ServletExec TM 4.1 User Guide for Microsoft Internet Information Server Netscape Enterprise Server iplanet Web Server and Apache HTTP Server
NEW ATLANTA COMMUNICATIONS, LLC ServletExec TM 4.1 User Guide September 14, 2001 Version 4.1 Copyright 1997-2001 New Atlanta Communications, LLC 100 Prospect Place Alpharetta, Georgia 30005-5445 Phone 678.366.3211 Fax 678.366.3210 http://www.newatlanta.com ServletExec is a trademark of New Atlanta Communications, LLC All other trademarks and registered trademarks herein are the property of their respective owners. This product includes software developed by the Apache Software Foundation (http://www.apache.org). No part of this document may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language or computer language, in any form or by any means, electronic, mechanical, magnetic, optical, chemical, manual, or otherwise without the prior written consent of New Atlanta Communications, LLC. New Atlanta Communications, LLC makes no representations or warranties with respect to the contents of this document and specifically disclaims any implied warranties of merchantability or fitness for any particular purpose. Further, New Atlanta Communications, LLC reserves the right to revise this document and to make changes from time to time in its content without being obligated to notify any person of such revisions or changes. The Software described in this document is furnished under a Software License Agreement ( SLA ). The Software may be used or copied only in accordance with the terms of the SLA. It is against the law to copy the Software on tape, disk, or any other medium for any purpose other than that described in the SLA. ServletExec 4.1 User Guide i
Contents 1. GETTING STARTED...1 1.1 SERVLET TERMINOLOGY...1 1.2 SERVLETEXEC PRODUCTS...1 1.3 STARTING SERVLETEXEC...2 1.3.1 ISAPI and NSAPI Products Only...2 1.3.1.1 Reinitializing ServletExec/ISAPI... 2 1.3.2 AS Product Only...3 1.4 VERIFYING YOUR SERVLETEXEC INSTALLATION...4 1.5 STARTING THE SERVLETEXEC ADMIN UI...5 1.6 LICENSING SERVLETEXEC...5 1.7 SETTING UP SERVLETEXEC ADMINISTRATORS...6 1.7.1 Setting the Admin Username and Password...6 1.7.2 Allowing Admin UI Access to Specific IPs...7 1.7.3 Requiring Secure Sockets Layer (SSL)...8 1.8 VIEWING LOGS...8 1.8.1 Logging Options...9 1.9 EXECUTING UNCONFIGURED SERVLETS...10 1.9.1 Sample/Unconfigured Servlets...10 1.9.2 Legacy Servlets That Don t Require Configuring...11 1.9.3 Web Application Servlets that Don t Require Configuring...11 1.9.4 Servlets with Multiple Class Files...11 1.9.4.1 Legacy servlet restrictions... 11 1.10 TECHNICAL SUPPORT...12 2. JAVA VIRTUAL MACHINE...13 2.1 VIEWING JAVA VM SETTINGS FOR SERVLETEXEC/ISAPI AND SERVLETEXEC/NSAPI...14 2.2 SELECTING AND CONFIGURING A JAVA VM...15 2.3 DEFINING THE CLASSPATH...15 2.4 SETTING JAVA VM OPTIONS...16 2.5 USING OPTIONAL PACKAGES...17 3. WEB APPLICATIONS...19 3.1 WEB APPLICATION OVERVIEW...19 3.1.1 Directories...19 3.1.1.1 WEB-INF directory... 20 3.1.2 Packaging...20 3.2 USING SERVLETEXEC S WEB APPLICATION ADMIN UI...20 3.3 RUNNING THE EXAMPLE WEB APPLICATION...21 3.4 DEPLOYING WEB APPLICATIONS...23 3.4.1 Creating a Web Application...23 3.4.2 Auto Deploying a Web Application...24 3.4.3 Installing a Web Application...25 3.4.4 Adding a Web Application...25 3.4.4.1 Using the root context path ( /)... 26 3.4.4.2 ServletExec Extensions... 26 3.4.4.3 Static File Caching... 27 3.4.4.4 Static Page Serving... 28 3.4.4.5 Configuring the ServletExec/AS Web Server Adapter (AS Only)... 28 3.4.5 Setting Up Roles, Users, and Role Mapping...29 3.4.5.1 Roles... 29 ServletExec 4.1 User Guide i
3.4.5.2 Users... 31 3.4.5.3 Role Mapping... 32 3.4.6 Editing the Web Application s web.xml Settings...33 3.4.6.1 Application... 34 3.4.6.2 Web Application Servlets... 41 3.4.6.3 Filters... 43 3.4.6.4 Security... 45 3.4.7 Reloading a Web Application...48 3.4.8 Removing a Web Application...48 4. LEGACY SERVLETS...50 4.1 ADDING SERVLETS...50 4.2 CONFIGURING SERVLETS...51 4.2.1 Servlets That Must Be Configured...52 4.2.2 Invoking Servlets...52 4.2.3 Servlet Directories...53 4.2.3.1 Servlets Directory Location... 54 4.2.3.2 Servlet Classes Location... 54 4.2.4 Remote Servlets...54 4.2.4.1 Restrictions on Remote Servlets... 55 4.2.5 Loading, Initializing, and Reloading Servlets...55 4.2.5.1 Loading and Initializing Servlets... 55 4.2.5.2 Reloading Servlets... 55 4.3 USING ALIASES...56 4.3.1 Suffix Aliases...57 4.3.1.1 Suffix Aliases and File Extension Mapping... 57 4.3.2 Prefix Aliases...57 4.3.3 ServletExec/AS Aliases...58 4.3.3.1 Microsoft IIS... 58 4.3.3.2 Netscape Enterprise Server / iplanet Web Server... 58 4.3.3.3 Apache... 59 4.3.4 Servlet Chains...60 4.3.5 The invoker Servlet...60 4.3.6 Servlets as Default Pages...61 4.3.6.1 ServletExec Application Server... 61 4.3.6.2 Netscape Enterprise Server and iplanet Web Server... 61 4.3.6.3 Microsoft IIS 4.0/5.0... 61 4.4 USING FILTERS...62 4.5 USING SERVLET LOGGING...63 4.5.1 Advanced Logging Options...63 4.6 VIEWING LOADED LEGACY SERVLETS...64 4.7 SESSION TRACKING...64 4.7.1 Session Tracking Overview...64 4.7.2 Session Tracking Example...65 4.7.3 HttpSession Value Classes...66 4.7.4 Configuring Session Tracking...67 5. DATA SOURCES...70 5.1 MANAGING DATA SOURCES...70 5.2 ADDING A DATA SOURCE...70 5.2.1 Accessing a Data Source From a Servlet...71 5.3 EDITING A DATA SOURCE...71 5.4 REMOVING A DATA SOURCE...71 6. JAVASERVER PAGES (JSP)...73 6.1 JAVASERVER PAGES OVERVIEW...73 6.2 RUNNING THE JSP EXAMPLE...74 6.3 CONFIGURING JAVASERVER PAGES...75 6.3.1 Configuring the JSP10Servlet...75 ServletExec 4.1 User Guide ii
6.3.2 Assigning a Servlet Alias...77 6.3.3 Adding tools.jar to the Classpath...77 6.4 USING JAVASERVER PAGES...78 6.4.1 nvoking a JSP Page From a Servlet...78 6.5 MICROSOFT IIS EXTENSION MAPPING...78 7. VIRTUAL SERVERS...81 7.1 HARDWARE AND SOFTWARE VIRTUAL SERVERS...81 7.2 MICROSOFT IIS...81 7.3 NETSCAPE ENTERPRISE SERVER / IPLANET WEB SERVER...82 7.4 SERVLETEXEC/AS AND VIRTUAL SERVERS...82 7.4.1 Microsoft IIS...82 7.4.2 Netscape Enterprise Server / iplanet Web Server...83 7.4.3 11.4.3 Apache HTTP Server...83 7.5 THE DEFAULT SERVER...84 7.6 CONFIGURING A VIRTUAL SERVER...84 7.7 ADMINISTERING VIRTUAL SERVERS...85 7.8 COMPATIBILITY WITH OLDER BROWSERS...86 8. SERVLET SECURITY...87 8.1 USING THE SERVLET SECURITY MANAGER...88 8.1.1 Enabling Servlet Security Manager...88 8.1.2 Resolving SecurityExceptions After Enabling Security Manager...88 8.1.3 Disabling Servlet Security Manager...88 8.2 CONFIGURING SERVLET SECURITY...88 8.3 MICROSOFT IIS SECURITY...90 9. RESOURCE MONITORING...93 9.1 MONITORING REQUESTS...93 9.2 MONITORING SESSIONS...94 9.3 MONITORING THREADS...95 10. DEVELOPING SERVLETS...97 10.1 SERVLETEXEC TECH SUPPORT FAQ...97 10.2 JAVA SERVLET API DOCUMENTATION...97 10.3 COMPILING SERVLETS...98 10.4 DEBUGGING SERVLETS...98 10.5 PROFILING SERVLETS...99 10.6 SERVLET THREADS...99 10.7 NATIVE METHODS...100 10.8 STATIC (CLASS) VARIABLES...100 10.9 SHARED CLASSES...100 10.10 HTTPSESSION VALUE CLASSES...100 10.11 SERVLET NAMES...101 10.12 (COMPILED CODE) IN STACK TRACES...101 10.13 USER ACCOUNTS FOR MICROSOFT IIS...101 10.14 UNIX FILE DESCRIPTORS...102 ServletExec 4.1 User Guide iii
1 1. Getting Started Even if you don t read manuals, please read this chapter! N ew Atlanta ServletExec 4.1 is a high-performance, reliable, and cost-effective web application server that implements the Java TM Servlet API 2.3 and JavaServer Pages (JSP) 1.2 standards defined by Sun Microsystems, Inc. as component technologies of the Java 2 Platform, Enterprise Edition (J2EE TM ). Additional information about J2EE, servlets, and JSP technologies can be found on Sun s web site: http://java.sun.com/j2ee/ ServletExec allows you to deploy servlets and JSPs on Microsoft Internet Information Server (IIS), Netscape Enterprise Server (NES), iplanet Web Server (iws), and Apache HTTP Server in a standard, robust, high-performance environment. 1.1 Servlet Terminology To better distinguish between servlets that are part of a web application and servlets that are not, this document uses the following terminology. References to simply servlet are applicable to both types. Term Legacy servlet Web Application Servlet Meaning Servlet that is not part of a web application Servlet that is part of a web application 1.2 ServletExec Products Table 1. Servlet Terminology ServletExec supports two basic configurations (in-process and out-of-process) with three products: ServletExec 4.1 Servlet Engine, an in-process web server plugin that adds highperformance servlet and JSP support to Microsoft IIS, Netscape Enterprise Server (NES), and iplanet Web Server (iws). ServletExec 4.1 User Guide 1
1. GETTING STARTED - ServletExec/ISAPI is the plugin servlet engine for Microsoft IIS on Windows NT or Windows 2000. - ServletExec/NSAPI is the plugin servlet engine for NES/iWS on Windows NT/2000 and SPARC Solaris. ServletExec 4.1 Application Server, an out-of-process web application server that includes web server adapters for deployment with Microsoft IIS, NES/iWS, and Apache. - ServletExec/AS is available for Windows NT/2000 and various UNIX platforms, including SPARC Solaris, Linux, HP-UX, and AIX. The key characteristics of each configuration are listed in Table 2 below. If you re using Microsoft IIS or NES/iWS and you aren t sure whether the Servlet Engine or Application Server configuration is best for you, we recommend starting with the Servlet Engine version of ServletExec (ServletExec/ISAPI or ServletExec/NSAPI). If you re using Apache, only the ServletExec/AS version is currently available. ServletExec Servlet Engine ServletExec Application Server Runs within the web server process Runs as a standalone process, separate from the web server Best performance Greatest architectural flexibility Easiest to install and configure Enhanced safety (process isolation) Single Java VM per web server Multiple Java VMs per web server ServletExec starts/stops automatically when the web server starts/stops ServletExec starts/stops independently of the web server Table 2. ServletExec Configurations 1.3 Starting ServletExec 1.3.1 ISAPI and NSAPI Products Only If you ve installed ServletExec/ISAPI or ServletExec/NSAPI, ServletExec automatically initializes and creates a Java VM instance when the web server starts. In other words, ServletExec is always running and available when the web server is running. 1.3.1.1 Reinitializing ServletExec/ISAPI Reinitializing ServletExec/ISAPI requires you to completely stop and restart the Microsoft IIS web server process. Note Stopping the web server from the Microsoft Management Console (Internet Service Manager) does not stop the web server process, but only stops the web server from responding to client requests. ServletExec 4.1 User Guide 2
1. GETTING STARTED To reinitialize IIS 4.0 on Windows NT 4.0 You must stop the IIS Admin Service, which unloads the ServletExec DLL. There are two ways to do this in Windows NT 4.0. Using Control Panel 1. In Control Panel, click Services. 2. Click IIS Admin Service, and then click Stop. Using the command line From the ServletExec ISAPI directory, execute the batch file stop_iis.bat, to completely stop IIS 4.0. To reinitialize IIS 5.0 on Windows 2000 You must stop the IIS Admin Service, which unloads the ServletExec DLL. There are three ways to do this in Windows 2000. Using Control Panel 1. In Control Panel, click Services. 2. Click IIS Admin Service, and then click Stop. Using the command line From the ServletExec ISAPI directory, execute the batch file stop_iis.bat, to completely stop IIS 4.0. Using the Internet Services Manager administrative tool Just click Restart IIS. 1.3.2 AS Product Only If you ve installed ServletExec/AS, the ServletExec process starts independently of the web server. Note There are subdirectories for each installed ServletExec/AS instance within the ServletExec/AS installation directory. The subdirectories are named se-<instance-name>. There is a separate StartServletExec.bat file (Windows NT/2000) or StartServletExec shell script (UNIX) for each ServletExec/AS instance within the se-<instance-name> subdirectories. To start ServletExec/AS on Windows NT or Windows 2000 Using Control Panel 1. In Control Panel, click Services. 2. Click ServletExec-<instance-name>, and then click Start. Using the Command Line From the ServletExecAS directory, execute the StartServletExec.bat file. ServletExec 4.1 User Guide 3
1. GETTING STARTED To start ServletExec/AS (UNIX) From the ServletExecAS directory, execute the StartServletExec shell script. 1.4 Verifying Your ServletExec Installation The ServletExec installers and installation scripts can make all of the needed changes to your system to allow you to run servlets and JSP. If the ServletExec installer for your web server completed successfully, and you allowed it to modify the web server configuration files (if prompted), there is no need for additional manual configuration. To verify your ServletExec installation 1. Restart your web server. If you installed ServletExec/AS, start the ServletExec/AS instance as described in Section 1.3. See Section 1.3.1.1 for Microsoft IIS-specific instructions. 2. After restarting your web server (and starting the ServletExec/AS instance, if necessary), verify your ServletExec installation using the included sample servlets. Invoke the sample servlets by entering the following URLs in your browser: http://localhost/servlet/dateservlet http://localhost/servlet/testservlet Note If your browser is running on a different machine than your web server, replace localhost in the above URLs with the host name or IP address of your web server. The /servlet/ prefix alias in the above URLs must be all lowercase and must not end with an s. ServletExec automatically maps the /servlet/ virtual directory to the appropriate Servlets physical directory. Important Do not configure a /servlet/ prefix alias for your web server--if you do, ServletExec will not work properly. See Section 4.2.3 for a discussion of the Servlets physical directory. The above examples illustrate the simplest way to invoke servlets. Because these servlets did not require any configuration, we refer to them as unconfigured servlets. Section 1.9 discusses unconfigured servlets in more detail. If you re unable to successfully execute these sample servlets, you should verify your installation using the ServletExec 4.1 Installation Guide. You can download the Installation Guide from: http://www.newatlanta.com/downloads/4_1/servletexec_41_installation_guide.pdf Also, check the online Technical Support FAQ for additional information: http://www.newatlanta.com/support/support-faq.jsp ServletExec 4.1 User Guide 4
1. GETTING STARTED 1.5 Starting the ServletExec Admin UI You can use all ServletExec features from the browser-based administration user interface (referred to as the ServletExec Admin Pages or the ServletExec Admin UI throughout this guide). To open or access the ServletExec Admin UI from a web browser Enter this URL into the Address field and press Enter: http://localhost/servlet/admin If you re accessing or opening the ServletExec Admin UI for the first time, your browser display will appear similar to the one shown in Figure 1, which illustrates the Admin UI for ServletExec/ISAPI. 1.6 Licensing ServletExec Figure 1. ServletExec/ISAPI Admin UI In unlicensed mode, the License and Security page appears by default when you launch ServletExec. See Figure 2 for a sample of the license portion of the page. ServletExec 4.1 User Guide 5
1. GETTING STARTED To bring up the ServletExec License and Security page Under General on the ServletExec Admin UI menu, click license & security. Note In unlicensed mode, ServletExec supports a maximum of three concurrent client requests. This allows you to evaluate ServletExec s features before purchasing a license. To license ServletExec Figure 2. License Section of the License and Security Page 1. Enter the license key and click Submit License Key. 2. Please review the ServletExec Software License Agreement (SLA) and abide by its terms and conditions. If you have any questions regarding the SLA, please contact us via email at sales@newatlanta.com. Important You must purchase a separate license key for each physical server machine on which ServletExec is installed. ServletExec 4.1 is licensed on a per-cpu basis, so make sure you have purchased the appropriate license for your machine. 1.7 Setting Up ServletExec Administrators To prevent unauthorized access, you must first define some basic settings that will tell ServletExec who has administration rights, what specific IPs those administration rights can be exercised from, and whether you want to require Secure Sockets Layer (SSL) for accessing the ServletExec Admin UI. This section covers these settings. 1.7.1 Setting the Admin Username and Password After entering your license key, you should immediately assign the Admin Username and Admin Password (also from the same ServletExec License and Security page). See Figure 3 for a look at the available data entry fields in this section of the page. This Admin Username and Password will be required for all future access to the ServletExec Admin UI. For Microsoft IIS on Windows NT/2000, the Admin Password ServletExec 4.1 User Guide 6
