creating a domain with WLST

in WLS 12.1 + the config.sh script no longer supports a silent installation

./config.sh -silent -response response_file

see Document "Can config.sh be Run in Silent or Non-GUI Mode in Weblogic 12c ? (Doc ID 2370636.1) "

"The configuration tool only works in GUI mode with 12.1.x and above. In order to create a domain without using a GUI the WLST tool will need to be used. "


this is really stupid, 99% of Linux machines are headless

and using UI defeats automation



here how to create a domain with WLST:

https://docs.oracle.com/middleware/1221/wls/WLSTG/domains.htm#WLSTG429

but when you do:

selectTemplate('Base WebLogic Server Domain')

you get a

Caused by: com.oracle.cie.domain.script.ScriptException: 60708: Template not found.

60708: Found no templates with Base WebLogic Server Domain name and null version

60708: Select a different template.

        at com.oracle.cie.domain.script.ScriptExecutor.selectTemplate(ScriptExecutor.java:556)

        at com.oracle.cie.domain.script.jython.WLScriptContext.selectTemplate(WLScriptContext.java:580)

do a showAvailableTemplates()


'20849: Available templates.\n20849: Currently available templates for loading: WebLogic Advanced Web Services for JAX-RPC Extension:12.2.1.3.0\nWebLogic Advanced Web Services for JAX-WS Extension:12.2.1.3.0\nWebLogic JAX-WS SOAP/JMS Extension:12.2.1.3.0\nBasic WebLogic Server Domain:12.2.1.3.0\nWebLogic Coherence Cluster Extension:12.2.1.3.0\n\n20849: No action required.\n'



so the solution is


selectTemplate('Basic WebLogic Server Domain', '12.2.1.3.0')


To find out more info on the domain template (like wls.jar) open its template-info.xml

REST Management Services in weblogic reverse engineered

wls-management-services.war

only Administrator and Operator can invoke

weblogic.management.rest.Application main entry point

weblogic.management.rest.bean.utils.load.BuiltinResourceInitializer : all the MBeans are loaded here


weblogic.management.runtime.ServerRuntimeMBean



weblogic.management.rest.wls.resources.server.ShutdownServerResource this is the REST endpoint

@POST
@Produces({"application/json"})
public Response shutdownServer(@QueryParam("__detached") @DefaultValue("false") boolean detached, @QueryParam("force") @DefaultValue("false") boolean force, @PathParam("server") String name) throws Exception {
return this.getJobResponse(name, ServerOperationUtils.shutdown(this.getRequest(), name, detached, force), new ShutdownJobMessages(this));
}



weblogic.management.rest.wls.utils.ServerOperationUtils




From MBean:

com.bea.console.actions.core.server.lifecycle.Lifecycle$AdminServerShutdownJob

http://localhost:7001/console/jsp/core/server/lifecycle/ConsoleShutdown.jsp

weblogic.t3.srvr.GracefulShutdownRequest
weblogic.t3.srvr.ServerGracefulShutdownTimer



via JMX:

weblogic.management.mbeanservers.runtime.RuntimeServiceMBean extends Service : String OBJECT_NAME = "com.bea:Name=RuntimeService,Type=weblogic.management.mbeanservers.runtime.RuntimeServiceMBean"

public interface ServerRuntimeMBean extends RuntimeMBean, HealthFeedback, ServerStates, ServerRuntimeSecurityAccess
void shutdown(int var1, boolean var2, boolean var3) throws ServerLifecycleException;



https://docs.oracle.com/middleware/1221/wls/WLAPI/weblogic/management/runtime/ServerRuntimeMBean.html#shutdown_int__boolean__boolean_







For a list of REST Examples see also https://docs.oracle.com/middleware/12212/wls/WLRUR/WLRUR.pdf


----------------------------------------------------------------------
Asynchronously force shutdown a server
----------------------------------------------------------------------
curl -v \
--user operator:operator123 \
-H X-Requested-By:MyClient \
-H Accept:application/json \
-H Content-Type:application/json \
-d "{}" \
-H "Prefer:respond-async" \
-X POST http://localhost:7001/management/weblogic/latest/domainRuntime/
serverLifeCycleRuntimes/Cluster1Server2/forceShutdown

HTTP/1.1 202 Accepted
Location: http://localhost:7001/management/weblogic/latest/domainRuntime/
serverLifeCycleRuntimes/Cluster1Server2/tasks/_3_forceShutdown

REST interface to manage WLS

this works like magic:


curl -s -v --user weblogic:weblogic0 -H X-Requested-By:MyClient -H Accept:application/json -H Content-Type:application/json -d "{timeout: 10, ignoreSessions: true }" -X POST http://localhost:7001/management/wls/latest/servers/id/AdminServer/shutdown


