J2EE - RMI from within a Servlet
Gilles Dubochet
I have an application that serves as a data source and that shares some
objects via RMI.
I hava an servlet that should use the remote objects from the data source.
String rmiAddress = "rmi://localhost:7857/InfrastructureDataSource";
dataSource = (InfrastructureDataSource)Naming.lookup(rmiAddress);
WHen I try to lookup the RMI object in the RMI server, I get a security
exception
javax.servlet.ServletException: error unmarshalling return; nested
exception is:
java.lang.ClassNotFoundException:
dataManager.InfrastructureDataSourceImpl_Stub (no security manager: RMI
class loader disabled)
at InfrastructuresWebView.init(InfrastructuresWebView.java:30)
caused by
java.rmi.UnmarshalException: error unmarshalling return; nested
exception is:
java.lang.ClassNotFoundException:
dataManager.InfrastructureDataSourceImpl_Stub (no security manager: RMI
class loader disabled)
at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)
at java.rmi.Naming.lookup(Naming.java:84)
at InfrastructuresWebView.init(InfrastructuresWebView.java:28)
(Line 28 is where the lookup takes place, line 30 is a throw of the
exception)
I then tried to add a security manager
if (System.getSecurityManager() == null ) {
System.setSecurityManager(new RMISecurityManager());
}
but I get the following exception
javax.servlet.ServletException: error unmarshalling return; nested
exception is:
java.lang.ClassNotFoundException:
dataManager.InfrastructureDataSourceImpl_Stub
at InfrastructuresWebView.init(InfrastructuresWebView.java:30)
...
caused by
java.rmi.UnmarshalException: error unmarshalling return; nested
exception is:
java.lang.ClassNotFoundException:
dataManager.InfrastructureDataSourceImpl_Stub
at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)
at java.rmi.Naming.lookup(Naming.java:84)
at InfrastructuresWebView.init(InfrastructuresWebView.java:28)
...
I tried to do exactly the same thing (same code) within a standard java
application (that is not a servlet) and it works beautifully.
If someone could tell me where the trick is, i'd be very thankfull. I
expect it to be something with the security manager, but I don't know
what and how.
Best regards, Gilles Dubochet
iksrazal
> Hello,
>
> I have an application that serves as a data source and that shares some
> objects via RMI.
>
> I hava an servlet that should use the remote objects from the data source.
>
> String rmiAddress = "rmi://localhost:7857/InfrastructureDataSource";
> dataSource = (InfrastructureDataSource)Naming.lookup(rmiAddress);
A DataSource simply is a DB pool which you can get connections from.
You can recieve that from any modern servlet container. There are
cases where you might need to get a DS outside of a container, but a
servlet is not one of them. Perhaps I'm missing something. Typically I
use InitialContext/JNDI to get DataSources.
> WHen I try to lookup the RMI object in the RMI server, I get a security
> exception
>
<snip>
Here's how I use rmi in a servlet to get a byte array (file).
Servlet:
//FileServer is the name of the remote object
String connectString = "//" + this.serverName + "/FileServer";
//FileInterface is stub that needs to be on both sides
FileInterface fi = (FileInterface) Naming.lookup(connectString);
byte[] filedata = fi.downloadFile(filename);
Rmi object:
public class FileServer
{
public static void main(String argv[])
{
if (System.getSecurityManager() == null)
{
System.setSecurityManager(new RMISecurityManager());
}
try
{
FileInterface fi = new FileImpl("FileServer");
Naming.rebind("//127.0.0.1/FileServer", fi);
}
catch(Exception e)
{
System.out.println("FileServer: "+e.getMessage());
e.printStackTrace();
}
}
}
You need a policy file, this one allows everything:
grant {
permission java.security.AllPermission "", "";
};
Start your rmi object like...
java -Djava.security.policy=policy.txt FileServer
And thats al there is to it.
iksrazal
Enrique
> I tried to do exactly the same thing (same code) within a standard java
> application (that is not a servlet) and it works beautifully.
>
> If someone could tell me where the trick is, i'd be very thankfull. I
> expect it to be something with the security manager, but I don't know
> what and how.
I'm just guessing, but maybe the security profile doesn't allow the
servlet access to the requested classes? Dunno how, it's been a long
while since I've RMIed. I'm eager to see responses from others.
epp
Rasputin
> Hello,
>
> I have an application that serves as a data source and that shares some
> objects via RMI.
>
> I hava an servlet that should use the remote objects from the data source.
>
> String rmiAddress = "rmi://localhost:7857/InfrastructureDataSource";
> dataSource = (InfrastructureDataSource)Naming.lookup(rmiAddress);
>
> WHen I try to lookup the RMI object in the RMI server, I get a security
> exception
>
> javax.servlet.ServletException: error unmarshalling return; nested
> exception is:
> java.lang.ClassNotFoundException:
> dataManager.InfrastructureDataSourceImpl_Stub (no security manager: RMI
> class loader disabled)
> at InfrastructuresWebView.init(InfrastructuresWebView.java:30)
This is because the servlet needs to get the stub for the remote object,
and the default security manager won't let you do dynamic classloading
(as you guessed).
> I then tried to add a security manager
>
> if (System.getSecurityManager() == null ) {
> System.setSecurityManager(new RMISecurityManager());
> }
>
> but I get the following exception
>
> javax.servlet.ServletException: error unmarshalling return; nested
> exception is:
> java.lang.ClassNotFoundException:
> dataManager.InfrastructureDataSourceImpl_Stub
> at InfrastructuresWebView.init(InfrastructuresWebView.java:30)
> ...
This error looks like the security manager is no longer a problem
(which is a bit odd - I wouldn't expect a servlet to be able to set a
security manager for the servlet engine) - that makes me think it's a
problem with the remote object itself...?
What is the RMI codebase set to in the VM that's exporting the remote
object?
It could be that the command line example you ran has the stub classfiles
for the remote object in its classpath, so it doesn't need to
dynamically load them - the servlet engine maybe sets its own classpath?
--
Rasputin :: Jack of All Trades - Master of Nuns
Gilles Dubochet
I've ended up solving my problems. A plural 'problems' because there
were many things that wouldn't let my servlet work correctly.
Actually, all the posted replies contained part of the answer.
For the posterity, I'll try to summarise all of it.
First, by default, Tomcat (but it seems to be the case with other
servlet servers too) has a very restrictive security policy for it's
servlets. This is understandable since Tomcat is suposed to run on a
public server where many servlets from various origins coexist.
To see what it's policy file looks like, go to
$CATALINA_HOME/conf/catalina.policy where everyting is defined. You are
of course free to change this policy file, but tomcat will only take it
into account if you specify the '-security' switch when laucning tomcat.
Otherwise, you can specify a policy file by adding the
-Djava.security.policy="the_file" switch.
Second, tomcat defines it's own classpath. Don't count on classes being
visible from within a servlet merely because they're visible from within
a local java application at the same place. I ended up placing all code
that I needed in the same directory than my servlet classes.
And tomcat's doc is very well done (should have been there earlier) :
http://jakarta.apache.org/tomcat/tomcat-4.0-doc/index.html
Best regards, Gilles Dubochet.
> I have an application that serves as a data source and that shares some
> objects via RMI.
>
> I hava an servlet that should use the remote objects from the data source.
>
> WHen I try to lookup the RMI object in the RMI server, I get a security
> exception
>