configuration

Using Settings.xml to handle Multiple Mirrors in Maven

The goal of having an internal artifactory is to host library for maven, so everytime we do java build, we dont need to pull the whole libraries from internet. Usally we have something like Nexus or JFrog for this.

But the thing is, sometimes we already have a working application that is running well when pulling libraries from online before, and now we need to change it into pointing into our artifact repository without have to change the maven’s pom.xml configuration.

for example, we have some pom.xml file which is pointing to a specific online repository like the sample below,

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
	xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
	<modelVersion>4.0.0</modelVersion>
	<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.7.4</version>
		<relativePath /> 
	</parent>
	<groupId>com.something</groupId>
	<artifactId>some-java-app</artifactId>
	<version>0.0.1-SNAPSHOT</version>
	<name>some-java-app</name>
	<description>some java app</description>
	<properties>
		<java.version>17</java.version>
		<tomcat.version>9.0.68</tomcat.version>
	</properties>
	<repositories>
		<repository>
			<id>splunk-releases</id>
			<name>Splunk Releases</name>
			<url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
		</repository>
		<repository>
			<id>spring-releases</id>
			<name>Spring Releases</name>
			<url>https://repo.spring.io/libs-release</url>
		</repository>
	</repositories>
	...
</project>

We can see that application is connecting to multiple maven repositories, such as Splunk JFrog and Spring Repository, other than the default Maven Central.

For this approach, we can create a custom settings.xml and implement a multiple mirror approach for handling to this problem. The result is looks like below xml,

<?xml version="1.0" encoding="UTF-8"?>
<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 http://maven.apache.org/xsd/settings-1.0.0.xsd">
    <servers>
        <server>
            <id>default</id>
            <username>username</username>
            <password>password</password>
        </server>
        <server>
            <id>splunk-releases</id>
            <username>username</username>
            <password>password</password>
        </server>
		<server>
            <id>spring-releases</id>
            <username>username</username>
            <password>password</password>
        </server>
    </servers>

    <mirrors>
        <mirror>
            <id>default</id>
            <name>Default Repository</name>
            <url>https://my-artifact-repository/default/maven2/</url>
            <mirrorOf>*, !splunk-releases, !spring-releases</mirrorOf>
        </mirror>
        <mirror>
            <id>splunk-releases</id>
            <name>Splunk Local Repository</name>
            <url>https://my-artifact-repository/splunk/maven2/</url>
            <mirrorOf>splunk-releases</mirrorOf>
        </mirror>
		<mirror>
            <id>spring-releases</id>
            <name>Spring Local Repository</name>
            <url>https://my-artifact-repository/spring/maven2/</url>
            <mirrorOf>spring-releases</mirrorOf>
        </mirror>
    </mirrors>
</settings>

As we can see on above, we have multiple mirror of repositories with each pointing to different local artifact repository endpoints. We can run maven build with having this configuration as parameter.

$ mvn clean package -s settings.xml

How to Clear User Cache in Keycloak

Keycloak provides a very convenient method of reducing workload to either database or active directory, and that is by using cache mechanism. But sometimes we want to trigger clearing cache manually, for example when there is some changes into the user data which coming from external applications.

We can do that by going to Keycloak menu, click on Realm Settings, and go to Cache tabs. We can clear cache by clicking on the User Cache Clear button.

But becareful since it will clear the whole user-cache, and not a specific user only.

How to Connect to Red Hat AMQ using Artemis and SSL

We can protect our AMQ end point using a specific SSL, preventing those who doesnt have the exact certificate to connecting to my AMQ server’s endpoint.

In order to do so, first we need to create a very simple certificate to be use by our AMQ server with a simple keytool command

keytool -genkey -alias artemists -keyalg RSA -sigalg SHA1withRSA -keystore artemis.ts -keysize 2048

It will generate a new file, artemis.ts

And generate a new keystore,

keytool -genkey -v -keystore broker02.ks -alias broker02 -sigalg SHA1withRSA  -keyalg RSA -keysize 2048 -validity 10000

Put string “password” if you need to input a password while generating those two items.

And reference those files on our AMQ broker.xml configuration,

<acceptor name="core">
tcp://0.0.0.0:61617?protocols=CORE;sslEnabled=true;
	keyStorePath=D:/tmp/broker02.ks;keyStorePassword=password;
	trustStorePath=D:/tmp/artemis.ts;trustStorePassword=password;
	enabledCipherSuites=SSL_RSA_WITH_RC4_128_SHA,SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,RSA;enabledProtocols=TLSv1,TLSv1.1,TLSv1.2;
	sslProvider=JDK;sniHost=localhost;anycastPrefix=jms.queue.;multicastPrefix=jms.topic;tcpSendBufferSize=1048576;
	tcpReceiveBufferSize=1048576;useEpoll=true;
	amqpCredits=1000;amqpMinCredits=300
</acceptor>

Start our server,

artemis run

We can connect using our artemis client with below command,

artemis producer --url tcp://127.0.0.1:61617?sslEnabled=true --message-count 1

The first time connected, it will shows error on your client’s side,

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
        at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
        at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
        at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)

And on your server’s side,

Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) [java.base:]
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117) [java.base:]
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:308) [java.base:]
        at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:285) [java.base:]
        at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:181) [java.base:]
        at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:164) [java.base:]
        at java.base/sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:685) [java.base:]

Means you need to use your server’s cert on your client while making request, there are multiple ways of doing that. The simplest is by putting your server’s certificate on your local client’s trust store.

keytool -exportcert -alias artemists -keystore artemis.ts -file artemis.cer
keytool -exportcert -alias broker-server -keystore broker02.ks -file broker02.cer

keytool -import -alias artemists -file artemis.cer -cacerts
keytool -import -alias broker-server -file broker02.cer -cacerts

Use password “changeit” while importing your certificate to client’s cacerts.

When re-run artemis producer again, it should gives a successful message like this

\bin>artemis producer --url tcp://127.0.0.1:61617?sslEnabled=true --message-count 1
Producer ActiveMQQueue[TEST], thread=0 Started to calculate elapsed time ...

Producer ActiveMQQueue[TEST], thread=0 Produced: 1 messages
Producer ActiveMQQueue[TEST], thread=0 Elapsed time in second : 0 s
Producer ActiveMQQueue[TEST], thread=0 Elapsed time in milli second : 27 milli seconds

Starting JBoss EAP or Wildfly with a Specific XML Configuration

We can run EAP or Wildfly with a specific XML configuration, not just the default one. For example we have a new configuration with the name of standalone-full-ha_1.xml, and want to run EAP based on it. First we need to put corresponding XML on below directory,

%WILDFLY_DIRECTORY%\standalone\configuration

And run using below command,

standalone.bat -c standalone-full-ha_1.xml

(Y)

Run as a Root User on Openshift

Sometimes my docker images got permission issue when deployed to Openshift, due to Openshift gives a random userid as enforced by its default security policy. In order to “bypass” those constrain and run my image as root, i run below command,

oc adm policy add-scc-to-user anyuid -z default -n project-name