Java Web Start applications and Gatekeeper

As more of our customers upgrade to Mac OS X 10.8 or later or purchase new machines we've had to deal with helping more of them work around Gatekeeper for our Java Web Start deployed applications. Many discussions found on the web show the confusion that surrounds this technology and how it interacts with Web Start apps. Most "solutions" suggest various security changes like allowing apps downloaded from anywhere. The one we most often employ is to control-click the JNLP file and choose Open. Then the dialog has an option to "install" the application anyway.
My take-away from the discussions has been that Gatekeeper is looking for what it considers to be executable code, including JNLP files and Java applets, to be signed via codesign which is stored as an extended HFS attribute and as a result is not transferred over HTTP unless the file is wrapped into some bundle like xip or in a disk image (dmg). Neither of these are a click-and-run experience and move me from the realm of Web Start deployment to just wrapping it up as an Apple app bundle.
Before OS X 10.8 (Mountain Lion) was released, Scott K published on the Talking Java Deployment blog an article titled Java applications and Gatekeeper where he suggested the best possible user experience comes from creating an app that is bundled with Java and signed with an Apple Devloper ID using the codesign tool. (Note this is not the same as the code signing from jarsigner in the JAR/META-INF. The article ends, edited, with a statement that Gatekeeper does not apply to command-line tools like java, javac, javah and so on. It has been my experience that it does seem to apply to javaws or whatever is used on the Mac to launch a Web Start app from a JNLP file. It is as if Apple has said they don't trust the Java security model for downloaded dynamic code and are adding an extra restriction that seems to severely limit the "click-and-run" functionality of Web Start or applets.
Is there anything I can do to get a JNLP file to "just work" for Mac end users like it use to before 10.8 / Gatekeeper?
Is there anything in the works from Oracle to fix this issue?
Jacob

Probably not the case here, but considering it is a development machine it is something to check. The symptoms you describe are exactly what happens when you setup JWS applications to be remotely debugged, and specify suspend=y. In that case, before the application launches, it waits for Eclipse (or some other development environment) to connect to it. I do this all the time and what happens before Eclipse attaches to the process is exactly what you describe. Check the JAVAWS_VM_ARGS to see what VM parameters are being used.
Jake

Similar Messages

Java web start application runs too slow...

Hello,
I am new to Java Web Start. I have created a java web start application and when i enable web start from local Execution, then it works perfectly well. But when i upload it on server and then download the application, then it is too too slow...i mean it takes minutes to get the output on clicking some button....my jnlp file is as under:
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<jnlp codebase="http://(web server code base)" href="launch.jnlp" spec="1.0+">
<information>
<title>ERD</title>
<vendor>Deepika Gohil</vendor>
<homepage href="http://appframework.dev.java.net"/>
<description>A simple java desktop application based on Swing Application Framework</description>
<description kind="short">ER Deign Tools</description>
</information>
<update check="always"/>
<security>
<all-permissions/>
</security>
<resources>
<j2se version="1.5+"/>
<jar href="ERD_1_2.jar" main="true"/>
<jar href="lib/appframework-1.0.3.jar"/>
<jar href="lib/swing-worker-1.1.jar"/>
<jar href="lib/jaxb-impl.jar"/>
<jar href="lib/jaxb-xjc.jar"/>
<jar href="lib/jaxb1-impl.jar"/>
<jar href="lib/activation.jar"/>
<jar href="lib/jaxb-api.jar"/>
<jar href="lib/jsr173_api.jar"/>
<jar href="lib/ant-contrib-1.0b3.jar"/>
<jar href="lib/jaxb-impl.jar"/>
<jar href="lib/jaxb-xjc.jar"/>
<jar href="lib/FastInfoset.jar"/>
<jar href="lib/gmbal-api-only.jar"/>
<jar href="lib/http.jar"/>
<jar href="lib/jaxws-rt.jar"/>
<jar href="lib/jaxws-tools.jar"/>
<jar href="lib/management-api.jar"/>
<jar href="lib/mimepull.jar"/>
<jar href="lib/policy.jar"/>
<jar href="lib/saaj-impl.jar"/>
<jar href="lib/stax-ex.jar"/>
<jar href="lib/streambuffer.jar"/>
<jar href="lib/woodstox.jar"/>
<jar href="lib/jaxws-api.jar"/>
<jar href="lib/jsr181-api.jar"/>
<jar href="lib/jsr250-api.jar"/>
<jar href="lib/saaj-api.jar"/>
<jar href="lib/activation.jar"/>
<jar href="lib/jaxb-api.jar"/>
<jar href="lib/jsr173_api.jar"/>
</resources>
<application-desc main-class="erd.screen1">
</application-desc>
</jnlp>
I dont understand the reason. Could you please help me out.
Thank you,
Deepika Gohil.

