Mike Lee, Technology Evangelist at Netscape Corporation, for CORBA and Internet Service Broker.

Bob Schlicher, CORBA Architect and Principal Consultant at AlterNet Communications, Inc.

(If you have additional questions about CORBA, visit the discussion group.)

Last Updated: 8/21/98

Section 1: General Info

Section 2: Product Licensing

Section 3: Netscape Internet Service Broker Architecture

Section 4: Getting Started

Section 5: Common Development Problems

Section 6: Advanced Design and Development Issues

Section 7: Security

Section 8: Future Support of CORBA in Netscape Products

1. What is Netscape Internet Service Broker (ISB)?
2. Which versions of Visibroker is ISB based on?
3. Which Netscape products provide support for CORBA?
4. Where do I find out more about Netscape's support for CORBA technology?

Netscape Internet Service Broker is Netscape's ORB product. Two variations exist: ISB for Java and ISB for C++. ISB is based on the corresponding Visigenic's Visibroker products.

Current version of ISB for Java (included in Communicator 4.x and Enterprise Server 3.x) is based on Visibroker for Java Version 2.5 and ISB for C++ is based on Visibroker for C++ Version 2.1.

• Netscape Communicator/Navigator 4.x or higher (includes client for ISB for Java)
• Netscape Enterprise Server 3.x (includes ISB for Java and C++; and one developer license)
• Visual JavaScript 1.0 or higher (provides a development environment for using CORBA components from Javascript.)
• Netscape Application Server (formerly KIVA). Ships with IONA's Orbix 2.2c01 (C++) and OrbixWeb 2.01.

Please see the Netscape CORBA Resources section.

1. Where can I find detailed information about licensing of various components of ISB?
2. What licenses are included with Netscape Enterprise Server 3.x?
3. What licenses are included with Navigator 4.x / Communicator?

There are specific licensing requirements for ISB. These are specified for all type of combinations, eg. non-Netscape Navigator clients, non-Enterprise Server CORBA servers etc. Detailed information can be found in the Marketing and Licensing FAQ.

• Development License for VisiBroker for Java
• Development License for VisiBroker for C++
• Runtime License for VisiBroker for Java
• Runtime License for VisiBroker for C++

• Run-time license for ISB for Java.

1. Is CORBA application development with ISB different from other CORBA products and if yes, how?
2. How does Netscape ISB differ from Visibroker?
3. Is Netscape ISB thread safe?
4. Does Netscape ISB implement thread-pooling?
5. Can Browser or Composer plug-ins use CORBA?
6. What is OSAgent?
7. What is WAI?

Mechanism for clients to discover (and "bind" to) servers in ISB is strictly CORBA compliant. Some other CORBA products use some form of bind API, which is ORB specific. This vendor specific bind call is a way to use a pseudo-naming service built into the ORB itself. According to IIOP/CORBA standard, clients discover servers by obtaining IOR (interoperable object reference) for servers. Naming service is the cleanest mechanism to achive this. Visibroker for Java and ISB use URL naming service, which has been submitted to OMG as a proposed standard. In this mechanism, the stringified (externalised) IOR is written to a directory accessible through the webserver.

 

Architecture Issue	Visibroker 2.5	Netscape ISB (as in NES 3.5.x)
ORB Daemon	OSAgent is responsible for  Registration of active implementations. Binding clients to server (implementations). Works as "transient names" service. Carries out "other" functions such as load-balancing.	There is no OSAgent or other daemon. ISB is "built-into" NES. Thus, ORBInterfaces are not available explicitly, thus ruling out DII.  Active implementations write their IORs in NES Name service directory.  ISB Clients do a name look-up which picks up the IOR file with the same name from the ISB naming service directory.  "Naming service" is limited to the files containing IORs in directory.  Is strictly limited to exposing only those IORs that are to be published through the web server.
Security	Allows use of GateKeeper. Through the GateKeeper, web clients may be able to register new servers or overwrite existing registations (weakness).	No longer possible to use GateKeeper. Requires write access to the naming service directory on the webserver, which should be limited to hosts "behind" the webserver. Disables dynamic invocation and access to ORB services.

