Every module that you install in Geronimo, whether it is a service, application, resource, etc., can be configured via a deployment plan. These deployment plans are XML files based on XML Schemas containing the configuration details for a specific application module or component. The Java EE 5 specification defines standard deployment descriptors such as web.xml, application.xml, etc. In some cases, the deployment descriptor is all that is required to install a module into a Geronimo server. However, in many cases, server-specific configuration is required when modules are installed. This server-specific configuration is accomplished by using Geronimo deployment plans.
Geronimo deployment plans can be packaged along with the application or specified externally at deployment time. If provided during deployment, this plan will overwrite any other Geronimo specific deployment plan provided with the application.
To package the deployment plans in you application you have to follow some naming conventions and place the file in a specific directory within your packaged application. For example, in a web application you would include the geronimo-web.xml
under the /WEB-INF directory, same place where you are also providing the web.xml
descriptor, all within the WAR. For an enterprise application you would include the geronimo-application.xml
under the /META-INF directory, same place where you are also providing the application.xml
descriptor, all within the WAR.
The Java EE 5 specification also let's you use Annotations where you add resource references, dependencies, etc. directly in the code. Geronimo provides a Deployment plan wizard that automatically generates the necessary deployment plans based on the standard deployment descriptors and annotations.
This document is organized in the following sections:
XML Schemas - Java EE Deployment Plans
Module Type |
Geronimo Schema |
Preferred Java EE Schema |
---|---|---|
General (Tomcat or Jetty) Web Application (WAR) |
||
Tomcat-Only Web Application (WAR) |
||
Jetty-Only Web Application (WAR) |
||
EJB (JAR) |
||
J2EE Connector (RAR) |
||
Application Client (JAR) |
http://geronimo.apache.org/xml/ns/j2ee/application-client-2.0 |
|
Application (EAR) |
XML Schemas - Common Elements & Configuration
Module Type |
Geronimo Schema |
Description |
---|---|---|
Server Plans & Common Elements |
Used to deploy new services in Geronimo in a standalone plan, and also contains common elements used by many other plans. |
|
Geronimo Plugin Descriptor |
Metadata on a Geronimo plugin or a list of available Geronimo plugins. |
|
Security Mapping |
Common security elements used by other plans. |
|
Security Realms |
Abbreviated syntax for configuring security realm and login module GBeans. You can either manually configure multiple GBeans or declare a single GBean for the realm using this to configure all the login modules. |
|
Naming |
Common elements for references to other components (EJBs, database pools, JMS resources, J2EE Connectors, Web Services, etc.) |
|
Primary Key Generator |
Abbreviated syntax for configuring primary key generators for CMP entity beans. Avoids manually configuring and wiring up PK generator GBeans. |
|
CORBA CSS Configuration |
Abbreviated syntax for configuring security for clients accessing remote EJBs via CORBA. |
|
CORBA TSS Configuration |
Abbreviated syntax for configuring security for EJBs exposed via CORBA. |
|
config.xml |
The format of the |
|
Tomcat Web App Configuration |
If you use the generic ( |
|
Jetty Web App Configuration |
If you use the generic ( |
Configurations
The examples provided in this section are independent of any application. Most of these configurations can be generated and deployed through the Geronimo Administration Console as well.
Connection pools
For the most part, deployment plans for database connection pool will be very similar from each other. However, depending on the database the pool will be connecting to, you may need to specify some additional parameters.