Check your web server's access logs to see how many requests web start is sending for each jar. After you've loaded the application the first time, for each subsequent launch, if you've got everything configured right, you should only see requests for the JNLP file and maybe some gifs because web start should load everything else out of the cache (if you're using the version-based download protocol). Or if you're using the basic download protocol, then you might see requests for each jar file, but even in this case, if your web server is prepared to evaluate the last-updated attribute for each jar request and for jars that have not changed, respond with no actual payload and a header value of Not-Modified, then that should run almost as fast.
You might also want to consider changing the "check" attribute of the "update" element from "always" to "background" for a couple of reasons. It should allow your app to start sooner (but this means that you might have to launch once or twice after an update is applied to the web server before the update shows up on the workstation). Also, my impression is that "always" is broken and prevents web start from ever checking to see if your jnlp file has been updated if you launch your app from a web start shortcut - launching from a browser is less likely to have this problem, depending on how often your browser is configured to check for updated resources.

Java Web Start application failing on my user account

Hi All,
I've been tearing my hair out over this for a while and haven't been able to get anywhere wiht it. I've finally cracked and decided to post a plea for help in here.
Basically, I have a web start application that will not start under my user profile but will under a new account I created. If I try and start it from the terminal with javaws I get "Bus Error" and that's all. Double clicking it gives me a crash dialoge box and the details can be seen here:
http://pastebin.com/m77b1111f
As I said before, running it in the other account works fine as does "sudo javaws /path/to/app.jnlp" but I really don't want to have to do that every single time.
I've deleted the JavaCache folder as well as any ~/Library/Preferences/java.plist all without any joy. Also, I'd like to add that there are a number of other Web Start apps that run without any problems.
Any ideas?

Thing is, if there was corruption of something that was system wide, it wouldn't work under a different profile, right?
Unpredictable as to how lomg it would work on a new account.
Is this usually the case for a safe boot?
Yes, it runs fsck_hfs -fy on the whole drive, dumps several caches & so on, the next boot will also take longer than usual as it rebuilds caches & so on.

Java Web Start Application surprisedly does not start anymore based on new JRE1.7.0_45