1. GETTING STARTED and Confirm Password fields are not displayed. Instead, the Admin Username must match that of a Windows user in the local domain. The password defined for the Windows user is used for authenticating access to the ServletExec Admin UI. In addition, Microsoft IIS users must make sure that Basic Authentication is enabled. See the ServletExec 4.1 Installation Guide for instructions on enabling Basic Authentication for Microsoft IIS. To reset Admin Username and Password Should you forget your ServletExec Admin Username and Password, you can reset them as follows. 1. Delete the servers.properties file from the ServletExec Data directory, which can be found within the ServletExec installation directory. This file contains your license key and virtual server configuration data, in addition to the Admin Username and Password. 2. Re-enter your license key and any virtual server configuration data you may have entered. See Section 1.6 for information on entering the license key. See Section 0 for information on configuring virtual servers. 3. From the License and Security page, enter a new Admin Username and Admin Password and click Submit. Figure 3. Administrator Setup Portion of the License and Security Page 1.7.2 Allowing Admin UI Access to Specific IPs You can enter a comma-separated list of IP addresses into Allowed IPs from which clients may access the ServletExec Admin UI. The specified IP addresses may include the * character to represent all IP addresses in a sub-range. For example, the following list of IP addresses would allow access to the ServletExec Admin UI from a client with the IP address 168.121.97.133 (or any IP address in the range from 204.84.126.1 to 204.84.126.255): 168.121.97.133,204.84.126.* Access to the ServletExec Admin UI is always allowed from the local machine on which ServletExec is running regardless of Allowed IPs entries. ServletExec 4.1 User Guide 7
1. GETTING STARTED 1.7.3 Requiring Secure Sockets Layer (SSL) ServletExec 4.1 allows you to require SSL (Licensed mode only) for accessing the Admin UI. Note The Require SSL feature is not available in the NSAPI product and does not appear in its License and Security page. 1.8 Viewing Logs From the View Logs page, you can check the ServletExec logs and the legacy servlet logs. You can view the logs for a web application s servlets from the individual web application s admin pages. Note The Servlet.log file is buffered. All other log files are not. Figure 4. View Logs Page To view the contents of ServletExec s log files 1. Under General on the ServletExec Admin UI menu, click View Logs. 2. In the Log Files list, select a log file. See the table below for information on each log file. Log File ServletExec.log Description Resides in installation directory Contains informational and error messages from ServletExec Contains output from calls to System.out and System.err Servlet.log Resides in Servlet Logs directory Contains output from log() method (with Servlet Logging enabled). Is the only buffered log file. See Section 4.5 for more information on Servlet ServletExec 4.1 User Guide 8
1. GETTING STARTED Log File Description Logging. ServletExecNative.log Created by ISAPI and NSAPI only Resides in installation directory Contains informational and error messages generated by native code portions of ServletExec 1.8.1 Logging Options Table 3. ServletExec Log Files The ServletExec Logging page gives you options for changing the number of backups to keep of the ServletExec.log file, changing its rollover limit, and changing the location of log files. Figure 5. ServletExec Logging Page To use ServletExec s advanced logging options Under Advanced on the Admin UI menu, click manage logs. The following logging options are configurable, as described in Table 4: Logging Option Max ServletExec.log Backups Servlet.log Directory ServletExec.log Directory Description Every time ServletExec restarts, a new ServletExec.log file gets created and the old files renamed ServletExec.log.<n>, where <n> is a number starting with 1 for the most recent backup. Specifies the directory to which Servlet.log and backups are written. Specifies the directory to which ServletExec.log file and backups are written. ServletExec 4.1 User Guide 9
1. GETTING STARTED Logging Option ServletExec.log Rollover Limit Description Specified in kilobytes. When the ServletExec.log file reaches specified size, a new ServletExec.log file gets created and the old file backed up as ServletExec.log.1 (all other backups have <n> incremented and the oldest backup file is deleted if necessary). Table 4. Advanced Logging Options Described 1.9 Executing Unconfigured Servlets Class files for legacy servlets (servlets that are not part of a web application) are stored in the physical Servlets directory or in a JAR file that is in the VM s classpath. The default location of the Servlets directory varies based on your operating system and web server. You can change the name and location of the Servlets directory using the Configure Virtual Server page of the ServletExec Admin UI. See the chapter for your web server in the ServletExec 4.1 Installation Guide for the location of the Servlets directory. See Section 7.6 for further information. 1.9.1 Sample/Unconfigured Servlets If you examine the Servlets directory after installing ServletExec you ll find a number of sample servlets, including these two: DateServlet.class and Test-Servlet.class. The names of these files, without the.class extension, are the same names we used to invoke the sample servlets in the URLs in Section 1.4 at the beginning of this chapter. To invoke an unconfigured servlet 1. Place the class file for the servlet in the Servlets directory or in the classpath. 2. Invoke the servlet using a URL of the form: http://localhost/servlet/servletname Where localhost can be replaced with the host name or IP address of your server Where /servlet/ is a virtual directory that ServletExec maps to the physical Servlets directory Where ServletName is the name of the servlet class file without the.class extension ServletExec 4.1 User Guide 10
1. GETTING STARTED 1.9.2 Legacy Servlets That Don t Require Configuring A legacy servlet does not have to be configured if all of the following conditions are true: The servlet class files all reside on the local web server within the Servlets directory or in a directory or JAR file that is in the VM s classpath. See Section 1.9.3 for a discussion of servlets that consist of multiple class files. The servlet does not need to be initialized when ServletExec initializes. The servlet does not require initialization parameters. Only one instance of the servlet needs to be created. If any of these conditions are not true, the servlet must be configured from the Configure Servlets and Manage Servlets pages in the ServletExec Admin UI. See Section 4.1 for a discussion of configuring legacy servlets. 1.9.3 Web Application Servlets that Don t Require Configuring A web application servlet does not have to be configured if all of the following conditions are true: The class that implements the doget(), dopost(), or service() methods is not part of a named Java package (the Java source file does not begin with a package statement). The servlet does not need to be initialized when ServletExec initializes. The servlet does not require initialization parameters. Only one instance of the servlet needs to be created. If any of these conditions are not true, the web application servlet must be configured from the Configure Servlets and Manage Servlets pages in the web application s Admin UI. See Section 3.4.6.2 for a discussion of configuring web application servlets. 1.9.4 Servlets with Multiple Class Files Both web application servlets and legacy servlets may have multiple class files. There are no restrictions on web application servlets ability to have multiple class files. The following restrictions apply only to legacy servlets. 1.9.4.1 Legacy servlet restrictions If a servlet consists of multiple class files, the individual class files may be stored directly in the Servlets directory, or they may be stored within a compressed or uncompressed Java.jar/.zip archive within the Servlets directory. If class files are placed directly in the Servlets directory, the sub-directory structure within the Servlets directory must match the package structure of the classes. (Remember, to invoke an unconfigured servlet, the class that implements the doget(), dopost(), or service() methods must not exist within a Java ServletExec 4.1 User Guide 11
1. GETTING STARTED package and must reside directly within the Servlets directory or in a directory or JAR file that is in the VM s classpath. Other classes may exist within Java packages). If class files are placed within a Java.jar/.zip archive, the name of the archive must be the same as the name of the class that implements the doget(), dopost(), or service() methods. The.jar/.zip extension. Java.jar/.zip archives must be placed directly within the Servlets directory and not within nested subdirectories. Finally, classes that are shared by multiple servlets, or multiple instances of the same servlet, cannot be placed in the Servlets directory. Instead, such shared classes must be placed in a directory that appears in the ServletExec classpath. See Section 2.3 for a discussion of the ServletExec classpath. See Section 4.2.3 for a more detailed discussion of the Servlets directory. 1.10 Technical Support If you re having difficulty installing or configuring ServletExec, check the online Tech Support FAQ: http://www.newatlanta.com/support/support-faq.jsp You may also want to consider subscribing to the ServletExec-Interest mailing list, a user-supported discussion forum for ServletExec developers: http://www.newatlanta.com/support/se-interest.jsp Details regarding free and paid support options, including online-, telephone-, and pagerbased support are available from the ServletExec web site: http://www.newatlanta.com/support.jsp ServletExec 4.1 User Guide 12
2 2. Java Virtual Machine Setting Java Virtual Machine (VM) options for ServletExec T his chapter is almost completely devoted to ServletExec/ISAPI and ServletExec/NSAPI. The differences between how the in-process and out-ofprocess products invoke the Java VM are the reason. The following two points explain the main differences between the in-process and out-of-process products. You must configure the Java Virtual Machine (VM) settings, including the classpath, for ServletExec/ISAPI and ServletExec/NSAPI using the ServletExec Admin UI. For ServletExec/AS, you can view the VM settings and classpath with the ServletExec Admin UI, but you can only modify them by editing the StartServletExec.bat file (Windows) or the StartServletExec script (UNIX). See Section 5.6 in the ServletExec 4.1 Installation Guide for information on editing the StartServletExec.bat file (Windows). See Section 6.6 in the ServletExec 4.1 Installation Guide for information on editing the StartServletExec script (UNIX). Important Note to ServletExec/AS Users The remaining sections of this chapter apply only to ServletExec/ISAPI and ServletExec/NSAPI The plugin servlet engine versions of ServletExec for Microsoft IIS Netscape Enterprise Server iplanet Web Server ServletExec 4.1 User Guide 13
2. JAVA VIRTUAL MACHINE 2.1 Viewing Java VM Settings for ServletExec/ISAPI and ServletExec/NSAPI This section explains how to view (or modify) the Java Virtual Machine settings for the ServletExec/ISAPI and ServletExec/NSAPI products. Note for ServletExec/AS Users As noted on the previous page, you must manually edit either the StartServletExec.bat file (Windows) or the StartServletExec script (UNIX) to modify Java VM settings. See Section 5.6 in the ServletExec 4.1 Installation Guide for information on editing the StartServletExec.bat file (Windows). See Section 6.6 in the ServletExec 4.1 Installation Guide for information on editing the StartServletExec script (UNIX). To view (or modify) Java VM settings for ServletExec/ISAPI and ServletExec/NSAPI (Windows only) Under Virtual Machine on the Admin UI menu, click Settings. This brings up the Java Virtual Machine (VM) Settings page as shown in Figure 6. Figure 6. Java Virtual Machine (VM) Settings Page ServletExec 4.1 User Guide 14
2. JAVA VIRTUAL MACHINE To view (or modify) Java VM settings for ServletExec/NSAPI (Solaris) You will need to edit the LD_LIBRARY_PATH in the NES/iWS start script. See Section 4.5.2.2 in the ServletExec 4.1 Installation Guide for instructions. 2.2 Selecting and Configuring a Java VM The information at the top of the Java Virtual Machine (VM) Settings page indicates which VM ServletExec was selected during initialization, as Figure 6 shows. ServletExec supports up to four flavors of Java VMs. They are: Sun s Classic VM Sun s HotSpot Client Performance Engine Sun s HotSpot Server Performance Engine IBM s Developer Kit for Windows, Java Technology Edition By default, ServletExec uses the Sun Classic VM with JDK 1.2.x and the Sun HotSpot Client Performance Engine with JDK 1.3.x. To select a VM other than Sun Classic (Windows) On the Java Virtual Machine (VM) Settings page, select Sun HotSpot Client, Sun HotSpot Server, or IBM. If you select one of these VMs, ServletExec will look for it during initialization. To select a VM other than Sun Classic (Solaris) You will need to edit the LD_LIBRARY_PATH in the NES/iWS start script. See Section 4.5.2.2 in the ServletExec 4.1 Installation Guide for instructions. Notes If the selected VM isn t installed, ServletExec will attempt to initialize using the Sun Classic VM instead (Windows only). To reinitialize ServletExec and the Java VM (and for changes to the selected VM to take effect), you must Stop and Restart your web server. 2.3 Defining the Classpath The Java VM classpath defines the directories and JAR files in which the VM will search when trying to load class files. By default, ServletExec sets the classpath to include all directories and JAR files required by ServletExec. You can add more directories to the classpath using the ServletExec Admin UI. This is actually required if you have a common set of class files (third-party libraries, for example) that are shared by many servlets and must be placed outside of the Servlets directory. Alternatively, it may be useful to share common class files across multiple virtual servers where each virtual server has its own Servlets directory. ServletExec 4.1 User Guide 15
2. JAVA VIRTUAL MACHINE Figure 7. Java Virtual Machine (VM) Classpath Page To view or modify ServletExec s Java VM classpath Under Virtual Machine on the Admin UI menu, click classpath. The Java Virtual Machine (VM) Classpath page will appear, as shown in Figure 7. - Windows: (a) Use the \ character as the file separator when specifying directory paths. (b) Use the full UNC name and not a mapped drive letter to specify paths to network drives. 1 Use the following form. \\<machine name>\<drive share name>\<path to file> - UNIX: Use the / character as the file separator when specifying directory paths. - You must specify directories that are added to the classpath as full paths. When adding.jar/.zip files to the classpath, you must specify the full path to the file. Note To reinitialize ServletExec and the Java VM (and for changes to the selected VM to take effect), you must stop and restart your web server. 2.4 Setting Java VM Options The Java Virtual Machine (VM) Options page provides a convenient method for setting VM options. Treat its data entry field (see Figure 8) as you would the command line with the java command. For detailed information on the java command and available options, see the documentation included with the JDK. To set Java VM options 1. Under Virtual Machine on the ServletExec Admin UI, click options. 2. Enter the options you want to configure for the VM and click Submit. 1 This is because mapped network drive letters are associated with particular users. ServletExec runs as part of the web server, which runs as an NT service and therefore is not aware of network drive letter mappings. ServletExec 4.1 User Guide 16
2. JAVA VIRTUAL MACHINE Figure 8. Java Virtual Machine (VM) Options Page 2.5 Using Optional Packages Optional Packages is Sun s new term for Extensions (or Standard Extensions). They are packages of Java classes and associated native code that extend the functionality of the core platform. You install Optional Packages by adding the JAR file containing them to one of two locations, depending on how you want to make them available: Main ServletExec Classpath This makes the Optional Package available to all ServletExec web applications. JDK's Ext directory This makes the Optional Package available to all ServletExec web applications, as well as all Java applications that use the JDK. ServletExec s Java Virtual Machine (VM) Optional Packages page lists all installed optional packages. See Figure 9 for a sample page. Note Older Optional Packages that do not include the Manifest.mf file (which must also contain an Extension-Name entry) will not appear on this page, but should still function normally. ServletExec 4.1 User Guide 17
2. JAVA VIRTUAL MACHINE Figure 9. Java Virtual Machine (VM) Optional Packages Page ServletExec 4.1 User Guide 18
