OpenAM - Preparing For Installation - Java Environment - Do we need to add the JVM options "--add-exports"

[joelcharlebois]

I noticed that the OpenAM Docker image's environment variables includes JAVA options (JAVA_OPTS) with several "--add-exports" options. The OpenAM Docker image runs Tomcat 9 on JDK 21 and includes several "--add-exports" JVM options, as below:

--add-exports java.base/sun.security.util=ALL-UNNAMED 
--add-exports java.security.jgss/sun.security.krb5=ALL-UNNAMED 
--add-exports java.base/sun.security.x509=ALL-UNNAMED 
--add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED 
--add-exports java.xml/com.sun.org.apache.xerces.internal.dom=ALL-UNNAMED

The OpenAM Installation Guide documentation, "Preparing for Installation" section, here: https://doc.openidentityplatform.org/openam/install-guide/chap-prepare-install, makes no mention of the "--add-exports" JVM options in the "Preparing a Java Environment" section, nor in the "Preparing Apache Tomcat" section.

When preparing the Java Environment, for deployment on various containers (e.g. Tomcat 9), using recent JDKs (e.g. 21), do we need to configure the JVM options for the container startup to include the various "--add-exports" options?

Thanks.

[maximthomas]

Good point, thank you, I've created an issue #836

[joelcharlebois]

Thanks.

Related;

1- When starting the OpenAM Docker image/container and tomcat, there are a number of other JVM startup options added via the tomcat startup script and I believe also via tomcat's CATALINA_OPTS environment variable. I believe that those are default or otherwise perhaps added by OpenAM deployment, but please verify if any additional manual configuration is required for those and please advise.

2 - I may have missed it, but I did not see a max heap size "-Xmx" jvm option being set. Was this missed on my part, an omission, or an assumption made that Docker admins would limit the OpenAM Docker container's memory usage?

3 - Are there any "--add-exports" or other jvm options required to run OpenDJ or JAVA Policy Agent using recent JDKs, that are not in their respective installation documentation?

Thanks again.

[joelcharlebois]

Another Related comment / question - Deploying OpenAM into Tomcat on Windows - JVM options "--add-exports"

On Windows, I was able to deploy OpenAM into Tomcat after adding the "--add-exports" JVM options to Tomcat's startup configuration. OpenAM will deploy, and display the configuration page.

However, I could not create a default or custom configuration with the embedded OpenDJ. The OpenDJ installation would fail, complaining about missing java exports.

To resolve this, I had to add a Windows environment variable "JAVA_TOOL_OPTIONS" with the same "--add-exports" that are required by OpenAM. Then the OpenAM configurator with embedded OpenDJ would complete successfully.

Question:

With respect to using the embedded OpenDJ in OpenAM, Are you able to somehow add these "--add-exports" JVM options into the OpenDJ configuration and startup commands/scripts themselves, to avoid having to set a system wide Windows environment variable?

Thanks.

[maximthomas]

1- When starting the OpenAM Docker image/container and tomcat, there are a number of other JVM startup options added via the tomcat startup script and I believe also via tomcat's CATALINA_OPTS environment variable. I believe that those are default or otherwise perhaps added by OpenAM deployment, but please verify if any additional manual configuration is required for those and please advise.

There is no need for additional configuration, except described in the OpenAM documentation.

2 - I may have missed it, but I did not see a max heap size "-Xmx" jvm option being set. Was this missed on my part, an omission, or an assumption made that Docker admins would limit the OpenAM Docker container's memory usage?

Yes, the limit defined by the -XX+UseContainerSupport option and depends on available container memory https://eclipse.dev/openj9/docs/xxusecontainersupport/

3 - Are there any "--add-exports" or other jvm options required to run OpenDJ or JAVA Policy Agent using recent JDKs, that are not in their respective installation documentation

No, there is no need to set these options. Tested on JDK 8 and 11

With respect to using the embedded OpenDJ in OpenAM, Are you able to somehow add these "--add-exports" JVM options into the OpenDJ configuration and startup commands/scripts themselves, to avoid having to set a system wide Windows environment variable?

With JDK 11 created setenv.bat for Tomcat 9 with the following contents

set "OPENAM_DATA_DIR=c:/Users/user1/Desktop/openam"
set "MEMORY=-server -XX:+UseG1GC" 
set "CATALINA_OPTS=%MEMORY% -Dcom.iplanet.services.configpath=%OPENAM_DATA_DIR% -Dcom.sun.identity.configuration.directory=%OPENAM_DATA_DIR%"
set "CATALINA_OPTS=%CATALINA_OPTS% --add-exports java.base/sun.security.util=ALL-UNNAMED --add-exports java.security.jgss/sun.security.krb5=ALL-UNNAMED --add-exports java.base/sun.security.x509=ALL-UNNAMED --add-exports java.base/sun.security.tools.keytool=ALL-UNNAMED --add-exports java.xml/com.sun.org.apache.xerces.internal.dom=ALL-UNNAMED"

Run OpenAM setup with the default configuration and everything works fine

[joelcharlebois]

Cool. Thanks. You're the man.