Doh, WebSphere Application Server, Resource Environment Providers and Not-so-Shared Libraries

I'm fiddling with old-school Java again, reminding myself how Resource Environment Providers work in WebSphere Application Server (WAS) 9.

Using this : -

Using resource environment providers in WebSphere Application Server

and this: -

Resource Environment Provider in EJB-jar xml

as inspiration, I'd written a very basic servlet, that reads from a Resource Environment Entry, setup using a Resource Environment Provider, ably provided by a Java class.

When I attempted to use my servlet ( the Resource Environment Entry is retrieved during the doGet() method, I saw this in the logs: -

...
[06/12/18 18:05:46:969 GMT] 00000098 annotation    W com.ibm.ws.webcontainer.annotation.WASAnnotationHelper inject(mo) SRVE8042E: An internal error caused the reference context that enables injection to not be initialized properly.

...

[06/12/18 18:05:47:539 GMT] 00000098 ServletWrappe E com.ibm.ws.webcontainer.servlet.ServletWrapper service Uncaught service() exception thrown by servlet com.davehay.Hello: java.lang.NoClassDefFoundError: com.ibm.acme.ree.lib.Config

at com.davehay.Hello.doGet(Hello.java:23)

...

Caused by: java.lang.ClassNotFoundException: com.ibm.acme.ree.lib.Config

...

Guess what ?

I bet you can't....

It was (l)user error.

Although I'd included my "utility" JAR as a Shared Library in WAS, I'd forgotten to "bind" it to the application : -

So, even though my application "knew" about the Resource Environment: -

it couldn't marry the two together i.e. the exception: -

...

Caused by: java.lang.ClassNotFoundException: com.ibm.acme.ree.lib.Config

...

took me right back to my beginnings with J2EE and WAS 2.X in the early noughts - it's always the class path, dummy

Using the Stream Editor (sed) with Bash variables

I've got a shell script to setup IBM HTTP Server (IHS), which includes a question: -

if [ -z "$1" ]

  then

    echo "For what product are you creating this ?"

    exit 1

fi

 and then uses the Stream Editor (sed) to use this variable : -

sed -i'' 's/PidFile\ logs/PidFile\ ${Product}\/logs/g' /opt/ibm/HTTPServer/${Product}/conf/httpd.conf

sed -i'' 's/ErrorLog\ logs/ErrorLog\ ${Product}\/logs/g' /opt/ibm/HTTPServer/${Product}/conf/httpd.conf

sed -i'' 's/CustomLog\ logs/CustomLog\ ${Product}\/logs/g' /opt/ibm/HTTPServer/${Product}/conf/httpd.conf

Sadly, this didn't quite work ....

Instead, I ended up with this: -

PidFile ${Product}/logs/httpd.pid

rather than this: -

PidFile WAS/logs/httpd.pid

 Thankfully, it was a quick fix - I just needed to change my Bash script to this: -

sed -i'' "s/PidFile\ logs/PidFile\ ${Product}\/logs/g" /opt/ibm/HTTPServer/${Product}/conf/httpd.conf

sed -i'' "s/ErrorLog\ logs/ErrorLog\ ${Product}\/logs/g" /opt/ibm/HTTPServer/${Product}/conf/httpd.conf

sed -i'' "s/CustomLog\ logs/CustomLog\ ${Product}\/logs/g" /opt/ibm/HTTPServer/${Product}/conf/httpd.conf

In other words, I replaced the single quotes around the s/from/to/g section of the Sed script with double quotes ....

Thanks to this: -

How do I use variables in a sed command?

for inspiration.

WebSphere Application Server (WAS) and Single Sign-On (SSO) - Back to 2011

It's been a while since last I did this, but I'm revisiting the happy days of 2011, when first I setup WAS and SSO with Microsoft Active Directory, Kerberos and SPNEGO.

I even presented upon the topic in 2012: -

IBM Connections and Desktop Single Sign-On using Microsoft Active Directory, Kerberos and SPNEGO

Whilst I've done the SPNEGO piece time and again, the thing that I'd not done in a while was to configure the fallback login page.

Thankfully, the IBM Connections documentation to which I referred back in 2012 is still there, albeit in more recent form: -

Configuring SPNEGO (and Kerberos optionally) on WebSphere Application Server

The significant thing is to create a fallback login page, using the HTML example here: -

Creating a redirect page for users without SPNEGO support

This was then hosted on the IBM HTTP Server (IHS) service that fronts the WAS 9 environment: -

/opt/ibm/HTTPServer/htdocs/NoSpnegoRedirect.html

which I then configured in WAS: -

Now, when I hit my servlet via a clean browser: -

https://was.uk.ibm.com:8443/HelloAgain/HelloAgain

I automatically get a login page: -

Note that the URL automatically gets ?noSPNEGO : -

https://was.uk.ibm.com:8443/HelloAgain/login.html?noSPNEGO

thanks to the filter criteria: -

WebSphere Application Server - Get your security roles right

I'm back in the early noughties, tinkering with Java Enterprise Edition (JEE) servlets and WebSphere Application Server (WAS) Network Deployment (ND).

This, in part, is to enable me to test my SPNEGO / Kerberos configuration.

Having created a JEE application in Eclipse, with servlet, login page etc. and having tested it in Liberty, I'd deployed my code to WAS ND.