Problem comes when you have only HTTPS, and even worse with 2 way SSL. Then you are screwed - pardon my french - because curl stupidly uses only pem certificates, so if you have p12 you must convert the p12 into 2 separate files, certificate and private key :


openssl pkcs12 -in mycert.p12 -out file.key.pem -nocerts -nodes
openssl pkcs12 -in mycert.p12 -out file.crt.pem -clcerts -nokeys
curl -E ./file.crt.pem --key ./file.key.pem https://myservice.com/service?wsdl

CORRECTION: it seems that CURL does support now p12 certs: curl --cert-type P12 ...https://curl.haxx.se/docs/manpage.html BUT only if you use the Apple Library "Secure Support" or something like that, not if you use NSS or OpenSSL libraries (do "curl -V" to find out)


See more here https://docs.oracle.com/middleware/1221/wls/WLRUR/using.htm#WLRUR180


return all servers:

curl -s --user weblogic:weblogic0 http://localhost:7001/management/weblogic/latest/edit/servers

WebLogic, dramatic reduction of TLS sessions creation by rejectClientInitiatedRenegotiation

why the TLS Sessions are constantly invalidated, removed from cache and recreated, discovering that it's WLS SSLConfigUtils.configureClientInitSecureRenegotiation() who initiates this:

at sun.security.ssl.SSLSessionContextImpl.remove(SSLSessionContextImpl.java:132)

at sun.security.ssl.SSLSessionImpl.invalidate(SSLSessionImpl.java:673)

at weblogic.socket.utils.SSLConfigUtils.configureClientInitSecureRenegotiation(SSLConfigUtils.java:27)

at weblogic.socket.JSSEFilterImpl.doHandshake(JSSEFilterImpl.java:135)

at weblogic.socket.JSSEFilterImpl.isMessageComplete(JSSEFilterImpl.java:354)

at weblogic.socket.SocketMuxer.readReadySocketOnce(SocketMuxer.java:976)

at weblogic.socket.SocketMuxer.readReadySocket(SocketMuxer.java:917)

at weblogic.socket.NIOSocketMuxer.process(NIOSocketMuxer.java:599)

at weblogic.socket.NIOSocketMuxer.processSockets(NIOSocketMuxer.java:563)

at weblogic.socket.SocketReaderRequest.run(SocketReaderRequest.java:30)

at weblogic.socket.SocketReaderRequest.execute(SocketReaderRequest.java:43)

at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:147)

at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:119)

the code responsible is:

public static void configureClientInitSecureRenegotiation(SSLEngine sslEngine, boolean clientInitSecureRenegotiation)

 {

   if (!IS_JDK_CLIENT_INIT_SECURE_RENEGOTIATION_PROPERTY_SET)

   {

     if ((sslEngine != null) && (!sslEngine.getUseClientMode()))

     {

       if (!clientInitSecureRenegotiation) {

         sslEngine.getSession().invalidate();

       }

       sslEngine.setEnableSessionCreation(clientInitSecureRenegotiation);

       if (isLoggable()) {

         SocketLogger.logDebug(clientInitSecureRenegotiation ? "Enabled" : "Disabled TLS client initiated secure renegotiation.");

       }

     }

   }

   else if (isLoggable()) {

     SocketLogger.logDebug("TLS client initiated secure renegotiation setting is configured with -Djdk.tls.rejectClientInitiatedRenegotiation");

   }

 }

so the invalidate() is called only if !clientInitSecureRenegotiation , but it appears that clientInitSecureRenegotiation=isClientInitSecureRenegotiationAccepted is always FALSE





in JSSESocketFactory:

  JSSEFilterImpl getJSSEFilterImpl(Socket connectedSocket, String host, int port)

    throws IOException

  {

    SSLEngine sslEngine = getSSLEngine(host, port);

    return new JSSEFilterImpl(connectedSocket, sslEngine, true);

  }

in JSSEFilterImpl:

public JSSEFilterImpl(Socket sock, SSLEngine engine, boolean clientMode)

    throws IOException

  {

    this(sock, engine, clientMode, false);  // parameter 4 is isClientInitSecureRenegotiationAccepted, THIS IS ALWAYS FALSE, and clientMode is always TRUE

  }

   

  public JSSEFilterImpl(Socket sock, SSLEngine engine, boolean clientMode, boolean isClientInitSecureRenegotiationAccepted)  // this constructor is ultimately invoked

    throws IOException

  {

so the only way to avoid session invalidation is by having IS_JDK_CLIENT_INIT_SECURE_RENEGOTIATION_PROPERTY_SET=false, that is by setting -Djdk.tls.rejectClientInitiatedRenegotiation=false (true or false doesn't seem to matter, as long as the variable is set)


Thanks to Carlo for the excellent analysis.

