and an empty keyed reference group, an exception occurs when you try to publish or import services from or to a registry.
Workaround: Log in to the Registry Console and remove any empty keyed reference groups (or add the desired keyed references to this group) for all business entities that have an empty keyed reference group. If no such business entities are found, please view the server log file for more information about this error.
Due to hot deployment, the correct version of an invoked service's MFL or WSDL may not be properly seen by a proxy service that invokes that service.
For example:
  1. A message that is to be processed by proxy service A will route to proxy service B.
  2. Proxy service A retrieves service information for proxy service B.
  3. Proxy service A and the MFL or WSDL for proxy service B are updated while step 2 is in progress.
  4. Proxy service A retrieves the MFL and WSDL for proxy service B and uses this to prepare the message that will be routed to proxy service B.
In step 4, the message is executing in the old version of proxy service A, but can potentially see the new versions of the MFL and WSDL of proxy service B.
Workaround: Ensure that you do not have any messages currently executing in a proxy service when you are updating the MFL and WSDL of a second proxy service that is invoked by the first.
AquaLogic Service Bus does not pass the HTTP Authorization header from the request to the pipeline because it opens a security vulnerability: you could inadvertently create a log action that writes the user name and unencrypted password to a log file.
Workaround: If your design pattern requires the HTTP Authorization header to be in the pipeline, do the following:
  1. In the startup command for AquaLogic Service Bus, set the following system property to true:
  2. In the AquaLogic Service Bus Console, on the Transport Configuration page, select Get All Headers or select User-specified Headers and specify Authorization.
  3. Restart AquaLogic Service Bus Console.
AquaLogic Service Bus will pass the Authorization header to the pipeline.
Due to class incompatibility issues, classes in a JAR file matching a certain pattern are invisible, and will not be available for use in a Java Callout.
Specifically, all classes whose names end with 814_WLStub and 815_WLStub will be invisible. These classes are stubs autogenerated by WebLogic Workshop versions 8.1.4 and 8.1.5.
If you use WSS or relied on specific AquaLogic Service Bus 2.1 error codes, either on proxy service error-handlers or client-side code, you need to be aware of the following change in AquaLogic Service Bus 2.5.
Whenever WebLogic Server WSS returns a SOAP fault to AquaLogic Service Bus, the AquaLogic Service Bus message-context has a
fault with:
  • error code: BEA-386201
  • description:"A web service security fault occurred [<root-wss-error>][<root-wss-fault-string>]
    • root-wss-error is the error-code from the WebLogic Server WSS SOAP fault,
    • root-wss-fault-string is the fault-string from the WebLogic Server WSS SOAP fault.
  • details: an instance of XML element {}WebServiceSecurityFault. This XML element also contains the root-fault error-code, fault-string and fault-details.
The AquaLogic Service Bus default error handler returns the root SOAP fault to the client.
  • BEA recommends that you update your error-handlers and/or client-side code to deal with the new error codes.
  • You can also write an error-handler that maps the new error-codes back to the AquaLogic Service Bus 2.1 error code. However, this is not a BEA recommended approach.
An error can occur when you attempt to import a service from a UDDI registry when that service was originally published to the registry from an AquaLogic Service Bus cluster in which any of the clustered servers uses the localhost address.
Specifically, if the service being imported references a resource (WSDL or Schema (XSD)) that in turn references another resource (WSDL of Schema).
Workaround: Ensure that before you publish services to a UDDI registry from a clustered domain, none of the servers in the cluster use localhost in the server addresses. Instead, use either the machine name or the IP address.
Attachments are supported on inbound requests and outbound responses (that is, in messages received by a proxy service) only when the transport is HTTP, HTTPS or E-mail.
Attachments are supported for all transport types for outbound requests and inbound responses (that is for messages sent by a proxy service).
When AquaLogic Service Bus is running on JRockit JVM, the firing of pipeline alerts can cause an OutOfMemory error.
Workaround: This is caused by a memory leak that has been fixed in JRockit. You can contact BEA Support for a fix to this problem.
When an Administration Server experiences a failure while sending a prepare message to one or more servers, the Administration Server may hang WebLogic Server.
Workaround: This is a race condition that has been fixed. Please contact WebLogic ServerWebLogic Server support and reference CR280738 to obtain the fix.
If an AquaLogic Service Bus proxy receives a multipart message (that is, a message with attachments) where the root part does not have an associated Content-ID MIME header, subsequent multipart messages sent by that proxy service will not have a Content-ID MIME header for the root part.
This behavior differs from release 2.1, in which AquaLogic Service Bus would autogenerate an absent header when sending multipart messages. The presence of this Content-ID header directly affects the presence of the "start" parameter in the "multipart/related" Content-Type of the multipart message.
While the Content-ID header and "start" parameter are considered optional by MIME standards, some Web Service stacks may require them and may return an error response back to the proxy service if they are absent.
Workaround: Make sure that clients sending multipart messages to AquaLogic Service Bus include a Content-ID header and "start" parameter.


