Extremely Serious

Month: September 2022

Container Aware JVM Parameters for Heap Memory

JVM Parameters

Modify the java heap memory based on container memory using one of the following JVM parameters:

Parameter Description
-XX:InitialRAMPercentage The initial size of the heap based on the total container memory.
-XX:MinRAMPercentage The maximum heap size based on the size of the JVM running on small heap. The small is heap is of approximately 125MB.
-XX:MaxRAMPercentage The maximum heap size based on the size of the JVM running on greater than small heap.

Displaying the Current Value

Use the following command the display the current value of the container aware JVM Parameters using the following:

docker container run -it --rm openjdk:17.0.2-slim java -XX:+PrintFlagsFinal -version | grep -E ".*RAMPercentage"

Expect to see something like the following:

   double InitialRAMPercentage                     = 1.562500
                   {product} {default}
   double MaxRAMPercentage                         = 25.000000
                   {product} {default}
   double MinRAMPercentage                         = 50.000000
                   {product} {default}

Checking the Current Memory and CPU using JShell

  1. Open a jshell in the container using the following:

    docker container run -it --rm openjdk:17.0.2-slim jshell
  2. Paste the following command in jshell:

    var rt = Runtime.getRuntime();
    System.out.printf("Heap size: %dMB%nMaximum size of heap: %dMB%nAvailable processors: %d%n", 
     rt.totalMemory()/1024/1024, rt.maxMemory()/1024/1024, rt.availableProcessors());
  3. Press enter.

    Expect to see something similar to the following:

    rt ==> java.lang.Runtime@1d81eb93
    Heap size: 252MB
    Maximum size of heap: 3966MB
    Available processors: 16
    $2 ==> java.io.PrintStream@34c45dca
  4. Type the following in jshell and press enter.

    /exit

Allocating a Memory and CPU to a Container

  1. Execute the following command to allocate 100mb of memory and 1 CPU to the container:

    docker container run -it --rm -m 100m --cpus=1 openjdk:17.0.2-slim jshell
  2. Paste the following command in jshell:

    var rt = Runtime.getRuntime();
    System.out.printf("Heap size: %dMB%nMaximum size of heap: %dMB%nAvailable processors: %d%n", 
     rt.totalMemory()/1024/1024, rt.maxMemory()/1024/1024, rt.availableProcessors());
  3. Press enter.

    Expect to see something similar to the following:

    rt ==> java.lang.Runtime@6659c656
    Heap size: 7MB
    Maximum size of heap: 48MB
    Available processors: 1
    $2 ==> java.io.PrintStream@2d8e6db6

    Notice the following:

    Value
    Heap size 7MB
    Maximum size of heap 48MB
    Available processors 1
  4. Type the following in jshell and press enter.

    /exit

Modifying the Allocated Maximum Size of Heap Memory

  1. Execute the following command to allocate 100mb of memory and 1 CPU to the container:

    docker container run -it --rm -m 100m --cpus=1 openjdk:17.0.2-slim jshell -R-XX:MinRAMPercentage=80
  2. Paste the following command in jshell:

    var rt = Runtime.getRuntime();
    System.out.printf("Heap size: %dMB%nMaximum size of heap: %dMB%nAvailable processors: %d%n", 
     rt.totalMemory()/1024/1024, rt.maxMemory()/1024/1024, rt.availableProcessors());
  3. Press enter.

    Expect to see something similar to the following:

    rt ==> java.lang.Runtime@6659c656
    Heap size: 7MB
    Maximum size of heap: 77MB
    Available processors: 1
    $2 ==> java.io.PrintStream@2d8e6db6

    Notice the Maximum size of heap become 77MB. This is because of the JVM argument -XX:MinRAMPercentage=80 passed in jshell as:

    -R-XX:MinRAMPercentage=80

    We use the --XX:MinRAMPercentage=80 because the memory allocated is a small heap.

  4. Type the following in jshell and press enter.

    /exit

The Resource Owner Password Credential (ROPC) Grant Type

The resource owner password credential grant type is designed as a stop-gap for legacy applications. Should only be used temporarily until the migration of the application to OAUTH is complete. This grant type should never be used anymore. This type can request for offline_access scope (i.e. to request for refresh token).

