1 Oracle GlassFish Server 3.1.2 and 3.1.2.2 Release Notes

To Configure Specific Ports for a JMS Host

When you create a JMS Host, GlassFish server automatically selects ports for the JMS provider (called the portmapper port in Message Queue terminology), the Message Queue TCP port and the Message Queue admin port.

To provide specific values for these ports, use the --mqport and --property options when creating the JMS host:

asadmin> create-jms-host --mqhost hostName --mqport portNumber \
--mquser adminUser --mqpassword adminPassword --target glassfishTarget \
--property imq\\.jms\\.tcp\\.port=tcpPort:imq\\.admin\\.tcp\\.port=adminPort \
jms-host-name

--mqport portNumber

This option specifies the JMS provider port number.

--property imq\\.jms\\.tcp\\.port=tcpPort:imq\\.admin\\.tcp\\.port=adminPort

The imq.jms.tcp.port and imq.admin.tcp.port properties specify the TCP port and the admin port numbers. The double backslashes (\\) are used in the --properties option to escape the dots in the property names.

To Configure Specific GMS Ports for a Cluster

When you create a cluster, GlassFish server automatically selects a port for GMS multicast that does not conflict with the GMS multicast port of any other cluster in the domain. Additionally, when you start a cluster, the GMS automatically selects an available port in a specific range for its TCP listener.

If two or more domains are running on the same host, configure the clusters in the domains to ensure that no GMS port conflicts can arise among the clusters. To avoid possible port conflicts, use the --multicast and --properties options when creating the cluster:

asadmin> create-cluster --multicastport multicast-port \
--properties GMS_TCPSTARTPORT=start-port:GMS_TCPENDPORT=end-port \
cluster-name

--multicastport multicast-port

This option specifies the port number for the GMS to use for UDP multicast.

--properties GMS_TCPSTARTPORT=start-port:GMS_TCPENDPORT=end-port

The GMS_TCPSTARTPORT and GMS_TCPENDPORT properties specify the range of port numbers the GMS is to use when selecting an available port for its TCP listener.

Use the Correct Java Version

Ensure that the version of Java used on all local and remote GlassFish Server hosts meets the requirements specified in Supported Platforms, JDK Versions, Browsers, mod_jk, and JDBC Drivers and Databases.

Use the JDK Binaries

The following binary files that are used with GlassFish Server must come from the JDK software, not the Java Runtime Environment (JRE) software:

• java

• keytool

To meet this requirement, ensure that the bin directory for the JDK software precedes the bin directory for the JRE software in your path.

Set the JAVA_HOME Environment Variable

Before performing any GlassFish Server installation or configuration procedures, set the JAVA_HOME environment variable on the GlassFish Server host machine to point to the correct Java version. Also be sure to add the JAVA_HOME/bin directory to the PATH variable for your environment. The JAVA_HOME variable must be set on all local and remote GlassFish Server hosts.

Set Other Environment Variables As Necessary

All remote asadmin subcommands require the correct version of Java to be available on the affected remote machine. For example, when creating a cluster or server instance on a remote machine, the remote machine uses its local default Java installation, not the Java installation that is on the DAS. Errors will therefore occur if the remote machine uses the wrong Java version.

Depending on the remote subcommand, the errors may not occur when the subcommand is executed, but may occur later, when interacting with a configuration or resource created or modified by the subcommand. For example, when creating a clustered server instance on a remote machine, the error may only first appear when you attempt to deploy an application on that server instance.

This issue is more likely to be encountered when GlassFish Server is installed on the remote server by means of a ZIP file package rather than a self-extracting installer run in GUI mode. This is because the GUI installer gives you the option to specifically choose your Java version, whereas you do not have that option when simply unzipping a ZIP file.

Depending on what shell is invoked via SSH on the remote host, the JAVA_HOME and PATH environment variables may need to be explicitly set in .bashrc, .cshrc, or some other shell configuration file. This configuration file may differ from the one that is used when you log in to the machine, such as .profile.

Alternatively, you can specifically set the Java path with the AS_JAVA property in the in the as-install/config/asenv.conf file.

Description

The asadmin restart-domain and restart-instance subcommands intermittently hang on Solaris 11 systems. This is cause by native Security SPI code in the JDK. This issue does not occur on operating systems other than Solaris 11.

Workaround

None. This issue does not cause any problems other than the occasional long wait for the subcommand to complete.

For the complete report about this issue, see GLASSFISH-15537.

Description

If you enabled secure admin for a GlassFish Server 3.1 domain, the domain remains enabled for secure admin when you install GlassFish Server 3.1.2.

However, GlassFish Server 3.1.2 uses a stronger technique to make sure that servers in one domain do not accidentally communicate with servers in another domain.

Workaround

Your updated GlassFish Server 3.1.2 domain does not use the improved domain isolation technique until you run the following command once:

asadmin> enable-secure-admin

You do not need to specify any other arguments with the command, even if you did so when you first enabled secure admin on your GlassFish Server 3.1 domain. GlassFish Server 3.1.2 automatically begins using the better algorithm from that point on.

For the complete report about this issue, see GLASSFISH-16437.

Description

The tcp-no-delay attribute for HTTP type network listeners is not working properly. Setting this attribute as follows has no effect:

asadmin> set server-config.network-config.protocols.protocol.http-listener-1.http.tcp-no-delay=true

Workaround

Set the tcpNoDelay property of the HTTP service instead, as follows:

asadmin> set server-config.http-service.property.tcpNoDelay=true

This enables tcpNoDelay for all network listeners.

For the complete report about this issue, see GLASSFISH-16902.

Description

When the GlassFish Server installer is invoked on the AIX 6.1 platform with the 64-bit version of JDK 6, the following warning is displayed on the screen:

Warning: Could not detect OS Architecture, falling back to os.arch [Architecture=ppc64]

Workaround

None. This warning is harmless and can be ignored.

Description

Installation of the Solaris x86 SDK bundle fails in the ko and zh_TW locales.

Workaround

GlassFish Server users can install the ZIP distribution or temporarily switch to an unaffected locale. SDK users can install using the Update Center or temporarily switch to an unaffected locale.

