Connecting to SharePoint with Claims Authentication

In a nutshell, the process of connecting to SharePoint happens like this; Make a request, re-direct to an STS for login, post token from login to SharePoint’s STS (‘_trust’ site), post token from SharePoint’s STS to SharePoint, and then capture and store the ‘FedAuth’ cookie generated by the site. Then and only then, can you start accessing the data from the site by providing the ‘FedAuth’ cookie. The diagram below outlines the process in a slightly more detail…




The new SharePoint Client objects accessing SharePoint and most of its information much easier than before. Unfortunately; they are new, and new things have very little support. Fortunately, this fact didn’t keep us from long hours with Microsoft Tech Support (naturally calling me back right as I was about to walk out the door).


Now on to the good stuff…


The primary component of using the SharePoint Client objects is the ClientContext class. This class manages all of the interaction with your application and the SharePoint site. You tell the ClientContext what you want it to do and then tell it to execute. All-in-all, it makes the code much cleaner when pulling information from SharePoint.



Instead of muddying up my code, I decided to extend the ClientContext class and make it able to connect to a Claims-based site on its own. The key to extending the class, was in utilizing the ‘ExecutingWebRequest’ event. Here is where I was able to do all of my work and setup the connection with SharePoint.


But; before I continue, one warning. This is beta code and should be used at your own risk. I currently only having it working by retrieving authentication by impersonating the local context. So, it will not pass on any Claims Based credentials if used from a website (Windows Identity Foundation).


If anyone reading this can figure out a clean way to pass on the user’s token, please let me know. Thanks!
view source
print?
001 using System;
002 using System.Linq;
003 using System.Net;
004 using System.Net.Security;
005 using System.Security.Principal;
006 using System.ServiceModel;
007 using System.ServiceModel.Channels;
008 using System.Text;
009 using System.Web;
010 using System.Xml;
011 using Microsoft.IdentityModel.Protocols.WSTrust;
012 using Microsoft.SharePoint.Client;
013
014 namespace SharePointLibraries
015 {
016 public class ClaimsClientContext : ClientContext
017 {
018 // store this info at the class level for access by the ExecutingWebRequest event
019 private string SharePointRootUrl
020 {
021 get
022 {
023 // return (new Uri(_sharePointSiteUrl)).GetComponents(UriComponents.Scheme | UriComponents.Host, UriFormat.SafeUnescaped).ToString();
024 var siteUri = (new Uri(_sharePointSiteUrl));
025 return string.Format("{0}://{1}/", siteUri.Scheme, siteUri.Host);
026 }
027 }
028 private string _sharePointSiteUrl;
029 private string SharePointSiteUrl
030 {
031 get { return _sharePointSiteUrl.EndsWith("/") ? _sharePointSiteUrl : _sharePointSiteUrl + "/"; }
032 set { _sharePointSiteUrl = value; }
033 }
034 public string SharePointSiteRealm { get; set; }
035 private string _loginStsUrl;
036 private string LoginStsUrl
037 {
038 get { return _loginStsUrl.EndsWith("/") ? _loginStsUrl : _loginStsUrl + "/"; }
039 set { _loginStsUrl = value; }
040 }
041
042 // store the Saml token so that it can be used by successive requests
043 private static string IssuedSamlToken { get; set; }
044 private static DateTime IssuedSamlTokenExpireDate { get; set; }
045
046 ///

047 /// Public constructor for all three being strings
048 ///

049 ///
050 ///
051 ///
052 public ClaimsClientContext(string sharePointSiteUrl, string sharePointSiteRealm, string loginStsUrl)
053 : base(sharePointSiteUrl)
054 {
055 if (sharePointSiteUrl == null) throw new ArgumentNullException("sharePointSiteUrl");
056 if (sharePointSiteRealm == null) throw new ArgumentNullException("sharePointSiteRealm");
057 if (loginStsUrl == null) throw new ArgumentNullException("loginStsUrl");
058
059 // save the settings
060 SharePointSiteUrl = sharePointSiteUrl;
061 SharePointSiteRealm = sharePointSiteRealm;
062 LoginStsUrl = loginStsUrl;
063
064 // specify the default credentials to use
065 Credentials = CredentialCache.DefaultCredentials;
066
067 // add a handler for the ExecutingWebReques event to provide the SAML token
068 // this.ExecutingWebRequest += new EventHandler(ClientContext_ExecutingWebRequest);
069 ExecutingWebRequest += ClientContext_ExecutingWebRequest;
070 }
071
072 ///