Problem ID
Found In
Fixed In
Before deleting a proxy service, delete all associated Transport-level (HTTP and HTTPS) and Service-level access control security policies.
Failure to delete these policies will leave the policies in the authorization-provider database and potentially cause unexpected results and potential security vulnerabilities.
A security error in the server log occurs in both AquaLogic Service Bus and WebLogic Server. The error is as follows:
"Server Identity fails validation, downgrading to anonymous."
Employ one of the following workarounds depending on your scenario:
  • When there is cross-domain transaction
  • Workaround: Establish domain trust.

  • When there is no cross-domain transaction
  • When there is no cross-domain transaction, these security exceptions can occur for WebLogic Server 9.1 and earlier releases. For 9.2 to 9.2 cross clustered domain JMS/JNDI/RMI calls, this exception is intermittent.

    Workaround: Configure the JTA SecurityInteropMode to "Performance" in the WebLogic Server Administration Console for 9.x domains, and on the command line for older versions. For more information, see "Setting Security Interoperability Mode" in Configuring Domains for Inter-Domain Transactions in Programming WebLogic JTA.

A problem in the client-side Web Service Security runtime causes X.509 token authentication to fail in certain cases.
Make sure to include a dummy username token CredentialProvider (see source code that follows) along with a ClientBSTCredentialProvider in the list of credential providers passed to the JAX-RPC client. The credential provider list is passed to the client as the value of the property named
For more information, see "Updating a Client Application to Invoke a Message-Secured Web Service" under "Configuring Message-Level Security (Digital Signatures and Encryption)" in Configuring Security in Programming Web Services for WebLogic Server.

import weblogic.xml.crypto.wss.WSSConstants;
import weblogic.xml.crypto.wss.provider.CredentialProvider;
import weblogic.xml.crypto.wss.provider.Purpose;

public class DummyUNTCredentialProvider implements CredentialProvider {

    public DummyUNTCredentialProvider() {

    public String[] getValueTypes() {
        return WSSConstants.UNT_VALUETYPES;

    public Object getCredential(String tokenType,
                                String issuerName,
                                ContextHandler ctxHandler,
                                Purpose p) {
        return null;


If you add or delete a security provider, you must reboot the server for the security changes to take effect.
In particular, if you configure a new PKI credential mapper and fail to reboot the server, you get an exception whenever you access any page in the Credentials section of the AquaLogic Service Bus Console. The Credentials section is available again after you reboot the server.
Unbound JMS Service account leads to continuous runtime exceptions.
When a service account is specified for a proxy service or business service to access the JMS server and/or JNDI lookup, you must first associate the service account with a username and password before invoking the service. Failure to do so results in AquaLogic Service Bus continually reporting the error as an exception.
Workaround: In the AquaLogic Service Bus Console, assign the username and password to the service account in the Credentials section of the Security Configuration module. The administration server does not have to be restarted.

Note: There are other conditions that can cause the same problem of continuous run-time exceptions. To avoid this problem again, we recommend that you configure JMS queues to have a limited number of retries.

