Wednesday Apr 17, 2013

GlassFish, Java Web Start, and Java 7 update 21 security changes

Oracle has released Java 7 update 21 which includes security changes which affect GlassFish users taking advantage of automatic Java Web Start support for launching app clients.  This posting summarizes what is changing, what you and your users should expect, and what developers and system administrators should do.

[Read More]

Wednesday Sep 26, 2012

JMX Monitoring of GlassFish Servers

Here is how you can use any JMX-compatible tool, such as jconsole or jvisualvm, to monitor and manage GlassFish servers.[Read More]

Wednesday Feb 29, 2012

A Few Changes to Secure Administration in GlassFish 3.1.2

GlassFish 3.1.2 administration is even more secure than before.

[Read More]

Sunday Feb 27, 2011

Securing Administration in GlassFish Server 3.1 - 3: Admin Message Encryption

The last of a three-part series about administrative security in GlassFish Server 3.1.  This entry talks about how GlassFish secures admin traffic through encryption.

[Read More]

Securing Administration in GlassFish Server 3.1 - 2: Remote Administration

The second part of this three-part blog talks about remote administration - and when GlassFish Server 3.1 does and does not allow it.

[Read More]

Securing Administration in GlassFish Server 3.1 - Part 1: Admin Authentication

This is Part 1 of a three-part blog in which I talk about several new aspects of administrative security in GlassFish 3.1.  This installment covers admin authentication.

[Read More]

Customizing generated Java Web Start JNLP for app clients in GlassFish Server 3.1

GlassFish has long provided automatic support for launching Java EE application clients using Java Web Start.  With GlassFish Server 3.1 you have powerful control over the JNLP which GlassFish generates.

[Read More]

Monday Jun 28, 2010

Calling all users of Java Web Start support for app clients in GlassFish

For GlassFish 3.1 we are looking at letting developers customize the JNLP document which GlassFish generates.  We have some choices to make and we really want our community's input.

[Read More]

Thursday Dec 10, 2009

App Client Container features in GlassFish v3

Today marks the release of GlassFish v3.0 which complies with the Java EE 6 specification!  Other postings highlight a number of other areas.  I'll talk briefly about the app client container (ACC) in v3.  Much of this information appears in the release notes accessible from the main v3 page as well, but here it's all focused on the ACC.

The v3 ACC is feature-compatible with the v2 ACC.  You should see no difference in functionality, whether you launch using the appclient script or the built-in Java Web Start support...except for some exceptions I've described below.  Below I've noted a few highlights that users might find useful or interesting: stricter access from clients to other JARs in the EAR, a change in the downloaded file format, and the new embeddable ACC.

Stricter JAR Access

The Java EE 6 spec imposes stricter rules than Java EE 5 about what JARs in an EAR an app client should have access to.  In v2 an app client would see EJB modules as well as any JARs at the top level of the same EAR.  In v3 this is no longer true by default when you deploy an EAR.  You can add elements to the client manifest's Class-Path to refer to such JARs, or for library JARs move them to the library directory in the EAR (/lib by default or settable using the <library-directory> element in the application.xml).  

You can request the older, v2 behavior by specifying --property compatibility=v2 on the deploy command when you deploy an app.  Note that if you have deployed an app under v2 and then use the upgrade tool then v2 compatibility happens automatically.   

Downloaded File Changes

When you deploy an app and specify --retrieve localdir, or use the get-client-stubs command, GlassFish downloads not just the app client but other application files the client needs -- such as library JARs and some files GlassFish generates.  In v2 GlassFish would group all of these files into a single, large JAR file and download that.  Then, as the first step in any app client launch, the ACC had to expand that large JAR file into a temporary directory before it could start the client.  GlassFish v3 does not package all these files into a single large JAR.  Instead, GlassFish downloads these files individually into a subdirectory below the directory you specify on the deploy or get-client-stubs command.  

This helps the ACC launch the client faster, because there's no need to expand any files first.  

You still launch the client using the exact same command as in v2.  For example, if you deploy myApp.ear which contains the app client myClient.jar, then in v3 as in v2 you launch the client using

appclient -client downloaddir/myAppClient.jar

Note: We have never officially published or documented the format or content of the downloaded directory, but in v2 some users have copied downloaded app clients by simply copying the single downloaded myAppClient.jar file.  This no longer works in v3.  Instead, use the get-client-stubs command to download the client files to the new location.

Embedded ACC

Beginning in v3 you can "call" the ACC from inside a running Java application of your own.  (For many users the appclient command or the built-in Java Web Start support will continue to meet their needs.)  The functional spec for the v3 ACC described the API, as does the published javadoc, but the basic programming model is that your application creates an app client container builder, invokes methods on that builder to configure the app client container (security, etc.) then gets the app client container from the builder.  Your application can then pass the app client to be run to the just-configured ACC's launch method, and the client class starts with the full support of the ACC behind it.

In fact, the appclient command implementation itself uses the embedded ACC API.   

Tuesday Feb 24, 2009

Looking for opinions from app client developers

As we are working on the support for app clients in GlassFish v3, I've posted a "request-for-opinions" in the GlassFish forum.

Rather than repeat it all here, please go visit the topic.  If you develop app clients please take a few moments to add your thoughts as replies to the forum topic there (not to this blog). 

Thursday Nov 06, 2008

About extensibility in GlassFish v3 prelude

Supporting new types of applications in GlassFish v3 is as easy as 1...2...3...literally.  Implement three interfaces GlassFish prescribes, package them as an OSGi module accessible to GlassFish, and then you deploy and run apps of the new type. 

[Read More]

Deployment in GlassFish v3 prelude

In GlassFish v3 prelude deployment is mostly what you know from v2...only quite a bit faster.

[Read More]

Monday Jan 14, 2008

JAX-WS 2.1 now part of Java 1.6.0_04

Using GlassFish app clients that access web services with Java SE 1.6 has become easier with the release of Java SE 1.6.0_04.  This is especially true when users launch such app clients using the automatic Java Web Start support that is part of GlassFish.

[Read More]

Thursday Dec 13, 2007

Why does GlassFish warn about not finding referenced JAR files?

The warning message "Error attempting to process extensions from the manifest of JAR file..." during a client launch might not always indicate a problem.

[Read More]

Friday Nov 09, 2007

JavaFX Script in a GlassFish app client - featuring persistence this time

This example of an app client with JavaFX uses a local persistence unit to implement a simple address book application.

[Read More]

News and musings on the technology I work on at Oracle.

The views expressed on this blog are my own and do not necessarily reflect the views of Oracle.


« July 2016