Intellij and WebLogic

https://www.jetbrains.com/help/idea/configuring-and-managing-application-server-integration.html

WebLogic Security documentation

https://docs.oracle.com/middleware/12213/wls/INTRO/security.htm#INTRO232



https://docs.oracle.com/cd/E19798-01/821-1841/girbe/index.html JACC "Java Authorization Contract for Containers"

https://docs.oracle.com/javase/8/docs/api/java/security/Permission.html java.security.Permission

https://docs.oracle.com/javase/8/docs/api/java/lang/SecurityManager.html java.lang.SecurityManager





Java Authentication Service Provider Interface for Containers (JASPIC)




Training Material:

https://www.udemy.com/how-to-secure-oracle-weblogic-12c/


https://www.udemy.com/oracle-weblogic-12c-for-administrators/

Old book https://www.amazon.com/Securing-Weblogic-Server-Luca-Masini/dp/1849687781

WebLogic on Kubernetes

https://blogs.oracle.com/weblogicserver/weblogic-server-certification-on-kubernetes

https://github.com/oracle/docker-images/tree/master/OracleWebLogic/dockerfiles/12.2.1.3

sample Dockerfile https://github.com/oracle/docker-images/blob/master/OracleWebLogic/samples/wls-k8s-domain/Dockerfile

WebLogic Dockerfiles are at https://github.com/oracle/docker-images/tree/master/OracleWebLogic

docker weblogic

https://hub.docker.com/r/ismaleiva90/weblogic12/

docker pull ismaleiva90/weblogic12
docker run -d --name myweblogic -p 49163:7001 -p 49164:7002 -p 49165:5556 ismaleiva90/weblogic12:latest
http://localhost:49163/console
User: weblogic
Pass: welcome1

exit ( go back to host )

generate a basic WAR:

mvn archetype:generate -DgroupId=com.mkyong -DartifactId=pippoWebApp -DarchetypeArtifactId=maven-archetype-webapp -DinteractiveMode=false


docker cp ./pippoWebApp/target/pippoWebApp.war myweblogic:/u01/oracle/weblogic/user_projects/domains/base_domain


then you have to manually deploy (copying to autodeploy doesn't work, this domain has PRODUCTION mode enabled)

http://localhost:7001/pippoWebApp/

See also http://www.javamonamour.org/2015/04/weblogic-deployment-with-docker.html


To get the image from Oracle itself:

https://blogs.oracle.com/weblogicserver/weblogic-server-certification-on-kubernetes

https://github.com/oracle/docker-images/tree/master/OracleWebLogic


git clone https://github.com/oracle/docker-images.git
cd docker-images/OracleWebLogic/dockerfiles

first you should download the JAr files and scp them here (this really sucks.... why not just curl them in place from a repository...)

./buildDockerImage.sh -v 12.2.1.3 -d -c

weblogic.transaction.internal.AppSetRollbackOnlyException: setRollbackOnly called on transaction

If you get "weblogic.transaction.internal.AppSetRollbackOnlyException: setRollbackOnly called on transaction " in your application, and have no clue what is going on, in Oracle Support you find this article:
"When setRollbackOnly() is Called in beforeCompletion() Synchronization Method , Thrown Exception Cannot be Obtained (Doc ID 1547327.1)"
you should apply a patch 16509700 AND specify -Dweblogic.transaction.allowOverrideSetRollbackReason=true , or upgrade to WLS 12.1.3

WebLogic: avoiding anonymous user calls

Servlet or JSP initialization

weblogic.xml

<servlet-descriptor>
       <servlet-name>MyServletName</servlet-name>
       <init-as-principal-name>MySERVLET.INIT.USER</init-as-principal-name>
   </servlet-descriptor>

Where MyServletName needs to be replaced with the name of your Servlet, as declared in the web.xml file.

ServletContextListener

config.xml

  <app-deployment>
    <name>myapp</name>
    <target>webInitServer</target>
    <source-path>./deploy/presear</source-path>
    <deployment-principal-name>MY.DEPLOYMENT.PRINCIPAL</deployment-principal-name>
    <security-dd-model>Advanced</security-dd-model>
    <staging-mode>nostage</staging-mode>
  </app-deployment>

EJB create method

weblogic-ejb-jar.xml

<?xml version="1.0" encoding="UTF-8"?>
<weblogic-ejb-jar xmlns="http://www.bea.com/ns/weblogic/90" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.bea.com/ns/weblogic/90 http://www.bea.com/ns/weblogic/910/weblogic-ejb-jar.xsd">
  <weblogic-enterprise-bean>
    <ejb-name>MyEJB</ejb-name>
    <stateless-session-descriptor>
      <business-interface-jndi-name-map>
        <business-remote>acme.ejb.test.MyEJB</business-remote>
        <jndi-name>pippo</jndi-name>
      </business-interface-jndi-name-map>
      <pool>
        <max-beans-in-free-pool>5</max-beans-in-free-pool>
        <initial-beans-in-free-pool>1</initial-beans-in-free-pool>
      </pool>
       <stateless-bean-is-clusterable>True</stateless-bean-is-clusterable>
      </stateless-clustering>
    </stateless-session-descriptor>
    <create-as-principal-name>MY.EJB.CREATE.PRINCIPAL</create-as-principal-name>
</weblogic-ejb-jar>