 

Yes. You have to ensure your server code is thread-safe too, to ensure end-to-end thread-safety of the deployed application.

No! Visibroker for Java 2.5 documentation mentions thread-pooling, but it is implemented only in VBJ 3.0. (Source: Ralph Galantine ralphg@visigenic.com on 15-Sep-97)

No. Visigenic and Netscape currently do not support CORBA calls from browser or composer plug-ins. (Source: Posting on secnew://netscape.dev.corba on 15-Sep-97 by Paul Pazandak pazandak@OBJS.com, quoting Visigenic Tech Support)

OSAgent is Visibroker's built-in naming and load-balancing service. It was included in the original Enterprise Server 3.0 release. As a result of the Enterprise Server patch and WAI patch (see Getting Started and security sections), OSAgent is no longer required and should not be used. ISB's own URL naming service is used instead.

WAI is a server extension API. It is the current and future wai ; ) (way) to extend Enterprise Server and to add applications to Enterprise Server. WAI service (WAS) is used to handle requests from the browser. Think of it as a newer and better version of NSAPI that is easier to implement and reuse.
More information can be found within the WAI documentation.

1. What Netscape Products do I need?
2. What other tools do I need?
3. How to configure Enterprise Server for using ISB?
4. Are there any examples illustrating ISB coding?

• Netscape Enterprise Server, latest patches are available at the File Library.
• Netscape Communicator 4.x or later.
• Visual JavaScript 1.0 or later, though not mandatory, allows you to develop and debug client and server side CORBA enabled Javascript and Java "weblications".

A Java Development Tool of your choice. For example, Symantec Visual Cafe for Java, Borland's JBuilder etc.

Follow the instructions found in the technote Enabling CORBA on Enterprise Server. Instructions on using Naming Service provided with ISB are found in the technote Using Naming Service: Accessing CORBA Objects.

Yes. Two examples are available here to help you get started.

1. (General ES) Class file Patch.class missing. How do I get it?
2. Bank and Station Monitor examples shipped with ES3.0 dont work. What is wrong?
3. (Unix, C++ CORBA Server only) Why is loader unable to find liborb.so ?
4. (ISB for Java) My CORBA applet works fine in appletviewer, but wont work in Navigator 4.x / Communicator. Why?
5. What is the name of the client-side ISB runtime Java class libraries?
6. What version of Visibroker do these libraries are from?
7. What happens if I remove IIOP10.JAR altogether?
8. How to upgrade the client IIOP10.JAR to Visibroker for Java 3.x version?
9. How do I force Communicator to use external org.omg.corba.* classes?
10. Can I replace NISB.ZIP with VBJ30.JAR in obj.conf to upgarde ES3.x to use Visibroker for Java 3.x?
11. My CORBA object names dont seem to be resolved, even though the names match exactly. Why?

This was a problem in the original release of Enterprise Server 3.0, which has been fixed by the patches for ES and WAI. Load the latest patch for Enterprise Server and WAI as described in Getting Started.

If the example code you have is dated earlier than 17 Dec 1997, download the revised examples, which have the revisions necessary to match late patches to ES3.0.

You need to add /wai/lib to LD_LIBRARY_PATH, SHLIB_PATH, or LIBPATH, depending on your platform.

The most common reason for this problem is that Communicator 4.x treats even local applets as untrusted. In a development environment, the solution is to add the following lines to prefs.js in your Communicator's install directory.

user_pref("signed.applets.codebase_principal_support", true); user_pref("signed.applets.local_security_for_local_classes", false); user_pref("signed.applets.low_security_for_local_classes", true);

For a production environment, you should use signed applets with capability APIs. Capability APIs allow an applet to explicitly request priviledges outside the sandbox.

IIOP10.JAR, residing in Program/Java/classes subdirectory of your Communicator directory.

Visibroker for Java 2.5.

This is pre-Communicator or Navigator 3.x situation. Your CORBA client applets will still work, but the client runtime component of the ORB will be dynamically downloaded. Since, it consisists of many class files, clientside ORB initialization may take up to several minutes.

