<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<body link="#355491" alink="#4262a1" vlink="#355491" style="background: #e2e2e2; margin: 0; padding: 20px;">
<div>
<table cellpadding="0" bgcolor="#FFFFFF" border="0" cellspacing="0" style="border: 1px solid #dadada; margin-bottom: 30px; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td>
<table border="0" cellpadding="0" cellspacing="0" bgcolor="#FFFFFF" style="border: solid 2px #ccc; background: #dadada; width: 100%; -moz-border-radius: 6px; -webkit-border-radius: 6px;">
<tbody>
<tr>
<td bgcolor="#000000" valign="middle" height="58px" style="border-bottom: 1px solid #ccc; padding: 20px; -moz-border-radius-topleft: 3px; -moz-border-radius-topright: 3px; -webkit-border-top-right-radius: 5px; -webkit-border-top-left-radius: 5px;">
<h1 style="color: #333333; font: bold 22px Arial, Helvetica, sans-serif; margin: 0; display: block !important;">
<!-- To have a header image/logo replace the name below with your img tag -->
<!-- Email clients will render the images when the message is read so any image -->
<!-- must be made available on a public server, so that all recipients can load the image. -->
<a href="http://community.jboss.org/index.jspa" style="text-decoration: none; color: #E1E1E1">Community</a></h1>
</td>
</tr>
<tr>
<td bgcolor="#FFFFFF" style="font: normal 12px Arial, Helvetica, sans-serif; color:#333333; padding: 20px; -moz-border-radius-bottomleft: 4px; -moz-border-radius-bottomright: 4px; -webkit-border-bottom-right-radius: 5px; -webkit-border-bottom-left-radius: 5px;"><h3 style="margin: 10px 0 5px; font-size: 17px; font-weight: normal;">
JBOSS 5.1.0GA + EJB/JNDI over HTTPS
</h3>
<span style="margin-bottom: 10px;">
reply from <a href="http://community.jboss.org/people/crussell42">Chris Russell</a> in <i>JBoss Remoting</i> - <a href="http://community.jboss.org/message/547833#547833">View the full discussion</a>
</span>
<hr style="margin: 20px 0; border: none; background-color: #dadada; height: 1px;">
<div class="jive-rendered-content"><p>As per <a class="jive-link-message-small" href="http://community.jboss.org/message/518953#518953">http://community.jboss.org/message/518953#518953</a></p><p>And  <a class="jive-link-wiki-small" href="http://community.jboss.org/docs/DOC-13276">http://community.jboss.org/wiki/EJB3overHTTPHTTPSinJBossAS-5</a></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min- padding: 0px;">I am able to make it work in both 5.0.1GA and 5.0.0EAP and 5.0.1SOA.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min- padding: 0px;">I use iptables to block everything except 8443 then use wire shark and all communication takes place over 8443.</p><p style="min- padding: 0px;">I have only every used the @RemoteBinding method however not the xml config file.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min- padding: 0px;">Here is the abreviated config and code</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min- padding: 0px;"><strong>The bean</strong></p><p style="min- padding: 0px;"><strong>{code}<br/></strong></p><p style="min- padding: 0px;"><span>@RemoteBinding(clientBindUrl = "</span><a class="jive-link-external-small" href="https://10.0.0.75:8443/servlet-invoker/SSLServerInvokerServlet/?timeout=300000&invokerDestructionDelay=300000" target="_blank">https://10.0.0.75:8443/servlet-invoker/SSLServerInvokerServlet/?timeout=300000&invokerDestructionDelay=300000</a><span>")</span><br/>public class AgencyManagerProxyBean implements AgencyManagerProxyRemote, AgencyManagerProxyLocal {</p><p style="min- padding: 0px;">{code}</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min- padding: 0px;"><strong>The thick client connection part looks like this</strong></p><p style="min- padding: 0px;">{code}</p><p style="min- padding: 0px;">     securityClient = SecurityClientFactory.getSecurityClient();        <br/>        securityClient.setVmwideAssociation(true);</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>        boolean loggedIn=false;<br/>        int tryCount=0;<br/>        while (!loggedIn) {<br/>        try {<br/>            tryCount++;<br/>        <br/>            // Ask for username and password this sets AgencyManagerPrefs values        <br/>            new LoginDialog(agencyManagerFrame);<br/>            <br/>            <br/>            //The username and password were set in the LoginDialog<br/>            String username = AgencyManagerPrefs.getProperty(AgencyManagerConstants.USERNAME_KEY);<br/>            String password = AgencyManagerPrefs.getProperty(AgencyManagerConstants.PASSWORD_KEY);  <br/>            //NOTE all this does is set some variables no actual login occurs<br/>            //that happens in the jndi lookup and initial ejb invocation level.