Se#ng Up the Oracle APEX Listener (Now ORDS) for ProducAon Environments. Dietmar Aust Opal- ConsulAng, Köln consulang.de

Transcription

1 Se#ng Up the Oracle APEX Listener (Now ORDS) for ProducAon Dietmar Aust Opal- ConsulAng, Köln consulang.de

2 Opal ConsulAng Dipl.- Inform. Dietmar Aust, Freelance Consultant Master's Degree in Computer Science (MSCS) Building Oracle based Web ApplicaAons since 1997 Portal, Forms, Reports, OWA Toolkit, now APEX! : Consultant at Oracle Germany Since 09/2000: Freelance Consultant, Since 2006 APEX only! Blog: h_p://daust.blogspot.com/ Regular presenter at Oracle conferences (ODTUG, DOAG, OOW) Author of the JasperReportsIntegraAon toolkit h_p:// consulang.de/tools Page 2

3 Why And What? Page 3

4 Why And What? WHY? Infrastructure for Oracle APEX produc,on environments o4en poorly configured: SAll use the embedded PL/SQL gateway ORDS connecaon pool not properly configured People find it hard to implement the recommended setup with an Apache h_p server and ORDS, because it seems to be complicated My personal interest: Want to have a step- by- step guide to implement the recommended architecture Want to have a presentaaon to educate my clients regarding the architecture and the best setup Page 4

5 Why And What? WHAT? Set up a produc,on environment for our Oracle APEX instance. CharacterisAcs Fits 80% of deployments Intranet usage mainly Basic security measures and good performance The proposed setup is flexible and can be extended in order to saasfy more elaborate requirements for higher security and even be_er performance Page 5

6 Agenda Page 6

7 Agenda Understanding the Architecture InstallaAon Ords Standalone, Tomcat 8 only, Apache h_p server in front of Tomcat OpAmizaAons Caching, enforcing SSL, URL rewriang Use Cases Password change db user, database server change Monitoring Performance and errors Advanced ConfiguraAons SSO, REST style URLs with APEX Page 7

8 Understanding the Architecture Page 8

9 Understanding the Architecture Overview and Components http http JDBC Oracle https AJP SQLNet Browser Webserver PL/SQL Gateway Oracle DB Serve static files SSL termination Cache / Proxy Compression... Translate URL /ords/f?p=100:1 => call to stored procedure APEX: Execute Logic & Generate HTML Apache Http Server, Nginx, IIS / Windows Apache Tomcat, Oracle XML DB ORDS mod_plsql dbms_epg... Oracle and higher Oracle XE 11g Page 9

10 Understanding the Architecture Consequences / Insights The WORK is done IN THE DATABASE The Webserver and PL/SQL gateway don t need a lot of processing power, most of the Ame idle Page 10

11 Understanding the Architecture Recommended Architecture The components in this presentaaon: Windows 7 32 bit (virtual machine) Apache 2.4 Tomcat 8 ORDS 3.0 Oracle XE 11g APEX https AJP ORDS 3.0 JDBC TNS Listener Oracle Apache http Server 2.4 Tomcat 8 ORDS 3.0 Oracle XE 11g APEX 5.0 Page 11

12 Understanding the Architecture Database Users APEX_PUBLIC_USER APEX / OWA main connecaon pool Size according to number of concurrent apex users OPTIONALLY installed when using REST services ORDS 2.0 APEX_LISTENER (with APEX ) Reads REST DefiniAons from repository APEX_ APEX_REST_PUBLIC_USER (with APEX ) REST ConnecAon pool for all REST operaaons Size according to concurent REST calls Users APEX_LISTENER and APEX_REST_PUBLIC_USER were created using the script apex_rest_config.sql as part of the APEX installaaon. Page 12

13 Understanding the Architecture Database Users ORDS 3.0 support RESTful Webservices even without APEX APEX_PUBLIC_USER APEX / OWA main connecaon pool Size according to number of concurrent apex users ORDS 3.0 ORDS_METADATA Stores REST DefiniAons ORDS_PUBLIC_USER REST ConnecAon pool for all REST operaaons Size according to concurent REST calls Currently there is sall the need for the users APEX_LISTENER and APEX_REST_PUBLIC_USER: The new download of staac applicaaon files and staac workspace files require it So that you can conanue to use the management interface in the SQL Workshop (else you have to use SQL Developer) Page 13

