Undeployment of composites when soa-infra is down

Undeployment of composites when soa-infra is down

Did you already have the problem that you couldn’t restart your server because of a certain (maybe broken) composite? Did you ever wish to perform an undeployment of your composites while soa-infra is down? In some of our projects we already had this requirement. Below you’ll find an explanation with a step-by-step example of how-to get rid of your composites – even when the soa-infra is not reachable.

Enterprise Manager with a list of the deployed composites (relevant for this post: HelloWorld 1.0.0)

Problem

A restart of the Managed Server failed because one of the composites referred to a file that could not be found. Therefore we received the following error message:  

weblogic.work.ExecuteThread.run(ExecuteThread.java:176)

Caused By: java.io.IOException: oracle.mds.exception.MDSException: MDS-00054: The file to be loaded oramds:/deployed-composites/default/HelloWorld_rev1.0.0/… does not exist.

        at oracle.mds.internal.net.AbstractOraMDSURLConnection.getPDocStream(AbstractOraMDSURLConnection.java:388)

        at oracle.mds.internal.net.AbstractOraMDSURLConnection.getInputStream(AbstractOraMDSURLConnection.java:176)

        at oracle.mds.internal.net.OraMDSURLConnection.getInputStream(OraMDSURLConnection.java:67)

        at java.net.URL.openStream(URL.java:1010)

        at oracle.fabric.common.metadata.MetadataManagerImpl.getInputStreamFromAbsoluteURL(MetadataManagerImpl.java:276)

        at oracle.integration.platform.common.MDSMetadataManagerImpl.getInputStreamFromAbsoluteURL(MDSMetadataManagerImpl.java:555)

        at oracle.integration.platform.common.MDSMetadataManagerImpl.transferFile(MDSMetadataManagerImpl.java:852)

        at oracle.integration.platform.common.MDSMetadataManagerImpl.transferFiles(MDSMetadataManagerImpl.java:839)

        at oracle.integration.platform.common.MDSMetadataManagerImpl.copyTree(MDSMetadataManagerImpl.java:820)

        at

How-to fix it?

Since redeployment is not possible because of a non-reachable soa-infra, we needed to look for the available options to delete the current deployment in an offline mode. This should help us to restart the server again. For this we did some research in the web but unfortunately most of the suggested solutions are only applicable when soa-infra is online. One of these examples is the export / import functionality for the MDS via Enterprise Manager - see the article Undeploy composites manually for more details. The functionality is very useful but it requires a running soa application. After that I tried to export the deployed-composites.xml as described in the above blog using WLST – unfortunately the result wasn’t satisfying:

Command:

wls:/domain/serverConfig> exportMetadata(application='soa-infra',server='<MY_MANAGED_ SERVER_SOA>',toLocation='<MY_TO_LOCATION>',docs='/deployed-composites/deployed-composites.xml')

 

Result:

Location changed to domainRuntime tree. This is a read-only tree with DomainMBean as the root.
For more help, use help(domainRuntime)
Executing operation: exportMetadata.

Traceback (innermost last):
  File "<console>", line 1, in ?
  File "/opt/oracle/Middleware/oracle_common/common/wlst/mdsWLSTCommands.py", line 237, in exportMetadata
  File "/opt/oracle/Middleware/oracle_common/common/wlst/mdsWLSTCommands.py", line 727, in executeAppRuntimeMBeanOperation
  File "/opt/oracle/Middleware/oracle_common/common/wlst/mdsWLSTCommands.py", line 697, in getMDSAppRuntimeMBean
UserWarning: MDS-91002: MDS Application runtime MBean for "soa-infra" is not available. "exportMetadata" operation failure.

Solution

Besides other options like direct access to MDS via Java (Full access to MDS Repository) or SQL (MDS_PATHS Table) we discovered a new and up-to-date Metalink-Note ([ID 1380835.1]) which described basically what we wanted. Thanks a lot to Markus Lohn (Oracle) for his support! We successfully followed the steps within the note and after that the server came up. Below I describe the approach with the above Hello World example. 

1. Download and copy the ShareSoaInfraPartition.ear from Oracle to access the MDS offline (Download it from the Metalink note). 

2. Connect to WLST and deploy the above application on the AdminServer. Use the WLST under $MIDDLEWARE_HOME/ oracle_common/common/bin.

3. Run the below command to export the metadata from the AdminServer. Change the values appropriate to your environment.

Command:

wls:/domain/serverConfig> 

exportMetadata(application='ShareSoaInfraPartition',server='<MY_ADMIN_ SERVER>',toLocation='<MY_TO_LOCATION>',docs='/deployed-composites/deployed-composites.xml')

Result:

Executing operation: exportMetadata.
Operation "exportMetadata" completed. Summary of "exportMetadata" operation is:
List of documents successfully transferred:
/deployed-composites/deployed-composites.xml
1 documents successfully transferred.