Description

Installation of the Update Center sometimes times out and fails.

Workaround

If Update Center installation fails in the installer or when running pkg or updatetool from the command line, enter the following from the command line:

> set PKG_CLIENT_CONNECT_TIMEOUT=300> set PKG_CLIENT_READ_TIMEOUT=300> glassfish3\bin\updatetool

Description

By default, when you enable secure admin, the GlassFish Server DAS does not use SSL client certificate authentication to verify the identify of administration clients (such as the asadmin utility, browsers, or IDEs). Instead, the administrative user typically provides a user name and password which authorize performance of administrative operations. To enable admin request SSL client certificate support in the DAS, set the following system property to true:

org.glassfish.admin.DASCheckAdminCert

This does not disable user name and password authentication. It simply adds client SSL certificate-based authentication as another alternative the DAS can use.

If you perform the following steps, then GlassFish Server might report communication errors related to SSL:

1. Enable secure admin for the domain.

2. Enable admin request SSL client certificate support as just described.

3. Use an administration client that is not configured to send an SSL client certificate for authentication.

4. Upload a moderate or large file as part of deployment.

This can happen if the upload is in progress when the GlassFish Server DAS requests certificate information from the administration client. This happens only if the client was not configured to use an SSL certificate.

Workaround

To enable admin request SSL client certificate support and deploy a large file, first upload the file manually to the system where the DAS is running or store the file in a shared file system that both your system and the DAS system can access. Then do not specify --upload=true when you deploy the application. The DAS finds the file without uploading it, so the certificate negotiation between the DAS and the administration client can complete normally.

Description

The JDK bundle is not installed if the JAVA_HOME or PATH environment variable is not set properly.

Workaround

Do one of the following:

• Add the actual JDK installation location to the PATH.

• Add the directory for a stand-alone JDK installation to the PATH.

• Set JAVA_HOME to the actual JDK installation location.

• Run the /usr/sbin/pkg developer/java/jdk command from the root (/) directory. If this command reports that the developer/java/jdk package is not installed, install that package before installing GlassFish Server.

Description

During High Availability testing on AIX, the Domain Admin Server (DAS) freezes and requires a complete restart.

Workaround

An IBM patch can be downloaded from https://www-304.ibm.com/support/docview.wss?uid=isg1fixinfo117990.

Description

If you change the system locale to something incompatible with the current encoding of the domain.xml file, GlassFish Server fails to start. This can happen during an upgrade.

Workaround

Change the system locale back to the previous setting.

If you are upgrading, convert the domain.xml file to native encoding before upgrading. On Unix systems, follow these steps:

1. Back up the domain.xml file.

2. Run the following commands:

   native2ascii domain.xml domain.xml.ascii
   native2ascii -reverse -encoding UTF-8 domain.xml.ascii domain.xml
   

3. Run the asupgrade command under c:\glassfish311\glassfish\bin\.

4. Run the following commands:

   native2ascii -encoding UTF-8 domain.xml domain.xml.ascii
   native2ascii -reverse domain.xml.ascii domain.xml
   

Description

Code that performs these steps fails with ORB and EJB container exceptions at the restart step:

1. Start embedded GlassFish Server.

2. Deploy a remote EJB application.

3. Undeploy the application.

4. Stop the server.

5. Restart the server.

6. Redeploy the application.

Workaround

Perform these steps:

1. Start embedded GlassFish Server.

2. Deploy a remote EJB application.

3. Undeploy the application.

4. Stop the server using the dispose method.

5. Restart the host virtual machine (JVM).

6. Recreate the embedded GlassFish Server instance.

7. Redeploy the application.

Description

Code that performs these steps fails at the redeploy step:

1. Start embedded GlassFish Server.

2. Deploy an application that uses the EJB Timer Service.

3. Undeploy the application.

4. Stop the server.

5. Restart the server.

6. Redeploy the application.

Workaround

Perform these steps:

1. Start embedded GlassFish Server.

2. Deploy an application that uses the EJB Timer Service.

3. Undeploy the application.

4. Stop the server using the dispose method.

5. Restart the host virtual machine (JVM).

6. Recreate the embedded GlassFish Server instance.

7. Redeploy the application.

Description

After you stop embedded GlassFish Server, some daemon threads continue to run. Some of these threads don't exit until the virtual machine (JVM) exits. Restarting embedded GlassFish Server repeatedly in the same JVM can cause Out of Memory errors.

Workaround

Restart the JVM.

Description

There is an issue with web services communication between GlassFish Server Metro and Oracle WebLogic Server when using the Oracle Web Services Manager (OWSM) wss11_saml_token_with_message_protection_service_policy policy.

Workaround

The fix for this problem is in Oracle WebLogic Server 11.1.1.4.0. See the Oracle WebLogic product page for more information.

Description

When the setSoLinger method or the setReuseAddess method is invoked, performance is degraded and the following exception is thrown:

[#|2009-01-26T00:33:56.325-0800|WARNING|sun-appserver9.1|
javax.enterprise.system.container.web|_ThreadID=17;
_ThreadName=SelectorReaderThread-8084;
_RequestID=11ae0030-c392-4217-8408-cfa7efe0a879;|setSoLinger
exception
java.net.SocketException: Invalid argument

This issue is caused by an issue with the JDK software. This issue is resolved in JDK version 7.

Workaround

None.

For the complete report about this issue, see GLASSFISH-7109.

Description

During an HTTP longevity test, the following exception is thrown 42 hours into the run:

[#|2009-04-05T17:41:26.537-0700|SEVERE|glassfish|javax.enterprise.system.core|
_ThreadID=15;_ThreadName=Thread-1;|doSelect
exception
java.io.IOException: Invalid argument

The instance and application are still accessible during the run.

This issue is caused by an issue with the JDK software. This issue is resolved in JDK version 7.

Workaround

None.

For the complete report about this issue, see GLASSFISH-7529.

Description

If a domain's /applications directory restricts access, or if you use directory deployment from a restricted directory, the server cannot read the files in the expanded directory. A NullProcessException error occurs during deployment.

Workaround

Change the file access settings for such directories to grant the server permission to read the directory contents.