073 /// Public constructor for Site Url being a Uri
074 ///

075 ///
076 ///
077 ///
078 public ClaimsClientContext(Uri sharePointSiteUrl, string sharePointSiteRealm, string loginStsUrl)
079 : base(sharePointSiteUrl)
080 {
081 if (sharePointSiteUrl == null) throw new ArgumentNullException("sharePointSiteUrl");
082 if (sharePointSiteRealm == null) throw new ArgumentNullException("sharePointSiteRealm");
083 if (loginStsUrl == null) throw new ArgumentNullException("loginStsUrl");
084
085 // save the settings
086 SharePointSiteUrl = sharePointSiteUrl.ToString();
087 SharePointSiteRealm = sharePointSiteRealm;
088 LoginStsUrl = loginStsUrl;
089
090 // specify the default credentials to use
091 Credentials = CredentialCache.DefaultCredentials;
092
093 // add a handler for the ExecutingWebReques event to provide the SAML token
094 ExecutingWebRequest += ClientContext_ExecutingWebRequest;
095 }

More Here

Courtesy:http://fredericloud.com/2011/01/11/connecting-to-sharepoint-with-claims-authentication/

More about → Connecting to SharePoint with Claims Authentication

SSO in Web Services Using SAML

Introduction:


Web Services provides a standard mean of interoperating between different software
applications running on a variety of platforms. The simplest web service
consists of a SOAP message for communication and a WSDL for web service
description. Web services use XML extensively which are very well understood
technology. WSDL document defines services as collection of network endpoints
or ports.


One of the main problems in distributed Web Services is security standards. Due to
different platforms the interpretation of security information has different
meaning in different security context. For instance if a J2EE application try
to exchange security information with a COM+ application, the data sent by J2EE
application will not be recognizable to COM+.
The other problem in distributed Web Services application is the
capability for single-sign on. Security Assertion Markup Language (SAML) is a
standard proposed by OASIS to solve problem like security information exchange
and how Single Sign on capabilities be provided within distributed web services
application.


Exploring SAML:


SAML is a set of specifications used for transferring information like user
authentication, entitlement, and attributes to identity provider (IP) which can
authenticate the user and allow access to resources on a server provider. In SAML a third party which is identity provider will assert the authentication information provided by the consumer and will return SAML assertion which can be passed with any incoming request to
the target or resource provider which will identify the assertion and allow
access to the corresponding activity.

By
obtaining the assertion from identity provider consumer can pass it with any
request. The same assertion can be used universally and by any part of
application which is a step forward to interoperability in security context.


All
the security services which implemented SAML are able to interpret security
information transferred by one service to another which makes SAML one of the
most accepted solutions for Web Services Security. The Assertion generated by identity provider
can be used by consumer as long as it is trusted by target or service provider.
The Service Provider can accept the principal an allow authentication.


SAML
provides three types of assertions:


1.
Authentication assertion


2.
Authorization decision assertion


3.
Attribute assertion.


Authentication
Assertion


The
authentication information is received by identity providers which process this
information and authorization assertion is made along with authorization
decision and attributes assertion.
Authentication Assertion is composed of the identity of issuer and the
principal, the period for which the assertion will be valid and some creation
time information. It also input some information about the provider system and
validation time etc.