3 3. Web Applications Deploying and configuring web applications with ServletExec A web application, as defined by Java Servlet API 2.3, is a collection of servlets, HTML pages, Java class files, and other resources that can be deployed as a single entity, either as a structured hierarchy of directories or as an archive file (a Web Archive, or.war file). A web application is rooted at a specific URL context path within a web server. For example, a catalog application could be located at the URL: http://www.mycorp.com/catalog/ All requests that start with that URL prefix will be routed to the ServletExec instance configured to contain the application. See the Java Servlet API 2.3 Specification for a detailed discussion of web applications: http://java.sun.com/products/servlet/ 3.1 Web Application Overview A web application can consist of the following items: Servlets JavaServer Pages Utility Classes Static documents (HTML pages, GIF/JPEG image files, etc.) Client-side applets, beans, and classes Descriptive metadata that ties all of the above elements together 3.1.1 Directories A web application exists as a structured hierarchy of directories. The root of this hierarchy serves as a document root for serving files that are part of this context. For example, for a web application configured with a URL context path of /catalog/ within a web server, the index.html file located at the base of the web application ServletExec 4.1 User Guide 19
3. WEB APPLICATIONS directory hierarchy will be served by ServletExec to satisfy a request for /catalog/index.html. 3.1.1.1 WEB-INF directory A special directory exists within the application directory hierarchy named WEB-INF. This directory contains all things related to the application that aren t in the document root of the application. In other words, the WEB-INF directory is not part of the public document tree of the application, and no file contained in the WEB-INF directory may be served directly to the client. The contents of the WEB-INF directory are: /WEB-INF/web.xml deployment descriptor /WEB-INF/classes/* directory for servlet and utility classes /WEB-INF/lib/*.jar directory for Java archive files containing servlets, beans, and other utility classes useful to the web application 3.1.2 Packaging Web applications can be packaged and signed, using the standard Java Archive tools, into Web Archive format (.war) files. For example, an application for issue tracking could be distributed in an archive with the filename issuetrack.war. 3.2 Using ServletExec s Web Application Admin UI The Manage Web Applications page serves as the home for ServletExec s web application administration features. From this page (see Figure 10), you can: Add a web application Configure a web application s ServletExec settings Edit a web application s web.xml settings Reload a web application Remove a web application Figure 10. Manage Web Applications Page (no applications added) ServletExec 4.1 User Guide 20
3. WEB APPLICATIONS 3.3 Running the Example Web Application The Example web application illustrates many of the features of web applications, including full source code for the examples. Tip Careful study of this example will answer many questions you may have regarding the use of web applications within ServletExec. To run the Example web application 1. Under Web Applications on the Admin UI, click manage to bring up the Manage Web Applications page (see Figure 10). 2. Click Add Web Application. This brings up the Add a Web Application page (see Figure 11). Figure 11. Add a Web Application Page 3. On the Add a Web Application page, you can specify any value for Application Name and URL Context Path. We recommend using Example and /example/, respectively. Note Avoid using white space and non-alpha characters (such as characters for comma, semi-colon, quotation marks, etc.). 4. In Location, enter the full path to the examplewebapp directory and click Submit. This returns you to the Manage Web Applications page. - For ServletExec/ISAPI, the default location of this directory is: C:\Program Files\New Atlanta\ServletExec ISAPI\Examples\exampleWebApp - For ServletExec/AS, configure the web server adapter(s) to recognize the /example/ URL context path. You can do this by running the ServletExec/AS installer or by manually editing the web server configuration ServletExec 4.1 User Guide 21
3. WEB APPLICATIONS file. Be sure to restart your web server afterward if you modify the configuration file, however. See Section 3.4.4.5 for more information. Figure 12. Manage Web Applications Page (with application) 5. Under Edit on the Manage Web Applications page, click web.xml for your newly added web application. This opens a new browser window specific to your example web application (see Figure 13). This new browser window also provides a new set of menu options that allow you to change the web.xml descriptor settings. See Section 3.4.6 for more information on this topic. Figure 13. Web Application Admin UI Start Page 6. Enter the following URL to bring up the index page of the Example web application: http://localhost/example/ 7. From the resulting index page, click each link to explore the Example web application. ServletExec 4.1 User Guide 22
3. WEB APPLICATIONS 3.4 Deploying Web Applications The process of deploying web applications involves two or more of the following steps. Creating a web application Auto-deploying a web application Installing the web application on the ServletExec server s file system Adding the web application using the ServletExec Admin UI Configuring the web application for ServletExec Editing the web application 3.4.1 Creating a Web Application If you have yet to create the web application you wish to deploy, you can use the ServletExec Admin UI to create it. If you use this feature, you will not have to install or add the new web application, as this process accomplishes both those steps. So, if you already have a web application, skip this step and go on to either Auto Deploying it (see Section 3.4.2) or installing it (see Section 3.4.3) To create a web application using the Admin UI 1. Under Web Applications on the Admin UI, click manage to bring up the Manage Web Applications page (see Figure 16). 2. Click Add Web Application. This brings up the Add a Web Application page (see Figure 17). 3. On the Add a Web Application page, enter an Application Name and a URL Context Path. Notes The Name and Context Path must both be unique. You can use any value in these fields but do avoid using white space and non-alpha characters (such as characters for comma, semi-colon, quotation marks, etc.). 4. In Location, enter the full path to the directory you wish to install the newly created web application into and click Submit. This returns you to the Manage Web Applications page. If the directory does not yet exist, you can have ServletExec create it for you in the following step, based on the information you enter into Location. This will bring up an error page alerting you to the missing directory (see Figure 14). Note If you are using ServletExec/AS, you will need to configure the web server adapter(s) to recognize the URL context path for your web application. Section 3.4.4.5 covers this step. 5. If you re presented with the Manage Web Applications page, go on to Step 6. If you re presented with the error page alerting you to the missing directory (or other missing ServletExec 4.1 User Guide 23
3. WEB APPLICATIONS resources), click Create Missing Resources. This brings up the Manage Web Applications page displaying a successful result. Figure 14. Missing Resources Error Page Figure 15. Manage Web Applications Page After Successfully Creating a Web Application 3.4.2 Auto Deploying a Web Application Using ServletExec s auto-deployment feature reduces the process of deployment to two steps. You will need to re-initialize ServletExec afterwards, though. If you use this method, you will not need to do any of the other sub-sections inside 3.4 Deploying Web Applications. To auto-deploy a web application 1. Drop the web application s.war file into a configured virtual server s folder residing in the web apps folder. You can use either the folder named default or any other folder for a configured virtual server. 2. Re-initialize ServletExec if it is running, or launch ServletExec, to see the web application appear on the Manage Web Applications page (see Figure 20). ServletExec 4.1 User Guide 24
3. WEB APPLICATIONS See the READ ME file inside the web apps folder for more information on autodeployment. 3.4.3 Installing a Web Application Before adding a web application into ServletExec, you first have to install it on the physical server where ServletExec resides. To install a web application for ServletExec 1. Copy the web application to any file system on the server on which ServletExec is installed. Important Do not put the web application in a web server s document root. Doing so creates a security risk. 2. Check to make sure the ServletExec process (or the web server process for the plugin servlet engine versions of ServletExec) has read permission enabledfor the web application. 3.4.4 Adding a Web Application Here you will begin using the ServletExec Admin UI in the deployment process. This section covers the installation of the web application into ServletExec. To add a web application 1. Under Web Applications on the Admin UI, click manage to bring up the Manage Web Applications page (see Figure 16). Figure 16. Manage Web Applications Page (no applications added) 2. Click Add Web Application. This brings up the Add a Web Application page (see Figure 17). ServletExec 4.1 User Guide 25
3. WEB APPLICATIONS Figure 17. Add a Web Application Page 3. On the Add a Web Application page, enter an Application Name and the URL Context Path. Note You can use any value in these fields but do avoid using white space and non-alpha characters (such as characters for comma, semi-colon, quotation marks, etc.). 4. In Location, enter the full path to the directory you installed into and click Submit. This returns you to the Manage Web Applications page. Note If you are using ServletExec/AS, you will need to configure the web server adapter(s) to recognize the URL context path for your web application. Section 3.4.4.5 covers this step. 3.4.4.1 Using the root context path ( /) If you choose to configure a web application using the root context path ( / ), thereafter the web server will only serve content that is part of a web application. Important Using the root context path ( / ) for a web application prohibits all legacy servlets configured within the Admin UI from being invoked. 3.4.4.2 ServletExec Extensions Enabling ServletExec Extensions provides several additional session tracking options. See Figure 18 for a complete listing. Important Enabling these extensions temporarily makes the web application no longer portable to other servlet engines. To restore portability to other servlet engines, you will need to disable the ServletExec Extensions and re-save the web.xml file for the web application. ServletExec 4.1 User Guide 26
3. WEB APPLICATIONS Figure 18. ServletExec Extensions Additional Session Tracking Options 3.4.4.3 Static File Caching When adding a web application (or afterward), you have the option of having the web application s static files cached in memory. Enabling this feature does improve performance but obviously uses more memory. Figure 17 shows the panel with this feature that you see while adding a web application. Note You can also enable/disable File Caching after deploying a web application by clicking the name of the application under Configure on the Manage Web Applications page, which brings up the page shown in Figure 19. ServletExec 4.1 User Guide 27
3. WEB APPLICATIONS Figure 19. Configure Web Application for ServletExec Page (ISAPI and NSAPI) 3.4.4.4 Static Page Serving In addition, from the Add a Web Application page or the Configure Web Application for ServletExec page, you can choose to have the web server serve static pages, which again obviously improves performance. To do this, make sure to select Disabled. This is actually disabling ServletExec from serving the static pages Important Disabling Serve Static Pages also disables File Caching. It will also disable web application security and filtering for static pages. 3.4.4.5 Configuring the ServletExec/AS Web Server Adapter (AS Only) For ServletExec/AS, you must configure the web server adapter(s) to forward requests that specify a web application URL context path to a particular ServletExec/AS instance. To configure a web server adapter after adding a web application Using the installer 1. Run the ServletExec/AS installer and select the Install or Update a web server adapter setup type. 2. Enter the name of the appropriate ServletExec/AS instance when prompted. 3. Specify the web application URL context path when prompted. 4. Restart the web server after the installer finishes. Using the command line You can manually edit the web server configuration file for the web application URL context path. See the ServletExec 4.1 Installation Guide for additional information about the web server configuration file for your web server. ServletExec 4.1 User Guide 28
3. WEB APPLICATIONS Note After you Add a Web Application, it appears on the Manage Web Applications page of the ServletExec Admin UI as Figure 20 shows. Figure 20. Manage Web Applications Page 3.4.5 Setting Up Roles, Users, and Role Mapping You can manage ServletExec s local security domain using the Roles, Users and Role Mapping features. Each has its own page, which is available under Web Applications on the Admin UI. The first thing you ll need to do is set up one or more Container Roles. Next, you ll associate Users with that Container Role. Finally, you ll need to map the Container Role to an existing Web Application Role. Note Any web application role defined within that web application is automatically mapped to a container role in ServletExec. See the Java Servlet 2.3 Specification, which is available at the following URL, for more information on web application security. http://java.sun.com/products/servlet/download.html 3.4.5.1 Roles From the Manage Roles page (see Figure 21), you can... Create a new role Create a new user Access the Modify Role page for any existing role Access the Modify User page for any associated user Access the admin pages for any associated web application Remove an existing role (if it does not have a web application association) ServletExec 4.1 User Guide 29
3. WEB APPLICATIONS To create a new Container Role Figure 21. Manage Roles Page 1. From either the Manage Roles page or the Manage Users page, click New Role. 2. On the Create a New Role page, enter the Role Name and press TAB. 3. Enter a comma-separated list of users for this security role into Associated Users and click Submit. Figure 22. Create a New Role Page Important Before a Container Role can be used, you must map it to an existing Web Application Role. See the following sections for information on both steps. See Section 3.4.5.2 for information on creating users. To modify an existing Role, User, or Web Application On the Manage Roles page, click the name of the Role, User or Web Application in the appropriate column to bring up its configuration page. To remove a Container Role 1. On the Manage Roles page, select the Remove checkbox for the appropriate Role and click Submit. If the Remove checkbox isn t available, go to Step 2 to disassociate the Role from its web application. 2. Under Web Applications on the Admin UI, click role mapping. This brings up the Manage Role Mapping page. ServletExec 4.1 User Guide 30
3. WEB APPLICATIONS 3. In the Container Role list for the appropriate Web Application Name, click <Not Mapped> and click Submit. ServletExec will not allow a container role with existing web application roles mapped to it, to be removed. 4. Return to the Manage Roles page and the Remove checkbox should be available. 3.4.5.2 Users Again, before you can use a Container Role, it has to have Users associated with it. From the Manage Users page (see Figure 23), you can... Create a new user Create a new role Access the Modify User page for any existing user Access the Modify Role page for any associated role Remove an existing user Figure 23. Manage Users Page To create a new user 1. From either the Manage Users page or the Manage Roles page, click New User. 2. On the Create a New User page (see Figure 24), enter the User Name and press TAB. 3. Enter a comma-separated list of security roles for this user into Associated Roles and press TAB. 4. Enter a password for the user (this is optional) and click Submit. ServletExec 4.1 User Guide 31
3. WEB APPLICATIONS Figure 24. Create a New User Page See Section 3.4.5.1 for information on creating roles. To modify an existing Role, User, or Web Application On the Manage Users page, click the name of the Role, User or Web Application in the appropriate column to bring up its configuration page. To remove a user On the Manage Users page, select the Remove checkbox for the appropriate User and click Submit. 3.4.5.3 Role Mapping As mentioned earlier in this section, before a Container Role can be used, you have to map it to an existing Web Application Role. From the Manage Role Mapping page (see Figure 25), you can Map a previously defined Container Role to an existing Web Application Role Modify an existing Role Mapping To map a previously defined Container Role to a Web Application Role In the Container Role list in the Manage Role Mapping page, click the appropriate Container Role for the Web Application Role you are mapping, and click Submit. See Section 3.4.6.4 if you have not yet defined any Web Application Roles. ServletExec 4.1 User Guide 32
