Advanced SSL configuration on IBM Http Server – Restrict unused HTTP methods and Verbose HTTP headers

Restricting unused HTTP methods

The HTTP method is supplied in the request line and specifies the operation that the client has requested. Browsers will generally just use two methods to access and interact with web sites; GET for queries that can be safely repeated and POST for operations that may have side effects. This means, we need to disable unused http methods. some of them are:(PUT|DELETE|TRACE|TRACK|COPY|MOVE|LOCK|UNLOCK|PROPFIND|PROPPATCH|SEARCH|MKCOL). Check with the application teams, if they need any of these methods for the application to work, before disabling them.

Testing before limiting http methods:

telnet josephamrithraj.mp 80
Trying xx.xx.xx.xx…
Connected to josephamrithraj.mp.
Escape character is ‘^]’.
OPTIONS / HTTP/1.1
Host: josephamrithraj.mp

HTTP/1.1 200 OK
Date: Thu, 14 Sep 2010 00:11:57 GMT
Server: Apache Web Server
Content-Length: 0
Allow: GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, PATCH, PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, LOCK, UNLOCK, TRACE

Connection closed by foreign host.

your IBM http servers configuration file [httpd.conf] has 2 sections named main and virtualhost sections. you need to add the following code at both the places. I am explaining this task using mod_rewrite module. So, first make sure that… mod_rewrite is enabled. then, add the following lines to your http.conf files main and virtualhost sections.

RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(PUT|DELETE|TRACE|TRACK|COPY|MOVE|LOCK|UNLOCK|PROPFIND|PROPPATCH|SEARCH|MKCOL)
RewriteRule .* – [F]

Restart the web server after adding the above lines.


Now, when someone tried to use one of these http methods, they will get forbidden response since we specified [F] in the rewrite rule.

Testing after adding and restarting web server

telnet josephamrithraj.mp 80
Trying xx.xx.xx.xx...
Connected to josephamrithraj.mp.
Escape character is '^]'.
OPTIONS / HTTP/1.1
Host: josephamrithraj.mp

HTTP/1.1 200 OK
Date: Thu, 14 Sep 2010 00:15:44 GMT
Server: Apache Web Server
Content-Length: 0
Allow: GET, POST
Connection closed by foreign host.
Testing TRACE methods

telnet josephamrithraj.mp 80
Trying xx.xx.xx.xx...
Connected josephamrithraj.mp
Escape character is '^]'.
TRACE / HTTP/1.0
Host: josephamrithraj.mp
testing... <- ENTER twice HTTP/1.1 403 Forbidden Date: Thu, 14 Sep 2010 00:18:31 GMT Server: Apache Web Server Content-Length: 320 Connection: close Content-Type: text/html; charset=iso-8859-1

Forbidden

You don't have permission to access / on this server.

Connection closed by foreign host.
Disable verbose HTTP headers:


you might have seen this … when the web server [apache or ibm http server] throws errors page, sometimes it might show the information related to its version, build, modules etc. This is a security issue since you are giving away the details about your web server. for example, take a look at this:

Server: Apache/2.0.53 (Ubuntu) PHP/4.3.10-10ubuntu4 Server at xx.xx.xx.xx Port 80
The line in the server header expose important version and variant information about the Linux operating system and Apache software used on the machine, indirectly expose the possible security holes that are existed to the hackers, or at least make malicious attackers easier to identify your system for available attack points.
To ensure that the Apache HTTP web server does not broadcast this message to the whole world publicly and fix possible security issue, modify these two directives ServerTokes and ServerSignature in httpd.conf configuration file.

ServerTokens

This directive configures what you return as the Server HTTP response Header. The built-in default is ‘Full’ which sends information about the OS-type and compiled in modules. The recommended value is ‘Prod’ which sends the least information.

Options: Full | OS | Minor | Minimal | Major | Prod

“ServerTokens Prod”

This configures Apache to return only Apache as product in the server response header on very page request, suppressing OS, major and minor version info.

ServerSignature

This directive lets you add a line containing the server version and virtual host name to server-generated pages. It is recommended to set it to OFF and Set to "EMail" to also include a mailto: link to the ServerAdmin.

Options: On | Off | EMail

“ServerSignature Off”

This instructs Apache not to display a trailing footer line under server-generated documents, which displays server version number, ServerName of the serving virtual host, email setting etc..


Courtesy:http://josephamrithraj.wordpress.com/2010/09/16/advanced-ssl-configuration-on-ibm-http-server-restrict-unused-http-methods-and-verbose-http-headers/

Advanced SSL configuration on IBM Http Server – Client Authentication and Ciphers

The Advanced SSL Configuration settings are

Client Authentication
Setting Ciphers
SSL for multiple IP virtual Hosts
Client Authentication:

If you enable client authentication, the server validates clients by checking for trusted certificate authority, Known as CA root certificates in the local key database. To enable client authentication, you need to use SSLClientAuth directive. The options to use with this stanza are:

None – The server requests no client certificate from the client.
Optional – The server requests, but does not require, a client certificate. If presented, the client certificate must prove valid.
Required – The server requires a valid certificate from all clients and returns a 403 status code if no certificate is present.
Required_reset – The server requires a valid certificate from all clients, and if no certificate is available, the server sends an SSL alert to the client. This enables the client to understand that the SSL failure is client-certificate related, and will cause browsers to re-prompt for client certificate information on subsequent access. make sure you have GSKit version 7.0.4.19 or later when you choose this option.
For example, If i want all the clients to be authenticated, then i need to add the following stanza
SSLClientAuth required

Ciphers

We set the cipher specification to use during secure transactions. The specified cipher specifications validate against the level of the Global Security Kit (GSK) toolkit that is installed on your system. Invalid cipher specifications cause an error to log in the error log. If the client issuing the request does not support the ciphers specified, the request fails and the connection closes to the client. IBM HTTP Server has a built-in list of cipher specifications to use for communicating with clients over Secure Sockets Layer (SSL). The actual cipher specification that is used for a particular client connection is selected from those which are supported by both IBM HTTP Server and the client.

Some cipher specifications provide a weaker level of security than others, and might need to be avoided for security reasons. Some of the stronger cipher specifications are more computationally intensive than weaker cipher specifications and might be avoided if required for performance reasons. When an SSL connection is established, the client (web browser) and the web server negotiate the cipher to use for the connection. The web server has an ordered list of ciphers, and the first cipher in that list which is supported by the client will be selected.

IBM HTTP Server supports the following SSL ciphers: SSLv3 and TLS and SSLv2

IBM recommends the following setting, keeping in mind both strong security and performance

## SSLv3 128 bit Ciphers
SSLCipherSpec SSL_RSA_WITH_RC4_128_MD5
SSLCipherSpec SSL_RSA_WITH_RC4_128_SHA

## FIPS approved SSLV3 and TLSv1 128 bit AES Cipher
SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA

## FIPS approved SSLV3 and TLSv1 256 bit AES Cipher
SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA

## Triple DES 168 bit Ciphers
## These can still be used, but only if the client does
## not support any of the ciphers listed above.
SSLCipherSpec SSL_RSA_WITH_3DES_EDE_CBC_SHA

## The following block enables SSLv2. Excluding it in the presence of
## the SSLv3 configuration above disables SSLv2 support.

## Uncomment to enable SSLv2 (with 128 bit Ciphers)
#SSLCipherSpec SSL_RC4_128_WITH_MD5
#SSLCipherSpec SSL_RC4_128_WITH_SHA
#SSLCipherSpec SSL_DES_192_EDE3_CBC_WITH_MD5
View the Ciphers which the server uses for Secure transactions

Set the LogLevel to info in the configuration file. Look in the error log for messages in this format: TimeStamp info_message mod_ibm_ssl: Using Version 2/3 Cipher: longname|shortname. The order that the cipher specifications are displayed in the error log from top to bottom represents the attempted order of the cipher specifications.

View the Ciphers were used for negotiating a connection

You can use the following LogFormat directive to view and log the SSL cipher negotiated for each connection:

LogFormat “%h %l %u %t \”%r\” %>s %b \”SSL=%{HTTPS}e\” \”%{HTTPS_CIPHER}e\” \”%{HTTPS_KEYSIZE}e\” \”%{HTTPS_SECRETKEYSIZE}e\”" ssl_common

CustomLog logs/ssl_cipher.log ssl_common

This logformat will produce an output to the ssl_cipher.log that looks something like this:

127.0.0.1 – - [01/Sep/2010:00:02:05 -0800] “GET / HTTP/1.1″ 200 1582 “SSL=ON” “SSL_RSA_WITH_RC4_128_MD5″ “128″ “128″

SSL for multiple IP virtual hosts

When you do not define an SSL directive on a virtual host, the server uses the directive default. You can define different (SSL) options for various virtual hosts. To enable SSL:

Specify the SSLEnable directive on the virtual host stanza in the configuration file, to enable SSL for a virtual host.
Specify a Keyfile directive and
Any SSL directives you want enabled for that particular virtual host.
Restart the server.
With all the above security options enabled, your virtual host may look like this:



SSLEnable

Keyfile keyfile.kdb

SSLCientAuth required

## SSLv3 128 bit Ciphers

SSLCipherSpec SSL_RSA_WITH_RC4_128_MD5

SSLCipherSpec SSL_RSA_WITH_RC4_128_SHA

## FIPS approved SSLV3 and TLSv1 128 bit AES Cipher

SSLCipherSpec TLS_RSA_WITH_AES_128_CBC_SHA

## FIPS approved SSLV3 and TLSv1 256 bit AES Cipher

SSLCipherSpec TLS_RSA_WITH_AES_256_CBC_SHA

## Triple DES 168 bit Ciphers

## These can still be used, but only if the client does not support any of the ciphers listed above.

SSLCipherSpec SSL_RSA_WITH_3DES_EDE_CBC_SHA

## The following block enables SSLv2.
## Excluding it in the presence of the SSLv3 configuration above disables SSLv2 support.

## Uncomment to enable SSLv2 (with 128 bit Ciphers)

#SSLCipherSpec SSL_RC4_128_WITH_MD5

#SSLCipherSpec SSL_RC4_128_WITH_SHA

#SSLCipherSpec SSL_DES_192_EDE3_CBC_WITH_MD5



Courtesy:http://josephamrithraj.wordpress.com/2010/09/04/advanced-ssl-configuration-on-ibm-http-server-client-authentication-and-ciphers/

How to collect performance data on Linux

Collect the following information when high CPU consumption is with IBM Java process:
Enable garbage collection trace to see whether Java garbage collection is thrashing if possible. If you want to enable Java garbage collection trace on IBM WebSphere Application Server, please refer to the following document: Enabling verbose garbage collection (verbosegc) in WebSphere application Server


Run the following command:

top -d delaytime -c -b > top.log

Where delaytime is the number of seconds to delay. This must be 60 seconds or greater, depending on how soon the failure is expected.


Create a script file, vmstat.sh with the following content:

#vmstat.sh
#output file name
VMSTAT_LOG=$1
LIMIT=288
#sleep for 5 miniutes
SLEEP_TIME=300
while true
do
i=0
echo >$VMSTAT_LOG
while [ $i -le "$LIMIT" ];
do
date >> $VMSTAT_LOG;
vmstat 5 12 >> $VMSTAT_LOG;
i=`expr $i + 1`;
sleep $SLEEP_TIME;
done
done

Create a script, ps.sh with the following content:

#ps.sh
#output file name
PS_LOG=$1
LIMIT=288
#sleep for 5 miniutes
SLEEP_TIME=300
while true
do
i=0
echo >$PS_LOG
while [ $i -le "$LIMIT" ];
do
date >> $PS_LOG;
ps -eLf >> $PS_LOG;
i=`expr $i + 1`;
sleep $SLEEP_TIME;
done
done

Run the scripts:

./ps.sh ps_eLf.log
./vmstat.sh vmstat.log

Notes: . The scripts ps.sh and vmstat.sh, as provided, roll over every 24 hours. . You might need to modify the scripts to meet your needs. . The preceding scripts will run forever. After the error condition is reached, you will have to terminate them.


When high CPU consumption occurs, collect the following logs:

netstat -an > netstat1.out


If the Web server is remote, run the following on the Web server system:

netstat -an > netstatwebserver1.out


Run the following:

kill -3 [PID_of_problem_JVM]


The kill -3 commands create javacore*.txt files

Note: If you are not able to determine which JVM process is experiencing the high CPU usage then you should issue the kill -3 PID for each of the JVM processes.



Wait two minutes.


Run the following:

kill -3 [PID_of_problem_JVM]


Wait two minutes.


Run the following:

kill -3 [PID_of_problem_JVM]


Wait two minutes.


Run the following:

netstat -an > netstat2.out



If the Web server is remote, run the following on the Web server system:

netstat -an > netstatwebserver2.out



If you are unable to generate javacore files, then perform the following:

kill -11 [PID_of_problem_JVM]

WARNING: kill -11 will terminate the JVM process, produce a core file, and possibly a javacore.


Review all output files and collect the following files for IBM Performance Analysis Tool for Java for Linux


ps_eLf.log
javacore*.txt files

Courtesy:http://wasissues.blogspot.com/

Migrating from Websphere 6.0 to Websphere 7.0

The application I manage at work is a client/server application written entirely in java. My company for years has been an IBM shop, so we have a large Websphere presence which is where the server is deployed. The application had been running on Websphere 5.1 for a few years and was fairly recently migrated to Websphere 6.0 to remain on a supported version of Websphere. Because the end of life for Websphere 6.0 is September 2010, we’re starting to plan for another upgrade now (we have major releases in January and June, so we’re targeting the June ’10 release for the upgrade). Websphere 6.1, if IBM holds to it’s pattern of every 2 years or so will remain supported until September 2012, however there’s no current end of life date documented yet (link). To get the longest life possible, I’m looking at Websphere 7.0 as the target platform for our June ’10 upgrade.

We have RAD 7.5 in house and a couple members of my team have installed it. I’ve been working on getting a local WAS 7.0 server up and running and getting our app deployed on it. There are some major differences between Websphere 5.1/6.0 and 7.0. I won’t go into details as those are readily available on IBM’s website, but would like to share some of my observations and pain so far.

Application Background: The server side of our application is effectively broken down into 2 pieces. One component is what we call a provision server that is essentially a cache of configuration data read from DB2. This configuration information contains rules which drive how the second component operates. The second component is the main workhorse app which receives a request, and creates a response based on configuration data retrieved from the provision server (if necessary) and data retrieved from any number of other applications we interface with. We have 2 provision server jvms for load balancing and fail over and roughly 20 app engine jvms spread across 2 data centers (the app engine hosts roughly 3500 end users and we target 200 users per jvm…roughly).

