Software Links
Getting Started
- Doc Structure
- A Globus Primer
- Globus Is Modular!
- Quickstart
- Installing GT
- Platform Notes
- GT Developer's Guide
- GT User's Guide (coming soon)
- Migrating from GT2
- Migrating from GT3
Reference
- Best Practices
- Coding Guidelines
- API docs
- Public Interfaces (coming soon)
- Resource Properties
- Samples
- Glossary
- Performance Studies (coming soon)
Manuals
Common Runtime
Security
- Non-WS (General) Security
- WS Java Security
- Message-level
- Authz Framework
- CAS
- Delegation Service
- MyProxy
- GSI-OpenSSH
- SimpleCA
- SGAS
Data Mgt
MDS4
Execution Mgt
Table of Contents
The Globus services can be run either in the standalone Java WS Core container that is installed with GT, or deployed into Tomcat.
The standalone Java WS Core container can be started and stopped with the provided globus-start-container and globus-stop-container programs. There are also helper programs (available only with the full GT installation) to start and stop the container detached from the controlling terminal (globus-start-container-detached and globus-stop-container-detached).
To deploy a service into Java WS Core container use the globus-deploy-gar tool. To undeploy a service use globus-undeploy-gar.
It is recommended to increase the maximum heap size of the JVM when running the container.
By default on Sun JVMs a 64MB maximum heap size is used. The maximum heap size can be set using
the -Xmx JVM option. Example:
$ setenv GLOBUS_OPTIONS -Xmx512M $ $GLOBUS_LOCATION/bin/globus-start-container
The above example will make the container start with maximum heap size set to 512MB.
It is also recommended to experiment with other JVM settings to improve performance. For
example, the -server option on Sun JVMs enables a server VM
which can deliver better performance for server applications.
To deploy a Java WS Core installation into Tomcat run:
$ cd $GLOBUS_LOCATION $ ant -f share/globus_wsrf_common/tomcat/tomcat.xml
deploySecureTomcat \ -Dtomcat.dir=<tomcat.dir>
Where <tomcat.dir> is an absolute
path to the Tomcat installation directory. Also,
-Dwebapp.name=<name> can be specified to set
the name of the web application under which the installation will be deployed. By default
"wsrf" web application name is used.
The deploySecureTomcat task will update an existing Tomcat
deployment if Java WS Core was already deployed under the specified web application name. The
redeploySecureTomcat task can be used instead to overwrite
the existing deployment.
![]() | Note |
|---|---|
Please note that during deployment a subset of the files from Java WS Core installation is copied into Tomcat. Also, the copied files in Tomcat might have different permissions then the originals. |
In addition to the above deployment step you will also need to modify the Tomcat
<tomcat_root>/conf/server.xml configuration file. In
particular you will need to add the following configuration entries:
Tomcat 4.1.x
Add a HTTPS Connector in the <Service name="Tomcat-Standalone"> section and update the parameters appropriately with your local configuration:
<Connector className="org.apache.catalina.connector.http.HttpConnector" port="8443" minProcessors="5" maxProcessors="75" authenticate="true" secure="true" scheme="https" enableLookups="true" acceptCount="10" debug="0"> <Factory className="org.globus.tomcat.catalina.net.HTTPSServerSocketFactory" proxy="/path/to/proxy/file" cert="/path/to/certificate/file" key="/path/to/private/key/file" cacertdir="/path/to/ca/certificates/directory" encryption="true"/> </Connector>In the above the
proxy,cert,keyandcacertdirattributes are optional. Furthermore, theproxyand the combination ofcertandkeyattributes are mutually exclusive. Theencryptionattribute is also optional (defaults totrueif not set).![[Important]](/docbook-images/important.gif)
Important The credentials and certificate configuration is used only by the connector and is not used by the rest of the web services stack in Globus Toolkit. To configure credentials for use in the toolkit, refer Section 1, “Security Descriptors Introduction”.
The
modeattribute can also be set to specify the connection mode. There are two supported connection modes:sslandgsi. Thesslmode indicates a regular SSL connection mode. Thegsimode indicates a SSL connection mode with transport-level delegation support. Thesslmode is the default mode if themodeattribute is not specified. Please note that thegsimode is intended for advanced users only.Add a HTTPS Valve in the <Engine name="Standalone" ... > section:
<Valve className="org.globus.tomcat.catalina.valves.HTTPSValve"/>
Tomcat 5.0.x
Add a HTTPS Connector in the <Service name="Catalina"> section and update the parameters appropriately with your local configuration:
<Connector className="org.globus.tomcat.coyote.net.HTTPSConnector" port="8443" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" autoFlush="true" disableUploadTimeout="true" scheme="https" enableLookups="true" acceptCount="10" debug="0" proxy="/path/to/proxy/file" cert="/path/to/certificate/file" key="/path/to/private/key/file" cacertdir="/path/to/ca/certificates/directory" encryption="true"/>In the above the
proxy,cert,keyandcacertdirattributes are optional. Furthermore, theproxyand the combination ofcertandkeyattributes are mutually exclusive. Theencryptionattribute is also optional (defaults totrueif not set).![[Important]](/docbook-images/important.gif)
Important The credentials and certificate configuration is used only by the connector and is not used by the rest of the web services stack in Globus Toolkit. To configure credentials for use in the toolkit, refer Section 1, “Security Descriptors Introduction”.