4. Open the deployed-composites.xml within deployed-composites folder under <MY_TO_LOCATION>.

5. Delete the composite series or revision which is causing the problem and save the file.

<composite-series name="default/HelloWorld" default="default/HelloWorld!1.0.0">
  <composite-revision dn="default/HelloWorld!1.0.0" state="on" mode="active" location="dc/soa_09001e40-be6f-4bc4-8a96-201f3848c38d">
    <composite dn="default/HelloWorld!1.0.0*soa_09001e40-be6f-4bc4-8a96-201f3848c38d" deployedTime="2012-03-09T13:15:14.139+01:00"/>
  </composite-revision>
</composite-series>

6. Import the updated file under <MY_FROM_LOCATION> into MDS.

Command:

wls:/domain/serverConfig> importMetadata(application='ShareSoaInfraPartition',server='AdminServer',fromLocation='<MY_FROM_LOCATION>',docs='/deployed-composites/deployed-composites.xml')

Result:

Executing operation: importMetadata.

Operation "importMetadata" completed. Summary of "importMetadata" operation is:
List of documents successfully transferred:

/deployed-composites/deployed-composites.xml
1 documents successfully transferred.

7. Restart your SOA server or soa-infra.

Enterprise Manager with a list of the deployed composites (note that HelloWorld 1.0.0 is not available)

Undeploy multiple SOA composites with WLST or ANT

Undeploy multiple SOA composites with WLST or ANT

As part of our current project the Build Management team asked for a solution to undeploy multiple composites at one time. Of course you have the “Undeploy All From This Partition” menu option in Enterprise Manager but since we have a lot of deployments every day the guys wanted to have a script solution. It is even more important for the nightly deployments on our continuous integration environment – strange, we couldn’t find anybody who wants to do the undeployment via Enterprise Manager manually every night ;-)

However with WLST or ANT the SOA Suite comes with two options to undeploy composites via script. In this article I’d like to explain you both ways.

Undeployment with WLST

You can test the steps below on Oracle's Pre-built Virtual Machine for SOA Suite and BPM Suite 11g.

1) Change to the WLST directory under MIDDLEWARE_HOME/Oracle_SOA1/common/bin.

cd /oracle/fmwhome/Oracle_SOA1/common/bin/

2) Open WLST

./wlst.sh

3)  Connect to the SOA server

wls:/offline> connect('weblogic','welcome1','t3://192.168.1.2:7001')
Connecting to t3://soabpm-vm:7001 with userid weblogic ...
Successfully connected to Admin Server 'AdminServer' that belongs to domain 'dev_bpm'.

wls:/dev_bpm/serverConfig>

4) Run the delete command for the appropriate partition

wls:/dev_bpm/serverConfig> sca_deletePartition('test')

partitionName = test

Partition was successfully deleted.

wls:/dev_bpm/serverConfig>

Please take into account that the command deletes all composites as well as the partition itself. If you need the partition for future deployments just recreate it with the sca_createPartition WLST-command. Also check the Oracle Fusion Middleware WebLogic Scripting Tool Command Reference for a complete list of SOA Suite Custom WLST Commands.

Undeployment with ANT

Another option is to use ANT for the undeployment of multiple composites. The key here is to reference the file ant-sca-mgmt.xml within your custom ANT-target. The file comes with SOA Suite as well as JDeveloper. See my quick example below:

<target name="sca_deletePartition">

  <echo>Undeploy Composites</echo>      

  <ant antfile="/oracle/fmwhome/Oracle_SOA1/bin/ant-sca-mgmt.xml"

     inheritall="false" target="deletePartition">         

      <property name="host" value="soabpm-vm"/>         

      <property name="port" value="7001"/>         

      <property name="user" value="weblogic"/>         

      <property name="password" value="welcome1"/>         

      <property name="partition" value="testPartition"/>      

  </ant>   

</target>

Again this command deletes all composites of the given partition as well as the partition itself. 

SOA VM setup

Connect to multiple SOA / BPM Virtual Machines from different computers in your network

Today I’d like to explain how to share instances of Oracle's Pre-built Virtual Machine for SOA Suite and BPM Suite across different computers in your network. Three requirements I had to address:

1. Call of external services like GeoNames (http://www.geonames.org/postal-codes/) from within the BPM Suite VM
2. Connection to multiple BPM Suite VMs from Host (e.g. JDeveloper and Browser)
3. Connection to multiple BPM Suite VMs from different developer computers in the network 
4. Share data between VMs and developer computers via FTP

The default options already support connections between host and client. However the target here was to address multiple independent VMs from different computers in the same network. The following settings worked in my environment:

1) Start the Oracle VM VirtualBox Manager and open network settings of the VM.

