java best practices for developing and - · pdf filejava best practices for developing and...

JavaBestPracticesforDevelopingandDeployingAgainstDatabasesintheCloud

NirmalaSundarappa,PrincipalProductManager,KuassiMensah, DirectorofProductManagement,JeanDeLavarene,DirectorofDevelopmentServerTechnologies,October5th,2017

SafeHarborStatementThefollowingisintended tooutline ourgeneralproductdirection. Itisintended forinformationpurposes only,andmaynotbe incorporatedintoanycontract.Itisnotacommitment todeliver anymaterial,code,orfunctionality,andshouldnotberelieduponinmakingpurchasingdecisions. Thedevelopment, release, andtimingofanyfeaturesorfunctionality described forOracle’sproductsremainsatthesolediscretion ofOracle.

ProgramAgenda

Whatarewetalkingabout?

SecuritySettings

JavaBestPractices

Questions

ProgramAgenda

SecuritySettings

JavaBestPractices

Questions

Whatarewetalkingabout?• PlainJavastandaloneapps• JavaAppContainers– ApacheTomcat– OracleWebLogicServer– IBMWebsphere– JBOSS

• JavatoolsorIDEs– SQLDeveloper,SquirrelSQL– Intellij, Jdeveloper, Eclipse, Netbeans

• AlltheseJavaappsmustbeabletoconnecttoaCloudDatabase

Whatarethethingstoconsider?JDBCdriversmustmeetthecloudspecificrequirementsForexample:• SupportforTLSv1.2withunlimitedciphersuites• Protocolspecificencryptionandchecksumming• Supportstrongauthentication– Basedoncertificates– Kerberosauthentication

• Supportvariouskeystore formats(KSS, JKS,Wallets)

Howaboutthese?• Propererrormessagesandtracestodebugconnectivity issues• Supportkeepalive mechanisms• HTTPproxyandwebsocketsIdeally• Reconnectonfailureandreplayin-flightwork• HowaboutasynchronousAPIs?– TheAPIisavailable fordownloadfromOpenJDK at– http://www.oracle.com/goto/java-async-db– Sendfeedbacktojdbc-spec-discuss@openjdk.java.net

ExamplewithOracleCloudDatabaseService

DatabaseEnvironment DefaultConnectivity

DatabaseasaService(DBaaS) TCP/IPwithnetworkencryption(Port1521)Toallowdirectconnection, openport1521forspecifictrustedhosts

ExadataExpressCloudService(EECS)Fullymanaged

TCPS(Port1522)TLSv1.2andstrongsecurityalgorithmsismandatoryTwo-stagesauthentication:Musthaveclientwalletinadditiontodatabasecredentials

ProgramAgenda

SecuritySettings

JavaBestPractices

Questions

SecuritySettings

• JDKversionisimportant– Securitybugsinsomeolderreleases– Alwaysusethe latestJDKupgrade

• JCEUnlimitedStrengthJurisdictionPolicyfiles– JDK9hasJCEbydefault– Needtobeinstalled intheJavaruntime forJDK7andJDK8.– TLS_RSA_WITH_AES_256_GCM_SHA384 andTLS_RSA_WITH_AES_256_CBC_SHA256ciphersuites useAESwith256bitkeysandhencerequireUnlimited JCEpolicyfiles

Mandatory:usinglatestJDKwithJCE

SecuritySettings

• Additionaljarsareneeded– oraclepki.jar ,osdt_core.jar,andosdt_cert.jar– AvailableonOracleMavenrepository(maven.oracle.com)

• Makesuretohavewalletsatanaccessiblelocation– cwallet.sso (auto-loginformat)or ewallet.p12(PKCS12format)

• Providethelocationofthewallet– oracle.net.wallet_location=

(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/Users/test/wallets/)))

• Enforcemutualauthenticationoracle.net.ssl_server_dn_match=true

EitherusingOracleWallets

SecuritySettings

• ConfiguretrustStore andkeyStore– Use javax.net.ssl.trustStore and javax.net.ssl.keyStore systemproperties orconnection properties

• SetthepasswordforJKS– Use javax.net.ssl.keyStorePassword andjavax.net.ssl.trustStorePassword

• EnabletheserverDNmatch– oracle.net.ssl_server_dn_match=true

OrusingJavaKeyStore(JKS)

ConnectingtotheCloudiseasierthanever

OracleJDBC18

DB18relatedcapabilitieswillbeupdatedoncetheDatabase18cisreleased.Pleasestaytuned.

