Using VirtualBox as Development Platform

This is a generic post regarding the usage of Virtual Machines and I will bring up topics that I frequently get asked about. There are several reasons why a Virtual Machine is a good choice for a development platform. A couple of reasons might be:

- The env. is contained as a whole and separate from whatever is happening on your host (host here equals the physical machine and guest will refer to the vm). This means that if you need to change host or upgrade OS isn't a big deal. Just have a backup of the VM's.

- You can share your whole dev. env. by simply let someone get a copy of the VM. This is how we share our demo env. internally from Development to the Field organizations.

Performance is rarely an issue anymore since most people should have access to a laptop/pc with at least 8GB RAM and the host OS should be 64 Bit. Some people even have access to SSD drives which removes the last bottleneck, Disk IO.

Moving from VMware to VBox

Inside Oracle most every product team these days share their new releases or early betas using pre-configured VM's and we see them in basically two formats, VirtualBox exports (sometimes just the VDI file) and VMware VM's. VirtualBox will handle both formats with ease. Most everything is now done on linux at Oracle so we see very few VM's with other OS's. Sharing the VM is the same but with Linux there are now license issues.

Some of the product demo VM's are now also available on OTN, http://www.oracle.com/technetwork/community/developer-vm/index.html

Unless the VM is shared in a VBox export format (which is of course is imported via File - Import Appliance) you can create a new empty VM but skip the disk creation step.

Screen shot above showing the step in the Create New Virtual Machine Wizard where the Disk file will be created. Un-check the checkbox and click Continue.

Later in VBox you can just add the disk file (the VDI or VMDK file). Screen shot above shows where to add the disk file in the Storage section in the Settings for the VM. Only thing you need to know is what type of controller that was used in the original VM, IDE, SATA or SCSI. If you have a VMware VM you can just open the .vmx file with any text editor and you can find this info in there.

When you have the VM running in VBox you will have to install the Guest Addtions (and if this was a VMware VM you need to remove VMware Guest Tools).

The Guest Addistions install will compile some kernel extensions and the Guest (the Virtual Machine) needs to be setup so that it can do just that, compile and build kernel extension. I will cover this in more detail later as it's rarely an issue. It can be an issue if you build a Guest from scratch and forgets to add these components (some kernel packages, the gcc compiler etc.).

Networking

Most questions I get relates to network issues and I think by now I have convinced most people to do what I do almost 100% of the time, run the guest with NAT networking. It will basically always just work. Regardles if your host is connected to a network or not. It also allows you to do everything you would expect from within the VM in terms of inbound and outbound traffic. Some tidbits of info:

• Each NAT guests on a host will have it's own subnet and they will all have the IP 10.0.2.15.
  
  
• A NAT guest will piggyback on the hosts's external IP and will have the same reach as the host. This also applies to VPN connections which means that if the host is on a VPN connection all NAT'd VM's will also be "on VPN". More interesting is perhaps that all these VM's can be reached from the VPN network using the Host's VPN IP. More on this under Port Forwarding below.
  
  
• You can create 4 Network interfaces using the VBox GUI (you can create another 4 using the command line interface). Other than NAT you can have Bridged, Host-only, Internal and a Generic mode. More on these modes here: http://www.virtualbox.org/manual/ch06.html#networkingmodes

Port Forwarding

This is one of the differentiating factors between VMware Player (Linux/Windows), VMware Fusion (Mac) and VirtualBox. VMware Workstation (Windows/Linux) has this feature but comes with a price tag of $189 currently. Oracle stopped licensing VMware Workstation around version 5.5 (current is 7.1) so my experience is a bit outdated but in 5.5 Port Forwarding was a bit complicated to setup. Not exactly intuitive, not the first time anyway.

The Port Forwarding button opens the dialog below and I would say that this is pretty intuitive, correct?

The name column is just for information purposes, you can write whatever you want or leave the default value which is Rule1, Rule2 etc. Protocol is a dropdown and it's either TCP or UDP. Host and Guest IP can be left blank (VBox knows both already). Left to configure is what port in the guest that should be exposed on the host.