Warning message appears during deployment of a Web Application with CustomRolesAndPolicies mode.
The following warning message appears:
<Warning> <Security> <BEA-090866> <The deployment of an unchecked policy for the resource "type=<url>, application=XBus Kernel, contextPath=/someproxyuri, uri=/" has been ignored. Unchecked policy is the default policy for URL and EJB resources. An unchecked policy can result if a deployment descriptor specifies a transport guarantee without the use of an authorization constraint.>
This warning appears when you create HTTP/S proxy services (when submitting the session) and during server startup when the proxy services are initialized. This warning is irrelevant. Access control for proxy services is configured through the AquaLogic Service Bus Console, not through deployment descriptors.
Web Service Security over JMS authentication fails with exception error.
In some cases, depending on various configuration settings, WSS authentication relies on the use of timestamps. It is hard to adequately configure the timestamp validity duration and other timestamp properties to guarantee successful processing of legitimate requests in a WSS over JMS scenario.
Workaround: None.

Note: BEA recommends you do not use WSS authentication over JMS.

Web Service Security username token without password must be digitally signed.
Web Service Security username tokens can be used in various ways. The token may include a username and password or just a username. When a username token is used without a password, the Web service security runtime will only accept it if it is covered by a signature. If the token is not signed, the runtime will reject it. The configuration-time WS-Policy validator does not enforce this restriction in this release.
AquaLogic Service Bus does not support WS-Policy on SOAP fault.
After you move a service account to a new location, its username/password is no longer mapped.
If you move an existing service account to a new location or rename the service account, the associated username/password is missing.
Workaround: Before you move or rename a service account, you must first delete its username/password credential. After you move or rename the service account, assign it the username/password again.
The test console fails during testing of a proxy service with an inbound SAML policy.
It is not possible to test a proxy service with an inbound SAML policy in this release.
A server runtime error occurs for the encrypted SAML holder-of-key token.
Server-side run time error results while decrypting the SAML token for a Web service with WS-Policy in which the policy specifies SAML holder-of-key token for identity+encryption of this token.
Changing PSP encryption credentials causes stale dynamic WSDL.
Anytime the encryption credential assigned to a proxy service provider is modified, the proxy service must be redeployed for the new credential to take effect.
This limitation only influences a dynamic WSDL, which affects clients that dynamically retrieve the WSDL, as well as the test browser.

Note: This does not affect the runtime. The runtime picks up the new credential immediately.

Workaround: Create a session, do a dummy edit of the proxy, and submit the session. This causes the dynamic WSDL cache to be flushed. Restarting the server also solves the problem.
Incomplete test service validation of security configuration can occur for SAML Holder-of-Key Outbound Service.
When testing a business service that has an Integrity assertion with a SAML holder-of-key token, the user must specify both a service provider and a username/password. If either one is missing, the test service is unable to invoke the business service.
  • If you do not specify a username/password you get this error message:
  • Error Invoking Test Service - <service name>
    Error applying WS-Security to the SOAP message: null

  • If you do not specify a service provider you get this error message:
  • Error Invoking Test Service - <service-name>
    The service requires a digital signature, you must specify a service provider

WS-Security Digital Signature Interoperability issues between WebLogic Workshop 8.1 SP4 and AquaLogic Service Bus.

When an AquaLogic Service Bus proxy service or business service is configured with the Sign.xml policy provided by WebLogic Server, the request must include a digital signature that covers, among other things, the signature verification token. This follows security best practices. However, WebLogic Workshop 8.1 SP4 does not sign the signature verification token. As a result the WebLogic Server Sign.xml policy cannot be used when:

  • A WebLogic Workshop 8.1 SP4 client uses the service control to invoke an AquaLogic Service Bus proxy service.
  • An AquaLogic Service Bus proxy service signs the outbound request to a business service implemented as a WebLogic Server 8.1 SP4 Web service.

Workaround: A partial workaround for this problem exists. This requires a WebLogic Server patch for AquaLogic Service Bus 2.1. You must create a custom digital signature WS-Policy in AquaLogic Service Bus in which the SignToken attribute of wssp:Integrity must be set to false. This means that the policy does not require the verification token to be included in the digital signature.

