Weblogic deployment

Deploying Applications to Oracle WebLogic Server
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13702/toc.htm


Controlling Deployment File Copying with Staging Modes
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13702/deploy.htm#i1027041

WLST deploy
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13813/reference.htm#i1024284


deploy(appName, path, [targets], [stageMode], [planPath], [options])

Client connecting to Weblogic SSL port

Configuring Weblogic Security

Hashtable env = new Hashtable();
      env.put(Context.INITIAL_CONTEXT_FACTORY,
              "weblogic.jndi.WLInitialContextFactory");
      env.put(Context.PROVIDER_URL, "t3s://weblogic:7002");
      env.put(Context.SECURITY_PRINCIPAL, "javaclient");
      env.put(Context.SECURITY_CREDENTIALS, "javaclientpassword");
      ctx = new InitialContext(env);

WLST Client has to configure trust using these properties:

java -Dssl.debug=true -Dweblogic.security.CustomTrustKeyStoreFileName=c:\app\cert\ServerTrust.jks
 -Dweblogic.security.TrustKeyStore=CustomTrust
 -Dweblogic.security.SSL.trustedCAKeyStore=c:\app\cert\ServerTrust.jks 
 weblogic.WLST connectSSL.py

http://download.oracle.com/docs/cd/E12839_01/web.1111/e13711/ssl_client.htm#i1067487

Configuring SSL on Weblogic

http://download.oracle.com/docs/cd/E12839_01/web.1111/e13707
/identity_trust.htm

http://java.sun.com/javase/6/docs/technotes/tools/windows/keytool.html#importCertCmd


http://chrismuir.sys-con.com/node/1075471/mobile

ProfessionalWeblogic

.  /usr/bea/wlserver_10.3/server/bin/setWLSEnv.sh

rm -f *jks *pem *der

# create CA self signed certificate
java utils.CertGen -certfile ServerCACert -keyusage digitalSignature,keyAgreement,keyCertSign,keyEncipherment,dataEncipherment -keyusagecritical false -keyfile ServerCAKey -keyfilepass ServerCAKey -selfsigned -e somebody@dave.com -ou FOR-DEVELOPMENT-ONLY -o XXXX -l PRAGUE -s CZ -c EU

#print certificate
openssl x509 -text -inform der -in ServerCACert.der

# store the private key and the digital certificate in the identity keystore
java utils.ImportPrivateKey -certfile ServerCACert.der -keyfile ServerCAKey.der -keyfilepass ServerCAKey -keystore ServerIdentity.jks -storepass ServerCAKey -alias identity -keypass ServerCAKey

#Store the same digital certificate into the trust keystore
keytool -import -v -trustcacerts -alias identity -file ServerCACert.der -keystore ServerTrust.jks -storepass ServerTrustStorePass

keytool -list -keystore ServerIdentity.jks -storepass ServerCAKey
keytool -list -keystore ServerTrust.jks -storepass ServerTrustStorePass

<Dec 11, 2009 12:17:40 AM CET> <Notice> <Security> <BEA-090171> <Loading the identity certificate and private key stored under the alias identity from the JKS keystore file /home/dave/workspace/cert/ServerIdentity.jks.> 
<Dec 11, 2009 12:17:44 AM CET> <Notice> <Security> <BEA-090169> <Loading trusted certificates from the JKS keystore file /home/dave/workspace/cert/ServerTrust.jks.> 
<Dec 11, 2009 12:17:44 AM CET> <Notice> <Server> <BEA-002613> <Channel "DefaultSecure" is now listening on 127.0.0.1:7002 for protocols iiops, t3s, ldaps, https.> 

java  -Dssl.debug=true -Dweblogic.StdoutDebugEnabled=true \
-Dweblogic.security.TrustKeyStore=CustomTrust \
-Dweblogic.security.CustomTrustKeyStoreFileName=/home/dave/workspace/cert/ServerTrust.jks \
-Dweblogic.security.CustomTrustKeyStoreType=jks \
-Dweblogic.security.SSL.trustedCAKeyStore=/home/dave/workspace/cert/ServerTrust.jks 