With port forwarding configured any service running in the guest can be reached via the host's IP and Port. As an example using the ports above you can connect with ftp from the host to the ftp server inside the guest with ftp://localhost:8021/. If someone on the same network wants to access the ftp server in the guest on your host they would simple replace localhost with the actual IP of your host. They don't need any info about the guest IP. They don't even need to know that this is a VM running on your laptop/desktop.

All the details here: http://www.virtualbox.org/manual/ch06.html#natforward

This is totally transparent to the host and the guest in most cases. One case where you need to do a little bit of configuration inside the guest is if you run a WLS instance and want to deploy to it from a JDev (or any other tool) running on the host or remote. The WLS instance inside the guest needs to know the real IP of the host for this to work. There is a such a setting in the Advanced Section on the WLS Server Console, External Listen Address. Map this to the real IP of host and everything should work just fine.

Navigate to the WLS Console for the AdminServer and click on the Advanced link and the settings shown above will appear.

Remote Access

There are several ways to access a guest both when you're local on the host or if you want to access your guest remotely or give someone else remote access to a guest that runs on your laptop/desktop. You can configure VNC inside the guest or enable Remote Desktop if it's Windows. You can install tools like NX from nomachine.com or Teamviewer from teamviewer.com inside the guest. Assuming we still run NAT you will need to configure Port Forwarding for any solution that runs as a process inside the guest, even pure command line tools like telnet and ssh. But there is a better alternative. Install nothing! Take a look at the dialog below. It shows the Display Settings for one of my guest. VirtualBox has a built-in Remote Display feature and it's better than anything VMware or Parallels have if you ask me.

Remote Display exposes the Console output of the guest using RDP. This means that you can access your linux guest VM's desktop remotely (or locally from the host) using Windows Remote Desktop (or any RDP client on Mac or Linux) and dynamically resize the remote window. you can also copy and paste text (this might behave a little different depending on the guest OS). Since it's the Console you have access to and the Remote Display Server is hosted by VBox and not the guest OS it will also stay connected during a reboot so you can see the usual Console output as if you had local access. As you can see from the dialog you can also share this Remote Display with multiple users. This Remote Display access has no connection to what type of Network your guest is using, NAT, Bridged, Host-only or even no networking. You can always enable the Remote Display.

I'll stop here for now but I will return with more on Virtualization. Both regarding VirtualBox and OVM.

/Mikael

 

 

Using a Web Proxy Server with WebCenter Family

The use of a Web Tier is always recommended in a production environment, for security, performance and better control and load management, no matter if is a Intranet, internet or extranet environment.

The most common use for the Web Tier with WebCenter is acting as Reverse Proxy to forward all requests to a frontend WebCenter site to the application server (Figure A), but there’s to many ways to do an enterprise deployment with a web tier and many flavors of web servers and load balancing options.

Let’s start with the WebLogic plugin with supported webservers. You can found the standard plugins in your WebLogic instalation dir, that will something like “%WEBLOGIC_HOME%/server/plugin/%OS%/”, but I recommend you to download the latest plugin from Oracle’s OTN or eDelivery websites, you will found the Oracle WebLogic Server Web Server Plugins 1.1 or later. With the version 1.1 you will found plugins for Apache 2.2.x (32-Bits and 64-Bits) and for IIS 6+ and IIS 7+. Always confirm the OS support with the WLS Plugin Support Matrix. If you need support for iPlanet 6+ or 7+, you can use the version 1.0. Any throuble to found the files, try search or create to the Oracle support (Ref.: Doc ID 1111903.1).

Some times you do not want to use a separate web server, you can use the WebLogic as a Web Server by using a servlet, but this is subject for another post.

When you are deploying a WebCenter solution using a proxy server, you need to remember to proxy all your requests from all weblogics for Security, performance and Control and also all non-weblogic requests such as static files, WebCenter Content custom requests, Services, Portlets and 3rd Party.

Is common in intranet deployments you see calls direct to the application servers, calls to several different servers, like the Figure C.