Unsolved Problem 1 – Remote EJB calls across separate local jvm/profiles doesn’t work: Now that you have a high level view of our applications architecture, here’s my first dilema which I haven’t found a solution to. Websphere now has the concept of profiles. Basically a profile equates to a jvm instance. It’s a little more than that, but that’s a good enough understanding for now. So if you want 2 distinct/separate JVMs configured differently, you would need to create 2 profiles and create servers associated with each profile. In all our lifecycles, we have distinct jvms setup for provision and app engine – we don’t cluster the app engine with the provision server because we want our dev/test lifecycles to mirror production, and production is separate because we don’t want a 1:1 correlation of provision server to app engine as the provision server is memory intensive and 2 jvms can handle the entire app engine load very effectively. So I want to replicate that with my RAD 7.5 setup – 1 app engine jvm and 1 provision server jvm running locally within RAD 7.5. That requires 2 separate profiles to be created, then a server defined and associated for each one. No problem. Where I run into problems is at runtime. The app engine makes remote (cross-jvm) EJB calls to the provision server. That requires a JNDI lookup of an EJB remote home object. For some reason, jvm 1 cannot see any JNDI objects that are stored in jvm 2. When I do an initial context and dump out the contents, all I ever get are the local JVM’s name server items. But if I point the local server at one of our test lifecycle provision servers, it sees those just fine. I have no idea why 1 local jvm can’t access another local jvm’s name server. I’m not sure if it’s because of the base version of Websphere that’s running, or some other limitation of the development environment, but that is one hurdle I can’t get over. So my workaround is to just deploy the provision server and app engine in the same jvm as local ejb calls work just fine.

Solved Problem 2 – creating a secure socket for an outbound ssl SOAP request: The app engine is a portal of sorts. It will call any number of external systems to retrieve data and aggregate that data as needed based on the request. There are several system we currently interface and several protocols we use to do so…SOAP over SSL, EJB, JDBD for example. We use apache soap (old, but still works) to call several external systems, one of which is the main system we interface with. In Websphere 5.1 and 6.0, we set our own JKS truststore for the request using the javax.net.ssl.truststore property. This truststore contains the SSL certificates of our target URL. It just worked. Now we move to Websphere 7.0 and the same requests which work in a local WAS 6.o server no longer work. After much digging and reading of documentation, it turns out WAS 6.1 (and 7.0) changed how SSL security was handled. Long story short, when WAS sees a secure socket being created, it assumes responsibility for securing that connection (Big Brother?) instead of letting you do your own thing. Now, there are ways around it, but the point is it is NOT backwards compatible. The quick fix for this was to put the SSL certs in Websphere’s default truststore (go to the admin console, under security and then ssl configuration and you can find a whole bunch of related config). There are several articles on this and I highly recommend reading the Websphere Application Server V7.0 Security Guide for background on this. It is extremely helpful.

More Here

Courtesy:http://bairdblog.wordpress.com/

Multiple webservice implementation classes available at the same time under WAS7

If you want to experiment with webservices by providing several alternative implementations of the same webservice (represented by the element), each having its own URL, and you’re using Websphere 7 and JAX-WS, then:

1. For each alternative implementation, add with a unique name under the element in the WSDL file. Beware: This is essential to enable multiple implementations.
2. For each alternative implementation, define a servlet and servlet mapping in web.xml like this:
view source
print?
1
2 $IMPLEMENTATION_CLASS_NAME$
3 $IMPLEMENTATION_CLASS_NAME$
4 1
5
6
7 $IMPLEMENTATION_CLASS_NAME$
8 /$DESIRED_UNIQUE_URL$
9
3. Create the implementations – likely as POJOs denoted with the @WebService annotation – and set the corresponding portName for each of them (@WebService(portName=””, …))
4. Deploy and use

1. Define a unique wsdl:port for each implementation

As mentioned, it’s necessary to define a unique wsdl:port for each implementation.

We define two ports, LearningActivityPort1 and LearningActivityPort2, using the same port type (i.e. the same transport protocol etc.).

LearningActivity.wsdl:
view source
print?
01
02
03 ...
04 ...
05 ...
06 ...
07
08
09
10
11
12
13
14
15
2. Define a servlet and servlet mapping for each implementation

Next we need to declare each of the webservice implementation classes as a servlet and define a servlet mapping to assign a unique URL to that implementation as described in WAS help:
web.xml:
view source
print?
01
02
05 pokusWeb4was7
06
07
08 LearningActivityHttpBindingImpl
09 example.LearningActivityHttpBindingImpl
10 1
11
12
13 LearningActivityHttpBindingImpl
14 /LearningActivityJaxbService
15
16
17
18 LearningActivityRawXmlServiceImpl
19 example.LearningActivityRawXmlServiceImpl
20 1
21
22
23 LearningActivityRawXmlServiceImpl
24 /LearningActivityRawXmlService
25
26
27 ...
28

When deployed, the two implementation will be thus available under http://localhost:9080/pokusWeb4was7/LearningActivityHttpService and http://localhost:9080/pokusWeb4was7/LearningActivityRawXmlService.
3. Create each implementation linking it to its port name

Finally we write the two implementation, each being assigned to a different port name:
example.LearningActivityHttpBindingImpl:
view source
print?
1 @javax.jws.WebService (serviceName="LearningActivityHttpService", portName="LearningActivityPort1")
2 public class LearningActivityHttpBindingImpl{
3
4 public TransactionResponseMessage updateLearningActivity(LearningActivityMessage learningActivityMsg) {
5 //...
6 return response;
7 }
8 }

example.LearningActivityRawXmlServiceImpl:
view source
print?
1 @javax.jws.WebService (serviceName="LearningActivityHttpService", portName="LearningActivityPort2")
2 public class LearningActivityRawXmlServiceImpl{
3
4 public TransactionResponseMessage updateLearningActivity(LearningActivityMessage learningActivityMsg) {
5 //...
6 return response;
7 }
8 }
Closing notes

Notice that with JAX-WS

* You don’t need webservice.xml – all the necessary information is (may be) provided via annotations
* You don’t need to declare the web services in web.xml unless you need some special configuration (as we do here)

More Here

Courtesy:http://theholyjava.wordpress.com/2010/12/29/tip-multiple-webservice-implementation-classes-available-at-the-same-time-under-was7/

Using Spring and Hibernate with WebSphere Application Server

Summary: If you’re considering using Spring or Hibernate with IBM® WebSphere® Application Server, this article explains how to configure these frameworks for various scenarios with WebSphere Application Server. This article is not an exhaustive review of either framework, but a critical reference to help you successfully implement such scenarios. (Updated with new security information.) This content is part of the IBM

Introduction

The Spring Framework, commonly referred to as Spring, is an open source project that aims to make the J2EE™ environment more accessible. Spring provides a framework for simple Java™ objects that enables them to make use of the J2EE container via wrapper classes and XML configuration. Spring’s objective is to deliver significant benefits to projects by increasing development productivity and runtime performance, while also improving test coverage and application quality.

Hibernate is an open source persistence and query framework that provides object-relational mapping of POJOs (Plain Old Java Objects) to relational database tables, as well as data query and retrieval capabilities.

While many organisations are interested in discovering what benefits they can obtain from using these frameworks, IBM wants customers who do use them to know that they can do so with WebSphere Application Server in a robust and reliable way. This article describes how these frameworks can be used with WebSphere Application Server, and explains best practices for a variety of use cases so that you can get started with Spring or Hibernate as quickly as possible.

Using Spring

Spring is generally described as a lightweight container environment, though it is probably 

more proper to describe it as a framework for simplifying development. The Spring Framework was developed by Interface21, based on publications by Rod Johnson on the dependency injection design pattern. Spring can be used either in standalone applications or with application servers. Its main concept is the use of dependency injection and aspect-oriented programming to simplify and smooth the transitions from development to testing to production.

One of the most often used scenarios involving Spring is to configure and drive business logic using simple Java bean classes. The Spring documentation should provide enough information to build an application using Spring beans; there is nothing WebSphere-specific about this. The following sections describe some of the usage scenarios for using Spring on WebSphere Application Server. Spring applications that are developed following the advice in this article should execute within a WebSphere Application Server or WebSphere Application Server Network Deployment environment with no difficulties.

Except where explicitly stated, the information presented here pertains to Versions 6.0.2.x, 6.1.x, and 7.0.x of WebSphere Application Server on all platforms.

Presentation tier considerations

This section describes considerations relating to the use of Spring in the Web-based presentation tier.

* Web MVC frameworks

Spring’s Web MVC framework is an alternative to other frameworks that have been around for some time. Web MVC frameworks delivered, used, and supported directly by WebSphere Application Server include JavaServer Faces (JSF) and Struts. Spring documentation describes how to integrate Spring with these Web frameworks. Use of any of these MVC is supported by WebSphere Application Server, although IBM will only provide product support for the frameworks shipped with WebSphere Application Server.

* Portlet MVC framework

Spring also provides a Portlet MVC framework (which mirrors the Spring Web MVC framework) and runs in both the WebSphere Portal V6.0 and the WebSphere Application Server V6.1 portlet containers. (See Spring Portlet MVC for an example set of Spring portlets.) Running portlets in the WebSphere Application Server V6.1 portlet container requires that an additional Web application be created to define the layout and aggregation of the portlets. Information on how to use the portlet aggregator tag library can be found in the WebSphere Application Server Information Center and in the article Introducing the portlet container. Using JSF in combination with portlets is a common practice for rendering. For information on how Spring, Hibernate, JSF, and WebSphere Portal can be combined together, see Configuring Hibernate, Spring, Portlets, and OpenInSessionViewFilter with IBM WebSphere Portal.

Data access considerations

This section describes considerations relating to the configuration of Spring beans that access data within a transaction.

The Spring framework essentially wraps Spring beans with a container-management layer that, in a J2EE environment, delegates to the underlying J2EE runtime. Following are descriptions of how Spring beans should be configured so that the Spring Framework properly delegates to (and integrates with) the WebSphere Application Server runtime.

* Accessing data sources configured in WebSphere Application Server

WebSphere Application Server manages the resources used within the application server execution environment. Spring applications that want to access resources, such as JDBC data sources, should utilize WebSphere-managed resources. To do this:

1. During development, the WAR module should be configured with a resource reference. For example:

jdbc/springdb
javax.sql.DataSource
Container
Shareable

2. For EJB JAR files, the same resource-ref should be declared in each EJB that needs to access the data source.

3. A data source proxy bean would then be declared within the Spring application configuration, which references a WebSphere-managed resource provider:

Accessing the data source through this proxy bean will cause the data source to be looked up using the module’s configured references, and hence be properly managed by WebSphere Application Server. Note that the jndiName property value matches the pattern java:comp/env/ concatenated with the res-ref-name declared in the resource-ref.

Alternatively, from Spring 2.5 onwards, this can be done using the approach. Notice how the jndiName property matches the actual value of the res-ref name declared in the resource-ref together with the resource-ref=”true” property:



4. The data source proxy bean may then be used by the Spring application as appropriate.
5. When the application is deployed to a WebSphere Application Server, a resource provider and resource data source must be configured in the normal fashion for use by the Spring application resource reference. The resource reference declared within the module’s deployment descriptor will be bound to the application server’s configured data source during deployment.
* Using JDBC native connections

Spring provides a mechanism for accessing native connections when various JDBC operations require interacting with the native JDBC resource. The Spring JdbcTemplate classes utilize this capability when a NativeJdbcExtractor class has been set on the JdbcTemplate class. Once a NativeJdbcExtractor class has been set, Spring always drills down to the native JDBC connection when used with WebSphere Application Server. This bypasses the following WebSphere quality of service functionality and benefits:
o Connection handle tracking and reassociation
o Connection sharing
o Involvement in transactions
o Connection pool management.

Another problem with this is the WebSphereNativeJdbcExtractor class depends on internal WebSphere adapter classes. These internal classes may differ by WebSphere Application Server version and may change in the future, thereby breaking applications that depend on this functionality.

Use of NativeJdbcExtractor class implementations (for example, WebSphereNativeJdbcExtractor) are not supported on WebSphere Application Server and you should avoid scenarios that require it. The alternative is to use the WebSphere Application Server WSCallHelper class to access non-standard vendor extensions for data sources.
* Using transactions with Spring

WebSphere Application Server provides a robust and scalable environment for transaction processing and for managing connections to resource providers. Connections to JDBC, JMS, and Java Connector resource adapters are managed by WebSphere Application Server regardless of whether or not a global transaction is being used; even in the absence of a global transaction there is always a runtime context within which all resource-provider connections are accessed. WebSphere Application Server refers to this runtime context as a local transaction containment (LTC) scope; there is always an LTC in the absence of a global transaction, and resource access is always managed by the runtime in the presence of either of a global transaction or an LTC. To ensure the integrity of transaction context management (and hence the proper management of transactional resources) WebSphere Application Server does not expose the javax.transaction.TransactionManager interface to applications or application frameworks deployed into WebSphere Application Server.

There are a number of ways to drive resource updates under transactional control in Spring, including both programmatic and declarative forms. The declarative forms have both Java annotation and XML descriptor forms. If you use Spring 2.5 with WebSphere Application Server V6.0.2.19 or V6.1.0.9 or later, you can take advantage of full support for Spring’s declarative transaction model. Spring 2.5 has a new PlatformTransactionManager class for WebSphere Application Server, called WebSphereUowTransactionManager, which takes advantage of WebSphere Application Server’s supported UOWManager interface for transaction context management. Managing transaction demarcation through WebSphere Application Server’s UOWManager class ensures that an appropriate global transaction or LTC context is always available when accessing a resource provider. However, earlier versions of Spring used internal WebSphere interfaces that compromised the ability of the Web and EJB containers to manage resources and are unsupported for application use. This could leave the container in an unknown state, possibly causing data corruption.

Declarative transaction demarcation in Spring 2.5 or later are supported in WebSphere Application Server using the following declaration for the WebSphere transaction support:



A Spring bean referencing this declaration would then use standard Spring dependency injection to use the transaction support, for example:





...



PROPAGATION_REQUIRED



Alternatively, from Spring 2.5 onwards, Spring’s AspectJ support can be utilised. In the following example, can be applied to various parts of the application. This indicates that all methods starting with “get” are PROPAGATION_REQUIRED and all methods starting with “set” are PROPAGATION_REQUIRES_NEW. All other methods use the default transaction settings.









The tag applies those settings to any executed operation defined within the class MyService.






Another alternative mechanism for declaring transaction settings is to use the Spring annotation-based transaction support. This requires the use of Java 5+, and therefore cannot be used with WebSphere Application Server V6.0.2.x.

Add the following to the Spring.xml configuration:



Any methods that require transactional attributes should then be marked with the @Transactional annotation:

@Transactional(readOnly = true)
public String getUserName()
{ ...

Be aware that the @Transactional annotation can only be used to annotate public methods.

