Friday Aug 08, 2014

Spotlight on GlassFish 4.1: #4 JAXP accessExternalSchema

'Spotlight on GlassFish 4.1' is a series of posts that highlights specific enhancements of the upcoming GlassFish 4.1 release. It could be a new feature, a fix, a behaviour change, a tip, etc.

#4 JAXP 1.5 accessExternalSchema

GlassFish 4.1 supports recent JDK versions (JDK 7 u65+ and JDK 8 u5+). Sometime, those newer JDKs might have some side effect as they bring new features too. 

For example, several properties have been introduced in JAXP 1.5 (JDK 7u40+ and JDK 8+). Properties which are used to set restrictions when JAXP is used to process untrusted XML contents. And by default, those restrictions are set!

GF 4.1 is configured to offer the behavior of GF 4.0 used with an older JAXP release (prior to JAXP 1.5), i.e. no restriction on schemas processing. So by default, a GF 4.1 domain.xml is configured with the following JVM option to allow all schemas to be processed: <jvm-options>-Djavax.xml.accessExternalSchema=all </jvm-options>
This configuration obviously assumes that your external XML content is trusted or at least sanitised by an XML firewall. This is applicable to JAXP 1.5 (and above).

Thursday Apr 12, 2012

EclipseLink Moxy Provider for JAX-RS and JAX-WS

EclipseLink MOXy is a JAXB provider bundled in GlassFish 3.1.2. In addition to JAXB RI, it provides XPath Based Mapping, better support for JPA entities, native JSON binding and many other features.

Learn more about MOXy and JAXB examples on their wiki.


Blaise blogged about how MOXy can be leveraged to create a JAX-WS service.You just need to provide data-binding attribute in sun-jaxws.xml and then all the XPath-based mapping can be specified on JAXB beans.

MOXy can also be used as JAX-RS JSON provider on server-side and client-side.

How are you using MOXy in your applications ?

Saturday Oct 15, 2011

Tab sweep - Mostly Java EE 6

Recent Tips and News on Java EE 6 & GlassFish:

Radio Receiver

What's new in Java EE 6 (Antonio)
Java EE Web Services @ minuteproject (
Java EE 6 and the Spring Framework (WebSphere Community Blog)
Best practices migrating from Spring to Java EE 6 (JavaOne Session 24423)
The Heroes of Java: Fabiane Bizinella Nardon (from Markus' Series)
TechCast Live - Mike Lehman Interview (OTN Live)

Friday Feb 18, 2011

First Java EE 6 Oracle Certifications now available

Oracle University (the training unit in the company) has now made available several new Java EE 6-related certifications. These are part of the Oracle Certification Program and cover EJB 3.1, JPA 2.0, Servlet & JSP, as well as Web Services.

Here are the links :

Oracle certifications

Java EE 6 - Enterprise JavaBeans Developer
Java EE 6 - Java Persistence API Developer
Java EE 6 - Web Services Developer
Java EE 6 - JavaServer Pages and Servlet Developer Certified Expert Exam

Each of the above links provides you with recommended training and preparation, pricing, date and exam topics. The complete certification path is here.

Saturday Mar 14, 2009

Towards REST and SOAP in Java EE 6 - JAX-RS 1.1 and JAX-WS 2.2


Progress on both sets of Web Services specifications for JavaEE 6...

On the RESTful side, Marc reports on a new specification draft. As usual, the JSR311 Website has full details including the Editors Draft and a Changelog. Marc points out there is still work pending in the integration with Servlet 3.0, EJB 3.1 and JSR 299.

On the SOAP side, Rama announces a new implementation of the latest JAX-WS 2.2 Draft.

Friday Feb 27, 2009

Towards Metro 2.0 - JAX-WS 2.2 Update

This week Harold gave the Metro Webinar, which is a good oppty to catch up with Metro news. There are two release families: GlassFish v2 and GF v3prelude uses the Metro 1.x releases while GlassFish v3 (post-prelude) will use Metro 2.0.


The latest 1.x release is Metro 1.4, out last Fall (see Jitu's Summary and GFv3 Prelude note). Jiandong recently published several notes explaining how to use it in STS (Security Token Service) scenarios: [1], [2], [3]; note that Jiandong reports a new 1.5 is being tested.

The Metro 2.x family is still evolving; its first delivery will be in GFv3 and will implement JAX-WS 2.2 (see Rama's post), which includes support for WS-Addressing - Metadata using Policy project. Metro 2.0 can also used on Java SE, see Fabian's note. Full details on Metro 2.0 in its OnePagers; also see the Roadmap, with the usual warning about dates!

Wednesday Feb 25, 2009

Today's Webinar - Metro, the GlassFish Web Services Stack


In today's (Thursday) webinar Harold will present on Metro, the GlassFish Web Services Stack. Metro is used in GlassFish, OpenSSO, OpenESB and a numer of JavaEE AppServers; one of its advantages is its strong interoperability with Microsofts's WCF in .Net.

Presentation at 11am US Pacific, at TheAquarium Channel. Full details (and recordings) at the Show Page.

PS. A bit later in the day, at 1pm US Pacific, I will host an Overview of GlassFish Portfolio Announcements, in Spanish.

Saturday Feb 14, 2009

Metro and Jersey - At Microsoft and O'Reilly


Metro, the Web Services stack, is one of the main components in GlassFish. One of its key benefits is excellent WebServices interoperability with the Microsoft stack, leveraging our relationship with MS. A consequence is showings in informal publications from Microsoft, like mszCool's Plans for 2009 and Identity Interoperability as well as in formal Federated Identity and Healthcare in the MS's The Architecture Journal.