2) Select Bridged Adapter in “Attached to”. Bridged Networking is used when you want your vm to be a full network citizen, i.e. to be an equal to your host machine on the network (see Networking in VirtualBox for more details).

3) Select the name of your network adapter. Take into account that when you change your connection method (WIFI / Cable) a different network adapter is required. Get the appropriate name from the network settings of the host.

4) Specify the Adapter Type.

5) Start the VM.

6) Per default the VM receives the IP via DHCP method. Open a terminal window in the client and send the following command as root user to get the current IP address information of your VM. Instead of DHCP you could also change the connection method of your VM to a static address.

ifconfig <CONNECTION-NAME>  (e.g. ifconfig eth1) 

7) Another way to get the IP information is the network icon at the bottom of the Oracle VM VirtualBox window.

8) Connect or ping this IP address (here: 192.168.2.131) from the host or from a different computer in your network. I suggest adding the IP address to your etc/hosts-file in order to address the VM via names instead of a static IP addresses. If successful start the SOA / BPM Server and enjoy the remote development. If not please check your firewall and router settings. Good luck!

Remove data in Oracle MDS

Remove data in Oracle MDS

The two main database schemas in the Oracle SOA Suite database repository are: <PREFIX>_SOAINFRA and <PREFIX>_MDS. Composite instance and runtime information are stored in the SOAINFRA schema. Commonly used metadata like WSDLs, XSDs, rules, fault policies, etc. as well as composite deployments are stored within the MDS schema. 

With every deployment / import of the metadata artifacts a new document version will be created in the MDS. This means that re-importing an updated WSDL-file into the MDS does not delete the previous version of the document. Furthermore we sometimes need to remove unnecessary and unwanted files from the repository. If this is not considered you might end in problems like below:

ORA-01654: unable to extend index DEV_MDS.MDS_PATHS_U2 by 128 in tablespace DEV_MDS
ORA-06512: at "DEV_MDS.MDS_INTERNAL_COMMON", line 865
ORA-06512: at "DEV_MDS.MDS_INTERNAL_COMMON", line 1021
ORA-06512: at "DEV_MDS.MDS_INTERNAL_COMMON", line 1121
ORA-06512: at "DEV_MDS.MDS_INTERNAL_COMMON", line 1216
ORA-06512: at "DEV_MDS.MDS_INTERNAL_COMMON", line 1872
ORA-06512: at line 1
 

In order to avoid production problems because of a full MDS tablespace you should clean up the schema from time to time. This post explains the options that Oracle SOA Suite provides to remove contents from MDS.

OPTION 1: Remove directories and files from MDS using WLST

1) Start WLST from SOA_HOME/common/bin/wlst.sh.

Example:
 
[oracle@soabpm-vm ~]$ cd /oracle/fmwhome/Oracle_SOA1/common/bin 
[oracle@soabpm-vm bin]$ ./wlst.sh 
wls:/offline>
 

2) Execute the following command: sca_removeSharedData('http://<soahost>:<soaport>', 'directory', 'user', 'password')

Example (delete folder 'interfaces' and all its subdirectories and files):

wls:/offline> sca_removeSharedData(‘http://localhost:8001’, ‘interfaces’, ‘weblogic’, ‘welcome1’)
 

Note: With the command above you can just remove directories and files which are stored under "apps".

OPTION 2: Remove directories and files from MDS using ANT

Oracle provides some ANT scripts which can be used to integrate the "remove" command into your central build & deploy proccess. Just search for the "removeSharedData" command in ant-sca-deploy.xml. On the server this file is located under SOA_HOME/bin. You can also find the file in your JDeveloper install folder under MIDDLEWARE_HOME/jdeveloper/bin.