For the complete report about this issue, see GLASSFISH-6545.

Description

Some features will not work well on Windows 7 and Vista with User Account Control (UAC) enabled. One example is the Administration Console, which cannot be launched.

Workaround

Disable UAC and reboot.

For the complete report about this issue, see GLASSFISH-10755.

Description

Option -l to relocate log files is ignored when used with options -a and -s and the log files are created in the default location.

Workaround

None.

For the complete report about this issue, see GLASSFISH-10693.

Description

The Start menu group for GlassFish Server is not displayed after installation is first completed. If you log out and then log back in, the menu group is displayed but it is empty.

Workaround

None.

For the complete report about this issue, see GLASSFISH-5087.

Description

The standalone Update Tool started with the updatetool command fails with a segmentation fault on Solaris when installing add-on components.

Workaround

Ensure that your system conforms to the standalone Update Tool patch requirements as defined in the Update Center Release Notes.

Update Tool functionality in the Administration Console uses a different Java-based Update Center API and is not affected by this issue.

For the complete report about this issue, see GLASSFISH-11222.

Description

When using Java Web Start to launch an application client, any managed beans in the application client will not be recognized.

Workaround

Launch the application client using the appclient script. Managed beans in the application client will be supported normally.

For the complete report about this issue, see GLASSFISH-11257.

Description

When you invoke the appclient script on Mac OS X systems with Java from Apple installed, the following stack trace is seen twice (only the first few lines are shown here):

Intentionally suppressing recursive invocation exception!
java.lang.IllegalStateException: recursive invocation
    at java.lang.ClassLoader.initSystemClassLoader(ClassLoader.java:1394)
    at java.lang.ClassLoader.getSystemClassLoader(ClassLoader.java:1377)
    at sun.security.jca.ProviderConfig$1.run(ProviderConfig.java:64)
...

Workaround

None needed.

Despite the warning messages, the client will be launched successfully and run normally. These errors are from an issue in the Apple Java implementation.

For the complete report about this issue, see GLASSFISH-8644.

Description

Installation log files cannot be opened by clicking the links on the Summary page that displays at the end of the installation process in the graphical installer.

Workaround

Access the files manually. The names of the installation log and summary files are timestamp-install.log and timestamp-install-summary.html. On Linux and Mac systems these files are generated under the $TMP directory.

For the complete report about this issue, see GLASSFISH-6621.

Description

If you reinstall GlassFish Server (with Update Tool) in the same installation directory with the same defaults and invoke Update Tool using the updatetool command, you receive a message saying that Update Tool is not installed and are asked if you want to install it. This occurs on Windows systems only.

Workaround

Following uninstallation, manually remove the remaining .org* directory before reinstalling.

For more information this issue, see GLASSFISH-8233.

Description

Debugging JPA is difficult because of limited messages from the server.

Workaround

Add the property org.eclipse.persistence.session.level=INFO to the logging.properties file. You can then use the Administration Console to control EclipseLink loggers.

For the complete report about this issue, see GLASSFISH-11274.

Description

In previous GlassFish Server versions, the JVM options provided a classpath-prefix and classpath-suffix attributes that made it possible to add JAR files or directories either in front of, or after the application serve's system classpath. These options are no longer present in GlassFish Server 3.1.2.

Starting with GlassFish Server v3 Preview, after switching to OSGi, the classpath-prefix and classpath-suffix options have been labeled "do not use."

Workaround

The classpath-prefix was typically used to substitute another package for one of the GlassFish Server packages, for example if a newer one was available. This same result can be achieved by using the Java Endorsed Standards Override Mechanism or on a per-application basis with the --libraries option for the deploy subcommand. These are documented in the Oracle GlassFish Server Application Development Guide. The Java Optional Package Mechanism, which is documented in this guide, does what classpath-suffix used to do.

Description

Windows Start Menu shows a single GlassFish Server even when multiple GlassFish Server installations are installed.

Workaround

None. When running GlassFish Server from the Start menu, the most recent installation starts. Similarly, when uninstalling from the Start menu, the last installed version is uninstalled.

Description

There is a known security vulnerability with Grizzly when running Java Runtime Environment 6 versions prior to Update 24. See http://java.net/jira/browse/GRIZZLY-970 for details.

Workaround

Use Java Runtime Environment 6 update 24 or greater to avoid the vulnerability. Oracle has released a security alert for this issue. For instructions on how to resolve it, see http://blogs.oracle.com/security/2011/02/security_alert_for_cve-2010-44.html.

For the complete report about this issue, see GLASSFISH-15909.

Description

There are a number of configuration functions for which a server restart is required, and a number for which a restart is not required. However, the underlying component modules for the functions listed below are not correctly prompting the user about the restart requirements. These incorrect or missing restart prompts occur regardless of whether the given function is performed from the command line or through the Administration Console.

This is an umbrella issue for the sub-issues listed below. The URL for the JIRA query that you can use to display all these sub-issues is http://java.net/jira/secure/IssueNavigator.jspa?mode=hide&requestId=10358.

• GLASSFISH-16100: Restart required for java mail session debug change, exception in server.log

• GLASSFISH-16013: Restart Required: changing http port does not trigger restart required message for a standalone instance

• GLASSFISH-16010: Restart Required: After changing JMS Type server instance is not reported as requiring restart

• GLASSFISH-15758: Restart Required status for remote instances does not get reset even when instance is restarted.

• GLASSFISH-15638: Show "restart required" status when IIOP service configuration / port is changed

• GLASSFISH-15635: [UB]Show "restart required" status when a new resource is created or deleted

• GLASSFISH-15629: [UB]Show "restart required" status when JDBC connection pool properties are changed

• GLASSFISH-15619: [UB]show "restart required" status when connector connection pool properties are changed

• GLASSFISH-15517: "Restart Required" when no changes are made to JVM options

• GLASSFISH-15507: [UB]DOC: Server restart is required after secure-admin is enabled or disabled

• GLASSFISH-14515 (http://java.net/jira/browse/GLASSFISH-14515): [UB]Restart not required for changes in resources

• GLASSFISH-3850: Changing default realm does not indicate that a server restart required

Workaround

Restart the DAS after performing any of the functions listed above.

