November | 2015 | Messages in a Bottle

[30 November 2015; notes on Tomcat 7 and BaseX 8.3.1 added 7 January 2016]

For a long time I have wished to have an XQuery engine I could use as a back end for Web applications.

Once upon a time, one could use 28msec’s Sausalito platform for this, but not since 28msec stopped supporting it. (In theory, one can still use their new tools to build XQuery-based applications, but I was not able to figure out how, the last time I tried.) But as I wrote when I first used Sausalito, “having an XML database on demand is a lot like having running water on demand — those who have never had it may think it’s a luxury anyone should be able to live without, but once you’ve had it, it can be hard to go back.”

I spent a couple days this past week trying again to choose among the various options (an XQuery server running in a shared hosting environment, running in a dedicated virtual private server, running in the cloud) and succeeded, after two days of work, in getting BaseX running under Tomcat at a Java hosting provider. (If you’re looking for Java hosting, I can say that I have been happy at Kattare.com.) Some of those two days went to attempting to make another solution work (but OpenShift appears to be unwilling to install its command-line tools on either of my current operating systems, and my network connection appears to be unequal to the task of downloading an OS upgrade for the sake of making OpenShift’s installation software happy), and some went to missteps.

If I could have spent time only on the things that turned out to work, it would only have taken a couple hours.

For the record, and for the benefit of any other XQuery developers out there who face the task of getting an XQuery engine running in a commercial hosting environment, this is the checklist I am making for myself for next time.

Prerequisites

The following checklist assumes that:

Your Java hosting provider provides you with Tomcat.
Your Java hosting provider provides you with ssh access.
You know how to ssh into your hosting provider and are comfortable using bash or another shell.
You have and can run a copy of BaseX installed on your local machine, which is the same version of BaseX as you are going to install in Tomcat. (Warning: if you are running a current BaseX locally, you may need to install a back-level BaseX for preparatory step 3 below.) It’s helpful to know where it’s installed, so you can launch the stand-alone version of BaseX successfully.
You are interested in getting an XQuery engine set up, so you can develop XQuery apps; you are not seeking to develop Java applications.
(Too bad for you; in order to install anything at all in Tomcat you must understand a little about Tomcat, and all of the Tomcat documentation is aimed at Java developers, not at users of Java applications. Sorry about that; I don’t like it either. As Liam Quin recently remarked to me, our refrigerator salesmen manage to tell us how to install the thing without expecting us to read documentation about how to build a freon condenser; someday the people who build Java application containers like Tomcat will realize that their users include people who want to use not write Java programs. I can hardly wait for the time when Java infrastructure is documented as intelligently as refrigerators. But so far, the refrigerators are winning.)

If these don’t all apply, you will need to make some adjustments on the fly.

Preliminary preparation

Review enough of the Tomcat configuration on your host (consulting the Tomcat documentation where necessary) to know in advance the answers to the following questions:
- 1.a What version of Tomcat and Java are you using?
  
  If you’re running Tomcat 6 and Java 1.6, you’ll need a version of BaseX that runs under Java 1.6. The last of that line was BaseX 7.9.
  
  If you’re running Tomcat 7 and Java 1.7, you can use the current version of BaseX (as I write this, that’s BaseX 8.3.1).
  
  If you’re running some other combination, I have no idea whether you can run BaseX 8 or not; there are conflicting reports on the Web, and I’m not interested enough in Java application development to bother trying to track down the details. Either stick with BaseX 7.9 for safety or try BaseX 8 and see if it works.
  
  Trying to run BaseX 8.x under Tomcat 6 and Java 1.6 will not break anything (that I know of). But the servlet will not deploy, and you will find an error message in your Tomcat logs that (how can I put this tactfully?) appears to be aimed at Java developers and is not very helpful to other readers. In my case, trying to deploy BaseX 8.3.1 in a Tomcat 6 environment cost me a few hours and some hairpulling, because it took time to understand what was going wrong.
  
  The original version of this post discussed only installation of BaseX 7.9, but I had now upgraded to Tomcat 7 and can also report on the process for BaseX 8.3.1.
- 1.b What directory serves as the base directory for Tomcat ($CATALINA_BASE)?
  
  On my hosting provider, it’s my home directory (i.e. ~) on the Java host.
- 1.c What URI is used for the web application management interface (the “Manager application”) in your Tomcat?
  
  This was surprisingly time consuming for me; I host two domains at my Java hosting provider, which I’ll call able.example.com and baker.example.com here, and the Manager application was available only on one of them (the one configured by server.xml as the ‘default’ one). But eventually I found that http://baker.example.com/manager/html/list gave me results; the various candidates with paths like $host/manager/html, $host/manager, $host/server/manager/html/list, $host/server/manager/html, $host/server/manager, and any path at all on the host http://able.example.com/, all failed.
- 1.d What userid and password do you use to sign in to the Manager application? Or equivalently for most purposes, where is your tomcat-users.xml file?
  