The WebSphereUowTransactionManager supports each of the Spring transaction attributes:
o PROPAGATION_REQUIRED
o PROPAGATION_SUPPORTS
o PROPAGATION_MANDATORY
o PROPAGATION_REQUIRES_NEW
o PROPAGATION_NOT_SUPPORTED
o PROPAGATION_NEVER

For earlier versions of Spring that do not provide org.springframework.transaction.jta.WebSphereUowTransactionManager, and for versions of WebSphere Application Server prior to V6.0.2.19 or V6.1.0.9 that do not provide com.ibm.wsspi.uow.UOWManager, transaction support in WebSphere Application Server is available via this Spring configuration:





This configuration supports a restricted set of transaction attributes that does not include PROPAGATION_NOT_SUPPORTED and PROPAGATION_REQUIRES_NEW. The Spring class org.springframework.transaction.jta.WebSphereTransactionManagerFactoryBean, which also claims to provide PROPAGATION_NOT_SUPPORTED and PROPAGATION_REQUIRES_NEW capabilities, uses unsupported internal WebSphere Application Server interfaces and should not be used with WebSphere Application Server.
* Using Spring JMS

Just as with accessing JDBC data sources, Spring applications intended to access JMS destinations must ensure they use WebSphere-managed JMS resource providers. The same pattern of using a Spring JndiObjectFactoryBean as a proxy for a ConnectionFactory will ensure that JMS resources are properly managed.

For JMS message sending or synchronous JMS message receipt, JMSTemplates can be used. This includes the use of Spring’s dynamic destination resolution functionality both via JNDI and true dynamic resolution.

The following example shows the configuration of a resource reference for a ConnectionFactory. This reference is mapped during application deployment to point to a configured, managed ConnectionFactory stored in the application server’s JNDI namespace. The ConnectionFactory is required to perform messaging and should be injected into the Spring JMSTemplate.


jms/myCF
javax.jms.ConnectionFactory
Container
Shareable


There is now a defined JNDI name for your ConnectionFactory within the application that can be looked up and injected into the JMSTemplate:










...








At run time, the JMSTemplate can locate destinations based on either their JNDI name (as configured in an application resource reference) or through “dynamic resolution,” based on the administrative name of the destination configured in WebSphere Application Server; for example, for the JMS myQueue queue, bound to a JNDI reference of jms/myQueue:

JNDI resolution:
jmsTemplate.send("java:comp/env/jms/myQueue", messageCreator);

Dynamic resolution:
jmsTemplate.send("myQueue", messageCreator);

As an alternative to J2EE message-driven beans (MDBs), Spring provides a message-driven POJO model for processing inbound JMS messages asynchronously. Only a DefaultMessageListenerContainer class will manage messages from the JMS queue to the configured POJO that must be a javax.jms.MessageListener implementation.

In a WebSphere Application Server environment, you must also specify a WorkManagerTaskExecutor class, which means the DefaultMessageListenerContainer class will delegate to a server-managed thread pool. The DefaultMessageListenerContainer should also be configured with the server’s transaction management via the WebSphereUowTransactionManager, as described above.





















While this message-driven POJO model can be used, it is recommended that J2EE message-driven beans (MDBs) be used directly in WebSphere Application Server configurations that require workload management and/or high availability. Be aware that no other Spring JMS MessageListenerContainer types are supported, as they can start unmanaged threads and might also use JMS APIs that should not be called by applications in a Java EE environment.
* Using JPA with Spring

The EJB 3.0 specification defines the Java Persistence API (JPA) as the means for providing portable persistent Java entities. WebSphere Application Server V7 and the WebSphere Application Server V6.1 EJB 3 feature pack both provide implementations of EJB 3 and JPA; it is also possible to use the Apache OpenJPA implementation of JPA with WebSphere Application Server V6.1 (see Resources). When Spring is used in conjunction with a JPA implementation, you should use JPA directly rather than using Spring’s JPA helper classes (in the org.springframework.orm.jpa package).

WebSphere Application Server V6.1 and later supports JPA application-managed entity managers, which might have a transaction type of either JTA or resource-local. JTA entity manager uses the application server’s underlying JTA transaction support, for which transaction demarcation can be defined using either standard J2EE techniques or Spring’s declarative transaction model, as described above.

A data access object (DAO) that uses JPA is packaged with a persistence.xml that defines persistence context for the JPA EntityManager used by the application. For example, a persistence.xml for a JTA entity manager that uses the data source with a JNDI name “java:comp/env/jdbc/springdb” can be set up like this:



org.apache.openjpa.persistence.PersistenceProviderImpl
java:comp/env/jdbc/springdb








By setting the openjpa.TransactionMode and openjpa.ConnectionFactoryMode properties to “managed,” the JPA entity manager delegates management of transactions and connections to WebSphere Application Server. The DAO may use Spring’s declarative transaction demarcation as described above.

Annotation style injection of a JPA EntityManager is also possible. This is identical to standard JPA:

@PersistenceContext
private EntityManager em;

You need this XML code to turn on EntityManager injection in the Spring XML configuration:




Spring will create an EntityManager from any EntityManagerFactory defined in this XML file. If more than one exists, then it will fail. Use one (and only one) of these ways to create an EntityManagerFactory:
o Using Spring’s basic configuration





o Using Spring’s advanced configuration







Of course, the benefits of annotations and JPA are also available by using the pure EJB 3 support in WebSphere Application Server V7 and the WebSphere Application Server V6.1 EJB 3 Feature Pack. In either case, you can create an EntityManagerFactory using the JPA API, as shown below. This approach is not recommended for a non-EJB 3 environment, because any EntityManagers created might not be properly managed. However, when you do have an EJB 3 environment, you can use this approach to separate your Spring and JPA configurations.


* Spring EntityManagerFactory and JPA When using JPA, there is a conflict in the Spring EntityManagerFactory that requires configuring the entityManagerFactoryInterface property. This issue and its resolution are documented on the Spring Web site. * IBM JDK 6 WebSphere Application Server V7 runs on IBM JDK 6, which cannot be used with versions of the Spring framework prior to V2.5.5, due to a Spring problem documented within this JIRA. Spring security considerations Spring provides a security framework that differs significantly from the standard Java EE security framework. In some cases, this framework can rely on the underlying Java EE security runtime, and in other cases, the Spring security framework completely replaces it. The Spring implementation of an authentication provider enables integration with the container, but only at the level of calling a specific subroutine, org.springframework.web.filter.DelegatingFilterProxy, which is implemented as a servlet filter and configured in web.xml for the url pattern /* so that it gets called on every request. In terms of applicability to WebSphere Application Server authentication, see this article on the WebSphere Application Server authentication process and various options for extending or customizing WebSphere Application Server authentication before you proceed with any of the three common use patterns listed below — or any other implementation using org.springframework.web.filter.DelegatingFilterProxy: * The servlet filter is employed to replace J2EE container security. In this case, WebSphere Application Server J2EE security is not used. Either security is not enabled, or, if it is employed, no J2EE authorization constraint is defined in the web.xml. Spring security has its own security context (stored in the HTTP session for a user, by default) and uses GrantedAuthority objects to determine a user’s permissions on resources. The Spring security context is used for all authorization decisions. Since there is no Java EE security context, none of the WebSphere Application Server security features (such as, authorization, SSO integration with proxies, Java EE application SSO, SPNEGO integration, identity propagation to EJBs, services, databases, and so on) apply. * The servlet filter is used in conjunction with a Spring “pre-authenticated authentication provider,” which is conceptually similar to a WebSphere Application Server Trust Association (TAI). Here, J2EE security is enabled and there is a J2EE authorization constraint in the web.xml, so normal container authentication takes place. The pre-authenticated authentication provider extracts the username from the runtime and then calls isUserInRole() on a set of predefined roles. These roles are mapped to GrantedAuthority objects, and from then on the Spring security context is used. In this case, there is a valid Java EE security context and WebSphere Application Server security features are available — with the caveat that Spring-specific security features might or might not honor WebSphere Application Server security behavior. One such example is that it is possible to change the identity on a thread using WebSphere Application Server APIs, but that behavior may or may not be consistent when Spring security is employed. * The servlet filter is used in conjunction with a Spring JAAS authentication provider. As with the first case listed, WebSphere Application Server J2EE security is likely not even enabled, or, if it is, there is no J2EE authorization constraint defined in the web.xml. However, the actual task of authenticating the credentials obtained by the filter is delegated to the container by use of what is (from the WebSphere Application Server point of view) an application JAAS login. The login module and login configuration used are specific to the container in use, and Spring callback handlers are supplied to provide the username and password of the user. When the login is complete, the principals are obtained from the subject using loginContext().getSubject().getPrincipals(), and they are passed to a piece of code called an AuthorityGranter, which decides what GrantedAuthority objects to grant based on the Principal objects; be aware that the GrantedAuthority objects are not based on J2EE roles here. From here on, the Spring security context is used. However, from a WebSphere Application Server security perspective, the ltpaLoginModule is only a small part of the security runtime and this module is not designed to be called in isolation; rather, it is designed to be called as part of a login configuration to instantiate a JAAS subject. The actual instantiation of the JAAS subject is done by a second module, com.ibm.ws.security.server.lm.wsMapDefaultInboundLoginModule. It is only after this second login module is called that a WebSphere Application Server security context is created. As a result, because the WebSphere Application Server login module in question is not intended to be used this way, using it directly in the manner described has unpredictable consequences. Moreover, users implementing this approach have encountered serious performance issues, in addition to suffering from the same limitations mentioned in the first pattern. Of these, only the second use case listed above can be considered true “integration” because J2EE security is used for authentication and the Spring security context is used for subsequent authorization — although since the Spring security context is stored by default in the HTTP session (which is a security anti-pattern because HTTP session is not secure), you should steer clear of the default. If you choose to employ this pattern, you must to go to extra lengths to protect the session — which is not normally considered to be part of the security infrastructure; for example, you’ll need to protect the session cookie and should enable WebSphere Application Server session security integration. (See WebSphere Application Server V7 advanced security hardening for more.) Rather than storing Spring security context in an HTTP session, a better option would be to extend Spring to store the context in the JAAS subject instead, which will require additional custom development. As mentioned elsewhere in this article, this guidance should not be considered to be exhaustive. The points presented here with respect to Spring security do not constitute a discussion of all possible implications of using Spring security; rather, it is simply a list of issues that users have encountered from the inappropriate use of Spring security. While it might be possible to extend Spring security to provide reasonably secure integration with WebSphere Application Server and other Java EE applications that do not use Spring, you should always leverage the security implementation provided by WebSphere Application Server for applications running in WebSphere Application Server. Not only will this ensure robust and reliable security integration, but the security that is provided will be fully supported within WebSphere Application Server. One feature of Spring security that users seem to like is the authorization framework, which goes beyond what native Java EE authorization provides. If this is your primary reason for considering Spring security, you should investigate other, less disruptive options, such as IBM Tivoli Security Policy Manager or writing your own custom authorization, perhaps using your own access control lists. Using HttpSessionContextIntegrationFilter and forceEagerSessionCreation You should always use WebSphere Application Server security mechanisms to secure your WebSphere Application Server applications. If you use the Spring Security filter HttpSessionContextIntegrationFilter, however, here is a problem scenario you should watch for. HttpSessionContextIntegrationFilter executes after the call to the WebSphere Application Server server-side application code has been made; for example, the filter runs after a call to index.jsp has been made, which returns response data. As a result, the response will already have been committed when the call to create a session is reached in the Spring filter, and so the HTTP headers have already been returned. Since a Set-Cookie header must be added to the HTTP response, and the response has already been sent, a Java EE compliant container (such as WebSphere Application Server) might throw an IllegalStateException causing the Set-Cookie to fail. It has been observed that this exception is suppressed in at least some versions of Spring Security, which might lead to a NullPointerException later on — making it very difficult to determine exactly what happened. To avoid this problem, you can set the forceEagerSessionCreation option on the HttpSessionContextIntegrationFilter entry to true in your Spring configuration: Integration and management considerations * JMX and MBeans Spring JMX MBeans are supported on WebSphere Application Server V6.1 and later only when registered with WebSphere Application Server’s container manager MBeanServer. If no server property is specified, the MBeanExporter tries to automatically detect a running MBeanServer. When running an application in WebSphere Application Server, the Spring framework will therefore locate the container’s MBeanServer. You should not use MBeanServerFactory to instantiate an MBeanServer and then inject it into the MBeanExporter. Furthermore, the use of Spring’s ConnectorServerFactoryMBean or JMXConnectorServer to expose the local MBeanServer to clients by opening inbound JMX ports is not supported with WebSphere Application Server. Spring JMX MBeans are not supported on WebSphere Application Server prior to Version 6.1. * Registering Spring MBeans in WebSphere Application Server WebSphere Application Server MBeans are identified by a javax.management.ObjectName when they are registered that looks like this: WebSphere:cell=99T73GDNode01Cell,name=JmxTestBean,node=99T73GDNode01, process=server1,type=JmxTestBeanImpl This means that when they are de-registered, they need to be looked up with the same “fully qualified” name, rather than the simple name property of MBean. The best approach is to implement org.springframework.jmx.export.naming.ObjectNamingStrategy, which is an interface that encapsulates the creation of ObjectName instances and is used by the MBeanExporter to obtain ObjectNames when registering beans. An example is available on the Spring Framework forum. You can add the ObjectNamingStrategy instance to the bean that you register. This will ensure that the MBean is properly de-registered when the application is uninstalled. ... * MBeans ObjectNames and notifications Due to the use of a fully qualified ObjectName for MBeans in WebSphere Application Server, you are advised to fully define that ObjectName to use notifications. This JIRA enables the Spring bean name to be used instead and should provide a fix, but only if you are on the appropriate version of Spring. * System z multicall/unicall limitation As Spring doesn’t allow the specification of platform-specific fields in the MBean descriptor, Spring JMX will work on multi-SR servers on WebSphere Application Server V6.1, but you are restricted in your deployment options. WebSphere Application Server will default to the unicall strategy so that only one instance of the MBean (in one, indeterminate SR) will be asked to execute a request. This may be sufficient in some scenarios but it is more likely that an application will require the ability to declare a combination of multicall and unicall methods, and possibly result in aggregation logic. * Scheduling and thread pooling Spring provides a number of TaskExecutor classes that can be used for scheduling work. The only Spring TaskExecutor that is supported by WebSphere Application Server for executing work asynchronously is the Spring WorkManagerTaskExecutor class, which properly utilizes thread pools managed by WebSphere Application Server and delegates to a configured WorkManager. Other TaskExecutor implementations might start unmanaged threads. You can setup a WorkManager within the WebSphere Application Server administrative console by navigating to Resources => Asynchronous beans => Work managers . The JNDI name for the resource can then be used in the Spring config file as a workManagerName property to define a WorkManagerTaskExecutor. This example uses WebSphere Application Server’s DefaultWorkManager JNDI name or wm/default: * Classloaders Spring and WebSphere Application Server both use several open source projects and, unfortunately, the versions of the projects they have in common won’t always match. Spring dependencies should be packaged as part of the application, and the server should be setup as described below to avoid conflicts. Otherwise, the classloaders may not load the appropriate version either for the runtime or for the application. Usually, this will cause exceptions to appear in the log regarding version mismatches of classes, ClassCastExceptions, or java.lang.VerifyErrors. One example is the use of Jakarta Commons Logging. Configuring Jakarta Commons Logging (JCL) for application use, or utilizing a different version of JCL than is provided by the application server (for example, embedded with the application code) requires specialized configuration on WebSphere Application Server. See Integrating Jakarta Commons Logging for strategies on how to configure a deployed application to use an embedded version of commonly used technologies. Keep an eye on the support Web site for updates on how to configure embedded JCL on WebSphere Application Server V6.x products. This is just one example of conflicts. Others might include application use of JDOM or specific versions of JavaMail. Replacement of WebSphere Application Server’s JAR files with these or other packages with later or different versions is not supported. Another classloader problem that may plague Spring users on WebSphere Application Server is the way Spring loads resources. Resources can include things such as message bundles, and with the classloader hierarchy and various policies for locating resources within the hierarchy, it is possible for resources using a common name to be found in an unintended location. The WebSphere Application Server classloader viewer can be used to help resolve this problem. The combination of this and other versions of common libraries may require that the application rename resources to a unique name. The example explained by James Estes on the Spring forum contains an EJB project and a Web project packaged into an EAR file. The solution described is to add the spring.jar file into both the WEB-INF/lib and the top level of the EAR, then set the classloader policy for the WEB project to PARENT LAST so that it finds the version in WEB-INF/lib first. The EJB project uses the version in the EAR. Design considerations Some of the infrastructure services provided by the Spring Framework replicate services provided by a standards-based application server runtime. Furthermore, the abstraction of the Spring framework infrastructure from the underlying J2EE application server necessarily weakens the integration with application server runtime qualities of service, such as security, workload management, and high availability. As a result, using the Spring Framework in applications deployed into the WebSphere Application Server must be carefully considered during application design to avoid negating any of the qualities of service provided by WebSphere Application Server. Where no other recommendation is made, directly using the services provided by WebSphere Application Server is preferred in order to develop applications based on open standards and ensure future flexibility in deployment. * Unmanaged threads There are some Spring scenarios that can lead to unmanaged thread creation. Unmanaged threads are unknown to WebSphere Application Server and do not have access to Java EE contextual information. In addition, they can use resources without WebSphere Application Server knowing about it, exist without an administrator’s ability to control their number and resource usage, and impede on the application server’s ability to gracefully shutdown or recover resources from failure. Applications should avoid any scenario that causes unmanaged threads to be started, such as: o registerShutdownHook Avoid using the Spring AbstractApplicationContext or one of its subclasses. There is a public method, registerShutdownHook, that creates a thread and registers it with the Java VM to run on shutdown to close the ApplicationContext. Applications can avoid this by utilizing the normal lifecycle notices they receive from the WebSphere container to explicitly call close on the ApplicationContext. o WeakReferenceMonitor Spring provides convenience classes for simplified development of EJB components, but be aware that these convenience classes spawn off an unmanaged thread, used by the WeakReferenceMonitor, for cleanup purposes. * Scheduling Spring provides (or integrates with) a number of scheduling packages, but the only Spring scheduling package that works with threads managed by WebSphere Application Server is the CommonJ WorkManager. Other packages, such as quartz and the JDK Timer, start unmanaged threads and should be avoided. Back to top Using Hibernate Hibernate is an open source persistence framework for POJOs, providing object-relational mapping of POJOs to relational database tables using XML configuration files. The Hibernate framework is a data access abstraction layer that is called by your application for data persistence. Additionally, Hibernate provides for the mapping from Java classes to database tables (and from Java data types to SQL data types), as well as data query and retrieval capabilities. Hibernate generates the requisite SQL calls and also takes care of result set handling and object conversion. Hibernate, like OpenJPA, implements the Java Persistence APIs (JPA) specification, which is a mandatory part of Java EE 5. (See Resources for developerWorks articles on using Hibernate.) Usage scenarios The following scenarios describe some of the possible scenarios for how to use Hibernate with WebSphere Application Server and WebSphere stack products. These are only example scenarios and should not be considered recommended scenarios. * Use a WebSphere Application Server data source In order for Hibernate to get database connections from WebSphere Application Server, it must use a resource reference, as mandated by the Java EE (formerly known as J2EE) specification. This ensures WebSphere Application Server can provide the correct behavior for connection pooling, transaction semantics, and isolation levels. Hibernate is configured to retrieve a data source from WebSphere Application Server by setting the hibernate.connection.datasource property (defined in the Hibernate configuration file) to refer to a resource reference (for example, java:comp/env/jdbc/myDSRef) defined in the module’s deployment descriptor. For example: java:/comp/env/jdbc/myDSRef Java EE resource references for Web applications are defined at the WAR file level, which means all servlets and Java classes within the container share the resource reference. Inside of an EJB module, resource references are defined on the individual EJB components. This means that, if many EJB components use the same Hibernate configuration, each EJB must define the same reference name on each EJB component. This can lead to complications that will be discussed a bit later. Once a data source is configured, one of the next steps to ensure that Hibernate works correctly is to properly configure transaction support. * Transaction strategy configuration Hibernate requires the configuration of two essential pieces in order to properly run with transactions. The first, hibernate.transaction.factory_class, defines transactional control and the second, hibernate.transaction.manager_lookup_class, defines the mechanism for registration of transaction synchronization so the persistence manager is notified at transaction end when it needs to synchronize changes with the database. For transactional control, both container-managed and bean-managed configurations are supported. The following properties must be set in Hibernate.cfg.xml when using Hibernate with WebSphere Application Server: o for container-managed transactions: org.hibernate.transaction.CMTTransactionFactory org.hibernate.transaction.WebSphereExtendedJTATransactionLookup o for bean-managed transactions: org.hibernate.transaction.JTATransactionFactory org.hibernate.transaction.WebSphereExtendedJTATransactionLookup java:comp/UserTransaction
The jta.UserTransaction property configures the factory class to obtain an instance of a UserTransaction object instance from the WebSphere container.