ProgramAgenda

Securityrequirementsandsettings

JavaBestPractices

Questions

DBCSConnectivity– Overview

• TCPconnections allowed– Port1521needstobeunblocked beforeusage

• Fullcontroloverthedatabase. – HRschemaisavailable,butneedstobeunlocked– Createmoreusersorschemasortablesbyconnectingtothecomputenode

• SSHaccess tothecomputenode

JavaconnectivitytoOracleDatabaseCloudService(DBCS)

Createtheserviceandunblockport1521

JavaConnectivitytoDBCS

Unblocktheport1521

JavaConnectivitytoDBCSusingTomcat

Samplecontext.xml

ScreenshotoftheServletconnectingtodatabaseservice

EECSConnectivity– Overview

• TCPSconnectionsrequired• MandatesSSLconnectionusingTLSv1.2– JavaKeyStoreFiles orOracleWallets

• PDB_ADMINistheusercreatedbydefault– Createyourownuser

• RequiresJavaCryptographyExtension(JCE)intheJDK/JRE.

AFullyManagedexperienceforhands-freeclouddatabaseoperation

Exadata ExpressCloudServiceConnectivity

Download client_credentials.zip

Exadata ExpressCloudService(EECS)Connectivity

Choosewalletorkeystore password

Exadata ExpressConnectivity

client_credentials.zip contents

Filename Descriptiontnsnames.ora andsqlnet.ora

Networkconfigurationfilesstoringconnectdescriptors andSQL*Net clientsideconfiguration

cwallet.sso andewallet.p12

Auto-openSSOwalletandPKCS12file.PKCS12file isprotectedbythewalletpasswordprovided intheUI.

truststore.jksandkeystore.jks

JKSTruststoreandKeystore.ProtectedbythewalletpasswordprovidedintheUI.

Exadata ExpressCloudService(EECS)Connectivity

Pre-requisites

• ForThinJDBC• Unziptheclient_credentials.zip filetoanylocation• UpdateJDKpath tousethelatest JDK8/JDK7withtherequiredJCEpolicyfiles• Passtruststore orwalletrelatedparametersasconnection/system properties• Connectusingtheconnection string“jdbc:oracle:thin:@dbaccess”withdbaccess beingtheTNSalias.

Detailed steps are documented in Exadata Express Service Console links

Exadata ExpressCloudServiceConnectivity

• java-Doracle.net.tns_admin=/home/myuser/cloud\-Doracle.net.ssl_server_dn_match=true\-Djavax.net.ssl.trustStore=/home/myuser/cloud/truststore.jks \-Djavax.net.ssl.trustStorePassword=welcome1\-Djavax.net.ssl.keyStore=/home/myuser/cloud/keystore.jks \-Djavax.net.ssl.keyStorePassword=welcome1\

DataSourceSample

Samplescripttorun

ProgramAgenda

SecuritySettings

JavaBestPractices

Questions

JavaBestPracticesfordevelopinganddeploying

• BestPracticesforPerformance• BestPracticesforSecurity• BestPracticesforHighAvailability• AlternativeapproachforAccessibility• Troubleshootingtips

ConnectingtoDatabaseservicesonCloud

BestPracticesforPerformance

• UseConnectionPooling(Example:UCP)– OptimizeMinPoolSize,MaxPoolSizeandtimeouts

• Bindvariables– Preventsre-parsingoffrequentlyexecuted statements– Re-execute thesamePreparedStatement withdifferentbinds

• Arrayoperationsinsteadofsinglerowoperations– DMLBatchingandRowPrefetch– preparedStatement.addBatch()andpreparedStatement.sendBatch()

Reduceroundtrips,optimizesessions anddatatransfer

• Prefetching– Prefetch anumberofrows(configurable)preparedStatement.setFetchSize(20)

• StatementCaching– Cachesmostrecentlyusedstatements– oracleDataSource.setImplicitCachingEnabled(true)and connection.setStatementCacheSize(10)

• ClientQueryResultCache– CachesSQLqueryresultsonclienttier– Oracletransparentlymaintains cacheconsistencywithserversidechanges

• Co-locateapplicationserversanddatabaseservers(ifpossible)inordertoreducelatency– Runpingortraceroute tolookatlatency

