FWD » Core Development » Runtime Infrastructure

There are a few issues here.

1. instead of P2J Server, please use rest_server or something like this (i.e. all lowercase and without spaces).

2. this section is incorrect:

Then added configurations under the "/security/accounts/processes/"

<node class="process" name="standard">
   <node-attribute name="enabled" value="TRUE"/>
   <node-attribute name="description" value="P2J server"/>
   <node-attribute name="master" value="TRUE"/>
   <node-attribute name="server" value="TRUE"/>
   <node-attribute name="alias" value="standard"/>
</node>

If should be:

<node class="process" name="rest_server">
   <node-attribute name="enabled" value="TRUE"/>
   <node-attribute name="description" value="Account for the legacy REST server"/>
   <node-attribute name="master" value="TRUE"/>
   <node-attribute name="server" value="TRUE"/>
   <node-attribute name="alias" value="rest_server"/>
</node>

3. the rest node must be defined with a certificate alias, and not FWD account name:

          <node class="container" name="rest">
            <node class="boolean" name="enabled">
              <node-attribute name="value" value="TRUE"/>
            </node>
            <node class="string" name="basepath">
              <node-attribute name="value" value="rest/"/>
            </node>
            <node class="string" name="alias">
              <node-attribute name="value" value="rest_server"/>
            </node>
            <node class="string" name="appserver">
              <node-attribute name="value" value="AppServeris"/>
            </node>
          </node>

4. You should define a dedicated process account for the appservers. So instead of:

Under the "/server/default/"

        <node class="process" name="P2J server">
          <node-attribute name="appserver" value="AppServeris"/>
        </node>

there should be something like, under /security/accounts/processes/:

          <node class="process" name="appserveris_process">
            <node-attribute name="appserver" value="AppServeris"/>
            <node-attribute name="enabled" value="TRUE"/>
            <node-attribute name="description" value="Process for appserver."/>
            <node-attribute name="alias" value="appserveris_alias"/>
            <node-attribute name="master" value="FALSE"/>
            <node-attribute name="server" value="FALSE"/>
          </node>

5. The scheduler configuration must reference the process account name for the appserver, like this:

    <node class="container" name="scheduler">
         <node class="job" name="start_appserver">
            <node-attribute name="type" value="process" />
            <node-attribute name="target" value="appserveris_process" />
            <node-attribute name="enabled" value="TRUE" />
            <node-attribute name="mode" value="now" />
          </node>

6. The <object-class name="start_appserver" leaf="true" immutable="false"> node and its children must be removed, these are schema nodes and not something which should appear in directory.xml

7. for the appserver, this configuration should appear under /server/default/runtime:

          <node class="container" name="appserveris_process">
            <node class="container" name="clientConfig">
              <node class="string" name="outputToFile">
                <node-attribute name="value" value="client_%appserver%_%pid%_%timestamp%_%userid%.log"/>
              </node>
              <node class="string" name="cfgOverrides">
                <node-attribute name="value" value="client:driver:background=true"/>
              </node>
              <node class="string" name="systemUser">
                <node-attribute name="value" value="[replace with an OS user]"/>
              </node>
            </node>
          </node>

Note that for the appserveris_alias and rest_server process accounts the certificate/private-keys need to be generated. The builtin certificate generation tool can be used for this.

I made all your suggested changes, but now getting error:

com.goldencode.p2j.cfg.ConfigurationException: server ID <standard> has no account
    at com.goldencode.p2j.security.SecurityCache.verifyServerId(SecurityCache.java:2881)
    at com.goldencode.p2j.security.SecurityCache.<init>(SecurityCache.java:455)
    at com.goldencode.p2j.security.SecurityCache.<init>(SecurityCache.java:353)
    at com.goldencode.p2j.security.SecurityManager.<init>(SecurityManager.java:697)
    at com.goldencode.p2j.security.SecurityManager.createInstance(SecurityManager.java:787)
    at com.goldencode.p2j.main.StandardServer.bootstrap(StandardServer.java:873)
    at com.goldencode.p2j.main.ServerDriver.start(ServerDriver.java:485)
    at com.goldencode.p2j.main.CommonDriver.process(CommonDriver.java:444)
    at com.goldencode.p2j.main.ServerDriver.process(ServerDriver.java:209)
    at com.goldencode.p2j.main.ServerDriver.main(ServerDriver.java:863)

I found the solution. It was not changed server-id on server.xml file.

I cant understand, what kind of certificates should be "trusted" getting this error:

Mar 31, 2021 9:14:15 AM com.goldencode.p2j.net.SSL onFailure
WARNING: handshake failure
javax.net.ssl.SSLHandshakeException: No trusted certificate found
    at sun.security.ssl.Alert.createSSLException(Alert.java:131)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:324)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:267)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:262)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
    at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:377)
    at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
    at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:968)
    at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:955)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:902)
    at com.goldencode.p2j.net.SSL.lambda$handshake$0(SSL.java:375)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
Caused by: sun.security.validator.ValidatorException: No trusted certificate found
    at sun.security.validator.SimpleValidator.buildTrustedChain(SimpleValidator.java:398)
    at sun.security.validator.SimpleValidator.engineValidate(SimpleValidator.java:135)
    at sun.security.validator.Validator.validate(Validator.java:271)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:315)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:278)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:141)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632)
    ... 12 more

Is the error when trying to start an appserver?

If so, it may be because the alias for the appserver certificate, configured as 'appserveris_alias' in:

        <node class="process" name="appserveris_process">
            <node-attribute name="appserver" value="AppServeris"/>
            <node-attribute name="enabled" value="TRUE"/>
            <node-attribute name="description" value="Process for appserver."/>
            <node-attribute name="alias" value="appserveris_alias"/>
            <node-attribute name="master" value="FALSE"/>
            <node-attribute name="server" value="FALSE"/>
          </node>

What aliases do you have under the /security/certificates/peers node?

I have three aliases "shared", "appserveris_alias", "rest_server".

You've mentioned that you had to change the server-id on server.xml.

Why did you need to do this? The 'standard' process account and its certificate (in the directory.xml you can find for the Hotel app), is for the FWD server. This should not be changed, or if it is changed, then there are lots of additional places which need to be updated. And there is no need to change this 'standard' name at this phase.

At this time, I would advise you this: please do a diff of your directory.xml with the one from the Hotel app, and revert all the 'standard'-related changes. And update back the server.xml to use 'standard'.

For the appserver and legacy REST support to work, all required changes do not involve modifying anything related to the 'standard' server account.

I changed server-id on server.xml because I got error mentioned above "server ID <standard> has no account".

Maybe it is possible to turn of security (something like develop mode, where I don't need certificates?)

For the appservers agents to start, the FWD server must have SSL enabled.

By changing the server account name (which defaults to 'standard'), does not affect just the certificates - there are ACL subjects and maybe more which need to be renamed.

Please put back the 'standard' changes (including its process account) and try again.

Deividas: Is everything working? I'd like to close this task if it is resolved.