Hi everyone,
we have to maintain a self-developed Java Application which is running based on JRE1.5.0_51 (x64). Our recent client machines have JRE1.7.0_40 (x64 too) installed in addition to the mentioned (and needed) JRE1.5.0_51 (x64).
Everything was fine up to the point where we tried to install the newest JRE1.7.0_45 (x64) as the new version for doing the web start magic. The result is that our application (which is/was unchanged!) does not launch anymore. The strange thing is that we do not get any StackTrace, Exception or something else like this.
The startup process simply hangs :-(
Nothing has changed (application itself, firewall, network settings, hardware) apart from the new JRE version. It's reproducible at will. If I install JRE1.7.0_40 (x64) the application starts, if I install JRE1.7.0_45 (x64) the application hangs.
I can say for sure, that in both cases (*_40 AND *_45) Web Start is able to do the synchronizing job and to launch the application base on the correct JRE1.5.0_51 (x64).
My guess is that in case of an installed JRE1.7.0_45 (x64), the application hangs when it tries to connect to the database (Oracle 11g) via JDBC.
I found a little hint in the Web Start Console. Therefore I had to switch the trace level of the console to 3 (which includes security, network and basic)
In case of an installed JRE1.7.0_40 (x64) - which leads to a running application - I will receive the following output:
Java Web Start 10.40.2.43
JRE-Version verwenden 1.5.0_51-b10 Java HotSpot(TM) 64-Bit Server VM
security: Istrusted: http://PKS-Server/jnlp2/advise_office.jnlp true
avawsApplicationMain     3798 DEBUG root                : get Service: com.sun.jnlp.BasicServiceImpl@3b8e609b fileName: connection.properties
network: Cacheeintrag nicht gefunden [URL: http://PKS-Server/jnlp2//connection.properties, Version: null]
network: Verbindung von http://PKS-Server/jnlp2//connection.properties mit Proxy=DIRECT wird hergestellt
avawsApplicationMain     3803 INFO root                : 'Alex2 connection.properties' wurde vom WebServer gelesen
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
avawsApplicationMain     4488 DEBUG root                : get Service: com.sun.jnlp.BasicServiceImpl@3b8e609b fileName: connection.properties
network: Cacheeintrag nicht gefunden [URL: http://PKS-Server/jnlp2//connection.properties, Version: null]
network: Verbindung von http://PKS-Server/jnlp2//connection.properties mit Proxy=DIRECT wird hergestellt
avawsApplicationMain     4492 INFO root                : 'Alex2 connection.properties' wurde vom WebServer gelesen
Connect OK => application starts.
In case of an installed JRE1.7.0_45 (x64) - which leads to a hanging application - I will receive the following output:
Java Web Start 10.45.2.18
JRE-Version verwenden 1.5.0_51-b10 Java HotSpot(TM) 64-Bit Server VM
security: Istrusted: http://PKS-Server/jnlp2/advise_office.jnlp true
avawsApplicationMain     3805 DEBUG root                : get Service: com.sun.jnlp.BasicServiceImpl@25a41cc7 fileName: connection.properties
network: Cacheeintrag nicht gefunden [URL: http://PKS-Server/jnlp2//connection.properties, Version: null]
network: Verbindung von http://PKS-Server/jnlp2//connection.properties mit Proxy=DIRECT wird hergestellt
avawsApplicationMain     3810 INFO root                : 'Alex2 connection.properties' wurde vom WebServer gelesen
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
network: Verbindung von socket://PKS-Server:1521 mit Proxy=DIRECT wird hergestellt
These last "network:" log entries will never stop. This will lead to an infinite loop which results in a great memory leak. I have to kill the process via windows task manager in order to get rid of it.
Does someone out there has the same problem? Are there any new additional security issues which prevent my client to establish the database connection on port 1521?
Any other ideas?
Thanks in advance for any hint on this issue!
Regards,
Alex

Resolution: We still were not able to solve this issue! The only way to get out of this is to install the JRE1.5 as the x64 variant. In this case no switching from 64-bit to 32-bit is needed and everything is on track again.
But this is still strange and unexplainable :-(

Java Web Start application doesn't run in Tomcat

I successfully did a Java Web Start example for me to learn then I tried another one where I encountered an error:
This is what Tomcat 6.0.18 says. The deploy is successful but when I try to run the web start application
with this htmlcode
<A href="http://localhost:8080/ConvertorValutar/app/launch.jnlp">I get this error witch leads me to think that it can't find the jar correct ?
type Status report
message /convertorvalutar/
description The requested resource (/convertorvalutar/) is not available.Appendix:
This is how I am doing the JAR
jar cfvm convertorvalutar.jar myManifest2.mf Java*.class IRata*.class The myManifest2.mf is
Main-class: JavaWebStart_Convertor witch is the main class
This way I am doing the WAR:
del *.war /F /Q
jar cfv convertorvalutar.war app/* WEb-INF/*This is the correct directory structure
│   faWar.bat
│   convertorvalutar.war
│
├───app
│       ConvertorValutar.jar
│       launch.jnlp
│
└───WEB-INF
    │   web.xml
    │
    └───lib
            jnlp-servlet.jarThis is the web.xml
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE web-app
PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN"
"http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>