The hibernate.transaction.manager_lookup_class property is supported on the WebSphere platform by WebSphere Application Server V6.x and later, and on WebSphere Business Integration Server Foundation V5.1 and later. This property configures Hibernate to use the ExtendedJTATransaction interface, which was introduced in WebSphere Business Integration Server Foundation V5.1 and WebSphere Application Server V6.0. The WebSphere ExtendedJTATransaction interface establishes a pattern that is formalized in Java EE 5 via the JTA 1.1 specification.
* Unsupported transaction configurations

The Hibernate documentation describes transaction strategy configurations for running on WebSphere Application Server Versions 4 and 5 products; however, these configurations use internal WebSphere interfaces and are not supported on those earlier versions. The only supported transaction configuration of Hibernate is described above, which means, as stated earlier, Hibernate usage is only supported on WebSphere Business Integration Server Foundation V5.1 and on WebSphere Application Server Version 6.x and later.
* Hibernate’s usage patterns within a WebSphere Application Server environment

Hibernate’s session-per-request and long conversation patterns are both available when using Hibernate with WebSphere Application Server. Customers must choose which is appropriate for their application, though it is our opinion that session-per-request offers better scalability.
o Multiple isolation levels

Sharable connections provide a performance improvement in WebSphere Application Server by enabling multiple resource users to share existing connections. However, if sharable connections and multiple isolation levels are both necessary, then define a separate resource-ref and Hibernate session-factory for each connection configuration. It is not possible to change the isolation level of a shared connection. Therefore, it is also not possible to use the hibernate.connection.isolation property to set the isolation level on a sharable connection. See Sharing connections in WebSphere Application Server V5 for more information on policies and constraints on connection sharing. (Although this article generally pertains to all shared connection use on WebSphere Application Server V5, the connection sharing advice still follows for Hibernate running on V6.x.)
o Web applications

Hibernate long conversation sessions can be used and stored in HttpSession objects; however, a Hibernate session holds active instances and, therefore, storing it in an HttpSession may not be a scalable pattern since sessions may need to be serialized or replicated to additional cluster members. It is better to use HttpSession to store disconnected objects (as long as they are small, meaning 10KB to 50KB) and re-associate them with a new Hibernate session when an update is needed. This is because HttpSession is best used for bookmarking and not caching. A discussion on how to minimize memory use in HttpSession is contained in Improving HttpSession Performance with Smart Serialization. Instead of using HttpSession as a cache, consider using a WebSphere data caching technology like ObjectGrid or DistributedObjectCache, as described in the next section.

For best practices on high performing and scalable applications, the book Performance Analysis for Java Websites is strongly recommended.

At the time of publication, the behavior of Hibernate’s cluster aware caches in conjunction with WebSphere Application Server has not been determined; therefore, it is not yet determined whether or not their use is supported and we will not discuss them further. As a result, customers requiring a distributed cache should consider creating a class that implements org.hibernate.cache.CacheProvider using the property hibernate.cache.provider_class, which employs one of the two distributed cache implementations in WebSphere.

* Integrating a second-level cache

A Hibernate session represents a scoping for a unit of work. The Session interface manages persistence during the lifecycle of a Hibernate session. Generally, it does this by maintaining awareness or state of the mapped entity class instances it is responsible for by keeping a first-level cache of instances, valid for a single thread. The cache goes away when the unit of work (session) is completed. A second-level cache also can be configured to be shared among all sessions of the SessionFactory, including across a cluster. Be aware that caching in Hibernate raises issues that will need to be addressed. First, no effort is made to ensure the cache is consistent, either with external changes to the database or across a cluster (unless using a cluster aware cache). Second, other layers (such as the database) may already cache, minimizing the value of a Hibernate cache. These issues must be carefully considered in the application design, but they are beyond the scope of this article.

Hibernate comes with several pre-configured caches. You can find information on them in the Hibernate Cache documentation pages. For read-only data, one of the in-memory caches might be enough. However, when the application is clustered and a cluster aware cache is needed, the local read-only caches are not enough. If a distributed cache is desired, we recommend using one of the WebSphere-provided distributed cache implementations. These can be used as a second level cache with Hibernate:
o The DistributedMap/DistributedObjectCache interfaces provide distributed cache support the WebSphere v6.x product family. See Using the DistributedMap and DistributedObjectCache interfaces for the dynamic cache for more information.
o ObjectGrid, available as part of the WebSphere Extended Deployment product, provides extensible object caching support. See ObjectGrid for more information.
* Using Hibernate in WebSphere Enterprise Service Bus and WebSphere Process Server

WebSphere Process Server and WebSphere Enterprise Service Bus (ESB) rely on the Service Component Architecture (SCA) and Service Data Objects (SDO) as an assembly and programming model for SOA. (See Resources to learn more about SCA and SDO.) SCA components are not Java EE components, so they do not have resource references, but rely instead on services and adapters to connect to systems. Resource references cannot be used when building Java SCA components; therefore, Hibernate cannot be used directly by an SCA component.

In this case, Hibernate persistence should be hidden behind some kind of facade. There are two alternatives:
o A local EJB session facade is created to wrap Hibernate persistence. The session facade provides adapter logic to map Hibernate entity POJOs to Service Data Objects and back. An integration developer can then use an EJB import to invoke the session facade, and invoke it in a tightly coupled fashion with corresponding Qualities of Service (QoS).
o An EJB Web service session facade is created to wrap Hibernate persistence. An integration developer can then use a Web service import to invoke the Web service for persistence. This gets around having to build POJO to SDO converters, since at the current time SCA only uses SDO for data types. Figure 1 illustrates a business process using both patterns, though the details of the process are beyond the scope of this article.

Figure 1. Sample business process
Figure 1. Sample business process
* Hibernate JPA API on WebSphere Application Server V6.1

Hibernate’s JPA support provides for JPA standard persistence and is a good alternative to the proprietary Hibernate APIs. Hibernate’s JPA implementation requires a Java SE 5 based runtime, and therefore only runs on WebSphere Application Server V6.1 or later. At the time of publication, Hibernate’s JPA support does not run on WebSphere System z or iSeries platforms. The Hibernate documentation describes how to package and deploy applications using Hibernate’s JPA implementation.
* Non-interoperable / Non-portable function

Section 3.2.4.2 in the JPA specification describes a scenario that is likely to cause interoperability and potential portability problems. This has to do with the combination of the use of lazy loading (that is, @Basic(fetch=LAZY)) and detached objects. When merging a detached object back into a session, JPA will examine the object and update the data store with any changed values. However, data objects are simple POJOs. If part of the POJO state wasn’t loaded when it was detached, it can appear to be changed when it is merged back in. To get this to work correctly, vendors must implement serialization techniques specific to their runtime. This is not interoperable and the semantics may not be portable either.

Back to top

Product and customer technical support

An area of reasonable concern for users is support of projects using open source and the impact of that usage upon a vendor’s support for its licensed products. IBM recognizes that some customers may desire to use non-IBM frameworks in conjunction with IBM WebSphere Application Server and is providing information to customers that may promote the creation of the most reliable operating environment for IBM WebSphere Application Server. IBM considers open source code and application frameworks installed by customers, either bundled as part of the application or as shared libraries, to be part of application code. By carefully utilizing this information when using open source projects, customers may use IBM products with a higher degree of confidence that they may have continued access to IBM product and technical support. If a problem is encountered when using these frameworks with WebSphere products, IBM will make reasonable efforts to ensure the problem does not lie with the WebSphere product.

It is expected that customers may safely use frameworks such as Spring and Hibernate on IBM products by observing the suggestions of this article and understanding a few key points:

* Customers must ensure that they only use those frameworks in ways that are allowed by WebSphere Application Server. In particular, this means that frameworks should not be used when they use internal product interfaces — unfortunately many open source frameworks do this when not configured carefully. Customers should avoid scenarios clearly documented as things to avoid on WebSphere.
* For open source frameworks, customers should ensure they understand and have access to matching source code and binaries for the framework they are using with WebSphere Application Server.
* Customers are encouraged to obtain corrective service for the frameworks from the open source community or from partners working with the open source community.

For more details on IBM support and policy please refer to the IBM Support Handbook and WebSphere Application Server Support Statement.

Although following the suggested practices of this article will help you enhance your experience when using WebSphere Application Servers in an open source environment, it is not an all inclusive list of ways in which an open source component may impact WebSphere Application Server operation or the operation of other components. Users of open source code are urged to review the specifications of all components to avoid licensing, support, and technical issues.

Throughout this article, the terms “support” or “supported” indicates that the usage being described uses only IBM documented functionality. The authors have done their best to provide advice on how to configure and use these frameworks to ensure that their usage is consistent with documented product behavior, but this article is neither an endorsement nor a statement of support for Spring or Hibernate.