1. Remove or rename IIOP10.JAR.
2. Ensure VBJ30.ZIP is on the CLASSPATH on client machine running Netscape communicator, or in the classes directory of the Communicator itself.
3. Add the <PARAM name=org.omg.CORBA.ORBClass value=com.visigenic.vbroker.orb.ORB> to your html.
4. If using Gatekeeper on the server, ensure it is running in the same directory as your CLASSPATH, or add it to CLASSPATH. This will not be very optimal, since VBJ30.ZIP (about 2MB) contains all VBJ 3.0 classes, rather than just the ones required for client-side ORB.

A commonly attempted and unsuccessful approach is to code the following applet parameters with your applet, to (a) specify the target classes to use and (b) Ensure backwards compatibility if using a version of Visibroker later than 2.5 on the server side:

<param name=org.omg.CORBA.ORBClass value=com.visigenic.vbroker.orb.ORB> <param name=ORBbackCompat value=true>

The reason it does not work is that even though ORBClass is mapped to your vendor ORB, other class lookups are still resolved within IIOP10.JAR.

No.

A common reason is you are using naming directory convention from pre-WAI patch release. For example, instead of:

netscape.WAI.Naming.register("<A HREF="/old?u=http%3A%2F%2Fdeveloper.iplanet.com%2Fsupport%2Ffaqs%2Fchampions%2Fcorba.html&y=1999">http://" + host + "/iiop_objects/VisigenicBank", manager);

Register the Server only with the following URL:

netscape.WAI.Naming.register("<A HREF="/old?u=http%3A%2F%2Fdeveloper.iplanet.com%2Fsupport%2Ffaqs%2Fchampions%2Fcorba.html&y=1999">http://" + host + "/VisigenicBank", manager);

This modification is necessary if you have installed the WAI-Patch.

1. My applet does not work with Communicator 4.0.3 (with JDK 1.1.2) + 403wt.zip (upgrading NC to JDK 1.1.4)?
2. How do I rollout my applet to production without requiring users to muck around with the IIOP10.JAR file and other settings?
3. How should a client re-connect to a CORBA Server after a shutdown and restart?
4. What is the relative performance of a CORBA client applet vs. a CORBA client (java) application?
5. Can I use event service (callbacks) with ISB?

Upgrade to Communicator 4.0.5 (JDK 1.1.5) or better. There may be a bug with JDK 1.1.4 release.

Use Java Plug-in to deploy the JVM you want your users to use. Note that you need to modify your HTML to use this plug-in and develop your applet with the same version of JDK as that of the Java Plug-in specified.

You have to start your server with the option

    -OAport 
or Java runtime option
    -DOAport = 

Retaining the previous port number contributes to keeping the client IOR (Interoperable Object Reference) valid.

This is courtsey of Anat Katz-Lichtenstein. According to his benchmark, a round trip time in Navigator applet was 70 millisecond, vs. 20 milliseconds in a java application --- both being CORBA clients. The additional time taken by the applet can be attributed to:
1. If using Gatekeeper, it will add another hop in the round trip.
2. Browser security sandbox environment will take resources and time for validation.
3. Operating system resource allocation happens two layers down -- OS allocates resources to browser, who in turn allocates resources to JVM.

Use of event service will require the applet to create a CORBA server implementation and register with ISB. This is possible only if the applet can write to name service URL directory on the webserver. This does not fit in with Netscape ISB's security implementation approach. Allowing write access to applet client hosts (which may require opening up that directory to everyone), may be possible to implement, but this functionality is not supported by Netscape. An implementation with production quality security will require authentication and authorization at both the client and server firewalls/webservers.

1. Why was Gatekeeper taken out of the final release Enterprise Server 3.x?
2. When will there be IIOP/ SSL support in the ORB environments?
3. What security concerns are there with enabling the Enterprise Server to run WAI applications?
4. How can we reduce the security problem with running WAI applications?