14 Understanding the Architecture Database Users Should we migrate the exisang RESTful definiaons in our APEX environment? =>!!! NO!!! What happens? They get copied over from APEX_ => ORDS_METADATA Now they exist in two places redundantly In this situaaon the definiaon stored in ORDS_METADATA wins over the definiaon stored in APEX Through the management interface in APEX you sall manage the OLD definiaon This is too confusing, thus: Keep the definiaons separate Either create new ones with SQL Dev directly or sall using the SQL Workshop in APEX Page 14

15 InstallaAon Page 15

16 InstallaAon Overview of the InstallaAon Layered Approach, step by step Configure ORDS in standalone mode, then TEST it Deploy ORDS to Tomcat, then TEST it Configure Apache h_p Server as a proxy to Tomcat, then TEST it Security and OpAmizaAons AssumpAons Apex_rest_config.sql already run, the users APEX_LISTENER and APEX_REST_PUBLIC_USER already exist in the database APEX 5.0 installed Page 16

17 InstallaAon ORDS 3.0 Download Download ORDS 3.0 h_p:// tools/rest- data- services/ downloads/index.html ords zip Install on the command line using java jar ords.war Help: java jar ords.war help Page 17

18 InstallaAon ORDS 3.0 Background ords.war is a J2EE applicaaon which can be deployed to Weblogic, Glassfish or Tomcat deployed into itself and run in standalone mode because it has a Je_y J2EE container embedded into the.war file => easy for tesang and development ORDS needs configuraaon files for the different connecaon pools and also config files for the standalone mode The command line installaaon will MODIFY the ords.war file and register a reference to the directory containing the config files updates a reference to the config directory IN the ords.war file Page 18

19 InstallaAon ORDS 3.0 Background ConfiguraAon Files defaults.xml All Common se#ngs and defaults for all connecaon pools ords/standalone/standalone.properaes Standalone mode configuraaon for Je_y (/i/ locaaon and port #) conf/apex.xml (APEX_PUBLIC_USER) conf/apex_al.xml (APEX_LISTENER) conf/apex_rt.xml (APEX_REST_PUBLIC_USER) conf/apex_pu.xml (ORDS_PUBLIC_USER) role- mapping.xml Maps Webserver Roles into RESTful Roles url- mapping.xml MulAple database configuraaons Page 19

20 InstallaAon ORDS 3.0 Background Axer the installaaon we must opamize the connecaon pool apex.xml (APEX_PUBLIC_USER, main connecaon pool) apex_al.xml (used for serving staac applicaaon and workspace files) not as high as the others apex_rt.xml (used for serving staac applicaaon and workspace files) A sample configuraaon: jdbc.iniaallimit=15 #sessions created in the connecaon pool at startup jdbc.maxlimit=50 max. number of concurrent sessions allowed jdbc.inacavitytimeout=1800 ConnecAon is not used for 1800 seconds => removed from pool jdbc.minlimit=15 Min. number of connecaons in pool, even if inacavitytimeout has passed Page 20

21 InstallaAon ORDS 3.0 Background OpAmizaAon is always difficult, monitoring the current usage, then trial and error Simple monitoring SELECT username, status, COUNT (*) cnt FROM v$session WHERE username LIKE '%APEX%' OR username LIKE '%ORDS%' GROUP BY username, status; Page 21

22 InstallaAon ORDS 3.0 Background If anything goes wrong during the installaaon - you can repeat the process, but you have to clean up the config files beforehand All config files in c:\app\ords_3.0\conf (including the subdirectories) ords_params.properties (the installer will remember our previous prompt and not ask again) Page 22

23 InstallaAon ORDS 3.0 Background When running ords.war we will install the users ORDS_METADATA and ORDS_PUBLIC_USER and you need SYSDBA privileges for that. Extract ords.war and send the installaaon scripts to the DBA (see ORDS installaaon guide) Directory: ords\scripts\install\core Script to execute as SYS: ords_manual_install.sql Page 23

24 InstallaAon Install ORDS 3.0 Create a directory to hold the ORDS configuraaon, i.e. the definiaon of the different connecaon pools mkdir c:\app\ords_3.0\conf Run the ords installer on the command line java - jar ords.war Enter the locaaon to store configuraaon data: c:\app\ords_3.0\conf StaAc image files for standalone mode: C:\downloads\apex_5.0\apex\images Configure the APEX Gateway Configure the APEX_LISTENER and APEX_REST_PUBLIC_USER Accounts Start in standalone mode Test: Page 24