The
following is the Authentication Statement Schema









































Attribute
Assertion

More Here

Courtesy:http://asadroshan.wordpress.com/2011/01/12/sso-in-web-services-using-saml/

More about → SSO in Web Services Using SAML

A Closer Look at Centrify DirectControl's Web SSO Solution

Core Features


At a high-level, the DirectControl for web/Java agent provides the following five key features:


* SPNEGO Support for Application Servers: the DirectControl for web/Java agent natively extends the security layer of each application server to implement the SPNEGO protocol for Kerberos and NTLM authentication and single sign-on. Per Wikipedia: "SPNEGO is used when a client application wants to authenticate to a remote server, but neither end is sure what authentication protocols the other supports...SPNEGO's most visible use is in Microsoft's "HTTP Negotiate" authentication extension. It was first implemented in Internet Explorer 5.01 and IIS 5.0 and provided single sign-on capability later marketed as Integrated Windows Authentication. The negotiable sub-mechanisms included NTLM and Kerberos, both used in Active Directory."


In effect DirectControl is extending the "secret handshake" that Microsoft provides between IE and IIS. Which means that now with DirectControl you can use IE or any other browser that supports SPNEGO and have that SSO experience to not only IIS but to non-Microsoft web servers such as Apache, JBoss, WebLogic and WebSphere (running on either the Windows or UNIX/Linux platforms).
* Kerberos Support for web/Java Applications: Kerberos is the mature approach that Microsoft uses for single sign-on in an all-Microsoft environment. While Kerberos is available for non-Microsoft platforms, like UNIX and Linux, it can be difficult for a non-expert to deploy and manage a Kerberos stack for use in single sign-on. DirectControl for web/Java, in cooperation with DirectControl for Systems, automatically deploys, configures and manages the entire Kerberos stack for the application server and OS that your custom application is installed on.


Optionally, NTLM can also be used for authentication in an environment or system where Kerberos is not functional or appropriate. NTLM is an older technology provided by Microsoft for authentication.
* Authorization based on Active Directory Groups: Using J2EE standards, DirectControl for web/Java can populate the proper J2EE roles based on Active Directory Groups. Additionally, custom user attribute can be passed to the application from Active Directory. This allows a custom web application to provide role-based access and personalization based on a centrally managed identity in Active Directory, regardless of the platform the application server runs on.
* Active Directory Federation Services (ADFS) Support: ADFS, based on industry standards such as the WS-* web services specifications, provides a platform for single sign-on across multiple applications during a single browsing session. Additionally, ADFS provides services that allow authentication and authorization to happen across security, organizational and domain boundaries. These services are included in Windows Server 2003 R2 and 2008. Follow this link for more information on our ADFS web SSO agents for non-Microsoft web servers.
* Support for SSO to the underlying operating systems: Centrify DirectControl delivers secure access control and centralized identity management by seamlessly integrating your UNIX, Linux, Mac, web and database platforms with Microsoft Active Directory. DirectControl effectively turns a non-Microsoft system into an Active Directory client, enabling you to secure that system using the same operating system-level authentication, authorization and Group Policy services currently deployed for your Windows systems.

This means by packaging the DirectControl agent for the operating system and application server, along with installation and configuration documentation and support and services of the DirectControl for web/Java products into a single comprehensive solution, Centrify can help provide a true single sign-on solution at both the OS and application layer that better interoperates with your enterprise.

More Here

Courtesy:http://www.centrify.com/blogs/tomkemp/centrify_active_directory_integration_with_web_java.asp

More about → A Closer Look at Centrify DirectControl's Web SSO Solution

ASP.NET Authentication Interview Questions

What is the advantage of using Forms authentication?
The advantage of using Forms authentication is that users do not have to be member of a domain-based network to have access to your application. Another advantage is that many Web applications, particularly commercial sites where customers order products, want to have access to user information. Forms authentication makes these types of applications easier to create.


List the steps to use Forms authentication in a web application?
1.Set the authentication mode in Web.config to Forms.
2.Create a Web form to collect logon information.
3.Create a file or database to store user names and passwords.
4.Write code to add new users to the user file or database.
5.Write code to authenticate users against the user file or database.