For the complete report about this issue, see GLASSFISH-16040.

Description

When shutting down a server that was started with the java -jar command, a large number of exceptions may sometimes be displayed in the console. Shutting down a server that was started with the --verbose option also causes this error.

Workaround

These are harmless exceptions and can be ignored. The errors are only displayed in the console when the server that is being shut down was started in either --verbose mode or by using the java -jar command. Also note that the --upgrade option implies --verbose, so shutting down a server that was started with the --upgrade option may also produce this error.

For the complete report about this issue, see GLASSFISH-15441.

Description

The asadmin update-admin-server-coordinates subcommand fails if secure-admin is enabled.

Workaround

Either disable secure-admin, or use the --adminport option with the update-admin-server-coordinates subcommand to explicitly set the port you want to use.

For more information, see enable-secure-admin(1).

Description

The example in the man page for the list-supported-cipher-suites subcommand lists the Kerberos cipher (*_KRB5_*) suites, but the Kerberos suites are not supported in GlassFish Server 3.1.2.

Workaround

None. This is a documentation error. Kerberos cipher suites are not supported in GlassFish Server 3.1.2.

Description

The subcommand description in create-jacc-provider man page references JSR196 and JAAS but the subcommand has nothing to do with those specifications. In addition, there is a typographical error in the subcommand example. Finally, the subcommand description for the delete-jacc-provider should be reworded.

Workaround

These man page errors will be corrected in the next GlassFish Server release. In the meantime, note the following:

• The subcommand description in create-jacc-provider man page should read as follows:

  The create-jacc-provider subcommand creates a JSR-115-compliant Java Authorization Contract for Containers (JACC) provider that can be used for the authorization of applications running in GlassFish Server. The JACC provider is created as a jacc-provider element within the security-service element in the domain's domain.xml file.

  The default GlassFish Server installation includes two JACC providers, named default and simple. Any JACC providers created with the create-jacc-provider subcommand are in addition to these two default providers. The default GlassFish Server JACC providers implement a simple, file-based authorization engine that complies with the JACC specification. The create-jacc-provider subcommand makes it possible to specify additional third-party JACC providers.

  Any number of jacc-provider elements can be created under the security-service but the GlassFish Server runtime will use only one of them at any given time. The jacc attribute on the security-service points to the name of the provider that is currently in use by GlassFish Server. Any change to the jacc attribute (to make it point to a different jacc-provider) would require a server restart. This command is supported in remote mode only.

• The create-jacc-provider subcommand sample should read:

  asadmin> create-jacc-provider
  --policyproviderclass com.sun.enterprise.security.provider.PolicyWrapper
  --policyconfigfactoryclass com.sun.enterprise.security.provider.PolicyConfigurationFactoryImpl
  

• The subcommand description in delete-jacc-provider man page should read as follows:

  The JACC provider used by GlassFish Server for authorization is specified by the jacc attribute in the security-service configuration element. If you are deleting the provider pointed to by the jacc attribute, ensure that the attribute value is also changed to the name of some other jacc-provider that exists under the security-service. Any change to the jacc attribute for a running service requires a server restart.

Description

It is not possible to set the lazy-init value for an IIOP listener from either the GlassFish Server Administration Console or the command line. Even the asadmin set command cannot be used to change the value.

Workaround

Currently, the only workaround for this issue is to edit the domain.xml file directly. For example, the domain.xml file could contain a property similar to the following:

<iiop-listener port="3700" id="orb-listener-1" address="0.0.0.0"
lazy-init="true"></iiop-listener>

In this example, the lazy-init property is enabled, and it can be disabled by changing the lazy-init value to false.

Note that lazy-init is disabled by default, so the domain.xml file could contain an iiop-listener element similar to the following:

<iiop-listener port="3700" id="orb-listener-1" address="0.0.0.0"></iiop-listener>

In this case, to enable lazy-init, you would add the following property to the iiop-listener element:

lazy-init="true"

For the complete report about this issue, see GLASSFISH-15975.

Description

When using GlassFish Server 3.1.2 on a system that uses IPv6 addressing, and there is a need to make the JMX service listen on a specific IPv6 address, and the address is specified as a literal IPv6 address, the RMIConnectorStarter class constructs an invalid URL in the start method.

For example, if your domain.xml contains the following:

<jmx-connector port="8686" address="e80::216:3eff:fe3e:4c35" security-enabled="false"
auth-realm-name="admin-realm" name="system"></jmx-connector>

The server will not open the JMX RMI port successfully and exceptions will be reported in the log file.

Workaround

The recommended workaround for this problem is to not use a literal address. Instead, define a name for the address, either in DNS or the hosts file, and then use that name as the value for the address for the JMX listener.

An alternate workaround is to enclose the address value in square braces. For example, use:

<jmx-connector port="8686" address="[e80::216:3eff:fe3e:4c35]" security-enabled="false"
auth-realm-name="admin-realm" name="system"></jmx-connector>

For the complete report about this issue, see GLASSFISH-15937.

Description

During the final GlassFish Server 3.1.2 development phase, fixes were made to a number of man pages after the man pages had already been localized. For users of non-EN locales, these corrections will not appear in the man pages, but are correctly displayed in the Oracle GlassFish Server Reference Manual.