1) Execute the command: ant -f ant-sca-deploy.xml removeSharedData -DserverURL=server.url -DfolderName=folder.name -Drealm=realm -Duser=user -Dpassword=password -DfailOnError=true/false

Example (delete folder 'interfaces' and all its subdirectories and files):
 
ant -f ant-sca-deploy.xml removeSharedData -DserverURL=http://localhost:8001 -DfolderName=interfaces"
 

Note: With the command above you can just remove directories and files which are stored under "apps"

OPTION 3: Remove files from MDS using WLST

1) Start WLST from SOA_HOME/common/bin/wlst.sh

Example:

[oracle@soabpm-vm ~]$ cd /oracle/fmwhome/Oracle_SOA1/common/bin
[oracle@soabpm-vm bin]$ ./wlst.sh
wls:/offline>
 

2) Connect to the SOA server: connect('user', 'password', 't3://<soahost>:<soaport>')

Example: 

wls:/offline> connect('weblogic', 'welcome1', 't3://localhost:8001') 
 

3) Execute the command: deleteMetadata(application=’application-name', server=’soaserver-name’, docs=’absolutePath’)

Example (delete all files in '/apps/interfaces' as well as the files in its subdirectories): 
 
wls:/...> deleteMetadata(application='soa-infra',server='soa_server1',docs='/apps/interfaces/**') 
 

Note: With the command above all files in directory 'apps/interfaces' will be deleted. Please note the double asterisk (**) at the end of the this parameter. The asterisk (*) represents all documents under the current directory. The double asterisk (**) represents all documents under the current directory and also recursively includes all documents in subdirectories.

OPTION 4: Remove files from MDS using MBean Browser

You can call the command "deleteMetadata" also from the Enterprise Manager / MBean Browser.

1) Login to EM (http://host:port/em)
2) Expand SOA
3) Right-click on soa-infra
4) Select Administration -> MDS Configuration
5) Click Runtime MBean Browser
6) Click Operations tab
7) Click deleteMetadata operation
8) Provide parameters:
      docs - list of entries to remove (fully qualified path, eg: /apps/interfaces/**)
      restrictCustTo - default
      excludeAllCust - false
      excludeBaseDocs - false
      excludeExtendedMetadata - false
      cancelOnException - true
9) Click Invoke

OPTION 5: Purge Metadata Version History using Fusion Middleware Control

For database-based MDS, you can purge the metadata version history using the Fusion Middleware Control (Enterprise Manager). This operation purges the version history of unlabeled documents from the application's repository partition. The tip version (the latest version) is not purged, even if it is unlabeled.

1) Login to EM (http://host:port/em)
2) Expand SOA
3) Right-click on soa-infra
4) Select Administration -> MDS Configuration
5) Scroll to the “Purge” section: enter a value in the Purge all unlabeled past versions older than field and click on the Purge button
6) In the Confirmation dialog box, click Close

Note: For more details see the Oracle Fusion Middleware Administrators Guide. Section 14.3.11.2 also explains how to purge metadata version history using WLST.

How to view the MDS content

After you removed files and/or directories from the MDS you might want to have a look at the actual content. The easiest way to do this is to create a MDS connection in JDeveloper.

Some additional information about the MDS

• Oracle Fusion Middleware Developer's Guide for Oracle SOA Suite - Deploying and Using Shared Metadata Across SOA Composite Applications
• Oracle Fusion Middleware Administrator's Guide - Managing  the Oracle Metadata Repository
• Storing SCA Metadata in the Oracle Metadata Services Repository
• Full access to MDS Repository

Configure Auto-Recovery in Oracle SOA Suite

Configure Auto-Recovery in Oracle SOA Suite

Oracle SOA Suite 11g has some great features to recover faulted instances automatically. When a BPEL process flow errors out, it is retried with all its invocations. This is undesirable in some cases. For example if re-calling a composite results in duplicated data, data have been changed before the recovery is planned to be executed or you do not want to create too many composite instances in order to save the space in your SOAINFRA-schema. See below the different places where automatic recoveries are configured / disabled.

1) Change RecurringScheduleConfig (see also the screenshot below) 

• Right-click soa-infra (SOA_cluster_name) 
• Choose SOA Administration > BPEL Properties 
• Click "More BPEL Configuration Properties" 
• Click "Recovery Config" 
• Change values for RecurringScheduleConfig 
• maxMessageRaiseSize = 0 
• startWindowTime = 00:00 
• stopWindowTime = 00:00 
• Click Apply 

2) Change StartupScheduleConfig (see also the screenshot below)

• Right-click soa-infra (SOA_cluster_name)
• Choose SOA Administration > BPEL Properties
• Click "More BPEL Configuration Properties"
• Click "Recovery Config"
• Change values forStartupScheduleConfig
• maxMessageRaiseSize = 0
• startupRecoveryDuration = 0
• subsequentTriggerDelay = 0
• Click Apply

3) Change GlobalTxMaxRetry
The property GlobalTxMaxRetry specifies how many retries are performed if an error is identified as a retriable one. For example, after several web service invocations, if dehydration fails due to a data source error, then this is identified as a retriable error and all activities from the prior dehydration state are retried. If the activities being retried are not idempotent (that is, their state can change with each retry and is not guaranteed to give the same behavior), then multiple retries can be problematic.