weblogic.WLST connectSSL.py

java utils.CertGen -help

Usage: java utils.CertGen
    -certfile <cert_file> -keyfile <private_key_file>
    -keyfilepass <private_key_password>
    [-cacert <ca_cert_file>][-cakey <ca_key_file>]
    [-cakeypass <ca_key_password>]
    [-selfsigned][-strength <key_strength>]
    [-e <email_address>][-cn <common_name>]
    [-ou <org_unit>][-o <organization>]
    [-l <locality>][-s <state>][-c <country_code>]
    [-keyusage [digitalSignature,nonRepudiation,keyEncipherment,
        dataEncipherment,keyAgreement,keyCertSign,
        cRLSign,encipherOnly,decipherOnly]]
    [-keyusagecritical true|false]
    [-subjectkeyid <subject_key_identifier>]
    [-subjectkeyidformat UTF-8|BASE64]
    [-help]

Where:
-cacert, -cakey, -cakeypass
    public certificate, private key file names, and private key
    password of the CA to be used as an issuer of the generated
    certificate. When these options are not specified Demo CA files:
    CertGenCA.der, CertGenCAKey.der from the current working directory
    or from WebLogic lib directory will be used.

-selfsigned
    generate a self-signed certificate. CA options will be ignored
    when this option is specified

-certfile, -keyfile
    output file names without extensions for the generated public
    certificate and private key. Appropriate extensions are appended
    when the pem and der files are created.

-keyfilepass
    password of the generated private key.

-strength
    size of the generated keys. The default is 1024 bits.

-e, -cn, -ou, -o, -l, -s, -c
    Subject DN attributes of the generated public certificate.

-keyusage
    generate certificate with keyusage extension, and with bits set
    according to the comma-separated list of bit names.
    Extension will be marked as critical by default.
    Use [-keyusagecritical false] to generate certificate with
    non-critical extension.

-subjectkeyid
    generate certificate with the specified subject key identifier
    Use [-subjectkeyidformat UTF-8|BASE64] to indicate the format of
    the specified subject key identifier string. The default is UTF-8.

WLSTException: Error occured while performing connect : "Cannot connect to WLST." : The command line trust keystore configuration is incorrect. Either TrustKeyStore is set to an illegal value or TrustKeyStore is set to CustomTrust and CustomTrustKeyStoreFileName is not set.

To use the trusted CAs in the JDK's cacerts, specify:

     -Dweblogic.security.TrustKeyStore=JavaStandardTrust
         defaults to JavaStandardTrust

     -Dweblogic.security.JavaStandardTrustKeyStorePassPhrase=passphrase
         defaults to no passphrase which means
         read-only access to the JDK's cacerts.

 To use the trusted CAs in DemoTrust.jks and in the JDK's cacerts, specify:

     -Dweblogic.security.TrustKeyStore=DemoTrust
     -Dweblogic.security.JavaStandardTrustKeyStorePassPhrase=passphrase
         defaults to no passphrase which means
         read-only access to the JDK's cacerts.

 To use the trusted CAs from another keystore, specify:

     -Dweblogic.security.TrustKeyStore=CustomTrust

     -Dweblogic.security.CustomTrustKeyStoreFileName=filename
         either an absolute pathname or a pathname relative to the
         directory the server was booted in.

     -Dweblogic.security.CustomTrustKeyStoreType=type
         defaults to the default keystore type specified
         in the JDK's java.security file.

     -Dweblogic.security.CustomTrustKeyStorePassPhrase=passphrase
         defaults to no passphrase. Some keystore types allow this
         but only grant read-access (eg. jks). Other keystore types
         require a keystore passphrase even for read-access.