Above you can see the same sample with all calls using the web server, for proxy forward, for reverse proxy, static files caching, even the use of Oracle Coherence is easy when you have a WebCenter Spaces + Content deployment.

We cannot forget to talk about the clustering and load balancers, Clustering is easy done by the WebLogic, you just need to follow the documentation. For Load balancing you need to choose what kind and what load balancer you will use.

LOAD BALANCING

You can do load balancing using the Web Proxy Server with WLS Plugin or a servlet as mentioned above or a External Load Balancer (Hardware) or Appliance.

Using the WLS Plugin you will need to remember to create a entry for WebCenter Server that are you using, that means that you need to create a entry for the /webcenter/ another for the /cs/, another for the “custom sitestudio” calls, for the portlets (If you do not create a parent folder for the portlets, you will need to create a entry for each portlet) and an entry for any other 3rd calls.

The configuration file for each entry will looks like this sample for IIS7:

# Changed by Oracle A-Team (Adao.Junior)
# Date: 07/31/2011
# WebCenter Content: CUSTOMER_WEB_SERVER
# WLSPlugin1.1-IIS6-IIS7-win64-x64
WebLogicCluster=192.168.100.101:8888,192.168.100.102:8888,192.168.100.101:8891,192.168.100.102:8891
ConnectTimeoutSecs=25
ConnectRetrySecs=5
KeepAliveEnabled=true
FileCaching=ON
SecureProxy=OFF
Debug=OFF
WLTempDir=C:\DEBUG\CONTENT

For a External Load Balancer (Hardware) you have many options, such as the f5 Big-IP, a guide to help you deploy with WebCenter could be found here.

There’s a option to use a hybrid configuration, with Hardware loadbalancers and Web Proxy to handle the web calls between the users and web farms, and web proxies and between the proxies and applications servers.

Improving WebCenter Performance – Part 1 (IIS Addendum)

If you read my previous post you might be wondering if you can achieve a similar performance with a different Web Server such as Microsoft Information Server. In this article I’ll describe the steps you need to follow to have IIS not only applying content compression, but also rewriting the expiration data in the HTTP header.

STEPS

1. Open the Internet Information Services Manager, right-click on the Default Web Site option and select Properties.



2. The window below should show up. Check the “Expire after” option and set it to 1,193 Hour(s). It will change the HTTP header Cache-control parameter from Expire to max-age in all local static resources, which solves the Internet Explorer caching issue.



3. Click on the MIME Types button and add the following ones:



4. Select the ISAPI Filters tab and check where the WebLogic ISAPI plug-in (wlFilter) is installed. The plug-in allows a smooth integration of WebLogic's HTTP functionality into Microsoft IIS.



Under the iisforward.dll’s directory you should find iisproxy.ini. Open the ini file and add the FileCaching=ON property as shown below. It will add another level of buffer to IIS and force it to add Content-Length property to the HTTP Header.

WebLogicHost=<WebCenter / Load Balancer host> 
WebLogicPort=<WebCenter / Load Balancer port> 
ConnectTimeoutSecs=20 
ConnectRetrySecs=2 
WlForwardPath=/webcenter,/rest 
Debug=OFF 
FileCaching=ON 

5. Make sure content compression is still setup. Right-click on Web Sites and choose properties.



Select the Service tab. The “Compress static files” option must be checked.




Don’t forget to restart IIS after the changes.

Setting up Task List portlets in WebCenter

The Task List is a standard JSR-168 portlet that allows you to check the ToDo tasks and take actions on those. Since the task list is a WSRP portlet producer application, it must be deployed on a managed server configured as a portlet container, such as WC_Portlet.
The objective of this post is to have a Cookbook format. The same steps can be found in Oracle’s documentation, except for some caveats and  images that should smooth the process.

Steps

The picture above describes the deployment architecture as well as some basic interaction between the involved managed servers. Please notices that we have two different domains in the picture.

Deploying Task List Portlet
1. Because the task list portlet producer application uses the deployed library oracle.soa.workflow.wc, you must confirm that the library is targeted to the Oracle WebLogic Server portlet managed server.

a. Log in to Oracle WebLogic Server Administration Console.
b. Go to Deployments > oracle.soa.workflow.wc >Targets.
c. See if WLS_Portlet is checked. If not, check it and save your updates.