Netscape chose for security reasons, to take out the Gatekeeper feature in Enterprise Server 3.x. Today there is no SSL support for IIOP which results in lack of privacy in an open environment such as the Internet. Gatekeeper allows any machine that can reach the server via HTTP or IIOP to register or intercept services, and or corrupt the namespace.

Netscape will be adding IIOP/SSL support to the C++ ORB in the Apollo release of the SuiteSpot servers, and for the Java ORB in the Mercury release of the Communicator.

Netscape will be adding IIOP/SSL support to the C++ ORB in a future release (later than Apollo) of the SuiteSpot servers, and for the Java ORB in the Mercury release of the Communicator. IIOP/SSL will be used to support point-to-point authentication based on a certificate framework. The protocol will include support for trust-based principal delegation.

If your web service is implemented as an application that runs outside the Enterprise Server's process, the following scenarios could occur: Someone could replace a web service by running another program that registers under the same name or by uploading a file to the server. Someone could run a program on a separate machine and register the program with your Enterprise Server. For more information read the Security chapter in: Writing web applications with WAI.

Netscape recommends that you follow these guidelines: (a) Restrict login access to the Enterprise Server's host machine. (b) Run WAI applications on the local machine only (the machine on which the Enterprise Server runs). (c) Restrict osagent so that it only accepts connections from the local host only.

For more information read the Security chapter in: Writing web applications with WAI

1. When will ISB for Java and C++ in Communicator and Enterprise Server be upgraded to later/latest version of Visibroker?
2. When will an implementation of Secure IIOP (IIOP over SSL) be available in Netscape products (Communicator and Enterprise Server 3.x)?
3. Is Netscape committed to Visigenic's ORB or is it likely to be replaced by another ORB like Orbix?

Netscape is working closely with Visigenic to integrate the latest versions of Visigenic ORBs into the releases of Enterprise Server and Communicator.

The simplified version of the route that Netscape takes is the following:

• Visigenic Releases their ORB
• Netscapes get source code andevaluates release
• Netscape modifies the code to fit Netscape security models, etc. (i.e. Removal of Gatekeeper).

So expect future major releases of Netscape products to upgrade to the latest or close to latest versions of the Visigenic ORB.

Netscape is actively working on an IIOP over SSL solution. Details of the approach are likely to be made public before a major release containing new versions of Visibroker products.

Netscape is committed to work with Visigenic ORB for the visible future.

NETSCAPE CORBA RESOURCES

• Netscape CORBA Central
• Marketing and Licensing FAQ
• Netscape ISB Documentation
• Netscape Internet Service Broker for Java - Programming Guide
• Netscape Internet Service Broker for Java - Reference Guide
• Netscape Internet Service Broker for C++ - Programming Guide
• Netscape Internet Service Broker for C++ - Reference Guide
• Enterprise Server Documentation
• Programming with the Web Application Interface (WAI)
• All Enterprise Server documents
• Tech Notes
• USING NAMING SERVICE: ACCESSING CORBA OBJECTS from Java, JavaScript (both client and server) and C++
• Enabling CORBA on Enterprise Server

GENERAL CORBA RESOURCES

• Object Mangement Group (OMG)'s web site
• CERFnet's Corba FAQ
• Visigenic web site
• Cetus's CORBA Links -- HUGE number of links on CORBA.. probably all you will ever need!
• IIOP Specification -- a Closer Look

CORBA SECURITY RESOURCES

• Object Management Group CORBA/Firewall Security Request for Proposals (DRAFT 1.0)
• IONA and Raptor Introduce CORBA-IIOP Ready Firewall (Press Release)
• Trusted Information Systems' SIGMA Research Project

MEMBERS RESOURCES

• CORBA Newsgroup
• WAI Newsgroup

This FAQ is intended as a developer resource. Any reference to third parties or third-party products should not be construed as an endorsement by Netscape Communications Corporation. 

---

Related Readings:

• Frequently Asked Questions: Find the answers to your questions on Internet technologies.
• Documentation: A library of technical information.
• Developer Central: Collections of developer resources organized by Internet technology areas.

Any sample code included above is provided for your use on an "AS IS" basis, under the Netscape License Agreement - Terms of Use