3. WEB APPLICATIONS To modify an existing Role Mapping Figure 25. Manage Role Mapping Page In the Container Role list in the Manage Role Mapping page, click the appropriate new Container Role for the Web Application Role you wish to change, and click Submit. 3.4.6 Editing the Web Application s web.xml Settings When you click web.xml under Edit on the Manage Web Applications page, ServletExec opens a new browser window that provides configuration pages specific to that web application, as shown in Figure 26. You can also switch to these pages directly by using a URL with the following form: http://localhost/<url context path>/admin Here are two examples: http://localhost/catalog/admin http://localhost/example/admin ServletExec 4.1 User Guide 33
3. WEB APPLICATIONS Figure 26. Web Application Admin UI Start Page The application settings available from these pages correspond to the elements of the web.xml deployment descriptor for a web application. Note Any changes you make to a web application s settings using the web application admin pages automatically updates the web.xml. Conversely, any manual edits to the web.xml file will be reflected in a web application s admin pages (after the web application has been reloaded). 3.4.6.1 Application The Application menu of a web application s admin pages provides nine configuration options. They are: Setting display options Managing initialization parameters Setting welcome files Configuring session tracking Setting MIME mapping (for responses to requests for static files with specific extensions) Managing error pages Managing tag libraries Managing listeners (Listeners are special classes that provide notification of Servlet Context and HTTP Session events) Viewing logs ServletExec 4.1 User Guide 34
3. WEB APPLICATIONS To set display options From the Set Display Options page (see Figure 26), enter any or none of the optional choices for defining how your web application appears in a browser. To create a new initialization parameter From the Manage Initialization Parameters page (see Figure 27), enter data into Name and Value, and then click Submit. To delete an initialization parameter From the Manage Initialization Parameters page (see Figure 27), clear all fields and click Submit. To add a welcome file Figure 27. Manage Initialization Parameters Page From the Set Welcome Files page (see Figure 28), enter the filename into Welcome Files and click Submit. To remove a welcome file From the Set Welcome Files page (see Figure 28), clear its field and click Submit. Note When ServletExec receives a request for a directory, it looks for welcome files in top-to-bottom order in that directory. ServletExec 4.1 User Guide 35
3. WEB APPLICATIONS To configure session tracking Figure 28. Set Welcome Files Page From the Configure Session Tracking page (see Figure 29), choose the settings you wish for the web application and click Submit. See Quickhelp in the lower portion of the page for specific information on each option. To add a MIME mapping Figure 29. Configure Session Tracking Page From the Set MIME Mapping page (see Figure 30), enter an Extension and MIME Type, and click Submit. To remove a MIME mapping From the Set MIME Mapping page (see Figure 30), clear all fields and click Submit. ServletExec 4.1 User Guide 36
3. WEB APPLICATIONS Figure 30. Set MIME Mapping Page Note The MIME Mapping page settings determine which MIME type a client receives when a static page is served. To add an error page From the Manage Error Pages page (see Figure 31), enter an HTTP Error Code or Java Exception and corresponding Location, and then click Submit. Notes Adding an error page specifies which page gets returned to the client when the specified error code or exception occurs in a servlet. Error pages are matched in descending (top to bottom) order. ServletExec 4.1 User Guide 37
3. WEB APPLICATIONS Figure 31. Manage Error Pages Page To remove an error page From the Manage Error Pages page (see Figure 31), clear one or both fields and click Submit. Tip Using the following feature (Add a Tag Library) greatly simplifies JSP management by eliminating the need to make changes to JSPs after a tag library descriptor (TLD) is moved or renamed. To add a tag library 1. From the Manage Tag Libraries page (see Figure 32), click Add Taglib. This brings up the Add a Tag Library page. Figure 32. Manage Tag Libraries Page 2. From the Add a Tag Library page (see Figure 33), enter a tag library name of your choosing into Taglib URI and its context-relative path into Taglib Location, and then click Submit. Tip Adding a tag library to a web application s XML settings in ServletExec allows you to use the Taglib URI in a JSP Taglib directive to specify a TLD instead of having to specify the path to the TLD. ServletExec 4.1 User Guide 38
3. WEB APPLICATIONS To edit a tag library Figure 33. Add a Tag Library Page 1. From the Manage Tag Libraries page (see Figure 32), click the name under Taglib URI of the tag library you are editing. This brings up the Edit Tag Library page. 2. From the Edit Tag Library page (see Figure 34), make your changes and click Submit to save or Reset to restore the prior settings. To remove a tag library Figure 34. Edit Tag Library Page From the Manage Tag Libraries page (see Figure 32), select the Remove checkbox for the tag library you are removing, and click Submit. Tip Use the following feature (Listeners) to be notified whenever lifecycle events occur. To add a listener From the Manage Listeners page (see Figure 35), enter the class name into Listeners and click Submit. To remove a listener From the Manage Listeners page (see Figure 35), clear its field and click Submit. ServletExec 4.1 User Guide 39
3. WEB APPLICATIONS To view the web application s logs Figure 35. Manage Listeners Page From the View Logs page (see Figure 36), select the log in the Log Files list, and then click Submit. The selected log display appears on the same page (see Figure 37). Figure 36. View Logs Page Figure 37. Sample Log ServletExec 4.1 User Guide 40
3. WEB APPLICATIONS 3.4.6.2 Web Application Servlets The Servlets menu of a web application s Admin UI provides three primary configuration choices. They are: Managing web application servlets (adding, editing, removing and setting load order) Mapping web application servlets to URL patterns Viewing all loaded web application servlets To add a web application servlet 1. From the Manage Servlets page (see Figure 38), click Add Servlet. This brings up the Add a Servlet page. Figure 38. Manage Web Application Servlets Page 2. From the Add a Servlet page (see Figure 39), complete all required (and optional, if desired) fields using the QuickHelp as a guide, and click Submit. ServletExec 4.1 User Guide 41
3. WEB APPLICATIONS To edit a web application servlet Figure 39. Add a Web Application Servlet Page 1. From the Manage Servlets page (see Figure 38), click the name of the servlet you re editing and click Submit. This brings up the Edit Servlet page. 2. From the Edit Servlet page, make your changes and click Submit to save or Reset to restore the prior settings. To change the load order for a web application servlet From the Manage Servlets page (see Figure 38), enter the appropriate value into Load Order, and click Submit. Note When a web application initializes, it loads only those servlets that have a specified load order. All other servlets load only when invoked. ServletExec 4.1 User Guide 42
3. WEB APPLICATIONS To remove a web application servlet From the Manage Servlets page (see Figure 38), select the Remove checkbox for the appropriate servlet, and click Submit. To map a web application servlet to a URL pattern From the Set Servlet Mapping page (see Figure 40), enter a URL Pattern and Servlet Name, and then click Submit. To delete a servlet mapping From the Set Servlet Mapping page (see Figure 40), clear all fields and click Submit. To view all loaded web application servlets Figure 40. Set Servlet Mapping Page From the web application s Admin UI, click View Loaded under Servlets. 3.4.6.3 Filters Figure 41. View Loaded Web Application Servlets Page Under the Filters menu of a web application s admin pages, you ll see two options. They are: Managing filters (adding, editing or removing) Mapping filters to URL patterns ServletExec 4.1 User Guide 43
3. WEB APPLICATIONS To add a filter 1. From the Manage Filters page (see Figure 42), click Add Filter. This brings up the Add a Filter page. Figure 42. Manage Filters 2. From the Add a Filter page (see Figure 43), complete all required (and optional, if desired) fields using the QuickHelp as a guide, and click Submit. Figure 43. Add a Filter Page To edit a filter 1. From the Manage Filters page (see Figure 42), click the name of the filter you re editing. This brings up the Edit Filter page. ServletExec 4.1 User Guide 44
3. WEB APPLICATIONS 2. From the Edit Filters page, make your changes and click Submit to save or Reset to restore the prior settings. To map a filter to a URL pattern From the Set Filter Mapping page (see Figure 44), enter a URL Pattern and Filter Name, a Servlet Name (must already appear on the Manage Servlets page) and Filter Name, and click Submit. See Chapter 11 of the Java Servlet 2.3 Specification for detailed information on format. To delete a filter mapping Clear all fields and click Submit. 3.4.6.4 Security Figure 44. Set Filter Mapping The Security menu of a web application s admin pages provides three primary settings pages. They are: Configuring access control (selecting an authentication method, defining the realm, specifying pages for the Form Based authentication method only) Defining web application roles Managing security constraints Enabling secure access controls on any web application resource requires a minimum of: One security constraint One web application role One selected authentication method One defined user One user-to-role mapping Note Failure to define a user and role mapping prevents access to a set of resources. ServletExec 4.1 User Guide 45
3. WEB APPLICATIONS See Section 3.4.5.2 for more information on setting up users. See Section 3.4.5.3 for more information on role mapping. See Chapter 12 of the 2.3 Java Servlet Specification for detailed information on web application security. Although there is no required order for configuring web application security, you should define all web application roles that will be referenced by a security constraint before creating the security constraint. Otherwise, you ll have to stop during the process of creating the security constraint to define a role or roles. To configure access control 1. From the Configure Access Control page (see Figure 45), choose one of the three Authentication Methods or click NONE. If you select the CLIENT-CERT method, click Submit. If you select one of the other methods, go on to Step 2. 2. Enter a Realm Name (only if you are choosing the BASIC method) and click Submit (this immediately activates the authentication method). If you are using another authentication method, go on to Step 3. 3. Enter the context-relative URL for the login form (FORM method only) into Login Form. 4. Enter the context-relative URL for the error page (FORM method only) into Error Page and click Submit. This immediately activates the authentication method. Figure 45. Configure Access Control Page (Form-based setting) A web application role is defined and known only within the context of a web application. Because a web application role is usually defined without the knowledge of the user names being used in a real deployment environment, it is meaningless without being mapped to both a user and a container role. To define a web application role From the Role Definitions page (see Figure 46), enter the name for the Role and an optional Description, and then click Submit. Important Web application security roles must be mapped to a container security role on the Manage Role Mapping page in the main ServletExec Admin UI. ServletExec 4.1 User Guide 46
3. WEB APPLICATIONS Figure 46. Define Role Page To delete a role Clear the contents in both Role and Description, and click Submit. To add a security constraint 1. From the Manage Security Constraints page (see Figure 47), click Add Constraint. This brings up the Add Security Constraint page. Figure 47. Manage Security Constraints Page 2. From the Add Security Constraint page (see ), enter a Display Name. 3. Specify the role or roles to grant access to the web resource collections in Auth. Constraint. 4. Set the communication between client and server in Data Constraint. Notes NONE indicates the web application does not require transport guarantees. CONFIDENTIAL indicates that SSL is required. 5. In Web Resource Collections, specify the name of each web application resource the constraint will protect along with its associated URL pattern and HTTP access method, and click Submit. Not specifying an HTTP method allows all methods. ServletExec 4.1 User Guide 47
3. WEB APPLICATIONS To edit a security constraint Figure 48. Add Security Constraint Page 1. From the Manage Security Constraints page (see Figure 47), click the name of the Security Constraint to edit. 2. From the Edit Security Constraints page, make your changes and click Submit to save. 3.4.7 Reloading a Web Application If you manually change a web application in any way, you will need to Reload the web application into ServletExec. To reload a web application From the Manage Web Applications page of the Admin UI, select the Reload check box for the web application you are reloading, and click Reload. 3.4.8 Removing a Web Application If you ever need to delete a web application (permanently or temporarily), you will need to use the Remove feature. One example would be if you detected a security problem with a web application and wanted to remove it from operation until the problem was resolved. ServletExec 4.1 User Guide 48
3. WEB APPLICATIONS Important Even if you are permanently removing the web application from your machine, be sure to use the Remove feature within ServletExec before deleting the web application from your hard drive. To remove a web application From the Manage Web Applications page of the Admin UI, select the Remove check box for the web application you are removing, and click Remove. ServletExec 4.1 User Guide 49
4 4. Legacy Servlets Adding and Configuring, Using Aliases, Using Filters, Viewing Logs, and Tracking Sessions for Servlets That Are Not Part of a Web Application S ervletexec allows you to deploy individual servlets independently of web applications (see Chapter 3 for a discussion of web applications). The ServletExec terminology for distinguishing between the two types of servlets is: Term Legacy Servlet Web Application Servlet Meaning Servlet that is not part of a web application Servlet that is part of a web application Table 5. Servlet Terminology The Servlets menu options in the ServletExec Admin UI provide many features for managing and configuring legacy servlets. The following sections of this chapter discuss each of these features. 4.1 Adding Servlets Before ServletExec can execute a configured servlet, you must first add it, beginning on the Manage Servlets page. Figure 49. Manage Servlets Page To add a servlet 1. From the Manage Servlets page of the Admin UI, click Add Servlet. This brings up the Add Servlet page. ServletExec 4.1 User Guide 50
4. LEGACY SERVLETS Figure 50. Add Servlet Page 2. Enter the name for invoking the servlet into Servlet Name, and press the TAB key. Note Both Servlet Name and Servlet Class are case-sensitive. 3. Enter the name of the class that contains the servlet s doget(), dopost(), or service() methods into Servlet Class. Be sure to include full package information. If this is a local servlet, go on to Step 5. If this is a remote servlet, continue with Step 4. 4. Enter the specific directory or.zip file (and complete path) that contains the class files for the remote servlet into Code Base, and press the TAB key. Skip this step for local servlets. 5. Enter the Initialization Parameters, if any, and click Submit. 4.2 Configuring Servlets In some cases, ServletExec can execute servlets that have not been configured. However, in many cases it will be necessary to configure servlets before they can be invoked. See the discussion of unconfigured servlets in Section 1.9. ServletExec 4.1 User Guide 51
4. LEGACY SERVLETS 4.2.1 Servlets That Must Be Configured Servlets must be configured if any of the following conditions are true: The servlet classes will be loaded from a remote web server. The servlet needs to be initialized when the web server initializes. The servlet requires initialization parameters. More than one instance of the servlet needs to be created. If none of the above conditions is true for a servlet, the servlet can be invoked without being configured. Figure 51. Configure Servlets Page Figure 51 shows the configuration of a fictional servlet, as it would appear in the ServletExec Admin UI. These values will be used to illustrate the following discussion. 4.2.2 Invoking Servlets ServletExec uses the Servlet Name you defined on the Add Servlet page (see Figure 51) to uniquely identify a servlet. It uses the Servlet Class (also Figure 51) to identify the Java class that implements the servlet s doget(), dopost(), or service() methods. ServletExec 4.1 User Guide 52