<web-app>
     <servlet>
          <servlet-name>JnlpDownloadServlet</servlet-name>
          <servlet-class>jnlp.sample.servlet.JnlpDownloadServlet</servlet-class>
     </servlet>
     <servlet-mapping>
          <servlet-name>JnlpDownloadServlet</servlet-name>
          <url-pattern>*.jnlp</url-pattern>
     </servlet-mapping>
</web-app>
</web-app>This is the jnlp:
<?xml version="1.0" encoding="UTF-8"?>
<jnlp codebase="http://localhost:8080/convertorvalutar/app">
<information>
     <title>Convertor Valutar</title>
     <vendor>remus.dragos</vendor>
     <description>Simple Java Web Start Example</description>
</information>
<resources>
     <j2se version="1.5+"/>
     <jar href="ConvertorValutar.jar"/>
</resources>
<application-desc main-class="JavaWebStart_Convertor"/>
</jnlp>Where is the problem?
Edited by: remus.dragos on Dec 9, 2008 7:14 PM

I did checked the names again and I found that the makeJar.bat had an "issue".
It missed the del *.jar and I had 2 uppercase letters like ConvertorValutar, instead of convertorvalutar.jar.
After that I rebuild the war and deployed and it works :)
Thanks.

How to count number of Java Web Start application downloads?

Hello,
The title says it all. Is there a reliable and secure way to get the number of times my application jars have been downloaded?
Reason: I am trying to determine whether a business model that charges (say) 1 cent, each time a jar is downloaded, is viable.
thanks,
Anil

Hello,
The title says it all. Is there a reliable and
secure way to get the number of times my
application jars have been downloaded?Absolutely, but this will have to be done at the server level. Each time a request for the JNLP file is made, simply log it. But again, I don't think you can/would do this in Java so it's server-specific regarding implementation.
Reason: I am trying to determine whether a
business model that charges (say) 1 cent, each time a
jar is downloaded, is viable.
thanks,
AnilWell, I guess you could log the IP that made the request, because you don't want to charge someone twice if they crash and reload in 5 minutes, right?

Java Web Start and SSL

I have an AP designed as a Java Web Start program,
and I want it to connect to a web service via SSL.
I know how to do that in a normal AP. Just add a property like :
System.setProperty("javax.net.ssl.trustStore","my.keystore");
But since a JAWS program is downloaded from server, and don't have a my.keystore on local file system. I can't set a property that way. Is anyone know how to deal with this?
Can a signed jar file help?
Thanx in advance.

We had the same problem. There's basically two ways around this. One is extremely easy and the other is a pain.
easy: Use a CA certificate on the web server (Verisign, thawte etc.). All java applications already have a keystore (cacerts) that recognizes
these CAs. This keystore will be used when the cert on the server is a CA. Only drawback - $250 or so for the cert.
painful: Programmatically extract your personal certificate keystore from the deployed client jar. Also programmatically apply it to your SSL handler. Basically - you have to code what's done in a regular App simply by "javax.net.truststore=keyfile". I didn't explore this option
too much as the easy option was viable.

Problem with CORBA application deployed using Java Web Start 1_6_0.