You can set GlobalTxMaxRetry to 0 in the Systems MBean Browser.

• Right-click soa-infra (SOA_cluster_name)
• Choose SOA Administration > Common Properties
• Click "More SOA Infra Advanced Configuration Properties"
• Click "GlobalTxMaxRetry"
• In the Value field, enter an appropriate value
• Click Apply

Securing SOA 11g Environment

Securing SOA 11g Environment

Security is the most important part of any enterprise application. So we need to secure SOA Production environment secure and make Jdeveloper communicate with that secure environment.
In this blog I’ll show you how to import certificate into weblogic and jdev and make it accessible over https.You can take the certificate from any trusted CA but that incur some extra expense.For testing and development purpose you can use self signed certificate else you can download the signed certificate from a CA which is free of cost, will show you the link in steps later.So prerequisite is your SOA 11.1.1.5 env is ready with Admin server which contains SOA managed server, just follow the steps and you are done!
At first open a command prompt and set exactly the same JAVA_HOME which your weblogic server is using.For that just run <fmw_home>\user_projects\domains\base_domain\bin\setDomainEnv.sh or setDomainEnv.cmd. Check the java –version to recheck once again and issue the below commands.In all cases you can use your own alias name and keystore name.I created my own certificates directory(can be at any location) and change the path to the same.
1. Generate Private Key pair using keytool
keytool -genkeypair -alias myserver -keyalg RSA -keysize 2048 -validity 365 -keystore shrikIS.jks -storepass welcome1
During key pair generation it will ask for some details onscreen and provide the same as per your wish.But for Prod environment your prod server URL would be the CN value.You can go ahead with any arbitrary value for testing purpose,after this command you can find shrikIS.jks created.
2. Generate CSR to be submitted to CA
keytool -certreq -v -alias myserver -file serverCert.csr -keypass welcome1 -storepass welcome1 -keystore shrikIS.jks
after this command you will find serverCert.csr file created in your directory.Just open that in notepad and copy the content like below sample,
-----BEGIN NEW CERTIFICATE REQUEST-----
MIICtTCCAZ0CAQAwcDELMAkGA1UEBhMCSU4xCzAJBgNVBAgTAkhSMRAwDgYDVQQHEwdHdXJnYW9u
MRMwEQYDVQQKEwpzaHJpa3dvcmxkMQswCQYDVQQLEwJJVDEgMB4GA1UEAxMXU2hyZWVrYW50YSBS
b3ljaG93ZGh1cnkwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCrurewhMtAxY/BGRPn
sWQANSIFqIprGDaCOz/YH3XAcUguPg7lUTkE8o6tRfT6vMrMSai2/zg8Cc9dwbNaTtRoJu15qAHq
6Ta6SjvQ4VeIwAP8T2BNnrHn+GQuo7E0ef0hNHuvVcsLoZy6dBlXIc/WBn869xUKt84+ZZ79cII8
VenWFvJXi1f8NxitkjKRzbOydFOVwOza8Lo90V7Tn/DkV2OHpL9bjLnWJhLT5ZGwxhnqne79tJbV
VTZepndjhuz0JEc4DjjS2TZqsT7q4zdXM0+5HwJDOxvqjEegfSewfwPlXGSLHhOSA1s6fsEQtmZ9
h7IGSC5TJQnoXyOyxz4lAgMBAAGgADANBgkqhkiG9w0BAQUFAAOCAQEAVbIrPKGA5d6CPzXfB50S
GE4c/1OAH+qx+cv0ZzulgnfuPdKaVWzqJDc13UquCBjl/8fKevASgTtmw420JVZX6teOiCUtH06n
tO1EIT/Ti53D5KIDCQhRosMl54OjBzYwfejTDXbjoOHtKHzQo9Wi8W5sl4dd5jAp1BP/PBbfxaBS
LLPbzSRxcQKTszpeE6ekFSaKzll1CnuBhCydjXMOf6rKFOD7s1vT5uN4+GFRjtXGUlzYqcKfCTgj
OBS/MfSru4IIZtweyXJUhGPCvLaVWyq0VQ+3x4TLXDrw1579MtDunuTaJiysk1bRc1Tjrhy/hmlP
txsGAdmwrduApovnHA==
-----END NEW CERTIFICATE REQUEST-----
You need to send this CSR to a CA who will give you root certificate,sometimes intermediate certificate and signed certificate(public key).Go to http://www.getacert.com/signacert.html.