Note: This is not a complete fix and implementers need to be aware of the possibility of a token substitution attack. That is, in a situation in which a digital signature is verified by reference to a token provided in the message that specifies the key, it is possible for a producer to later claim that a different token, containing the same key, but different information was intended. BEA CR265963 tracks this issue. See also "Security Considerations" at

Some WS-Policies fail to show up in dynamic WSDL.
In AquaLogic Service Bus 2.1, you bind WS-policies to services by adding annotations to various WSDL constructs. This is commonly referred to as "WS-Policy attachment". Some WS-Policy attachment points do not work correctly. AquaLogic Service Bus 2.1 supports attaching ws-policies to the following elements:
If you attach a WS-Policy to any WSDL construct other than the previous ones, the WS-Policy will be effective at run time, but it will not be included in the dynamic WSDL.
CR255331 (continued)
To attach a WS-Policy to these elements, add a nested wsp:Policy element. The Policy element may have an embedded wsp:PolicyReference. For example:
  <binding name="ServiceBinding" type="...">
    <operation name="foo" ...>
              <wsp:PolicyReference URI="policy:Auth"/>
              <wsp:PolicyReference URI="policy:Sign"/>
              <wsp:PolicyReference URI="policy:Encrypt"/>
             <wsp:PolicyReference URI="policy:Encrypt"/>
  <service name="myService">
      <port binding="tns:ServiceBinding" name="myService">
         <soap:address location="..."/>
            <wsp:PolicyReference URI="policy:Sign"/>
Workaround: Make sure you attach all policies on the supported WSDL constructs.
After you rename or move a proxy service provider, its PKI credentials are lost.
If you move a proxy service provider to a new location, or rename the proxy service provider, the associated PKI credentials are no longer mapped.
Workaround: Before you move or rename a proxy service provider, delete its PKI credentials. After you move or rename the proxy service provider, reassign the PKI credentials.
Intermittent Web Service Security timestamp validation errors: "Message is too old" or "Message Created time in the future."
A bug in the Web Service Security runtime causes intermittent timestamp validation errors when the message age is short and Clock Precision is specified.
Workaround: If you suspect you are having this problem, contact your BEA representative and request a patch for CR251516. (The Clock Precision property was deprecated and replaced by the more intuitive Clock Skew property.) See CR251516 in the "Web Services and XML section of WebLogic Server 9.2 Known and Resolved Issues.
The WebLogic Server WS-Policy parser accepts policies with unknown assertions.
AquaLogic Service Bus 2.5 service validation generates warnings when a policy bound to the service has unknown policy assertions. However, this release does not check for unknown policy assertions in WSDL or WS-Policy resources.
Workaround: Check for unknown WS-policy assertions in the WSDL. Ensure that the WSDL contains only valid assertion entries. For more information see Using Web Services Policy to Specify Inbound Message Security in the Security guide.


Problem ID
Found In
Fixed In
Using HTTP tunneling from an AquaLogic Service Bus 2.5 domain to access an EJB in a WebLogic Server 8.1 domain can result in exceptions.
Workaround: For HTTP tunneling between WebLogic Server 9.2 and WebLogic Server 8.1 to work, you must set the t3-server-abbrev-table-size element to 255 in the config.xml file in the AquaLogic Service Bus domain (the 9.2 domain), as shown in the following code snippet:
The iWay55 installer does not work with AquaLogic Service Bus 2.5.
To deploy and access the iWay installer:
1.Copy the contents of the weblogic91/common/bin/commEnv.cmd file that the iWay55 installer creates and add it to the end of the weblogic92/common/bin/commEnv.cmd file.
2. Save the file and restart the server.
You cannot move an AquaLogic Service Bus configuration JAR file with encrypted resources exported with the Sun or JRockit JDK to the IBM AIX JDK and vice-versa.
There are differences in the various JDK implementations of the Password-Based Encryption algorithms used by AquaLogic Service Bus to protect resources with sensitive data. These differences cause import to fail when an encrypted resource created with the Sun or JRockit JDK is imported into the IBM JDK or vice versa.
For information about the encryption algorithms, see
There is no problem in exporting and importing encrypted resources with the same JDK.
Workaround: Export the resources without a pass-phrase by deselecting the Protect Sensitive Data flag when going across different JDKs. WARNING: This resources file may contain passwords that are in the clear text.
Using the Linux SYBASE jRockit Non-XA driver with LLR enabled can result in a deadlock situation and throws a SQLException on the Sybase database.
Workaround: Use the Linux SYBASE jRockit XA driver.