This is an umbrella issue that includes the following man page review issues:

• GLASSFISH-15875 man-page-review: list-admin-objects, list-connector-resources, list-jndi-resources

• GLASSFISH-15958 man page: webtier CLIs

• GLASSFISH-15878 man-page-review: create-jdbc-connection-pool

• GLASSFISH-15877 man-page-review: remove the section "Application Scoped Resources" from multiple resource man-pages

• GLASSFISH-15879 man-page-review: note about resource-ref in multiple resource related commands

• GLASSFISH-15962 Man page for update-node-config is wrong about SSH nodes

• GLASSFISH-15876 man-page-review: list-connector-resources, list-jndi-resources

• GLASSFISH-15873 man-page-review: delete-resource-adapter-config

• GLASSFISH-15872 man-page: flush-connection-pool, ping-connection-pool

• GLASSFISH-15874 man-page-review: delete-connector-resource, delete-jdbc-resource, delete-jndi-resource

• GLASSFISH-15566 change-master-password --help has wrong content

• GLASSFISH-15485 Error in man pages for restart-local-instance, start-local-instance, stop-local-instance

• GLASSFISH-15867 documentation of create-system-properties has inconsistencies

• GLASSFISH-15919 man-page-review: jms CLIs

• GLASSFISH-3198 Synopsis for asadmin help create-custom-resource wrong

• GLASSFISH-15564 create-http-health-checker man page error

• GLASSFISH-15956 man page: remove --upgrade option from start-local-instance

• GLASSFISH-15947 Remove --upgrade from start-local-instance man page

Workaround

The correct man pages are displayed in GlassFish Server distributions for the EN locale, and will be available for all locales in GlassFish Server 3.2. In the meantime, users of non-EN 3.1.2 locales should refer to the Oracle GlassFish Server Reference Manual for the latest subcommand usage instructions.

For the complete report about this issue, see GLASSFISH-15929.

Description

It is necessary to grant additional permissions to CDI-enabled Java EE applications that are deployed in a GlassFish Server 3.1.2 domain or cluster for which security manager is enabled. These additional permissions are not required when security manager is disabled.

Workaround

To deploy CDI-enabled Java EE applications in a GlassFish Server 3.1.2 domain or cluster for which security manager is enabled, add the following permissions to the applications:

grant codeBase "file:${com.sun.aas.instanceRoot}/applications/[ApplicationName]" {
 permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
};

For example, for a CDI application named foo.war, add the following permissions to the server.policy file, restart the domain or cluster, and then deploy and use the application.

grant codeBase "file:${com.sun.aas.instanceRoot}/applications/foo" {
 permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
}; 

See "Changing Permissions for an Application" in Oracle GlassFish Server Application Development Guide for instructions on modifying application permissions. See "Enabling and Disabling the Security Manager" in Oracle GlassFish Server Application Development Guide for instructions on enabling and disabling security manager. For the complete report about this issue, see GLASSFISH-15456.

Description

Listing JMS physical destinations causes the DAS to hang if the MQ Broker for the instance is not started. This issue occurs in both the Administration Console and when using the asadmin list-jmsdest subcommand.

Workaround

All JMS destination subcommands, including list-jmsdest, create-jmsdest, delete-jmsdest, and flush-jmsdest requires the MQ broker for the instance to be running. For more information, see the Oracle GlassFish Server Message Queue Release Notes.

Description

Creating a JMSRA resource adapter configuration and setting the thread pool to http-thread-pool generates an exception in the server.log.

Workaround

GlassFish Server 3.1.2 provides Grizzly-based and ORB-based thread pool implementations. By default, the create-resource-adapter-config subcommand takes a thread-pool ID parameter that is based on an ORB thread pool. When a thread-pool is initialized, the ORB thread pool manager verifies that the thread-pool is not already being used by the Grizzly thread pool manager. The thread-pool is initialized only if Grizzly is not already using the configuration.

For more information, see "Administering the Object Request Broker (ORB)" in Oracle GlassFish Server Administration Guide. For the complete report about this issue, see GLASSFISH-15571.

Description

When running the GlassFish Server sample files, the output generated by the ant all command displays deployment URLs even for applications that do not have a Web client. For example, the criteriaQuery and hello-jaxws2.2 sample applications do not have a Web client, but ant all still generates deploy-url messages for them, similar to the following:

Application deployed at htt://localhost:8080/criteriaQuery
Application deployed at htt://localhost:8080/hello-jaxws2.2

Workaround

This is a simple message string error, and does not affect the functionality of the samples. Ignore this message for applications that do not have a Web client and corresponding URL.

For the complete report about this issue, see GLASSFISH-12264.

Description

The man page for the create-transport man page states the following for the --maxconnectionscount option:

The maximum number of connections for the network listener that references this transport. A value of -1 specifies no limit. The default value is 4096.

However, because of a GlassFish Server bug, setting the --maxconnectionscount value to -1 disables keep-alive for the connection.

Workaround

Use the following values for --maxconnectionscount:

-1

Currently does not correctly set the --maxconnectionscount to unlimited. Instead, specify some big number, up to Integer.MAX_VALUE.

1

Process one keep-alive request, and then close the connection after processing the second request on the same connection.

0

Disable keep-alive for the connection

For more information, see "Timeout" in Oracle GlassFish Server Performance Tuning Guide. For the complete report about this issue, see GLASSFISH-16025.

Description

When running the GlassFish Server Administration Console in some versions of Internet Explorer and Firefox, the node tree on the left side of the Administration Console is not always updated correctly when new elements are added to the server configuration. For example, the node tree may not update correctly after adding a new JDBC Pool, resource, or virtual server. This issue is not consistently reproducible and is very intermittent.

Workaround

Reload the Administration Console by pressing the Home button or the browser's reload button to update the values in the node tree.

For the complete report about this issue, see GLASSFISH-15997.

Description

When using the DataDirect driver with Sybase, inserting an entity that uses GenerationType.IDENTITY will fail. The problem is that the DataDirect driver creates a stored procedure for every parameterized prepared statement.

Workaround

Set the PrepareMethod=direct property on the corresponding datasource to change the default DataDirect behavior for handling prepared statements.

For the complete report about this issue, see GLASSFISH-15763.

Description

The Administration Console sometimes simply displays a blank screen even though the status bar in the browser window indicates that the page loading is complete. This can happen if you have been working in the Administration Console and then restart the server from the command line. This can also happen after upgrading or reinstalling GlassFish Server.

Workaround

This issue can usually be resolved by doing a Shift+Reload in your browser window. In some cases, particularly when the error occurs after a GlassFish Server upgrade or reinstallation, it may be necessary to clear your browser's cache, cookies, and active logins going back at least one day in the browser history.

For the complete report about this issue, see GLASSFISH-15633.

Description

A stateless session bean should not save JMS connections or sessions in fields of the bean. Applications that do so may encounter errors.