More Here

Courtesy:http://skysoftarchive.wordpress.com/2010/11/21/using-spring-and-hibernate-with-websphere-application-server/

WebSphere Interview Questions

1) Explain about web sphere?

The word web sphere popularly refers to IBM middleware technology products. Web sphere is known for its turn key operation in e business applications. It has run time components and tools which can help in creating applications which run on WAS. WAS refers to web sphere application server.

2) Explain about web sphere commerce?

IBM web sphere commerce has a single platform which offers complete ecommerce solutions to developers. It can be very productive if you are planning to do business with consumers, business and indirectly through channel partners. This can be used to perform business with consumers, business and channel partners altogether.

3) Detail about the architecture of web sphere?

Web Sphere is built on three main components they are

• Database

• J2EE application server

• A web server

The databases which it supports are

• DB2

• Oracle

• Cloudscape

Application server is IBMWAS and the supported web servers are

• IBM server

• Microsoft IIS

• Sun web server

4) State some of the features present in web sphere?

Some of the features which are present in web sphere are: -

• Order management

• Web sphere commerce accelerator

• Analytical and business intelligence

• Open standards such as Java, EJB, etc

• Web sphere commerce payments and customer care, etc

5) Explain about IBM Web Sphere edge server?

Web sphere edge server is used to improve the performance of web based systems. It can be used as forward or proxy server. Basically four components are present in the web sphere they are Network dispatcher, Caching proxy, Content distribution and application service at the edge.

6) Explain about extended deployment?

Web sphere application server extended deployment increases the functionality of the server in two main areas they are manageability and performance. Dynamic virtualization between servers is possible with the help of XD. A stand alone distributed cache was added to it under the performance header, it is known as Object Grid.

7) Explain about the security features present in WAS?

Security model for web sphere is primarily based on JAVA EE security model. It also depends upon the operating system. User authentication and authorization mechanisms are also provided in WAS. Light weight third party authentication mechanism is the main security feature present in WAS.

8) Explain about asymmetric clustering?

Asymmetric clustering applications are primarily used in electronic trading systems employed in banks. Some of the features are, partitions can be declared during run time and are usually run on a single cluster at a time. Work specific to a particular can be routed to that cluster.

9) Explain the various Administrator benefits using Web sphere?

Web sphere almost reduces the work of server administrator as he can manage load on servers efficiently without any hassles. It also gives him flexibility to divide the load and applications among different server farms. He can also predict about the incoming load on servers. Email alerts, restart options, memory leak detection, etc.

10) Explain about caching proxy of IBM Web sphere Edge sphere?

A caching proxy can be configured in forward direction or as a proxy. Content requested by the user is cached by edge before sending or adhering to the query. Page fragments arising from JSP or servlets are cached by Edge and the caching process is slow. Performance and scalability of J2EE applications can be increased by edge.

11) Explain about the network deployment feature present in WAS?

Managing singletons will be a thing of the past and it also provides hot recovery of singletons which makes you forget about your GC collected singletons. Transaction logs can stored on a shared file system. For clustering run time operations deployment manager`s role was eliminated. J2EE failover support and cell configuration support is also present.

12) Explain about IBM web sphere integration developer?

Web sphere integration developer provides an IDE to build applications based on service oriented architecture. Web sphere process server and web sphere ESB were built with WID. WID was built with RAD Eclipse based technology.

13) Explain about compute Grid?

Compute grid is also known as Web sphere batch. Web sphere extended deployment offers a Java batch processing system called as Compute Grid. This forms an additional feature to Web sphere network environment. Various features are provided which help a developer to create, manage and execute batch jobs. Job scheduler, xJCL, batch container and batch programming controller.

14) Explain about web sphere MQ Real time transport?

This feature is very useful in instant messaging across different clients through intranet and internet. This supports high volume and high performance across different clients. It uses the concept of light weight transport which is again based on IP rather than the queue process.

15) Explain about Web sphere MQ JMS Provider?

Web sphere MQ and Web Sphere Business integration manager Broker are very useful in providing Java messaging services to wide range of clients (publisher –subscribe, point to point). Java classes are chiefly responsible for translating the API calls to API`s defined by web sphere. It is very useful to have knowledge of Web sphere MQ for proper configuration.

16) Explain the attribute CHANNEL in web sphere MQ?

CHANNEL specifies the name of the server connection channel. Generally this is Web Sphere MQ network abstraction. The default standard used by CHANNEL is SVRCONN which is the server connection channel. This server is generally used to communicate to the queue manager by the client.

17) Is the naming of connection factory independent of the name specified by JMS client?

Yes, the naming of connection factory is independent of the name specified by JMS client. This is made possible by WAS (Web sphere application server) with its resource references. It isolates the application from object names. This feature is important because it gives us the flexibility to change the administered object without changing the JMS client code.

18) What is the difference between Web Server and Application Server ?

Webserver:

A Web server handles the HTTP protocol. When the Web server receives an HTTP request, it responds with an HTTP response, such as sending back an HTML page. To process a request, a Web server may respond with a static HTML page or image, send a redirect, or delegate the dynamic response generation to some other program such as CGI scripts, JSPs (JavaServer Pages), servlets, ASPs (Active Server Pages), server-side JavaScripts, or some other server-side technology. Whatever their purpose, such server-side programs generate a response, most often in HTML, for viewing in a Web browser.

Application Server:

As for the application server, according to our definition, an application server exposes business logic to client applications through various protocols, possibly including HTTP. While a Web server mainly deals with sending HTML for display in a Web browser, an application server provides access to business logic for use by client application programs. The application program can use this logic just as it would call a method on an object

19) What is JDBC ?

JDBC technology is an API (included in both J2SE and J2EE releases) that provides cross-DBMS connectivity to a wide range of SQL databases and access to other tabular data sources, such as spreadsheets or flat files. With a JDBC technology-enabled driver, you can connect all corporate data even in a heterogeneous environment

20) What is EJB ?

Enterprise JavaBeans (EJB) technology is the server-side component architecture for the Java 2 Platform, Enterprise Edition (J2EE) platform. EJB technology enables rapid and simplified development of distributed, transactional, secure and portable applications based on Java technology.

21) What are the different application servers and Web Servers supporting J2EE technology’s ?

JBoss Is an Application Server that supports J2EE

IBM Websphere and BEA WebLogic servers are a combination of Application Server, Web Server & container

Jakarta Tomcat is a Servlet container and a Web server.

Apache Sever is a Web server

22. What is the WebSphere Application Server Console and what is it’s role? What is the default URL and port for accessing it?

The administrative console is a browser-based interface that allows you to configure application server settings, deploy and manage applications, and perform additional tasks that are not included in the HTTP Server Administration interface. It used to be a Java application, however to be firewall safe it was made into a web-based application.

It runs on the default install port 9060 e.g http:\\hostname:9060\ibm\console, however this can be changed by editing virtual_hosts names. also when during installation ie GUI or response-file install you can set the ports that will be used.

23. What Development Environment(s) are available to develop applications for WebSphere?

IBM provides several industrial strength development environments based on Eclipse development framework the current IDE is Rational Developer for Websphere. Applications can also be developed with the Websphere Application Server Toolkit and third party tools like Jbuilder, and Eclipse/ANT etc.

24. In WebSphere how would you provide the ability for an Web application (JSP) to be able to provide authentication for both a local user and LDAP.

Using the Administration Console:

Turn on Administrative security.

Federate a local repository and an LDAP repository together.

Restart server.

Ensure Web application has a web.xml file to be able assign LDAP groups to roles.

25. What version of Websphere software is required to install WebSphere clustering? How would you configure Websphere for clustering: list basic steps?

WebSphere Application Server Network Deployment is the software required to install a WebSphere cluster.

Install base with Deployment Manager

Create profiles for Deployment Manager and each node in the cell using with the Profile Management Tool ensuring the nodes are federated.

Use the Deployment Manager’s Administration Console to create the cluster and set cluster settings as appropriate.

Create Windows Services or Start up scripts for Deployment Manager, Node manager and Severs to ensure restart when OS is rebooted.

26. How would you ensure that a Websphere Application server or Websphere Application Server Node is started when the OS being windows 2000/2003 is re-booted?

Use the command WASService to register the Websphere Application Server or Websphere Application node as a Windows service.

27. What language is the default scripting language for Websphere and which language is the preferred scripting language? What Websphere tool can be used to run scripts and where is it located?

JACL is the default scripting language for WAS, Both JACL and Jython can be used.

Jython is the preferred scripting language as JACL is now deprecated.

WSAdmin tool located in the \bin directory

28. What type of files are required to deploy an application into Websphere. How can they be installed?

WAR or EAR files.

Can be installed using Administration Console or scripts.

29. How would use ensure WebSphere server logs are created on a different drive than the installation root?

Change the WebSphere server’s server variables using the Administrative Console or use scripts.



Web Sphere Application Server 6.1

Questions and Answers

QUESTION 1

A cluster member has suddenly crashed. The administrator is concerned about aborted transactions holding locks in the database. What can an administrator do to release the locks?

1. Unmount the shared file system such as Network Attached Storage (NAS) where the transaction log is stored
2. Restart the deployment manager and node agents who manage the transaction log
3. Verify another running cluster member has access to the transaction log
4. Reconnect the database where the transaction log is stored

Answer: C

QUESTION 2

What functionality does the Caching Proxy server provide?

1. Reverse proxy and content-based routing
2. Dynamic content caching and integration with servlet caching
3. File serving enabler
4. HTTP compression
5. Integration with Dynacache and third party object caches

Answer: A,B

QUESTION 3

What is needed to load balance the HTTP traffic across a cluster of Web servers?

1. Configure a proxy server such as Tivoli Access Manager (TAM)
2. Enable server affinity for each HTTP server in the cluster
3. Implement the caching proxy server component of the WebSphere Edge
4. Use an IP sprayer from the load balancing component of the WebSphere Edge Components

Answer: D

QUESTION 4

What does a WebSphere application server provide to support the installation and deployment of JSR 168 compliant portlets?

1. An embedded portlet container
2. A scaled-down version of the WebSphere Portal Server
3. Several J2EE applications that render and aggregate portlets in a browser
4. An embedded version of WebSphere Portal Express

Answer: A

QUESTION 5

Which two components provide workload management capabilities?

1. Node agent
2. Web server plug-in
3. Caching proxy
4. Deployment manager
5. Load balancer

Answer: B,E

QUESTION 6

Which services are implemented by the WebSphere application server?

1. Security, JMS messaging, Naming and HTTP Plug-in
2. The user registry, Naming and HTTP Plug-in
3. HTTP Load Balancing services, JMS messaging and Data Replication Service (DRS)
4. Security, Naming, Transaction and Dynamic Cache

Answer: D

QUESTION 7

Session Initiation Protocol (SIP) servlets are packaged in which type of archive file?

1. SAR
2. WAR
3. JAR
4. EJB-JAR
5. SIP-JAR

Answer: A

QUESTION 8

In a WebSphere cell configuration, which component is a single point of failure?

1. Deployment manager
2. Web container
3. EJB container
4. HTTP server

Answer: A

QUESTION 9

Which approach should be recommended when designing a production topology for WebSphere application servers providing high availability and failover capabilities?

1. Create a design using multiple machines that handles the full production load, enabling the use of

Application server clustering to provide failover capabilities

1. Utilize load balancers between the Web servers and the application servers to provide failover support at the application server tier
2. Place the Authentication servers outside of the intrusion firewall with the Web servers, since the Web servers will need to access them
3. Use the largest processor engines and least number of physical machines for the application server tier, to minimize the software licensing costs

Answers: A

QUESTION 10

If an administrator configures session management for an application server to user SSL ID tracking, which two other session tracking mechanisms should also be enabled?

1. Cookies
2. URL Rewriting
3. Security Integration
4. Serial Access
5. Java2 Security

Answer: A, B

QUESTION 11

An application server is using data source connections being managed thru connection pooling.How ever, the server is logging database errors resulting from lack of connections. In this context, what applies to tuning database connections?

1. Data sources are abstracted from the JDBC drivers to permit database upgrades without impacting the application logic. The administrator should decrease the connection timeout value.
2. The connection pool is managed by the application server container, so in addition to increasing the connection setting, additional connections allowed must be configured on the database.
3. The data sources are released at the end of the commit phase when using Type 4 JDBC drivers. New connections will be created upon the next database access.
4. It is necessary to tune the applications before tuning WebSphere application server. Connections not returned to the pool are often caused by programs not closing connections properly.

Answer: D

QUESTION 12

Which set of parameters can a system administrator adjust to directly improve performance for the EJB container?

1. Transaction lifetime and client inactivity timeout
2. Cache size and cache cleanup interval
3. Data source connection pool and server JVM size
4. Session timeout and HTTP session object size

Answer: B

QUESTION 13

When altering the level of logging information, which level provides more detailed logging information than the default (info) level ?

1. Fatal
2. Warning
3. Severe
4. Config

Answer: D

QUESTION 14

A J2EE application needs to be configured as follows:

The EJB module and the utility JAR in the application must be loaded by the same Class loader. Web module WAR1 and the EJB module must use the same Class loader and Webmodule WAR2 must have its own Class loader.

What is the correct Web module Class loader configuration for this application?

1. WAR1 – Module, WAR2 – Module
2. WAR1 – Module, WAR2 – Application
3. WAR1 – Application, WAR2 – Application
4. WAR1 – Application, WAR2 – Module

Answer: D

QUESTION 15

Which Web module parameter adjustments would result in improved response time for Web clients ?

1. Disable load on startup
2. Enable pre-compile JSP option
3. Set the distributable flag
4. Set the reload interval to 20 seconds or less

Answer: B

QUESTION 16

Which Web server plug-in setting is NOT configurable using the administrative console?

1. Load balancing option
2. Retry interval
3. Refresh configuration interval
4. Minimum number of connections

Answer: D

QUESTION 17

An application has 15 concurrent users and a connection pool size of 10. Each user users 3 prepared statements. For this application, what is the recommended prepared statement cache size?

1. 10
2. 15
3. 30
4. 45

Answer: C

QUESTION 18

What is the correct syntax when running the backup configuration of administrative server files when WebSphere Security is enabled?

1. backupConfig WebSphereConfig user -password
2. backupConfig WebSphereConfig backup.zip nohalt user -password
3. backupConfig WebSphereConfig –cell user -password
4. backupConfig WebSphereConfig profilename=AppSrv01 user -password

Answer: A

QUESTION 19

When the application server is experiencing normal to heavy usage, which statement most accurately describes optimal pool usage?

1. The pools will all show similar numerical values, indicating balanced workload is occurring throughout the application server.
2. Pools used by the application should be released and rebuilt in conjunction with JVM garbage collection cycles ensuring that no state connections persist.
3. The performance Management Interface (PMI) must be explicitly enabled on the application server to be monitored, since it requires CPU resources on the server being monitored.
4. Pools used by the application should be nearly fully utilized, indicating that resources are being efficiently used.

