Oracle9iAS Release 2 J2EE and Web Services Overview · Summary & Conclusions ... products and services across the company. ... compile, profile, and optimize J2EE applications and

Oracle9i Application Server Release 2 An Overview of the J2EE and Web Services Features April 2002

Executive Overview ...................................................................................................... 4

Pure Java Container/Runtime executing on JDK .......................................... 4 Development Productivity ................................................................................. 4 Deployment Reliability........................................................................................ 5

1. Introduction................................................................................................................ 6 2. Oracle’s Java Strategy and Oracle9iAS ............................................................. 6 3. Application Development features ................................................................... 7

3A. Oracle HTTP Server ......................................................................................... 7 Apache Mod_OC4J ............................................................................................. 8 Proxy Plug-In Support for Netscape and Microsoft IIS ............................... 9 Certification with Firewalls and Load Balancers............................................. 9

3B. JavaServer Pages............................................................................................... 10 JSP Elements ...................................................................................................... 10 JSP Translator Release 2 ................................................................................... 10 Connection Pool Tags....................................................................................... 11 Caching Tags....................................................................................................... 11 Sendmail Tags and JavaBean............................................................................ 12 File-Access Tags and JavaBean........................................................................ 12 XML tags............................................................................................................. 12 EJB Tags.............................................................................................................. 12 Other Tags .......................................................................................................... 13

3C. Servlets............................................................................................................... 13 Servlet 2.3 Support............................................................................................. 14

3D. Enterprise JavaBeans ...................................................................................... 15 Java Transaction API (JTA) ............................................................................. 17 Java Messaging Service (JMS) .......................................................................... 18 Message Driven Beans (MDBs)....................................................................... 19 Active Components for J2EE (AC4J) ............................................................ 19 Java Naming and Directory Interface (JNDI)............................................... 21 J2EE Connector Architecture (JCA) .............................................................. 21 J2EE 1.3 Features .............................................................................................. 23 Local Interfaces for Enterprise JavaBeans..................................................... 23

3E. Database Access and O-R Mapping ............................................................. 25 Oracle9iAS Object-Relational Mapping ......................................................... 26 Third Party O-R Mappings - TopLink Integration....................................... 26 Business Components for Java ........................................................................ 26 JDBC Enhancements ........................................................................................ 27 SQLJ Enhancements ......................................................................................... 27

3F. Web Services..................................................................................................... 27 Oracle9iAS Release 2 Web Services Facilities ............................................... 28

3H. Developer Productivity .................................................................................. 29 4. Application Deployment features.................................................................... 30

4A. Performance ..................................................................................................... 31 4B. Scalability........................................................................................................... 31

Oracle9iAS Scalability Strategy ........................................................................ 31 Resource Pooling ............................................................................................... 33 Load Balancing ................................................................................................... 34 Clustering ............................................................................................................ 35 Hardware Scalability .......................................................................................... 36

4C. High Availability and Reliability .................................................................... 36

Oracle9iAS J2EE and Web Services Features Page 2

Zero Planned Downtime .................................................................................. 37 Zero Unplanned Downtime............................................................................. 37

4.5 Security and Directory Services ............................................................. 40 Encrypted Communication .............................................................................. 41 PKI-based Authentication................................................................................ 41 Single Sign-On.................................................................................................... 42 Centralized Administration............................................................................... 43

4E. Systems Management ...................................................................................... 44 Deploying J2EE Applications using Oracle Enterprise Manager .............. 46

5. Summary & Conclusions .................................................................................. 46 Pure Java Container/Runtime executing on JDK ........................................ 47 Development Productivity ............................................................................... 47 Deployment Reliability...................................................................................... 47


EXECUTIVE OVERVIEW

Enterprise Applications are today designed on an Internet Architecture in which a middle-tier Java Application Server provides a runtime environment for the Application. To meet these needs and to provide a robust, mission critical platform for J2EE applications, Oracle provides the next release of Oracle9i Application Server which provides a number of new facilities to simplify enterprise application development and to provide greater reliability for applications when they are deployed. J2EE applications can be built with Oracle9i JDeveloper which is seamlessly integrated with Oracle9iAS Release 2. The major J2EE enhancements in Oracle9iAS Release 2 are outlined below. Pure Java Container/Runtime executing on JDK Oracle9iAS’ J2EE Container is implemented completely in Java making it: (i) Lightweight - 25 MB disk, 20MB of Memory; (ii) Fast to install, can be completed in less than 15 minutes; (iii) Easy to use – simple management and configuration, supporting standard Java Development and Profiling Tools; and (iv) Available on 32-Bit and 64-Bit Versions of standard Operating System and Hardware Platforms including Solaris, HP-UX, AIX, Tru64, Windows NT and Linux. Oracle9iAS Release 2 is certified to run on JDK 1.3, and will be certified to run on JDK 1.4 shortly after the initial production release. Development Productivity Oracle9iAS Release 2 significantly enhances support for J2EE and Web Services providing a productive environment to develop and deploy dynamic Web Sites, transactional Internet Applications, and Web Services. In parallel Oracle has also delivered a developer preview of its J2EE 1.3 Container which will be part of the first maintenance release of Oracle9iAS Release 2. • Oracle HTTP Server - Release 2 has been upgraded to Apache v 1.3.22 with enhancements for session

routing and IP Load Balancing, dynamic port discovery and registration, high availability, new security facilities, and new mods - mod_oc4j, mod_oraDAV, and mod_OSSO.

• JavaServer Pages - Release 2 enhances JSP Support with a number of JSP 1.2 features, JSP source level debugging, several pre-packaged JSP Tag Libraries, and several performance optimizations.

• Servlets - Release 2 provides complete support for Servlet 2.3 including Servlet Filters, Filter chaining, and Application lifecycle events. It is 100% compatible for applications developed to the Servlet and JSP standards on the Tomcat Servlet Engine.

• Enterprise JavaBeans - Release 2 provides enhanced EJB Support with a number of EJB 2.0 features including CMP enhancements, pluggable JMS providers, Message Driven Bean enhancements, the introduction of Active Components for J2EE (a framework for developing loosely coupled asynchronous Web Services), a complete JAAS Provider for Security, and JTA and JNDI enhancements. Oracle’s J2EE 1.3 Preview provides full support for all EJB 2.0 Services including EJBQL, CMP with Relationships, CORBA Support, and Local Interfaces.

• J2EE Connector Architecture: A complete implementation of the J2EE Connector Architecture enables application developers to use standard resource adapters to connect to enterprise information systems from their J2EE applications.

• Web Services - Release 2 provides facilities to deploy synchronous (RPC-style) and asynchronous (messaging-style) Web Services supporting SOAP 1.1, WSDL 1.1, UDDI 1.0 and key elements of JAX-* web services standards.

• Developer Productivity - Release 2 provides a number of enhancements to improve developer productivity including seamless integration with Oracle9i JDeveloper, a number of command line tools and


utilities, ANT extensions, certification of popular J2EE Frameworks (including struts), and automated migration tools. Release 2 has been certified with the industry’s leading development tools, messaging systems, object-relational mappings, security solutions, directory services, system management products, and content management solutions.

Deployment Reliability Oracle9iAS Release 2 not only provides the industry’s most productive development environment for J2EE applications but also provides a number of new features that enhance its capabilities for mission critical application deployment. • Performance - Release 2 has a number of code path enhancements and several new concurrency control

options to improve J2EE Performance. • Scalability - Release 2 has more efficient Resource Pooling, enhanced Java Caching and Web Caching

facilities, enhanced routing and load balancing of IP (HTTP, AJP, FTP, SMTP), RMI, RMI-over-IIOP, and SOAP requests, integrated clustering and session failover facilities for servlets and EJBs, and enhanced horizontal and vertical hardware scalability.

• High Availability - Release 2 improves high availability to ensure that applications remain highly available when software maintenance operations (Zero Planned Downtime) are carried out, and across system failures (Zero Unplanned Downtime). Planned downtime is reduced through online operations, dynamic instance and cluster reconfiguration, hot deployment of applications, and rolling upgrade facilities. Unplanned downtime is reduced through the absence of a single point of failure; automatic Connection re-routing and load balancing in the instance of a failure; clustered session state fail over across a cluster; a fast start fault recovery architecture where failures or instance deaths are automatically discovered and instances are automatically restarted, reconfigured and re-clustered.

• Security - Release 2 has security enhancements including encrypted communication; strong PKI-based authentication; complete Java2/JAAS security support for authentication, authorization and role-based access control, and delegation; and centralized administration in LDAP.

• Systems Management - Finally, Oracle Enterprise Manager can be used to monitor status, resource consumption, faults, and performance of either instances or clusters; and to administer both single instances and clusters of Application Servers.

This document provides a detailed technical overview of the J2EE Facilities in Oracle9iAS Release 2 discussing Oracle’s Java Strategy and roadmap; providing an overview of the development, deployment and the high availability and scalability features.


1. INTRODUCTION During the past five years, Java has become the language of choice for developing and deploying enterprise applications. Its promise of a unified portable application development solution that can execute on a simpler, lower cost, server-based infrastructure that is operating system and hardware platform-independent has driven its rapid adoption by application developers and corporate Chief Information Officers. Today, all enterprise applications are being designed on an Internet architecture in which a middle-tier Java application server provides a runtime environment for the application. The Java™ 2 Platform, Enterprise Edition (J2EE) defines an application model and set of programming interfaces providing a standard “container” environment for executing Java applications. Oracle9iAS Release 2 provides a fast, lightweight, highly scalable, easy-to-use, and complete Java2 Enterprise Edition (J2EE) container written entirely in Java which executes on the standard Java Development Kit (JDK) Virtual Machine (Java VM). This document provides a detailed technical overview of the J2EE Facilities in Oracle9iAS Release 2. It is organized into three sections: • First, it discusses Oracle’s Java Strategy and Product Roadmap • Second, it provides an overview of the J2EE Features in Oracle9iAS Release 2 • Third, it provides an overview of performance, scalability, availability, security and management

facilities of Oracle9iAS Release 2. 2. ORACLE’S JAVA STRATEGY AND ORACLE9IAS Oracle has made a significant strategic commitment to Java and is integrating it in a number of different products and services across the company. Oracle has three primary objectives for Java: • Oracle is fully committed to supporting Java standards specifically the Java2 Enterprise Edition

(J2EE) as a standard methodology to develop and deploy enterprise Java Applications. • Oracle provides Java developers with a complete development environment for Java - a rich set of

Java tools and programmatic interfaces to make application development easy and productive. • Oracle provides a high performance, scaleable, and highly available server infrastructure to deploy

Java/J2EE applications.

S ervle tsS e rv le ts

9 iA S

JS P sJS P s

9 iJD eve lo per E JB sE JB s

D ata base

S to redS to redP rocedu resP rocedu res

JD B CJD B C

S Q LJS Q LJ

Figure - Oracle’s Java Strategy

The figure below illustrates Oracle’s Java strategy which is explained in greater detail below.


• Development Tools - Oracle offers JDeveloper as a productive Java development tool that provides 100% support for developing and deploying J2EE applications. JDeveloper integrates UML Modeling facilities to model and generate J2EE applications and web services; a complete Java IDE to edit, compile, profile, and optimize J2EE applications and web services; and a fully integrated Oracle9iAS J2EE container that runs within the tool itself making the process of edit-compile-debug-deploy cycle fast and highly efficient.

• Application Server - Oracle9iAS provides a fully standards compliant J2EE container that runs on the standard JDK Java Virtual Machine and provides support for JSPs, Servlets, Enterprise JavaBeans (EJBs), Web Services and all J2EE services. It provides a fast, highly scalable, highly available and highly productive environment to build and deploy enterprise-scale J2EE applications.

• Database Server - For data manipulation in Java, Oracle provides a Java Virtual Machine (that is compatible with the JDK) and server environment in the database that is tightly integrated with SQL and PL/SQL. The Oracle Database environment will allow users to write traditional database stored procedures, triggers, and abstract data type (ADT) methods in Java.

• Database Access from Java - Oracle offers two different mechanisms to access databases from Java or J2EE applications: − JDBC Drivers - Oracle offers two different JDBC drivers - a Type 2 JDBC/OCI driver and a

Type 4 Pure Java JDBC driver - to access Oracle Databases from Java. Oracle also certifies and distributes the DataDirect (formerly Merant) JDBC drivers to access non-Oracle databases including IBM DB/2, Microsoft SQL-Server, Informix, and Sybase from Java.

− SQLJ - Embedded SQL in Java - Oracle also provides SQLJ - an ANSI/ISO standard programming interface that provides a standard way to embed SQL statements in Java programs. It offers a much simpler and higher productive programming API than JDBC.

Now that we have understood Oracle’s Java strategy, let us examine Oracle9iAS Containers for J2EE and review the J2EE facilities in Oracle9iAS Release 2 in greater detail. In the next section, we discuss new features for Application Developers; in the following section, we discuss improvements in performance, scalability, high availability, security, and manageability.

3. APPLICATION DEVELOPMENT FEATURES Oracle9iAS Release 2 further enhances Oracle’s support for J2EE and Web Services development providing a productive application server environment for developers to develop and deploy dynamic Web Sites, transactional Internet Applications, and Web Services. In this section, we will describe in detail the new development features for J2EE and Web Services in 6 major areas: • HTTP Server • JavaServer Pages • Servlets • Enterprise JavaBeans • Database or O-R Mapping • Web Services

3A. Oracle HTTP Server Based on the industry leading Apache Web Server, Oracle’s HTTP Server is the HTTP listening entry point to Oracle9iAS. Release 2 has several new features including: • Apache v 1.3.22 - In Release 2, Oracle HTTP Server provides a completely configured, tested, and

supported version of the Apache Web Server version 1.3.22. It incorporates extended Apache functionality to provide SSL and HTTPS support. Oracle’s HTTP Server dispatches requests to


invoke program logic written in Java, PL/SQL, PERL, or as CGI executables via a standard Apache mod architecture.

• Session Routing, IP Load Balancing - Release 2 provides session routing enhancements to optimally route requests between the web server and specific instances of the J2EE container.

• Dynamic Port Registration - To simplify configuration and management, Oracle9iAS’ HTTP Server can dynamically identify and register a set of ports when started up or restarted, either as a single instance or within a cluster. This eliminates the need to statically configure these ports.

• High Availability Facilities - Oracle has added two facilities in Release 2 for high availability - (i) Fast Restart High Availability architecture designed to detect instance failure and automatically restart Web servers eliminating system outages due to unplanned downtime; and (ii) Clustered Apache servers that allow multiple HTTP Servers to share a single virtual IP-address, to load balance requests more effectively, and to be started, shut down, upgraded, and cloned as a single set of instances. These are described in greater detail in Section 4.

Apache Mod_OC4J With Release 2, Oracle provides three new Apache mods including mod_OC4J for J2EE application request routing, mod_OSSO for single-sign on, mod_OSSL for SSL support, and mod_oraDAV for Web DAV support. Mod_oc4j acts as a connector to route requests between the HTTP Server and Oracle’s J2EE Container. Mod_oc4j uses the Apache JServ Protocol (AJP 13) binary format to pass request and response data between the two end points. By using a binary encoding instead of a text format, communication between Apache and the J2EE Container is both faster and more efficient since the message header processing is less verbose that with HTTP. mod_oc4j has been extended to support multiple OC4J instances, providing load balancing and failover. mod_oc4j supports multiple OC4J instances, providing load balancing and failover across the instances. Routing information is maintained to ensure that stateful servlet requests are always routed to the same J2EE container.

9iAS

HTTP ServerHTTP Server

ProcessPool

mod_ (ConnPool)

OC4J (J2EE)OC4J (J2EE)

9iAS

PERLPERL

9iAS

CGICGI

9iAS

Figure - Oracle9iAS HTTP Server


Proxy Plug-In Support for Netscape and Microsoft IIS With Release 2, Oracle offers a Proxy Plug-in to enable the use of Microsoft Internet Information Server (IIS), or Netscape Enterprise Server (NES) as Web servers with Oracle9iAS’ J2EE Container. The Proxy Plug-in provides users with four important benefits: • No Separate Proxy Server Required - Oracle provides a completely certified and tested proxy plug-in to

eliminate the need for users to license a separate proxy server. • Optimized Performance - Oracle’s proxy plug-in provides facilities such as cookie propagation, socket

connection keep alives, and session keep alives to optimize performance when routing requests to Oracle9iAS from either IIS or NES.

• Integrating ASP/ISAPI and NSAPI Applications - The proxy provides an efficient architecture to combine Microsoft ISAPI and ASP Applications, or NSAPI Applications with J2EE applications deployed on Oracle9iAS as shown in the figure below.

• Integrating Security - Finally, the proxy is also integrated with Oracle’s mod_OSSO facility so that Oracle’s single sign-on security continues to function even with other Web servers.

The figure below illustrates how Oracle’s proxy plug-in can be deployed with various web servers and Application Server instances.

Figure - Oracle Proxy Plug-In and IIS/Netscape Web Servers

Certification with Firewalls and Load Balancers To ensure that Oracle9iAS’ HTTP Server, Proxy Plug-in, and J2EE Container can be deployed in a variety of configurations including Internet facing systems, simple or complex DMZ architectures with one or more firewalls, and corporate intranets, Oracle9iAS Release 2 is certified with a number of leading Firewalls and Load Balancers including: • Firewalls - Cisco PIX and Checkpoint Firewall 1; and • Load Balancers - Cisco CSS, F5 BigIP, Nortel Networks, and Alteon.


3B. JavaServer Pages JavaServer Pages (JSPs) are a text-based, presentation-centric way to rapidly develop and easily maintain, information-rich, dynamic web pages. JSPs separate content presentation from content generation enabling web designers to change the overall page layout without altering the underlying dynamic content. JSPs use XML-like tags and scriptlets written in the Java programming language to encapsulate the logic that generates the content for the page. Additionally, the application logic can reside in server-based resources, such as JavaBeans, that the page accesses with these tags and scriptlets. By separating the page logic from its design and display, JSPs make it faster and easier to build web-based applications. A JSP page looks like a standard HTML or XML page, with additional elements that the JSP engine processes and strips out. Both JSP pages and servlets are more desirable than Common Gateway Interface (CGI), because CGI is not platform-independent, uses more overhead, and does not have an easy way to access parameter data and pass it to a program. JSP Elements A JSP Page consists of the following elements:

• JSP Directives - A JSP Directive passes information to the JSP engine. There are several types of JSP Directives including: Page Directives which communicate page-specific information, such as buffer and thread information or error handling; Language Directives which specify the scripting language, along with any extensions; Include Directives which can be used to include an external document in the page; and Taglib Directive which indicate a library of custom tags that the page can invoke.

• JSP Actions or Tags which implement JSP processing through JSP-specific XML-based tags. A tag is used to encapsulate functionality that can be used from a JSP Page - examples might include conditional logic, database access, and iterations. JSP 1.0 includes a number of standard tags, referred to as the core tags and JSP 1.1 includes additional standard tags. The advantage of tags is that they are easy to use and share between applications.

• Scriptlets - JSP pages can also includes include small scripts, called scriptlets, in a page. A scriplet is a code fragment, executed at request time processing. Scriptlets may be combined with static elements on the page (as in the example above) to create a dynamically-generated page. Scripts are delineated within <% and %> markers. Anything within those markers will be evaluated by the scripting language engine, in our example the Java virtual machine on the host. The JSP specification supports all of the usual script elements, including expressions and declarations.

JSP Translator Release 2 Oracle9iAS Release 2 provides a JSP 1.1 compliant translator and runtime engine. Oracle has already delivered a JSP 1.2 compliant translator and runtime as part of its J2EE 1.3 Developer Preview - the JSP 1.2 translator will be integrated with the complete Oracle9iAS offering with the first maintenance release of Oracle9iAS Release 2. Oracle’s JSP Translator has several important features:

• Simple, Body, Parameterized, and Collaboration Tags - OC4J supports simple JSP tags where the body of the tag is evaluated only once; body tags where the body of the tag may be evaluated multiple times (as in an iterator loop); parameterized tags where the tag can accept and display parameters; and collaboration tags which are a special kind of parameterized tag where two tags are designed to collaborate on a task. For example, one tag could add a certain value to the page scope and another tag can then look for this value for further processing.

• Pre-Packaged JSP Tag Libraries - To improve developer productivity, Oracle9iAS provides a large number of pre-packaged JSP tag libraries to streamline the process of building JSP applications. Tag


libraries include Connection Pooling Tags, XML Tags, EJB Tags, File Upload/Download Tags, e-mail Tags, Caching Tags, Personalization Tags and other Tags.

• Pre-Compilation of JSPs - To further improve application performance, Oracle9iAS provides facilities to enable the pre-compilation of JSPs to their final form before deploying. This removes the need for the container to compile the JSP into the corresponding Java class file when it is first requested, therefore reducing the response time for the first access of the Web application.

• Source Level Debugging of JSPs - To still further improve developer productivity, Oracle9iAS also supports source level debugging of JSPs. This eliminates the need for developers to debug their JSP applications by examining the code that is generated when the JSP is compiled. Oracle has facilities that allow developers to debug JSP Applications as standard Java applications - set breakpoints, check variable values, step through etc. - all at the source level.

• Full WAR file-based Deployment - Oracle9iAS also provides tools to: (i) Package JSP Pages and servlets into J2EE standard web application archive (WAR) files; and (ii) A deployment tool that takes the resulting WAR file and deploys it to one or more Oracle9iAS instances. The WAR deployment tool also supports cluster deployment enabling a specific archive to be simultaneously deployed to all the Oracle9iAS instances defined to constitute a “cluster”.

The remainder of this section describes the pre-packaged JSP tag libraries provided by Oracle9iAS. Connection Pool Tags With Release 2, the JSP Connection Pooling Tags have been extended - the dbOpen tag now has a new attribute, datasource. The datasource attribute can take the JNDI values for a pooled or vanilla JDBC connection datasource specified in the datasources.xml file. The JSP application that uses a connection pool will use the specified datasource attribute of the dbOpen tag and set it to the JNDI value specified in the location entry. Caching Tags Release 2 supports two types of caching tags for “edge-side” caching and caching within the JSP or servlet application.

• JESI tags - Edge Side Includes (ESI) is an W3C standard XML schema/markup language that allows dynamic content to be cached in a Web Cache or to be assembled in an “edge network.” By caching this dynamic content, it reduces the need to execute JSPs or Servlets, thereby improving performance, offloading the application servers, and reducing latency. JESI (JSP to ESI) tags are layered on top of an Edge Side Includes (ESI) framework to provide ESI caching functionality in a JSP application. JESI tags enable the user to break down dynamic content of JSP pages into cacheable components or fragments. Oracle provides several JESI Tags - <jesi:include>, <jesi:control>, <jesi:template>, <jesi:fragment>, <jesi:invalidate>, <jesi:personalize>. Release 2 provides fine-grained control allowing developers to cache fragments of JSP pages down to each individual tag - these can be cached in the Oracle9iAS Web Cache and are automatically invalidated and refreshed when a JSP changes.

• Web Object Cache tags - The Web Object Cache is an Oracle9iAS facility that allows Web applications written in Java to capture, store, reuse, post-process, and maintain the partial and intermediate results generated by JSPs or servlets. For programming interfaces, it provides a tag library (for use in JSP pages) and a Java API (for use in servlets). Cached objects might consist of HTML or XML fragments, XML DOM objects, or Java serializable objects. By caching these objects in memory, various operations can be carried out on the cached objects including - (i) Applying a different XSLT based on user profile or device characteristics on the stored XML; and (ii) To re-use a cached object


outside HTTP, such as SMTP, to send e-mail to clients. Oracle provides several Web Object Caching tags including - <ojsp:cache>, <ojsp:cacheXMLObj>, <ojsp:cacheInclude>, <ojsp:invalidatecache>. Developers can combine different tag libraries together very effectively to accomplish significant tasks with limited coding.

Sendmail Tags and JavaBean It is often useful to be able to send e-mail messages from a Web application, based either on the status of a Web site or a specific user action. The JavaMail API specifies a platform-independent and protocol-independent framework to send e-mail messages. Release 2 provides a JSP Custom Tag and JavaBean which hide the details of the JavaMail API, to more easily send e-mail through servlets or JSP pages. The sender and recipient attributes are required, and either the host or session attribute is required. The default MIME type is set to “text/plain”, and the character set is that of the response object of the JSP page context. File-Access Tags and JavaBean Release 2 also provides tag libraries and Java Beans that add convenient file upload and file download functionality to JSP pages and servlets. Files can be uploaded to or downloaded from a file system or a database (including Oracle9i Internet File System).

• File Uploading - Oracle9iAS furnishes a convenience tag, httpUploadForm, for users to specify where uploaded files will come from. The httpUploadForm tag lets users select files for uploading and creates the necessary multipart HTTP request. You also have the option of creating your own HTML form to create a request. The httpUploadBean JavaBean (usually for servlets) and httpUpload tag (for JSP pages) is used to receive and process the multipart form-encoded data stream and write the files to the appropriate location, in either the file system or a database. Target files and database rows can be over-written if they already exist.

• File Downloading - The httpDownloadBean JavaBean (usually for servlets) or httpDownload tag (for JSP pages) is used to download files. The JavaBean and the tag allow users to specify the file system source directory or the database prefix to match for file retrieval, and to obtain and display a list of the files that are available for download. Recursive downloading is also allowed.

XML tags Release 2 provides XML tags to expose the most powerful and useful features of an XML parser to JSP developers. The following three tags furnish XML functionality to JSPs and Servlets:

• Transform tag for XML/XSL data transformation - Many Web applications generating dynamic JSP pages require XSL transformation to occur in the server before results are returned to the client. You can use this transform tag to output the result either directly to the HTTP client or to a specified XML DOM object.

• Parse Tag to Convert Input Streams to XML DOMs - parsexml tag converts an input stream to an XML DOM object.

• Database Query Tag - The SQL tag dbQuery has an additional attribute, toXMLObjName, to output the query results into an XML DOM object.

EJB Tags


Release 2 also includes an EJB tag library, which provides a set of tags to simplify the use of Enterprise JavaBeans in JSP pages. The functionality of the EJB tags follows the J2EE specification - the tags are designed to instantiate EJBs by name, using configuration information in the web.xml file. One of the tags is a useBean tag, with functionality similar to that of the standard jsp:useBean tag for invoking a regular JavaBean. The following tags are available: • ejb:useHome – Looks up a Home interface • ejb:useBean – Looks up and narrows a bean • ejb:createBean - Creates a bean instance for the ejb:useBean tag to use • ejb:iterate - Iterates over the finder results from a home

When first creating an EJB instance, you will have to use a useHome tag to create a home interface instance, then the following as appropriate: • To create a single EJB instance - a useBean tag, and either the useBean tag value attribute or a

nested createBean tag • To create a collection of EJB instances and iterate through them (more typical for entity beans): an

iterate tag • After an EJB instance is created, it is placed in the appropriate scope object, and you will need only a

useBean tag to access it subsequently Other Tags

Release 2 also provides several other JSP tag libraries including:

• UltraSearch Tags - UltraSearch tags offer a streamlined way to integrate Web searching with JSPs. • Intermedia Tags - Intermedia tags enable you to easily access the full range of multimedia content from

JSPs - Images, Audio, and Video. • Personalization Tags - Oracle Personalization builds on a powerful database technology of data mining.

Using data mining algorithms, Personalization builds predictive models of users' interests, preferences, and purchasing behavior. Personalization applies data mining to e-commerce, by focusing on Web site visitors' click-through patterns, past purchases, user ratings, and demographic profiles. Personalization can make very targeted recommendations to a Web application by predicting user preferences. Personalization tags integrate the power of the Oracle Recommendation Engine with Java Server Pages to help you build dynamic content that is automatically targeted to your audience. In Release 2, Personalization is exposed to the JSP developer community by wrapping the low-level Recommendation Engine Java API (REAPI) into a standard paradigm of JSP tags.

3C. Servlets A Java Servlet is a program that extends the functionality of a Web server. A servlet receives a request from a client, dynamically generates the response (possibly querying databases to fulfill the request), and then send the response containing an HTML or XML document to the client. Servlets are similar to CGI but much easier to write, since servlets use Java classes and streams. They are also faster to execute because servlets are compiled to Java Byte code and at run time the servlet instance is kept in memory. The Oracle9iAS Servlet engine executes on the standard JDK Java VM and provides:

• Support for Servlet 2.3 - Oracle9iAS Release 2 provides full support for the Servlet 2.3 specification.


• 100% Compatible with Tomcat - It is 100% compatible for applications developed to the JSP and Servlet standards using the Tomcat Servlet Engine delivered by the Apache consortium. As a result, developers who have used Apache and Tomcat to develop their applications can very easily deploy them to Oracle9iAS.

• Complete Support for Filters - It supports simple and complex filters which are part of the Servlet 2.3 specification. Specifically, a filter is a component that is invoked when a client requests a resource that the Filter is mapped to such as a URL pattern or a Servlet Name. Normally a filter is used to wrap and manipulate a request, response, or header values before or after the execution of the original request target, and is not intended to generate the response for the client. Filters can be simple where they are configured to act upon a single request, complex where they act upon multiple requests, parameterized where they can receive input and output arguments; and chained where they can be placed into a chain where are a number of Filters can be invoked one after the other.

• Full WAR file-based Deployment - Servlets are packaged and deployed to J2EE containers using a standard Web application archive (.WAR) file. Oracle9iAS provides: (i) A WAR file packaging tool that takes several servlets (and JSPs see below) and packages them into a WAR file; (ii) A WAR file deployment tool that takes the resulting WAR and deploys it to one or more Oracle9iAS instances. The WAR deployment tool also supports cluster deployment enabling a specific archive to be simultaneously deployed to all the Oracle9iAS instances defined to constitute a “cluster”.

• Auto-Deployment of Servlets – When a Web application is deployed, the server automatically decompresses the .WAR archive, generates the container specific deployment descriptor, and makes the application immediately available for use without requiring the server to be restarted.. The Web container is also capable of compiling source code for a servlet and running the resulting application, in much the same fashion as the JSP model. This can help to shorten the develop-compile-deploy lifecycle for J2EE applications.

• Stateful Failover and Cluster Deployment of Servlets - Servlets make use of the standard servlet HttpSession object to save the conversational state for a client between method requests. The HttpSession object acts like a storage-bucket for a specific client, enabling any data that is needed on subsequent requests to be stored and then retrieved at a later time with the client specific key. A cluster is a group of Oracle9iAS servers that coordinate their actions in order to provide scalable, highly-available services in a transparent manner. Oracle9iAS supports an IP-multicast based clustering mechanism that allows servlets to transparently (i.e. without any programmatic API changes) replicate servlet session state, specifically HttpSession objects to other Oracle9iAS instances in the cluster. (For more information see section 4).

Servlet 2.3 Support Release 2 fully supports the Servlet 2.3 specification, including the following features:

• Filters - Filters are the most significant addition to the Servlet 2.3 specification. They are Java classes that implement defined interfaces and are invoked automatically by the servlet container. Filters are able to serve as either pre-proccessors, post-processors or: both: − Preprocessors that modify the request headers and request data by providing a customized

version of the request object that wraps the real request of the request before it reaches a servlet. − Postprocessors that modify the response headers and response data by providing a customized

version of the response object that wraps the real response. Examples of filters include authentication filters, logging and auditing filters, image conversion filters, data compression filters, encryption filters, and XSLT filters that transform XML content.

− Filter Interface - The Filter interface defines three interfaces - Filter, FilterChain, and FilterConfig. public void init(FilterConfig filterConfig) throws


ServletException - activates/initializes a filter; public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException - performs the actual filtering work; and public void destroy() - deactivates a filter, and releases resources. Filters can be declared using the <filter> tag in standard web.xml.

• Application Lifecycle Events - Application lifecycle events let listener objects be notified when servlet contexts and sessions are initialized and destroyed, as well as when attributes are added or removed from a context or session. This gives Web application developers greater control to manage resources and state. Two types of Lifecycle events are supported: − Servlet Context Events - Servlet Context Listeners can be used to manage resources or state

held at a VM level for the application. − HTTP Session Events - HTTP Session Listeners can be used to manage state or resources

associated with a series of requests made into a Web Application from a particular client or user. The following table shows the different event types with the appropriate listener interfaces in the

Servlet 2.3 specification, all of which are supported in Oracle9iAS Release 2.

Event Type Description Listener Interface Servlet Context Events Lifecycle Changes to attributes

The servlet context has just been created and is available to service its first request, or the servlet context is about to be shutdown Attributes on the servlet context have been added, removed or replaced

javax.servlet.ServletContextListener javax.servlet.ServletContextAttributesListener

Event Type Description Listener Interface Http Session Events Lifecycle Changes to attributes

An HttpSession has just been created, or has been invalidated or timed out Attributes have been added, removed or replaced on the HttpSession

javax.servlet.http.HttpSessionListener javax.servlet.HttpSessionAttributesListener

Figure - Application Lifecycle Events

3D. Enterprise JavaBeans Enterprise JavaBeans (EJB) components are designed to encapsulate business logic, so that the developer does not have to worry about mundane things such as database access, transaction support, security, caching, and concurrency. In the EJB specification they are the responsibility of the EJB container. An enterprise bean consists of interfaces and classes. Clients access enterprise bean methods through the enterprise bean's home and remote interfaces. The home interface provides methods for creating, removing, and locating the enterprise bean and the remote interface provides the business methods. At deployment time, the container creates classes from these interfaces that it uses to provide access to clients seeking to create, remove, locate, and call business methods on the enterprise bean. The enterprise bean class provides the implementations for the business methods, create methods, and finder methods; and if


the bean manages its own persistence, provides implementations for its lifecycle methods as well. There are two types of enterprise beans - session beans and entity beans.

• Session Beans - A session bean represents a transient conversation with a client, and might execute database reads and writes. A session bean might invoke the JDBC calls itself, or it might use an entity bean to make the call, in which case the session bean is a client to the entity bean. A session bean's fields contain the state of the conversation and are transient. If the server or client crashes, the session bean is lost. Session beans can be stateful or stateless. − Stateful Session Beans - A stateful session bean contains conversational state on behalf of the

client. The conversational state is the session bean's instance field values plus all objects reachable from the session bean's fields. Stateful session beans do not represent data in a persistent data store, but they can access and update data on behalf of the client.

− Stateless Session Beans - Stateless session beans do not have any state information for a specific client. They typically provide server-side behavior that does not maintain any particular state. Stateless session beans require fewer system resources. A business object that provides a generic service or represents a shared view of stored data is a good candidate for a stateless session bean.

• Entity Beans - An entity bean represents data in a database and the methods to act on that data. In a relational database context for a table of employee information, there is one bean for each row in the table. Entity beans are transactional and long-lived - as long as the data remains in the database, the entity bean exists. Entity Beans can support either container managed or bean managed persistence. − Container Managed Persistence (CMP) - With CMP, an application developer does not need

to explicitly map the Entity Bean to the persistent database store since the EJB container transparently maps and manages the Entity Bean’s interaction with the persistent store. As a result, an entity bean using CMP does not require the developer to use any JDBC 2.0 APIs for database access, making CMP simpler and easier to use - however, it limits the application developer’s control of the interaction between the Application Server and database and, therefore, may introduce some performance overhead.

− Bean Managed Persistence (BMP) - In contrast, BMP can be used by developers who want maximum control between the way an enterprise bean writes and reads state from a persistent store. BMP is more complex than CMP since the application developer will have to implement the bean's lifecycle methods with JDBC 2.0 API code to handle loading and storing data and maintaining consistency between the run time and persistent database storage. BMP should be used by developers looking for maximum control over the EJB and also when an EJB is being backed up in a non-relational database.

Oracle9iAS Release 2 provides a JDK-based EJB Container that provides an EJB 1.1 Compliant Runtime and several important aspects of the EJB 2.0 Specification. Oracle has already delivered an EJB 2.0 runtime as part of its J2EE 1.3 Developer Preview - this will be integrated with the complete Oracle9iAS offering with the first maintenance release of Oracle9iAS Release 2. The key Release 2 features are:

• Complete Container Managed (CMP) and Bean Managed Persistence (BMP) Implementation - Oracle9iAS provides complete CMP and BMP for Entity Beans supporting both its own object-relational mapping (O-R) and the O-R mapping specified in the EJB 2.0 specification.

• Complete Set of J2EE Services - Oracle9iAS Release 2 provides a comprehensive set of J2EE services - JMS (Messaging), JTA (Transactions), JNDI (Naming and Directory), JCA (Connectors), JAAS (Security), JavaMail (Mail), and MDBs (Message Driven Beans). It also provides a number of features to make database access from J2EE applications efficient and flexible.

• Dynamic EJB Stub Generation - To improve productivity, a developer does not need to pre-compile EJB stubs using ejbc, rmic or other such facilities into the client application. Rather, the Oracle9iAS EJB


container generates EJB stubs on demand as it needs them - this makes application and system maintenance significantly simpler than competitor products.

• Full EAR File-based Deployment - Oracle9iAS provides tools to: (i) Package WAR and Enterprise JavaBeans into standard J2EE enterprise application archives (EAR files); and (ii) A deployment tool that takes the resulting .EAR file and deploys it to one or more Oracle9iAS instances. The EAR deployment tool also supports cluster deployment enabling a specific archive to be simultaneously deployed to all the Oracle9iAS instances defined to constitute a “cluster”.

• Automatic Deployment of EJB Applications - In J2EE applications, there are two kinds of deployment descriptors or module-configuration files. The generic J2EE deployment files that all application servers support and vendor specific files - the generic descriptor files are used by the application developer or component assembler and the vendor specific descriptor files are used by the application deployer. In the auto-deployment scenario, the Oracle specific deployment information is automatically generated when the J2EE EAR file is deployed on the server. When an application developer changes an EJB module that has already been deployed, the developer does not need to either re-deploy the EJB or restart the server. The user needs to simply edit the server.xml configuration file, the server reads the file, and automatically picks up the changes.

• Stateless and Stateful EJB Clustering - A cluster is a group of Oracle9iAS servers that coordinate their actions in order to provide scalable, highly-available services in a transparent manner. With Release 2, stateless session EJBs, stateful session EJBs, and Entity Beans can be clustered using an IP-multicast based clustering mechanism to transparently replicate session state and to support load balancing and failover. Release 2 also provides a number of services to make cluster-wide application deployment and configuration easy and efficient. (For more information, see section 4 below).

The figure below conceptually illustrates Oracle’s J2EE Container and the various services it provides.

Figure - Oracle9iAS J2EE Services

In the remainder of this section we will discuss the various EJB facilities in Oracle9iAS in greater detail. Java Transaction API (JTA) The Java Transaction API (JTA) and Java Transaction Service (JTS) form the basis of the transactional support in J2EE and more specifically for EJB and JDBC 2.0. JTS is a low-level API for transaction


management that basically maps Java to the Object Management Group (OMG) Object Transaction Service. JTA is a high-level API that consists of two parts:

• Transaction Interface allows transaction demarcation to enable groups of operations done by distributed components to be bound into a single global transaction.

• XA Resource Interface enables the handling of distributed transactions - called Two Phase Commit transactions - which involve coordination of a transaction across more than one resource.

Oracle9iAS Release 2 provides a complete implementation of the JTA specification for highly scalable 1PC and 2PC. There are several enhancements with Release 2 including highly optimized 1 PC operations and several new concurrency control models (described in the performance section below). Java Messaging Service (JMS) JMS is the J2EE mechanism to enable asynchronous communication through the exchange of messages between Java programs. JMS supports two messaging models:

• Point to Point is based on message queues. A message producer sends a message to a queue. A message consumer attaches itself to a queue to listen for messages. When a message arrives on the queue, the consumer takes it off the queue and responds to it. Messages can be sent to just one queue and will be used by just one consumer. Consumers have the option to filter messages to specify the exact message types they want.

• Publish and Subscribe is a model in which producers send messages to a topic and all the registered consumers for that topic retrieve those messages. In this case, many consumers can receive the same message.

Oracle9iAS Release 2 provides support for JMS in the following manner:

• Fast, Lightweight, Compliant - Oracle9iAS provides two out-of-the-box JMS implementations - OracleJMS which uses the Oracle database’s integrated Advanced Queuing (AQ) to offer secure, transactional, recoverable, guaranteed delivery of messages. Oracle9iAS also offers a fast, lightweight, in-memory JMS that can be used to pass messages between applications in the mid-tier.

• Pluggable JMS Providers - Oracle9iAS J2EE applications (application-client programs, servlets, EJBs, and so on) can access queues and topics using the JMS API. They can use an Oracle9iAS specific JNDI namespace to look up JMS ConnectionFactories and Destinations. Oracle9iAS defines a ResourceProvider interface for plugging in message providers and provides the implementation classes for Oracle's Advanced Queuing and for third-party messaging systems such as MQSeries, SonicMQ and SwiftMQ. The implementation classes and the connection factories make the message providers known in the Oracle9iAS namespace (java:comp/env/jms) for JMS consumers such as Java clients and Message-Driven Beans. The Oracle9iAS ResourceProvider interface allows switching between message providers transparently to the JMS client. JMS clients can mix messages from multiple messaging systems in the same application, and switch between them (merely by changing the JNDI mappings) without any change in the source code.

• OracleJMS - OracleJMS is the Java front-end for the Oracle database integrated Advanced Queuing (AQ), which offers secure, transactional, recoverable, guaranteed delivery of messages. Advanced Queuing provides a number of important facilities: OJMS leverages the Oracle database robustness, query-ability and DML operations, scalability and high availability, and support for all data types in message payload, including relational data, text, XML, and multimedia. The following general features are discussed: − Message Retention and Queryability - Oracle AQ integrates a messaging system with the

Oracle Database leveraging the database’s robustness, and providing guaranteed message


retention and auditing/tracking while eliminating the need for 2-PC operations between the messaging system and the database. Further, since the queues are stored in the Oracle Databases, they can be queried using standard SQL.

− Message Payloads - Oracle AQ can support a variety of structured and unstructured datatypes as message payloads including relational data, text, XML, objects, and multimedia data.

− Message Transports - Oracle AQ also provides support for reliable once-only, in-order delivery of messages over a variety of transports including SOAP, Net8, and others. It can also use other messaging providers such as MQ-Series for transport.

− Secure Access - Finally, Oracle AQ provides stringent access control on individual queues and messages using the database’s ACL mechanisms.

Message Driven Beans (MDBs) A Message Driven Bean is an enterprise bean that allows J2EE applications to process messages asynchronously. It acts as a JMS message listener, which is similar to an event listener except that it receives messages instead of events. The messages may be sent by any J2EE component - an application client, another enterprise bean, or a Web component - or by a JMS application or system that does not use J2EE technology.

• Message Driven Beans vs Session Beans - In several respects, a message-driven bean resembles a stateless session bean: (i) A message-driven bean's instances retain no data or conversational state for a specific client. (ii) All instances of a message-driven bean are equivalent, allowing the EJB container to assign a message to any message-driven bean instance. (iii) The container can pool these instances to allow streams of messages to be processed concurrently. (iv) A single message-driven bean can process messages from multiple clients. Session beans and entity beans allow you to send JMS messages and to receive them synchronously, but not asynchronously. To avoid tying up server resources, you may prefer not to use blocking synchronous receives in a server-side component. To receive messages asynchronously, use a message-driven bean.

• Message Driven Beans and JMS Listeners - A MDB is a JMS message listener that can reliably consume messages from a queue or a durable subscription. The advantage of using an MDB instead of a JMS message listener is that the EJB container does a lot of the work for you. − The consumer is created for the listener. That is, the appropriate QueueReceiver or

TopicSubscriber is created by the container. − The MDB is registered with the consumer. The container registers the MDB with the

QueueReceiver or TopicSubscriber and its factory at deployment time. − The message acknowledgment mode is specified.

• Oracle9iAS MDB Support - Oracle9iAS Release 2 provides a complete MDB implementation. MDBs can subscribe on both queues and topics and they can be activated from any JMS provider that is registered with the application server over any of the transports supported by the JMS provider. When a message arrives, the container calls the message-driven bean's onMessage method to process the message. The onMessage method normally casts the message to one of the five JMS message types and handles it in accordance with the application's business logic. The onMessage method may call helper methods, or it may invoke a session or entity bean to process the information in the message or to store it in a database. A message may be delivered to a message-driven bean within a transaction context, so that all operations within the onMessage method are part of a single transaction. If message processing is rolled back, the message will be redelivered.

Active Components for J2EE (AC4J)


The existing J2EE framework provides a very productive and scalable environment to author and deploy transactional based, short lived applications. However, it does not yet fully address emerging e-business requirements of long-lived interactions between autonomous applications. Further, as Web Services proliferate within organizations, Web Services will need to communicate with other Web Services in a loosely coupled environment, over a long period of time, without limiting resources, and surviving abnormal system crashes. Long-lived interactions between autonomous application components and Web Services require that all participants act as peers and communicate in an asynchronous and reliable fashion. To address these issues, Oracle9iAS Release 2 introduces “Active Components for J2EE” (AC4J), a programming framework for easily developing loosely coupled applications, which are consistent, scaleable, and recoverable. AC4J introduces the concept of loosely coupled beans, known as Active Enterprise Java Beans. An AC4J is a standard EJB with several important features:

• Autonomous Peer Model – With AC4J, each application, when interacting with another application, exists as an autonomous peer. The responding application may choose to ignore the request, or to execute one or more functions on behalf of the requestor (possibly different than the one that the requestor asked for), before responding to the initiating application. As peers, both applications can make requests to each other, but neither can require submission from the other. Neither application can assume control over the resources that its peer application owns. To support this programming model, Oracle9iAS provides reliable Asynchronous, Disconnected, one way, or request/response type Interactions between Active EJBs.

• Declarative Specification - AC4J makes this entire paradigm easy to program allowing users to declaratively specify a number of pieces of information by simply adding attributes to the EJB deployment descriptor. When deployed, Oracle9iAS provides a runtime environment that automatically provides a number of services for these components. AC4J hides queues/topics and related JMS constructs from applications, provides automatic definition of communication message formats, and packs/unpacks messages, automatic routing of service requests to the appropriate service provider, automatic security context propagation, authorization and identity impersonation, automatic exception routing and handling, which is integrated in the EJB framework and automatic tracking and documenting of the computation progress of ActiveEJBs.

• Transactional Data Driven Execution of EJB Applications - AC4J also provides composite matching on available data based on specified rules, which describe under which conditions these data can fire which EJB method. Coupled with the transparent scheduling and activation of EJBs and execution of their methods that this provides, AC4J enables transactional data driven execution of EJBs.

• Long-Running Transactions - Since the communication between the various services and the associated tasks being performed can take a very long period of time, AC4J provides automatic durability of J2EE computational state in a portable way, automatically passivating and activating state as necessary.

• Sophisticated Capabilities - Further, with AC4J, Oracle9iAS automatically manages load balancing and scalability transparently to the applications, provides conversational state and globally visible identity (ActiveHandle); supports parallel and incremental invocation of Active EJB methods and synchronization on their results (fork and join operations); and supports restart-ability of Active EJB business method(s) in the case of system or application failures while monitoring and enforcement of application consistency.


Figure - Active Components for J2EE

Java Naming and Directory Interface (JNDI) JNDI is the standard interface to naming and directory services. J2EE applications use JNDI to find other distributed objects. The JNDI Interface has two parts: an application-level interface that is used by application programs to access naming and directory services and a service provider interface to attach a provider of naming and directory services. Oracle9iAS Release 2 provides a complete JNDI 1.2 implementation. Web applications and Enterprise JavaBeans access names using the standard JNDI programming interfaces. With Release 2, the JNDI service provider can either be implemented - (i) In an XML-based file system; or (ii) In an LDAP Directory as an alternative JNDI Service Provider. The JNDI environment allows components and subcomponents to be specified for a system, without having to customize the code of the system. The specification recommends, but does not require, that all resource manager connection factory references be organized in the subcontexts of the environment of the application component, using a different subcontext for each resource manager type. With Release 2, all J2EE objects are specified with a specific JNDI context:

• System-Provided Objects, such as transaction context (JTA UserTransaction objects) and factories, are stored in java:comp/env.

• All User-Defined Objects (<env-entry> tag) such as enterprise beans, environment entries, JDBC datasource, and message connections are stored in corresponding subcontexts - java:comp/env/jdbc for datasources references,java:comp/env/jms for JMS connection factories, java:comp/env/mail for JavaMail connection factories, and java:comp/env/url for URL connection factories.

J2EE Connector Architecture (JCA) The J2EE Connector Architecture (JCA) defines a standard architecture for connecting the J2EE platform to heterogeneous Enterprise Information Systems (EIS). Examples of such systems include Packaged


Applications, mainframe transaction processing systems, database systems, and legacy applications not written in the Java programming language. Oracle9iAS Release 2 supports the various different aspects of the JCA specification including:

• Resource Adapter - A resource adapter is a driver used by an application server or an application client to connect to a specific EIS. Examples of resource adapters are JDBC or SQLJ drivers to connect to a relational database, an ERP resource adapter to connect to an ERP system, and a TP resource adapter to connect to a TP monitor. Oracle9iAS Release 2 supports both stand-alone and embedded resource adapters. A stand-alone resource adapter, materialized by a stand-alone Resource Adapter Archive (RAR) file, is available to all deployed applications in the application server instance. An embedded resource adapter, bundled within an enterprise application archive (EAR), is available only to the J2EE application with which it is packaged.

• Application Contract - The client API furnished by a resource adapter can either be the standard Common Client Interface (CCI), or a client API specific to the type of a resource adapter and its underlying EIS. The EIS side of the contract, is implemented by the resource adapter, transparently to the application components Oracle9iAS Release 2 provides full support for JCA client API.

• Quality of Service - Oracle9iAS Release 2 also supports the three “Quality of Service” (QoS) contracts between an application server and an EIS. All resource adapters must support their side of the QoS contracts to be pluggable into Oracle9iAS Release 2: − Connection Pooling enables an application server to pool connections to an underlying EIS, and

enables application components to connect to an EIS. − Transaction Management enables an application server to use a transaction manager (JTA

XAResource) to manage transactions across multiple resource managers. − Security Management provides authentication, authorization, and secure communication

between the J2EE server and the EIS.

• Pre-Packaged JCA Connectors - Finally, Oracle certifies a number of JCA connectors to connect to Oracle and non-Oracle Databases, Packaged Applications, and Legacy Systems. The figure below conceptually illustrates the services that Oracle9iAS offers for legacy connectivity. More information on these can be found from the Oracle9iAS Integration Whitepaper.

Figure - Oracle9iAS J2EE Connectivity


J2EE 1.3 Features All the services described up to this point in this section are part of Oracle9iAS Release 2, v902. In the remainder of this section, we discuss a set of services that are part of the EJB 2.0 specification which have already been delivered by Oracle as part of its J2EE 1.3 Developer Preview and will be officially supported as part of the first maintenance release of Oracle9iAS Release 2. Local Interfaces for Enterprise JavaBeans A client may access a session or an entity bean only through the methods defined in the bean's interfaces which define the client's view of a bean. All other aspects of the bean - method implementations, deployment descriptor settings, abstract schemas, database access calls - are hidden from the client providing modularity and encapsulation. Well designed interfaces simplify the development and maintenance of J2EE applications by shielding clients from any complexities in the business logic and also allowing the EJBs to change internally without affecting the clients. EJBs support two types of client access - remote or local.

• Remote Access - A remote client of an enterprise bean has the following traits: (i) It may run on a different machine and a different Java Virtual Machine (JVM) than the enterprise bean it accesses. (ii) It can be a web component, a J2EE application client, or another enterprise bean. (iii) To a remote client, the location of the enterprise bean is transparent. To create an enterprise bean with remote access, you must code a remote interface and a home interface. The remote interface defines the business methods that are specific to the bean.

• Local Access - A local client has these characteristics: (i) It must run in the same JVM as the enterprise bean it accesses. (ii) It may be a web component or another enterprise bean. (iii) To the local client, the location of the enterprise bean it accesses is not transparent. (iv) It is often an entity bean that has a container-managed relationship with another entity bean. To build an enterprise bean that allows local access, you must code a local interface and a local home interface. The local interface defines the bean's business methods and the local home interface defines its life-cycle and finder methods.

• Local Interfaces and Container-Managed Relationships - If an entity bean is the target of a container-managed relationship, then it must have local interfaces. Further, if the relationship between the EJBs is bi-directional, both beans must have local interfaces. Moreover, since they require local access, entity beans that participate in a container-managed relationship must reside in the same EJB container. The primary benefit of this locality is increased performance - local calls are usually faster than remote calls.

• Local vs Remote Access - The decision on whether to allow local or remote access depends on the following factors: (i) Container-Managed Relationships - If an entity bean is the target of a container-managed relationship, it must use local access. (ii) Tight or Loose Coupling of Related Beans - tightly coupled beans depend on one another. For example, a completed sales order must have one or more line items, which cannot exist without the order to which they belong. The OrderEJB and LineItemEJB beans that model this relationship are tightly coupled. Tightly coupled beans are good candidates for local access. Since they fit together as a logical unit, they probably call each other often and would benefit from the increased performance that is possible with local access.

Oracle9iAS provides complete support for local interfaces. Enterprise JavaBeans Query Language (EJB QL)


EJB QL defines the queries for the finder and select methods of an entity bean with container-managed persistence. A subset of SQL92, EJB QL has extensions that allow navigation over the relationships defined in an entity bean's abstract schema. The abstract schema is part of an entity bean's deployment descriptor and defines the bean's persistent fields and relationships. The term "abstract" distinguishes this schema from the physical schema of the underlying datastore. The abstract schema name is referenced by EJB QL queries since the scope of an EJB QL query spans the abstract schemas of related entity beans that are packaged in the same EJB JAR file. For an entity bean with container-managed persistence, an EJB QL query must be defined for every finder method (except findByPrimaryKey). The EJB QL query determines the query that is executed by the EJB container when the finder method is invoked. Oracle9iAS provides complete support for EJB QL with the following important features: • Automatic Code Generation - EJB QL queries are defined in the deployment descriptor of the entity bean.

When the EJBs are deployed to Oracle9iAS, the container automatically translates the queries into the SQL dialect of the target data store. Because of this translation, entity beans with container-managed persistence are portable -- their code is not tied to a specific type of data store.

• Optimized SQL Code Generation- Further, in generating the SQL code, Oracle9iAS makes several optimizations such as the use of bulk SQL, batched statement dispatch, etc. to make database access efficient.

• Support for Oracle and Non-Oracle Databases - Further, Oracle9iAS Release 2 provides the ability to execute EJB QL against any database - Oracle, MS SQL-Server, IBM DB/2, Informix, and Sybase.

• CMP with Relationships - Oracle9iAS supports EJB QL for both single entity beans and also with entity beans that have relationships, with support for any type of multiplicity and directionality.

CORBA Support - RMI-over-IIOP RMI over IIOP is part of the J2EE 1.3 Specification and provides two important benefits - (i) RMI over IIOP provides the ability to write CORBA applications for the Java platform without learning CORBA Interface Definition Language (IDL). (ii) IIOP eases legacy application and platform integration by allowing applications written in C++, Smalltalk, and other CORBA supported languages to communicate with J2EE components. Oracle9iAS supports RMI-over-IIOP providing the following important facilities:.

• Automatic IDL Stub and Helper Class Generation - To work with CORBA applications in other languages, IDL, CORBA stubs and skeletons can be generated - (i) Automatically by Oracle9iAS when the J2EE Application is deployed to it. (ii) IDL can also be generated from J2EE interfaces using the rmic compiler with the -idl option. Further, developers can use the rmic compiler with the -iiop option to generate IIOP stub and tie classes, rather than Java Remote Messaging Protocol (JRMP) stub and skeleton classes.

• Objects-By-Value - Oracle9iAS’ RMI-IIOP implementation provides flexibility by allowing developers to pass any serializable Java object (Objects By Value) between application components.

• POA Support - The Portable Object Adapter (POA) is designed to provide an object adapter that can be used with multiple ORB implementations with a minimum of rewriting needed to deal with different vendors' implementations. The POA is also intended to allow persistent objects -- at least, from the client's perspective. That is, as far as the client is concerned, these objects are always alive, and maintain data values stored in them, even though physically, the server may have been restarted many times, or the implementation may be provided by many different object implementations. Oracle9iAS provides complete POA support.


• Interoperating with Other ORBs - Oracle9iAS’ RMI-IIOP implementation will interoperate with other ORBs that support the CORBA 2.3 specification. It will not interoperate with older ORBs, because these are unable to handle the IIOP encodings for Objects By Value. This support is needed to send RMI value classes (including strings) over IIOP. Oracle9iAS also provides complete support for the Interoperable Naming, Security, and Transactions elements in the J2EE 1.3 specification allowing developers to build J2EE applications and interoperate them with J2EE applications on other Application Servers and with legacy systems through CORBA.

CMP with Relationships The EJB 2.0 specification enables the specification of relationships between entity beans. An entity bean can be defined so as to have a relationship with other entity beans. For example, in a project management application the ProjectEJB and TaskEJB beans would be related because a project is made up of a set of tasks. You implement relationships differently for entity beans with bean-managed-persistence than those entity beans that utilize container-managed-persistence. With bean-managed persistence, the code that you write implements the relationships. With container-managed persistence, the EJB container takes care of the relationships for you. For this reason, relationships in entity beans with container-managed persistence are often referred to as container-managed relationships.

• Relationship Fields - A relationship field in an EJB identifies a related bean. A relationship field is virtual and is defined in the enterprise bean class with access methods. Unlike a persistent field, a relationship field does not represent the bean's state.

• Multiplicity in Container-Managed Relationships - There are four types of multiplicities all of which are supported by Oracle9iAS: − One-to-One - Each entity bean instance is related to a single instance of another entity bean. − One-to-Many - An entity bean instance is related to multiple instances of the other entity bean. − Many-to-One - Multiple instances of an entity bean may be related to a single instance of the

other entity bean. This multiplicity is the opposite of one-to-many. − Many-to-Many - The entity bean instances may be related to multiple instances of each other.

• Direction in Container-Managed Relationships - The direction of a relationship may be either bi-directional or unidirectional. In a bi-directional relationship, each entity bean has a relationship field that refers to the other bean. Through the relationship field, an entity bean's code can access its related object. If an entity bean has a relative field, then we often say that it "knows" about its related object. For example, if an ProjectEJB bean knows what TaskEJB beans it has and if each TaskEJB bean knows what ProjectEJB bean it belongs to, then they have a bi-directional relationship. In a unidirectional relationship, only one entity bean has a relationship field that refers to the other. Oracle9iAS supports both unidirectional and bi-directional relationships between EJBs.

• EJBQL and CMP With Relationships - EJB QL queries often navigate across relationships. The direction of a relationship determines whether a query can navigate from one bean to another. With Oracle9iAS, EJBQL queries can traverse CMP Relationships with any type of multiplicity and with both unidirectional and bi-directional relationships.

3E. Database Access and O-R Mapping

Oracle9iAS Release 2 provides a number of optimizations to improve how efficiently J2EE applications can access Oracle and non-Oracle Databases. Release 2 provides a variety of different options to communicate with databases from Java - it provides a number of enhancements to its own O-R mapping facilities; integrates with industry leading O-R mapping solutions such as Toplink; provides better


integration with Oracle’s Business Components for Java framework; and has enhancements to both JDBC and SQLJ. Each of these are explored in greater detail below. Oracle9iAS Object-Relational Mapping Oracle9iAS furnishes, out of the box, its own persistence manager for entity beans, which supplies both simple (1:1) mapping and complex relationship (1:n) mapping. • Simple O-R Mapping - Oracle9iAS supports both 1:1, Many:1, and 1:Many object-relational mappings.

It automatically maps fields of an entity bean to corresponding database table. Additionally, it allows users to specify object-relational mappings between EJBs allowing developers to use 1:1 Mappings in EJBs with zero work.

• Complex O-R Mappings - A common problem is that it is hard to map anything but a simple bean with simple fields to a database table without writing custom code to do the mapping. As a result, most entity bean development is divided into two categories - simple (1:1) object models that use CMP; and practical (more complex) object models that use BMP. Oracle9iAS includes an O-R mapping system that allows complex object models to be mapped to database tables with ease allowing practical object models to use CMP. Specifically, it allows the following types of fields to be mapped within entity beans: simple objects and primitives (e.g. INT, CHAR); objects (compound objects); serializable objects (compound objects that can be serialized and stored in BLOBs and CLOBs); entity reference (a reference to another entity bean); and collections. Further, it provides an isolation layer that captures the SQL that is automatically code generated allowing the CMP facilities to target Oracle and non-Oracle databases.

• EJB 2.0 O-R Mapping - Oracle9iAS Release 2 provides complete support for the EJB 2.0 O-R mapping specification.

Third Party O-R Mappings - TopLink Integration Release 2 integrates leading third party O-R mapping solutions including TopLink for Java, with the EJB container. TopLink provides developers with the flexibility to map objects and Enterprise Java Beans to a relational database schema with minimal impact. TopLink for Java provides advanced mapping capabilities such as bean/object identity mapping, type and value transformation, relationship mapping (1:1, 1:n and m:n), object caching and locking, batch writing, and advanced and dynamic query capabilities. TopLink offers a GUI mapping tool - the TopLink Mapping Workbench - which simplifies the process of mapping J2EE components to database objects. TopLink provides EJB 2.0 support, automatic or developer-configured bi-directional relationship maintenance, automatic or developer-configured cache synchronization session management via XML, and optimistic read locking. Oracle9iAS is also integrated with other leading O-R mapping solutions in the market. The information can be obtained from http://www.oracle.com. Business Components for Java BC4J Release 2 improves the ease of deployment, scalability, and runtime aspects of BC4J. Specifically BC4J has a number of new runtime features including - (i) Inheritance Support with a Discriminator allowing users to subclass business components, polymporphic View Objects, View Objects based on any Data Source, View Link and Association Enhancements, and support for Oracle Object Types. Further, BC4J application module pools and connection pools can be more flexibly configured for improved scalability including the ability to set maximum pool size, initial pool size, high water marks, thread safety, and statistics collection and logging facilities. Finally, BC4J application modules can be packaged as EJB jars and web archives (WAR), and individual archives can be packaged into enterprise archives (EAR) to be deployed to Oracle9iAS.


JDBC Enhancements With Oracle9iAS Release 2, Oracle provides Type 2 and Type 4 JDBC drivers to access Oracle8i and 9i Databases from Java. With Release 2, there are several JDBC Enhancements with both drivers being fully JDBC 2.0 compliant. They provide: • Complete Data Type Support - Support for advanced data types, such as BLOBs, CLOBs, Character

Streams; Abstract Data Types; Collections; and with the Oracle9i Database Release support for Abstract Data Types with Inheritance

• JDBC 2.0 Connection Pooling - They provide full support for JDBC 2.0 Connection Pools. • Advanced Features - They also provide a number of advanced features such as support for Transparent

Application Failover which allows the mid-tier to redirect connections to a “failed-over” node when an Oracle Database fails; scrollable result sets; batch updates; Unicode support; and several other advanced capabilities.

• DataDirect JDBC Drivers - To access non-Oracle Databases from OC4J, Oracle distributes the Type 4 JDBC Drivers from DataDirect (formerly Merant). The DataDirect JDBC drivers provide access to Informix, Sybase, Microsoft SQL-Server, and IBM DB/2 Databases from Oracle9iAS.

• Non-Emulated Data Sources – In addition to the familiar emulated DataSource provided in earlier releases, Release 2 introduces a new non-emulated DataSource model for Oracle9iAS. The new non-emulated expose OracleConnection objects which are faster, take advantage of Oracle JDBC driver extensions, and supply better integration with the transaction managers.

SQLJ Enhancements SQLJ is an ANSI and an ISO standard that simplifies database access from Java by embedding SQL statements in Java programs. SQLJ is an attractive alternative to JDBC programmers, because SQLJ code is more concise than JDBC, and SQLJ supports early type checking and SQL statement checking. The key new SQLJ enhancements with Release 2: • Full Syntax Parsing - SQLJ translation now provides full syntax parsing of embedded SQL and

PL/SQL statements. You can turn this feature on with the SQLJ command line flag parse=both. • SQLJ-specific Data Sources - The SQLJ runtime for Oracle9iAS (runtime12ee.jar) now provides SQLJ-

specific datasources. These have the same functionality as corresponding Oracle JDBC datasources, but additionally allow SQLJ developers to obtain SQLJ connection contexts just as easily as JDBC connections. The SQLJ datasources implement the interface sqlj.runtime.SqljDataSource, with (among others) the additional methods: DefaultContext getDefaultContext(); DefaultContext getDefaultContext(String user,String password().

3F. Web Services Web Services are a set of Internet standard messaging protocols, programming standards, and network registration and discovery facilities that expose business Applications to other Services over the Internet. Release 2 provides a complete infrastructure for developing, deploying and managing Web Services supporting SOAP 1.1, WSDL 1.1, and UDDI 1.0. Oracle also provides early versions of upcoming J2EE standards for Web Services including JAX-M, JAX-P, JAX-RPC, and JAX-R.. Oracle9i JDeveloper is integrated with Oracle9iAS Release2 providing developers with a highly productive environment to develop Web Services. While this section provides a very brief overview of Oracle9iAS’ capabilities for Web Services, more information can be found in the Oracle9iAS Web Services whitepaper.


Oracle9iAS Release 2 Web Services Facilities There are several new features in Oracle9iA providing’ support for Web Services:

• SOAP Message Processor - Oracle9iAS provides a SOAP 2.2 Message Processor which runs as a servlet on Oracle9iAS’ J2EE Container and provides the following facilities: (i) SOAP Protocol Handling - It provides a complete implementation of the interoperable SOAP specification including support for SOAP requests with attachments (XML payloads); support for cookies and sessions which are useful to pass state information for stateful Web Services; and support for SOAP message delivery over a variety of transports including HTTP and SMTP. Oracle9iAS’ SOAP processor integrates the Oracle XML Parser and provides a number of performance optimizations to process both RPC-style and messaging requests.

• WSDL Stubs and Skeleton Generation Facilities - Oracle9iAS provides tools to generate WSDL 1.1 compliant stubs and skeletons in two ways - (i) Auto-Generation - With Release2, an application developer does not necessarily need to statically generate the WSDL interfaces for a Web Service and pre-compile the client stubs into a client application. Rather, the Oracle9iAS Web Services’ runtime automatically generates WSDL, server skeletons, and clients stubs on demand as it needs them - this makes application and system maintenance significantly simpler than competitor products. (ii) WSDL Generation Tools - Optionally, Oracle9iAS also provides a set of tools to statically generate WSDL XML and client stubs given a Java class or J2EE application. These tools have also been integrated seamlessly with Oracle’s JDeveloper development tool and other IDEs.

• UDDI Registry - Oracle9iAS provides a UDDI v 1.0 compliant registry to publish and discover Web Services. It has several important elements - (i) Database-backed - Oracle9iAS’ uses an Oracle Database to store UDDI information persistently and reliably and is fast, highly scalable, and highly reliable. It leverages Oracle Advanced Security facilities so that only authenticated and authorized clients can access it. (ii) Browsing - The UDDI registry can be browsed using any standard UDDI browser and is certified with Microsoft and IBM’s UDDI browsers. (iii) Compliant Programmer API - It completely implements the UDDI Programmer API specification which allows users to browse, query, and publish web services. It can be operated both as a private UDDI registry within organizations and as a public UDDI node supporting the standard UDDI synchronization mechanisms. (iv) Managing UDDI Entries - The UDDI registry supports a number of standard UDDI classification taxonomies. Web Services can be published to the UDDI registry, and existing services can be both browsed and deleted using Oracle Enterprise Manager.

• Runtime Environment - Oracle9iAS Release 2 provides a unified runtime environment for J2EE applications and Web Services. This provides Web Services with a number of services including transaction management, messaging, naming, efficient request brokering, and lifecycle management. − Develop Web Services - Web Services can be implemented in a number of different ways -

stateless and stateful Java Classes, stateless session EJBs, message-driven beans, and PL/SQL and Java stored procedures There are two ways in which Web Services can be invoked on Oracle9iAS - RPC-style and messaging.

− RPC-Style Invocation - For RPC-style requests Oracle supports both a highly efficient static binding (similar to a CORBA TIE implementation) and a dynamic binding (aligned with the proposed JAX-RPC standard).

− Messaging Style Invocation - Oracle allows a JMS listener including Oracle AQ, to receive and process a SOAP message payload. Oracle also supports guaranteed, once-only, in-order delivery of SOAP messages over HTTP and SMTP transports.


The figure below illustrates conceptually the various Web Services facilities of Oracle9iAS.

Figure - Oracle9iAS Web Services

99iiASAS

Java ClassJava Class

JSPJSP

ServletServlet

LegacyLegacyLegacy

SSKKEELLEETTOONN

DB

PL/SQLPL/SQL

Static RPCStatic RPC

DynamicDynamicRPCRPC

EJBEJBUDDIUDDI

STUBSTUBWS ClientWS Client

MessagingMessaging

WSDLWSDL

HTML/XML Streams

SOAPSOAP

3H. Developer Productivity To improve developer productivity, Oracle9iAS Release 2 provides a number of new enhancements. These include the following capabilities:

• JDeveloper Integration - JDeveloper provides a rapid application development environment based on industry standards. (i) For Java developers, the latest J2EE APIs are supported including graphical tools for building Enterprise JavaBeans, JavaServer Pages and Servlets. (ii) For XML developers, an XML Schema driven code editor offers guided XML editing and XML processing tools include an XML parser, XSLT Processor and XML Schema Processor. (iii) For SQL developers, a database browser enables inspection of any SQL92 compliant database and development of PL/SQL in Oracle databases. (iv) For Web Service developers, wizards provide publishing and consumption of J2EE applications as Web Services using SOAP, WSDL and UDDI.

• Command Line Tools and Utilities - With Release 2, Oracle offers a number of new command line tools and utilities and several extensions to Jakarta Ant. These include tools to configure the server, data sources, web services and J2EE skeleton generation tools, a CMP mapping utility, application packaging and deployment tools, WAR and EAR file validation tools, and several others.

• Automated Migration from 1.0.2.2 to Release 2 - Oracle offers an automated migration tool to migrate Oracle9iAS 1.0.2.2 to Release 2. The tool provides automated facilities to migrate - (i) Oracle HTTP Server and Oracle J2EE container configuration information from 1.0.2.2 to Release 2; and (ii) Re-deploy J2EE applications packaged as .WAR and .EAR files from 1.0.2.2 to Release 2.

• Apache Frameworks - For developers who want to use J2EE Frameworks from the Apache community, Oracle also certifies and supports Apache Struts, Cocoon, Turbine, and Avalon with Release 2.

• MVC Framework for J2EE - For developers who are familiar with an MVC (Model-View-Controller) approach to J2EE, Release 2 provides an MVC framework that uses UML (Unified Modeling


Language) modeling and declarative techniques to provide a common and systematic way of developing J2EE applications. The components employed in one application or service can be rearranged to define another service or be redeployed to a different environment - from a servlet to a console based application, or even an EJB for example. The MVC Framework provides a process/page flow engine, allowing developers to organize their applications into any number of processes, and transition between these processes in a logical manner. Various services such as filters, Enterprise JavaBeans, JMS Queues, and events can be integrated into this framework. The MVC Framework can be downloaded directly from the Oracle Technology Network (http://otn.oracle.com).

• Integration with Third Party Tools - Oracle9iAS Release 2 is integrated with best of breed development tools including the following tools: − HTML Design Tools - Macromedia UltraDev, Adobe GoLive, and Microsoft Frontpage − UML Modeling Tools - Rational Rose, TogetherSoft ControlCenter − Java Development Tools - WebGain Visual Café, Borland JBuilder, Sun Forte, Sitraka Jprobe,

Neuvis NeuArchitect, Empirix BeanTest, Pramati Studio, Cacheon Business Service Center, Computer Associates Cool:Joe, Blaze Advisor

− Monitoring Tools - Mercury Interactive LoadRunner, VMGear Optimizeit, Compuware OptimalJ, Sitraka JProbe

4. APPLICATION DEPLOYMENT FEATURES Oracle9iAS Release 2 not only provides the industry’s most productive development environment for J2EE applications but also provides a number of new features that enhance its capabilities for mission critical Application Deployment. Release 2 has a number of enhancements to improve the Performance and Scalability of J2EE applications. To further improve Performance, Scalability, and Availability of J2EE applications, Oracle9iAS Release 2 integrates built-in Java Caching and Web Caching. Enhancements have been made to ensure that Applications remain Highly Available across system failures (Zero Unplanned Donwtime), and when software maintenance operations (Zero Planned Downtime) are carried out. Finally, centralized Systems Management, Security and Directory facilities provide administrators with the ability to monitor, manage and secure distributed systems, users, and the J2EE applications they access. These capabilities are illustrated in the figure below and are discussed in greater detail in the rest of this section.


Figure - Oracle9iAS Deployment

4A. Performance Oracle9iAS is the fastest Java Application Server in the industry and there are a number of enhancements in Release 2. Oracle provides in separate whitepapers:

• Comparable Web Services Benchmarks - Oracle provides benchmarks that compare the relative performance of Oracle9iAS against MS.NET for Web Services. These show not only that Oracle9iAS is significantly faster than MS.NET but also that it scales better maintaining predictable performance even as loads on the system grow.

• Comparable J2EE Container Benchmarks - Oracle is also in the process of publishing an ECPerf benchmark which is treated as an industry standard benchmark to compare the price-performance of J2EE containers.

Release 2 has several performance enhancements including: • Code Path Optimizations - There have been several code path optimizations in Release 2 to improve end-

to-end application performance including optimizations to the threading model, network and I/O model, event model, and other elements to improve performance for both RPC and stream-based applications. Oracle also has a number of XML optimizations to improve Web Services’ performance.

• Entity Bean Scalability - The current release enhances entity beans scalability by enabling multiple clients to concurrently look up and invoke methods on the same entity bean instance, using a configurable pool of bean wrapper instances per primary key value.

• Better Concurrency Control - Release 2 introduces a number of new concurrency control options to improve scalability and performance of large J2EE applications. − Read-Only Locking - For read-only beans that are not updating the database, the bean

developer can instruct the Oracle9iAS container to avoid calling or generating ejbStore(). The appropriate isolation mode will be selected, depending on whether the state of the bean can be updated by external systems, such as non-EJB applications using SQL.

− Pessimistic Locking - Oracle9iAS can serialize access to the bean’s state while providing each client with its own bean instance, for deterministic timeout and deadlock detection.

− Optimistic Locking - Oracle9iAS also supports an alternate locking scheme which does not use row locking - data consistency will depend on the isolation mode of the bean (“Non-Repeatable-Reads” or “Serializable”) and the order in which clients are updating the rows.

4B. Scalability

Oracle9iAS provides the most scalable application server in the industry. The scalability of a system refers to how well it can respond as user demands increase and how efficiently it uses system resources to handle large volumes of users. With application servers, the primary scalability bottlenecks are CPU-constraint (where the system becomes constrained because it is CPU-bound) and memory-constraint (where the system becomes constrained because it is memory bound). Oracle9iAS Scalability Strategy


Oracle9iAS Release 2 provides a number of enhancements to ensure that J2EE and Web Services applications scale better with zero application changes, either on a single CPU or on multiple CPUs. The key facilities are: • Resource Pooling - Release 2 optimizes the use of scarce resources such as threads, memory, HTTP

Server to J2EE Container connections, database connections, servlet and EJB instances by pooling them efficiently to improve scalability. Release 2 adds many optimizations to these pooling mechanisms and adds a sophisticated Java Caching Service where shared objects can be placed to get better performance and scalability.

• Load Balancing - Release 2 optimizes the routing and load balancing of IP (HTTP, AJP, FTP, SMTP), RMI, RMI-over-IIOP, and SOAP requests across one or more instances of the application server. It adds more sophisticated load balancing schemes at each tier of the application server.

• Clustering - Release 2 provides clustering facilities to improve scalability beyond the capability of a single Java VM or a single CPU. The clustering framework in Release 2 provides: − Cluster All Services - With Release 2, Oracle9iAS provides the ability to cluster Apache servers

and J2EE containers including JSP runtimes, Servlet container, EJB container, JMS, and JNDI. − Cluster Load Balancing - With Release 2, Oracle9iAS’ clustering provides for dynamic

registration and load balancing across cluster instances. − Cluster Failover - Release 2 also provides failover of session state for both servlets, and EJBs

(stateful session beans and entity beans) across cluster instances. − Cluster Management - Finally, Release 2 introduces a comprehensive cluster management

framework to lower the cost of managing clusters by: (i) Providing a single point from which a cluster of instances can be configured, and (ii) Providing hot deployment of applications to an entire cluster. Additional facilities for high availability include rolling upgrade across a cluster.

• Hardware Scalability - Horizontal and Vertical Scalability - When loads on the system grow beyond the capabilities of a single CPU, Release 2 supports two hardware scalability models - horizontal scalability which consists of adding a set of identical 1-2 CPU systems; vertical scalability which consists of migrating the application server from 1-2 CPU systems to higher end SMP-clustered hardware. All of these different scalability strategies can be used without changing J2EE applications.

The figure below conceptually illustrates Oracle9iAS Scalability model. Let us look at these different strategies in greater detail.


Figure - Oracle9iAS Scalability Resource Pooling Oracle9iAS provides very efficient scalability supporting large numbers of users on a single CPU, supporting more users on a single Java VM, and allowing clusters of Java VMs to be started to handle more users or greater loads. There are four important ways in which it provides such scalability:

• Single JVM - Threading Model - Oracle9iAS’ threading model lends itself nicely to shared access to resources. Specifically, Oracle9iAS can maintain a hierarchy of J2EE containers in the following manner: (i) A single hardware instance (box) can run multiple Oracle9iAS instances; (ii) A single Oracle9iAS instance can run multiple Java Virtual Machines (JDKs); (iii) A single Java Virtual Machine or JDK can start and maintain multiple threads; (iv) Each thread can run a single J2EE application module (JSP, servlet or EJB). Additionally, Oracle9iAS’ J2EE Container pre-starts and maintains a pool of threads to process requests. When a specific request is received from a J2EE client, an idle thread is selected and the specific J2EE module is loaded and executed on that thread. When the J2EE module has completed servicing that request, the thread is freed up and placed back in the pool. Release 2 provides enhancements to make the threading model configurable and to provide greater control over how threads are allocated and Oracle9iAS instances started as loads on the system grow.

• Inbound Request Pooling (Connection Pooling) - Oracle9iAS also maintains a pool of socket connections to handle requests coming from a J2EE client, a Web server, a load balancer, or another J2EE application module. If the request can be serviced in a request-response fashion (as in a stateless, HTTP 1.0 fashion), the socket is reused when the response is written back out on the socket. If the socket needs to be “kept-alive” (as in HTTP 1.1 or for clustering purposes), the J2EE container maintains the socket across multiple requests until it can be freed up.

• Outbound Request Pooling (Database Connection Pooling) - To eliminate database access overhead, Oracle9iAS’ J2EE Container pre-starts and maintains a pool of JDBC connections to a database. On specific requests, it selects/reuses an idle JDBC connection from the pool - when it is complete, it places the connection back into the pool to be reused by other clients. Release 2 provides JDBC 2.0 compliant connection pooling facilities.


• Java Object Caching (Resource Pooling) - Release 2 provides an enhanced Java Cache designed to reduce database access overhead and to improve Application Server scalability. The Caching Service provides a set of interfaces to reduce database access overhead by fetching database objects from the database into the mid-tier, casting them from SQL into Java and using these shared Java objects. This is particularly useful when accessing read-only objects from the database or using an optimistic concurrency control model. − Better Scalability - The Java Cache can also be used to cache Java/J2EE objects across multiple

Application Server instances - by keeping only a single copy of these objects, Release 2 consumes less memory and as a result can improve scalability.

− Faster Performance - Operations such as XSL-T transformations can then be performed against these cached objects in the mid-tier.

− Distributed and Configurable - The Java Cache is distributed and can cache shared objects across multiple threads in a single process, across process boundaries on a single CPU, and across processor/machine boundaries. The cache is configurable allowing objects to be grouped, pooled, pinned, and paged to a file system as necessary.

− Concurrency Control - To improve performance, Java object creation and database reads are distributed to avoid bottlenecks. However, to ensure concurrency, database writes are automatically synchronized across a cluster - by default the cache supports a model of optimistic reads and pessimistic writes.

The figure below conceptually illustrates the scalability architecture for Oracle9iAS.

Figure - Oracle9iAS Java Caching Load Balancing

Load balancing essentially means how requests from clients can be distributed across multiple Oracle9iAS instances on a single CPU or on multiple CPUs. Oracle9iAS Release 2 provides a number of advanced capabilities including:

• Load Balancing at HTTP Server - The Web server uses a simple but efficient mechanism to load balance between HTTP server processes within a single instance of the service. The master HTTP server process does not service client requests itself but spawns and monitors a group of child processes


which take turns accepting HTTP requests from a shared socket by using a mutex. Once a child receives a request but before it begins servicing it, it releases the mutex which can be acquired by another child - as a result, access to the socket is serialized but children may service requests in parallel. Additionally, Oracle HTTP servers can be run on multiple nodes where client requests can be load balanced over the separate host instances using a variety of techniques including DNS round-robin or a dedicated hardware load balancer (see below).

• Load Balancing at Oracle9iAS J2EE Container - Web and EJB container instances load balance requests either across instances on a single node or across multiple nodes using a variety of load balancing algorithms. There are several load balancing enhancements in Release 2 including those for RMI, RMI-over-IIOP, and SOAP requests.

• Dynamic Registration and Load Balancing - Release 2 also provides a “dynamic clustering” architecture where components dynamically register themselves with the appropriate load balancing point when they are started or restarted and requests are dynamically routed to those instances via configurable load balancing algorithms.

• Integration with Third Party Load Balancing Products - Release 2 has been certified with IP load balancing Appliances - Cisco Local Director, BigIP, and Alteon - for stateless and stateful load balancing. Best practices on how to configure these devices with Oracle9iAS can be obtained from Oracle Technology Network.

• Connection Re-direction and Node Affinity - While Oracle9iAS’ load balancing algorithms can be used to determine which instance to direct either a request from a new client or a stateless request from an existing client, Oracle9iAS also supports standard facilities such as cookies and dynamic URL-rewriting to bind and redirect clients to an existing session on a specific instance. Session IDs are packaged into either a cookie or a dynamic URL - when the client sends back a subsequent request, the load balancers and the HTTP server can redirect the request across tiers to the specific instance.

Clustering Clustering essentially means the use of a group of Oracle9iAS servers that coordinate their actions in order to provide scalable, highly-available services in a transparent manner. Clusters enforce homogeneity between member instances so that a cluster of application server instances appear to function as a single virtual instance. Release 2 provides a broad set of clustering facilities with several new capabilities:

• Oracle9iAS Clusters - In Release 2, the clustering facilities have been broadened to include not just the J2EE container but both the HTTP server and the J2EE container. Release 2 introduces two key new concepts - application server instances and clusters. An Oracle9iAS instance represents the collection of Oracle9iAS component processes and the configuration data required to start those processes. A simple way to think of an Oracle9iAS instance is to equate it with a runtime instantiation of a single Oracle9iAS environment. A cluster is a collection of Oracle9iAS instances with identical cluster-wide configuration and cluster-wide application deployment. When you configure an Oracle9iAS instance you can choose to configure it as part of at most one cluster. Instances belonging to a cluster can be deployed on a single CPU or on multiple CPUs.

• Clustered J2EE Services - With Release 2, clustering is extended to include all J2EE Services - JSPs, Servlets, EJBs (session beans and entity beans), JMS, and JNDI Services.

• Stateful Servlet, EJB Failover - With Release 2, the clustering facilities provide failover of session state across application server instances. This includes failover of: (i) Servlet Session State – through HttpSession objects; and (ii) EJB State - for stateful session EJBs and entity beans. With stateful failover, when an instance fails a client is automatically routed to another instance in the cluster to


which the session state has already been failed over. More information about the clustering architecture and failover model is discussed in the section on High Availability below.

• Cluster Configuration - Release 2 provides a set of clustering services - Oracle Process Monitoring and Notification (OPMN) and Distributed Configuration Manager (DCM) - which are responsible for three important facilities - (I) Maintaining a cluster-wide topology of live and failed instances for load balancing purposes; (ii) Maintaining cluster-wide configuration information so that all cluster instances can be configured from one place and are configured identically; and (iii) Automatically restarting and synchronizing failed instances in a cluster. These services which are described below work together to provide sophisticated capabilities that “dynamically cluster” Oracle9iAS instances.

• Cluster Management with Enterprise Manager - Finally, Oracle Enterprise Manager provides a comprehensive set of GUI-based facilities to manage Oracle9iAS clusters in Release 2. Using the cluster framework services described above, Enterprise Manager provides a single point of cluster administration including: (i) Cluster Creation – To create a cluster; to destroy it; to add or remove instances from the cluster; (ii) Cluster Start - start, stop, or restart a cluster as a single operation; (iii) Cluster Configuration - Configure and re-configure a cluster of instances homogeneously as a single operation without configuring each component; and to add an instance to a cluster and to have it inherit the clusters configuration. (iv) Monitoring - Cluster-wide status, performance, resource, and fault monitoring. (v) Cluster Application Deployment - Deploy J2EE applications to a cluster without manually deploying the application to each instance in turn.

Hardware Scalability When loads on the system grow beyond the capabilities of a single CPU, Release 2 supports two different hardware scalability models - horizontal scalability and vertical scalability.

• Horizontal Scalability - When loads grow beyond the capacity of a single CPU, multiple CPUs can be added. Multiple Java VMs can be started up on these CPUs, each JVM with one or more Oracle9iAS instances. These instances can be clustered together. Requests can then be transparently distributed to across these CPUs, JVMs, and Oracle9iAS instances. Release 2 can be deployed in a variety of different “horizontal scalability” architectures with commodity 1-4 CPU boxes being added in racks, Blades, as standalone servers, and in other configurations.

• Vertical Scalability - Administrators can choose not to add more CPUs but to migrate the application server to a higher end hardware configuration (if a system is CPU-bound) or add more memory (if a system is memory-bound). To support such vertical scalability, Oracle9iAS is available on a broad range of hardware platforms scaling from low-powered desktop systems, low-end uniprocessor machines to high-end SMP clusters, and on 32-bit and 64-bit versions of major Operating Systems including Solaris, HP-UX, AIX, Tru64, Windows (2000, NT, and XP underway) and Linux (SuSE and Redhat). This allows users to move their applications to SMP clustered hardware without rewriting their applications.

To summarize, Oracle9iAS Release 2 provides a number of scalability strategies to improve the scalability of applications on a single CPU or on multiple CPUs without requiring application changes.

4C. High Availability and Reliability

Availability of an overall system or of an individual system component is defined as the percentage of time that it works normally (or alternatively the mean-time-to-failure for the system) and how quickly and efficiently the system can recover from failures (or alternatively the mean-time-to-recovery for the system). Oracle9iAS Release 2 is designed to provide a highly available and highly reliable infrastructure to deploy J2EE applications with a number of new high availability enhancements focusing around two issues:


• Zero Planned Downtime - Zero Planned Downtime describes a set of facilities that are aimed at eliminating the need to take down an application in order to perform planned maintenance operations such as patching, upgrade, and maintenance.

• Zero Unplanned Downtime - Zero Unplanned Downtime describes a set of facilities that are aimed at ensuring that the application does not have any downtime even if one or more instance of the application server on which the application is deployed fails.

Let us look at each of these elements in greater detail. Zero Planned Downtime To reduce the need to take down an application deployed on Oracle9iAS in order to perform planned maintenance operations such as patching, upgrade, and maintenance on the Application Server itself, Release 2 provides a number of new facilities: • Hot Deployment of Applications - First, Oracle9iAS allows for hot deployment of applications - JSPs,

Servlets, EJBs, and Web Services - to an instance of the Application Server that is already running. • Dynamic Instance Reconfiguration - Second, Oracle9iAS also supports the ability to dynamically

reconfigure J2EE Container instances - all configuration information is specified in XML files and application server instances do not need to be bounced when configuration changes are made.

• Dynamic Cluster Reconfiguration - Third, when multiple instances belong to a cluster, configuration changes made to one instance are automatically replicated by DCM across the cluster.

• Rolling Upgrade - Fourth, when an application is deployed to a cluster of Oracle9iAS instances, any specific instance in the cluster can be taken off-line, modified, upgraded, and rejoined to the cluster without any application downtime - we call this “rolling upgrade of instances.” This allows planned maintenance operations to be performed on any application server instance without needing to shut down the application itself.

Zero Unplanned Downtime To reduce unplanned downtime for applications, Oracle9iAS Release 2 provides two important facilities - (i) Zero Application Downtime - Longer Mean-Time-to-Failure - Prevent applications from having any downtime even if any specific Oracle9iAS instance or underlying system resource (CPU, JVM, network) has a failure. This significantly increases the Mean-Time-to-Failure for applications. (ii) Faster Failure Recovery - Shorter Mean-Time-to-Recovery - They also ensure that in the event of a failure, the Oracle9iAS instance can be recovered much more quickly and efficiently decreasing the Mean Time-to-Recovery from faults. Oracle9iAS Release 2 is designed to have - (i) No single point of failure - applications continue to run even if an instance fails); (ii) Automatic Connection Re-routing and Load Balancing - Connections are automatically re-routed around a failed instance; (iii) Session Failover - Session state is automatically failed over for Servlets and EJBs to another instance in the cluster; (iv) Fast Start Fault Recovery - Failures or instance deaths are automatically discovered and instances are restarted with instance specific or cluster-wide configuration information as appropriate; and (v) Dynamic Registration - When instances recover, they are dynamically registered and load balancing commences automatically. The specific features are:

• No Single Point of Failure - Oracle9iAS can be deployed in an architecture that exposes no single point of failure. A hardware load balancer can send requests to any of multiple Oracle9iAS Web Cache or Oracle HTTP Servers. The Oracle HTTP Servers, in turn, can dispatch requests to any Web container instance. The Web container can in turn dispatch requests to any EJB instance. The EJB instances can


in turn access the database across any database connection. In Release 2, the J2EE containers are all fronted by either local or remote Oracle HTTP Servers, which function as load balancing mount points ensuring that the system has complete redundancy in the event of a failure of any HTTP Server or J2EE container. The figure below conceptually illustrates the absence of a single point of failure.

Figure - Oracle9iAS High Availability

• Automatic Connection Rerouting - For stateful applications, every tier of Oracle9iAS can re-route connections from a “stateful” client to a pre-existing session on a specific Oracle9iAS instance; or in case of failure, to another instance belonging to the same cluster. For stateless applications, the configurable load balancing facilities at every tier transparently route client requests to an alternate instance in a cluster in the event of a failure.

• Stateful Failover - Release 2 provides failover of servlet and EJB session state across Oracle9iAS instances that belong to the same cluster. If the Oracle9iAS J2EE container has been configured to support clustering, it is registered along with a group of other instances as a cluster with a common cluster ID. In the case of an instance failure, the load balancer recognizes the instance failure, identifies other servers with the same cluster ID, and routes the connection to one of those servers using the load balancing algorithm. The session state from the failed J2EE container has already been replicated via IP-Multicast across all instances in the cluster, and, as a result, the client is able to access the session again. − Servlet Session State - Servlet state captured as HttpSession objects is replicated to other

members in the cluster. − EJB Clustering is transparent to both the server component (the EJBs) and the client code

(servlet, Java client); clients are required to provide the ApplicationClientInitialContextfactory only with a dynamic “lookup URL” method which will request the server to identify its peers and send back to the requestor a list of its peers. Thereafter, the client will connect to a random instance from the list of servers. The host listed in the provider.url serves only as a nameserver that tells the client about the servers in the cluster.

− Stateful Session Bean Failover - Stateful session bean clustering can be achieved using one of the following methods: (i) VM Termination State Replication - At VM termination, using VM shutdown hooks (JDK 1.3 or higher), the session is migrated to the “cluster”, including the transitive closure of all serializable and EJB referenced objects reachable by the stateful session bean. When a client request fails to connect to a node, the Oracle9iAS infrastructure connects the


client session to a different node; the new node, realizing that it does not have the conversational state for the session, then makes a GET_SESSION request to the “cluster”. If the session migration succeeded, then the new node retrieves the session from the “cluster” and processes the client request. (ii) End-of-Call State Replication - The state of the stateful session bean is replicated at the end of every method call to all nodes in the cluster. This is the most reliable option, because the state of the stateful session bean is replicated to all nodes in the cluster using a JMS multicast topic. This broadcasts the state to all nodes in the cluster that use the same multicast address. This state stays in the topic until it is needed. When needed, on a method call against the alternate node, the latest state for the bean is found off the JMS topic, reinstated, and the bean invocation continues. (iii) Session Context State Replication - In HTTP clustering, you can explicitly manage both what type of information, and when it is replicated, through the setAttribute method of the HttpSession object. Oracle provides a similar mechanism for stateful session beans through a new OC4J-specific StatefulSessionContext class. This enables you to explicitly control the specific state that you wish to replicate to the other nodes in the cluster. While this is a finer-grained, better performing, and more reliable state replication model, it must be noted that this is not a standard J2EE mechanism and the use of it will reduce application portability.

− Stateless Session Bean Failover - Stateless session bean clustering is achieved by redirecting the client to a different server. The client side RemoteInvocationHandler will under the covers, attempt to connect to a different server if a remote method invocation fails.

− Entity Bean Failover - When entity beans are clustered, at committed transaction boundaries and upon writing to the database, the EJB container instance multicasts an EJB_FLUSH command to the “cluster”. The EJB_FLUSH command notifies the other servers that they should flush their respective caches and refresh their view of the entity bean from the persistent store.

• Automatic Death Detection - Fast Restart Architecture - With Release 2, Oracle9iAS has integrated fault monitoring facilities to both detect the death or failure of a specific instance and restart it in order to minimize Mean-Time-to-Recovery for that instance. This facility is provided by Oracle Process Manager and Notification Service (OPMN). The process monitoring architecture consists of three facilities: − Fault Monitors, written in Java or C, to periodically ping various processes associated with an

Oracle9iAS instance. The watchdog process in the Oracle HTTP Server monitors the HTTP child processes and restarts a failed process.

− The Notification Service which channels events from different instances via a publish-subscribe mechanism to other services that are interested in receiving these event notifications. The events are all communicated over HTTP between different processes.

− Instance Recovery - Specific instances can be recovered either by administrative intervention from Enterprise Manager which receives event notifications; or by an auto-restart facility.

− Cluster Configuration Synchronization - When instances are restarted, the instances automatically pick-up the latest cluster-wide configuration information from the Distributed Configuration Management Service (DCM) which maintains all cluster-wide configuration information and ensures that all instances are synchronized across the cluster. DCM performs two tasks - first, it identifies the configuration information needs to be restarted with by looking up cluster-wide configuration information from a repository which can either be a local XML file or a database. DCM then generates and propagates a set of events to OPMN - together these two services ensure that the Oracle9iAS instance gets the correct startup/shutdown commands and is appropriately configured when started.


• Dynamic Registration and Transparent Load Balancing - When the instance is recovered, the instance dynamically registers itself with the appropriate load balancing mount point and requests are automatically routed to it. Specifically, the Apache mod_OC4J works in conjunction with the clustering services to keep its routing information updated so that it load balances across all live Application Server instances. When the instance registers itself dynamically with the appropriate cluster and load balancing point, DCM and OPMN synchronize this information maintaining an up-to-date topology of the deployed architecture. The figure below illustrates the various services involved in providing high availability with Oracle9iAS.

Figure - Oracle9iAS Fault Recovery and Clustering

• Transparent Application Failover (TAF) - Database State Management - Finally, every Oracle9iAS middle-tier communicates with databases using a connection pool; every application writes persistent state to the database. When used with an Oracle Database Server, Oracle9iAS provides advanced state recovery facilities called Transparent Application Failover (TAF). TAF essentially means that when an Oracle Database is deployed with a set of Oracle9iAS instances, and an Oracle Database fails, the mid-tier Application Servers receive an asynchronous notification from the database and can automatically fail over the JDBC connection and route database requests to the “failed-over” database node. Depending on the way in which the Oracle Database is configured and the degree of redundancy in the JDBC connections, Oracle9iAS provides three degrees of failover: − Cold Failover - The JDBC connection is failed over but the application needs to re-establish the

session and re-start the SQL query. − Warm Failover - The JDBC connection is failed over and the database session state is recovered

but existing SQL queries need to be restarted. − Hot Failover - The JDBC connection is failed over, the database session state and SQL cursor

are both recovered so that existing reads proceed without interruption. In addition, Oracle9iAS is also certified with Oracle9i Real Application Clusters for high availability.

4.5 Security and Directory Services Release 2 provides a comprehensive integrated security framework with several major enhancements. It provides a complete PKI-based security infrastructure, offers users single sign-on across Internet


Applications and Web Services, and centralizes security administration in an LDAP Directory Services to lower management cost. Encrypted Communication When J2EE applications are deployed, they are typically divided into two or three tiers - the Web server tier where the HTTP servers are deployed; the Web presentation tier where the JSPs and servlets are deployed; and the business logic tier where EJBs are deployed. These different services can be combined into one physical mid-tier or distributed on separate physical tiers. Oracle9iAS encrypts communication from the client to the application server and from the application server to the database:

• Web Server to Application Server - Standard SSL X.509v3 certificates can be used to encrypt communication between any HTTP, RMI, RMI-over-IIOP, SOAP, and any browser and the Oracle HTTP Server.

• Application Server to Database Server - Oracle Advanced Security can be used to encrypt communication between the J2EE container and the Oracle database via JDBC using SSL over Net8.

• Firewall Certification - To ensure that Oracle9iAS’ HTTP Server, Proxy Plug-in, and J2EE container can be deployed in a variety of configurations including Internet facing, simple or complex DMZ architectures with one or more firewalls, and Intranets, Oracle9iAS Release 2 is certified with a number of leading Firewalls Cisco PIX and Checkpoint Firewall One.

• RMI Tunneling - Oracle9iAS also supports the ability to tunnel RMI over HTTP and HTTPS protocols. RMI over HTTP/HTTPS tunneling can be used for Java-based clients when they need to communicate with Oracle9iAS and the only option is to use the HTTP protocol. Typically, HTTP tunneling provides a way to simulate a stateful socket connection

• SSL Support - SSL is used for confidentiality using a standard set of cryptographic mechanisms to encrypt data and distribute keys between communicating devices. The specific set of encryption, integrity protection, key distribution algorithms, and encryption key length is called a ciphersuite. Oracle9iAS supports a wide range of ciphersuites particularly those which use SSL X.509v3 certificates for authentication and key distribution.

• SSL Caching - Oracle HTTP Server allows SSL sessions to be cached so that multiple message interchanges between two IP addresses can be exchanged under one session - session caching improves performance significantly.

PKI-based Authentication SSL can also be used to provide client authentication using X.509 certificates as part of a public key infrastructure deployment. Oracle HTTP Server can be configured to restrict access to files and services based on information in the clients X.509 certificates. Information can be used in making an access decision including the distinguished name in a client certificate, profile information contained within the DN, and the certificate trust point (i.e. the CA which issued the user’s certificate). From an authentication point of view, Release 2 provides several features: • Two-Way Authentication - With Release 2, Oracle HTTP Server provides strong authentication (client-

to-server, and server-to-client) using SSL X.509v3 certificates. • Configuring for Authentication - With Release 2, SSL can be configured to accept trust points it recognizes

or those signed by trust points it recognizes and so forth. Authentication can be based on lists of partial or fully distinguished names. Once SSL authentication occurs, the information available in the certificate can be used in directives such as <directory>, <files>, and <location>. SSL authentication can be combined with basic authentication and/or host-based access control. In this


way, administrators can allow different combinations of SSL and basic-authenticated users’ access to files and services and combine such restrictions with host-based access control.

• Security Context Propagation - Release 2 allows for security related information about the SSL sessions such as the URL which arrived in the HTTPS request, the size of the cipher key used in the SSL session, the ciphersuite used, and the distinguished name from the certificate. Applications can use these variables to perform additional access control or authorization on user requests. Further, within the same Oracle9iAS instance, the security context can be propagated from the servlet container to the EJB container. This propagation ensures that the servlet does not need to re-authenticate itself to an EJB.

• Intrusion Detection - Release 2 also enhances the Oracle HTTP Server to provide logging for SSL-related information. This can be used to determine if intrusions were attempted, if they succeeded, and to determine the source of intrusion attacks.

Java2 Security The Java2 platform defines the Java2 Security Model and the J2EE platforms provides a security framework referred to as Java Authentication and Authorization Service (JAAS). Oracle9iAS offers a complete JAAS implementation with the following features:

• Comprehensive Security - JAAS can be used as a mechanism for authentication (identifying users), authorization (limiting what they can do), and delegation (enabling code to run securely, with privileges of other users). Applications can obtain authenticated user (principal) identity from a set of standard authentication services JAAS provides and they can manage the privileges which principals have for accessing objects. It also supports privilege delegation for managing privileges of methods invoked by principals.

• PKI, SSO, or Custom Authentication - The JAAS provider provides a flexible authentication framework which offers specific authentication mechanisms based on SSL and SSO but also allows developers to integrate custom authentication modules through the standard JAAS Login Module API. SSL Authentication allows users who have client X.509V3 certificates to authenticate to JAAS and thus to J2EE applications using these certificates. SSO Authentication allows J2EE applications to use the Single Sign-on Server for authentication.

• Role-Based Access Control - The JAAS Provider provides secure, centralized, and customizable role-based access control. The JAAS Provider does not explicitly define user communities but uses a concept called realms which provide access to users and roles.

• JAAS Delegation - The JAAS Provider has support for privilege delegation allowing a J2EE Application to run with the privileges of a specific user. Both RunAsClient (where an application runs with the privileges of the current client user) and RunAsID (where an application runs with the privileges of a specific user) are supported. This allows developers to enforce the principle of least privilege in their applications allowing only those privileges needed to perform a specific function.

• JAAS Repositories - Oracle JAAS provider can manage user identities in either an encrypted XML file or in Oracle Internet Directory. Integration with OID enables Java-based applications to leverage the centralized user management capabilities of Oracle Internet Directory, yet allow delegated administration by organization. Applications can retrieve roles for users, and roles can be hierarchical (that is, role can be assigned to other roles).

Single Sign-On Oracle9iAS Release 2 has significantly enhanced the Single Sign-On (SSO) capability. These enhancements include architectural changes and new features.


• Single Sign-On for Any Application - In Release 2, SSO and LDAP are core services of Oracle9iAS and users now have single sign-on to any set of 9iAS Applications including J2EE and Web Services.

• SSO Server - The SSO Server is a network service that authenticates users and passes their identity securely to partner applications. It prompts users for a username and password when they access the system for the first time in a given time period, and verifies the user’s identity. When a user authenticates to the SSO Server, it sets an SSO cookie in the user’s browser - the presence of a valid cookie confirms that the user has been authenticated.

• Partner Applications - Partner applications are those that work within the SSO framework - specifically they delegate responsibility for user authentication to the Oracle9iAS SSO Server and they accept the user identity it presents them.

• Single Sign-On - Oracle JAAS provider supports integration of Java-based applications with single sign-on, providing greater security unification across Oracle9iAS. Oracle JAAS provider also supports extensible, pluggable authentication.

• PKI Integration - New features for SSO include mod_OSSO and PKI integration. Mod_OSSO is a new module for the Oracle HTTP Server, which allows the HTTP Server to become an SSO partner application. Applications running underneath the Oracle HTTP Server will be able to obtain a user’s identity, as validated by SSO, from the HTTP Server. Another new feature for Oracle9iAS Release 2 is the ability to support PKI authentication. As in Oracle9iAS Release 1, a user who has an X.509v3 certificate installed in their client will be able to authenticate to Oracle9iAS via SSL. In Oracle9iAS Release 2, the SSO server can be configured to obtain such a user’s identity from the SSL module without requiring the user to submit an explicit SSO username/password for authentication.

• Directory Integration and Security Provisioning - Oracle9iAS SSO now fully supports Oracle Internet Directory (OID) integration. By default, users and passwords are managed in OID. Users and their passwords are now provisioned for SSO via OID, using the OID Delegated Administration Services Self Service Console (SSC).

The figure below conceptually illustrates

Figure - Oracle9iAS Single Sign-On Centralized Administration With Oracle9iAS Release 2, Oracle provides Oracle Internet Directory is used to centrally manage user accounts, their access control privileges, and groups. Once users have been created centrally in OID, they


can be shared across all components in Oracle9iAS. Key Release2 enhancements include security, self-service console, password policy management, plug-in framework, Oracle Directory Integration Platform, increased search performance, alias de-referencing, and enhanced proxy capabilities.

• Key Directory Features - OID provides the following key directory features: (i) Native LDAP v3 server supporting all LDAP2000-compliant RFCs, including LDAP v2 and v3 RFCs; (ii) Supports the X.500 information, naming, and storage model; (iii) Extensible directory schema for online modifications with no downtime; and (iv) LDAP developer APIs in Java, C, and PL/SQL to assist with application development.

• Security Integration and SSO - In Release 2, OID ensures that user accounts and groups can be managed centrally and securely. Users can be created centrally in Oracle Internet Directory, and shared across all Oracle9iAS Services. When users log in, they are authenticated once by the Oracle9iAS Single Sign-on Server against their Oracle Internet Directory credential, and can access multiple applications seamlessly.

• Self-Service Console and Delegated Administration Service - With Release 2, OID includes a Self-Service Console, an easy-to-use, web-based interface that allows end-users and application administrators to search for and manage data in the directory. Combined with the new Delegated Administration Service, this console provides Oracle9iAS administrators with a means of provisioning end-users in the Oracle9iAS environment. OID also enables components of Oracle9iAS to synchronize data about user and group events, so that those components can update any user information stored in their local application instances.

• Password Management - OID also now offers sophisticated password policy management capabilities (e.g., control over expiration times and password length) and the ability to store passwords using a variety of hashing schemes. These features allow administrators to define consistent security policies across applications and easily share passwords with other systems.

• Powerful Directory Search Capabilities - OID provides users with very fast directory searches through sophisticated server-side caching capabilities. OID also provides two key features that ensure administrators can deliver seamless directory services to all users: (i) Alias De-referencing - When a user or an application searches on an alias, OID automatically de-references the alias and returns the entry to which it refers. This feature enables administrators to change the names of objects in ways that are transparent to users and applications. (ii) Enhanced Proxy Capabilities - Administrators can safely establish well performing, auditable middle-tier application access to the directory "on behalf of" end user communities.

• Synchronization with 3rd Party LDAP Servers - The Oracle Directory Integration Platform enables customers to synchronize data between OID, various third party metadirectories and other enterprise LDAP repositories, such as iPlanet.

4E. Systems Management Oracle Enterprise Manager provides a comprehensive systems management platform for managing both Oracle9iAS and Oracle9i Database. It combines a graphical console, Oracle Management Servers, Oracle Intelligent Agents, common services, and administrative tools. Release 2 is designed to streamline and lower management costs by integrating all components of Oracle9iAS with Oracle Enterprise Manager. Single Point of Administration - Enterprise Manager Home Page With Release 2 Oracle Enterprise Manager includes a web-based administration interface for managing Oracle9iAS. This new graphical HTML-based interface uses a servlet-based administration service to gather configuration data and performance metrics from Oracle9iAS for presentation through an HTML-


based graphical interface. By making the management facilities accessible from a browser, administrators can mange Oracle9iAS either locally or remotely (for instance when out-of-the-office), including through firewalls. To support multiple levels of management, Oracle introduces the Oracle Enterprise Manager Home Pages. Each Home Page provides the information you need to monitor the performance and availability of Oracle9iAS from a particular level of management detail. Selected Home Pages also provide tools for configuring your Oracle9iAS components. From each Home Page, you can obtain high-level information or you can drill down to get more specific information about an instance, component, or application. The following Home Pages that are available when you use the Oracle Enterprise Manager: • Oracle9iAS Farm Home Page - Use the Oracle9iAS Farm Home Page to view a set of related application

server instances on your network and to create clusters that speed up the configuration and deployment of your Web applications.

• Oracle9iAS Instance Home Page - Use the Oracle9iAS Instance Home Page to manage all aspects of an individual application server instance.

• Oracle9iAS Component Home Page - Drill down to a component Home Page to monitor or configure an individual component of the application server.

Database

SSO Server

LDAP

EnterpriseEnterpriseManagerManager

FaultsFaults

Performance

ResourceResource

ClustersClusters

MonitorMonitor

ManageManage

Figure - Managing Oracle9iAS with Enterprise Manager

The Homepage provides an aggregate view of the status and performance of a 9iAS instance or its components. From this single page, an administrator can determine - (i) The availability of the instance and each of the components in the instance; (ii) The CPU and memory consumption of the instance and each component; and (iii) How long each component has been up. It also provides the ability to start or stop the instance or component. Oracle9iAS Configuration Each of the 9iAS components has an administration homepage linked with the Oracle9iAS Homepage. Administrators can also use the new administration interface to configure all the components, and to perform administrative operations such as deploying applications. Configuration facilities include:

• Configuring HTTP Server - Each Oracle HTTP Server can be configured using the Oracle HTTP Server Home Page on the Oracle Enterprise Manager Web site. Configuration tasks such as modifying


directives, changing log properties, specifying a port for a listener, managing client requests, and editing server configuration files can all be done from Oracle Enterprise Manager.

• Configuring J2EE Container - Each individual J2EE container and its deployed applications can be configured from Enterprise Manager including the ability to configure Web Site; Global JSP Container Parameters; Global Web Application Parameters; RMI and JMS Listeners; Data Sources; Security Principles and JAAS Parameters; UDDI Registry Categories and Entries; and XML Files

• Application Level Configuration Once you have deployed an application, it has its own Application Home Page, which is accessible from the J2EE Container Home Page. The Application Home Page can be used to modify most of the application parameters such as to configure Application General Parameters, Local J2EE Services, and to modify XML deployment descriptors.

Oracle9iAS Monitoring Through integration with Oracle Enterprise Manager and the Dynamic Monitoring Service (DMS), Release 2 provides comprehensive monitoring metrics to administrators. These include:

• Resource Metrics - Percentage of the CPU being used for the Oracle9iAS J2EE container instance. As usage increases, the CPU utilization increases; Memory Usage (MB) - Number of megabytes being utilized for Oracle9iAS J2EE container memory; and Heap Usage (MB) - Total amount of heap space used (in megabytes) since the server was started.

• JDBC Metrics - JDBC metrics include the number of open JDBC connections; Number of total JDBC connections; Number of transactions that are currently open from beans in EJB modules; Number of transactions committed by Enterprise Java Beans in EJB modules; and the Number of times a transaction was rolled back by beans in EJB modules.

• JSP and Servlet Metrics - Servlet and JSP metrics provides the transactional details about the server and includes the following metrics - Number of currently active sessions for the specified Oracle9iAS J2EE container instance; total number of active requests currently being processed; amount of time in seconds spent processing requests during the last period; and Number of requests processed per second.

• EJB Metrics - EJB Metrics provide information such as the number of EJB Methods currently active; Number of EJB Methods executed per second; Request Processing Time which measures the amount of time in seconds spent processing requests; and the number of requests processed per second.

Deploying J2EE Applications using Oracle Enterprise Manager Finally, Oracle Enterprise Manager provides a step-by-step wizard to deploy J2EE applications and Web Services to a single Oracle9iAS instance or a cluster of Oracle9iAS instances. During the deployment process, if the application is a Web Service, Enterprise Manager also provides facilities to browse and optionally register the Web Service with Oracle’s UDDI Registry.

5. SUMMARY & CONCLUSIONS

Enterprise Applications are today designed on an Internet Architecture in which a middle-tier Java Application Server provides a runtime environment for the Application. To meet these needs and to provide a robust, mission critical platform for J2EE applications, Oracle provides the next release of Oracle9i Application Server which provides a number of new facilities to simplify enterprise application development and to provide greater reliability for applications when they are deployed. J2EE applications can be built with Oracle9i JDeveloper which is seamlessly integrated with Oracle9iAS Release 2. The major enhancements in Oracle9iAS Release 2 are:


Pure Java Container/Runtime executing on JDK Oracle9iAS’ J2EE Container is implemented completely in Java making it: (i) Lightweight - 25 MB disk, 20MB of Memory; (ii) Fast to install, can be completed in less than 15 minutes; (iii) Easy to use – simple management and configuration, supporting standard Java Development and Profiling Tools; and (iv) Available on 32-Bit and 64-Bit Versions of standard Operating System and Hardware Platforms including Solaris, HP-UX, AIX, Tru64, Windows NT and Linux. Oracle9iAS Release 2 is certified to run on JDK 1.3, and will be certified to run on JDK 1.4 shortly after the initial production release. Development Productivity Oracle9iAS Release 2 significantly enhances support for J2EE and Web Services providing a productive environment to develop and deploy dynamic Web Sites, transactional Internet Applications, and Web Services. In parallel Oracle has also delivered a developer preview of its J2EE 1.3 Container which will be part of the first maintenance release of Oracle9iAS Release 2. • Oracle HTTP Server - Release 2 has been upgraded to Apache v 1.3.22 with enhancements for session

routing and IP Load Balancing, dynamic port discovery and registration, high availability, new security facilities, and new mods - mod_OC4J, mod_oraDAV, and mod_OSSO.

• Java Server Pages - Release 2 enhances JSP Support with a number of JSP 1.2 features, JSP source level debugging, several pre-packaged JSP Tag Libraries, and several performance optimizations.

• Servlets - Release 2 provides complete support for Servlet 2.3 including Servlet Filters, Servlet Chaining, and Application Lifecycle Events. It is 100% compatible for applications developed to the Servlet and JSP standards on the Tomcat Servlet Engine.

• Enterprise JavaBeans - Release 2 provides enhanced EJB Support with a number of EJB 2.0 features including CMP enhancements, complete JCA support, pluggable JMS providers, Message Driven Bean enhancements, the introduction of Active Components for J2EE (a framework for developing loosely coupled asynchronous Web Services), a complete JAAS Provider for Security, and JTA and JNDI enhancements. Oracle’s J2EE 1.3 Preview provides full support for all EJB 2.0 Services including Local Interfaces, EJB QL, EJB 2.0 style CMP with relationships, and CORBA Support.

• Web Services - Release 2 provides facilities to deploy synchronous (RPC-style) and asynchronous (messaging-style) Web Services supporting SOAP 1.1, WSDL 1.1, UDDI 1.0 and key elements of JAX-PACK Web Services standards.

• Developer Productivity - Release 2 provides a number of enhancements to improve developer productivity including seamless integration with Oracle9i JDeveloper, a number of command line tools and utilities, ANT extensions, certification of popular J2EE Frameworks (including struts), and automated migration tools. Release 2 has been certified with the industry’s leading development tools, messaging systems, object-relational mappings, security solutions, directory services, system management products, and content management solutions.

Deployment Reliability Oracle9iAS Release 2 not only provides the industry’s most productive development environment for J2EE applications but also provides a number of new features that enhance its capabilities for mission critical Application Deployment. • Performance - Release 2 has a number of code path enhancements and several new concurrency control

options to improve J2EE Performance.


• Scalability - Release 2 has more efficient Resource Pooling, enhanced Java Caching and Web Caching facilities, enhanced routing and load balancing of IP (HTTP, AJP, FTP, SMTP), RMI, RMI-over-IIOP, and SOAP requests, integrated clustering and session failover facilities for servlets and EJBs, and enhanced horizontal and vertical hardware scalability.

• High Availability - Release 2 improves high availability to ensure that Applications remain Highly Available when software maintenance operations (Zero Planned Downtime) are carried out and across system failures (Zero Unplanned Downtime). Planned Downtime is reduced through online operations, dynamic instance and cluster reconfiguration, hot deployment of applications, and rolling upgrade facilities. Unplanned Downtime is reduced through the absence of a single point of failure; automatic Connection Re-routing and Load Balancing in the instance of a failure; clustered session state failover across a cluster; a Fast Start Fault Recovery architecture where failures or instance deaths are automatically discovered and instances are automatically restarted, reconfigured and re-clustered.

• Security - Release 2 has security enhancements including encrypted communication; strong PKI-based authentication; complete Java2/JAAS security support for authentication, authorization and role-based access control, and delegation; and centralized administration in LDAP.

• Systems Management - Finally, Oracle Enterprise Manager can be used to monitor status, resource consumption, faults, and performance of either instances or clusters; and to administer both single instances and clusters of Application Servers.

Release 2 of Oracle9iAS provides a mission critical platform to deploy J2EE applications. Oracle will continue to evolve its Application Server to radically improve developer productivity and radically improve deployment reliability.


Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: Phone: +1.650.506.7000 Fax: +1.650.506.7200 www.oracle.com Oracle Corporation provides the software that powers the Internet. Oracle is a registered trademark of Oracle Corporation. Various product and service names referenced herein may be trademarks of Oracle Corporation. All other product and service names mentioned may be trademarks of their respective owners. Copyright © 2002 Oracle Corporation All rights reserved.

Documents

Oracle9iAS Release 2 J2EE and Web Services Overview · Summary & Conclusions ... products and services across the company. ... compile, profile, and optimize J2EE applications and