JBoss Application Server 5.1/ESB 4.5 GA and ActiveMQ 5.4 integration

On one of my last projects I had to integrate JBoss ESB 4.5 GA with ActiveMQ 5.4.0 and Spring 3. NOTE: the fixes below also work for integration with JBoss 5.1 Application Server.



My starting point was of course this post: Integrating Apache ActiveMQ with JBoss. (Or is this the original?)
Part of the requirements mentioned in that article (Apache ActiveMQ 4.0.1+ and JBoss 4.0.4+) got me worried that the steps described might not work for my version of JBoss and ActiveMQ. Even though there's a '+' after the version numbers :)

First I had quite a hard time finding the .rar file! Finally found it in \lib\optional in the ActiveMQ zip: activemq-rar-5.4.0.rar

After that I followed the steps including up to 'Configuring JBoss'. In there you also have to start JBoss again.
I didn't see any exceptions fly around so thought all was fine, so I started the consumer ('ant consumer').
But there I got:

[java] javax.jms.JMSException: Could not connect to broker URL: tcp://localhost:61616. Reason: java.net.ConnectException: Connection re[Thread-2] Caught: javax.jms.JMSException: Could not connect to broker URL: tcp://localhost:61616. Reason: java.net Connection Exception : connection refused

Strrrange, because I thought the server started fine. After quite some searching, I figured out the error message probably indicates that there's just nothing listening at localhost:61616.
After carefully checking the startup log (searching for 'activemq') I found out it hadn't started!

17:17:31,566 INFO [XBeanXmlBeanDefinitionReader] Loading XML bean definitions from class path resource [broker-config.xml] 17:17:31,768 WARN [ActiveMQResourceAdapter] Could not start up embeded ActiveMQ Broker 'xbean:broker-config.xml': Line 29 in XML document from class path resource [broker-config.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-elt.1: Cannot find the declaration of element 'beans'.

That's weird, some namespace problem?
Searching on the biggg internet I found this page (via), explaining that the namespaces are different from 5.1 onwards.

Since I'm using AMQ 5.4.0 I tried in broker-config.xml:

<beans xmlns="http://activemq.apache.org/schema/core">

But that still gave:

17:23:38,638 WARN [ActiveMQResourceAdapter] Could not start up embeded ActiveMQ Broker 'xbean:broker-config.xml': Line 29 in XML document from class path resource [broker-config.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-elt.1: Cannot find the declaration of element 'beans'.

So now I just tried all the namespace definitions:

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:amq="http://activemq.apache.org/schema/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/activemq-core-5.2.0.xsd "> </beans>

Darn, still not ok:

17:27:42,265 WARN [ActiveMQResourceAdapter] Could not start up embeded ActiveMQ Broker 'xbean:broker-config.xml': Line 49 in XML document from class path resource [broker-config.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-complex-type.2.4.c: The matching wildcard is strict, but no declaration can be found for element 'persistenceAdapter'.

But that was easy, missing the namespace prefix. So I modified:

<amq:persistenceAdapter> <amq:journaledJDBC journalLogFiles="5" dataDirectory="activemq-data"/> <!-- To use a different datasource, use th following syntax : --> <!-- <journaledJDBC journalLogFiles="5" dataDirectory="../data" dataSource="#postgres-ds"/> --> </amq:persistenceAdapter>

But again an error:

17:29:50,840 WARN [ActiveMQResourceAdapter] Could not start up embeded ActiveMQ Broker 'xbean:broker-config.xml': Line 50 in XML document from class path resource [broker-config.xml] is invalid; nested exception is org.xml.sax.SAXParseException: cvc-complex-type.2.4.a: Invalid content was found starting with element 'amq:journaledJDBC'. One of '{"http://activemq.apache.org/schema/core":amqPersistenceAdapter, "http://activemq.apache.org/schema/core":jdbcPersistenceAdapter, "http://activemq.apache.org/schema/core":journalPersistenceAdapter, "http://activemq.apache.org/schema/core":kahaDB, "http://activemq.apache.org/schema/core":kahaPersistenceAdapter, "http://activemq.apache.org/schema/core":memoryPersistenceAdapter, WC[##other:"http://activemq.apache.org/schema/core"]}' is expected.