Java Web Start fans and experts:
We have been using Java Web Start to deploy the client side of a CORBA-based application since the inception of Java Web Start ... including Java Web Start 1.0 right up through the present.
With Java Web Start 1_6_0, we see evidence that Web Start is "tinkering with" the IOR that CORBA uses to communicate. In all previous versions of Java Web Start, independent of the JRE which the application uses, the stringified IOR have been the same size regardless of whether the application is deployed locally or via Java Web Start. With Java Web Start 1_6_0, the stringified IOR is much longer than the "real" IOR (again, regardless of the JRE used by the application itself). To me this smells like a bug in Java Web Start 1_6_0. Has anyone else observed this behavior?
Here are some specifics .... I've run the same client application with various JREs both with and without Java Web Start as the deployment mechanism. The application was compiled and runs against servers that are running JDK 1_5_0_09.
Here is the summary of my results from a Linux box running various JREs, various versions of Java Web Start, and also running as a non-JWS deployed application. I've listed the length of the stringified IOR in each case.
JRE 1.5.0 non-JWS client: stringified IOR length = 344
JRE 1.6.0 non-JWS client: stringified IOR length = 344 ... this, I think, excludes the JRE as the cause of these problems.
Java WS 1.5.0, JRE 1.5.0 JWS client: stringified IOR length = 344
Java WS 1.5.0, JRE 1.6.0 JWS client: stringified IOR length = 344
Java WS 1.6.0, JRE 1.6.0 JWS client: stringified IOR length = 1568
Java WS 1.6.0, JRE 1.5.0 JWS cleint: stringified IOR length = 1568
In all cases, the stringified IOR length is determined by the service receiving the message and is always running JRE 1_5_9_09 and is
always the same 344 characters in length UNLESS it was deployed
using Java Web Start 1_6_0, in which case it in nearly 5 times as big!
To me, it sure looks as if there is a problem with Java Web Start 1_6_0 to be adding so much to the stringified IOR. Note: it's hard to tell how different the underlying IOR is in the JWS 1_6_0 case because, unlike most other ORBs, the Sun ORB doesn't have a tool to extract the IOR into a human readable structure. However, I can think of no good reason why the identical application deployed using Java Web Start 1_6_0 should have a stringified IOR length that is different than that of the same application deployed in non-JWS form or should differ from the behavior seen in all previous releases of Java Web Start.
Any clues or suggestions? Has anyone else observed this behavior?
Thanks,
John

Hi.
I got a different problem. My Corba application works in JRE 1.6, but doesn't works in JRE 1.5.X. I got an unexpected error and my console shows:
getSubjectX500Principal NoSuchMethodError: java.lang NoSuchMethodError
#### Java Web Start Error:
#### null
Can you help me?

Java Web Start and Firefox

Hello!
I want to use some java web start applications, which are started directly by clicking a link. My browser (firefox) doesn't know the java web start mime type (*.jnlp). Because of that I can only download the specific JNLP-File instead of executing this file to start the java app.
There is no jnlp mime type in the firefox section Edit-->Preferences --> Application and I can't add a new mime type because there is no funkction to did that job.
I have installed the jre and the jdk package. In firefox Tools --> Addons there is the plugin "Java Plug-in 1.6.0_19" listed.
Has anybody an idea, who to add the jnlp mime type in firefox?
Thanks for help!
Best regards,
Flasher

Maybe this can help you.
And related link in Ubuntu Forum.

How to package/inlcude C++ .exe and .dll files in a Java Web Start App?

Hello,
I have a Java Web Start application that runs fine if the application is only 1 .jar file.
But I have a need to also run C++ .exe and .dll file from my Java application.
I wonder if someone could please tell me how to package/include C++ .exe and
.dll files in my Java web start application?
Thank you and Best Regards,
Akino

You need to place the EXE and DLLs inside the jar.
Java cannot execute them from the jar. They have to be extracted (see Class.getResourceAsStream) from the jar and copyied into the target machine file system, perahps to the temp directory. Now you can execute them using Runtime.exec() or ProcessBuilder.start().
Edited by: baftos on Jan 14, 2011 6:49 PM