<br/>            securityClient.setSimple(username, password);        <br/>            securityClient.login();         <br/>            logger.info("SecurityClient data set");<br/>            <br/>            <br/>            Properties props = new Properties();<br/>            props.put("java.naming.factory.initial", "org.jboss.naming.HttpNamingContextFactory");</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span>            String providerUrl = "</span><a class="jive-link-external-small" href="https://" target="_blank">https://</a><span>"+AgencyManagerPrefs.getProperty(AgencyManagerConstants.AMPROXY_HOST_KEY)+":8443/invoker/JNDIFactory";</span><br/>            <br/>            props.put("java.naming.provider.url", providerUrl);<br/>            <br/>            //JBOSS claims we need this rather than security client.<br/>            props.put(Context.SECURITY_PRINCIPAL, username);<br/>            props.put(Context.SECURITY_CREDENTIALS, password);</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>            props.put("java.naming.factory.url.pkgs", "org.jboss.naming");</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>            Context ctx = new InitialContext(props);<br/>            <br/>            logger.info("Created context");<br/>            logger.info(ctx);<br/>            //logger.info(props);<br/>            logger.info("End Created context");<br/>            <br/>            logger.info("Lookup amproxyservice");        <br/>            AgencyManagerProxyInterface bean = (AgencyManagerProxyInterface) ctx.lookup("sec-amproxyservice/AgencyManagerProxyBean/remote");<br/>            logger.info("Got reference to bean");</p><p style="min- padding: 0px;">{code}</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min- padding: 0px;"><strong>The jboss 5.1 ga, 5.0eap, 5.0.1soa config changes</strong></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p style="min- padding: 0px;">== Open the SSL socket ==<br/>{noformat}<br/>edit server/default/deploy/jbossweb.sar/server.xml<br/>uncomment section "SSL/TLS Connector" to enable Connector port="8443"<br/>replace keystoreFile="${jboss.server.home.dir}/conf/chap8.keystore" with  your keystore name<br/>replace keystorePass="rmi+ssl" sslProtocol = "TLS" /> with keystorePass="<your new secure password>" sslProtocol = "TLS" /><br/>{noformat}</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>== Expose JNDI Naming service via HTTPS ==<br/>Edit /opt/java/jboss/server/default/deploy/http-invoker.sar/META-INF/jboss-service.xml<br/>It needs to contain the following 2 entries. '''NOTE''' the http one below is commented out and should replace<br/>the '''matching un-commented''' one that is in the file by default.</p><p>{code:xml}</p><p><pre><br/>   <!-- Expose the Naming service interface via HTTP <br/>   <mbean code="org.jboss.invocation.http.server.HttpProxyFactory"<br/>      name="jboss:service=invoker,type=http,target=Naming"><br/>      <attribute name="InvokerName">jboss:service=Naming</attribute><br/><span>      <attribute name="InvokerURLPrefix"></span><a class="jive-link-external-small" href="http://" target="_blank">http://</a><span></attribute></span><br/>      <attribute name="InvokerURLSuffix"><br/>        <value-factory bean="ServiceBindingManager" method="getStringBinding"><br/>           <parameter>jboss.web:service=WebServer</parameter><br/>           <parameter>:${port}/invoker/JMXInvokerServlet</parameter><br/>        </value-factory><br/>      </attribute><br/>      <attribute name="UseHostName">true</attribute><br/>      <attribute name="ExportedInterface">org.jnp.interfaces.Naming</attribute><br/>      <attribute name="JndiName"></attribute><br/>      <attribute name="ClientInterceptors"><br/>          <interceptors><br/>             <interceptor>org.jboss.proxy.ClientMethodInterceptor</interceptor><br/>             <interceptor>org.jboss.proxy.SecurityInterceptor</interceptor><br/>             <interceptor>org.jboss.naming.interceptors.ExceptionInterceptor</interceptor><br/>             <interceptor>org.jboss.invocation.InvokerInterceptor</interceptor><br/>          </interceptors><br/>      </attribute><br/>   </mbean><br/>   --></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>   <!