4. LEGACY SERVLETS Note For unconfigured servlets, Servlet Name is the name of the class that implements the doget(), dopost(), or service() methods. Use this class name wherever you would use Servlet Name in the following discussion. To invoke a servlet In the browser s Address (Internet Explorer) or Location (Netscape) window, enter the Servlet Name in a URL. Always precede the Servlet Name with the /servlet/ prefix alias. For example, the following URL invokes the servlet named Foobar: http://localhost/servlet/foobar Note The /servlet/ prefix alias and servlet name are case-sensitive in the URL. In the above example, the doget() or service() method of the Servlet Class corresponding to the servlet name Foobar is invoked. The Servlet Class is configured to be: com.newatlanta.foobarservlet The mapping of Servlet Names to Servlet Classes is arbitrary. That is, there are no rules for defining Servlet Name is based on the value of Servlet Class. Again, /servlet/ in the above URL is a prefix alias that is mapped to a physical directory by ServletExec when it looks for the Servlet Class. See the discussion on servlet directories in Section 4.2.3. One instance of the Servlet Class is created for each Servlet Name configured for that class. You may configure multiple Servlet Names for a Servlet Class to create multiple instances of that class. This may be useful if servlet behavior is controlled by initialization arguments, as different instances of a Servlet Class can be given different initialization arguments. The instance that will be invoked is determined by the Servlet Name specified in the URL. 4.2.3 Servlet Directories Servlet classes can reside on the local web server or on a remote web server. By default, local classes are placed in the Servlets directory. This is the directory to which the /servlet/ prefix alias is mapped for local servlets. Important Microsoft IIS users: Do not create a servlet virtual directory! ServletExec performs this mapping internally. If you create an IIS virtual directory named servlet, it will interfere with ServletExec s operation. ServletExec 4.1 User Guide 53
4. LEGACY SERVLETS 4.2.3.1 Servlets Directory Location The default location of the Servlets directory is within the ServletExec installation directory. (For ServletExec/AS, there is a separate Servlets directory for each ServletExec/AS instance; for ServletExec/NSAPI, there is a separate Servlets directory for each NES/iWS web server instance). You can change the name and location of the Servlets directory using the Configure Virtual Servers feature of the ServletExec Admin UI. See Chapter 7 for a discussion of virtual servers. 4.2.3.2 Servlet Classes Location Servlet classes can be stored in Java.jar/.zip archives within the Servlets directory, or the individual.class files can be placed in the Servlets directory. In the latter case, the sub-directory structure within the Servlets directory must reflect the package structure of the classes. For example, the directory structure for the servlet class com.newatlanta.foobarservlet would appear as follows: Servlets +-com +-newatlanta +-FoobarServlet.class If a servlet s classes are stored in a Java.jar/.zip archive, the archive file name must be the same as the name of the class that implements the doget(), dopost(), or service() methods, excluding package information. For example, the.jar archive for com.newatlanta.foobarservlet would be named FoobarServlet.jar and placed directly in the Servlets directory: Servlets +-FoobarServlet.jar Finally, classes that are shared by multiple servlets, or multiple instances of the same servlet, cannot be placed in the Servlets directory. Instead, such shared classes must be placed in a directory that appears in the ServletExec classpath. See Section 2.3 for a discussion of the ServletExec classpath. 4.2.4 Remote Servlets For servlet classes that reside on remote web servers, the Code Base parameter (see Figure 51) specifies the location of the directory or.jar/.zip archive that contains the servlet classes. For example: http://www.newatlanta.com/coolservlets/ http://www.newatlanta.com/servlets/coolservlet.jar The directory specified by the Code Base parameter is the directory to which the /servlet/ prefix alias is mapped for remote servlets. Do not use the Code Base parameter for local servlets. ServletExec 4.1 User Guide 54
4. LEGACY SERVLETS 4.2.4.1 Restrictions on Remote Servlets When the Security Manager is enabled, ServletExec considers remote servlets as untrusted and places the following restrictions on them. Remote servlets in ServletExec Cannot use Java networking classes Can only read a limited set of system properties Cannot invoke an external (native) process Cannot load a dynamic (native) library Cannot create a class loader Cannot perform any operations on files Cannot set stream and socket handler factories Cannot initiate print job requests Cannot access the system clipboard Because of these security restrictions, remote servlets must exist as a single.class file or.jar/.zip archive. A security exception will occur if a remote servlet exists in multiple.class files. 4.2.5 Loading, Initializing, and Reloading Servlets ServletExec passes initialization arguments to the servlet s init() method when the servlet loads. See Figure 51 for an example of configuring servlet initialization arguments. 4.2.5.1 Loading and Initializing Servlets Typically, servlets are loaded and initialized the first time they re invoked. In some cases, it may be desirable to load servlets when ServletExec initializes. For example, a servlet may create a background thread that needs to be running before the servlet is invoked the first time. The Init Load Order parameter takes a numeric value that specifies the order in which servlets load during ServletExec initialization. Servlets are loaded starting with 1, and then proceeding in ascending numerical order. Note If this parameter is left blank, the servlet does not load during ServletExec initialization, but will be loaded the first time the servlet is invoked. 4.2.5.2 Reloading Servlets Manually reloading servlets can be useful when modifications are made to remote servlet classes, or when changing servlet initialization arguments. To manually reload a legacy servlet From the Manage Servlets page, select the Reload checkbox for the appropriate servlet and click Reload (see Figure 49). ServletExec 4.1 User Guide 55
4. LEGACY SERVLETS Servlet Location Local Reload Method ServletExec examines local servlet classes for modifications whenever the servlet is invoked. It loads new classes if it has detected any changes (even if the class files reside in a Java.jar/.zip archive). Note ServletExec checks only the class that implements the doget(), dopost(), or service() methods for modifications. If other classes used by the servlet have been modified, ServletExec will not detect those changes. Remote ServletExec does not check remote servlet classes for modifications when invoking them as this could cause unacceptable performance degradation due to networking delays. Important You must manually reload remote servlets after modifying their servlet class files. Table 6. Local and Remote Servlet Reloading 4.3 Using Aliases Servlet aliases provide an alternative to the /servlet/<servlet Name> method of invoking servlets. Servlet aliases also provide a mechanism for specifying servlet chains for request processing (servlet chains are discussed in more detail in Section 4.3.4). Figure 52 illustrates the configuration of servlet aliases and serves as a reference for the remainder of this discussion. Notes The Servlet Name(s) with which a Servlet Alias is associated must be configured using the Configure Servlets page as described in Section 4.1. Servlet aliases are case-sensitive and exist in two forms: suffix and prefix. A suffix alias is one that begins with *. Any URL that ends with the suffix invokes the specified servlet or servlet chain. ServletExec 4.1 User Guide 56
4. LEGACY SERVLETS Figure 52. Servlet Aliases Page 4.3.1 Suffix Aliases In Figure 52, both *.foobar and *.tmpl define suffix aliases. With this configuration, the following URLs will be sent to the TemplateServlet for processing: http://www.newatlanta.com/templatexample.tmpl http://www.newatlanta.com/templatexample.tmpl?query=args http://www.newatlanta.com/some/path/myfile.tmpl 4.3.1.1 Suffix Aliases and File Extension Mapping As in the *.tmpl and *.foobar examples, suffix aliases are often employed to implement file extension mapping. With file extension mapping, any file with the specified extension gets mapped to the specified servlet or servlet chain. There is no requirement however, to limit use of suffix aliases to file extensions. 4.3.2 Prefix Aliases Any alias that is not a suffix alias (does not begin with * ) is automatically treated by ServletExec as a prefix alias. So, in Figure 52, /date would be a prefix alias. Any URL beginning with this prefix is routed to the DateServlet for processing, as in these examples: http://www.newatlanta.com/date http://www.newatlanta.com/dateoftoday http://www.newatlanta.com/date/today.html Notes ServletExec will automatically add the leading (forward slash) / if you don t include it when configuring a prefix alias. ServletExec 4.1 User Guide 57
4. LEGACY SERVLETS If a URL matches both a prefix and suffix alias, only the servlet or servlet chain associated with the prefix alias is invoked (prefix aliases are checked before suffix aliases). If a URL matches more than one prefix or suffix alias, ServletExec selects the longest alias. On the Servlet Aliases page, ServletExec displays servlet aliases in exactly the same order as it uses for matching servlet aliases to servlets. In short, that is to look first for prefix aliases (longest to shortest) and then to suffix aliases (longest to shortest). It does not consider alphabetical order. See Figure 52 for the order in which ServletExec compares URLs to servlet aliases. 4.3.3 ServletExec/AS Aliases For the out-of-process ServletExec/AS, in addition to configuring servlet aliases using the ServletExec Admin UI, you must also manually modify the web server configuration file(s). The following sections describe the necessary modifications for each web server. 4.3.3.1 Microsoft IIS The ServletExec/AS web server adapter configuration data for Microsoft IIS is stored in the servletexec.properties file within the C:\InetPub\scripts directory. To manually configure a servlet alias for Microsoft IIS Enter a servlet alias property name using this form: servletexec.<instance-name>.aliases=<alias list> where <instance-name> is the name of a ServletExec/AS instance. Servlet aliases follow the property name as a comma-separated list of values. Enter prefix aliases as they appear in the ServletExec Admin UI, preceded with the path separator /. Enter suffix aliases as they appear in the ServletExec Admin UI, but without the leading asterisk ( * ). For example, the aliases illustrated in Figure 52 would be configured in servletexec.properties as follows: servletexec.frodo.aliases=/date,/sv,.foobar,.tmpl,.jsp Note The above entry in servletexec.properties instructs the ServletExec/AS web server adapter for Microsoft IIS to forward HTTP requests whose URLs match any of the configured aliases to the ServletExec/AS instance named frodo. 4.3.3.2 Netscape Enterprise Server / iplanet Web Server For Netscape Enterprise Server and iplanet Web server, in addition to configuring servlet aliases using the ServletExec Admin UI, you must also add a NameTrans directive to the default object in the web server obj.conf configuration file for each alias. To manually configure a servlet alias for Netscape or iplanet The NES/iPlanet httpd.conf directives for the servlet aliases in Figure 52 would appear as follows: Enter the NameTrans directives using the form for the examples in Figure 52: ServletExec 4.1 User Guide 58
4. LEGACY SERVLETS <Object name=default> NameTrans fn= assign-name from= /date* name= frodo NameTrans fn= assign-name from= /sv* name= frodo NameTrans fn= assign-name from= *.foobar name= frodo NameTrans fn= assign-name from= *.tmpl name= frodo NameTrans fn= assign-name from= *.jsp name= frodo... </Object> <Object name="frodo"> Service fn="servletexecservice" group="frodo" </Object> Notes For suffix aliases, the from parameter of the NameTrans directive takes the same form as the alias that is configured in the ServletExec Admin UI. For prefix aliases, the from parameter includes an additional trailing asterisk ( * ). 4.3.3.3 Apache For Apache, in addition to configuring servlet aliases using the ServletExec Admin UI, you must add directives to the Apache httpd.conf configuration file for each alias. A ServletExecAliases directive must be added for each ServletExec/AS instance, which identifies all of the servlet aliases to be processed for that instance. To manually configure a servlet alias for Apache 1. Enter a ServletExecAliases directive for each ServletExec/AS instance using this format: ServletExecAliases <instance-name> <alias list> 2. In addition to the ServletExecAliases directive, you must add separate directives for each prefix and suffix alias. For each suffix alias, add an AddHandler directive to httpd.conf in the following format: AddHandler servlet-exec <suffix-alias> For each prefix alias, add a Location directive to httpd.conf in the following format: <Location /prefix-alias> SetHandler servlet-exec </Location> The Apache httpd.conf directives for the servlet aliases in Figure 52 would appear as follows: ServletExecAliases frodo /date /sv.foobar.tmpl.jsp <Location /date> SetHandler servlet-exec </Location> <Location /sv> SetHandler servlet-exec </Location> ServletExec 4.1 User Guide 59
4. LEGACY SERVLETS AddHandler servlet-exec foobar AddHandler servlet-exec tmpl AddHandler servlet-exec jsp See the ServletExec 4.1 Installation Guide for more information on the Apache httpd.conf file and configuring servlet aliases. 4.3.4 Servlet Chains Servlet chains can be configured to allow multiple servlets to process a request. You define servlet chains by specifying multiple Servlet Names, separated by commas, for a servlet alias. In Figure 52, the *.foobar suffix alias is associated with a servlet chain. Requests for URLs that end with the.foobar file extension are first processed by FooServlet. The output stream from FooServlet is directed to the input stream of BarServlet, which then produces the final output stream that is sent to the client. Generally, servlets must be specifically designed by the servlet developer to participate in servlet chains. The exception is the first servlet in the chain, which is not required to do any special processing to participate in the chain. Servlets that are not first in the servlet chain must read the output stream of the previous servlet in the chain. Note to Servlet Developers The output stream of the previous servlet in the chain is read from a ServletInputStream object, which is retrieved by invoking the getinputstream() method on the HttpServletRequest or ServletRequest object passed as a parameter to your servlet s service(), doget(), or dopost() method.). One possible use of servlet chains is to implement a complex servlet as a chain of modular servlets. Another possible use is to implement a post-processing servlet that could be chained to any other servlet (this specific, or per-chain post-processing is in contrast to the generic post-processing facility provided by Servlet Filters, discussed in the next section). 4.3.5 The invoker Servlet ServletExec recognizes a special Servlet Name that can be used to provide alternatives to the /servlet/ prefix alias used in URLs to invoke servlets. The Servlet Name invoker may be mapped to prefix aliases as shown in Figure 52. Important The name invoker must be all lowercase, and the prefix alias must not end with /. In the following example, the prefix alias /sv/ may now be used in place of /servlet/ in URLs to invoke servlets. http://localhost/sv/testservlet Note You cannot use the invoker servlet in servlet chains. ServletExec 4.1 User Guide 60