Answer: D

QUESTION 20

When configuring a J2C connection factory, which setting can be configured using the administrative console ?

1. Container-managed authentication alias
2. Component-managed authentication alias
3. Authentication preference
4. Mapping configuration alias

Answer: B

QUESTION 21

What is the correct command to save configuration changes in a Jython script file?

1. AdminConfig.save()
2. $AdminConfig save
3. AdminTask.save()
4. $AdminTask.save
5. The WebSphere scripting tool does not a periodic save based on a property in its configuration.

Answer: A

QUESTION 22

Which additional deployment descriptor information can a WebSphere application have beyond the J2EE requirements ?

1. IBM Bindings associate local names to deployment platform specific resources
2. IBM Extensions support additional options
3. For EJB modules, a set of files map Entity Enterprise JavaBeans to a specific data store “schema”
4. Web Service Interoperability mapping files
5. Jython deployment scripts
6. Cloudspace DDL files

Answer: A, B, C

QUESTION 23

What is the name of the WebSphere scripting tool?

1. wasadmin
2. wsadmin
3. ws_ant
4. wsdeploy

Answer: B

QUESTION 24

When is J2EE mapping of security roles to users and groups allowed?

1. During application development with Rational Application Developer (RAD) or with Application Server Toolkit (AST)
2. During an application installation
3. After an application is installed
4. During application runtime
5. During the creation of an application profile
6. When configuring the user registry

Answer: A, B, C

QUESTION 25

In a federated namespace, what are the primary uses of cell and node persistent partitions?

1. For the storage of topological data in the XML repository
2. For the storage of configuration buildings, such as CORBA and indirect name lookups
3. For binding the server root of the server, such as EJB homes and resource artifacts
4. For reading configuration data from the file system, such as EJB deployment descriptors, and registering the necessary objects

Answer: B

QUESTION 26

An administrator needs to enable support for a number of applications that use message-driven bean (MDBs). Some of the beans use point-to-point messaging and other beans use publishsubscribe messaging. The administrator will typically need to perform which two sets of tasks?

1. Configure the default JMS provider and the necessary destinations (queues and topics)
2. Deploy the MDBs to the message engine and select the SOAP over JMS protocol
3. Configure queue managers using the WebSphere MQ JMS provider
4. Configure a service integration bus and add the appropriate bus member
5. Deploy the MDBs to JCA container and select bean managed persistence

Answer: A, D

QUESTION 27

A DB2 data source is used across different applications. The application is installed in multiple machines for horizontal scaling, but the database driver location differs from machine to machine. When using WebSphere variables, what is the most maintainable way to define the scope for this data source?

1. JDBC provider-cell scope data source- node scope
2. JDBC provider-cell scope data source- cell scope
3. JDBC provider-node scope data source- cell scope
4. JDBC provider-node scope data source- node scope

Answer: B

QUESTION 28

In addition to data sources and Shared Libraries, which resources can enhanced EARs support?

1. JAAS Authentication Aliases, Class loader policy and Virtual host information
2. JAAS Authentication Aliases, Class loader policy and Virtual host information and JVM command line parameters
3. JAAS Authentication Aliases, Virtual host information and JVM command line parameters
4. JAAS Authentication Aliases, Class loader policy and JVM command line parameters
5. Class loader policy, Virtual host information and JVM command line parameters

Answer: A

QUESTION 29

When installing WebSphere Application Server v6.1 along with IBM HTTP Server and related plug-ins, an administrator notices the following message in the /logs/install/log.txt Plugin.Install, com.ibm.ws.install.ni.ismp.actions

ISMPComponentizedFileRepositoryDeployAction, err, Component not found: prereq.jdk

Which two additional entries should the administrator verify?

1. The JAVA_HOME system environment variable
2. The CLASSPATH system environment variable
3. The JAVA_INSTALL_PATH value in log.txt
4. The CURRENT_WORKING_DIRECTORY value in log.txt
5. The PLUGIN_JDK_ROOT value in log.txt

Answer: C, D

QUESTION 30

To create a customized installation package (CIP), which file must be created first so that the installation factory can use it to generate the CIP?

1. An Ant file
2. A response file
3. A build definition file
4. A ifcli file

Answer: C

QUESTION 31

A system administrator is planning to do a silent install using a customized response file. The system

Administrator does not want to install the samples that come with the product.

Which option in the response file should the administrator update to NOT include the samples with the

Installation?

1. Install Type
2. custom
3. feature
4. PROF_Action

Answer: C

QUESTION 32

A system administrator has just completed installing the core binary files of WebSphere Application Server Network Deployment. The system administrator wants to create a deployment manager profile with a Federated Node. What is the easiest method to accomplish this?

1. Create a Cell profile using the Profile Management Tool
2. Create a deployment manager profile using the Profile Management Tool
3. Create deployment manager and custom profiles using the manageprofiles command
4. Create deployment manager and custom profiles using the Profile Management Tool

Answer: A

QUESTION 33

If a Web Server is located in the intranet, behind the DMZ (Demilitarized Zone), which configuration option is the easiest to maintain and operate?

1. Web server in an unmanaged node
2. Web server in a stand-alone profile
3. Web server in a managed node
4. Web server in the deployment manager profile

Answer: C

QUESTION 34

When creating a profile, which statement is NOT true?

1. Administrative security must be enabled.
2. There is an option to make a profile the default profile.
3. Typical profile creation uses default configuration settings.
4. A Web server definition can be created in the profile.

Answer: A

QUESTION 35

After installation and application server profile creation, which servlet is useful for validating system configuration?

1. HitCount
2. HelloHTML
3. WSSamples
4. Snoop

Answer: D

QUESTION 36

How can an administrator view the contents of the activity.log file in the profile root directory?

1. Run the waslogbr script from the command line and use the Log Analyzer
2. Open the file using the IBM Support Assistant (ISA) and use the Thread Analyzer tool
3. Use the Profiling and Logging perspective in the Application Server Toolkit (AST)
4. Open the file using any text editor

Answer: C

QUESTION 37

Which statement is true about WebSphere JVM logs?

1. The number of historical JVM log files is fixed at 3; this value will reset on each server restart.
2. The JVM logs are self-managing and can roll over based on time or file size.
3. The JVM logs should be moved from the default location to make them easier to access from the command line.
4. The JVM logs are, by default, kept outside the Application server filesystem directory tree to prevent them from being overwritten when applying fixpacks.

Answer: B

QUESTION 38

From which root can the JNDI dumpNameSpace utility be used to examine the contents of the namespace when JNDI errors are occurring?

1. Node, which contains all JNDI references used within the cells defined scope
2. Server, which contains the objects that are accessible by remote processes
3. Local, which contains objects that are available by local processes only
4. Java, which contains naming information unique to the specific server application

Answer: B

QUESTION 39

While monitoring a server, an administrator notices that the server is being restarted by its node agent approximately every 60 minutes. The administrator suspects that the server is crashing for memory related reasons. How can the administrator troubleshoot possible causes for the server crashing?

1. Look for heap dumps in the servers root profile directory and examine them with a Heap Analyzer tool
2. Start the server using the trace option and examine the startServer.log file using the Application Server Toolkit (AST)
3. Stop the server using the trace option and examine the stopServer.log file using the AST
4. Set the environment variable IBM_HEAPDUMP equal to true for the servers node agent and examine any node agent heap dumps

Answer: A

QUESTION 40

To enable tracing on a WebSphere component, such as the naming service or the rsadapter using a servers Diagnostic Trace Service, which set of tasks should an administrator perform?

1. Use the Application Server Toolkit (AST) to improve the activity.log file and edit this file to specify a trace string for the component, then export the activity.log file to the node agents configuration directory
2. Use the Administrative console to direct the trace output to memory buffer, select a trace output format, select a component to trace and set the log detail level to either fine, finer, or finest
3. Edit the wsadmin.properties file to specify a trace string for the component and accept all of the default tracing properties then perform a full-resynchronize of the node agent
4. From the administrative console select Tracing, select a node agent, select Process Logs, select a trace output format, select a component to trace and set the Log Details Levels to detail

Answer: B

QUESTION 41

Which statement describes the WebSphere v6.1 FFDC feature?

1. FFDC does not affect performance of the WebSphere application server.
2. FFDC logs are mainly intended for application development teams.
3. The application server needs to be restarted after enabling FFDC.
4. FFDC information is stored in an optimized relational database.

Answer: A

QUESTION 42

An administrator should use the IMB Support Assistant (ISA) to perform which tasks?

1. Submit a Problem Management Report (PMR) electronically to IBM Support and check the PMRs status
2. Analyze a service log file against a symptom database and submit the results to IBM support
3. Assemble and package enterprise applications into EAR files and submit to IBM Support for profiling
4. Create a log of the activity for several components of an application server and submit the log to IBM support

Answer: A

QUESTION 43

An administrator creates a horizontal cluster and deploys an application that uses HTTP session objects. How should the administrator configure support for session object persistence?

1. Configure memory-to-memory persistence in the Web server plug-in properties
2. Configure HTTP session memory-to-memory replication when creating the cluster
3. For each cluster member, configure memory-to-memory replication for the Web container session management
4. Configure memory-to-memory persistence in the HTTP servers httpd.conf file
5. Enable session affinity in the Web server plug-in properties

Answer: B, C

QUESTION 44

A system administrator has enabled dynamic caching across a cluster of servers and configured a replication domain for the cluster. Which configuration mode should the system administrator enable for memory to memory session partitioning to ensure each object is replicated to every consumer of the replication domain?

1. Single replica
2. Full Group replica
3. Specific number of replicas
4. Entire domain

Answer: B

QUESTION 45

A system administrator is federating a node using the addNode command.

The addNode command CANNOT perform, by default, which step?

1. Create entries in the master repository for the federated node
2. Include applications in the cell
3. Update the node’s wsadmin.properties file to reflect the new cell environment settings
4. Create a definition for the node agent

Answer: B

QUESTION 46

If the Web server is not an IBM HTTP Server and is defined to managed node, which two actions can be taken from the administrative console?

1. Check the status of the Web server
2. Enable dynamic trace on the server
3. Generate a plug-in configuration file for that Web server and propagate the plug-in configuration file after it is generated
4. Start the server
5. Stop the server

Answer: A, C

QUESTION 47

For performance reasons, a J2EE application maintains HTTP session information in memory (not persisted). The information in the session can be recreated based on the contents of various cookies. Recreating this data from the cookies would incur performance penalties.

Which mechanism minimizes the need to recreate session data?

1. Memory-to-memory replication in Server mode
2. Memory-to-memory replication in Both client and server mode
3. Session affinity in Web server plug-in
4. Database persistence

Answer: C

QUESTION 48

When adding a new member to a cluster, why might it be necessary for an administrator to select the option for generating unique HTTP ports?

1. To avoid port conflicts with other servers on the same node
2. To ensure that cluster members on different nodes have unique ports
3. To prevent other applications from using these ports
4. To enable encryption over the secure HTTP ports

Answer: A

QUESTION 49

Mapping J2EE security roles to users is a function of:

1. Installing an application
2. Defining the JDBC connections to the backend databases.
3. Defining the security configuration on the Web server.
4. Regenerating the Web server plug-in file.

Answer: A

QUESTION 50

A company needs to merge several user repositories so that users from each repository can authenticate to the WebSphere cell. The existing repositories are contained in different relational databases and LDAP directories. How can an administrator most easily leverage the existing repositories to configure a single user repository that contains all of the users?

1. Implement a federated user repository using the Virtual Member Manager (VMM)
2. Use Tivoli Access Manager (TAM) to create a single virtual repository
3. Create a custom user registry and import the user data from the repositories
4. Creating a single LADP directory that contains each of the repositories as sub-trees

Answer: A

QUESTIN 51

What is the minimum administrative role that is required for an enterprise application to be started through the console?

1. Operator
2. Administrator
3. Configurator
4. Monitor

Answer: A

QUESTION 52

The application server is architected to use an existing user registry that stores administrative users and application users. What is needed to setup this architecture?

1. Configure the JNDI path to the security database
2. Configure the connection to the existing user registry
3. Retrieve a list of nodes and node agents contained within the cell
4. Generate Web services binding for the existing user registry

Answer: B

QUESTION 53

Which two tasks can be performed using the IBM Key Management Utility (IKeyman) for managing SSL for IBM HTTP Server?

1. Install GSKit
2. Create a key database file
3. Create self-signed certificate
4. Edit httpd.conf to use a certificate
5. Sign certificates on certificate authority’s (CA) behalf

Answer: B, C

QUESTION 54

The Virtual Member Manager (VMM) in WebSphere is NOT able to federate which repository/registry?

1. The file-based repository that is built into the system
2. One or more external LDAP repositories
3. A JDBC accessible database repository
4. Local operating system registry

Answer: D

QUESTION 55

Which statement most accurately defines the location of where the WebSphere security service runs?

1. The security service runs on the LDAP server and is accessed through the application server node agent
2. The security service runs in the federated nodes of the cell
3. The security service runs on the deployment manager
4. The security service runs locally in each of the WebSphere processes (deployment manager, node agent and application server.)

Answer: D

QUESTION 56

When implementing WebSphere security, which statement is true about authentication and authorization credentials?

1. Authentication takes place utilizing a user registry, however authorization is done based on properties defined within the .ear file
2. Both authentication and authorization require lookups to the security service LDAP database.
3. WebSphere security processes run on a centralized security service LDAP database to facilitate single sign on administration of both authentication and authorization credentials.
4. Authorization must occur before authentication to ensure the proper J2EE Security roles are utilized for the LDAP lookup.

Answer: A

QUESTION 57

Which three steps are automatically performed to enable SSL between the HTTP plug-in and WebSphere application server?

1. Creation of keyrings and keys for the plug-in
2. Creation of keyrings and keys for the application server
3. Procurement of a certificate from a certificate authority (CA) for the plug-in
4. Procurement of a certificate from a certificate authority (CA) for the application server
5. Establishment of a trust relationship between the plug-in and the application server
6. Importing the application server’s certificate to the trust file

Answer: A, B, E

QUESTION 58

Assume that a federated repository is configured from three existing repositories: A, B and C, A user tries to log in but is denied access. What is a possible reason for the login failure?

1. The users ID does not exists in all three repositories
2. One or more of the three repositories is not accessible
3. The users ID is contained in repository A, which is a file-based repository
4. The users LDAP Distinguished Name (DN) is not the same across all repositories.

Answer B

QUESTION 59

What is the minimum administrative role required for Java 2 security to be enabled through the administrative console?

1. Administrator
2. Configurator
3. Operator
4. Security

Answer: A

QUESTION 60

What are three goals of the Virtual Member Manager (VMM)?

1. Provide a repository that can span multiple WebSphere cells
2. Provide a repository-independent programming interface
3. Support various pluggable repositories
4. Provide the ability for users to achieve a single view of their own multiple repositories in a federated model
5. Provide a cache or repository information

Answer: B, C, D

QUESTION 61

Which statement is NOT true about Application Server Toolkit (AST)?