-- Expose the Naming service interface via HTTPS --><br/>   <mbean code="org.jboss.invocation.http.server.HttpProxyFactory"<br/>      name="jboss:service=invoker,type=http,target=Naming"><br/>      <attribute name="InvokerName">jboss:service=Naming</attribute><br/><span>      <attribute name="InvokerURLPrefix"></span><a class="jive-link-external-small" href="https://" target="_blank">https://</a><span></attribute></span><br/>      <attribute name="InvokerURLSuffix">:8443/invoker/JMXInvokerServlet</attribute><br/>      <attribute name="UseHostName">true</attribute><br/>      <attribute name="ExportedInterface">org.jnp.interfaces.Naming</attribute><br/>      <attribute name="JndiName"></attribute><br/>      <attribute name="ClientInterceptors"><br/>          <interceptors><br/>             <interceptor>org.jboss.proxy.ClientMethodInterceptor</interceptor><br/>             <interceptor>org.jboss.proxy.SecurityInterceptor</interceptor><br/>             <interceptor>org.jboss.naming.interceptors.ExceptionInterceptor</interceptor><br/>             <interceptor>org.jboss.invocation.InvokerInterceptor</interceptor><br/>          </interceptors><br/>      </attribute><br/>   </mbean></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p></pre></p><p>{code:xml}</p><p><br/>== Add the Servlet Invoker ==<br/>This will add the servlet invoker that allows us to do https jndi lookups and ejb invocations from clients over https.<br/>{noformat}<br/>$ cd /opt/java/jboss/server/default/deploy<br/>{noformat}<br/>Then create a file servlet-invoker-service.xml and a directory and file servlet-invoker.war/WEB-INF/web.xml<br/>The contents of these are as follows<br/>'''servlet-invoker-service.xml'''</p><p>{code:xml}</p><p><pre><br/><?xml version="1.0" encoding="UTF-8"?><br/><!DOCTYPE web-app PUBLIC<br/>   "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"<br/><span>   "</span><a class="jive-link-external-small" href="http://java.sun.com/dtd/web-app_2_3.dtd" target="_blank">http://java.sun.com/dtd/web-app_2_3.dtd</a><span>"></span><br/><web-app><br/>    <servlet><br/>        <servlet-name>ServerInvokerServlet</servlet-name><br/>        <description>The ServerInvokerServlet receives requests via HTTP<br/>           protocol from within a web container and passes it onto the<br/>           ServletServerInvoker for processing.<br/>        </description><br/>        <servlet-class>org.jboss.remoting.transport.servlet.web.ServerInvokerServlet</servlet-class><br/>        <init-param><br/>            <param-name>locatorUrl</param-name><br/>            <param-value>servlet://${jboss.bind.address}:8080/servlet-invoker/ServerInvokerServlet</param-value><br/>            <description>The servlet server invoker</description><br/>        </init-param><br/>        <load-on-startup>1</load-on-startup><br/>    </servlet></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>    <servlet><br/>        <servlet-name>SSLServerInvokerServlet</servlet-name><br/>        <description>The ServerInvokerServlet receives requests via HTTPS<br/>           protocol from within a web container and passes it onto the<br/>           ServletServerInvoker for processing.<br/>        </description><br/>        <servlet-class>org.jboss.remoting.transport.servlet.web.ServerInvokerServlet</servlet-class>      <br/>        <init-param><br/>            <param-name>locatorUrl</param-name><br/>            <param-value>sslservlet://${jboss.bind.address}:8443/servlet-invoker/SSLServerInvokerServlet</param-value><br/>            <description>The servlet server invoker</description><br/>        </init-param><br/>        <load-on-startup>2</load-on-startup><br/>    </servlet><br/>   <br/>    <servlet-mapping><br/>        <servlet-name>ServerInvokerServlet</servlet-name><br/>        <url-pattern>/ServerInvokerServlet/*</url-pattern><br/>    </servlet-mapping></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>    <servlet-mapping><br/>        <servlet-name>SSLServerInvokerServlet</servlet-name><br/>        <url-pattern>/SSLServerInvokerServlet/*</url-pattern><br/>    </servlet-mapping><br/>   <br/></web-app><br/>{code:xml}</p><p><br/><strong>'''servlet-invoker.war/WEB-INF/web.xml'''</strong></p><p>{code:xml}<br/><?xml version="1.0" encoding="UTF-8"?