So here in the blank section copy paste your CSR content and click submit. After that you reach the below screen,

From this screen download all two .cer files in same directory.
3. Import the getacert.cer file as RootCert as below,
keytool -import  -file getacert.cer -alias RootCA -keystore shrikIS.jks -storepass welcome1
4. Establish Certificates Chain
Then you have to import the ShreekantaRoychowdhury-2011-07-21-214305.cer file , but remember here you have to give same alias name as you given while generating the private key pair at first step, to establish the certificate chain.
keytool -import  -file ShreekantaRoychowdhury-2011-07-21-214305.cer -alias myserver -keystore shrikIS.jks -storepass welcome1
You should see ‘Certificate reply was installed in keystore’ message after executing the above command.
5. Create Trust Store
Now export the public key of your certificate and store it in a trust store by using below commands,
keytool -export -alias myserver -file server.cer -keystore shrikIS.jks -storepass welcome1
keytool -import -alias server -trustcacerts -file server.cer -keystore shrikTS.jks
After this you will find another keystore shrikIS.jks is created in your directory.
Download keytool-iui from http://code.google.com/p/keytool-iui/ to see or manage your keystore in a GUI interface, its pretty cool one,here are the screenshots for mine,


6. Configure Weblogic Server
Now go the server tab of your weblogic console,

Click on Adminserver and keystore tab there after,

Change the keystore to Custom Identity and Custom Trust and provide the Identity store and trust store location with password. Give keystore type JKS.Now click the SSL tab and give the private key alias and password there,

Here in the Advanced section select Hostname verification to none (in Prod don’t do that) and select Client Cert Requested But not Enforced in Two Way Client Cert Behavior: section dropdown list.
Then go the General tab and enable SSL port ,

Thant’s All ! you are almost set , secure all the managed server in same fashion.
Now restart the Server and try to open the console giving https and SSL port. You will find the certificate information in the browser,

You can view that certificate is issued to you and issued by getacert.
7. Configure Jdeveloper 11.1.1.5
Now you have to configure Jdeveloper to communicate with secured weblogic server.
For that open the jdev.conf file under <Jdev_Home>\jdeveloper\jdev\bin directory to check the Java location,

Now go to the <JDK_Folder>\jre\lib\security directory and copy your server.cer file here that you created in step 5.We need to import that to cacerts by below command
keytool -v -import -file server.cer -keystore cacerts
give the default password changeit.
Now open the Jdev and go the preference section under Tool –>HTTP Analyzer –>HTTPS Setup.Here give the Identity and Trust store location and password as below,

Now in the Appserver Connection in Resource Palette select your SOA server configuration and select Always use SSL as below and test the same.

You should get all success here and that completes the SOA Environment Security.

Invoking specific operation in a WS in BPEL

Invoking specific operation in a WS in BPEL

If a WS has multiple operations and if you want to invoke a particular operation from a BPEL invoke activity, the process is no different than invoking a simple WS with one operation.

Steps:

1. Create an external reference for the WS by drag/dropping the WebService component from the component pallete to the SOA Composite and select the wsdl of the appropriate WS. I assume the WS is already deployed.
2. Create a BPEL process and create a wire between the BPEL and the WS.
3. With this, a partner link is created in the .bpel file.
4. Create an invoke activity in the BPEL process and wire to the partner link. In the Edit Invoke popup, under the partner role, you can find the operation dropdown from which you select the appropriate operation. Based on the operation selected, the variable gets created(just in case you opt to automatically create a new one).

Invoking a Secured WebService in BPEL - Oracle SOA Suite 11g

No Webservice in real-world business applications is just exposed as it is, Security is enabled inherently

Oracle Fusion Middleware uses a policy-based model to manage and secure Web services across an organization

Policies apply security to the delivery of messages

Policies can be managed by both developers in a design-time environment and system administrators in a runtime environment

Below are the steps to invoke a secured WebService from a BPEL Process

1. Before we start, we have to know what is the security policy imposed by the WebService. In this example, we are considering a WebService that has oracle/wss_username_token_client_policy

2. There are 2 ways of imposing security for services in Oracle SOA Suite 11g
1. Design Time
1. Simply, rt click on the web service reference --> Configure WS Policies --> Select the appropriate Policy

Please note that you can select multiple policies at once, depending on the security of the WebService

This step adds the following snippet

      <wsp:PolicyReference URI="oracle/wss_username_token_client_policy" orawsp:category="security" orawsp:status="enabled"/>

2. Run Time
1. The same could be done at runtime using Enterprise Manager(EM)

Login to EM --> rt click on soa_infra --> configure Policies --> select the appropriate Policy

The above step creates a 'Lock' icon on top of the web service reference as shown above

3. Open composite.xml, goto source view, find out the reference tag in the file and add the following snippet which basically tells that this particular reference is secured with so-and-so policy, and these are the credentials for invoking the same

      <property name="oracle.webservices.auth.username" type="xs:string"

                many="false" override="may">admin</property>

      <property name="oracle.webservices.auth.password" type="xs:string"

                many="false" override="may">Welcome123</property>

Partnerlinks in Oracle SOA Suite 11g

Links to all the wsdl-driven services in a composite that BPEL interacts with, are called Partner Links.