Java web start and .JRXML

Hello everyone.
I have an application form calling from browsers from client side using Java web start (JNLP) and applications has one report (.jrxml file) which is placed at server. I could start application form from client browsers but at the time of executing report it does not respond. There is no message , I think does not find path of where .jrxml file is placed. Can any one help me. Pl. note that reports get executed when users presses button on form.
With thanks !
prashant

bump

Java web start and xforms

Hi,
I've written an application which uses Xforms to fill in and save a set of fields to a file and then uses an Xforms submission to launch a java web start application which reads in the saved data. This approach allows me to provide a simple forms gui and process the resultant data on the client side.
However, this solution is limited and it would be much nicer if my web start application could read the xml instance data direct from the xforms submission (and provide data back to the form).
I know it's a long shot, but is there a way of doing this? An XForms submission with a post or put simply overwrites my jnlp file if it has permission to do so (as one might expect).
At the moment I do the following ...
<xf:submission id="RunJava" method="get" action="http://www..../myfile.jnlp"/>
If it were possible to do this then Xforms and java web start would make powerful allies imho.
Thanks for any wisdom.
-- Rupert

bump

Java Web Start and JAAS

Has anybody tried to use JAAS in an application launched via Java Web Start?
I'm experiencing problems with it. (The application works fine when being launched directly on the client.)
If somebody already successfully tried, please let me know.
Do I need to modify tags in the JNLP file? Do I need to re-configure my webserver or servlet engine?

OK I got a response from the Java Web Start engineering folks. It sounds like using JAAS directly, to login to an ejb app server or whatever, is out of the question with Java Web Start on JDK1.3:
<< begin Sun's email >>
The problem you got is due to JAAS 1.0 (jaas.jar) uses systemClassLoader to load
classes that are defined in the JNLP application jar files, which should be
loaded by the contextClassLoader instead. For more information on classLoading
with JWS, look at:
http://java.sun.com/products/javawebstart/faq.html#54
http://java.sun.com/products/javawebstart/docs/developersguide.html#dev
The new JAAS that comes with JDK 1.4 fixed this problem, which uses
contextClassLoader in their class.
Thanks for your interest in Java Web Start.
<< end of Sun's email >>
FYI our workaround: We use a SOAP servlet as a proxy for the app server and we've defined a SOAP xmlrpc api between our client and the application server. This has the advantage of being able to get thru firewalls, as our variant of SOAP is transported on HTTP. Java Web Start installs and starts the SOAP client.
I would hope the JWS folks would search the Sun provided services and see which ones ignore the current thread's class loader and fix them.
David Harvey
Siemens Energy and Automation, Inc.
Gardner Systems Business Unit

Java Web Start won't work, applications don't open

I have this problem.
When I open a Java Web Start application, a white loading screen shows up (Java Loading...), and I wait a few seconds, nothing happens, and the screen disapears. I don't have an idea what's wrong. I'll appreaciate any help.

Do you have Java configured to pop up a console
when JWS applications load? If not, ask it to do
so (I am still not sure that the console will appear,
but it is worth a try).
Are you able to load any JWS applications?
Here is a specific example of a very simple one
http://www.physci.org/jws/#bs (the basicserv.jnlp)

Unable to Launch Integration Builder: Java Web Start problem

Hi,
I am unable to launch the integration builder. I am using JDK 1.4.2_05. The java Web Start gives the following error:
Unsigned application requesting unrestricted access to system
Unsigned resource: http://<XIHostName>:50000/rep/repository/aii_util_rb.jar
I have tried deleting the Java web start cache, and even reinstalling the JDK.
Can someone suggest a workaround this problem ?
thanks,
Manish

The Java Web Start cannot accept unsigned jars. If the jars are signed, it will ask in a dialog box if it should allow unrestricted access to this jar.
In my case, I upgraded XI SP0 to SP4, which included updating the Adapter Core, Adapter Framework, and the XI TOOLS to SP4.
On launching the Web start, it seemed that the jars were not getting signed. JWS cannot allow unsigned jars to the client.
These jars are maintained in:
\usr\sap\<SID>\SYS\global\xi\directory_server\javaws\directory
I am having problems with my XI upgrade to SP4, and it is probably not signing the jars.
Do you know why this may be happening ...
thanks,
Manish

Java Web Start applications and Gatekeeper

Similar Messages

Maybe you are looking for