  Please tell me you and your hosting provider didn’t leave it at the Tomcat default. If you did, now would be a good time to change it, so that random strangers don’t have administration privileges in your Tomcat instance.
  
  In my installations, this information is in $CATALINA_BASE/conf/tomcat-users.xml; I find it convenient to have that file open in an emacs buffer before trying to navigate to the Manager application, so I can copy and paste the password instead of typing it.
- 1.e What does the Manager application look like when things are normal?
  
  That is, look at it before hand, before you do anything. Otherwise, you’ll never be able to tell whether what you’re looking at afterwards is normal, or you broke something.
- 1.f Where is the webapps directory for the Tomcat engine and host into which you wish to install?
  
  In my case, there is one for each virtual host, named with the virtual host name, a hyphen, and the string “webapps”: able_example_com-webapps and baker_example_com-webapps.
- 1.g How do you stop and restart Tomcat?
- 1.h Where does your Tomcat write its logs?
Decide in advance what userids you wish to specify for your BaseX database(s); for each userid specify the initial password and the initial permissions for each user. At the very least, determine what userid and password will be used as the default database user for the servlet.

For what it’s worth, I like to set the database up with two users, initially: an administrator userid with ADMIN permissions, whom I’ll call ‘Abel’ here, and a userid with READ permissions, whom I’ll call ‘Romeo’. For purposes of this exposition I’ll assume their passwords are ‘Elba1812’ and ‘Juliet1597’.
Prepare a suitable file of userids, passwords, and privileges.

How you do this varies between BaseX 7.9 and BaseX 8.0 and later.

In BaseX 7.9, the documentation tells us that global users, passwords, and permissions are stored in a .basexperm file in the BaseX home directory. The calculation of what counts as the home directory varies depending on how BaseX is installed, and I am unable to deduce from the documentation what counts as the home directory when BaseX 7.9 is running under Tomcat. Experiment, however, shows that it’s apparently …/webapps/BaseX79/WEB-INF. (At least, that’s where the .basexperm file needs to go.)

An examination of the .basexperm file on your local installation (look in your home directory) will show you (at least, it showed me) that it’s not intended for editing by a human. We will need to use BaseX to make a .basexperm file for us.

You might be tempted to say “Wait, let’s get BaseX running on the server, then use the REST interface to create users Abel and Romeo and assign them passwords and permissions, then use the Abel userid to assign permission level NONE to the built-in userid ‘admin’. I like the way you think, but I don’t think that’s going to work. (Ask me how I know.) The server command for creating or altering passwords does not allow the password value to be given as an argument: instead, the server prompts you for the password. But there is no way for the REST interface to prompt you for a password.

One workaround (this is apparently what the BaseX developers had in mind for this situation) is to use BaseX 7.9 on your local machine (we’ll use the stand-alone version, but if you’re adventurous you can use the client-server version or the GUI) to make a .basexperm (permissions) file, which you will then copy to the appropriate directory on the server.

Since I don’t want the .basexperm file I create now to interfere with the existing set of users and passwords on my local machine, I want to run BaseX with a new home directory that is not the one usually used. So what I do in my bash shell is something like the following:
```
# make a temporary place for a .basexperm
# file to reside

mkdir ~/basex-temp-home
cd ~/basex-temp-home
echo "# hi there" > .basexhome
echo "DBPATH = `pwd`/data" > .basex

# Now launch BaseX.  N.B.

/opt/local/BaseX-7.9/basex/bin/basex
```
In BaseX, I issue the following server commands to create the users I want, and assign a new password for the built-in admin user. I’d assign NONE to admin if I could, but I can’t, so I just reset the password.
```
# Just check to see where we are to start with:
SHOW USERS

CREATE USER Abel
# at this point, the server prompts for
# the password 'Elba1812'
CREATE USER Romeo
# password:  Juliet1597
GRANT ADMIN TO Abel
GRANT READ TO Romeo
ALTER USER admin
# password:  Elba1812

# now, just to make sure we are
# where we want to be
SHOW USERS

EXIT
```
If all has gone well, BaseX will have created a .basexperm file in directory ~/basex-temp-home.

(Alternatively, I guess one might rename the existing .basexperm to .temp.basexperm.old, launch the GUI, issue the server commands given above, exit, move the new .basexperm out of ~ and into some other place, then give the old .basexperm its old name back. But I haven’t tried it this way.)