However, when I tried to access the servlet: -

https://was.uk.ibm.com:9444/HelloWorld/Hello

I saw this: -

[03/12/18 17:15:19:295 GMT] 00000096 WebCollaborat A   SECJ0129E: Authorization failed for user hayd:defaultWIMFileBasedRealm while invoking GET on default_host://HelloWorld, Authorization failed, Not granted any of the required roles: reader

I'd already ensured that I'd mapped my users ( hayd and Administrator ) to the appropriate role: -

However, I was holding it wrong .... when I'd hand-cranked the web.xml, I'd made a little booboo.

I'd specified the Security Role as: -

Reader

but specified the Auth Constraint -> Role Name as: -

reader

So it made NO difference to which user/group I assigned the Reader role; it'd never work :-(

Get it right .....

SPNEGO - Not working, now working

There's a theme to my blog posts these days: -

Docker for macOS - Broken, now fixed 

Maven and Spring and Liberty - Broken, now fixed 

Kerberos and Red Hat Enterprise Linux - Now friends

so this one is all about SPNEGO and Kerberos.

Having enabled WebSphere Application Server (WAS) 9 and Windows Server 2012 R2 to play nicely together with Kerberos/SPNEGO, I was STILL seeing a logon box in Internet Explorer 11: -

I'd already checked that Integrated Windows Authentication (IWA) was enabled; this now appears to be the default: -

*BUT* guess what I'd forgotten ?

Yep, I had NOT added the site: -

https://was.uk.ibm.com

to the appropriate zoneS in IE.

Now I'd already realised that IE11 no longer shows the internet/intranet/trusted zone in the status bar, BUT you can get a view using the [Alt] [F] [R] key sequence: -

Initially I added the site to the Trusted sites zone: -

but to no avail.

I then followed this: -

Configuring the client browser to use SPNEGO

and added the site to the Local intranet zone: -

which actually moves it from Trusted sites: -

and now it just works.


Nice :-)

Docker for macOS - Broken, now fixed

I had this occur today: -



after updating Docker to the latest version.

I'm using macOS Mojave 10.14.1, and Docker is now 2.0.0.0-mac81 : -



The specific exception in the Docker box was: -

2018-12-04T08:47:42Z docker 
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0Error starting daemon: error initializing graphdriver: driver not supported
2018-12-04T08:47:42Z docker + failed_to_start

There's an issue on Github here: -

https://github.com/docker/for-mac/issues/3388

and it's also referenced here: -

https://github.com/docker/for-mac/issues/3349

including this: -

EDIT: Using the "Factory Reset" button has me up and running again.

Like the posters, I hit the Reset switch: -

and now we're back in the game ......

docker load -i ace.tar 

b8c891f0ffec: Loading layer [==================================================>]    120MB/120MB

33db8ccd260b: Loading layer [==================================================>]  15.87kB/15.87kB

79109c0f8a0b: Loading layer [==================================================>]  14.85kB/14.85kB

f1dfa8049aa6: Loading layer [==================================================>]  3.072kB/3.072kB

926ba84fdf78: Loading layer [==================================================>]   2.56kB/2.56kB

14ddc615b0a9: Loading layer [==================================================>]  2.048kB/2.048kB

7bfdaab18f80: Loading layer [==================================================>]  6.564MB/6.564MB

53a3f139859a: Loading layer [==================================================>]  1.057GB/1.057GB

2c91522175de: Loading layer [==================================================>]  1.487MB/1.487MB

b9e113a69961: Loading layer [==================================================>]  12.79MB/12.79MB

42bf48ad84d5: Loading layer [==================================================>]  6.433MB/6.433MB

ab4fa38d2a99: Loading layer [==================================================>]  16.38kB/16.38kB

4b07a7d9d690: Loading layer [==================================================>]  26.11kB/26.11kB

136e79d5bba2: Loading layer [==================================================>]  19.62MB/19.62MB

4252d65c4c6f: Loading layer [==================================================>]   2.56kB/2.56kB

Loaded image: ibmcom/ace:latest

docker images

REPOSITORY          TAG                 IMAGE ID            CREATED             SIZE

ibmcom/ace          latest              b8cdb54f47bc        2 weeks ago         1.17GB

MacBookPro:~ davidhay$ docker -v

Docker version 18.09.0, build 4d60db4

Kerberos and Red Hat Enterprise Linux - Now friends

Following a number of previous posts, including: -

Koralling Kerberos Keytabs

IBM Business Process Manager and Desktop SSO via Kerberos and SPNEGO

I was looking for, and failing to find, utilities such as ktutil and ktlist on my RHEL 7.6 box.

Of course, I was holding it wrong.

I was missing the Kerberos (KRB5) tooling: -

yum install -y  krb5-libs

yum install -y  krb5-server
yum install -y  krb5-workstation

specifically the last of the three.

Thanks to this: -

Installing Kerberos on Redhat 7

for pointing out the error of my ways.

Now I have this: -

ls -al `which ktutil`

-rwxr-xr-x 1 root root 23784 Aug  1 20:34 /bin/ktutil

so I can do this: -

rkt() { echo -e "read_kt $1\nlist\nquit" | ktutil | grep -v "^ktutil:";}

rkt /mnt/was.uk.ibm.com.keytab 

ktutil:  read_kt /mnt/was.uk.ibm.com.keytab
slot KVNO Principal
---- ---- ---------------------------------------------------------------------
   1    4                   HTTP/was.uk.ibm.com@UK