The
modeattribute can also be set to specify the connection mode. There are two supported connection modes:sslandgsi. Thesslmode indicates a regular SSL connection mode. Thegsimode indicates a SSL connection mode with transport-level delegation support. Thesslmode is the default mode if themodeattribute is not specified. Please note that thegsimode is intended for advanced users only.Add a HTTPS Valve in the <Engine name="Catalina" ... > section:
<Valve className="org.globus.tomcat.coyote.valves.HTTPSValve"/>
Tomcat 5.5.x
Add a HTTPS Connector in the <Service name="Catalina"> section of the Tomcat config file and update the parameters appropriately with your local configuration:
<Connector className="org.globus.tomcat.coyote.net.HTTPSConnector" port="8443" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" autoFlush="true" disableUploadTimeout="true" scheme="https" enableLookups="true" acceptCount="10" debug="0" protocolHandlerClassName="org.apache.coyote.http11.Http11Protocol" socketFactory="org.globus.tomcat.catalina.net.BaseHTTPSServerSocketFactory" proxy="/path/to/proxy/file" cert="/path/to/certificate/file" key="/path/to/private/key/file" cacertdir="/path/to/ca/certificates/directory" encryption="true"/>
In the above the
proxy,cert,keyandcacertdirattributes are optional. Furthermore, theproxyand the combination ofcertandkeyattributes are mutually exclusive. Theencryptionattribute is also optional (defaults totrueif not set).![[Important]](/docbook-images/important.gif)
Important The credentials and certificate configuration is used only by the connector and is not used by the rest of the web services stack in Globus Toolkit. To configure credentials for use in the toolkit, refer Section 1, “Security Descriptors Introduction”.
The
modeattribute can also be set to specify the connection mode. There are two supported connection modes:sslandgsi. Thesslmode indicates a regular SSL connection mode. Thegsimode indicates a SSL connection mode with transport-level delegation support. Thesslmode is the default mode if themodeattribute is not specified. Please note that thegsimode is intended for advanced users only.Add a HTTPS Valve in the <Engine name="Catalina" ... > section of the Tomcat config file:
<Valve className="org.globus.tomcat.coyote.valves.HTTPSValve55"/>
![]() | Note |
|---|---|
It is recommend to run Tomcat with Java 1.4.2+. |
You may have to edit
<tomcat.dir>/webapps/wsrf/WEB-INF/web.xml if you are
running Tomcat on a non-default port, that is if not using port 8443 (HTTPS). For example, if
you run Tomcat on port 443 using HTTPS then the WSRF servlet entry should be modified to have
the following defaultProtocol and
defaultPort parameters:
<web-app> ... <servlet>
<servlet-name>WSRFServlet</servlet-name>
<display-name>WSRF Container Servlet</display-name>
<servlet-class> org.globus.wsrf.container.AxisServlet
</servlet-class> <init-param>
<param-name>defaultProtocol</param-name>
<param-value>https</param-value> </init-param>
<init-param> <param-name>defaultPort</param-name>
<param-value>443</param-value> </init-param>
<load-on-startup>true</load-on-startup> </servlet>
... </web-app> Alternatively, you can use the setDefaults Ant task to set the
default protocol/port in the web.xml file:
$ cd $GLOBUS_LOCATION $ ant -f share/globus_wsrf_common/tomcat/tomcat.xml setDefaults \
-Dtomcat.dir=<tomcat.dir> \
-DdefaultPort=<port>
-DdefaultProtocol=<protocol>
Also, by default the
webContext
property is set to the directory name of the web application on the file system.
However, sometimes the context under which the web application is published might be different
from the directory name of the application. In such cases it is necessary to explicitly
configure the published context name in the web.xml file. To configure
the web application context name set the webContext parameter
in web.xml file. For example (assuming services are published under
http://localhost:8080/foo/services) the
webContext should be set to:
<web-app> ... <servlet>
<servlet-name>WSRFServlet</servlet-name> ...
<init-param> <param-name>webContext</param-name>
<param-value>foo</param-value> </init-param> ...
<load-on-startup>true</load-on-startup> </servlet>
... </web-app> To enable local
invocation in Tomcat you must add axis-url.jar to the
CLASSPATH before starting Tomcat.