4. LEGACY SERVLETS 4.3.6 Servlets as Default Pages ServletExec allows you to invoke servlets as default pages for a web server based on suffix aliases. For example, if the default page for the web server is configured as index.jsp, ServletExec will translate directory index requests (URLs ending with / ) to /index.jsp and then forward the request to the JSP10Servlet (because of the *.jsp suffix alias). Generally, there must be a file that matches the default page name in the directories for which this feature is enabled. For example, assume a suffix alias *.dtm is defined for the DateServlet and a default page index.dtm is configured for the server. In this case, a file named index.dtm must be placed in directories for which the DateServlet is to be invoked as the default page. The contents of the index.dtm file are irrelevant. Invoking servlets as default pages is implemented slightly differently for each web server. Details of how this feature is implemented for different web servers, and their limitations (if any), are described in the following sections. 4.3.6.1 ServletExec Application Server ServletExec/AS does not support invoking servlets as default pages by any web server. 4.3.6.2 Netscape Enterprise Server and iplanet Web Server For the plugin servlet engine configurations for Netscape Enterprise Server and iplanet Web Server, ServletExec determines the default pages by extracting them from the following directive in the obj.conf file: PathCheck fn= find-index index-names="<default1>,<default2> When ServletExec receives a request for a directory index (a request URL ending with / ), it searches the directory for a default page in the order in which the default pages are listed in the PathCheck directive in obj.conf. If ServletExec finds a default page that maps to a servlet via a servlet alias, then the servlet is invoked to process the request. Note When the default pages in the PathCheck directive in obj.conf have been modified, you must restart the web server so ServletExec can incorporate the changes. 4.3.6.3 Microsoft IIS 4.0/5.0 Microsoft IIS 4.0/5.0 keeps a master list of default pages for all web sites and virtual directories, and also allows each web site and virtual directory to have its own list of default pages. ServletExec only uses the first default page in the master list of default pages for invoking servlets. When ServletExec receives a request for a directory index (a request URL ending with / ), if the first default page in the master list of default pages maps to a servlet via a servlet alias, then the servlet is invoked to process the request. The known limitations for invoking servlets as default pages with IIS 4.0/5.0 are: After modifying the default page, ServletExec must be re-initialized before it can incorporate the change. ServletExec 4.1 User Guide 61
4. LEGACY SERVLETS If the default page maps to a servlet and a request is received for a directory that doesn t contain a default page, the servlet will be invoked anyway. The first default page in the master list of default pages is used for all web sites and virtual directories. 4.4 Using Filters Servlet filters provide a facility for doing response post-processing based on the MIME type of the response. For example, in Figure 53, the servlet named Foobar is configured to filter MIME type foo/bar. Any output response stream with MIME type foo/bar produced by any servlet is redirected to the input stream of servlet Foobar. Note to Servlet Developers The output response stream is read from a ServletInputStream object, which is retrieved by invoking the getinputstream() method on the HttpServletRequest or ServletRequest object passed as a parameter to your servlet s service(), doget(), or dopost() method). Figure 53. Servlet Response Filters Page Before being configured as a servlet filter, the Servlet Name must be configured using the Configure Servlets page as described in Section 4.1. Notes Only one servlet filter can be configured per MIME type. Servlet chains cannot be used as servlet filters. MIME types are case-sensitive. Only one filter is applied per response. In other words, if a servlet that is acting as a filter produces a response with a MIME type that is also mapped to a servlet filter, the second filter is not applied. The reason for this is to prevent infinite loops of filters. For example, if the Foobar servlet produces a response with MIME type of foo/bar, that response will not be redirected back to the Foobar servlet a second time. ServletExec 4.1 User Guide 62
4. LEGACY SERVLETS 4.5 Using Servlet Logging With servlet logging enabled, if a servlet invokes its log() method, the output is written to a file named Servlet.log in the Servlet Logs directory. For virtual servers, subdirectories are created within the Servlet Logs directory for each virtual server. Servlet logging can be enabled or disabled from the ServletExec Admin UI (see Figure 54). Figure 54. Manage Servlet Logs Page Servlet log entries are buffered in memory by ServletExec and only written to the Servlet.log file after the buffer limit is exceeded. The default buffer limit is 40 entries. Clicking Purge Log Buffer causes ServletExec to immediately write the contents of the buffer to the log file. ServletExec will continue writing entries to the Servlet.log file until the log rollover limit, as specified in kilobytes, has been reached. When that happens, the Servlet.log file is renamed Servlet.log.x, where x is incremented by 1 for each rollover, and a new Servlet.log file is created. The default log rollover limit is 100 KB. 4.5.1 Advanced Logging Options From the ServletExec Logging page (see Figure 55), you can Specify the maximum number of ServletExec.log backups Modify the ServletExec.log rollover limit (in kilobytes) Specify the directory to which the ServletExec.log file and its backups are written Specify the directory to which the Servlet.log file and its backups are written ServletExec 4.1 User Guide 63
4. LEGACY SERVLETS Figure 55. ServletExec Logging Page 4.6 Viewing Loaded Legacy Servlets ServletExec provides a page where you can see, at a glance, all loaded legacy servlets. From the Loaded Servlets page, you can also unload or reload those servlets (see Figure 56). Figure 56. Loaded Servlets Page If you would like to modify the load order, go to the Manage Servlets page and change the settings in the Load Order column. 4.7 Session Tracking ServletExec implements the full Session Tracking feature of Java Servlet API 2.3. This feature allows you to maintain state information about a user visiting your web site. 4.7.1 Session Tracking Overview Session Tracking gives servlets the ability to keep state about a user as the user moves through the web site. ServletExec maintains user state by creating an HttpSession object for each visitor to the site. The HttpSession object is then passed as part of the ServletExec 4.1 User Guide 64
4. LEGACY SERVLETS request to the servlet s doget(), dopost(), and service() methods. Servlets can add information to the HttpSession objects or read information from them. When a servlet receives a request, it invokes the getsession() method of the HttpServletRequest object to obtain an existing HttpSession object or create a new one. After obtaining an HttpSession object, the servlet can invoke its setattribute() method to add state information to the object and its getattribute() method to get state information from the object. State information can be any arbitrary named objects defined by the servlet developer. ServletExec tracks the HttpSession object for a user via an internal session ID. What happens next depends upon whether cookies play a role. If cookies have been enabled from the ServletExec Admin UI and the client supports cookies, then ServletExec uses cookies to keep track of the session ID. If the client supports RFC2109 cookies, then ServletExec will use RFC2109 cookies. If not, Netscape cookies will be used. You can find more information on cookies in RFC2109 and in Netscape's Cookie Specification, which is available at: http://www.netscape.com/newsref/std/cookie_spec.html If cookies aren t an option and URL rewriting has been enabled from the ServletExec Admin UI, then ServletExec will use URL rewriting to keep track of the session ID. Note URL rewriting is disabled by default. A session can be invalidated either manually by the servlet developer by invoking the HttpSession object s invalidate() method, or automatically by ServletExec. A session will be invalidated automatically when it has been unused for a time period specified by the "Invalidation Time" setting. 4.7.2 Session Tracking Example The example in Table 7 illustrates Session Tracking. This example tracks the number of times a visitor has accessed a particular page and displays it as a counter. Step Action 1 The first thing this servlet does is retrieve the HttpSession object for the user by invoking the HttpServletRequest getsession() method. Passing true as the parameter causes ServletExec to create a new HttpSession object if one doesn t already exist. 2 The servlet then attempts to retrieve an Integer object named counter from the HttpSession object by invoking the getattribute() method. If getattribute() returns null, the servlet creates a new Integer object, initializing it to 1. Otherwise, ServletExec 4.1 User Guide 65
4. LEGACY SERVLETS the servlet increments the value of the Integer object. 3 The Integer object is then placed back into the HttpSession by invoking setattribute() so it can be retrieved again when the next request from this user is processed. 4 The servlet then outputs an HTML page back to the user including the incremented Integer value. 5 Finally, if the Integer value exceeds 100, the HttpSession is invalidated. This will cause a new HttpSession object to be created for this user the next time this servlet is accessed. 4.7.3 HttpSession Value Classes Table 7. Session Tracking Example Explained The example above stores and retrieves objects of class Integer using the setattribute() and getattribute() methods of the HttpSession object. The Integer class is part of the base java.lang package. Servlet developers are free to store and retrieve objects of any class as values in the HttpSession object. However, the class files for such classes must not be placed in the Servlets directory. Instead, they must be placed in a different directory that must then be added to the ServletExec classpath. Study the following example code. import java.io.*; import javax.servlet.*; import javax.servlet.http.*; public class SessionTest extends HttpServlet { public void doget( HttpServletRequest request, HttpServletResponse response ) throws ServletException, IOException { // get the session object (create a new one if necessary) HttpSession session = request.getsession( true ); // get the counter from the session object Integer ival = (Integer)session.getAttribute( counter ); // set the value to 1 if null, otherwise increment it ival = new Integer( ival == null? 1 : ival.intvalue() + 1 ); // write out the new session data value session.setattribute( counter, ival ); // output the page response.setcontenttype( text/html ); ServletOutputStream out = response.getoutputstream(); out.println( <html><head><title>session Tracking ); out.println( Test</title></head> ); out.println( <body><center><h1>session Tracking Test</h1> ); ServletExec 4.1 User Guide 66
4. LEGACY SERVLETS out.println( You have hit this page + ival + times. ); out.println( </center></body></html> ); out.close(); } // invalidate the session if over 100 hits if ( ival.intvalue() > 100 ) session.invalidate(); } 4.7.4 Configuring Session Tracking Example 1. Session Tracking ServletExec s Session Tracking implementation provides several possible configuration options. See Figure 57 for a sample Session Tracking page. Figure 57. Session Tracking Page (Legacy Servlets) ServletExec 4.1 User Guide 67
4. LEGACY SERVLETS To configure session tracking for a legacy servlet 1. Under Servlets on the Admin UI, click session tracking. 2. Set the options as you wish and click Submit. See Table 8 and Table 9 for detailed information on each option. Option Cookies Invalidation Interval Invalidation Time Description Enables/disables the use of cookies for the session ID. The default setting is Enabled. The interval specified in seconds when servletexec will check for sessions that have become invalid. The default value is 10 seconds. The time specified in minutes that a session could go unused before becoming invalid. The default value is 30 minutes. Max Residents The maximum number of sessions stored in memory at one time. After this limit is reached, sessions will be swapped to disk. The default value is 1024. Max Sessions Persistence Protocol Switch Rewriting Session Tracking Swap Directory Swap Interval URL Rewriting The total number of allowed sessions. The default number is 1024 Enables/disables restoring of sessions after a server restart. The default setting is Enabled. Enables/disables the rewriting of URLs to place the session ID in URLs when the URL indicates a switch from http to https or vice-versa. The default setting is Disabled. Enables/disables Session Tracking. The default setting is Enabled. Specifies the sub-directory within the server directory (within the ServletExec Data directory) where sessions are stored when they are swapped out. The default setting is sessionswap. The interval specified in seconds when servletexec will check for too many sessions in memory. The default value is 10 seconds. Enables/disables the rewriting of URLs to place the session ID in the URLs for session tracking wherever response.encodeurl( ) or response.encoderedirecturl() are used in your code. The default setting is Disabled. Table 8. Basic Session Tracking Options ServletExec 4.1 User Guide 68
4. LEGACY SERVLETS With cookies enabled, the following settings are also supported: Option Cookie Comment Cookie Domain Cookie Max Age Cookie Name Cookie Path Cookie Secure Description The value of the comment field that is sent with the session ID cookie. The comment field is only sent to clients that support RFC2109 cookies. If Cookie Comment is left blank then a comment field isn't sent. The default value is ServletExec Session Tracking Cookie. The value of the domain field that is sent with the session ID cookie. If Cookie Domain is left blank then a domain field isn't sent. The default value is null (a blank field). The maximum age of the session ID cookie. If Cookie Max Age is set to a value less than 0 then the expires field isn't sent for Netscape cookies and the Max-Age field isn't sent for RFC2109 cookies. The default value is -1. The name used for the session ID cookie. The default value is sesessionid. The value of the path field that is sent with the session ID cookie. If Cookie Path is left blank then a path field isn't sent. The default value is "/". If true, the secure field is sent with the session ID cookie. The default setting is False. Table 9. Additional Session Tracking Options With Cookies Enabled ServletExec 4.1 User Guide 69
5 5. Data Sources Managing Data Sources with ServletExec S ErvletExec allows you to add JDBC 2.0 data sources and manage them from within ServletExec. Using ServletExec s data sources management features also allows you to switch JDBC drivers or modify the settings for connecting to a database (user name and password, for example) without having to modify and recompile the servlet. 5.1 Managing Data Sources From the Manage Data Sources page (click manage under Data Sources on the Admin UI menu), you can view at-a-glance, all data sources that have been added to ServletExec, a brief description of each data source, and the availability of each data source. You can also perform the following operations: Add a data source Edit a previously added data source Remove a data source Figure 58. Initial Manage Data Sources Page 5.2 Adding a Data Source To add a data source 1. From the Manage Data Sources page (see Figure 58), click Add Data Source. This brings up the Add Data Source page. 2. From the Add Data Source page (see Figure 59), ServletExec 4.1 User Guide 70
5. DATA SOURCES Figure 59. Add Data Source Page 5.2.1 Accessing a Data Source From a Servlet When you need to access a data source from a servlet, use the following code format. To access a data source from a servlet Add code to the servlet s.java file using the following format: Context ctx = new InitialContext(); DataSource ds = (DataSource)ctx.lookup( "jdbc/<data source name>" ); 5.3 Editing a Data Source To edit a previously added data source 1. From the Manage Data Sources page (see Figure 60), click the Data Source Name to edit. This brings up the Edit Data Source page. 2. From the Edit Data Source page, make your changes and click Submit to save or Reset to restore the previous settings. 5.4 Removing a Data Source To remove a data source From the Manage Data Sources page (see Figure 60), select the Remove checkbox beside the data source you re removing and click Remove. ServletExec 4.1 User Guide 71
5. DATA SOURCES Figure 60. Removing a Data Source Note Any time the status for a data source appears as Unavailable, check the ServletExec.log for the cause. ServletExec 4.1 User Guide 72
6 6. JavaServer Pages (JSP) Server-side Scripting with Java S ervletexec implements the JavaServer Pages (JSP) 1.2 specification using the built-in JSP10Servlet. The JSP10Servlet comes preconfigured in ServletExec. This chapter describes how to modify the JSP10Servlet configuration options and how to run the example provided with ServletExec. Important If you re using ServletExec/NSAPI (the plugin servlet engine version of ServletExec for Netscape Enterprise Server or iplanet Web Server) on UNIX, you must manually add tools.jar to the classpath from the ServletExec Admin UI before invoking JSP pages. If you're using ServletExec/AS, the ServletExec installer automatically adds tools.jar to the StartServletExec script. If you receive error messages when trying JSP pages, check to make sure that tools.jar is there and, if not, manually add it. It must be present in the StartServletExec script for JSP to work properly. See Section 6.3.3 for more details. More information about JSP, including a copy of the JSP 1.2 specification, can be found on Sun s web site: http://java.sun.com/products/jsp/ 6.1 JavaServer Pages Overview The JavaServer Pages feature involves generating HTML pages from hybrid HTML/Java source files. These source files are typically named using the.jsp extension (not required, though). Java source code is embedded in.jsp pages using JSP tags that are described in the JSP 1.2 specification. The JSP10Servlet performs the following tasks at the first request for a.jsp file. Translates the.jsp file into a Java source file (.java) Compiles the Java source file into a Java class file (.class) Instantiates and runs the compiled Java class file as a servlet For subsequent requests for the.jsp page, if the requested file was modified after its initial compilation, the JSP10Servlet detects the modification and repeats the above ServletExec 4.1 User Guide 73