What happens when someone accesses a Web application that uses Forms authentication?
When someone accesses a Web application that uses Forms authentication, ASP.NET displays the logon Web form specified in Web.config. Once a user is authorized, ASP.NET issues an authorization certificate in the form of a cookie that persists for an amount of time specified by the authentication settings in Web.config.


What is the difference between Windows authentication and Forms authentication?
The difference between Windows authentication and Forms authentication is that in Forms authentication your application performs all the authentication and authorization tasks. You must create Web forms and write code to collect user names and passwords and to check those items against a list of authorized users.

What is the use of mode attribute in authentication element in a web.config file?
You use the mode attribute to specify the type of authentication your web application is using. Set the mode attribute to forms to enable Forms authentication.


What is the use of name attribute and loginUrl attribute of a forms element in a web.config file?
Name attribute of forms element is used to set the name of the cookie in which to store the user’s credential. The default is .authaspx. If more than one application on the server is using Forms authentication, you need to specify a unique cookie name for each application.
loginUrl attribute of forms element is used to set the name of the Web form to display if the user has not already been authenticated. If omitted, the default is Default.aspx.


What is protection attribute in a forms element used for in web.config file?
The protection attribute of a forms element of web.config file is used for setting how ASP.NET protects the authentication cookie stored on the user’s machine. The default is All, which performs encryption and data validation. Other possible settings are Encryption, Validation, and None.


What is timeout attribute in a forms element used for in web.config file?
Timeout attribute is used to set the number of minutes the authentication cookie persists on the user’s machine. The default is 30, indicating 30 minutes. ASP.NET renews the cookie automatically if it receives a request from the user and more than half of the allotted time has expired.


In which namespace the FormsAuthentication class is present?
System.Web.Security namespace


Which method checks the user name and password against the user list found in the credentials element of Web.config?
The FormsAuthentication class’s Authenticate method checks the user name and password against the user list found in the credentials element of Web.config.


Which method can be used to remove forms authentication cookie?
Use the signout() method of FormsAuthentication class to sign out when the user has finished with the application or when you want to remove the authentication cookie from his or her machine. For example, the following code ends the user’s access to an application and requires him or her to sign back in to regain access
FormsAuthentication.SignOut();


What is the advantage of Authenticating Users with a Database?
You can authenticate users based on a list in Web.config. The FormsAuthentication class’s Authenticate method is set up to read from web.config file automatically. That’s fine if user names and passwords are created and maintained by a system administrator, but if you allow users to create their own user names or change their passwords, you’ll need to store that information outside the Web.config file. This is because changing Web.config at run time causes the Web application to restart, which resets any Application state and Session state variables used by the application.


What are the advantages of storing user names and passwords in a database rather than a file?
You can store user names and passwords in any type of file; however, using a database has the following significant advantages:
1. User names can be used as primary keys to store other information about the user.
2. Databases can provide high performance for accessing user names and passwords.
3. Adding, modifying, and accessing records are standardized through SQL.


Can you encrypt user names and passwords stored in a file or a database?
Yes, you encrypt user names and passwords stored in a file or a database. You can encrypt them using the FormsAuthentication class’s HashPasswordForStoringInConfigFile method. This method uses the SHA1 or MD5 algorithms to encrypt data, as shown below:
Password = FormsAuthentication.HashPasswordForStoringInConfigFile(Password, “SHA1″);


Can you change authentication type in a subfolder’s web.config file?
Authentication type (Windows, Forms, or Passport) can be set only at the application’s root folder. To change authentication type in a subfolder’s web.config file, you must create a new Web application project and application starting point for that subfolder.


How can you control access to subfolders in a web application?
The authorization settings in the Web.config file apply hierarchically within the folder structure of a Web application. For instance, you might want to allow all users access to the root folder of a Web application but restrict access to Web forms (and tasks) available from a subfolder. To do this, set the authentication type in the root folder’s Web.config file, and then use the authorization element in the subfolder’s Web.config file to restrict access.