1. It has a similar look and feel to the IBM Rational family of products and is based on Eclipse.
2. It has a complete development environment for enterprise applications including EJBs.
3. It is supported on Windows, Linux and AIX.
4. It has Jython editor and source debugger.
5. It can run wsadmin scripts inside AST.

Answer: C

QUESTION 62

The WebSphere scripting tool supports which two scripting languages?

1. BSF
2. Jython
3. Perl
4. Ant
5. Jacl

Answer: B, E

QUESTION 63

A system administrator needs to create a data source and make it available on multiple nodes using different directory structures. Which two actions should the system administrator take to do this?

1. Define the JDBC provider at the cell scope
2. Define the JDBC provider at the node scope
3. Define the JDBC provider at the server scope
4. Create the data source that uses this JDBC provider at the cell scope
5. Create the data source that uses this JDBC provider at the node scope
6. Create the data source that uses this JDBC provider at the server scope

Answer: A, D

QUESTION 64

An application uses a JMS queue for point-to-point messaging. As part of the queue configuration, an administrator is able to specify which two sets of properties?

1. Scope, activation specification and connection factory
2. Scope, JMS provider and JNDI name
3. J2C authentication data, connection timeout and reap time
4. Bus name, delivery mode and priority
5. Class path, topic name and JMS name

Answer: B, D

QUESTION 65

A customer has a WebSphere Application Server v4 client and wishes to look up and access objects in WebSphere Application Server V6.1 without requiring changes to the client. What must the customer do to enable WebSphere Application Server V6.1 objects to be accessible through the legacy name space?

1. Configure a leaf binding
2. Create a corbaname binding
3. Use a compound name
4. Create a configured name binding

Answer: D

QUESTION 66

Which are the three possible components of Web modules?

1. Servlets
2. JSPs
3. SIP servlet files
4. MDB files
5. HTMLs
6. Session and entity beans
7. RAR files

Answer: A, B, E

QUESTION 67

Which three statements are true about J2EE security roles?

1. Authorization is performed using the J2EE security roles.
2. Security roles are applied to the Web and EJB application components.
3. Security roles provide an access control mechanism to manage the applications access to system level resources.
4. Binding of the users and groups to the J2EE security roles is usually done at the application install time.
5. Authentication is performed using the J2EE security roles.
6. Security roles can be modified dynamically at runtime.

Answer: A, B, D

QUESTION 68

What is the default connection pool that the WebSphere scripting tool uses?

1. SOAP
2. RMI
3. SOAP is tried first then RMI is tried second
4. NONE
5. TCP

Answer: A

QUESTION 69

An administrator need to configure a data source for use by a Servlet 2.2 based Web application. Which data source type must the administrator define?

1. WebSphere Application Server V6 data source
2. WebSphere Application Server V4 data source
3. JDBC Type 4 data source
4. JDBC Type 2 data source

Answer: B

­QUESTION 70

The Profile Management Tool allows you to enable WebSphere administrative security. Which user registry is used for this default security?

1. Local operating system
2. Standalone custom registry
3. Standalone LDAP registry
4. Federated Repositories

Answer: D

QUESTION 71

An installation and profile creation was just completed. Which tool can be used to check installation files, report differences and create an inventory of configured files?

1. Collector tool
2. Installation verification tool (IVT)
3. Installver tool
4. Administrative console

Answer: C

QUESTION 72

Which file can a system administrator consult prior to starting an installation to determine which components are already installed on the machine?

1. vpd.properties
2. prereqChecker.xml
3. log.txt
4. profileregistry.xml

Answer: A

QUESTION 73

After creating a profile, a system administrator discovers there are port conflicts. Which action should the system administrator take to fix the port conflicts in the existing profile?

1. Re-create the profile entering different ports
2. Update the portdef.props file
3. Run the updatePorts.ant script
4. Edit the server.xml file

Answer: C

QUESTION 74

What does the Installation Factory use to create a customized installation package (CIP)?

1. A build definition that defines how to customize WebSphere application server
2. A CIP containing a customized WebSphere application server
3. A customized response file containing the definition of the installation package
4. The ifgui command to build a silent response file

Answer: A

QUESTION 75

A system administrator needs to create an application server profile that does NOT contain the administrative console. Which action should the system administrator take while using the Profile Management Tool to create the profile?

1. Select the typical installation which does not install the administrative console to the server
2. Select the advanced operation which has an option to install the administrative console to the server
3. After the profile creation, uninstall the administrative console application
4. Delete the application from the installed directory

Answer: B

QUESTION 76

When attempting to install WebSphere Application Server v6.1 using the silent install, the installation fails early in the process and no log files appear to be created in the logs directory. Which two steps can the administrator perform to troubleshoot the issue?

1. Restart the installation after an OS restart
2. Restart the installation with the –log parameter
3. Look for the log files in the system temporary area
4. Run the installation verification test (IVT)
5. Start over by creating a new responsefile.txt using the responsefile.base.txt

Answer: B, C

QUESTION 77

When accessing the application server process logs, STDOUT and STDERR, on a federated node, in which default file system path will they be found?

1. //logs//native_stderr.log and //logs//native_stdout.log
2. /logs//native_stderr.log and /logs/native_stdout.log
3. /logs/stderr.log and /logs/stdout.log
4. /logs/stderr.log and /logs/stdout.log

Answer: A

QUESTION 78

An administrator is analyzing an activity.log file from a profile by using the Application Server Toolkit (AST) Profiling and Logging perspective. There are hundreds of log records.

Most of the records are informational messages. How can the administrator view only the records whose severity is at the Warning and Error level?

1. The activity.log file must be filtered using the Log Analyzer before it is improved into AST
2. Create two filters, one showing only Errors and one showing only Warnings. Export each and merge them into a single new activity log.

1. When the activity.log file is imported into AST, use the filter option to exclude the informational message
2. Update the filter so that it shows only Error and Warning log records.

Answer: D

QUESTION 79

After hearing from clients that they are having problems logging into an application, an administrator enables tracing on WebSphere security components using the following log trace string:

com.ibm.ws.security.*=detail and restarts the server

When the administrator examines the trace log, there are no events recorded for any security components.

What must be the administrator do to ensure that the trace information is written to the trace log?

1. Modify the server.xml file to enable tracing and restart the server
2. Configure the trace output format with the advanced setting
3. Set the Log Detail Levels to one of the following: fine, finer, finest
4. Update the Log Detail Levels for the servers node agent

Answer: C

QUESTION 80

Under which circumstance should the WebSphere administrator use the dumpNameSpace utility?

1. When the application server will not start because the JNDI namespace tables have become corrupted
2. When applications are experiencing a problem accessing a specific WebSphere data source
3. Before regenerating the plug-in for the Web server
4. To clear the namespace prior to installing or redeploying an application

Answer: B

QUESTION 81

An administrator is monitoring a servers JVM Runtime by using the administrative consoles Tivoli Performances Viewer. It appears that garbage collection is running frequently and taking a relatively long time to complete. Which action should the administrator take to gather more information on the garbage collection process for this server?

1. Edit the servers sas.server.props file and set com.ws.jvmgc equal to verbose
2. Use the administrative console to enable Verbose garbage collection for the server
3. Enable tracing on the server with the following trace string: com.ibm.ws.jvm.*=finest
4. Use wsadmin to generate a heap dump and analyze the dump with the Application Server Toolkit (AST)

Answer: B

QUESTION 82

To conserve disk space, an administrator would like to roll the FFDC log files every three days. Without interfering with normal application server operation, how can this be accomplished?

1. By writing a logRoller script and executing it every three days.
2. By running a system job that cleans the files as needed
3. By configuring the ExceptionFileMaximumAge property in ffdcRun.properties
4. By configuring the TimesToDump property in ffdcStop.properties

Answer: C

QUESTION 83

In order to gather all of the necessary data required by IBM Support to troubleshoot a database connection pooling problem, an administrator should perform which task(s)?

1. Run the collector command, use the problemType option to specify database connection pooling and submit the resulting JAR file to IBM Support
2. Use the Service component of the IBM Support Assistant (ISA) to gather data for the database connection pooling problem type
3. Reproduce the problem, create a JAR file including the System.log and native_stdout.log files then submit the JAR file to IBM Support
4. Reproduce the problem, use the Tivoli Performance Viewer to log the JDBC connection pool activity then submit the log file to IBM Support

Answer: B

QUESTION 84

What is the advantage of implementinga multi-tiered environments across multiple machines?

1. It can more closely align with a customer’s business functions (i.e. distribution, ordering, and inventory management.)
2. The tiers allow you to tune individual products
3. It is the separation of tiers that allows operating system tuning parameters to be used based on the machine’s function
4. Separation reduces maintenance complexities since components are highly available in a distributed configuration

Answer: C

QUESTION 85

A WAR file containing several JSR 168 compliant portlets has been successfully installed in an application server. If portlet serving has been enabled, how can the portlets be accessed with a browser?

1. Request the PortletServingServlet servlet and then submit the name of the portlet
2. Request the portlets index.jsp and then submit the context root and portlet name
3. Request the wpsServlet servlet and then select the portlet from a portal menu
4. Request the portlet directly using a URL that includes the name of the portlet

Answer: D

QUESTION 86

When an application server cluster is added to a Service Integration Bus as a cluster bus member, the messaging engine defined will be highly available. The messaging engine becomes active on:

1. all the servers within the cluster

1. each node agent
2. only one server within the cluster
3. the deployment manager

Answer: C

QUESTION 87

Which statement is NOT true about the Session Initiation Protocol (SIP) container?

1. The servlet container provides the network services over which requests and responses are received and sent.
2. A SIP servlet container manages the network listener points on which it listens for incoming SIP traffic.
3. The SIP servlet container can employ a SIP proxy server to route, load balance, and improve response times between SIP requests and back-end SIP container resources.
4. The SIP servlet container can directly interact with other SIP servlet container in the cell to co-ordinate SIP servlet requests.
5. The SIP servlet container decides which appliations to invoke and in what order. The container also contains and manages servlets through their life cycle.

Answer: D

QUESTION 88

Which statement describes the relationship between WebSphere MQ and WebSphere default messaging as a JMS provider?

1. Default messaging relies on WebSphere MQ as the JMS Provider
2. Default messaging is a version of WebSphere MQ.
3. WebSphere MQ and default messaging are separate and do not share any modules or configuration data
4. WebSphere MQ and default messaging must share the same Cloudscape database.

Answer: C

QUESTION 89

Which statement is true for a managed application server process to startup?

1. A node agent and deployment manager must be running before starting a managed server.
2. Starting a managed server is not dependent on the presence of a running deployment manager.
3. The node agent should not be started before any managed servers on that node.
4. The deployment manager needs to be started before the managed server.

Answer: B

QUESTION 90

In a cell configuration, which protocol is used for sending requests between application servers?

1. HTTP
2. HTTPS
3. IIOP
4. OSE

Answer: C

QUESTION 91

What are the three possible modes that the replication service instance can be set up to run in?

1. Server mode
2. Client mode
3. Both mode
4. Publish/Subscribe mode
5. Event Listener mode
6. Broadcast mode

Answer: A, B, C

QUESTION 92

What has to be configured to implement memory-to-memory HTTP Session persistence?

1. EJB session beans and EJB Container
2. The HTTP Plug-in and embedded HTTP Server
3. The JMS Server and Queue Manager
4. The Data Replication Service (DRS) and Web container

Answer: D

QUESTION 93

An administrator is configuring JDBC database connections. Where is the file system path to the DB2 or Oracle driver .zip files specified?

1. Within the .ear file of the deployed application
2. Within the connection pool parameters for the cell
3. On the connection manager J2C configuration panel
4. From the Environment -> WebSphere Variables panel of the Administration Console

Answer: D

QUESTION 94

While an administrator is using the Tivoli Performance Viewer to analyze a performance problem with a production application server, the administrator notes that the database connection pools have a much lower percentage of utilization than the other pools. Which statement explains this observation?

1. The database server is constrained, causing calls to the database to consume more resources than are available for processing
2. This condition indicates there is a bottleneck in one of the processes upstream in the pipeline of process flows within the application server.
3. The connection pools have not been defined to account for parallel application server calls to the database, causing this particular server to show low utilization
4. The Tivoli Performance Viewer percentages are only useful for performing performance analysis on a server that is executing in a controlled load test scenario.

Answer: B

QUESTION 95

A J2EE application needs to be configured as follows:

The EJB module and the utility JAR in the application must be loaded by the same Class loader.

Each Web module must have its own unique Class loader.

What is the correct application server and Web module Class loader configuration for this application?

1. Isolation policy -> Single, Class loader policy -> Application
2. Isolation policy -> Single, Class loader policy ->Module
3. Isolation policy -> Multiple, Class loader policy -> Module
4. Isolation policy -> Multiple, Class loader policy -> Application

Answer: C

QUESTION 96

Which statement most accurately describes the effect of increasing the JVM maximum heap size?

1. No measurable performance change will result from increasing the heap size
2. A larger heap size will cause the server to take longer to start
3. More objects will be created and the time required to garbage collect will decrease.
4. The time between garbage collections will increase, but the garbage collection will take longer.

Answer: D

QUESTION 97

For security reasons, an administrator would like to ensure that HTML resources are isolated between Web modules running on a server. Which setting should the administrator configure?

1. Class loader configuration
2. Virtual host configuration
3. HTTPS ports configuration
4. Admin console configuration

Answer: B

QUESTION 98

In order to generate a plug-in configuration file on which all applications in the cell are mapped, which action must a system administrator take?

1. Run the GenPluginCfg command on each server
2. Run the GenPluginCfg command on the deployment manager
3. Select the Automatically Generate Plug-in option in the administrative console
4. Select the Generate Plug-in option in the Web server’s page in the administrative console

Answer: B

QUESTION 99

When using the Tivoli Performance Viewer, the WebSphere administrator notes that the Summary and Detailed reports display in tabular format, however the graphics do not display. What must the administrator do to correct the problem?

1. The graphics display only if there is sufficient variance in the data being collected. The application server monitored is not under load condition, therefore the default reports are the preferred display mechanism and no action is required.
2. The Performance Monitoring Interface and the Performance Advisor must both be enabled from the Administrative Console accessed through the Deployment Manager in order for the Performance Advisor graphics to display.
3. The administrator must override the default scale set in the default report since it is set too high to cause the graphics to be generated
4. The Scalable Vector Graphics (SVG) plug-in for Adobe must be downloaded and installed on the administrators browser since this is required for the graphics display.

Answer: D

QUESTION 100

According to the Upstream Queuing model for performance tuning, what reflects the correct application of recommended settings for maximum concurrent clients?

