Page History

...

JobScheduler currently comes with a proprietary built-in web server. However, it is possible to configure JobScheduler to work with Jetty by using the JobScheduler plugin feature. This document describes what you have to do to run JobScheduler with an underlying Jetty web server.

Installation

Since release 1.3.12.2163 the JobScheduler installer contains a plugin for Jetty. Note that this plugin is still under development and is provided "as is".
The installer generates some symlinks to simulate virtual directories for JOC (JobScheduler Operations Center). The symlink generation is not supported for Windows systems dated before Windows Vista.
- The installer configures the ./config/factory.ini, the ./config/jetty.xml and the ./config/web.xml files as described below.
- The installer does not configure the ./config/scheduler.xml file. If you want to use Jetty then you have to configure ./config/scheduler.xml as described below.
- The installer contains a keystore file for testing https. This keystore is not trusted and does not provide the correct hostname, but can still be used for testing.

Please created your own keystore file jetty.jks.

After the installation you can open JOC with Jetty via:

...

You can modify these ports in the ./config/jetty.xml.

If you operate multiple JobScheduler installations for the same host then you have to modify the ports of Jetty accordingly to prevent ports from being used twice.

Configure factory.ini (Put the necessary libraries in the classpath)

To run JobScheduler with Jetty instead the built-in web-server you have to use the Jetty plugin. It is a part of the library com.sos.scheduler.engine.plugins.jetty-xxx.jar. Beside the com.sos.scheduler.engine.plugins.jetty-xxx.jar it is necessary to add any dependent libraries for the Jetty plugin to the classpath of JobScheduler. The installer adds them to the ./lib/jetty_ext folder and to the classpath in the ./config/factory.ini file.

...

Code Block

title	Example for Windows

 ...
 [java]
 class_path = ${SCHEDULER_HOME}/lib/*.jar;${SCHEDULER_HOME}/lib/hibernate/*.jar;${SCHEDULER_HOME}/lib/jetty_ext/*.jar
 ...

Configure scheduler.xml

To use the Jetty plugin you have to configure this with the file scheduler.xml:

Code Block

language	xml
collapse	true

 <spooler>
  <config ...>
    ...
    <security ignore_unknown_hosts="yes">
      <allowed_host host="localhost" level="all"/>
      <allowed_host host="192.11.0" level="all"/>
    </security>
    
    <plugins>
      ...
      <plugin java_class="com.sos.scheduler.engine.plugins.jetty.JettyPlugin">
        <plugin.config />
      </plugin>
      ...
    </plugins>
    ...
  </config>
 </spooler>

Please note that it is required to specify an empty plugin.config element.

Simple user authentication

It is possible to configure simple user authentication in the plugin configuration, e.g.

Code Block

language	xml
collapse	true

 <plugins>
   <plugin java_class="com.sos.scheduler.engine.plugins.jetty.JettyPlugin">
     <plugin.config>
       <loginService>
         <logins>
           <login name="testName" password="testPassword" roles="SecurityLevel.all"/>
         </logins>
       </loginService>
     </plugin.config>
   </plugin>
 </plugins>

...

Add a security constraint to the file web.xml like this:

Code Block

language	xml
collapse	true

    <security-constraint>
        <web-resource-collection>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>SecurityLevel.info</role-name>
            <role-name>SecurityLevel.all</role-name>
        </auth-constraint>
    </security-constraint>

Configure `jetty.xml`

To operate JobScheduler with Jetty it is also required to create two configuration files for the Jetty web server (./config/jetty.xml and ./config/web.xml). The minimum configuration defines a connector for the port for http communication with JobScheduler:

Code Block

language	xml
collapse	true

 <Configure class="org.eclipse.jetty.server.Server">
   <Call name="addConnector">
     <Arg>
       <New class="org.eclipse.jetty.server.nio.SelectChannelConnector">
         <Set name="port">40444</Set>
       </New>
     </Arg>
   </Call>
 </Configure>

...

With a second connector it is possible to define a communication channel via https (SSL):

Code Block

language	xml
collapse	true

 <Call name="addConnector">
  <Arg>
    <New class="org.eclipse.jetty.server.ssl.SslSelectChannelConnector">
      <Arg>
        <New class="org.eclipse.jetty.util.ssl.SslContextFactory">
          <Set name="keyStore"><SystemProperty name="jetty.home" default="." />/ssl/jetty.jks</Set>
          <Set name="keyStorePassword">jobscheduler</Set>
          <Set name="keyManagerPassword">jobscheduler</Set>
          <Set name="trustStore"><SystemProperty name="jetty.home" default="." />/ssl/jetty.jks</Set>
          <Set name="trustStorePassword">jobscheduler</Set>
        </New>
      </Arg>
      <Set name="port">48444</Set>
      <Set name="maxIdleTime">30000</Set>
    </New>
  </Arg>
 </Call>

The SSL connection expects the jetty keystore file jetty.jks in the subfolder $SCHEDULER_DATA/ssl. With the above configuration you can connect to JobScheduler via https at port 48444.

keystore

To generate a keystore file use keytool:

Code Block

language	bash

keytool -genkey -alias jetty -keyalg RSA -keysize 1024 -dname "CN=[hostname], OU=JobScheduler, O=SOS GmbH, L=Berlin C=DE" -keystore my_jetty.jks -storepass jobscheduler -keypass jobscheduler -validity 1826

where hostname should be the JobScheduler host. Use own values for OU, O and L.

Configure web.xml

To run JobScheduler with Jetty it is required to create two configuration files for the Jetty web server (jetty.xml and web.xml). The files have to bestored in the $SCHEDULER_DATA/config folder.

...

No Format
file:///c:/Program Files (x86)/sos-berlin.com/jobscheduler/[scheduler_id] on Windows

No Format
file:///c:/Program Files (x86)/sos-berlin.com/jobscheduler/[scheduler_id] on Linux

Code Block

language	xml
collapse	true

 <?xml version="1.0" encoding="UTF-8"?>
 <web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
          xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd" 
          xmlns="http://java.sun.com/xml/ns/j2ee" 
          version="2.4">
    <display-name>JobScheduler test configuration (web.xml)</display-name>
    <servlet>
        <servlet-name>Default</servlet-name>
        <servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
        <init-param>
            <param-name>dirAllowed</param-name>
            <param-value>false</param-value>
        </init-param>
    </servlet>
    <servlet-mapping>
        <servlet-name>Default</servlet-name>
        
        <url-pattern>/</url-pattern>
    </servlet-mapping>
    <servlet>
        <servlet-name>JOC</servlet-name>
        <servlet-class>org.eclipse.jetty.servlet.DefaultServlet</servlet-class>
        <init-param>
            <param-name>resourceBase</param-name>
            <param-value>file:///c:/Program Files (x86)/sos-berlin.com/jobscheduler/scheduler</param-value>
        </init-param>
    </servlet>
    <servlet-mapping>
        <servlet-name>JOC</servlet-name>
        <url-pattern>/operations_gui/*</url-pattern>
    </servlet-mapping>
 </web-app>

Send commands via HTTP (POST|GET)

If you use Jetty and you want to send a command (e.g. <show_state/>) to the JobScheduler then you have to use the URL:

Code Block

language	bash

http://localhost:40444/jobscheduler/engine-cpp/

or respectively.

Code Block

language	bash

https://localhost:48444/jobscheduler/engine-cpp/

Example for HTTP GET

Code Block

language	bash

http://localhost:40444/jobscheduler/engine-cpp/&lt;show_state/&gt;

...

The commands that can be sent via HTTP GET have been restricted from JobScheduler version 1.7 onwards.
See Release Information for further information.

Jetty configuration examples

User authentication with a properties file

Beside the Simple user authentication provided by the Jetty plugin you can use a more complex authentification method described by the Jetty configuration. The example below shows the use of the HashLoginService, a mechanism whose authentication and authorization information is stored in a properties file.

First make sure, that your plugin declaration in scheduler.xml does not contain any authentification information:

Code Block

language	xml
collapse	true

   <plugins>
     <plugin java_class="com.sos.scheduler.engine.plugins.jetty.JettyPlugin">
       <plugin.config />
     </plugin>
     ...
   </plugins>

In the second step you should define the HashLoginService in your Jetty configuration (jetty.xml) as a user realm. That means that you have to configure at least the location of the properties file containing the user information (userid, password, roles) and assign them a name (here myRealm).

Code Block

language	java
collapse	true

    <Call name="addBean">
        <Arg>
            <New class="org.eclipse.jetty.security.HashLoginService">
                <Set name="name">myRealm</Set>
                <Set name="config"><SystemProperty name="jetty.home" default="." />/config/realm.properties</Set>
                <Set name="refreshInterval">0</Set>
            </New>
        </Arg>
    </Call>

The properties file config/realm.properties contains one or more user definitions, e.g.

Code Block

language	text
collapse	true

   infouser: test, SecurityLevel.info
   alluser: test, SecurityLevel.all

Please note: In realm.properties you can specify the password like

Code Block

language	text
collapse	true

  alluser: MD5:098f6bcd4621d373cade4e832627b4f6, SecurityLevel.all

...

Finally you have to configure a security constraint and assign your user realm myRealm to a login configuration. To do this you have to update your web.xml:

Code Block

language	xml
collapse	true

    <security-constraint>
        <web-resource-collection>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <auth-constraint>
            <role-name>SecurityLevel.info</role-name>
            <role-name>SecurityLevel.all</role-name>
        </auth-constraint>
    </security-constraint>

Code Block

language	xml
collapse	true

    <login-config>
        <auth-method>BASIC</auth-method>
        <realm-name>myRealm</realm-name>
    </login-config>

...

SecurityLevel.info grants exclusively permissions to watch jobs but not to start jobs, while SecurityLevel.all grants permissions to start jobs.

IP authorization

To restrict the access for specific hosts you have to define an IPAccessHandler in your jetty.xml:

Code Block

language	xml
collapse	true

    <Get id="oldhandler" name="handler" />
    <Set name="handler">
        <New class="org.eclipse.jetty.server.handler.IPAccessHandler">
            <Set name="handler"><Ref id="oldhandler"/></Set>
            <Set name="white">     
                <Array type="java.lang.String">
                    <Item>127.0.0.1</Item>    
                </Array>
            </Set>
        </New>
    </Set>

...

Space shortcuts

Page tree

Versions Compared

Old Version 46

New Version 47

Key

Installation

Configure factory.ini (Put the necessary libraries in the classpath)

Configure scheduler.xml

Simple user authentication

Configure `jetty.xml`

keystore

Configure web.xml

Send commands via HTTP (POST|GET)

Jetty configuration examples

User authentication with a properties file

IP authorization

Space shortcuts

Page tree

Page History

Versions Compared

Old Version 46

New Version 47

Key

Installation

Configure factory.ini (Put the necessary libraries in the classpath)

Configure scheduler.xml

Simple user authentication

Configure jetty.xml

keystore

Configure web.xml

Send commands via HTTP (POST|GET)

Jetty configuration examples

User authentication with a properties file

IP authorization

Configure `jetty.xml`