What is the advantage of using Windows authentication in a Web application?
Windows authentication uses the security features integrated into the Windows NT and Windows XP operating systems to authenticate and authorize Web application users. The advantage of Windows authentication is that your Web application can use the exact same security scheme that applies to your corporate network – user names, passwords, and permissions are the same for network resources and Web applications. One of the key advantages of Windows authentication is that users who are logged on to the network don’t have to log on again to access the Web application.


What is the default authentication method when you create a new Web application project?
Windows authentication is the default authentication method when you create a new Web application project.


How do you allow or deny access to specific users using an authorization list from Web.config file, when using windows authentication?
When the application uses Windows authentication, ASP.NET checks the project’s Web.config authorization list to see which network users are allowed to access the application. The asterisk (*) and question mark (?) characters have special meaning in the authorization list. The * character indicates all users. The ? character indicates unauthenticated users.


To restrict access to specific users, list their names separated by commas in an element. When ASP.NET checks the authorization list in Web.config, it accepts the first match that it finds. Be sure to end the authorization list with a element to deny access to any nonapproved users.


What is Role-Based authorization in windows authentication?
Role-based authorization lets you identify groups of users to allow or deny based on their role in your organization. In Windows NT and Windows XP, roles map to names used to identify user groups. Windows defines several built-in groups, including Administrators, Users, and Guests. You can view, modify, or add groups using the Computer Management console


To allow or deny access to certain groups of users, add the element to the authorization list in your Web application’s Web.config file.


How do you get a User Identity?
Once a user is authenticated and authorized, your application can get information about the user by using the User object’s Identity property. The Identity property returns an object that includes the user name and role information, as shown in the following code:


private void Page_Load(object sender, System.EventArgs e)
{
Label1.Text = User.Identity.IsAuthenticated.ToString();
Label2.Text = User.Identity.Name;
Label3.Text = User.Identity.AuthenticationType;
}


How do you determine, what is the role of the current user?
The User object provides an IsInRole method to determine the role of the current user, as shown in the following example:
if(User.IsInRole(“Administrators”))
{
// Do something.
}


Can you specify authorization settings both in Web.config and in IIS?
Yes, you can specify authorization settings both in Web.config and in IIS. The IIS setting is evaluated first and then the setting in Web.config is evaluated. In general, this means that the most restrictive setting will be used.


What is the user account under which an ASP.NET web application runs by default?
Web application runs under the identity of the ASPNET user account by default.


How can you set the web application to run under a specific user’s account?
You can set the application to run under a specific user’s account by setting the application’s identity element to enable impersonation


How can you see the impersonated identity under which code is executing?
To see the impersonated identity under which code is executing, use the WindowsIdentity class’s GetCurrent method, as shown in the sample code below
Response.Write(System.Security.Principal.WindowsIdentity.GetCurrent().Name);


The identity element can be used with any type of authentication; however, it is most useful with Windows authentication because Windows authentication users have accounts with specific permissions.


What is Passport Authentication?
Passport authentication identifies users via Microsoft Passport’s single sign-on service. Microsoft Passport is meant to provide Internet users with a single identity that they can use to visit a wide variety of Web sites that require authentication. Information about the user is available to your application through a profile that is stored with Microsoft.


What are the advantages of Passport authentication?
The advantages of Passport authentication are that the user doesn’t have to remember separate user names and passwords for various Web sites and that the user can maintain his or her profile information in a single location. Passport authentication also provides access to other Microsoft services, such as Passport Express Purchase.


What is passport software development kit (passport SDK)?
To use Passport authentication in your Web application, you must install the Passport SDK. The Passport SDK is free for preproduction development and testing. To deploy a site for public use, you must obtain an annual license from Microsoft.


