Since it can sometimes be tricky, I thought I would write about how to establish an EJB connection to a P8 platform. I try a lot of things to actually see it was quite easy.
First, forget about a non SSL connection with WebSphere 8. I tried a lot of things, including modifying the RMI/IIOP configuration in the WebSphere console to allow non SSL connection but nothing worked. But using SSL for EJB does’t mean you have to have your CE exposed via https, this is something different and doesn’t require any settings so why not use this.
First the connection code
To make it work to have to change a little bit the code you are using to establish the connection, It may be other solutions to make it work of course, but this one worked for me.
Warning: You have to use the fully qualified name of the server, using the IP address in the URI and the configuration file didn’t work for me. Here the hostname is basil.
Connection conn = Factory.Connection.getConnection("iiop://basil:2809/FileNet/Engine"); Subject subject = UserContext.createSubject(conn, "P8Admin", "*********", "FileNetP8"); UserContext.get().pushSubject(subject); Domain domain = Factory.Domain.getInstance(conn, null); ObjectStore os = Factory.ObjectStore.fetchInstance(domain, "TARGETOS", null); System.out.println("Object store name: " + os.get_Name());
Of course if you do only this, it won’t work since we did’t give any information about Corba and the CE server. You will get the following exception:
JSAS1480I: Security is not enabled because the ConfigURL property file is not set. Exception in thread "P=48700:O=0:CT" com.filenet.api.exception.EngineRuntimeException: FNRCS0001E: SECURITY_ANONYMOUS_DISALLOWED: Access to Content Engine was not allowed because the request was made anonymously instead of by an authenticated user.
Edit the build path
Using EJB is server dependent, also you will have to add the jar of your application server, in our case WebSphere. The jar is called com.ibm.ws.ejb.thinclient_8.5.0.jar and is located in the folder WAS_HOME/runtimes, which, if you keep every default value, should be /opt/IBM/WebSphere/AppServer/runtimes. Copy this file somewhere on your developer workstation and add it to your project build path:
You might also have to use the IBM implementation of orb. I didn’t have to do that, which is strange since I am using a Sun JRE, but you can find the jar com.ibm.ws.orb_8.5.0.jar in the same directory that the thinclient jar. And the either add it to your path like the thinclient, or put in alone in a folder and add the following option to your JVM:
But again, for me it worked without this jar so maybe you won’t need it.
The Corba configuration
You need to get two files from the WebSphere server in order to make it work. They are:
You can find them in the folder WAS_HOME/profiles/profile_name/properties, if you did a CPIT installation or used default value, it should be:
Copy this file into your project, then open sas.client.props, and modify the following lines
com.ibm.CORBA.securityServerHost=basil com.ibm.CORBA.securityServerPort=2809 com.ibm.CORBA.loginSource=none
For me it’s working without changing loginUserId and loginPassowrd line.
# RMI/IIOP user identity com.ibm.CORBA.loginUserid= com.ibm.CORBA.loginPassword=
Then open the ssl.client.props file and edit the 2 following lines:
At this moment you have two options, you can get this 2 files from your WebSphere server, in the folder etc of your profile, or let our application create the keystore and trusstore. If you let it create them for you it will just pop a window asking if you trust the certificate. If you want to be user interaction free, copy the 2 files fron the server to your project folder.
Add the JVM option
You also need to tell Corba that your want to use these 2 files as configuration, for this add this 2 options when launching the application:
You can also use relative path like this:
But the file: is really important!
Also if you want to be more agile to several platform, you can set these properties into your code before the connection it works the same:
System.setProperty("com.ibm.CORBA.ConfigURL", "file:sas.client.props"); System.setProperty("com.ibm.SSL.ConfigURL", "file:ssl.client.props");
You can read sometimes that you also have to define the property
com.ibm.websphere.naming.WsnInitialContextFactory, but this is not necessary with the WAS8 EJB thin client jar because it contains a jndi.properties file defining this property for you.
Modify the WebSphere configuration
In order to make the EJB connection work, WebSphere needs to know properly its own name. The hostname for the BOOTSTRAP_ADDRESS and ORB_LISTENER_ADDRESS must be updated to use the real hostname (fully qualified) and not localhost.
- Open the WebSphere administration console (https://host:9043/ibm/console).
- Go to Servers > Server Types > WebSphere application servers > server_name > Communication > Ports
- Edit BOOTSTRAP_ADDRESS and ORB_LISTENER_ADDRESS to use your hostname and not localhost.
- Don’t forget to save and restart the server.
Open the EJB Ports
Of course, don’t forget to modify your firewall configuration and if you have, the port redirection to your server. To make an SSL EJB connection to a WebSphere server, you will have to open the following ports (check the value of ports in the Port configuration in the WebSphere administration console):
- BOOTSTRAP_ADDRESS: default is 2809
- CSIV2_SSL_SERVERAUTH_LISTENER_ADDRESS: default is 9403
- ORB_LISTENER_ADDRESS: default is 9100
This gives with iptables:
iptables -I INPUT 4 -i eth0 -p tcp --dport 2809 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -I INPUT 4 -i eth0 -p tcp --dport 9100 -m state --state NEW,ESTABLISHED -j ACCEPT iptables -I INPUT 4 -i eth0 -p tcp --dport 9403 -m state --state NEW,ESTABLISHED -j ACCEPT
If you don’t you will get the following error in the console
SECJ0395E: Could not locate the SecurityServer at host/port: notonlyanecmplace.com/2809 to validate the userid and password entered. You might need to specify valid securityServerHost/Port in WAS_INSTALL_ROOT/profiles/profile_name/properties/sas.client.props file.
With a orbtrc file saying:
com.ibm.ws.security.orbssl.WSSSLClientSocketFactoryImpl createSSLSocket P=555290:O=0:CT ORBRas[default] JSSL0130E: java.io.IOException: Signals that an I/O exception of some sort has occurred. Reason: connect timed out com.ibm.ws.security.orbssl.WSSSLClientSocketFactoryImpl createSSLSocket P=555290:O=0:CT ORBRas[default] CONNECT_FAILURE_ON_SSL_CLIENT_SOCKET - JSSL0130E: java.io.IOException: Signals that an I/O exception of some sort has occurred. Reason: connect timed out com.ibm.CORBA.transport.TransportConnectionBase connect:386 P=555290:O=0:CT ORBRas[default] org.omg.CORBA.COMM_FAILURE: CONNECT_FAILURE_ON_SSL_CLIENT_SOCKET - JSSL0130E: java.io.IOException: Signals that an I/O exception of some sort has occurred. Reason: connect timed out vmcid: 0x49421000 minor code: 80 completed: No
Launch the application
Finally you can launch your application and hopefully everything will work as expeced, you should see an output like this:
log4j:WARN No appenders could be found for logger (filenet_error.api.com.filenet.apiimpl.util.ConfigValueLookup). log4j:WARN Please initialize the log4j system properly. Object store name: TARGETOS
And if you didn’t copy the keystore and truststore, you should get this window first: