X509Certificates - Getting Closer

Found a sample Java servlet that reads client certificates. Loaded it into JDev 10.1.3, configured it for OAS 10.1.2, deployed it successfully to a new OC4J container, and connected to it successfully, but it reported that no client certificate was present. This was a head scratcher, so I reviewed the Java API for the X509Certificate class and the HTTPRequest interface, tried a couple of things, didn't get anything to work, and then somehow ended up on the Sun Developer Network, where I found this post: Obtaining an X509Certificate from a Web App. The post mentions adding the directive "Oc4jExtractSSL On" to the Apache mod_oc4j.conf file. Apparently, you have to explicitly tell the Oracle HTTP Server to pass the client certificate to the OC4J. So I tried it - but still not getting the certificate. But I think I'm getting closer - still googling and hopefully I'll have an answer by the end of the day.

Update: Found another missing piece of the puzzle in an OTN post. Enabled the SSLOptions +ExportCert +StdEnvVars directives in ssl.conf, but the servlet is still not getting the certificates. Posted a plea for help in the OTN OC4J/J2EE forum here. Hope I hear from someone soon.

Another Update: I hate the Metalink interface so much I usually leave it as my last resource, but lo and behold I found Note 256244.1 Sample code to read Client Certificate details in a Servlet/JSP. It links to Note 255965.1 Configuration steps to read Client Certificate details from a Servlet/JSP (sorry - Oracle CSI required to access). The configuration steps have added nothing new to what I've already done with mod_oc4j.conf and ssl.conf. But I thought I'd give the sample code a try. Opened a new application in JDev 10.1.3, changed to the 1.4.2 library, created a servlet, copied and pasted the code, no errors, ran it in the embedded OC4J and got the expected result: A web page stating the connection was not made via HTTPS so no certificate data available. Yippee! Created my deployment descriptors and profile, deployed it to an .EAR, copied the .EAR to the applications directory of my configured OC4J, deployed successfully and all I get is a #@!&^! 404 Page Not Found Error.


Slamming head on desk. . .

Step 1: Learning How To Deploy an EAR File to OAS 10g

This morning I worked through the JDeveloper tutorial "Deploying A Web Application" to learn how to package and deploy an EAR file to an OAS 10g Application Server. The tutorial uses a stand-alone OC4J instance instead, but I figured deploying to a real, live OAS 10g R2 10.1.2.0.2 server couldn't be much different.

I followed the tutorial and everything worked as advertised. Then I created an OC4J instance on my 10.1.2.0.2 middle-tier. I created an application server connection for the OC4J instance, tested the connection successfuly, and attempted to deploy the EAR file created during the tutorial.

This is what I get in the JDeveloper deployment log:

---- Deployment started. ---- Apr 25, 2007 1:15:29 PM
Target platform is Oracle Application Server 10g 10.1.2 (Windows) (hw-05-0193_test).
Wrote WAR file to C:\oracle\jdeveloper\jdev\mywork\OrderEntry\ViewController\deploy\WebArchive.war
Running dependency analysis...
Wrote JAR file to C:\oracle\jdeveloper\jdev\mywork\OrderEntry\Model\deploy\ModelArchive.jar
Wrote EAR file to C:\oracle\jdeveloper\jdev\mywork\OrderEntry\Deployment\deploy\OrderEntryApplication.ear
Invoking DCM servlet client...
C:\oracle\jdevstudio_10.1.3.2\jdk\jre\bin\javaw.exe -Djava.protocol.handler.pkgs=HTTPClient -jar C:\oracle\jdevstudio_10.1.3.2\jdev\lib\oc4j_remote_deploy.jar http://hw-05-0193.emts.tybrin.com:18101/Oc4jDcmServletAPI/ ias_admin **** redeploy c:\oracle\mid1012 C:\oracle\jdeveloper\jdev\mywork\OrderEntry\Deployment\deploy\OrderEntryApplication.ear OrderEntryApplication test
Initializing log
Servlet interface for OC4J DCM commands
Command timeout defined at 600 seconds
Executing DCM command...
Executing command redeploy c:\oracle\mid1012 C:\oracle\jdeveloper\jdev\mywork\OrderEntry\Deployment\deploy\OrderEntryApplication.ear OrderEntryApplication test
Command = REDEPLOY
Reading application's ear file
Ear file was successfully read
Opening connection to Oc4jDcmServlet
Setting userName to ias_admin
Sending command to DCM servlet
HTTP response code = 200, HTTP response msg = OK
Command was successfully sent to Oc4jDcmServlet
Receiving session id from servlet to check command status
Session id = 0a0b0d0346b5c27f8ee09107497488b1f5557e188584
Please, wait for command to finish...
Checking command status...
Setting userName to ias_admin
Setting Cookie to JSESSIONID=0a0b0d0346b5c27f8ee09107497488b1f5557e188584
Checking command status
HTTP response code = 200, HTTP response msg = OK
Command has not finished yet
Checking command status...
Setting userName to ias_admin
Setting Cookie to JSESSIONID=0a0b0d0346b5c27f8ee09107497488b1f5557e188584
Checking command status
HTTP response code = 200, HTTP response msg = OK
Command has finished
Receiving command exit value
Receiving command output
**** No output was received from command
Closing connection to Oc4jDcmServlet
#### DCM command did not complete successfully (-8)
#### HTTP return code was -8
Exit status of DCM servlet client: -8
Elapsed time for deployment: 29 seconds
#### Deployment incomplete. #### Apr 25, 2007 1:15:58 PM

And this is the error OAS 10g EM reported when I copied the EAR file to the OC4J applications directory and attempted to use the OC4J's applications page to deploy the file:

Deployment failed: Nested exception
Resolution:

Base Exception:
java.rmi.RemoteException
deploy failed!: ; nested exception is:
oracle.oc4j.admin.internal.DeployerException: Unknown assembly root-tag attribute: xmlns:xsi. deploy failed!: ; nested exception is:
oracle.oc4j.admin.internal.DeployerException: Unknown assembly root-tag attribute: xmlns:xsi


As usual with Oracle, nothing is ever easy. Time to give the documenation a read.

Update: Googled the OTN Forums and found a post relating to the same error. Several posts down was a suggestion to read Chapter 22 of the ADF Developer's Guide - this discusses deploying applications developed with JDev 10.1.3 on OAS 10.1.2 platforms. Apparently they use different versions of the JDK. I browsed the guide for a moment, and then decided to see if there was something platform-specific in the deployment process. I followed the tutorial to create a new deployment profile, but found nothing platform-specific. But I went ahead and tried to deploy it to the 10.1.2 application server and - it worked! Maybe the deployment process writes a makefile or something platform- and version-specific. . .

Now I have to figure out the username and password the application is prompting me for. The one used for the OC4J standalone doesn't work and neither does the ias_admin password for the 10.1.2 OAS.

Another update: The username/password was a non-issue. Having two web servers on the same box is always confusing (my OHS uses port 7778. . .)

But now the control page for the OC4J says that although the application is present, it's status is "not loaded". I bet Google loves me (and every other self-taught Oracle wannabe).

One more update: I checked the deployment properties in JDeveloper and I forgot to select some options. Undeployed from app server, redeployed from JDev and got the original error again. Just another false trail.