How does Passport authentication work?
When a user accesses an application that implements Passport authentication, ASP.NET checks the user’s machine for a current passport authentication cookie. If none is found, ASP.NET directs the user to a Passport sign-on page. Once the user signs in, the Passport service authenticates the user, stores an authentication cookie on the user’s computer, and directs the user back to the originally requested Web page.


What are the steps to follow to use Passport authentication?
1. Install the Passport SDK. Passport is not included with Visual Studio, although the .NET Framework does include classes for working with the Passport SDK once it is installed.
2. Set the application’s authentication mode to Passport in Web.config. Set authorization to deny unauthenticated users.
3. Use the PassportAuthentication_OnAuthenticate event to access the user’s Passport profile to identify and authorize the user.
4. Implement a sign-out procedure to remove Passport cookies from the user’s machine.


Where is PassportAuthentication_OnAuthenticate event present?
PassportAuthentication_OnAuthenticate event is present in Global.asax.

More Here

Courtesy:http://ggopi.wordpress.com/2011/01/12/asp-net-authentication-interview-questions/

More about → ASP.NET Authentication Interview Questions

Common Tomcat Memory Issues and How To Fix Them

Some of the most frequently reported Tomcat performance issues have to do with memory leaks, OutOfMemoryError messages, and Tomcat JVM memory allocation. If you are experiencing any of these issues, read on - this article will help you understand exactly what's causing your performance issues, and how to correct them.


We'll also take a look at some of the things that make configuring Tomcat's memory settings a tedious task, and share some tools that allow you to quickly identify and repair memory issues, and enforce your configuration changes across multiple servers.


Say Goodbye To OutOfMemoryError Messages
OutOfMemoryError messages, or OOME's, are one of the most common problems that users experience with Tomcat. These messages can be caused by a wide variety of factors, and they severely affect application performance, so it's a good idea to do everything you can to prevent them before they occur. Here are the most common OOME-triggering situations, and steps to help you avoid them in the future.


Tcat Server's management console gives you deep visibility into the memory stats of your Tomcat instances, allowing you to eliminate memory leaks and tune your servers more quickly than ever. Download Tcat Server today!


Cause 1 - Memory Leaks


Memory leaks when relaunching applications, a commonly reported problem, are in fact usually traceable to flaws in the design of the web application, not Tomcat's codebase.


These applications most likely retain references to the web application class loader, preventing garbage collection processes from clearing classes from the Permanent Generation, or PermGen.


Because the PermGen has a finite size, reloading the flawed application just a handful of times can trigger an OutOfMemoryError, or OOME. Eliminating retained references to the web application class loader will allow Garbage Collection to function properly, preventing these errors.


Memory Leak Protection in Tomcat 7.0


Fortunately for developers, Tomcat 7, which will be released in summer of 2010, features a number of memory leak fixes and workarounds, and these have also been retroactively ported to Tomcat 6.0.x. Developers who are experiencing memory leak issues should consider upgrading to the latest version of Tomcat as soon as possible.


Cause 2 - Hardware Issues


An OOME message means one simple thing - you don't have enough memory to complete an operation. If your server is running with less than 128MB of RAM, the only true way to fix your issues will be to upgrade your system. Any other solution will only be a temporary patch, at best.


Cause 3 - Large Number of Frequently Recomplied JSPs

If your application includes a large number of JSPs that feature "frequently recompiled" objects such as dynamic headers, you should consider looking into the configuration of your JSP compiler. There are a number of steps that can be taken to prevent memory leaks from these pages, which may be chewing up your RAM.


Cause 4 - OS-Specific Threshold Limits


If you are running a *nix OS, your OOME may be caused by running out of file descriptors, which can occur if your threshold is set too low. You can change the threshold by using limit to increase the Max Processes per user limit to match your application's needs.


Another OS-specific factor that can cause OOME messages is a per-process thread limit. Your JVM is considered a single process, so if your OS has a low default threshold of threads per process, this may be causing your memory issues. The majority of OS's allow this threshold to be increased, so check your documentation.