Starting AdminServer with WLST

Use the WLST startServer command to start the Administration Server.

startServer([adminServerName], [domainName], [url], [username],
[password],[domainDir], [block], [timeout], [serverLog],
[systemProperties], [jvmArgs] [spaceAsJvmArgsDelimiter])

import os

adminServerName = "AdminServer"
adminServerUrl = "t3://localhost:7001"
adminUser = "weblogic"
adminPassword = "weblogic123"

domainName = "base_domain"
domainHome = "/app/bea/domains/base_domain"

print "JAVA_HOME %s" % os.getenv("JAVA_HOME")
print "CLASSPATH %s" % os.getenv("CLASSPATH")

try:
    print "try connect to WLS %s" % adminServerName
    hideDumpStack("true")
    connect(adminUser, adminPassword, adminServerUrl)
    hideDumpStack("false")
    print "Connected to %s" % adminServerName
except WLSTException:
    hideDumpStack("false")
    print "Server not started, try start %s " % adminServerName
    startServer(adminServerName,domainName,
        adminServerUrl, adminUser, adminPassword,
        domainHome,block="true")
    print "started %s" % adminServerName
    connect(adminUser, adminPassword, adminServerUrl)

ls()

shutdown(force='true')

exit()    

Initializing WebLogic Scripting Tool (WLST) ...

Welcome to WebLogic Server Administration Scripting Shell

Type help() for help on available commands

JAVA_HOME /usr/java/jdk160_05
CLASSPATH None
try connect to WLS AdminServer
Connecting to t3://localhost:7001 with userid weblogic ...
Server not started, try start AdminServer 
Starting weblogic server ... 

Server started successfully.
started AdminServer
Connecting to t3://localhost:7001 with userid weblogic ...
WLST-WLS-1260094522421: <Dec 6, 2009 11:15:45 AM CET> <Warning> <JMX> <BEA-149517> <An attempt was made to unregister an mbean that was already unregistered: weblogic.servlet.internal.ServletRuntimeMBeanImpl@146de01> 
Successfully connected to Admin Server 'AdminServer' that belongs to domain 'mydomain'.

Warning: An insecure protocol was used to connect to the 
server. To ensure on-the-wire security, the SSL port or 
Admin port should be used instead.

Weblogic 11g (10.3.1) weblogic-application.xml, application.xml documentation

Enterprise Application Deployment Descriptor Elements
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13706/app_xml.htm#i1062940

http://java.sun.com/xml/ns/javaee/

Using run-as-principal in MDB deployment descriptor

ejb-jar.xml

            <security-identity>
                <run-as>
                 <role-name>Admin</role-name>
                 </run-as>
                </security-identity>
        </message-driven>

...

<assembly-descriptor>
    <security-role>
         <role-name>Admin</role-name>
    </security-role>
        <container-transaction>

weblogic-ejb-jar.xml

<security-role-assignment>
            <role-name>
                    Admin
            </role-name>
                <principal-name>
                weblogic
                </principal-name>
          </security-role-assignment>
          <run-as-role-assignment>
        <role-name> 
            Admin 
        </role-name>
        <run-as-principal-name>
            weblogic
        </run-as-principal-name>
    </run-as-role-assignment>

Weblogic 11g (10.3.1) weblogic.xml, web.xml, weblogic-ejb-jar.xml, ejb-jar.xml documentation

Oracle Developer Guides
http://download.oracle.com/docs/cd/E12839_01/dev.htm

Oracle® Fusion Middleware Developing Web Applications, Servlets, and JSPs for Oracle WebLogic Server
11g Release 1 (10.3.1)
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13712/toc.htm

Java EE : XML Schemas for Java EE Deployment Descriptors
http://java.sun.com/xml/ns/javaee/


web.xml Deployment Descriptor Elements
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13712/web_xml.htm#i1039990

Oracle® Fusion Middleware Programming Enterprise JavaBeans for Oracle WebLogic Server
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13719/toc.htm

weblogic-ejb-jar.xml Deployment Descriptor Reference
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13719/ejb_jar_ref.htm#i1432300

ejb-jar.xml schema
http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd


weblogic.xml Deployment Descriptor Elements
http://download.oracle.com/docs/cd/E12839_01/web.1111/e13712/weblogic_xml.htm#i1057398