AquaLogic Service Bus Console

Problem ID
Found In
Fixed In
A "Graphics Library Disabled" image is displayed instead of charts in the Monitoring module if the Graphics Library cannot be initialized.
A "Graphics Library Disabled" image is displayed instead of pie and bar charts in the Monitoring module if the Graphics Library cannot be initialized in a Linux environment. Links on the Server Summary, Server Detail, Alert Summary, and Alert Detail pages are also removed. The problem may be that the graphics library support (X11) toolkit is not installed on your machine.
Workaround: Linux requires the X11 modules installed as a precursor to the installation of AquaLogic Service Bus. Isolate the libraries required for installing the X11 toolkit or the native graphics library for Linux. You can fix this problem by setting the proper "DISPLAY" environment variable.
After clicking a link within the AquaLogic Service Bus Console, if you click a second link before the first has finished loading, the Console throws an exception.
Workaround: Allow the current page to finish loading before clicking another link.
Only WebLogic Server Administrators can define access control policies.
Only users in the WebLogic Server built-in Administrator role are allowed to manage access control policies on AquaLogic Service Bus resources; that is, transport-level HTTP or HTTPS proxy service access control policies and proxy service policies. To configure these policies, users must log in to the AquaLogic Service Bus Console as the WebLogic Server Administrator and select Access Controls in the Security Configuration module.
There is no visual indication that an Alert rule set to fire "Once Until Condition Clears" is occurring if the condition is still true after a long period of time.
When you configure an Alert rule to fire Once until Condition Clears, an alert is fired the first time the condition is true and does not fire again until the condition is reset and evaluates to true again. The timestamp for the alert (the date and time that the alert occurred) remains the same. Therefore, in cases where the condition remains true for several hours or maybe days, the single alert generated for the condition moves down the Alert Summary list on the Dashboard, leaving no visible indication that the alert is still occurring.
The default browser options for Windows 2003 Server cause a browser JavaScript Error when you click a link in the left navigation pane of the AquaLogic Service Bus Console.
The default Internet OptionsArrow symbolSecurity Settings for Windows 2003 Server are set to High, which disables active scripting. This causes a browser error when you click a link in the left navigation pane of the AquaLogic Service Bus Console.
Workaround: Modify the Internet OptionsArrow symbolSecurity Settings to Active Script: Enable. Because AquaLogic Service Bus uses JavaScript in the Console pages, make sure JavaScript is enabled in your browser.
You must manually edit the JMS URI from the WSDL when you register a JMS business service.
When you register a JMS business service in AquaLogic Service Bus, you must manually edit the URI from the WSDL file when adding it to service definition. The URI format is as follows:
Service monitoring details may not equal 100%.
When using Service Monitoring Details in the AquaLogic Service Bus Console, the Success Ratio plus the Failure Ratio may not equal 100%. There may be a +/- 1% margin of error when reporting these success and failure ratios.
Alert rules are replaced with newly imported rules.
Importing an alert rule with the same ID as an existing alert rule that is associated with a different service results in inconsistent alert rule behavior.
Workaround: You should not import configurations that have alert rules with the same alert rule ID but associated with different services.
Alerts do not fire in a cluster environment when one server's interval has expired and the other server's interval has not expired.