In BaseX 8.3.1, the documentation tells us that users, passwords, and permissions are stored in a human-editable users.xml document in the database directory. Experiment shows that if in this environment we add a new user, BaseX 8.3.1 places the users.xml document at …/webapps/BaseX831/data.

One could go through a process similar to that described above to create a users.xml file, but in practice I became lazy and handled things a slightly easier, slightly riskier way (see description of “the lazy way” below in steps 8 and 9).
Prepare in advance a small Web-accessible XML file or two to use in creating a helloworld database to check that things are running as you expect.

I use the documents in http://cmsmcq.com/2015/11/XQuery-over-HTTP/data/ for making a helloworld example. When installing BaseX 8.3.1, it proves simpler to use XML documents on my hard disk.

Doing the deed

After the four preparation steps just described, the steps for actually installing the software are very simple in principle: first fetch a copy of the WAR file for BaseX into the appropriate webapps directory, adjust its configuration, and then restart Tomcat to deploy the app.

Download the WAR file for BaseX.

In one window, I use ssh to reach my hosting provider. In another, I navigate to the Downloads area on the BaseX web site.

In the browser window, I right-click the WAR file and save its URI to the clipboard (in different browsers this is Copy Link, or Copy Link Address, or Copy Link Location).

In the ssh window, I issue the following commands, using a Paste action (command-V) to insert the URI of the WAR file (substituting the BaseX version number for $vvv):
```
mkdir incoming
cd incoming
curl --output BaseX$vvv.war $URI-of-WAR-file
```
Open the Manager application in a browser window and keep an eye on it.
Put the WAR file in the webapps directory

If you do this while Tomcat is running, Tomcat will unpack the WAR file; this is convenient, because you need to edit files inside it. On the other hand, you don’t want BaseX to start up yet, so keep an eye on the Manager window to make sure that BaseX doesn’t suddenly show up there. If it does, use the Manager application to stop it.
Configure BaseX

The only essential configuration to do at this point is to install the userids prepared earlier and change the default username and password used when the HTTP request supplies none; otherwise anyone who happens across your BaseX engine on the open Web has admin privileges.
- 8.a Copy the .basexperm or users.xml to your Java hosting provider. (Or, if we are doing things the lazy way, do nothing here.)
  
  It doesn’t much matter how you do this (but be aware that the file is binary; cut and paste is not going to work). I use scp; from my local machine I type:
```
scp .basexperm able.example.com:incoming/.basexperm
```
  I could copy it straight to the webapps directory, but I like to keep a copy in ~/incoming in case I end up zapping the webapps subdirectory.
- 8.b Place the .basexperm file in the …/webapps/BaseX79/WEB-INF directory, or the users.xml in the …/webapps/BaseX831/data directory. (Again, if we are doing things the lazy way, we do nothing here.)
  
  In my ssh window on the web host I type:
```
cd ~/able_example_com-webapps/BaseX79
cp ~/incoming/.basexperm .
```
  8.c Change the default user and password by editing the web.xml file. (Even if we are doing things the lazy way, this is worth doing.)
  
  No one who presents no credentials gets to create a new database or change the setup on our server. So the default user should not have admin permissions, only read permissions. It is this for which we made the read-only user Romeo.
  
  In …/webapps/BaseX79/WEB-INF/web.xml, close to the top of the file, the default user credentials are set:
```

<context-param>
<param-name>org.basex.user</param-name>
<param-value>admin</param-value>
</context-param>
<context-param>
<param-name>org.basex.password</param-name>
<param-value>admin</param-value>
</context-param>
```
  This changes to
```

<context-param>
<param-name>org.basex.user</param-name>
<param-value>Romeo</param-value>
</context-param>
<context-param>
<param-name>org.basex.password</param-name>
<param-value>Juliet1597</param-value>
</context-param>
```
- 8.d Take care of anything else you need to configure.
  
  In my Tomcat 6 installation, there is already a servlet named ‘default’, so the rules at the end of web.xml for static content cause problems. For the moment, I comment them out. I may try to deal properly with them later, but I am looking for a back end, not a complete web server. If I have static content to be served, Apache will serve it, not BaseX.
  
  Under Tomcat 7, the rules for static content caused no trouble, so I didn’t comment them out.
Flip the switch

Restart Tomcat to cause it to deploy BaseX.

You can in principle cause Tomcat to deploy the new application by issuing appropriate commands from the Manager application, and possibly even upload the WAR file from your machine, without logging in to your hosting provider. When I tried doing it that way, I ran into other problems, so I’ve never actually done it that way.

Check in the Manager application to make sure BaseX appears in the list of servlets and is deployed.