25 InstallaAon Install ORDS 3.0 OpAmize the connecaon pool apex.xml Se#ngs: apex_al.xml apex_rt.xml jdbc.iniaallimit=15 jdbc.maxlimit=50 jdbc.minlimit=15 Restart ords.war standalone and test the configuraaon again (verify syntax in config file) : h_p://localhost:8080/ Now stop the standalone (in the next step we will install the tomcat on port 8080 and this would cause a port conflict)! Page 25

26 InstallaAon Install Tomcat 8 Download Apache Tomcat 8 for Windows 32bit Service installer h_p://tomcat.apache.org/download- 80.cgi apache- tomcat exe Install Apache Tomcat 8 as a service Page 26

27 InstallaAon Install Tomcat 8 Choose the defaults Page 27

28 InstallaAon Install Tomcat 8 Leave the defaults and provide a user for the administraaon via the web manager applicaaon Page 28

29 InstallaAon Install Tomcat 8 Choose a JRE, at least Java 7 is required Page 29

30 InstallaAon Install Tomcat 8 To the desanaaon folder we will refer to as TOMCAT_HOME Page 30

31 InstallaAon Install Tomcat 8 The service is iniaally created to be started manually: This has to be changed to have it start automaacally at system startup Test the installaaon using h_p://localhost:8080/ Page 31

32 InstallaAon Deploy the APEX images (/i/) to Tomcat 8 Deploy the APEX Images to Tomcat Copy apex\images => TOMCAT_HOME\webapps\ROOT Then rename the folder images to i Test the file locaaon using h_p://localhost/i/apex_version.txt Page 32

33 InstallaAon Deploy ords.war to Tomcat 8 Deploy ords.war to Tomcat Copy ords.war => TOMCAT_HOME\webapps The ords.war will be automaacally deployed and the directory ords is created Test the setup using h_p://localhost:8080/ords/ Now: Viable setup: Service starts up automaacally ConnecAon pool opamized Page 33

34 InstallaAon Apache 2.4 Apache h_p server (h_p://h_pd.apache.org) Easier to set up on Linux / Unix than on Windows, typically part of the Linux distribuaons Some syntax changes in 2.4: h_p://h_pd.apache.org/docs/trunk/upgrading.html h_ps:// your- apache- configuraaon- from to syntax Typically supports h_ps via ssl out of the box, comes with self signed ceraficates included for tesang / development purposes For producaon sites you should a signed ceraficate Fine for development and tesang environments Page 34

35 InstallaAon Install Apache 2.4 Download Apache h_p Server 2.4 h_p://h_pd.apache.org/docs/current/pla orm/windows.html#down h_p:// bin/download.plx Also download the MS Windows libraries (DLL) Page 35

36 InstallaAon Install Apache 2.4 Install the Microsox Visual C Redistributable vcredist_x86.exe Unzip the Apache folder and copy it to c:\apache24 => DEFAULT Apache installa,on completed! Page 36

37 InstallaAon Configure Apache 2.4 What is virtual hosang? Apache supports muaple different configuraaons depending on the name and / or port we talk to the Apache, basically running mulaple web sites on the same machine E.g. at the German Telecom used virtual hosts for different applicaaons (mulaple DNS entries for the same ip address): h_p://abit.telekom.de h_p://spots.telekom.de The setup for SSL / h_ps is also a virtual host Page 37

38 InstallaAon Configure Apache 2.4 Create a new config file for our APEX setup copy config file apex.conf to c:\apache24\conf\apex.conf Page 38

39 InstallaAon Configure Apache 2.4 Include this configuraaon in all RELEVANT virtual hosts APACHE_HOME\conf\extra\h_pd- vhosts.conf APACHE_HOME\conf\extra\ h_pd- ahssl.conf (specific to this distribuaon) Page 39

40 InstallaAon Configure Apache 2.4 Start Apache on the command line c:\apache24\bin\h_pd.exe Install Apache as a service c:\apache24\bin\h_pd - k install Start Apache Service net start "Apache2.4" Stop Apache Service net stop "Apache2.4 Test Apache h_p Server: h_p://localhost/ and h_ps://localhost/ Reload the server configuraaon (just graceful, no session is lost) c:\apache24\bin\h_pd.exe - k restart Page 40

41 InstallaAon Configure Apache 2.4 Limit Access to Tomcat to Apache via AJP protocol only Bind Tomcat to localhost ONLY, so that only Apache h_pd server is allowed to talk to it Modify TOMCAT_HOME\conf\server.xml: <Connector port="8080" protocol="http/1.1"... connecaontimeout="20000" redirectport="8443" /> address=" " <!- - Define an AJP 1.3 Connector on port > <Connector port="8009" protocol="ajp/1.3" redirectport="8443" address=" " /> Page 41