The Alert queries currently only take into account data set for which the aggregation interval has expired. Therefore, in a cluster environment, valid data present in a node could potentially be ignored on a server whose interval has not expired. This problem occurs only at server start and only for the first aggregation interval of the server that is yet to receive data, when one server has already received data and the sampling cycle has started and the other server's sampling cycle has not started.
404-Not Found message appears if the English version is used in a Japanese, Korean, or Simplified Chinese browser.
If the English version of AquaLogic Service Bus is installed for use within a browser whose language is set to Japanese, Korean, or Simplified Chinese, a 404 message appears when a user clicks the More Info button within the console.
Workaround: Install a localized version or set the browser's language to English ('en').
Wildcard searches within the User Management page do not work if a wildcard is placed before text.
Within the User Management page of the AquaLogic Service Bus Console, wildcard searches do not work when the wildcard precedes the text. For example, "*de".
Workaround: When using wildcards in searches, the wildcard character must be at the end of the text. For example, "de*".
Duplicate alerts are generated under certain conditions in a cluster environment.
When you operate in a cluster environment, if you have a short aggregation interval set for a service and a much longer aggregation interval set for the alert rules defined for this service, it is possible that you can receive duplicate alerts for the same alert aggregation interval period. This problem occasionally occurs if the alert timers running in the Managed Servers become unsynchronized because of the individual server start timings.
Proxy and business services with the same name in the same folder create alert problems.
Workaround: Ensure that services that reside in the same folder have unique names.
If you name a new resource in the AquaLogic Service Bus Console using a badly formed path, the console may hang.
The problem happens only for the IE browser on WinXP-SP2 or Win03-SP1.
Workaround: You cannot cancel the pop-up progress meter window. You must close the browser instance running the AquaLogic Service Bus Console and open a new one, then enter a valid file path for the new resource.
The username and password specified in the test console must exist in the local AquaLogic Service Bus domain even if the business service being tested is in a remote domain. The test service performs a local authentication before invoking any proxy or business service.
Workaround: Ensure that the username and password that you specify in the test console exists in the local domain.
A Reset Statistics operation for a service is not performed on the Managed Server that is down. Statistics are only reset on running servers.
A Reset Statistics (or reset all statistics) operation that is requested through the AquaLogic Service Bus Console or ServiceDomainMBean while one or more managed servers in a cluster is down only performs the reset operation on the running managed servers. The statistics on Managed Servers that were down when the reset operation was requested will not be reset when the servers are restarted. If you see unexpected or inconsistent results after servers are restarted, you can perform the reset operation manually.
Workaround: Ensure that all the Managed Servers in a cluster are up and running before requesting a reset operation.
Server names are not displayed in status messages on the "Service Monitoring Details" page in the Dashboard.
If the aggregator does not receive statistics from the server in a single domain, or from all of the servers in a cluster domain, the status message displayed on the Service Monitoring Details page does not display the server name or names.
Workaround: You can get the missing server name or names from the Service Monitoring Summary page.
The AquaLogic Service Bus Console incorrectly includes non-public classes and their methods when listing Java methods that can be called from a JavaCallout Action.
Selecting a Java method of a non-public class results in a java.lang.IllegalAccessException.
Workaround: You can find out what the access modifiers on a class are by using the javap utility. For example:
javap -classpath {jarfile} {fully_qualified_classname}