2. In WebCenter PS3 there’s a shared lib issue. You also need to deploy rules.jar as a shared library in WC_Portlet. You can find rules.jar under <JDEV_INSTALL>/jdeveloper/soa/modules/oracle.rules_11.1.1/rules.jar.

3. Deploy the TaskListPortlet.ear file WC_Portlet.

a. You can find it under /Oracle_Home/SOA_Home/soa/applications/TaskListPortlet.ear.
b. Ensure that the WSRP producer application is running by accessing the WSDL from a web browser http://server:port/TaskListPortlet/portlets/wsrp2?WSDL.

Connecting Task List Producer to SOA Server

The next step is to configure the remote JNDI providers on WebCenter. As mentioned before, the task list portlet bring the info from SOA server through remote EJB calls.

1. Log in to WLS Console and navigate to Domain Structure > Services > Foreign JNDI Providers.

a. Click New. In the Name field, enter ForeignJNDIProvider-SOA, target it to WC_Portlet, and click OK.
b. Click the ForeignJNDIProvider-SOA link and enter the values in the table below.

Initial Context Factory	weblogic.jndi.WLInitialContextFactory
Provider URL	t3://[soa_hostname]:[port]/soa-infra
User	weblogic
Password	Enter weblogic password.
Confirm Password	Password confirmation.

2. Click the Links tab. Under Foreign JNDI Links, click New. Now enter the same values on the table below to Name, Local JNDI Name, and Remote JNDI Name.

RuntimeConfigService

ejb/bpel/services/workflow/TaskServiceBean

ejb/bpel/services/workflow/TaskMetadataServiceBean

TaskReportServiceBean

TaskEvidenceServiceBean

TaskQueryService

UserMetadataService

 

Configuring EJB Identity Propagation

We’ll start by enabling global trust. Log in to the WLS Adm Console for WebCenter.

On the left side of the page, click on Domain > Security > Advanced and modify the domain credentials.



Log in to the SOA server Admin Console and modify the domain credentials to the same password as entered for WebCenter.
Regarding application authorization, the same user logged-in to the Spaces application must be present in the Porlet and SOA identity stores, or the three servers could point to the same identity store. For this post we have OID setup as the common identity store. For more info please see Oracle doc.

Securing the Task List Portlet Producer Application Using Web Services Security

We’ll start by enabling WS-Security for the task list portlet producer application.
1. Open Oracle Enterprise Manager.

2. In the navigator on the left side, select Farm_wc_domain > WebLogic Domain.

3. Right-click wc_domain and select Security > Security Provider Configuration.

4. Access the Keystore section at the bottom of the provider configuration page and click Configure.

a. Let’s generate the keystore.
keytool -genkeypair -keyalg RSA -alias orakey -keypass welcome1 -keystore default-keystore.jks -storepass welcome1 -validity 3600

b. Copy default-keystore.jks file to WEBCENTER_DOMAIN/config/fmwconfig.

c. Enter the details for keystore management and identity certificates as shown below.

d. Click OK.

e. Restart WC_Portlet and AdminServer in the WebCenter domain.

f. Follow the same steps starting at b, but now for the SOA domain. To make your life easier we’ll use the same default-keystores.jks file, which means that you don’t need to run the keytool command again.

Specifying the Inbound Security Policy

1. Open Oracle Enterprise Manager.

2. Right-click Application Deployments > TaskListPortlet (WC_Portlet).



3. Select Web Services.

4. Click on WSRP_v2_Markup_Service.


5. Attach oracle/wss10_saml_token_with_message_protection_service_policy.



6. Click OK.

7. Restart WC_Portlet.


Consuming Task List Portlet from WebCenter Spaces

1. Right-click Farm_wc_domain > WebCenter > WebCenter Spaces > webcenter. Select Settings > Service Configuration.



2. Register a new portlet producer with the following information.



3. Once the portlet producer is successfully register, open WebCenter Spaces and drop the portlet into any page. That’s how it should look like.



