Multi threading implementation for Active Expression in Policy Server

Products

• SITEMINDER

Issue/Introduction

When running Custom Java code with the Policy Server, the Policy Server crashes.

The stack reports the crash occurs in Custom Java code:

  #0 0x00007f3af823c5c8 in myClass::Connect
  (ConnectRequest_s&, char*, unsigned short) ()
  from /{home_policy_server}/mylibforjava.so

The Custom Java code is launched by an Active Expression.

The code to launch the ActiveExpression is:

   public int init(APIContext context) throws Exception {
   // Initialize the Cache
          log.info("Initialization of <CustomJavaActiveResponse> was successful");
          return 0;
      }

The Java initialization is done through several threads in time as seen from logs:

 
  2021-06-21 00:55:05,902 Thread-8 INFO myCustomJavaActiveResponse - Initialization of myCustomJavaActiveResponse was successful
  2021-06-21 00:57:57,104 main INFO myCustomJavaActiveResponse - Initialization of myCustomJavaActiveResponse was successful
  2021-06-30 11:54:12,271 Thread-3 INFO myCustomJavaActiveResponse - Initialization of myCustomJavaActiveResponse was successful

Some questions:

1. For Active expression init() method, is this the responsibility of main thread or child thread?
2. Is Siteminder implementation of Active expression multi threading safe?
3. The SiteMinder Policy Server launches java-as-a-service via JVMOptions.txt. On a Linux server, is it possible to spot java service via ps -aef command?

Resolution

1. SiteMinder calls init() once to initialize this class (active expression) before making calls to invoke().
   
   So any initialization procedures that the Custom Java class requires, must be done here as it calls once per instance of class.
   
   It performs following :
   
   a. It loads the library if not already loaded and calls the init() method to initialize the instance;
   b. A successfully initialized object remains in cache until the SiteMinder Policy Server shuts down.
   
   This is loaded by one of the worker thread, which is processing the current transaction request.
   
   Similarly release(), is called once when SiteMinder Policy Server is shutting down.
   
   This method is to perform any rundown procedure if any.
   
   
2. With regard to invoke() call APIContext supplied to Active Expression class that is local, hence it's thread safe, but if this function is using any common resource handle which shared is between threads (e.g. connection handle, etc), then thread-safety has to be maintain.
   
   The SiteMinder Policy Server expects the ActiveExpression class should be stateless model that does not depend on instance state stored in member variables of the ActiveExpression class.
   
   In such case where connection handle or memory reference is used, then code has to be thread safe, using recommended practices e.g. synchronize, locks, atomics objects etc.
3. The SiteMinder Policy Server creates JVM environment inside the main process, hence the separate Java process running as part of service might not be visible, instead the smpolicysrv process can be used to take thread dumps from a attached JVM.
   
   On Linux OS, there are several tools and commands to get all threads related to a parent process as (1):
   
   # ps -eLf
# ps -T
# htop

Additional Information

1. Is there a way to see details of all the threads that a process has in Linux?