1. Web server=75, Web container=75, Datasource=25
2. Web server=75, Web container=50, Datasource=25
3. Web server=50, Web container=50, Datasource=50
4. Web server=25, Web container=50, Datasource=75

Answer: B

QUESTION 101

A critical error is occuring on a production node causing the JVM logs to rapidly fill up. Which resolution should the WebSphere administrator take as the first step for troubleshooting?

1. The logs are self-managing and can roll over based on time ro file size, so simply opening the logs with a text editor will ensure that new log files are created.
2. Removing the application server from the network, either administratively or physically, is necessary to stop the JVM processing.
3. Stopping the JVM process from the command line, removing the application administratively thru the console and restarting the JVM will allow processing to continue on other applications.
4. The administrator should remove the failing application server from user requests, thereby stabilizing the application server so that troubleshooting can begin.

Answer: D

QUESTION 102

When configuring session management for a Web container, which property represents the number of cached sessions?

1. Session Expiry value
2. Maximum in-memory session count
3. L2 Cache Integration count

1. Maximum wait on serial access

Answer: B

QUESTION 103

An administrator has a cluster of two members and needs to ensure that roughly twice as many client requests are routed to cluster member A. than are routed to cluster member B. How should the administrator configure this type of load distribution?

1. Create two entries for member A in the HTTP plug-in configuration
2. Double the OS priority for member As JVM process
3. Assign to member A, a weight two times as large as member Bs weight
4. Double the minimum size of member As Web container thread pool

Answer: C

QUESTION 104

What is the default behavior of federating a node using the addNode command?

1. Starts the node agent and application server processes
2. Includes applications and buses
3. Starts the deployment manager and the node agent
4. Does NOT include applications and buses

Answer: D

QUESTION 105

It has been decided to use database session persistence for a particular J2EE application. Which two steps must be performed to implement this feature?

1. Configure the JDBC provider and data source
2. Select a multi row schema
3. Create session database
4. Configure row size to match session size
5. Create session database tables

Answer: A, C

QUESTION 106

If an IBM HTTP Server is defined, the IHS Administration is installed and the IBM HTTP Server is defined to an unmanaged node, which two can be done?

1. Display the IBM HTTP Server Error log (error.log) and Access log (access.log) files as well as display and edit the IBM HTTP Server configuration file (httpd.conf)
2. Start and stop the server and propagate the plug-in configuration file after it is generated
3. Update the server with new fixpacks
4. Enable dynamic trace
5. Flush its local cache

Answer: A, B

QUESTION 107

In order to create a new WebSphere cell and implement a horizontal scaling topology, an administrator needs to perform which task(s)?

1. Federate nodes and create multiple clusters
2. Load balance multiple HTTP servers using Edge Components
3. Deploy multiple database servers using a high availability software product
4. Federate nodes and create cluster members across multiple machines

Answer: D

QUESTION 108

What is the default configuration setting for the Data Replication Service (DRS)?

1. Single replica
2. Full group replica
3. Specify number of replicas
4. Entire domain

Answer: A

1. What about master repository?

Ans: deployment manager contains the MASTER configuration and application files. All updates to the configuration files should go through the deployment manager.

2. Tell me IHS executable files, means bin directory files?

Ans: Apache, ApacheMonitor, htpasswd, htdigest, htdbm, ldapstash, httpd.exe

3. Why given the httpd.conf file to installation of plug-in?

Ans: identify the web server (port, virtual hosts) to configure the web server definition

4. How to configure remote system httpd.conf file?

Ans: select web server machine (remote)

5. Several types of log files in the appserver?

Ans: system out, system err, trace, native out , native err, activity.

6. websphere packages?

Ans: express, base, network deployment

7. What is the profile?

Ans: profiles are a set of files that represent a websphere application server configuration.

8. What is the trace?

Ans: A trace is an informational record that is intended for service engineers or developers to use. As such, a trace record might be considerably more complex, verbose and detailed than a message entry.

9. What is heap memory?

Ans: Objects storage space for objects references created at run time in a jvm is heap memory.

10. Out of memory exception is there, how to handle that exception?

Ans: To incrise heap memory size

11. What about IHS?

Ans: IHS (IBM HTTP Server) is one of the web servers. It serves the static content only and it takes up only http requests.

12. What about plug-in?

Ans: plug-in is one of the modules it is interface between application server and web server, the plug-in process receives the request from the client first. If the request is for dynamic content, the plug-in diverts the request to the websphere application server. If the request is for static content, the plug-in forwards it to the Http server.

13. What is the global security?

Ans: it provides the authentication and authorization for websphere application server domain (administration client or console).

14. How to configure the global security?

Ans: open console and then select security option in the right side menu, and then select localOs registry in the user registry, then enter the username, passwords. And again select global security then ltpa option then provide the password, then save the configuration. And restart the deployment server and then relogin the console.

15. What is SSL?

Ans: ssl is a protocol for providing encrypted data communications between two processes.

16. What is PMI? How to configure PMI?

Ans: monitoring and tuning–>PMI–>select any process (server1, nodeagent, dmgr) and then enable PMI–>then apply and then save. Select performance viewer–>current activity and then select enabled process and click the start monitoring button after that process select.

17. What is the UNIX command of all display server processes?

Ans: ps –ef| grep java

18. What is node?

Ans: logical group of servers.

19. How to start the server?

Ans: startserver.sh server1

20. How you get nodeagent……what you have to install to get nodeagent?

Ans: Custom Profile

21. How to add the node?

Ans: addnode.sh 8879

22. What is the application server?

Ans: The application server provides a runtime environment in which to deploy, manage, and run j2ee applications.

23. What is the node?

Ans: A node corresponds to a physical computer system with a distinct IP host address.The node name is usually the same as the host name for the computer.

24. What is the node?

Ans: A node corresponds to a physical computer system with a distinct IP host address. The node name is usually the same as the host name for the computer.

25. How many types of profiles are in nd product?

Ans: 1.deployment manager profiles 2.application server profiles 3.custom profile

26. What is diffrence b/w dmgr and other profiles?

Ans: dmgr app custom

1.its used for administration 1.admin console is there 1.plain node purpose of remaining profiles 2.initially one app server there 2.empty node 2.it supports the distributed 3.work independently environment. 4. Put applications 3.it is not included app server 4.admin console is there 5.work independently 6.do not put applications

27. Diff b/w 5.0 and 6.0?

Ans: Web Sphere Studio 3.5, comes up with Visual Age for Java. WSAD 5.0 supports J2EE 1.3 java specifications. RAD 6.0 supports J2EE 1.4 and integrated with Eclipse 3.0, UML Visual Editor, Tomcat Jakarta, Ant scripting, EJB universal test client and SOA tools.

28. What is the difference between web server and application server?

Ans: Application Server: takes care of Security, Transaction, Multithreading, Resource pooling, load balancing, clustering, performance, highly availability, scalability, etc. Exposes business logic to client applications through various protocols, possibly including HTTP. Supports deployment of .war and .ear files Application server = web server + EJB container.

29. Diff b/w weblogic and websphere?

Ans: Both BEA Weblogic and IBM’s WebSphere provide J2EE based application servers which are competitors. WebSphere leverages more on connectivity issues with MQ and legacy systems with strong dominance in J2EE.

30. Some problem is there in web server, so this information which log file contain?

Ans: http.log, plugin.log

31. What is jdbc?

Ans: jdbc is a low level pure java api used to execute sql statements.

32. What is datasource?

Ans: A data source is associated with a jdbc provider that supplies the specific jdbc driver implementation class

33. What is diff b/w type4 and type2?

Ans: type4 type2

1. It is pure java oriented 1.it is not a pure java oriented driver

2.require client side software 2.no need any client software

34. Some application not accessing, so what is the problem? This information which log file contains?

Ans: systemout, systemerr

35. In type3 client software which machine you have install?

Ans: server side machine

36. two databases there (oracle and db2),so I want 3 datasources for oracle and 2 data sources for db2 so create 3 datasource names for oracle and 2datasourcename for db2 is possible or not?

Ans: possible

37. What is jndi?

Ans: we can register resources in the application server’s java naming and directory interface (jndi) namespace. Client applications can then obtain the references to these resource objects in their programs.

38. Why use the boostrap port number?

Ans: client applications use the bootstrap port to access websphere’s built-in object request broker (orb) to use enterprise java beans in applications installed on the application server. The java naming and directory interface service provider url used by the client application needs to reference the bootstrap port to obtain an initial context for looking up ejb’s it wants to use. (For communicate two servers)

39. What are the appserver components?

Ans: admin server, web container, ejb container,j2c service, naming server, messaging engine, security server.

40. LDAP port number?

Ans: 389 or 636

41. How to start the server?

Ans: startserver.sh server1

42. Packages of websphere?

Ans: express, base, network deployment

43. What is webcontainer?

Ans: The web container provides a runtime environment for servlets, jsp’s, javabeans, and static content.

44. How to find out free diskspace from command prompt?

Ans: du -sk (kb) du -sm (mb)

45. How to find out certain server configuration details like port no, server name, node name, pid?

Ans: through admin console.

46. Configure the plug-in through admin console is possible or not?

Ans: possible

47. Where to set the path?

Ans: environments–>websphere variables

48. How many types of installations?

49. Application installed but not working. What are troubleshooting steps?

Ans: see jvm & application are up, check plugin-cfg.xml file for the root context used by the web application if it does not exist generate plugin and restart web server.

50. Applications installed fine, also generated plugin, but application still not working, in this case which log to see?

Ans: plugin.log

51. Default admin port?

Ans: 9060, ssl 9043

52. Default bootstrap port?

Ans: 2809

53. How to hit application without hitting the web server?

Ans: webcontainer port on application server

54. In how many ways you can perform administration?

Ans: console,,,JMX

55. No of ways of doing deployments?

Ans: Admin console…..jython (jacl) scripts

56. What is CellDiscoveryAddress

Ans: Node uses this port to talk to DMGR

57. What is NodeDiscoveryAddress

Ans: DMGR uses this port to talk to node

58. How websphere discovers a change in JSP and compiles it?

Ans: There is an algorithm that websphere uses to find the timestamp of .jsp and .class files. It checks that timestamp of .class file is always later than its corresponding .jsp file.

59. What is classloader?

Ans: The Java Classloader is a part of the Java Runtime Environment that dynamically loads Java classes into the Java Virtual Machine

60. how do you specify a jar file to be used by the application, consider that you have many jar files in your system?

Ans: classloader

61. What is a managed node?

Ans: Node with NodeAgent

62. What is a managed webserver?

Ans: Remote webserver access through local (dmgr/cell)

1) What is the default user registry, if you enable Global Security at the time of installation
Its federated repositories…. actually it is a file

2) Which commands require username/password , if you enable admin security
all stop* , syncNode, addNode(?)

3) When can you enable global security?
- while installing
- After installation also

4) Does enabling admin security needs j2ee security to be enabled?
No

5) Does enabling admin security enables j2ee security?
yes

6) What is the most important step to do, if you change your user repository.
recycle all the JVMs. otherwise the key tokens will not be updated for the new repo

7) who can change admin security settings?
Adminstrator

8. what is the tool supplied by IBM for SSL management in Websphere
ikeyman

9) How do you change the cell wide SSL?

http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21154255

10) how do you replace the default plugin-key.kdb file with new kdb file?

11) can we use diffrent SSL for nodes and plugin ?
Yes

1.WHAT IS TRACING?
Tracing is when you go through an entire program and record the value of variables and the output. You trace a program when you want to find out what actually went wrong

2.WHERE TO GIVE APPLICATION PRIORITY WHILE STARTING SERVER?
it will be under Enterprise applications ->app name -> startup behaviour ->Startup order in the admin console

3.HOW TO MOVE CODE DEV ENVIRONMENT TO TESTING ENVIRONMENT?
I’m sure what they mean by code here. I think, incase of applications, export them from in DEC and deploy in TEST.

4.WHAT IS SSL?WHEN IT ENCRYPT & DECRYPT THE DATA?
SSL are digital signed certificates. user for meesage/communication integrity and confidentiality. Generally encrypt at Sender side and decrypt at receiver side

5.WHAT IS INCIDENT MANAGEMENT?
It is part of ITIL process….. simple explanation is, when there is a problem in ur WAS environment, which procedure do you follow.

6.WHEN APPLICATION IS DOWN WHAT U WILL DO?
First look at the logs for errors. If you find the error, save the logs and start ur application. Then start trouble shoot.
If no error found, run a trace and look for FFDC etc..

7.I HAVE 16GB RAM,WHAT IS THE MINIMUM & MAXIMUM HEAPSIZE ?
No relation. Heap settings should be made depends on application

8.HOW TO OPEN ADMIN CONSOLE IN AIX/UNIX & WHAT IS THE DEFAULT FILE SYSTEM OF AIX?
admin console can be viewed from remote machine which has a browser, if not behind firewall.

9.WHAT IS FILE DESCRIPTORS IN AIX?
A file descriptor is a handle created by a process when a file is opened. There is a limit to the amount of file descriptors per process.If the file descriptor limit is exceeded for a process, you may see the following errors:”Too Many Open Files”

10.HOW TO RESOLVE PORT CONFLICTS IN PRODUCTION ENVIRONMENT?
check why there is port conflict
run updateports script in WAS

what is cluster

how do you create a cluster
go to servers -> clusters-> new ->give cluster_name->define first member->define other members->finish

how do you add a new cluster member
go to servers -> clusters->cluster_name ->cluster members ->new ->give name/node/others->apply->ok->save

one of the cluster member (jvm) is having issues. To troubleshoot the issue, you decided to take it out of the cluster. How do you do that?
Make its runtime weight to 0

In a complex environment, there are 10 machines. Machine A is having 8GB RAM and machine B having 2GB of RAM. The administrator decided to send twice as many request as machineB to machineA. How can he achive it?
give machineA twice the weight as machineB

After making some changes on a cluster, it is required to recycle/restart all the cluster JVMs. The lead admin told you to make sure that there should not be any downtime during this recycle. Which option do you use to achieve it?
Ripplestart

A large application which has 5web modules has been deployed on to a cluster. After some months, the developer asked you to update on of the 5web modules. How do you do it?
Rollout

what is a backup cluster

can you change the cluster name, once it was created
No

1. What is the difference b/n web and app servers

2. What are the new features in WAS ND 6.1

3. How many types of profiles are available in WAS ND6.1

4. What is a Cell

5. What is NodeAgent

6. What is DMGRs default admin port

7. What are the pre-perquisites for installing WAS

8. While installing WAS, if the installation fails and no logs are found. Which location should you check for the details

9. While installing WAS, can we create any CELL in WAS ND 6.1

10. After installing WAS, you found INSTALLCONFPATIALSUCCESS in the install log, what does it mean?

11. While installing as non-root, can WAS detect other existing WAS installations

12. Which file hold the existing WAS installation details

13. After installation you found that some ports are conflicting, how do you change/update

More Here

Courtesy:http://middlewarekb.wordpress.com/2010/11/20/websphere-interview-questions/