Cause 5 - Insufficient Permanent Generation Size


Although your PermGen can be exhausted by improperly retained references to class loaders, it can also be filled up if your application simply uses a large number of JSP's and servlets. The default size is 64MB, but this can be increased by using the -XX:MaxPermSize= switch. Try doubling or quadrupling the size, and see if that eliminates the error messages.


Optimizing JVM Memory Allocation


Even if you're not getting any OOME messages, properly configuring your JVM's memory allocation is an essential part of getting the best performance out of Tomcat. JVM memory reallocation is an expensive process that can tie up power you want going to serving requests. Cutting down on the number of times it happens will give you a solid performance boost.


Step 1 - Eliminate Excessive Garbage Collection


Excessive garbage collection can stress your server's request-serving power. Starting the JVM with a higher maximum heap memory by using the -Xmx switch will decrease the frequency with which garbage collection occurs.


Additionally, if you don't mind lowering the total garbage collection throughput of your application, consider using the -Xincgc switch to enable incremental garbage collection.


Step 2 - Properly Configure Memory Reallocation


Utilizing these techniques along with the -Xms switch, which sets initial heap memory equal to the maximum heap memory, will eliminate any need for the JVM to resize or reallocate the heap memory, leaving more to be used by other memory-intensive processes.




Why Configuring Tomcat's Memory Settings Is So Tedious


Tuning Tomcat's memory usage to suit the needs of your applications offers big benefits to your site's performance, but it can also mean a lot of tedious work - log in via the terminal, open a Tomcat configuration file, search through the XML, tweak a setting, restart the server, open up a monitoring client, find another error, tweak again, restart...


Add in a few clusters of servers running different applications, and you're looking at hours of repetitive testing and tweaking, multiple profiles to maintain, and the need to do it all over again on every Tomcat instance you're running if a new version of an application requires a change in settings.


It's no wonder that many Tomcat administrators grimly put up with frustrating memory usage errors or less-than-optimal configurations - manually testing and applying configurations is simply too much work for a busy administrator to handle.


Tcat Server Makes Enterprise Tomcat Administration A Reality


Don't let tedious configuration tasks prevent optimal performance! Mulesoft's Tcat Server makes Tomcat Administration a reality.


Running in front of your existing Tomcat infrastructure, Mulesoft's Tcat Server provides powerful monitoring, configuration, and administration tools to keep your Tomcat servers performing like never before. Every one of Tcat's powerful features is accessible from the same central web console - no more switching tools, looking up ports, or configuring SSH keys ever again.


How Tcat Server Saves You Time


To help you understand how Tcat Server saves you time, let's look at an example scenario. Let's say we are running three clusters of three Tomcat instances each, and each is running a different combination of applications, with different memory requirements. Lately, there have been a lot of memory errors on our servers, and it's having a real impact on our user experience. We have to make changes to our memory settings.


First, let's do things the old fashioned way - manually. Because we're running clustered instances, to find the proper memory settings, we'll have to test the cluster under load, log into one machine, change a setting, and then copy the configuration file to every other server in the cluster. Then, we'll simply manually issue a restart command to each server in the cluster, and test again. Oops! The setting's not quite right. Time to repeat the whole process. Too bad we have three clusters to configure; guess the third one will have to wait until tomorrow, along with all the other work we wanted to get done today.


Now, let's look at the same scenario using Tcat Server. Log in to Tcat's centralized web console and open up the Servers tab. Select the cluster you want to test first, and get instant, real-time, graphical data about your memory use. Navigate to the Server Profile you've created for this cluster, and make a change to the memory usage. With two clicks, publish the configuration to the entire cluster, and restart all your instances to see your changes take effect. Need to add a new worker to the cluster? No problem! Tcat Server lets you enforce an unlimited number of server profiles across your infrastructure, putting you in complete control of your network's performance.

More Here

Courtesy:http://www.mulesoft.com/tomcat-memory

More about → Common Tomcat Memory Issues and How To Fix Them