So journaledJDBC is unknown. There must be something with a wrong namespace version or something. From the XSDs from here it seemed there was an element in the wrong place. So I just removed the whole persistenceAdapter element.

I also noted that there is a persistenceFactory element in the AMQ 450 broker-config.xml, which is not present in the Integrating Apache ActiveMQ with JBoss post.
So I also changed that one's dataDirectory to be the same as in the (just removed) persistenceAdapter:

<amq:persistenceFactory> <amq:journalPersistenceAdapterFactory journalLogFiles="5" dataDirectory="${jboss.server.data.dir}/activemq"/> </amq:persistenceFactory>

Yes that did it! See the log part below:

17:45:01,215 INFO [XBeanXmlBeanDefinitionReader] Loading XML bean definitions from classpath resource [broker-config.xml] 17:45:01,542 INFO [DefaultListableBeanFactory] Pre-instantiating singletons in org.springframework.beans.factory.support.DefaultListableBeanFactory@157402b: defining beans [org.apache.activemq.xbean.XBeanBrokerService#0]; root of factory hierarchy 17:45:01,697 INFO [PListStore] PListStore:activemq-data\bruce.broker1\tmp_storage started ... stuff deleted ... 17:45:02,896 INFO [BrokerService] ActiveMQ 5.4.0 JMS Message Broker (bruce.broker1) is starting 17:45:02,911 INFO [BrokerService] For help or more information please see: http://activemq.apache.org/ 17:45:03,083 INFO [SchedulerBroker] Scheduler using directory: activemq-data\scheduler 17:45:03,145 INFO [JournalPersistenceAdapter] Journal Recovery Started from: Active Journal: using 5 x 20.0 Megs at: C:\jbossesb-server-4.5.GA\bin\${jboss.server.data.dir}\activemq\journal 17:45:03,176 INFO [JournalPersistenceAdapter] Journal Recovered: 0 message(s) in transactions recovered. 17:45:03,207 INFO [TransportServerThreadSupport] Listening for connections at: tcp://localhost:61616 17:45:03,223 INFO [TransportConnector] Connector bruce.broker1 Started 17:45:03,223 INFO [BrokerService] ActiveMQ JMS Message Broker (bruce.broker1, ID:PC555-4930-1389432149-0:0) started

Also after that the consumer and producer worked fine.

And as a final optimization to not having to change the namespace for each new ActiveMQ version, I removed the version from the activemq-core xsd:

<beans xmlns="http://www.springframework.org/schema/beans" xmlns:amq="http://activemq.apache.org/schema/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/activemq-core.xsd ">

To summarize, this is the final broker-config.xml (some comments deleted for space):

<?xml version="1.0" encoding="UTF-8"?> <!-- START SNIPPET: xbean --> <beans xmlns="http://www.springframework.org/schema/beans" xmlns:amq="http://activemq.apache.org/schema/core" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd http://activemq.apache.org/schema/core http://activemq.apache.org/schema/core/activemq-core.xsd "> <!-- shutdown hook is disabled as RAR classloader may be gone at shutdown --> <amq:broker useJmx="true" useShutdownHook="false" brokerName="bruce.broker1"> <amq:managementContext> <!-- use appserver provided context instead of creating one, for jboss use: -Djboss.platform.mbeanserver --> <amq:managementContext createConnector="false"/> </amq:managementContext> <amq:persistenceFactory> <amq:journalPersistenceAdapterFactory journalLogFiles="5" dataDirectory="${jboss.server.data.dir}/activemq"/> </amq:persistenceFactory> <amq:transportConnectors> <amq:transportConnector name="bruce.broker1" uri="tcp://localhost:61616" discoveryUri="multicast://default"/> </amq:transportConnectors> </amq:broker> </beans>

JBoss 5.1 AS specific stuff:

I just copied over the above created .rar dir to the jboss-5.1.0.GA/server/default/deploy/activemq-ra.rar/META-INF directory and started it.