EJB timer

ejb-jar.xml

<?xml version="1.0" encoding="UTF-8"?>
<ejb-jar id="ejb-jar" 
 xmlns="http://java.sun.com/xml/ns/javaee" version="3.0"
 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/ejb-jar_3_0.xsd">
  <enterprise-beans>
    <session>
      <ejb-name>CDRTimer</ejb-name>
      <ejb-class>acme.ejb.timer.test.CDRTimerBean</ejb-class>
      <session-type>Stateless</session-type>
      <security-identity>
        <run-as>
          <role-name>TimerExecutor</role-name>
        </run-as>
      </security-identity>
    </session>
  </enterprise-beans>
  <assembly-descriptor>
    <security-role>
      <description></description>
      <role-name>TimerExecutor</role-name>
    </security-role>
  </assembly-descriptor>
  <ejb-client-jar>CDRTimerEJBclientjar.jar</ejb-client-jar>
</ejb-jar>

weblogic-ejb-jar.xml

  <run-as-role-assignment>
    <role-name>TimerExecutor</role-name>
    <run-as-principal-name>CDRTIMER.RUN.PRINCIPAL.NAME</run-as-principal-name>
  </run-as-role-assignment>

WebLogic 2 Way SSL

on the server tab, enable SSL

on the SSL tab, enable "client certificate requested and enforced"

then enter https url in Firefox:

https://192.168.56.1:7002/SnoopServlet/SnoopServlet.jsp

Your connection is not secure

The owner of 192.168.56.1 has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website.

click on "advanced"

192.168.56.1:7002 uses an invalid security certificate. The certificate is not trusted because the issuer certificate is unknown. The server might not be sending the appropriate intermediate certificates. An additional root certificate may need to be imported. The certificate is not valid for the name 192.168.56.1. Error code: SEC_ERROR_UNKNOWN_ISSUER

Secure Connection Failed

An error occurred during a connection to 192.168.56.1:7002. SSL peer cannot verify your certificate. Error code: SSL_ERROR_BAD_CERT_ALERT

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem.

See https://support.mozilla.org/en-US/kb/what-does-your-connection-is-not-secure-mean

In Firefox: Tools / Options / Advanced / Certificates / View certificates / Your Certificates

Run keystore explorer (it needs unlimited cryptography strength), create new pkcs12 keystore, Tools/generate key pair, rsa 2048 key length, sha-256 with RSA,

please enter the password that was used to encrypt this certificate backup

In Chrome:

This site can’t provide a secure connection

192.168.56.1 didn’t accept your login certificate, or one may not have been provided.
Try contacting the system admin.

I add set JAVA_OPTIONS="-Djavax.net.debug=all" to startWebLogic.cmd

javax.net.ssl.SSLHandshakeException: null cert chain

SnoopServlet

Create a Dynamic Web project "SnoopServlet"

This is the web.xml:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://xmlns.jcp.org/xml/ns/javaee" xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd" id="WebApp_ID" version="3.1">
  <display-name>SnoopServlet</display-name>
  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
    <welcome-file>index.htm</welcome-file>
    <welcome-file>index.jsp</welcome-file>
    <welcome-file>default.html</welcome-file>
    <welcome-file>default.htm</welcome-file>
    <welcome-file>default.jsp</welcome-file>
  </welcome-file-list>
  <servlet>
    <description></description>
    <display-name>MySnoopServlet</display-name>
    <servlet-name>MySnoopServlet</servlet-name>
    <servlet-class>MySnoopServlet</servlet-class>
  </servlet>
  <servlet-mapping>
    <servlet-name>MySnoopServlet</servlet-name>
    <url-pattern>/MySnoopServlet</url-pattern>
  </servlet-mapping>
</web-app>

This is the weblogic.xml:

<?xml version="1.0" encoding="UTF-8"?>
<wls:weblogic-web-app xmlns:wls="http://xmlns.oracle.com/weblogic/weblogic-web-app" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd http://xmlns.oracle.com/weblogic/weblogic-web-app http://xmlns.oracle.com/weblogic/weblogic-web-app/1.9/weblogic-web-app.xsd">
    <wls:weblogic-version>12.2.1.2</wls:weblogic-version>
    <wls:context-root>SnoopServlet</wls:context-root>
</wls:weblogic-web-app>

import java.io.IOException;
import java.io.PrintWriter;
import java.util.Enumeration;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

@SuppressWarnings("serial")
public class MySnoopServlet extends HttpServlet
{
    public int mycount = 0;
    public MySnoopServlet()
    {
    }

    public void destroy()
    {
    }

    public void doGet(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException
    {
     mycount+=1;
        HttpSession session;
        PrintWriter out;
        response.setContentType("text/html");
        session = request.getSession();
        out = response.getWriter();
        try {
         out.println("<html>");
         out.println("<head><title>SnoopServlet</title></head>");
         out.println("<body text='#ffffff' bgcolor='#666699' link='#ffffff' vlink='#ffffff' alink='#ffffff'>");
         out.println("<p>The servlet has received a GET. This is the reply.</p>");
         out.flush();
         out.print("<p>Request");
         out.print("<br>Principal = " + request.getUserPrincipal());
         out.print("<br>URL = " + request.getRequestURL().toString());
         out.print("<br>AuthType = " + request.getAuthType());
         out.print("<br>RemoteUser = " + request.getRemoteUser());
         out.print("<br>ServerName = " + System.getProperty("weblogic.Name"));
         out.print("<br>SessionID = " + session.getId());
         out.println("<br><hr> <br>");
         Enumeration enum1 = request.getHeaderNames();
         out.print("<p>Header");
         String item;
         for(; enum1.hasMoreElements(); out.print("<br>" + item + "=" + request.getHeader(item)))
             item = (String)enum1.nextElement();
 
         out.flush();
         out.println("<br><hr> <br>");
         out.print("<p>Attributes");
         for(enum1 = request.getAttributeNames(); enum1.hasMoreElements(); out.print("<br>" + item + "=" + request.getAttribute(item)))
             item = (String)enum1.nextElement();
 
         out.flush();
         out.println("<br><hr> <br>");
         out.print("<p>Parameters");
         for(enum1 = request.getParameterNames(); enum1.hasMoreElements(); out.print("<br>" + item + "=" + request.getParameter(item)))
             item = (String)enum1.nextElement();
 
         out.println("<br><hr> <br>");
         out.flush();
       }
       catch (Throwable th) {
        out.print("<pre>");
        th.printStackTrace();
        th.printStackTrace(out);
        out.print("</pre>");
      }
      finally {
        out.println("</body></html>");
      }
        return;
    }

    public void init()
        throws ServletException
    {
    }

    
}

http://localhost:7001/SnoopServlet/MySnoopServlet?pippo=pluto

The servlet has received a GET. This is the reply.

Request
Principal = null
URL = http://192.168.56.1:7001/SnoopServlet/MySnoopServlet
AuthType = null
RemoteUser = null
ServerName = AdminServer
SessionID = MHcJQYLAVotakdRTZ2rAwUj_sRjWlQ3Bui-_d50iyOJwAwNJW6B2!837838669!1486213972672

Header
Host=192.168.56.1:7001
User-Agent=Mozilla/5.0 (Windows NT 10.0; WOW64; rv:51.0) Gecko/20100101 Firefox/51.0
Accept=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language=en-US,en;q=0.5
Accept-Encoding=gzip, deflate
Cookie=JSESSIONID=MowJK_Z1Wj2l48jsHZqf21DItW3tklujnqPmzh6Uj9vnI9CEtDfX!-1767948456
Connection=keep-alive
Upgrade-Insecure-Requests=1

Attributes

Parameters
pippo=pluto

The JSP can be found in $WL_HOME/samples/server/examples/src/examples/security/sslclient/src/main/webapp/SnoopServlet.jsp

<!-- Copyright (c) 1999,2015, Oracle and/or its affiliates. All Rights Reserved.-->
<%@ page import="java.util.Enumeration,
      java.io.PrintWriter"%>

<%!
   /**
  * <p>This helper method can be used to help prevent Cross Site Scripting
  * vulnerabilities. Any Servlet or JSP which sends user input (eg.
  * query parameters in HTTP requests) to be rendered into a user's browser
  * needs to use this method to encode the user input.  This ensures that any
  * HTML in their input (either malicious or otherwise) is not executed by
  * the browser.  This is achieved by converting characters to their HTML
  * escaped form.  For example, '&' is converted to '&amp;amp;'.
  * <p>
  * A full description of Cross Site Scripting (XSS) vulnerabilities can
  * be found at
  * <a href="http://www.cert.org/tech_tips/malicious_code_mitigation.html">
  * http://www.cert.org/tech_tips/malicious_code_mitigation.html</a>.
  *
  * @param str
  */
  public String encodeXSS(String str) {
   return weblogic.servlet.security.Utils.encodeXSS(str);
  }
%>

<%
 try {
%>
   <p>
    This servlet returns information about the HTTP request
    itself. You can modify this servlet to take this information
    and store it elsewhere for your HTTP server records. This
    servlet is also useful for debugging.
      </p>
   <h3>
   Servlet Spec Version Implemented
   </h3>
   <pre>
   <%= getServletConfig().getServletContext().getMajorVersion() + "." + getServletConfig().getServletContext().getMinorVersion() %>
   </pre>
   <h3>
   Requested URL
   </h3>
   <pre>
   <%= request.getRequestURL().toString() %>
   </pre>
   <h3>
   Request parameters
   </h3>
   <pre>
<%