For example on Windows:
> cd <tomcat.dir> > set
CLASSPATH=<tomcat.dir>\common\lib\axis-url.jar > bin\startupOn Unix/Linux (csh/tcsh):
$ cd <tomcat.dir> $ setenv CLASSPATH
<tomcat.dir>/common/lib/axis-url.jar $ bin/startup Please always check the Tomcat log files under the
<tomcat.dir>/logs directory for any errors or
exceptions.
Tomcat 4.1.x
Copy
$GLOBUS_LOCATION/lib/common/commons-logging-*.jarfiles to<tomcat.dir>/common/libdirectory. Also, copy<tomcat.dir>/webapps/wsrf/WEB-INF/classes/log4j.propertiesfile to<tomcat.dir>/common/classes/directory. Then configure the Log4j configuration file in<tomcat.dir>/common/classes/directory appropriately. The debugging settings will affect all the code in all web applications.Tomcat 5.0.x, 5.5.x
Copy
$GLOBUS_LOCATION/lib/common/log4j-*.jarand$GLOBUS_LOCATION/lib/common/commons-logging-*.jarfiles to<tomcat.dir>/webapps/wsrf/WEB-INF/lib/directory. Then configure the Log4j configuration file in<tomcat.dir>/webapps/wsrf/WEB-INF/classes/directory appropriately. The debugging settings will only affect the web application code.
To create a .war of a Java WS Core installation do:
$ cd $GLOBUS_LOCATION $ ant -f share/globus_wsrf_common/tomcat/tomcat.xml war
-Dwar.file=<war.file>
Where <war.file> specifies the absolute path of the war file.
Please note that deploying a war file might not be
enough to have a working Java WS Core deployment. For example, in some cases the
xalan.jar must be placed in the
endorsed directory of the container.
Assuming Java WS Core is already deployed into Apache Tomcat (as described in Deploying Java WS Core), use the globus-deploy-gar tool with the -tomcat <tomcat.dir> option to deploy your GT service directly into Tomcat. Similarly, to undeploy a service, use the globus-undeploy-gar tool with the -tomcat <tomcat.dir> option to undeploy the service from Tomcat.
Alternatively, to indirectly deploy a service into Tomcat, first deploy the service into a regular GT installation using the globus-deploy-gar tool and then redeploy the GT installation into Tomcat (as described in Deploying Java WS Core). Similarly, to undeploy a service, first undeploy the service from a regular GT installation using globus-undeploy-gar tool and then redeploy the GT installation into Tomcat.
![]() | Note |
|---|---|
Some GT services may not work properly in Tomcat. |
To deploy a Java WS Core installation into JBoss (version 4.0.x+) do the following:
Run:
$ cd $GLOBUS_LOCATION $ ant -f share/globus_wsrf_common/tomcat/jboss.xml deployJBoss \ -Djboss.dir=<jboss.dir>Where <jboss.dir> is an absolute path to the JBoss installation directory. Also,
-Dwebapp.name=<name>can be specified to set the name of the web application under which the installation will be deployed. By default "wsrf" web application name is used.Add a HTTPS Connector in the <Service name="Catalina"> section of the Tomcat config file and update the parameters appropriately with your local configuration:
<Connector className="org.globus.tomcat.coyote.net.HTTPSConnector" port="8443" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" autoFlush="true" disableUploadTimeout="true" scheme="https" enableLookups="true" acceptCount="10" debug="0" protocolHandlerClassName="org.apache.coyote.http11.Http11Protocol" socketFactory="org.globus.tomcat.catalina.net.BaseHTTPSServerSocketFactory" proxy="/path/to/proxy/file" cert="/path/to/certificate/file" key="/path/to/private/key/file" cacertdir="/path/to/ca/certificates/directory" encryption="true"/>
In the above the
proxy,cert,keyandcacertdirattributes are optional. Furthermore, theproxyand the combination ofcertandkeyattributes are mutually exclusive. Theencryptionattribute is also optional (defaults totrueif not set).![[Important]](/docbook-images/important.gif)
Important The credentials and certificate configuration is used only by the connector and is not used by the rest of the web services stack in Globus Toolkit. To configure credentials for use in the toolkit, refer Section 1, “Security Descriptors Introduction”.
The
modeattribute can also be set to specify the connection mode. There are two supported connection modes:sslandgsi. Thesslmode indicates a regular SSL connection mode. Thegsimode indicates a SSL connection mode with transport-level delegation support. Thesslmode is the default mode if themodeattribute is not specified. Please note that thegsimode is intended for advanced users only.Add a HTTPS Valve in the <Engine name="Catalina" ... > section of the Tomcat config file:
<Valve className="org.globus.tomcat.coyote.valves.HTTPSValve55"/>
![]() | Note |
|---|---|
JBoss 4.0.x+ installation with embedded Tomcat is required. The Tomcat configuration file should be under
|
![[Note]](/docbook-images/note.gif)