JB0SS 4.0.4 R1 -> 4.0.4.R2 ssl ejb3 stopped working

[schuller007]

Following the instructions at http://docs.jboss.org/ejb3/appserver/reference/build/reference/en/html/transport.html I could run my rich client app against EJB3s running on sslsocket no problem.

On 4.0.4 R2 running the same code, following the same steps I am getting the following exception:

15:16:43,156 ERROR [SSLSocketServerInvoker] Failed to accept socket connection
java.lang.reflect.InvocationTargetException
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)

at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Sou
rce)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at org.jboss.remoting.transport.socket.ServerThread.createServerSocket(S
erverThread.java:184)
at org.jboss.remoting.transport.socket.ServerThread.(ServerThread.
java:86)
at org.jboss.remoting.transport.socket.SocketServerInvoker.processInvoca
tion(SocketServerInvoker.java:426)
at org.jboss.remoting.transport.socket.SocketServerInvoker.run(SocketSer
verInvoker.java:388)
at java.lang.Thread.run(Unknown Source)
Caused by: java.io.StreamCorruptedException: invalid stream header
at java.io.ObjectInputStream.readStreamHeader(Unknown Source)
at java.io.ObjectInputStream.(Unknown Source)
at org.jboss.remoting.loading.ObjectInputStreamWithClassLoader.(Ob
jectInputStreamWithClassLoader.java:57)
at org.jboss.remoting.serialization.impl.java.JavaSerializationManager.c
reateInput(JavaSerializationManager.java:52)
at org.jboss.remoting.transport.socket.ServerSocketWrapper.createInputSt
ream(ServerSocketWrapper.java:56)
at org.jboss.remoting.transport.socket.ClientSocketWrapper.createStreams
(ClientSocketWrapper.java:76)
at org.jboss.remoting.transport.socket.ClientSocketWrapper.(Client
SocketWrapper.java:54)
at org.jboss.remoting.transport.socket.ServerSocketWrapper.(Server
SocketWrapper.java:50)
... 9 more

[cyril.joui]

Do you use the good libraries on your client ? (and not the 4.0.4RC1 libraries) ?

It may be the problem ...

[schuller007]

Thanks for the repy, but I am using the correct libraries:

In jboss404r2\client:

jbossall-client.jar
jboss-aop-jdk50-client.jar
jboss-aspect-jdk50-client.jar
jboss-ejb3-client.jar
jboss-ejb3x.jar


Any other ideas?

[schuller007]

In the server.log I found the following. I am not getting this in 4.0.4RC1.

[org.jboss.system.ServiceController] Creating dependent components for: jboss.aop:service=AspectDeployer dependents are: [ObjectName: jboss.remoting:type=Connector,name=DefaultEjb3Connector,handler=ejb3
State: CONFIGURED
I Depend On:
jboss.aop:service=AspectDeployer
, ObjectName: jboss.ejb3:service=EJB3Deployer
State: CONFIGURED
I Depend On:
jboss.aop:service=AspectDeployer
jboss.ejb:service=EJBDeployer
jboss.ejb3:service=JarsIgnoredForScanning
]
2006-05-15 10:37:19,953 DEBUG [org.jboss.system.ServiceController] Creating service jboss.remoting:type=Connector,name=DefaultEjb3Connector,handler=ejb3
2006-05-15 10:37:20,000 DEBUG [org.jboss.remoting.transport.socket.ssl.SSLSocketServerInvoker] Did not find server socket factory configuration as mbean service or classname. Creating default server socket.2006-05-15 10:37:20,000 DEBUG [org.jboss.remoting.transport.socket.ssl.SSLSocketServerInvoker] Created server socket factory: javax.net.DefaultServerSocketFactory@fd918a
2006-05-15 10:37:20,015 DEBUG [org.jboss.system.ServiceController] Creating dependent components for: jboss.remoting:type=Connector,name=DefaultEjb3Connector,handler=ejb3 dependents are: []
2006-05-15 10:37:20,015 DEBUG [org.jboss.system.ServiceController] Creating service jboss.ejb3:service=EJB3Deployer
2006-05-15 10:37:20,015 DEBUG [org.jboss.system.ServiceController] waiting in create of jboss.ejb3:service=EJB3Deployer waiting on jboss.ejb:service=EJBDeployer



In jboss-service.xml I have:

 <mbean code="org.jboss.remoting.transport.Connector"
 xmbean-dd="org/jboss/remoting/transport/Connector.xml"
 name="jboss.remoting:type=Connector,name=DefaultEjb3Connector,handler=ejb3">
 <depends>jboss.aop:service=AspectDeployer</depends>
 <attribute name="InvokerLocator">sslsocket://${jboss.bind.address}:3843</attribute>
 <attribute name="Configuration">
 <handlers>
 <handler subsystem="AOP">org.jboss.aspects.remoting.AOPRemotingInvocationHandler</handler>
 </handlers>
 </attribute>
 </mbean>

[bdecoste]

There is a known issue with the remoting component that impacts the use of SSL with EJB3. http://jira.jboss.com/jira/browse/JBREM-464

The workaround is to configure ejb3 with a security domain and socket factory. Example below:

<!-- The server socket factory mbean to be used as attribute to socket invoker -->
 <!-- which uses the JaasSecurityDomain -->
 <mbean code="org.jboss.remoting.security.domain.DomainServerSocketFactoryService"
 name="jboss.remoting:service=ServerSocketFactory,type=SecurityDomainAdvanced"
 display-name="SecurityDomain Server Socket Factory">
 <attribute name="SecurityDomain">java:/jaas/SSLAdvanced</attribute>
 <depends>jboss.security:service=JaasSecurityDomain,domain=SSLAdvanced</depends>
 </mbean>

 <mbean code="org.jboss.security.plugins.JaasSecurityDomain"
 name="jboss.security:service=JaasSecurityDomain,domain=SSLAdvanced">
 <!-- This must correlate with the java:/jaas/SSL above -->
 <constructor>
 <arg type="java.lang.String" value="SSLAdvanced"/>
 </constructor>
 <!-- The location of the keystore
 resource: loads from the classloaders conf/ is the first classloader -->
 <attribute name="KeyStoreURL">localhost.keystore</attribute>
 <attribute name="KeyStorePass">opensource</attribute>
 </mbean>

 <!-- The Connector is the core component of the remoting server service. -->
 <!-- It binds the remoting invoker (transport protocol, callback configuration, -->
 <!-- data marshalling, etc.) with the invocation handlers. -->
 <mbean code="org.jboss.remoting.transport.Connector"
 xmbean-dd="org/jboss/remoting/transport/Connector.xml"
 name="jboss.remoting:type=Connector,transport=socket3843,handler=ejb3">
 display-name="Socket transport Connector">

 <attribute name="Configuration">
 <config>
 <invoker transport="sslsocket">
 <attribute name="dataType" isParam="true">invocation</attribute>
 <attribute name="marshaller" isParam="true">org.jboss.invocation.unified.marshall.InvocationMarshaller</attribute>
 <attribute name="unmarshaller" isParam="true">org.jboss.invocation.unified.marshall.InvocationUnMarshaller</attribute>
 <!-- The following is for setting the server socket factory. If want ssl support -->
 <!-- use a server socket factory that supports ssl. The only requirement is that -->
 <!-- the server socket factory value must be an ObjectName, meaning the -->
 <!-- server socket factory implementation must be a MBean and also -->
 <!-- MUST implement the org.jboss.remoting.security.ServerSocketFactoryMBean interface. -->
 <attribute name="serverSocketFactory">jboss.remoting:service=ServerSocketFactory,type=SecurityDomainAdvanced</attribute>
 <attribute name="serverBindAddress">${jboss.bind.address}</attribute>
 <attribute name="serverBindPort">3843</attribute>
 </invoker>
 <handlers>
 <handler subsystem="AOP">org.jboss.aspects.remoting.AOPRemotingInvocationHandler</handler>
 </handlers>
 </config>
 </attribute>
 <depends>jboss.remoting:service=ServerSocketFactory,type=SecurityDomainAdvanced</depends>
 <depends>jboss.aop:service=AspectDeployer</depends>
 </mbean>

[schuller007]

I have copied the example into my ejb3.deployer/META-INF/jboss-service.xml but I got this exception:

11:37:00,500 WARN [ServiceController] Problem starting service jboss.security:s
ervice=JaasSecurityDomain,domain=SSLAdvanced
javax.management.InstanceNotFoundException: jboss.security:service=JaasSecurityM
anager is not registered.
at org.jboss.mx.server.registry.BasicMBeanRegistry.get(BasicMBeanRegistr
y.java:523)
at org.jboss.mx.server.MBeanServerImpl.invoke(MBeanServerImpl.java:653)
at org.jboss.security.plugins.JaasSecurityDomain.startService(JaasSecuri
tyDomain.java:403)

[schuller007]

How come it works on 4.0.4 RC1?

[bdecoste]

Do you see the jboss.security:service=JaasSecurityManager deployed in the JMX Console?

There were some changes to the remoting package between 4.0.4.RC1 and 4.0.4.GA. This is a known issue that will be corrected in a near term remoting release.

[schuller007]

Yes it is deployed and started.

[bill.burke]

i'm going to push out an EJB3 release later tomorrow(or sometime this week) with an SSL tutorial.

If you can't wait that long

$ cvs checkout -r Branch_4_0 jboss-4.0.x
$ cd jboss-4.0.x/ejb3/docs/tutorial/ssl

[bill.burke]

that tutorial works with 4.0.4GA

[tsar_bomba]

Forgive my ignorance, I'm rather new to JBoss. Would this issue have affected SSL (https) in Tomcat as well? I'm having a real tough time getting https to work in JBoss 4.0.4.GA.

[schuller007]

Bill,

I am a bit puzzled, I thought you acknowledged that it does not work in the GA and you will update the SSL tutorial. Again I have tried the old tutorial out of the box and I am getting

11:37:00,500 WARN [ServiceController] Problem starting service jboss.security:service=JaasSecurityDomain,domain=SSLAdvanced
javax.management.InstanceNotFoundException: jboss.security:service=JaasSecurityM
anager is not registered.

which apparently according to bdecoste is due to some changes in the remoting package.

If you have some time, please shed some light on this.

[starksm64]

"tsar_bomba" wrote:
Forgive my ignorance, I'm rather new to JBoss. Would this issue have affected SSL (https) in Tomcat as well?

No.

[bill.burke]

follow the CVS checkout as mentioned below if you want your answer now. I'll be doing a release shortly for RC7 that has an SSL tutorial that works with 4.0.4GA