   Enumeration enum_ = request.getParameterNames();
   while(enum_.hasMoreElements()){
     String key = (String)enum_.nextElement();
     String[] paramValues = request.getParameterValues(key);
     for(int i=0;i < paramValues.length;i++){
         out.println(key + " : "  + encodeXSS(paramValues[i]));
     }
   }

%>
   </pre>
   <h3>
   Request information
   </h3>
   <pre>
   Request Method: <%= request.getMethod() %>
   Request URI: <%= request.getRequestURI() %>
   Request Protocol: <%= request.getProtocol() %>
   Servlet Path: <%= request.getServletPath() %>
   Path Info: <%= request.getPathInfo() %>
   Path Translated: <%= request.getPathTranslated() %>
   Query String: <%= encodeXSS(request.getQueryString()) %>
   Content Length: <%= request.getContentLength() %>
   Content Type: <%= request.getContentType() %>
   Server Name: <%= request.getServerName() %>
   Server Port: <%= request.getServerPort() %>
   Remote User: <%= request.getRemoteUser() %>
   Remote Address: <%= request.getRemoteAddr() %>
   Remote Host: <%= request.getRemoteHost() %>
   Authorization Scheme: <%= request.getAuthType() %>
   </pre>
   <h3>Certificate Information</h3>
   <pre>
<%
   java.security.cert.X509Certificate certs [];
   certs = (java.security.cert.X509Certificate [])
   request.getAttribute("javax.servlet.request.X509Certificate");
   if ((certs != null) && (certs.length > 0)) {
%>
    Subject Name : <%= certs[0].getSubjectDN().getName() %> <br>
    Issuer Name :<%= certs[0].getIssuerDN().getName() %> <br>
    Certificate Chain Length : <%= certs.length %> <br>
<%

      // List the Certificate chain
      for (int i=0; i<certs.length;i++) {
%>  Certificate[<%= i %>] : <%= certs[i].toString() %>

<%
    } // end of for loop

   }
   else // certs==null
    {
%>
    Not using SSL or client certificate not required.
<%
    } // end of else
%>
   </pre>
   <h3>
   Request headers
   </h3>
   <pre>
<%
   enum_ = request.getHeaderNames();
   while (enum_.hasMoreElements()) {
    String name = (String)enum_.nextElement();
    out.println(name + ": " +encodeXSS(request.getHeader(name)));
   }
%>
   </pre>
  </td>
 </tr>
<%
 }
 catch (Exception ex) {
  ex.printStackTrace(new PrintWriter(out));
 }
%>

http://localhost:7001/SnoopServlet/SnoopServlet.jsp

WebLogic: all MS in a cluster hang while starting up.... weblogic.cluster.MemberManager.getJNDIStateDump issue

in the thread dump of both MS I see several blocked threads:

weblogic.cluster.MemberManager.getRemoteMembers
weblogic.iiop.ClusterServices.getMembers
weblogic.cluster.ClusterRuntime.clusterMembersChanged
weblogic.cluster.MemberManager.findOrCreate
plus some 150 DynamicJSSEListenThread threads....
In particular all BLOCKED threads are waiting for lock 0x000000060276f168 who is held by this getJNDIStateDump:

"[STANDBY] ExecuteThread: '2' for queue: 'weblogic.kernel.Default (self-tuning)'" daemon prio=10 tid=0x00007f6a800024c0 nid=0x74bd runnable [0x00007f6b1f7e6000]
   java.lang.Thread.State: RUNNABLE
               at java.net.SocketInputStream.socketRead0(Native Method)
               at java.net.SocketInputStream.read(SocketInputStream.java:152)
               at java.net.SocketInputStream.read(SocketInputStream.java:122)
               at sun.security.ssl.InputRecord.readFully(InputRecord.java:442)
               at sun.security.ssl.InputRecord.read(InputRecord.java:480)
               at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:946)
               - locked <0x000000060bcf5160> (a java.lang.Object)
               at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:903)
               at sun.security.ssl.AppInputStream.read(AppInputStream.java:102)
               - locked <0x000000060bd2a9b0> (a sun.security.ssl.AppInputStream)
               at java.io.BufferedInputStream.fill(BufferedInputStream.java:235)
               at java.io.BufferedInputStream.read1(BufferedInputStream.java:275)
               at java.io.BufferedInputStream.read(BufferedInputStream.java:334)
               - locked <0x000000060bd2a988> (a java.io.BufferedInputStream)
               at sun.net.www.http.HttpClient.parseHTTPHeader(HttpClient.java:690)
               at sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:633)
               at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1325)
               - locked <0x000000060c29d3c8> (a sun.net.www.protocol.https.DelegateHttpsURLConnection)
               at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)
               - locked <0x000000060c29d4a8> (a sun.net.www.protocol.https.HttpsURLConnectionImpl)
               at weblogic.cluster.MemberManager.getJNDIStateDump(MemberManager.java:244)
               at weblogic.cluster.MemberManager.waitForSync(MemberManager.java:222)
               at weblogic.cluster.MemberManager.waitToSyncWithCurrentMembers(MemberManager.java:182)
               - locked <0x000000060276f168> (a weblogic.cluster.MemberManager)
               at weblogic.cluster.InboundService.start(InboundService.java:52)
               at weblogic.server.AbstractServerService.postConstruct(AbstractServerService.java:78)
               at sun.reflect.GeneratedMethodAccessor6.invoke(Unknown Source)
               at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
               at java.lang.reflect.Method.invoke(Method.java:606)
               at org.glassfish.hk2.utilities.reflection.ReflectionHelper.invoke(ReflectionHelper.java:1017)
               at org.jvnet.hk2.internal.ClazzCreator.postConstructMe(ClazzCreator.java:388)
               at org.jvnet.hk2.internal.ClazzCreator.create(ClazzCreator.java:430)
               at org.jvnet.hk2.internal.SystemDescriptor.create(SystemDescriptor.java:456)
               at org.glassfish.hk2.runlevel.internal.AsyncRunLevelContext.findOrCreate(AsyncRunLevelContext.java:225)
               at org.glassfish.hk2.runlevel.RunLevelContext.findOrCreate(RunLevelContext.java:82)
               at org.jvnet.hk2.internal.Utilities.createService(Utilities.java:2488)
               at org.jvnet.hk2.internal.ServiceHandleImpl.getService(ServiceHandleImpl.java:98)
               - locked <0x000000060acd0028> (a java.lang.Object)
               at org.jvnet.hk2.internal.ServiceHandleImpl.getService(ServiceHandleImpl.java:87)
               at org.glassfish.hk2.runlevel.internal.CurrentTaskFuture$QueueRunner.oneJob(CurrentTaskFuture.java:1162)
               at org.glassfish.hk2.runlevel.internal.CurrentTaskFuture$QueueRunner.run(CurrentTaskFuture.java:1147)
               at weblogic.work.SelfTuningWorkManagerImpl$WorkAdapterImpl.run(SelfTuningWorkManagerImpl.java:553)
               at weblogic.work.ExecuteThread.execute(ExecuteThread.java:311)
               at weblogic.work.ExecuteThread.run(ExecuteThread.java:263)

It turned out that the SAME domain was running before on a different set of servers, and while migrating them the operator forgot to shut down the previous instances. How this could interfere with the current domain, it's still a mystery

WebLogic "The managed server could not update the configuration files"

getting this error today, with Admin server up and running, and starting a Managed server member of a cluster.... the .bindings file is part of the MQ Foreign JMS server configuration:

<Dec 29, 2016 4:07:04 PM CET> <Error> <Management> <BEA-141196> <The managed server could not update the configuration files during the registration with the deployment service. The update failed due to an exception:
weblogic.management.DeploymentException: Exception occured while copying files
 at weblogic.deploy.internal.targetserver.datamanagement.DataUpdate.doUpdate(DataUpdate.java:307)
 at weblogic.deploy.internal.targetserver.datamanagement.ConfigDataUpdate.doUpdate(ConfigDataUpdate.java:102)
 at weblogic.deploy.internal.targetserver.datamanagement.DataUpdate.update(DataUpdate.java:72)
 at weblogic.deploy.internal.targetserver.datamanagement.Data.commitDataUpdate(Data.java:118)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.updateFiles(RuntimeAccessDeploymentReceiverService.java:880)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.handleRegistrationResponse(RuntimeAccessDeploymentReceiverService.java:728)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.registerHandler(RuntimeAccessDeploymentReceiverService.java:699)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.start(RuntimeAccessDeploymentReceiverService.java:169)
 at weblogic.t3.srvr.ServerServicesManager.startService(ServerServicesManager.java:462)
 at weblogic.t3.srvr.ServerServicesManager.startInStandbyState(ServerServicesManager.java:167)
 at weblogic.t3.srvr.T3Srvr.initializeStandby(T3Srvr.java:881)
 at weblogic.t3.srvr.T3Srvr.startup(T3Srvr.java:568)
 at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:469)
 at weblogic.Server.main(Server.java:71)
Caused By: java.io.FileNotFoundException: /path/to/mydomain/config/jms/.bindings (Permission denied)
 at java.io.FileOutputStream.open(Native Method)
 at java.io.FileOutputStream.<init>(FileOutputStream.java:194)
 at java.io.FileOutputStream.<init>(FileOutputStream.java:145)
 at weblogic.utils.FileUtils.writeToFile(FileUtils.java:115)
 at weblogic.deploy.internal.targetserver.datamanagement.DataUpdate.copy(DataUpdate.java:265)
 at weblogic.deploy.internal.targetserver.datamanagement.DataUpdate.copyOrExtractTo(DataUpdate.java:202)
 at weblogic.deploy.internal.targetserver.datamanagement.DataUpdate.updateLocalData(DataUpdate.java:168)
 at weblogic.deploy.internal.targetserver.datamanagement.DataUpdate.doUpdate(DataUpdate.java:299)
 at weblogic.deploy.internal.targetserver.datamanagement.ConfigDataUpdate.doUpdate(ConfigDataUpdate.java:102)
 at weblogic.deploy.internal.targetserver.datamanagement.DataUpdate.update(DataUpdate.java:72)
 at weblogic.deploy.internal.targetserver.datamanagement.Data.commitDataUpdate(Data.java:118)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.updateFiles(RuntimeAccessDeploymentReceiverService.java:880)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.handleRegistrationResponse(RuntimeAccessDeploymentReceiverService.java:728)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.registerHandler(RuntimeAccessDeploymentReceiverService.java:699)
 at weblogic.management.provider.internal.RuntimeAccessDeploymentReceiverService.start(RuntimeAccessDeploymentReceiverService.java:169)
 at weblogic.t3.srvr.ServerServicesManager.startService(ServerServicesManager.java:462)
 at weblogic.t3.srvr.ServerServicesManager.startInStandbyState(ServerServicesManager.java:167)
 at weblogic.t3.srvr.T3Srvr.initializeStandby(T3Srvr.java:881)
 at weblogic.t3.srvr.T3Srvr.startup(T3Srvr.java:568)
 at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:469)
 at weblogic.Server.main(Server.java:71)
> 

