JCA Provider Support

[mheydem]

Glassfish 5.1 + Java SE 8

In the days of Glassfish 5.1 and Java SE 8 I had a JCA (Java Cryptography Architecture) Provider running with Glassfish. The setup looked like this:

• Java SE 8
• Glassfish 5.1
• Entry in path/to/jdk8/jre/lib/security/java.security: security.provider.11=org.example.security.MyProvider
• Entry in path/to/glassfish/glassfish/domains/domain/config/domain.xml: <jvm-options>-Djava.ext.dirs=${com.sun.aas.javaRoot}/lib/ext${path.separator}${com.sun.aas.javaRoot}/jre/lib/ext${path.separator}${com.sun.aas.instanceRoot}/lib/ext</jvm-options>
• Placed my implementation of the Provider as jar in path/to/glassfish/glassfish/domains/domain/lib/ext

This setup was working fine.

Glassfish 7.0.1 + Java SE 17

Now I'm working with

• Glassfish 7.0.1
• Jakarta EE 10
• Java SE 17 (corretto)

Investigation

The ext dirs mechanism was removed and cannot be used for this purpose anymore. Simply moving the implementation of the JCA Provider jar from path/to/glassfish/glassfish/domains/domain/lib/ext to path/to/glassfish/glassfish/domains/domain/lib does not work. There are multiple new ways for integration of a JCA Provider: https://docs.oracle.com/en/java/javase/17/security/howtoimplaprovider.html#GUID-3FD26072-6982-4DCE-932C-DE152C463992 All of these ways of integration require to put the implementation of the JCA Provider as jar in classpath or module-path.

It looks like the classpath of a Glassfish domain cannot be configured anymore in the domain.xml, since options like system-classpath, classpath-prefix or classpath-suffix were removed.

The module-path can be modified in the domain.xml like this, and this works, but for an absolute path only: <jvm-options>--module-path=C:/absolute/path/to/glassfish/glassfish/domains/domain/lib/myJcaProvider.jar</jvm-options>

Setting an relative path fails, as the variable is not substituted: <jvm-options>--module-path=${com.sun.aas.instanceRoot}/lib/myJcaProvider.jar</jvm-options>

Interrestingly, when starting the domain in the Eclipse IDE by using the Payara Tools, the variable in the relative path is substituted and it works fine.

Request

• Please check if my investigation is correct
• Is the --module-path approach the best way to integrate a JCA Provider? Do you have suggestions?
• Do you have an idea for a workaround to get it running in Glassfish 7.0.1?

[mheydem]

Would it be a viable way to extend variable substitution in the domain.xml to --module-path as well?

[OndroMih]

A solution would be to implement a similar feature as in Payara: https://github.com/payara/Payara/pull/5707 - add lib/ext directory to the classpath on Java 9+.

[github-actions[bot]]

This issue has been marked as inactive and old and will be closed in 7 days if there is no further activity. If you want the issue to remain open please add a comment