Workaround

To avoid this issue, if a stateless session bean's business method requires the use of a JMS connection and session, then the business method should create the JMS connection and session, use it to send or receive messages, and then close the connection and session before returning.

For the complete report about this issue, see GLASSFISH-15558.

Description

Server fails to stop when in secure admin mode and the Administration Console has been loaded.

Workaround

This is just one of a number of issues that may occur when using a JDK version lower than 1.6.0_22. Ensure that you are using JDK 1.6.0_22 or later. See Hardware and Software Requirements for complete information about GlassFish Server 3.1.2 JDK requirements.

For the complete report about this issue, see GLASSFISH-15482.

Description

If an asadmin set subcommand is executed to change a realm-property for a realm that is already loaded (perhaps due to an earlier CLI command targeted at the realm), then the realm continues to behave as if the set subcommand was not executed.

Workaround

Restart GlassFish Server after using a set subcommand to change a property for a realm that has already been loaded.

For the complete report about this issue, see GLASSFISH-15429.

Description

Very occasionally, WARNING messages that state "java.io.EOFException: Trying to read 72 bytes. Already read 0 bytes" may be observed in the server log.

Workaround

If no other messages or exceptions are logged at the same time in either the server or broker logs these messages may be ignored.

For the complete report about this issue, see GLASSFISH-15424.

Description

Performing a MySQL ping after setting nonstandard for mysql-pool, the following error message is displayed:

Ping failed Exception - Access denied to execute this method : 
setLargeRowSizeThreshold Please check the server.log for more details.

Workaround

Only set the standard documented properties for mysql-pool. These properties are as follows:

• "databaseName"

• "serverName"

• "port"

• "networkProtocol"

• "user"

• "password"

• "roleName"

• "datasourceName"

For more information, see "Configuration Specifics for JDBC Drivers" in Oracle GlassFish Server Administration Guide. For the complete report about this issue, see GLASSFISH-14547.

Description

If an EJB Timer resource is changed after the EJB Timer Service is started on a previous resource, the EJB Timer table is not created after a server restart.

Workaround

The DAS must be restarted if any automatic timers are to be deployed. In addition, unless the EJB Timer table is created manually, the domain-dir/generated/ejb-timer-service-app marker file also needs to be removed.

For the complete report about this issue, see GLASSFISH-13873.

Description

When closing an idle or expired connection, Grizzly waits a period of time, called the linger time, for any pending data transmission to complete. If the client on the connection is not network accessible, GlassFish Server might appear to hang.

Workaround

Add the following JVM option to the configuration:

-Dcom.sun.enterprise.web.connector.grizzly.linger=-1

Description

When a domain is restored using a configuration-only backup, the contents of the domain's config directory are restored but the other contents of the directory are lost, thus corrupting the domain.

Workaround

Perform the following steps to restore a domain directory from a configuration-only backup.

The domain name to be restored in this example is named domain1. The configuration is restored to a temporary directory named /tmp/domain1. Once the configuration is restored, the old configuration is moved aside and the restored configuration is copied from the temporary directory to the domain directory.

1. Create a temporary directory to hold the restored configuration files for the domain.

   For example:

   mkdir /tmp/domain1
   

2. Restore the domain.

   asadmin restore-domain --backupdir /tmp/das-backups --domaindir /tmp domain1
   

3. Stop the domain.

4. Change to the domain directory that is actually being restored.

   cd domain-dir
   

5. Rename the existing domain config directory.

   For example:

   mv config config-
   

6. Copy the domain configuration from the /tmp directory into the real domain config directory.

   cp /tmp/domain1 config
   

Description

JSF 2.0 PhaseListeners are executed on each virtual server for any given request. In a multiple virtual server scenario, this means the PhaseListener is invoked multiple times, once for each VM.

The root cause of the problem, like most Mojarra-with-Virtual Server problems, is the invalidity of the assumption that there is always just one ServletContext per application per VM. In the case of N virtual servers, there are N ServletContext instances (and attendant lifecycle listener calls) per application per VM. For example, in a seven-node virtual server scenario, the PhaseListeners are invoked seven times.

Workaround

Create a custom LifecycleFactory instance that correctly handles the virtual server case. Details for doing this are provided in http://java.net/jira/secure/attachment/44826/i_gf_15809-workaround.txt.

For the complete report about this issue, see GLASSFISH-15809.

Description

JSF/Seam 3 applications intermittently fail to start, generating an error message similar to the following:

WARNING: StandardWrapperValve[FacesServlet]: PWC1382: Allocate exception 
for servlet FacesServlet
java.lang.IllegalStateException: Application was not properly initialized at 
startup, could not find Factory: javax.faces.context.FacesContextFactory

This issue may occur when a JSF application does not register the Faces Servlet in the application's web.xml file. The com.sun.faces.config.FacesInitializer will attempt to initialize the JSF Servlet, which normally works without problem, except when Seam Faces is included in the application, which also tries to initialize the Servlet. This issue is not deterministic because of the random ordering of listeners by GlassFish Server.

Workaround

Add the following code to the web.xml file for the application:

<servlet>
<servlet-name>Faces Servlet</servlet-name>
<servlet-class>javax.faces.webapp.FacesServlet</servlet-class>
<load-on-startup>1</load-on-startup>
</servlet>

For the complete report about this issue, see GLASSFISH-16061.

Description

GlassFish Server Message Queue (MQ) 4.5 SP2 and GlassFish Server 3.1.2 are now installed together through a common installation program. Prior versions of MQ and GlassFish Server were installed separately through their own installation programs.

The older MQ installation program prompted the user to set an MQ administrator password, but the GlassFish Server 3.1.2 installer does not. Instead, in GlassFish Server 3.1.2 with MQ 4.5 SP2, the default behavior at MQ instance startup is to generate content for a file-based user repository configuration file named passwd. By default, this file-based user repository is configured as the MQ repository to be used to authenticate client connections to the broker. The default passwd file contains the following user entries:

These credentials may not match those used for the GlassFish Server administrator.