It’s at this point that I ran into failures with BaseX 8.3.1 running under Tomcat 6. The Tomcat logs (remember I told you to find out where your Tomcat logs are going?) said (among many other things):

Nov 27, 2015 6:44:35 PM org.apache.catalina.startup.HostConfig deployWAR SEVERE: Error deploying web application archive BaseX831.war java.lang.UnsupportedClassVersionError: org/basex/http/SessionListener : Unsupported major.minor version 51.0 (unable to load class org.basex.http.SessionListener)

Searching on the Web for the wording of the error message tells me that this is what happens when you try to run a Java program compiled with Java 7 (or 1.7? or 51.0? I wonder what drugs Sun engineers were on when they decided how to number Java versions? And how many drugs Oracle engineers have had to consume in order to be willing to continue following the same pattern?) under Java 6 (or 1.6). This is what alerted me to the statement that was there on the BaseX downloads site all along: “Versions before BaseX 8.0 can be run with Java 6.” Read with a heightened sensitivity to subtle entailments, we can infer that they mean: version 8.0 and later won’t run with Java 6.

This analysis seems consistent with the fact that I get the same error message when I try to run BaseX 8.x on a system whose default Java is Java 6.

If we are using BaseX 8.* and doing things the lazy way, it is now that we set up our users and passwords. Do this first thing, since until you do it, your server is open to anyone who happens by and tries “admin” as the userid and “admin” as the password.
1. Log in to the dba application that comes with BaseX 8, using the default admin username and password. On my setup, the dba application is at http://baker.example.com/BaseX831/dba.
2. Change the password for the admin account to Elba1812. (This closes the door to our casual intruders.)
3. Glance at the dba application’s tabs for Databases, Users, Files, and Settings,
  just to make sure no one has exploited the window of vulnerability we opened by starting the server with the default admin password in place.
4. Add the userid Abel with password Elba1812.
5. Add the userid Romeo with password Juliet1597.
Test

To test that things are going as expected, the REST interface can be used (both in 7.9 and 8.3.1) to create and query a database. In 8.3.1, it’s easier to use the dba application. I’ll describe both methods.

Using the REST interface

First, a query that should work from the default user (without credentials):
```
http://able.example.com/BaseX79/rest
```
Hmm. This doesn’t in fact work for me: it prompts me for a userid and password. One possible explanation is that I mistyped the password either when creating the .basexperm file or in the web.xml file. Another is that I have once again managed to misunderstand what the BaseX wiki says about the USER and PASSWORD options. For the moment, however, I am going to ignore this problem of failure in setting the default user. When I do give the appropriate userid and password, I get the expected response from the REST server.

Next, some queries that should require credentials; if you dereference this using curl or wget without specifying the –user option, you will get an “Access denied” message, and if you try in a browser the browser will normally prompt you for userid and password. Supply user Abel and password Elba1812.

All of the following URIs contain characters that will need to be escaped; I find that the browser always takes care of that for me.
```
http://able.example.com/BaseX79/rest?command=show users
```
Then create a database and add some documents:
```
http://able.example.com/BaseX79/rest?command=create db helloworld http://cmsmcq.com/2015/11/XQuery-over-HTTP/data/doc1.xml
http://able.example.com/BaseX79/rest/helloworld?command=add http://cmsmcq.com/2015/11/XQuery-over-HTTP/data/doc2.xml
http://able.example.com/BaseX79/rest/helloworld?command=add http://cmsmcq.com/2015/11/XQuery-over-HTTP/data/doc3.xml
http://able.example.com/BaseX79/rest/helloworld?command=add http://cmsmcq.com/2015/11/XQuery-over-HTTP/data/doc4.xml
```
Now we can query them:
```
http://able.example.com/BaseX79/rest/helloworld?query={/}
```
Finally, we can delete the database:
```
http://able.example.com/BaseX79/rest?command=drop db helloworld
```
If the responses to dereferencing these URIs is as expected, then hurrah, it works, and you can now get on with your application development.

If not, then check the logs (remember I told you to find out where your logs are going?) and good luck to you.

Using the dba application in BaseX 8.3.1

In the Databases tab, create a helloworld database.

Then use the Add button to add resources to it. In 8.3.1, this expects
you to upload files from your browser; it doesn’t seem to accept URIs. So I uploaded
my local copies of the four hello-world documents, one at a time.

In the Queries tab, type some queries in the query widget, click the Run button to evaluate them, and make sure the results are as expected.
- collection('helloworld')/*
- collection('helloworld')//greeting[@var='northern']
The REST queries listed above should also work.

Messages in a Bottle

CMSMcQ's klog

Monthly Archives: November 2015

Running the BaseX XQuery engine under Tomcat

Prerequisites

Preliminary preparation

Doing the deed