6. JAVASERVER PAGES tasks. If the requested file was not modified, the JSP10Servlet uses the existing servlet to handle the page request. By default, the javac compiler included with the JDK is used to compile the Java source file in the second step. You can configure the JSP10Servlet to use an external (non- JDK) compiler such as IBM s Jikes. If the compiler encounters errors while compiling a.jsp page, the output error messages are sent to the client s browser. See the example below as well as discussion of the JSP10Servlet compiler parameter farther down. For example, in order to use IBM s Jikes compiler on a Windows machine with ServletExec/ISAPI, you would configure the JSP10Servlet to take the following init parameters: compiler = D:\ibmJikes\jikes compilecommand = -classpath 'D:\jdk1.2.2\jre\lib\rt.jar;D:\Program Files\New Atlanta\ServletExec ISAPI\lib\servlet.jar;D:\Program Files\New Atlanta\ServletExec ISAPI\lib\ServletExec41.jar;D:\Program Files\New Atlanta\ServletExec ISAPI\Examples' Note You must also include all necessary classes in the classpath option that gets passed to the alternate Java Compiler through the compilecommand init argument of JSP10Servlet. 6.2 Running the JSP Example If you have problems running this test, check the ServletExec.log file for error messages. To run the JSP example provided with ServletExec 1. Place the file hangman.jsp in the web server s document root directory (hangman.jsp can be found in the Examples subdirectory of the ServletExec installation directory). 2. Add the bean newatlanta.bean.hangmanbean to the ServletExec classpath. For example, the full path to the Hangmanbean.class file for the default Microsoft IIS installation is: C:\InetPub\ServletExec ISAPI\Examples\newatlanta\bean\Hangmanbean.class Therefore, the following path should be added to the ServletExec classpath: C:\InetPub\ServletExec ISAPI\Examples See Chapter 2 for a discussion of the ServletExec classpath. Important Be sure to stop and restart your web server after modifying the ServletExec classpath. Invoke the hangman.jsp page from a browser using the following URL: http://localhost/hangman.jsp ServletExec 4.1 User Guide 74
6. JAVASERVER PAGES 6.3 Configuring JavaServer Pages The JSP10Servlet comes preconfigured in ServletExec and requires no manual configuration steps before using JSP. Notes The JSP10Servlet will not appear on a web application s admin pages as it is implicitly configured in ServletExec and not in the web application s web.xml file. It will only appear on a web application s admin pages and in its web.xml file if it has been configured with init arguments. Mapping of the.jsp extension to the JSP10Servlet also comes preconfigured in ServletExec. It also will not appear on a web application s admin pages. You might want to use this section to verify your ServletExec installation or to make changes to the current settings. To use JSP with ServletExec 1. Configure the JSP10Servlet. 2. Assign a servlet alias to the JSP10Servlet. 3. Add tools.jar to the ServletExec classpath if it isn t already there. The rest of this section discusses each of these configuration steps. 6.3.1 Configuring the JSP10Servlet To use the JSP10Servlet, the servlet class: com.newatlanta.servletexec.jsp10servlet must be configured using the ServletExec Admin UI with the Servlet Name JSP10Servlet. See Section 4.1 for instructions on how to configure servlet names. Note The JSP10Servlet is preconfigured in ServletExec and does not need to be modified unless you need to change the value of the init arguments, which are discussed below. You may assign optional initialization (init) arguments when the JSP10Servlet is configured. None of the init arguments is preconfigured and all take their default values unless explicitly modified using the ServletExec Admin UI. The JSP10Servlet supports the following init arguments: Argument compileaterrestart Description If true, then after a web server restart all.jsp pages are recompiled even if they haven t been modified. This is necessary so that.class files used by a.jsp page that may have been modified will be recompiled ServletExec 4.1 User Guide 75
6. JAVASERVER PAGES Argument compilecommand compiler DefaultPageClassName errorpage packagelevel packageprefix Description (even if the.jsp page hasn t changed). Normally this situation occurs during development, so this parameter should be set to true during development and reset to false for production. The default value is false. Specifies the compiler options to use when compiling the Java files (for example: compilecommand=-classpath C:\myclasses). The default value for this argument is null. Specifies the path to the executable for an external (non-jdk) Java compiler to be used to compile the JSP pages (on Windows the path to the executable must not include the.exe extension). Servletexec has been tested with IBM s jikes compiler. If using this compiler, the compilecommand argument must be used to specify the classpath (see above). The default value for this argument is null, which causes the JDK javac compiler to be used. Indicates the default base class for JSP pages. You can override the default base class by using the extends JSP directive. Default value is JSP10HttpJspPage. The specified class must meet all of the requirements for a JSP base class as specified in JavaServer Pages Specification 2.3. Specifies a URL to be invoked when a JSP error occurs (for example: /error.html or /servlet/errorservlet). Specifies the number of subdirectories from the root document directory path to be prepended to the class name as packages. This argument only needs to be used when virtual servers are used, but not configured using the ServletExec Admin UI. In this case, the value of 1 for this argument should be adequate to insure that the JSP pages generated for each virtual server have a unique class name. The default value is 0. The package to prepend to the class name. The default value for this argument is pagecompile. ServletExec 4.1 User Guide 76
6. JAVASERVER PAGES Argument pagecheckseconds urlrewriting Verbose workingdir Description The time in seconds the JSP10Servlet should wait after the last check before checking to see if a JSP page has been modified and needs to be recompiled. Setting this parameter will improve performance because it will reduce the number of times the JSP10Servlet accesses the file system. If set to 0, the JSP10Servlet checks a JSP page for modifications every time the page is accessed. The default value is 0. If true, then all URLs in a JSP page are rewritten with the Session ID if URL rewriting is enabled for Session Tracking. The default value is false. If true, prints a message to System.out when compiling a file. The default is false. The directory for storing the generated.java and.class files. The default value for this argument is the servlets directory (non-web application JSP pages) or the web application s configuration directory under the ServletExec Data directory (web application JSP pages). See Section 4.2.3 for a discussion of the servlets directory. 6.3.2 Assigning a Servlet Alias Table 10. JSP10Servlet Supported Init Arguments To use the JSP10Servlet, the JSP10Servlet name must be mapped to the servlet suffix alias *.jsp. See Chapter 4 for instructions on configuring servlet names and aliases. Note The JSP10Servlet name and *.jsp alias are preconfigured in ServletExec and do not need to be modified unless you want to map JSP pages using a different suffix alias. 6.3.3 Adding tools.jar to the Classpath If you re using a JDK along with the default javac compiler for compiling JSP pages, the file tools.jar must appear in the ServletExec classpath. For most configurations, ServletExec automatically adds tools.jar to its classpath and you don t need to do anything. If you re running ServletExec/NSAPI (the plugin servlet engine version of ServletExec 4.1 User Guide 77
6. JAVASERVER PAGES ServletExec for Netscape Enterprise Server or iplanet Web Server) on UNIX, you must add tools.jar to the classpath for JSP to work properly. See Chapter 2 for a discussion of the ServletExec classpath. Note The tools.jar file may be missing from the classpath in certain cases, such as when switching from a JRE to a JDK. 6.4 Using JavaServer Pages The JSP10Servlet reads a.jsp file that contains embedded JSP directives, JSP declarations, JSP scriptlets, JSP expressions and JSP beans, then parses the file and creates a servlet that generates the HTML response page. See the JSP 1.2 specification for a complete description of the JSP syntax: http://java.sun.com/products/jsp/ Tip Using the Add a Tag Library feature in ServletExec (see page 38) greatly simplifies JSP management by eliminating the need to make changes to JSPs after a TLD is moved. 6.4.1 nvoking a JSP Page From a Servlet A servlet can invoke a JSP page using the RequestDispatcher interface. Here's an example: RequestDispatcher dispatcher = getservletcontext().getrequestdispatcher( "/mypage.jsp" ); dispatcher.include( request, response ); // request and response are the parameters to the servlet s service(), // doget(), or dopost() method 6.5 Microsoft IIS Extension Mapping You can use the Extension Mapping feature of Microsoft IIS 4.0/5.0 to control access to JSP pages with NT File System (NTFS) security. To enable Extension Mapping in IIS 5.0 1. Click Start, point to Settings and click Control Panel. 2. In Control Panel, double-click Administrative Tools. 3. In Administrative Tools, double-click Services. 4. In the Services control panel, click IIS Admin Service and click Stop. 5. Edit the servers.properties file (which can be found in the ServletExec Data directory) by setting the value of the servletexec.useiisextmapping property to true. ServletExec 4.1 User Guide 78
6. JAVASERVER PAGES 6. Add.jsp to the Microsoft IIS extension map: 7. Click Start, point to Settings and click Control Panel. 8. In Control Panel, double-click Administrative Tools. 9. In Administrative Tools, double-click Internet Services Manager. 10. Open Properties for your server. First, expand Internet Information Server until you can see the icon for your server. Then right-click the server icon and select Properties from the pop-up menu. 11. Make sure WWW Service is selected in the Master Properties list, and click Edit. 12. In the WWW Service Master Properties dialog, click the Home Directory tab, and then click Configuration. This will open the Application Configuration dialog. 13. In the Application Configuration dialog, click Add to open the Add/Edit Application Extension Mapping dialog. 14. In the Add/Edit Application Extension Mapping dialog, set the Executable field to the path to the ServletExec_ISAPI.dll file and set the Extension field to.jsp. Make sure the Check that file exists checkbox is selected. See Figure 62 for an example. 15. Click OK to close all dialogs. Important Figure 61. Add/Edit Application Extension Mapping (IIS 5.0) After setting the value of the servletexec.useiisextmapping property to true in Step 2, you must configure all ServletExec suffix aliases using IIS Extension Mapping. If the suffix alias does not map to a physical file (unlike.jsp) then do not check the Check that file exists checkbox in the Add/Edit Application Extension. To enable Extension Mapping in IIS 4.0 1. In the Services control panel, click IIS Admin Service and click Stop. 2. Edit the servers.properties file (which can be found in the ServletExec Data directory) by setting the value of the servletexec.useiisextmapping property to true. ServletExec 4.1 User Guide 79
6. JAVASERVER PAGES 3. Add.jsp to the Microsoft IIS extension map: 4. Open Internet Service Manager (Microsoft Management Console). 5. Open Properties for your server. First, expand Internet Information Server until you can see the icon for your server. Then right-click the server icon and select Properties from the pop-up menu. 6. Make sure WWW Service is selected in the Master Properties list, and click Edit. 7. In the WWW Service Master Properties dialog, click the Home Directory tab, and then click Configuration. This will open the Application Configuration dialog. 8. In the Application Configuration dialog, click Add to open the Add/Edit Application Extension Mapping dialog. 9. In the Add/Edit Application Extension Mapping dialog, set the Executable field to the path to the ServletExec_ISAPI.dll file and set the Extension field to.jsp. Make sure the Check that file exists checkbox is selected. See Figure 62 for an example. 10. Click OK to close all dialogs. Important Figure 62. Add/Edit Application Extension Mapping (IIS 4.0) After setting the value of the servletexec.useiisextmapping property to true in Step 2, you must configure all ServletExec suffix aliases using IIS Extension Mapping. If the suffix alias does not map to a physical file (unlike.jsp) then do not check the Check that file exists checkbox in the Add/Edit Application Extension. ServletExec 4.1 User Guide 80
7 7. Virtual Servers Configuring ServletExec for Multi-hosting Environments S ervletexec has several unique features for supporting virtual servers in multihosting environments. Multi-hosting is a web server feature whereby a single physical server hosts multiple virtual servers with different domain (or host) names. For example, a single physical server may host both www.abc.com and www.xyz.com. In multi-hosting environments, you can set ServletExec configuration options separately for each virtual server. You can also define a separate admin username, password, and allowed client IP addresses for accessing the ServletExec Admin UI for each virtual server. 7.1 Hardware and Software Virtual Servers Virtual server implementations come in two forms. One form, known as Hardware Virtual Servers (or IP-based Virtual Servers) assigns a different IP address to each virtual server. In the other form, known as Software Virtual Servers, the physical server has only a single IP address. The main effect on ServletExec of the form of virtual server implementation in use is the manner in which the document root directory is defined for each virtual server. You will set most of ServletExec s multi-hosting configuration options using the ServletExec Admin UI. Netscape and Apache servers may require additional directives in the obj.conf or httpd.conf configuration files, respectively. See the following sections for more information on multi-hosting configurations. See the ServletExec 4.1 Installation Guide for additional discussion of these configuration files. 7.2 Microsoft IIS Microsoft IIS only supports virtual servers on Windows NT Server and Windows 2000 Server. Virtual servers are not supported on Windows NT Workstation, Windows 2000 ServletExec 4.1 User Guide 81
7. VIRTUAL SERVERS Professional, or Windows 95/98. Both hardware and software virtual servers are supported by IIS 4.0 and 5.0. Notes The document root directory is specified for each virtual server during IIS configuration. For each IIS virtual server, you must define a virtual scripts directory that maps to the physical directory that contains the ServletExec_ISAPI.dll file. The virtual directory must have execute permission enabled. For the default web site, this is the SCRIPTS virtual directory, which maps to the C:\InetPub\Scripts physical directory. 7.3 Netscape Enterprise Server / iplanet Web Server Netscape web servers support both hardware and software virtual servers. Hardware virtual servers require a separate NameTrans directive to be added to the obj.conf file for each virtual server. See the ServletExec 4.1 Installation Guide for discussion of the obj.conf file. In software virtual servers, the web server document root is the document root directory for all virtual servers. No additional configuration is required for ServletExec. In addition to supporting multiple virtual servers, Netscape web servers allow you to install multiple instances of the web server. Each server instance is associated with a unique IP address and/or port. Notes You must install ServletExec separately for each Netscape server instance. Server instances (and ServletExec) are configured independently, as if each were a standalone server. 7.4 ServletExec/AS and Virtual Servers For ServletExec/AS, it s possible to configure the web server adapter(s) to forward requests to a specific ServletExec/AS instance based on the virtual server to which the request is addressed. For example, you can install two ServletExec/AS instances and configure the web server adapter(s) to forward requests for www.abc.com to one instance and www.xyz.com to the other. See the following sections for details on the different web servers. 7.4.1 Microsoft IIS Configuration data for the ServletExec/AS web server adapter for Microsoft IIS is stored in the servletexec.properties file with the directory where the ServletExec_Adapter.dll file is installed. The default installation directory is: C:\InetPub\scripts. ServletExec 4.1 User Guide 82