Workaround

Ideally, the GlassFish Server administrator and MQ administrator should share the same user credentials because the two products are now the same. Functionality for setting the MQ administrator user name and password during product installation are planned for future versions of the GlassFish Server installer.

In the meantime, there are several post-installation workarounds, listed below, that you can perform on the MQ side with the imqusermgr User Manager utility to change or set the MQ administrator user name and password. In all cases, see "User Manager Utility" in Oracle GlassFish Server Message Queue Administration Guide for more detailed information about this utility.

• Change the credentials for an existing MQ Broker instance.

  Use the imqusermgr User Manager utility to administer MQ Broker passwords.

• Set the credentials that will subsequently be used for all new MQ Broker instances.

  The instructions vary slightly, depending on whether you want to create a new MQ administrator user name or if the user name will remain unchanged.

  • If creating a new MQ administrator user name

    Delete the existing MQ administrator user name.

    as-install-parent/mq/imqusermgr delete -u admin -c -varhome tmp-dir -s -f
    

    Create the new MQ administrator user name.

    as-install-parent/mq/imqusermgr add -u user-name -p password -c -varhome tmp-dir -s -f
    

  • If reusing the existing MQ administrator user name and only updating the password

    Update the administrator password.

    as-install-parent/mq/imqusermgr update -u admin -p password -c -varhome tmp-dir -s -f
    

    Move the MQ Broker accesscontrol.properties file to the GlassFish Server installation.

    mv tmp-dir/instances/imqbroker/etc/accesscontrol.properties as-install-parent/mq/etc
    

Description

The IIOP protocol as implemented in GlassFish Server calls the ORB to locate the EJB component. Because the EJB component is deployed on the same server as the ORB, the ORB sends the private IP address to the client instead of the public IP address. The ORB has no way of knowing the public IP address, which is determined by the firewall. The client then tries to connect using the private IP address, which does not go though the firewall.

Workaround

None. There is no properly tested workaround available for this issue.

Description

If you attempt to change a DCOM node to an SSH node, using either the Edit Node page of the Administration Console or the asadmin update-node-ssh command, the operation fails unless you specify the SSH port.

Workaround

In the Edit Node page of the Administration Console, enter the port number. When using the asadmin update-node-ssh command, specify the --sshport option. The default SSH port value is 22.

Description

Code that invokes equals() on an instance of java.lang.annotation.Annotation causes an AccessControlException when running in the IBM JDK but succeeds without an exception in a similar version of the Oracle JDK.

Workaround

Include the following grant in the server.policy file, substituting the name of your application for app-name:

grant codeBase "file:${com.sun.aas.instanceRoot}/applications/app-name/-" { permission java.lang.reflect.ReflectPermission "suppressAccessChecks"; };

This workaround was tested with the following versions:

• Java version 1.6.0

• Java SE Runtime Environment (build pap3260sr9fp1-20110208_03(SR9 FP1))

• IBM J9 VM (build 2.4, JRE 1.6.0 IBM J9 2.4 AIX ppc-32 jvmap3260sr9-20110203_74623 (JIT enabled, AOT enabled)

• J9VM - 20110203_074623

• JIT - r9_20101028_17488ifx3

• GC - 20101027_AA)

• JCL - 20110203_01

• uname -a output included AIX 1 6 00090DB6D700

Description

The introduction of non-multicast mode for Group Management Services (GMS) in GlassFish Server 3.1.2 altered which network interface was automatically selected to be used on a multi-homed machine for clustering communications. This change can result in some clustered instances no longer being able to join their running cluster.

In GlassFish Server 3.1-3.1.1, a network interface that did not support multicast was not considered as a candidate to be selected as the network interface to be used for cluster communications. Thus, the automatic selection of network interfaces was impacted. Specifically, virtual network interfaces that used to be ignored because they did not support multicast can be incorrectly selected as the default network interfaces for cluster communications.

Workaround

Do one of the following:

• Disable or remove the network interfaces that are being selected incorrectly.

• Specify which network interface to use on the machine(s) selecting the incorrect network interface. For more information, see "Using the Multi-Homing Feature With GMS" in Oracle GlassFish Server High Availability Administration Guide.

Description

If you try to use the Administration Console from a system through a proxy server on another system back to the original system, while using the system's full host name (instead of localhost or 127.0.0.1) you are denied access because the request is treated as a remote request, which requires that secure admin be enabled.

Workaround

Do one of the following:

• Do not use a proxy server.

• Use localhost or 127.0.0.1 as the host name.

• Enable secure admin so that what GlassFish Server interprets as a remote request is accepted as such.

To enable secure admin, see "Managing Administrative Security" in Oracle GlassFish Server Security Guide.

Description

If a cluster has only one running server instance and high availability is enabled, you may see the following log message indicating session replication failure:

Multicast datagram of size 155?379 exceeds max multicast size 65?536

The high-availability subsystem is sending replica sessions to null, which translates to a UDP broadcast. Broadcasts over UDP multicast never support a size larger than 64K.

Workaround

Always ensure that at least two clustered instances are running. Use the asadmin get-health cluster-name command to monitor a cluster's health (see the Oracle GlassFish Server Reference Manual). There is also information in the server log that indicates how many cluster members are running in a cluster.

Description

When JRockit and Coherence*Web are both used in combination with GlassFish Server, and a Coherence*Web enabled application is deployed, CPU usage sometimes reaches 100% and deployment sometimes fails.

Workaround

Use the Oracle JDK instead of JRockit.

Description

If you are using the Internet Explorer 9 or Google Chrome browser, export of the loadbalancer.xml file succeeds but causes the Administration Console to hang.

Workaround

Use a different browser.

Description

If the security manager is on, tests for using Coherence*Web and TopLink Grid with GlassFish Server fail.