On a related note, O'Reilly has published Java Web Services: Up and Running - A quick, practical, and thorough introduction where Martin Kalin covers SOAP and RESTful Web Services in Java using Metro and Jersey.

For WebServices discussions, check out our Forum, and the mailing lists USERS@Metro and USERS@Jersey. Although we consider Jersey a piece of Metro - we love SOAP and REST equally :-) and the two parts are intended to mesh together - we are maintaining two mailing lists as the audiences tend to be disjoint.

Tuesday Sep 16, 2008

OpenSSO Mid-September Roundup

There's been so much happening in the OpenSSO community over the past week or two, I haven't kept up with covering it here at The Aquarium. Here's a quick roundup:

OpenSSO Logo

Sun Super-SE Shesh Kondi describes how to deploy OpenSSO and its Java EE agents onto Weblogic on Mac OS X. This isn't a supported combination, but it's really handy for demos and development.

At Sun Developer Network, the latest in the 'From the Trenches at Sun Identity' series, Sidharth Mishra talks to Marina Sum about Security for Web Services.

One I picked up on Google Alerts - Qingfeng Zhang has integrated OpenSSO with JA-SIG CAS, allowing users to login to CAS and access resources protected by OpenSSO.

If you haven't already given OpenSSO a whirl, go sign up to the project, download the bits and do it now - you may just win some goodies from the CafePress OpenSSO store.

Finally, a great example of an open source community in action - OpenSSO authentication providers for Spring and Seraph. These are integrations in the 'opposite direction' from the CAS one above, allowing users to login to OpenSSO and access resources protected by Spring Security and Atlassian Seraph (the latter used by Jira and Confluence).

To stay current on OpenSSO, subscribe to Planet OpenSSO (feed).

Wednesday Jul 30, 2008

Metro 90% better performing than Axis, JAX-WS works

Academy Award Oscar

ArcGIS SOAP stack switched from Axis 1.x to Metro because of XML performance bottleneck. And they observed:

"The result of this project is an increased performance of the ArcGIS Server's SOAP stack (by about 90%)."

A quote from another user trying to connect disparate systems:

"But I honestly cannot believe customers will continue to put up with the furball that AXIS2 has become. And if I am in a position to make a recommendation, I will recommend JAX-WS. It works."

Another endorsement of Metro's pluggable & extensible architecture is DCOM and Grizzly transports for Metro, reported by Jitu.

How is Metro helping you ?

Saturday Jul 19, 2008

Invoking GlassFish WebServices from SilverLight and .NET


In the heels of the Developer.COM Award for Metro for its interoperability capabilities here are two blog posts from Guy Burstein specifically describing how to do it: From SilverLight and From .NET Client.

Metro interoperability is a key reason for the Metro Adoption. We have had a number of GlassFish customer wins that started on a desire to interoperate with Microsoft's stack.

And it is always nice to see GlassFish mentioned at MSDN :-)

Tuesday May 13, 2008

Metro on GlassFish v3 TP2


The GFv3 TP2 does not include the SOAP web services stack - Metro - (content) but it has all the required hooks and Metro is available from the v3 download center, as Bhakti explains in her Latest Note.

Installation is straight-forward with the new UpdateCenter (ScreenShot). Try it out and let us know how it goes.

BTW, for those curious, you can poke to the IPS repositories through HTTP: windows, linux, mac, solaris SPARC, solaris x86

PS. As you can see, in addition to Metro, the GFv3 repository includes Grails support, Jersey (RESTful Web Services), jMaki/AJAX, and jRuby. Since TP2 already includes the Java Web Tier (Servlet+JSP+JSF) and JPA (EclipseLink), it is actually a very functional release - please share your experiences with it.

Friday Apr 18, 2008

Fetching User Attributes With Identity Services

Identity Services Screenshot

Over the past few months, Aravindan Ranganathan, Lakshman Abburi and Marina Sum have been working on a series of articles covering the new identity services functionality available now in OpenSSO and coming soon in Sun Federated Access Manager 8.0. This week sees the publication of part 3, covering retrieval of user attributes.

One notable feature of the series is it's presentation of both SOAP/WSDL and REST patterns for accessing OpenSSO's identity services. Which do you use, and why?

Friday Apr 11, 2008

Web Services Security in Metro video interview

Photo of interviewee

The GlassFish Podcast has already provided some GlassFish audio, but this time Ed Ort brings us video with this interview of members of the Metro Web Services Security team. The interview, which was taped at the recent Hyderabad Sun Tech Days, starts off with interviewee background questions before it gets into the point-to-point vs. end-to-end security tradeoff (both of which Metro can do).

It then goes on to discuss the four main parts (specifications really) implemented today in Metro : WS-Security, WS-SecurityPolicy, WS-Trust, and WS-SecureConv (full list). The interview finally touches on the future beyond Metro 1.1 which is mainly about implementation of next versions of the specifications.

If nothing else, this is a good time to put a face on a name if you've been participation in the Metro mailing list or forum. If you're coming to JavaOne, you may want to write down this Microsoft/Sun session about interoperable web services.

Wednesday Apr 02, 2008

Metro and Microsoft - Microsoft Technology Centers and in BizTalk

FLying Pig in Cincinnati

You know the saying... "when Pigs Fly..."? Well, Clemen's Latest note starts:

A flock of pigs has been doing aerobatics high up over Microsoft Campus in Redmond

What he is referring is that he just checked in GlassFish and Metro into the latest Biztalk SDK! Neat! And he has some very nice words for the Metro team, as Arun highlights.

On the other side of the Atlantic, Alexis highlights another Microsofter, St├ęphane, on another aspect of the same relationship: GF and NetBeans being available at Microsoft Technology Centers.

I think we may have a new mascot - the flying pig!