><br/><server><br/>  <mbean code="org.jboss.remoting.transport.Connector" name="jboss.remoting:service=connector,transport=servlet"<br/>    display-name="Servlet transport Connector"><br/>    <attribute name="InvokerLocator">servlet://${jboss.bind.address}:8080/servlet-invoker/ServerInvokerServlet</attribute><br/>    <attribute name="Configuration"><br/>      <handlers><br/>        <handler subsystem="AOP">org.jboss.aspects.remoting.AOPRemotingInvocationHandler</handler><br/>      </handlers><br/>    </attribute><br/>  </mbean></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>  <mbean code="org.jboss.remoting.transport.Connector" name="jboss.remoting:service=connector,transport=sslservlet"<br/>    display-name="Servlet transport Connector"><br/>    <attribute name="InvokerLocator">sslservlet://${jboss.bind.address}:8443/servlet-invoker/SSLServerInvokerServlet</attribute><br/>    <attribute name="Configuration"><br/>      <handlers><br/>        <handler subsystem="AOP">org.jboss.aspects.remoting.AOPRemotingInvocationHandler</handler><br/>      </handlers><br/>    </attribute><br/>  </mbean> <br/></server></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>{code:xml}</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>== FIX EAP 5.0==<br/>If you dont do this clients will get the dreaded<br/>Caused by: java.net.ProtocolException: Server redirected too many  times (20)</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p><span>As per [</span><a class="jive-link-external-small" href="http://community.jboss.org/thread/146840" target="_blank">http://community.jboss.org/thread/146840</a><span> Jira CR created]</span></p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>So to fix this particular issue I edited</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>'''server/default/deploy/http-invoker.sar/invoker.war/WEB-INF/web.xml'''</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>And commented out the url-pattern stuff at the bottom.</p><p style="min-height: 8pt; height: 8pt; padding: 0px;"> </p><p>Note I did try just setting the roles.properties to have my user have a HttpInvoker role but that did not work.<br/>{code:xml}<br/>   <!-- An example security constraint that restricts access to the HTTP invoker<br/>   to users with the role HttpInvoker Edit the roles to what you want and<br/>   configure the WEB-INF/jboss-web.xml/security-domain element to reference<br/>   the security domain you want.<br/>   --><br/>   <security-constraint><br/>      <web-resource-collection><br/>         <web-resource-name>HttpInvokers</web-resource-name><br/>         <description>An example security config that only allows users with the<br/>            role HttpInvoker to access the HTTP invoker servlets<br/>         </description><br/>         <url-pattern>/restricted/*</url-pattern><br/>     <!-- COMMENT OUT THIS AND 5.0 EAP works.<br/>         <url-pattern>/JNDIFactory/*</url-pattern><br/>         <url-pattern>/EJBInvokerServlet/*</url-pattern><br/>         <url-pattern>/JMXInvokerServlet/*</url-pattern><br/>     --><br/>         <http-method>GET</http-method><br/>         <http-method>POST</http-method><br/>      </web-resource-collection><br/>      <auth-constraint><br/>         <role-name>HttpInvoker</role-name><br/>      </auth-constraint><br/>   </security-constraint><br/></pre></p><p style="min- padding: 0px;">{code:xml}</p></div>
<div style="background-color: #f4f4f4; padding: 10px; margin-top: 20px;">
<p style="margin: 0;">Reply to this message by <a href="http://community.jboss.org/message/547833#547833">going to Community</a></p>
<p style="margin: 0;">Start a new discussion in JBoss Remoting at <a href="http://community.jboss.org/choose-container!input.jspa?contentType=1&containerType=14&container=2050">Community</a></p>
</div></td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</body>
</html>