7. VIRTUAL SERVERS Mapping of requests from virtual hosts to ServletExec/AS instances is controlled using the servletexec.<instance-name>.hosts directives. For example, the following directives: servletexec.frodo.hosts=www.abc.com servletexec.bilbo.hosts=www.xyz.com will cause requests for www.abc.com to be forwarded to the ServletExec/AS instance named frodo, and requests for www.xyz.com to be forwarded to the ServletExec/AS instance named bilbo. See the comments in the servletexec.properties file for more information. 7.4.2 Netscape Enterprise Server / iplanet Web Server The NES/iWS obj.conf configuration file provides the configuration parameters for the ServletExec/AS web server adapter for NES/iWS. The NameTrans directive is used to map incoming requests to ServletExec/AS instances. For example, the following directives: NameTrans fn="assign-name" address="192.168.200.24" from="/servlet/*" name="frodo" NameTrans fn="assign-name" address="192.168.200.67" from="/servlet/*" name="bilbo" will cause all servlet requests that are addressed to 192.168.200.24 and whose URL begins with the prefix /servlet/ to be forwarded to the ServletExec/AS instance named frodo. All requests that are addressed to 192.168.200.67 and whose URL begins with the prefix /servlet/ will be forwarded to the ServletExec/AS instance named bilbo. See the ServletExec 4.1 Installation Guide for additional information about obj.conf directives for ServletExec/AS. 7.4.3 11.4.3 Apache HTTP Server The Apache httpd.conf configuration file provides the configuration parameters for the ServletExec/AS web server adapter for Apache. The ServletExecInstances, ServletExecApplications, and ServletExecAliases directives are used to map incoming requests to ServletExec/AS instances. Consider the following directives: <VirtualHost www.abc.com> ServletExecInstances frodo 127.0.0.1:8888 ServletExecApplications frodo /example ServletExecAliases frodo /servlet.jsp </VirtualHost> <VirtualHost www.xyz.com> ServletExecInstances bilbo 127.0.0.1:8889 ServletExecApplications bilbo /example ServletExecAliases bilbo /servlet.jsp </VirtualHost> The first set of directives maps incoming servlets requests for www.abc.com to the ServletExec/AS instance named frodo. The second set of directives maps incoming servlet requests for www.xyz.com to the ServletExec/AS instance named bilbo. ServletExec 4.1 User Guide 83
7. VIRTUAL SERVERS See the ServletExec 4.1 Installation Guide for additional information about httpd.conf directives for ServletExec/AS. 7.5 The default Server ServletExec automatically creates the configuration options for a server named default the first time it initializes. ServletExec uses the configuration options for the default server when an HTTP request is received for an unconfigured virtual server. It isn t necessary to configure all (or any) virtual servers. ServletExec will use the configuration options for the default server for unconfigured servers. For single-host environments, do not configure a virtual server. Instead, use (or modify) the configuration options for the default server. 7.6 Configuring a Virtual Server Figure 63 illustrates how to configure a virtual server using the ServletExec Admin UI. To configure a virtual server, you must specify the host name of the server (i.e., www.abc.com ) in the Server Name field and the path to the Servlets Directory. Notes The Servlets Directory path must be specified as a full path. Multiple virtual servers may share a Servlets directory. Figure 63. Configure Server Page ( default virtual server) For Windows, use the \ character as the file separator when specifying directory paths. For UNIX, use /. ServletExec 4.1 User Guide 84
7. VIRTUAL SERVERS All path specifications must end with the file separator. If you omit the trailing file separator, ServletExec will add it for you. Here are some examples of path specifications for the Servlets directory: Windows C:\InetPub\ServletExec ISAPI\Servlets\ UNIX /usr/netscape/suitespot/docs/ The Error Page field is used to specify a URL that will be invoked by ServletExec when an error occurs during processing of a servlet for the virtual server. URLs must be specified as relative paths from the web server root, for example: /error.html /servlet/myerrorservlet The User Name and Allowed IPs fields are discussed below. 7.7 Administering Virtual Servers After configuring virtual servers, any time you bring up a ServletExec Admin UI page, the host name of the virtual server appears at the top of the page. The default server displays default. Note Until you configure a virtual server, all pages operate on the default server and default is omitted. The user name and password defined for a virtual server provide access to the configuration options for that server. For Microsoft IIS on Windows NT, the Password field is not displayed. Instead, the User Name must be that of a Windows user. ServletExec uses the password defined for the Windows user for authenticating access to the ServletExec Admin UI. The Allowed IPs field allows you to specify a comma-separated list of IP addresses from which clients may bring up the ServletExec Admin UI for a virtual server. The specified IP addresses may include the * character to represent all IP addresses in a subrange. For example, the following list of IP addresses would allow access to the ServletExec Admin UI from a client with the IP address 168.121.97.133, or any IP address in the range from 204.84.126.1 to 204.84.126.255: 168.121.97.133,204.84.126.* ServletExec always allows access to the ServletExec Admin UI from the local machine on which ServletExec is running regardless of the setting of the Allowed IPs field. To bring up the virtual server s admin pages, use the following URL: http://<server-name>/servlet/admin where <server-name> is the host name of the virtual server. If the user name and password for a virtual server are not defined (left blank), only the ServletExec Admin user (as defined on the License and Security page) can access the configuration options for that server. The ServletExec Admin user name and password can be used to access the options for any virtual server. ServletExec 4.1 User Guide 85
7. VIRTUAL SERVERS To access the configuration options for the default server, use the host name of an unconfigured server or the IP address of the server as the <server-name> in the admin URL. If multiple hardware virtual servers are defined, use the IP address of any virtual server. Only the ServletExec Admin user is allowed to access the configuration options for the default server. Only the ServletExec Admin user is allowed to access the following ServletExec Admin UI pages: License Logging Virtual Servers Security VM Settings (or Classpath) Session Tracking 7.8 Compatibility with Older Browsers To support multiple virtual servers, ServletExec relies on receiving the server host name from the browser in the Host field of the HTTP request headers. Some older browsers do not set the Host field. When receiving requests from these browsers, ServletExec uses the configuration for the default server. If there is no default server configured, the browser will receive a 404 Not Found result. If there is a default server configured, servlets that access files may have problems because they may not receive the proper document root directory for the virtual server. The following browsers are known to support the HTTP request header Host field: Netscape Navigator 2.0 and higher (Windows, UNIX) Microsoft Internet Explorer 3.0 and higher (Windows) ServletExec 4.1 User Guide 86
8 8. Servlet Security Securing System Resources for Servlets B y default, servlets that reside on the local web server have very broad security privileges and almost unlimited access to services provided by the host operating system. ServletExec always considers remote servlets (with Security Manager enabled) as untrusted and greatly reduces their security privileges. For more information, see Section 4.2.4. By enabling ServletExec s built-in Servlet Security Manager, it s possible to limit the security privileges of local servlets, and to define such limits per virtual server. This feature is particularly useful to web hosting service providers who are hosting multiple domains on a single physical server, because servlet security privileges and restrictions can be set per domain. Figure 64. Servlet Security Manager Page (disabled) ServletExec 4.1 User Guide 87
8. SECURITY FOR LEGACY SERVLETS 8.1 Using the Servlet Security Manager 8.1.1 Enabling Servlet Security Manager By default, ServletExec s built-in Servlet Security Manager is disabled and must be enabled before servlet security restrictions can be configured. To enable Servlet Security Manager 1. On the Admin UI, click servlet security under Advanced. This brings up the Servlet Security page (see Figure 64 for an example). 2. Click Enable Security Manager. 3. Restart the web server or ServletExec/AS instance. 8.1.2 Resolving SecurityExceptions After Enabling Security Manager Beginning with JDK 1.2, the JDK security scheme changed. This has resulted in some Java VM security settings not being available from the Servlet Security page. If you are seeing SecurityExceptions, edit the java.policy file to give permission to your servlet to perform the task it is trying to perform. If you want to give permission to your servlets to do everything, add the following to your java.policy file: grant { permission java.security.allpermission; }; For more information on the java.policy file and adding entries, see: http://www.javasoft.com/products/jdk/1.3/docs/guide/security/index.h tml http://www.javasoft.com/products/jdk/1.3/docs/guide/security/permiss ions.html 8.1.3 Disabling Servlet Security Manager If you need to disable Servlet Security Manager and can no longer access the Admin UI, use the following procedure To disable Servlet Security Manager without access to the Admin UI 1. Make sure ServletExec isn t running. 2. Remove the VMSettings.pref. file from the ServletExec Data folder. 3. Restart ServletExec. 8.2 Configuring Servlet Security After enabling the Servlet Security Manager as described above, you can enable or disable the following security privileges for local servlets per virtual server, as Figure 65 shows: ServletExec 4.1 User Guide 88
8. SECURITY FOR LEGACY SERVLETS Security Privilege Clipboard Access Create Class Loader Load Dynamic Library Description (when enabled) Allows servlets to access the system clipboard. Allows servlets to create custom Java class loaders. This privilege should remain enabled in most cases because the ServletExec built-in JSP10Servlet must be able to create custom class loaders. Allows servlets to load native libraries. This privilege must remain enabled if servlets use third party libraries that invoke native modules (such as the JDBC-ODBC Bridge). Allows servlets to create network sockets to initiate Networking (Connect) outgoing connections. Networking Allows servlets to create network sockets to listen for (Listen) incoming connections. Print Job Access Allows servlets to initiate print job requests. Set Factory Allows servlets to set socket and stream handler factories. Start New Allows servlets to invoke external (native) operating Process system processes. System Allows servlets to read Java VM system properties. Properties This privilege should remain enabled in most cases (Read) because some system classes (such as PrintWriter) need System Properties (Write) access to system properties. Allows servlets to write Java VM system properties. Table 11. Servlet Security Manager Security Privileges In addition to specifying these privileges, you can define the directories and files to which servlets have read and/or write access. The value all gives servlets unlimited access to directories and files (this is the default). ServletExec 4.1 User Guide 89
8. SECURITY FOR LEGACY SERVLETS Figure 65. Servlet Security Manager Page (enabled) If you decide to restrict servlet access to specific directories, keep in mind that servlets must have access to the following directories: The Servlets directory for the virtual server The properties directory for the virtual server. For example: C:\InetPub\ServletExec ISAPI\ServletExec Data\<virtual server> The virtual server s document root directory All paths in the ServletExec classpath, including the JDK classpath. Normally this means giving access to the JDK installation directory (for example: C:\jdk1.3.1) and all directories added to the ServletExec classpath. See Section 2.3 for more information. 8.3 Microsoft IIS Security Because of the way ServletExec filters HTTP requests to forward them to servlets, the built-in security of the Microsoft IIS server cannot be used to protect URLs that invoke ServletExec 4.1 User Guide 90
8. SECURITY FOR LEGACY SERVLETS servlets. To work around this limitation, ServletExec provides a way to protect such URLs. On the IIS Security/Groups page, as illustrated in Figure 66, you can define ServletExec Groups that contain Windows NT Users. Important In order for this feature to work properly, you must disable HTTP Keep-Alives for your web site. Figure 66. Groups Page (IIS Security) To disable HTTP Keep-Alives in IIS 4.0 1. Open Internet Service Manager (Microsoft Management Console). 2. Open Properties for your server. First, expand Internet Information Server until you can see the icon for your server. Then right-click the server icon and select Properties from the pop-up menu. 3. Open the Properties dialog for your server and click the Performance tab. 4. De-select the HTTP Keep-Alives Enabled checkbox. 5. Click OK. On the IIS Security/Resources page, you can restrict access to a servlet or URL that invokes a servlet, to specified ServletExec Groups and/or Windows NT Users, as illustrated in Figure 67. To protect a servlet in IIS Enter the servlet name in Resource, the ServletExec Groups and/or Windows NT Users that are allowed to access the servlet, and click Submit. To protect a URL that invokes a servlet in IIS Enter the URL in Resource, the ServletExec Groups and/or Windows NT Users that are allowed to access the servlet, and click Submit. Note Entering a URL resource will cause all URLs that begin with the URL resource to be protected. ServletExec 4.1 User Guide 91
8. SECURITY FOR LEGACY SERVLETS Figure 67. Resources Page (IIS Security) ServletExec 4.1 User Guide 92
9 9. Resource Monitoring Monitoring Resources with ServletExec M onitoring your application server resources within ServletExec is very easy. ServletExec s resource monitoring features allow you to view, in real-time, how ServletExec is handling its load. Monitoring these resources will give you the necessary information, should you need to adjust your system. Specifically, you can monitor Requests Sessions Threads In addition to just viewing the displayed information, you can also modify how that information gets displayed, and perform other operations. See the following sections for detailed information. 9.1 Monitoring Requests The Monitor Requests page (see Figure 68) provides an at-a-glance display of all current and maximum requests. In addition to viewing the current and maximum requests, you can also: Clear the number of maximum requests for all legacy servlets or a web application (just select the Reset Maximum Requests checkbox and click Reset) Modify the page s refresh interval (just change the existing value and click Submit) Clear the number of maximum requests for all legacy servlets and web applications (simply click Reset All) Note The dash ( ) listing under Application Name reflects the totals for all requests that are not part of a web application. ServletExec 4.1 User Guide 93
9. RESOURCE MONITORING Figure 68. Monitor Requests Page 9.2 Monitoring Sessions The Monitor Sessions page (see Figure 69) shows all currently active and maximum active sessions. In addition, you can also modify the page settings as follows. Clear the number of maximum sessions for either all legacy servlets (the none listing under Application Name) or an individual web application (just select the Reset Max Active checkbox and click Reset) Modify the page s refresh interval (just change the existing value and click Submit) Clear the number of maximum sessions for all legacy servlets and web applications (click Reset All) Note The dash ( ) listing under Application Name reflects the totals for all sessions that are not part of a web application. ServletExec 4.1 User Guide 94
9. RESOURCE MONITORING Figure 69. Monitor Sessions Page 9.3 Monitoring Threads The Monitor Threads page (see Figure 70) provides a display of all running threads, along with the group, start time, and priority information for each thread. Note Start Time information is only available for threads that are processing a request. In addition to viewing this thread information, you can also: Modify the page s refresh interval (just change the existing value and click Submit) Kill a specific request thread (select the Kill checkbox and click Submit) Warning Use this with caution. Killing request threads could create an unknown state for resources. ServletExec 4.1 User Guide 95
9. RESOURCE MONITORING Figure 70. Monitor Threads Page ServletExec 4.1 User Guide 96