The issue is that a MS tried to get the latest configuration files from the Admin at startup. See "Error Starting WebLogic Server: BEA-141196: The managed server could not update the configuration files during the registration with the deployment service (Doc ID 1461960.1)". in My Oracle Support.

You can either make that configuration file WRITEABLE, or shut down the Admin and make sure that the MS has already the latest configuration.

Awesome 100 minutes presentation on What is new in WebLogic 12.1.3

http://download.oracle.com/tutorials/ecourse/fmw/wls/wls_12.1.3_new_features/presentation.html or https://goo.gl/ESkvHj

It covers a lot of aspects including Exalogic, JTA, Elastic clusters, JMS....

WebLogic 12 shared libraries

https://docs.oracle.com/cd/E24329_01/web.1211/e24368/libraries.htm#WLPRG325

Excellent presentation here:



it's always recommended to set Specification Version and Implementation Version in the MANIFEST.MF

same is true with Applications : Weblogic-Application-Version should be set in MANIFEST.MF (see https://docs.oracle.com/cd/E24329_01/web.1211/e24368/versioning.htm#WLPRG250 )

WebLogic Server Request Performance View

On how to configure the deployment to add a "Context ID" using the wldf-resource/wldf-instrumentation-monitor tag: http://docs.oracle.com/cd/E24329_01/web.1211/e24426/config_context.htm#WLDFC253

Java Mission Control jmc WebLogic plugin

funnily, the plugin installs, but whenever I run it, it says "event type BLA is not enabled in this recording" and I can't figure out how to enable the event recording...

https://docs.oracle.com/javacomponents/jmc-5-5/jmc-user-guide/experimental.htm#JMCCI131
https://blogs.oracle.com/WebLogicServer/entry/weblogic_tip
this video is about the JRockit version:

To install: run jmc.exe, Help, Install new Software

If you see this when activating Commercial Features via JMC:

[jfr][WARN ][3932.289] Unable to register PDH query for "\Process(java#0)\% Processor Tim"
[jfr][WARN ][3932.290] Please check the registry if this performance object/counter is disabled
[jfr][WARN ][3932.290] Unable to register PDH query for "\Process(java#0)\% Privileged Tim"
[jfr][WARN ][3932.290] Please check the registry if this performance object/counter is disabled
[jfr][WARN ][3932.290] Unable to register PDH query for "\Process(java#1)\% Processor Tim"
[jfr][WARN ][3932.290] Please check the registry if this performance object/counter is disabled
[jfr][WARN ][3932.290] Unable to register PDH query for "\Process(java#1)\% Privileged Tim"
[jfr][WARN ][3932.290] Please check the registry if this performance object/counter is disabled
[jfr][WARN ][3932.293] Unable to register PDH query for "\System\Context Switches/se"
[jfr][WARN ][3932.293] Please check the registry if this performance object/counter is disabled

it seems to be a known bug (Windows only)

WebLogic Partitions and Multitenancy

Excellent presentation here:



https://blogs.oracle.com/imc/entry/introducing_oracle_weblogic_server_12

https://blogs.oracle.com/WebLogicServer/entry/domain_partitions_for_multi_tenancy great conceptual overview of Partitions

About targeting Resource Groups to Virtual targets and Partitions https://blogs.oracle.com/dipol/entry/partition_targeting_and_virtual_targets

WebLogic Elastic cluster

very interesting demos on how to scale up/down (with console, with WLST or via policies) the number of managed servers in a cluster