• TunetheSessionDataUnit(SDU)forlargeLOBs,XMLs, largeresultSets– Max:2MB(12c),64K(11.2),32K(pre-11.2)– Setonbothserverandclientside(sqlnet.ora(DEFAULT_SDU_SIZE), tnsnames.ora orURL)

– jdbc:oracle:thin:@(DESCRIPTION=(SDU=11280)(ADDRESS=(PROTOCOL=tcp)(HOST=myhost-vip)(PORT=1521))(CONNECT_DATA=(SERVICE_NAME=myorcldbservicename)))

• Sharded databaseforscalability31

• Forcorporateenvironment,useVPN• Ifyouwanttoenabledirectconnection– Enableaccess toDatabase listeners fromonlyspecific setoftrustedIPaddresses

• SetupLogonStormHandlertolimittheconnectionrate– RATE_LIMIT parameterforListener

• Protectthewalletorkeystore– Ensurethatthefilesareprotectedthroughfilesystempermissions, backedupsecurely,andonlyreadaccess isgrantedtotheusersrunningapplications atrun-time

BestPracticesforSecurity

BestPracticesforHighAvailability• LeveragemostadvancedHAfeatures byusinglatestDBclient– Timeoutandretryinconnectstring– ApplicationContinuity– ReplayDriver– Atmostoncecommit– Inflighttransactions aretransparentlyreplayedincaseoffailure– FastApplicationNotification– Morereliable andpredictable thantheuglyTCPtimeout– Inbandnotifications arepreferred

OracleBestPracticesforHighAvailabilityGracefullyhandleservicetemporaryunavailability

(DESCRIPTION_LIST =

(DESCRIPTION=

(ENABLE=BROKEN)

(TRANSPORT_CONNECT_TIMEOUT=10)

(RETRY_COUNT=10)(RETRY_DELAY=5)(ADDRESS_LIST=(ADDRESS = . . .)(ADDRESS= . . .))(CONNECT_DATA=(SERVICE_NAME=hr_svc)))

(DESCRIPTION=

(RETRY_COUNT=10)(RETRY_DELAY=5)(ADDRESS_LIST=(ADDRESS = . . .)(ADDRESS=. . .)) (CONNECT_DATA=(SERVICE_NAME=hr_svc2))))

TCP/IPleveltimeout

EnableTCPKeepAlive

Retrywhileserviceisunavailable

Connection String:

ExposeyourCloudDatabaseasanOData feedOpenProtocolforqueryable andinteroperableRESTful APIs

• StartedbyMicrosoftin2007• OASISStandardsinceFeb2014• RESTful APIsinsteadofSQL• Allowsrapiddevelopment

OData:• Filtering• Ordering• Joining• Paging• Transactions

TroubleshootingTips• Commoncause–Firewallsblockingconnections• Troubleshooting–Runtraceroute,e.g.• traceroute -T-p1521<IPofDBaaS host>(forDBaaS)(YoucanfindDBaaS hostPublic IPfromDBaaS ServiceConsole)

• traceroute -T-p1522<public hostnameforyourExadata ExpressCloudService>(Youcanfindthepublichostnamefromthetnsnames.ora file,whichisincluded inthezipfiledownloadedfromServiceConsole.Example:dbaccess.us2.oraclecloudapps.com)

– Identifywhereitisfailingandtakeappropriateactions

ProgramAgenda

SecuritySettings

JavaBestPractices

Questions5

java best practices for developing and - · pdf filejava best practices for developing and...

Documents

dispute best practices - hancock whitney · dispute best...

“substantive best practices” best practices in...

“substantive best practices” best practices in trial...

best practices for powerpoint! welcome! best practices for...

2015 fat loss best practices...2015 fat loss best practices...

challenges and best practices for storing/ challenges and...

“substantive best practices” best practices in consumer...

best practices - university of southern california · pdf...

backup and recovery best practices with veeam...

best practices for data warehousing. 2 agenda – best...

dell emc unity: best practices guide...h15093 best practices...

monitoring “best practices” - international … · ·...

o busines s best practices of financial...

precondemnation best practices - nossaman best practices...

best practices in gas well best practices in gas well

sustainable minerals development: best practices in...

best practices for setting bios parameters for · pdf...

best practices putting “best practices” into practice

cpap best practices/worst practices

best practices guide -- cuda...