BEA XQuery Mapper

Problem ID
Found In
Fixed In
Pasting expressions in the expression boxes in Constraint view causes an error.
When expressions are pasted in the left-hand or right-hand expression box in the Constraints view, a compilation error occurs.
Workaround: Instead of pasting, type expressions in the left-hand or right-hand expression box.
Undoing a delete operation of a disabled node link does not bring it back.
Workaround: Press CTRL Z a few times to undo the delete.
For a recursive element, in Test view, source data is not properly generated.
The generated data for a recursive element is empty. Therefore, when you use such a generated recursive element, the resultant data is empty in the Test View on Run too.
Workaround: Correct the generated data and then run the Query.
Design view cannot recover a namespace change.
If an XQuery file is kept open while the schema files (used in the XQuery file) are modified with namespace changes, the Design view is not able to recover if the user switches to this view.
Workaround: Close the XQuery file and reopen the XQuery file after refreshing the project.
MFL data testing unnecessarily mandates the availability of unused XML files.
When the transformation file involves both XML and non-XML schema as inputs—even if the XML schemas are not mapped for output—testing of such transformation requires both the XML and MFL (non-XML types) source data to be available in order to perform testing. However, this is not the case with XML-only transformations.
Result data is incorrect when join links exist between non-XML files.
The resultant data for a non-XML element is not correct when there is a join link. When the join link is removed, the resultant data is generated properly.
The If-Then-Else expression is not displayed when a target node is selected.
When there is a If-Then-Else expression for a target node, that expression is not displayed when you click on the target node. However, this problem only occurs the first time the XQuery file is open and the node is selected.
Workaround: Click on any target node, then click on the required target node.
Selecting Generate Data in Test view generates data for all the choices.
A choice element accepts only one data choice among the many choices at a given time. In the Test view, when you select Generate Data, data is generated for all the cases of a choice element. So a validation error occurs when data is generated for the choice element.
Workaround: Delete all elements except the one for which you wish to generate data.
Problems occur large XQuery files are opened in Test view.
The XQuery Mapper may hang, displaying the following message when attempting to open large XQuery files in the Test view: "Initializing... Please wait."
Workaround: Close the XQuery file and reopen it. Do not switch views while the file is being opened.
See CR250692.
Changing a Join condition from OR to AND works intermittently.
In Eclipse, if you click on a target node item and right-click on any OR, then select Change Join condition to And from the pop-up menu, nothing happens.

Note: This problem does not always occur. It is an occasional bug.

The Convert Data Link to Structural Link option is missing from the Copy Link right-click menu.
When you right-click on a copy link, the Convert Data Link to Structural Link option is missing in the right-click menu options.
Workaround: Delete the copy link and create a link between one of the child-child elements. Then, create a link between a parent-parent element, which will be a structural link, and then delete the child-child link.
Code is not displayed after the View Code option is selected from the Copy Link right-click menu.
When you right-click on a copy link and select the View Code option, the associated code is not displayed in Source view.
Workaround: Select the Source tab to manually switch to the Source view.
XQuery Mapper exits abruptly while a new XQuery transformation is being created with a large schema.
You cannot open an XQuery file in XQuery Mapper when the file contains many inputs and is used in conjunction with a large schema.
Workaround: Limit the number of inputs in the schema.
It is not possible to create a copy link while doing non-XML to XML and XML to non-XML data transfer.
The copy link is not created even when the data structures at both source and target types are similar.
Workaround: Create a link between parent-parent element. Right-click on this link and select the Induce Map option.
It is not possible to validate the date format for non-XML result data during execution.
In Test view, the date format is not being validated if the result is non-XML. This is specific to XML to non-XML transformation.
The namespace prefix is not generated when the target is non-XML.
When the target is non-XML, the target namespace prefix is not generated properly in the XQuery source. This problem causes an error when XQuery is executed in Test view.
Workaround: In Source view, specify the target type in element() of the main XQuery function and add the namespace prefix for each of the target elements.


Problem ID
Found In
Fixed In
The following code snippet provided in the Online Help that you launch from the AquaLogic Service Bus Console is incorrect
The Online Help, Table 17-4 (Dynamic Routing row) includes this code snippet:
<ctx:route isProxy="false">
The isProxy attribute should be on the service element, not the route element. The corrected code snippet is:
    <ctx:service isProxy='true'>myProject/folderPath/serviceName</ctx:service>

Note: The AquaLogic Service Bus Console Online Help is also provided on the edocs Web site. Please see this version for the most up-to-date version of the information. It includes the fix for this issue:

2.5 e-docs version
Link provided to the W3C Funtions and Operators in the BEA XQuery Mapper Online Help is incorrect
The "Inserting Calls to XQuery Functions" section in the BEA XQuery Mapper Online Help provides a link to the April 2005 specification for XQuery 1.0 and XPath 2.0 functions and operators. This link is incorrect. The link should target the XQuery 1.0 and XPath 2.0 functions and operators in the W3C Working Draft 23 July 2004 (upon which the BEA XQuery engine is based), at the following URL:

Note: The BEA XQuery Mapper online help is also provided on the edocs Web site. Please see this version for the most up-to-date version of the information. It includes the fix for this issue:

2.5 e-docs version

  Back to Top       Previous  Next