Embedded Derdy DB
<?xml version="1.0" encoding="UTF-8"?> <connector xmlns="http://geronimo.apache.org/xml/ns/j2ee/connector-1.2"> <dep:environment xmlns:dep="http://geronimo.apache.org/xml/ns/deployment-1.2"> <dep:moduleId> <dep:groupId>console.dbpool</dep:groupId> <dep:artifactId>TimeReportPool</dep:artifactId> <dep:version>1.0</dep:version> <dep:type>rar</dep:type> </dep:moduleId> <dep:dependencies> <dep:dependency> <dep:groupId>org.apache.geronimo.configs</dep:groupId> <dep:artifactId>system-database</dep:artifactId> </dep:dependency> </dep:dependencies> </dep:environment> <resourceadapter> <outbound-resourceadapter> <connection-definition> <connectionfactory-interface>javax.sql.DataSource</connectionfactory-interface> <connectiondefinition-instance> <name>TimeReportPool</name> <config-property-setting name="Driver">org.apache.derby.jdbc.EmbeddedDriver</config-property-setting> <config-property-setting name="ConnectionURL">jdbc:derby:TimeReportDB</config-property-setting> <connectionmanager> <local-transaction/> <single-pool> <max-size>10</max-size> <min-size>0</min-size> <match-one/> </single-pool> </connectionmanager> </connectiondefinition-instance> </connection-definition> </outbound-resourceadapter> </resourceadapter> </connector>
Security
A Java EE application may consist of several components that can be deployed on to different containers such as WEB container, EJB container, WebServices container in a JEE5 server. This kind of deployment allows multi-tier applications that interact with one another to perform a given user task. Multi-tier JEE5 applications can be secured by properly selecting authenticating mechanisms and designing authorization levels or roles. The authentication and authorization aspects of the application components are declared in corresponding JEE5 deployment descriptors. The declared security roles or levels are mapped to real security roles or levels in the Geronimo deployment plans through Security realms. In Apache Geronimo, the security realms abstract away authentication and authorization aspects of the application components. Authentication and Authorization together enable access control for the various components of the application.
Depending on the selected authenticating system, a JAAS login module is selected and configured in a Security Realm. JAAS login modules connect to corresponding user/group repositories and perform authentication and retrieve authorization information. Geronimo provides login modules that connect to different types of user/group repositories. These are PropertiesFileLoginModule, LDAPLoginModule, SQLLoginModule and CertificatePropertiesFileLoginModule.
For example, Geronimo uses "geronimo-admin" security realm to authenticate users when they login to admin console. The deployment plan of the security realm is follows.
Deployment plan of the "geronimo-admin" security realm used by Geronimo admin console |
---|
<module xmlns="http://geronimo.apache.org/xml/ns/deployment-1.2"> |
The above security realm is deployed over two property files var/security/users.properties and var/security/groups.properties that contain user/group information using "org.apache.geronimo.security.realm.providers.PropertiesFileLoginModule". The admin console is a web application that uses the above security realm for user authentication.
Security realm deployment plan is an XML file that uses "http://geronimo.apache.org/xml/ns/deployment-1.2" Geronimo schema for ModuleId, dependency and security realm GBean configurations. The XML file uses "http://geronimo.apache.org/xml/ns/loginconfig-2.0" Geronimo schema for login module configuration.
The following table provides the summary of user/group repositories and corresponding login modules in Apache Geronimo
User/Group Repositories |
Login Modules |
---|---|
Property Files |
org.apache.geronimo.security.realm.providers.PropertiesFileLoginModule |
Database |
org.apache.geronimo.security.realm.providers.SQLLoginModule |
Ldap repository |
org.apache.geronimo.security.realm.providers.LDAPLoginModule |
Certificate Repository |
org.apache.geronimo.security.realm.providers.CertificatePropertiesFileLoginModule |
Any other |
User has to supply the custom JAAS module. Admin console can be used to create and deploy a security |
Depending on the type of the login module, the options for configuration changes. Admin console enables users to create and deploy security realms using all the above mentioned login modules.
Once a security realm is deployed, it's available for any JEE5 application deployed in Apache Geronimo to map declared roles to actual users/groups through a Geronimo deployment plan.
Resources
Applications
Depending on the type of application you are deploying you will need a different type of deployment plan. The following table illustrates the standard JEE deployment descriptors as well as those specific to Apache Geronimo.
File |
Standard JEE deployment descriptors |
Apache Geronimo specific Deployment plan |
---|---|---|
Web Application Archive (WAR) |
web.xml |
geronimo-web.xml |
Enterprise Web application archive (EAR) |
application.xml |
geronimo-application.xml |
J2EE Connector resources archive (RAR) |
ra.xml |
geronimo-ra.xml |
J2EE client application archive (JAR) |
client.xml |
geronimo-application-client.xml |
JAR containing EJBs |
ejb-jar.xml |
openejb-jar.xml |
- geronimo-web.xml
- geronimo-application.xml
- geronimo-ra.xml
- geronimo-application-client.xml
- openejb-jar.xml