Got one error trying:

18:00:48,611 ERROR [AbstractKernelController] Error installing to Parse: name=vfsfile:/C:/jboss-5.1.0.GA/server/default/deploy/activemq-ra.rar/ state=Not Installed mode=Manual requiredState=Parse org.jboss.deployers.spi.DeploymentException: Error creating managed object for vfsfile:/C:/jboss-5.1.0.GA/server/default/deploy/activemq-ra.rar/ at org.jboss.deployers.spi.DeploymentException.rethrowAsDeploymentException( DeploymentException.java:49) ... Caused by: org.jboss.xb.binding.JBossXBException: Failed to parse source: cvc-complex-type.2.4.d: Invalid content was found starting with element 'config-property-value'. No child element is expected at this point. @ vfsfile:/C:/jboss-5.1.0.GA/server/default/deploy/ activemq-ra.rar/META-INF/ra.xml[100,36]

Ah for some reason I had an empty in ra.xml. Removing that made the 5.1 server start fine and the producer produce and the consumer consume!

PS: the example consumer & producer now send out 2000 messages instead of the 10 you see in the Integrating Apache ActiveMQ with JBoss post.

Hope this might help somebody some time :)

Best of this Week Summary 21 September - 27 September 2009

• Always feeling a bit less up-to-date when using RSS/Atom feeds? Well, convince your RSS/Atom provider to implement the PubSubHubBub protocol: it provides a callback-hook, which when registered to as feed subscriber, causes an immediate update (ping) to the subscriber (instead of waiting for the next RSS/Atom feed request).
  Or will rssCloud be the winner of this realtime RSS extension? Here's the basic (simpler) flow of rssCloud:
  
  
  Differences between the two are described here (including some issues) and here. A real old-fashioned flame-war has even started between the creators of the two protocols.
  And a good comparison which explains quite well why PuSH is the better choice of the two. Note that both protocols seem to be server-to-server only! (e.g think when you're behind a firewall or NAT...)
  See this article for an explanation of the PuSH flow of notifications/information in below's diagram:
  
  
  Update: PubSubHubbub explained by co-creator Brett Slatkin (an engineer at Google).
  
  
• Want to get to know Hadoop? In short "Hadoop allows you to write and run your application in a distributed manner and process large amounts of data with it. It consists out of a MapReduce implementation and a distributed file system." Check the rest of this introduction for more details.
  


• Five Java anti-patterns to prevent (out-of) memory problems.
  


• Three Best and three worst practices in BPM and SOA.
  


• "Tom Killalea, Vice President of technology with responsibility for infrastructure and distributed systems engineering at Amazon.com wrote an article on ACM queue on building scalable web services. He outlines guiding principles to building scalable web services with a lot of real-world examples, the core theme of which is “build only what you need”."
  

Best of this Week Summary 29 October - 02 November 2008

• Lots of OpenID news this week: Microsoft Live ID will be an OpenID provider. It is still in a testing phase; you can already try it out. Google is also going to be an OpenID provider, including the use of OAuth. But that looks less promising when looking carefully: the implementation is not completely following the OpenID standards! See step 3 and 4 in the image below.
  
  A clarification on why Google has done this can be found here. Basically, two reasons:
  
  1. this way users can use their Gmail accounts instead of the normally required URLs. But a URL does exist in the form of 'https://www.google.com/accounts/o8/id'.
     
  2. Google doesn't allow OpenID for users at sign-in, because its federated login would break many of their rich-client applications. Google is working on this one.


• Whitepaper on how the JTeam company has implemented Continous Integration. Their complete list of CI tools is described; handy when you're looking for inspiration.
  


• Things to think about when considering Maven as your build tool (different angle on the post :-)
  


• Interesting posts from the Google Chrome team on the decisions they made creating the browser.
  

Outstanding issues with OpenID and tips for improvements

In this fourth post about OpenID I'll try to give a complete overview of the outstanding issues with OpenID. At the end I'll give a couple of tips for improvements on the outstanding issues. You can find my previous posts here, here and here.