You can double check your task list content by logging in into Business Process Workspace with the same user, obviously. You should see the same tasks.

Running Human Task in the Integrated WLS

If you are currently developing a Human Task you might have wasted some time testing and redeploying your application many times. You also might have been remote debugging it, which takes quite some time due to the unresponsiveness of your remote WLS.
The steps I describe below will make your BPM Workspace application point to the Human Task running inside the Integrated WLS in JDeveloper, which means that for any changes done in the UI layer you will only need to refresh the browser to see it or rebuild a Java class to get it reflected on the business layer. Kudos go to the BPM Product Management team that has put this ant script together, I’m just making the setup process more clear.

Setup

1. Open $JDEV_DOMAIN_HOME/config/fmwconfig/system-jazn-data.xml and add  the following grant for BPM. $JDEV_DOMAIN_HOME is usually located under C:\Users\<username>\AppData\Roaming\JDeveloper\system11.1.1.4.37.59.23\DefaultDomain. C:\Oracle\Middleware is where JDeveloper is installed ($JDEV_HOME).

   1: <grant>

   2:     <grantee>

   3:         <codesource>

   4:             <url>file:C:\\Oracle\\Middleware\\jdeveloper\\soa\\modules\\oracle.soa.workflow_11.1.1\\-</url>

   5:         </codesource>

   6:     </grantee>

   7:     <permissions>

   8:         <permission>

   9:             <class>oracle.security.jps.JpsPermission</class>

  10:             <name>VerificationService.createInternalWorkflowContext</name>

  11:         </permission>

  12:         <permission>

  13:             <class>oracle.security.jps.service.policystore.PolicyStoreAccessPermission</class>

  14:             <name>context=APPLICATION, name=*</name>

  15:             <actions>getApplicationPolicy</actions>

  16:         </permission>

  17:         <permission>

  18:             <class>oracle.security.jps.service.policystore.PolicyStoreAccessPermission</class>

  19:             <name>context=SYSTEM, name=*</name>

  20:             <actions>getConfiguredApplications</actions>

  21:         </permission>

  22:         <permission>

  23:             <class>oracle.security.jps.service.policystore.PolicyStoreAccessPermission</class>

  24:             <name>context=SYSTEM, name=*</name>

  25:             <actions>getSystemPolicy</actions>

  26:         </permission>

  27:         <permission>

  28:             <class>oracle.security.jps.service.credstore.CredentialAccessPermission</class>

  29:             <name>context=SYSTEM, mapName=BPM-SERVICES, keyName=BPM-SERVICES</name>

  30:             <actions>read</actions>

  31:         </permission>

  32:         <permission>

  33:             <class>oracle.security.jps.service.credstore.CredentialAccessPermission</class>

  34:             <name>context=SYSTEM, mapName=BPM-CRYPTO, keyName=BPM-CRYPTO</name>

  35:             <actions>read,write</actions>

  36:         </permission>

  37:         <permission>

  38:             <class>oracle.security.jps.JpsPermission</class>

  39:             <name>IdentityAssertion</name>

  40:             <actions>*</actions>

  41:         </permission>

  42:     </permissions>

  43: </grant>

2. Start your embedded WLS instance.



3. Download and unzip bpm-jdev.zip. Open build.properties and set the properties shown below appropriately.



4. Run ant.

5. Now we’ll check if the Human Task is pointing to the machine that hosts JDeveloper. Go to Enterprise Manager in your SOA domain and select the corresponding BPM process.



6. Click on the Human Task, in my case, CreateOrder.

 

7. Under the Administration tab you should see the Human Task pointing to JDeveloper’s machine.

Running

1. Expand the Human Task project in JDeveloper, right click in the bounded task flow that references the Human Task form, and click either Run or Debug.



2. It will start JDev’s Integrated WLS and deploy the human task to the server

3. Open BPM Workspace application.

a. Create a new composite by clicking in process name under Applications.



b.Check if the address bar in the popup windows points to your Integrated WLS.