They are the references to the actual implementations, through which the BPEL process interacts with the external world(services).

Invoked Partner Links : Links to services that are invoked by the BPEL process.

Clinet Partner Links : Links to services that can invoke a BPEL process.

In otherwords, all outward(to the BPEL process) links can be called as invoked partnerlinks and inward links can be called as client partner links.

<PartnerLinkType>

A partner link type defines how two individual WSDL-defined partners can interact together and what each of the partners have to offer.

Is defined in the wsdl of the services thru the WSDL extensibility mechanism.

It is included in the wsdl file of every service involved in the BPEL process.

It identifies the portType element referenced by the partnerLink in the process .bpel file.

 

Example:

In wsdl,

  <plink:partnerLinkType name="ABCPartnerLink">

    <plink:role name="SomeService"

                portType="ns:SomeServicePortType">

    </plink:role>

  </plink:partnerLinkType>

The <PartnerLinkType> element contains <role> element that the service provider or consumer can play, as defined in the <PartnerLink> element of the .bpel file

<PartnerLinks> are defined in the .bpel file.

Defines portType of the partner process that will participate in the BPEL process.

Contains myRole and partnerRole attributes, which relate to the <role> element in the

wsdl file's <PartnerLinkType>

A BPEL can interact with the services in 3 ways

1.  Services that invoke a BPEL process
2.  Services that are invoked by the BPEL process
3.  Services that act both ways

Need Review:

The client role represents the requestor of the service. Basically used for the callback.

Dehydration in BPEL - Oracle SOA Suite 11g

Over the life cycle of a BPEL instance, the instance with its current state of execution may be saved in a database. When a BPEL instance is saved to a database, the instance is known as being dehydrated. The database where the BPEL instance is saved is called a dehydration store.

Once a BPEL instance is dehydrated, Oracle BPEL Server can off load it from the memory of Oracle BPEL Server. When a certain event occurs, such as the arrival of a message or the expiration of a timer, Oracle BPEL Server locates and loads the persistent BPEL instance from the dehydration store back into the memory of Oracle BPEL Server and resumes the execution of the process instance. Dehydrating BPEL instances offers reliability. If Oracle BPEL Server crashes in the middle of executing a process, the instance can be recovered automatically, programmatically, or manually from the dehydrated states. When Oracle BPEL Server resumes the execution of the process instance, it resumes from the last dehydration point, which is the last state of the instance that Oracle BPEL Server saves to the dehydration store.

                When and how the dehydration occurs differs based on the process types:

■ Transient process — Oracle BPEL Server dehydrates the process instance only once at the end of the process. When a host crashes in the middle of running the process instance, the instances are not visible from Oracle BPEL Control.

■ Durable process/idempotent — Oracle BPEL Server dehydrates the process instance in-flight at all midprocess breakpoint and non-idempotent activities, plus the end of the process. When the server crashes, this process instance appears in Oracle BPEL Control up to the last dehydration point (breakpoint activity) once the server restarts. If the server crashes before the process instance reaches the first midprocess breakpoint activity, the instance is not visible in Oracle BPEL Control after the server restarts.

        There are three cases in which dehydration occurs:

1. When the BPEL instance encounters a mid-process breakpoint activity (not including the initial receive)

Activities like wait, receive, onMessage, onAlarm, call to an async WSDL

That is where an existing BPEL instance must wait for an event, which can be either a timer expiration or message arrival. When the event occurs (the alarm expires or the message arrives), the instance is loaded from the dehydration store and execution is resumed. This type of dehydration occurs only in durable processes, which have mid-process breakpoint activities. A transient process does not have any midprocess breakpoint activities.

2. When the BPEL instance encounters a non-idempotent activity

When Oracle BPEL Server recovers after a crash, it retries the activities in the process instance. However, it should only retry the idempotent activities. Therefore, when Oracle BPEL Server encounters a nonidempotent activity, it dehydrates it. This enables Oracle BPEL Server to memorize that this activity was performed once and is not performed again when Oracle BPEL Server recovers from a crash.