42 InstallaAon Configure Apache 2.4 Verify that caching works Firefox => built- in developer tools Safari => built- in developer tools The files are only requested ONCE for 8 hrs Verify that compression works Page 42

43 OperaAonal Use Cases Page 43

44 OperaAonal Use Cases Change connecaon pool UC#1: Password for APEX_PUBLIC_USER needs to be changed java jar ords.war setup apex Prompts for all database setup parameters again and UPDATES all config files, doesn t create them from scratch Page 44

45 OperaAonal Use Cases Change connecaon pool Axer the change we need to reload the new configuraaon in your Tomcat by either: 1. Restart the Tomcat service 2. touch the webapps\ords.war file Update the Amestamp, Tomcat will automaacally redeploy 3. use the Tomcat management interface to reload Page 45

46 OperaAonal Use Cases Change connecaon pool UC#2: Database was moved to a different machine Modify the config file conf\apex.xml directly and change the JDBC connect informaaon <entry key="db.hostname">localhost</entry> <entry key="db.password">@051acf4b824b6756ddc388ab8175</entry> <entry key="db.port">1521</entry> <entry key="db.sid">xe</entry> <entry key="db.username">apex_public_user</entry> Reload the new configuraaon in your Tomcat as described in UC#1 Page 46

47 Monitoring Page 47

48 Monitoring Errors / Logfiles Apache h_p server APACHE_HOME\logs error_log (errors) access_log (who accessed which file and what was the result (h_p return code (e.g. 404 not found or 200 ok) and the size Tomcat TOMCAT_HOME\logs catalina.log (includes messages from Tomcat itself but also all J2EE applicaaons, i.e. ORDS): Page 48

49 Monitoring Errors / Logfiles Je_y doesn t support AJP The proxy direcaves in the apex.conf won t work with Je_y in standalone mode, Je_y doesn t support AJP Account APEX_REST_PUBLIC_USER locked => Download of staac images don t work Look into the TOMCAT_HOME\logs\catalina.log file, there you will see errors like: 22- Jun :33: SEVERE [ajp- nio exec- 13] oracle.dbtools.common.config.db.databasepools.isvalid The pool named: apex_rt is not correctly configured, error: ORA : the account is locked All configured connecaon pools are also validated at startup when running the je_y in standalone mode => you will see it on the command line, too Page 49

50 Monitoring Errors / Logfiles In APEX we can see all errors due to unhandled excepaons: Page 50

51 Monitoring Performance APEX Monitoring using the APEX DicAonary Views SELECT application_id, page_id, COUNT (*) AS hits, COUNT (*) / 60 AS hits_pro_min, MIN (elapsed_time) AS MIN, AVG (elapsed_time) AS AVG, MAX (elapsed_time) AS MAX, AVG (elapsed_time) * COUNT (*) weight FROM apex_workspace_activity_log WHERE view_date > SYSDATE - 1 / 24 / 60 * 60 /* 1 hour */ GROUP BY application_id, page_id ORDER BY AVG (elapsed_time) * COUNT (*) /* weight */ desc Page 51

52 Monitoring Performance Use browser tools to understand performance issues All current browsers have integrated developer tools But there also add- ons like Firebug Page 52

53 Advanced ConfiguraAons Page 53

54 Advanced ConfiguraAons SSO with MS Windows SSO with Windows There are different ways to use SSO in our APEX applicaaons. We shouldn t use NTLM anymore since this is a really old protocol and not considered secure any more. Apache + mod_auth_kerb Kerberos authenacaaon with the Windows AcAve Directory h_p:// sign- on- for- apex- applicaaons- using- kerberos/ SSO with Internet InformaAon Server (IIS) Here we also do the naavely integrated NTLM or Kerberos authenacaaon which is built into the IIS. Then we use mod_ajp to proxy the requests to the Apache Tomcat and ORDS. Tomcat 8 + Kerberos/SPNEGO authenacator h_ps://community.oracle.com/message/ Page 54

55 Advanced ConfiguraAons REST- style URLs REST- style URLs for accessing your applicaaon, e.g. /home /customer /customer/edit/<id> h_p:// and- apex.com/human- readable- urls- in- oracle- apex- part- 2/ Page 55

56 APEX connect 2016: June 7-9th in Berlin Call for Paper is coming soon Check out apex.doag.org 5 6 The beauty and the beast: APEX & SAP.

57 Q&A Dietmar Aust Opal- ConsulAng, Köln consulang.de daust.blogspot.com consulang.de Page 57