Not average-internet-joe ready
An OpenID is just not in the format an average user currently understands. My parents for example would not be able to "grasp" the idea of a URL being your identification. XRI is a work in progress to let people pick a username that is more or less like regular usernames like '=Paul.Smith'.

Many websites that support OpenID just point to OpenID.net (just renewed by the way, where it's now a lot easier way to find OpenID providers). From there on the user is just "on her own" to figure out what to do. This is not really OpenID's fault, but if the sites that are OpenID-enabled (consumers) are not making it easy for the user to create an account, users will just give up and sign in the "old fashioned" way. These sites should provide direct pointers to solid OpenID providers.

Delegation is quite hard to explain and understand. Even harder to actually use. It is just too hard for the average internet user to set it up. Though delegation is a real important aspect of OpenID, because it allows you to not be dependent on one OpenID provider. If you don't set up delegation for yourself from the start (because that will be your OpenID URL which you can then point (delegate) to any OpenID provider you want), you are out of luck if ever your OpenID provider goes busted.

Different OpenID providers show different, sometimes even confusing, messages when the user has to confirm the site they want to get access to. It gets even more difficult when you can assign multiple personas (see my second post for an explanation of personas). Which one to pick? And why?


Security
Of course there's the phishing issue (man-in-the-middle) that a malicious consumer site can just redirect the user to a fake OpenID provider. A solution some providers take is forcing the user to login via their regular login page first (and bookmarklet). Though it provides a small barrier, it makes the whole OpenID process just more confusing to the user. And it is not a full solution against phishing; on the phishing site, just tell the user the separate login-page has been fixed (just a bit of social engineering :-). Note that OpenID trusts DNS to direct the given URL to the correct machine; DNS servers are known for being hacked too.

There's also the replay-attack issue, where a sniffer can grab the authenticating response and replay it to the consumer. A partial barrier for that is the use of a nonce (number-used-once, see my third post for some references). Version 2.0 of OpenID should by default contain the nonce-fix for replay-attacks. This does not protect against the case that the man-in-the-middle is the first to use the resonse-URL (more a "pre-play" attack).

If an attacker gains access to a user's OpenID login, he immediately has access to all sites that user can login to; with the same OpenID/password combination.

Since all OpenID providers have the option to stay logged-in to it (thus authenticating without providing a password), CSRF attacks become very easy: no password is required.

Exploitation of an XSS flaw on trusted domains as something.CNN.com or else.microsoft.com to prevent an OpenID provider to know where the user is really signing in to. For a full explanation see "[OpenID] What's broken in OpenID 2.0? (IIW session)".

How can a consumer use OpenID in an API it provides? The consumer can not ask the user for credentials at each API call. It should ask via the OpenID provider. Work in this area is the oAuth protocol, which I'll cover a bit more in my next post about OpenID.

Privacy
Since all authentication (ownership prove of the OpenID) goes via the OpenID provider, the provider can track all the sites their users are accessing.


Improvement tips
Below I list a couple of ways OpenID can be improved to tackle the above mentioned problems:

• Integrate the flow of signing up to an OpenId provider into your consumer/relying party (OpenID enabled) website.
  
• OpenID providers should provide clarity upfront to the users whether their service will always be for free, whether it does support multiple personas etc.
  
• Consumer sites should implement OpenID more transparently. There is no need to make a distinction at registration between OpenID or not. If the user enters no password, it's probably an OpenID so try OpenID authentication, otherwise it's probably a regular signup.
  
• Find a better solution to handle phishing and replay-attacks. SSL client-certificates could be a solution, but then you'd have to bring the public-private keys to every browser and delete them again. The solution could be cryptography using private/public keys (thus not using a password).
  
• OpenID providers should not recycle inactive accounts or at least use a nonce, which the consumers should also check.
  

References
- The Identity Corner » The problem(s) with OpenID
- Beginner's guide to OpenID phishing
- Single Sign-On for the Internet: A Security Story