Workaround

If the security manager is on and you are using Coherence bundled with your application through either Toplink Grid or Coherence*Web, grant the following permissions to your application's codebase in the security.policy file, substituting the name of your application for app-name:

grant codeBase "file:${com.sun.aas.instanceRoot}/applications/app-name/-"
{
  permission java.lang.reflect.ReflectPermission "suppressAccessChecks";
  permission java.lang.RuntimePermission "modifyThread";    
  permission java.lang.RuntimePermission "accessDeclaredMembers";    
  permission java.lang.RuntimePermission "createClassLoader";    
  permission java.lang.RuntimePermission "getClassLoader";    
  permission java.lang.RuntimePermission "getenv.*";    
  permission java.lang.RuntimePermission "getProtectionDomain";    
  permission java.lang.RuntimePermission "selectorProvider";    
  permission java.lang.RuntimePermission "setContextClassLoader";    
  permission java.lang.RuntimePermission "shutdownHooks";    
  permission java.net.SocketPermission "*", "accept,connect,resolve,listen";
  permission java.security.SecurityPermission"insertProvider.CoherenceSecurityProvider";  
  permission java.security.SecurityPermission"putProviderProperty.CoherenceSecurityProvider";  
  permission java.util.PropertyPermission "java.net.preferIPv4Stack", "read";
  permission java.util.PropertyPermission "java.net.preferIPv6Addresses","read";  
  permission java.util.PropertyPermission "java.version", "read";  
  permission java.util.PropertyPermission "os.arch", "read";  
  permission java.util.PropertyPermission "os.name", "read";  
  permission java.util.PropertyPermission "sun.arch.data.model", "read";  
  permission java.util.PropertyPermission "tangosol.*", "read";  
  permission java.util.PropertyPermission "user.dir", "read";  
  permission java.util.PropertyPermission "buffermanager.*", "read";  
  permission java.util.PropertyPermission "sbm.cleanup.frequency", "read";  
  permission javax.management.MBeanPermission "com.tangosol.*", "*";  
  permission javax.management.MBeanServerPermission "*";  
  permission javax.management.MBeanTrustPermission "*";  
  permission javax.security.auth.AuthPermission "getSubject";  
  permission java.security.SecurityPermission"putProviderProperty.OracleCommonsSecurityProvider";  
  permission java.security.SecurityPermission"insertProvider.OracleCommonsSecurityProvider";
  permission java.lang.RuntimePermission "modifyThread";
};

Description

A traffic loss occurs when a clustered server instance is restarting. There is a time gap of a few seconds between when port 8080 is running and when application loading is complete. During this gap client requests are denied with a 404 error.

Workaround

None. The client must retry the request after application loading is complete.

Description

Repeated redeployment of a Coherence 3.7.1 enabled application may cause a memory leak and lead to an OutOfMemory error. The cluster may become unusable. After an instance in the cluster has shown the error, asadmin commands that operate on the entire cluster may return with an SSLHandshakeException message and fail.

Workaround

Use Coherence 3.7.0 instead.

If you must use Coherence 3.7.1, to get the cluster back in use:

1. Identify the instances that have gone OutOfMemory by looking at each instance's server logs.

2. Kill those instances from the command line using the kill -9 pid command.

3. Restart the cluster using the asadmin start-cluster cluster-name command.

Description

When you create a JMS Destination Resource in the Administration Console, this resource gets added under the Resources > JMS Resources > Connection Factories node. When you click on this entry, a java.lang.NullPointerException is thrown.

Workaround

The table listing of Connection Factories in the right frame of the Administration Console is correct. Use the table listing instead.

Description

The GlassFish Server installer provides an option to create a silent file that records all user choices and is only supported in the Typical scenario. This silent file can later be used to perform installation without user interaction.

The generated silent file does not contain any passwords. If this file is used for running automated silent installation, the created GlassFish Server domain provides an unauthenticated login mechanism.

Workaround

Use interactive installation if you want the GlassFish Server domain to require passwords.

Description

When you try to run an application client on Windows with cygwin, the application client is appending extra characters to the arguments. For example, for a simple parameter 3, it is sending $'3\r'.

Workaround

Depending on how your application client handles command-line arguments, you might be able to work around this problem without changing your application client by adding an extra command-line argument. For example, instead of entering this command:

appclient -jar mydir/MyClient.jar 3

You could enter this command:

appclient -jar mydir/MyClient.jar 3 extra

This adds the trailing \r to the last argument, extra, protecting the previous ones. Note that this does not work if your application client handles all the arguments on the line in some way.

Another workaround is to modify your application client to use String.trim on the arguments, or at least the last one, which removes any trailing \r character.

Description

GlassFish Server installation crashes if you perform these steps:

1. Select Custom Installation on the Installation Type page and then Next.

2. Select Install Only on the Installation page and then Next.

3. Select Back on the Install Directory page.

4. Select Configure an Existing Installation on the Installation page and Next.

5. Select Next on the Install Directory page.

Workaround

To configure an existing installation, go directly to this option without selecting a different option first.

Description

The Coherence JPA tests with TopLink Grid failed to insert an entity on AIX with the following error:

The socket name is not available on this system

Workaround

Define a JVM property that specifies use of an IPV4 stack as follows:

asadmin create-jvm-options --target cluster-name -java.net.preferIPv4Stack=true

Description

If the JDK version is 1.7.0_03 and you attempt to set the rewrite-location load balancer property using the asadmin set command, the command fails.

Workaround

Set the rewrite-location property by editing the loadbalancer.xml file, located in the web-server-install/https-machine-name/conf directory.

Description

If a plain file exists in the installation parent directory, for example glassfish3 based on the glassfish.zip distribution, then the install-node command fails with a NullPointerException.

Because the GlassFish installer leaves two files in the installation parent directory (uninstall.exe, uninstall.sh), the install-node command can only be used with installations created using the glassfish.zip distribution.

Workaround

Do one of the following:

• Remove any plain files from the installation parent directory before using the install-node command.

• Install the software manually on the remote node and do not use the install-node command.

Description

By default, GlassFish Server performs LDAP group search. If you have not created any groups in LDAP, the search fails.

Workaround

To disable LDAP group search, set the com.oracle.enterprise.security.auth.realm.ldap.DISABLEGROUP_SEARCH Java system property to true in the required GlassFish Server instance or cluster configurations:

asadmin> create-jvm-options --target=target
-Dcom.oracle.enterprise.security.auth.realm.ldap.DISABLEGROUP_SEARCH=true

where target is the GlassFish Server instance or cluster for which you are disabling LDAP group search.