Idempotent activities are those activities where the result is the same irrespective of no. of times you execute the process.

Repeated invocations have the same affect as one invocation.

Ex : Read-Only services

3. When the BPEL instance finishes

At the end of the BPEL process, Oracle BPEL Server saves the process instance to the dehydration store, unless you explicitly configure it not to do so. This happens to both durable and transient processes. For transient processes, the end of the process is the only point where the process instance is saved. This is because a transient process does not have any mid-process breakpoint activities and nonidempotent activities where the in-flight dehydration can occur.

------------------

Dehydration triggered by:

(a)Breakpoint activities: <receive>, <onMessage> (including <pick>), <onAlarm>, <wait>, and <reply>

(b)When using checkPoint()within a <bpelx:exec>activity

------------------

A BPEL invoke activity is by default an idempotent activity, meaning that the BPEL process does not dehydrate instances immediately after invoke activities. Therefore, if idempotent is set to true and Oracle BPEL Server fails right after an invoke activity executes, Oracle BPEL Server performs the invoke again after restarting. This is because no record exists that the invoke activity has executed. This property is applicable to both durable and transient processes.

If idempotent is set to false, the invoke activity is dehydrated immediately after execution and recorded in the dehydration store. If Oracle BPEL Server then fails and is restarted, the invoke activity is not repeated, because Oracle BPEL Process Manager sees that the invoke already executed.

When idempotent is set to false, it provides better failover protection, but at the cost of some performance, since the BPEL process accesses the dehydration store much more frequently. This setting can be configured for each partner link in the bpel.xml file.

Some examples of where this property can be set to true are read-only services (for example, CreditRatingService) or local EJB/WSIF invocations that share the instance's transaction.

--------------------

BPEL Dehydration Stores

As already explained, when a BPEL process instance is saved in the database, it uses the schema that is configured using Repository Creation Utility(RCU) that you would use during SOA environment setup.

Here are some of the tables that a BPEL engine uses to store its current instance state.

cube_instance - stores instance metadata, eg. instance creation date, current state, title, process identifier

cube_scope - stores the scope data for an instance

work_item - stores activities created by an instance

document - stores large XML variables, etc.

Creating a Simple BPEL Process : HelloWorld BPEL

Business Process Execution Language(BPEL) is an execution language for defining business processes. In short, it is the language for orchestrating multiple WebServices based on the business logic.

This post is about creating your first BPEL process using Oracle SOA Suite 11g

This is a simple BPEL process that gives back fullName as response, inputs being firstName & lastName

Defining your first BPEL Process

Create a new Project, name it HelloWorldBPELPrj and select Empty Composite in the next screen'

 

Define a Schema as follows

 

In the composite file, drag and drop BPEL Process component from the Component Palette into the Components swimlane of the composite.xml

This will open up a wizard where you need to give the following details

Name : HelloWorldBPEL

Template : Syncrhonous BPEL Process

Select Input and Output from the schema just created

Select the checkbox "Expose as a SOAP WebService" so that it creates a WebService with the same message types in the External References section of the composite.xml, though which external clients talk to this BPEL process

 

This will create the following in the composite.xml

 

Now that you've created the skeleton, lets implement the BPEL process.

Either open the .bpel file from the Navigator or double click the BPEL process icon in the coposite.xml - this will take you to the BPEL Component Editor where you'll implement the business logic in the BPEL process

When you look at the empty BPEL process, you'll find an incoming line from the external WS to Receive Activity, and an outgoing line from Reply Activity to the same external WS. These lines represent the flow of message to and from the WS to the BPEL Process

Note : Every operation in a BPEL process is called an Activity

Click on the "X" symbol in the boundary enclosing both the activities. The boundary is called a Scope in BPEL, which is similar to Scope in any programming language

This will open up variables section, where you'll see 2 variables (inputVariable and outputVariable). The inputVariable contains the the value coming into the BPEL process from the external WS.

In this example, inputVariable contains just a simple string, name

We need to concatenate this with 'Hello ' and assign it to the output variable. This can be done using Assign activity

Drag and drop Assign activity in between the two activities, name it AssignOutput

 

Here, we need to concatenate both the elements from the input and assign it to the output. For this, click on the Expression icon at the top right as shown

Use the concat() function from the String functions and append Hello to the name from the inputVariable, as shown

 

This will create a function icon in the middle of the Assing editor, where you need to drag this to assign it to the returnMsg of the outputVariable and click OK

With this, the outputVariable is stuffed which is sent back to the calling WS(indicated the outgoing line)

Thats it, you are done with your first BPEL process

Deploy the project as per this link and test it in Enterprise Manager