  1. Use the token end point to do post request for the access token with the following headers:

    Content-Type = application/x-www-form-urlencoded

    And with the following form data:

    grant_type = password
    client_id = the one used from step 1.
    client_secret = 
    username = 
    password = 
    scope = (Optional) what permision wanted. If not specified, default permission will be given.
    state = (Optional) value to echo to us.

    Expected Response

    {
    "access_token" : <ACCESS_TOKEN>,
    "token_type" : "Bearer",
    "expires_in" : 3600,
    "scope" : <The scope allowed by the server>
    }
  2. Call the API with the authorization header like the following syntax:

    Bearer <ACCESS_TOKEN>

Related Post
KEYCLOAK – JWT GENERATION – PASSWORD GRANT TYPE

Keycloak – Realm – OpenID Configuration

The open id configuration exposes some information like the following:

  • Authorization endpoint
  • Token endpoint
  • Supported grant types
  • Supported response types
  • Supported response modes
  • Supported claims
  • Supported scopes

Use the following address syntax to find-out the OpenID configuration:

<KEYCLOAK_ADDRESS>/realms/<TARGET_REALM>/.well-known/openid-configuration

Example

Given

Token Value
KEYCLOAK_ADDRESS http://localhost:8080
TARGET_REALM test

The OpenID configuration would be:

http://localhost:8080/realms/testrealm/.well-known/openid-configuration

Keycloak – JWT Generation – Password Grant Type

Pre-requisite

  • Keycloak 19^1

Creating a New Client and User

  1. Sign in to keycloak admin console using the following address:

    Must know a valid credential.

    http://localhost:8080/admin/

  2. Switch or create a realm that is NOT a master realm (i.e. leave the master realms for keycloak usage only), like the following (i.e. jwtrealm):
    jwt-realm

  3. Create a new client as follows:

    1. Ensure that OpenID Connect is the Client type.

    2. Provide a Client ID (e.g. jwtclient).

    3. Click the Next button.

      client-general-settings

    4. Enable the Client authentication.

    5. In the Authentication flow, unselect the standard flow.

    6. Click the Save button.

      client-capability-config

  4. Create a new user as follows:

    1. Fill-in the username field (e.g. testuser).

    2. Click the Create button.

      user-create

    3. Click the Credentials tab.

    4. Click the Set password button.

    5. Fill-in the Password field.

    6. Fill-in the Password confirmation field.

    7. Turn-off temporary.

    8. Click the Save button.

      user-password

    9. Click the Save password button.

Using Postman for Testing

  1. Create a post request to the following address format:

    http://localhost:8080/realms/<TARGET_REALM>/protocol/openid-connect/token

    Example

    Using the jwtrealm as the TARGET_REALM (i.e. configured in the previous section).

    http://localhost:8080/realms/jwtrealm/protocol/openid-connect/token

  2. Click the Body tab.

  3. Select x-www-form-url-encoded.

  4. Add the following entries:

    Key Value Comment
    client_id jwtclient This is the client configured earlier.
    grant_type password This is for direct access grant type.
    client_secret <Client secret> This can be found in the jwtclient (i.e. configured earlier) client credentials tab.

    client-secret

    scope openid The openid scope is required; to indicate that the application intends to use OIDC to verify the user's identity.
    username testuser This is the user configured earlier.
    password <password> This is the password for the user that is configured earlier.
  5. Click the Send button.

    postman-request

Success Output

The success output is in the following format.

{
    "access_token": "The access token.",
    "expires_in": "Access token expiration.",
    "refresh_expires_in": "Refresh token expiration",
    "refresh_token": "The refresh token.",
    "token_type": "Bearer",
    "id_token": "The ID token.",
    "not-before-policy": 0,
    "session_state": "The session state.",
    "scope": "openid profile email"
}

You paste the encoded token to the following website to decode its content:

https://jwt.io/

Invalid Credential Output

{
    "error": "invalid_grant",
    "error_description": "Invalid user credentials"
}

Related Post
THE RESOURCE OWNER PASSWORD CREDENTIAL (ROPC) GRANT TYPE

Windows Shutdown and Restart Event IDs

The event IDs that can be searched in windows event viewer (i.e. Windows Logs -> System) for the confirmation of shutdown or restart.

Event ID Name Description
14 The system has rebooted without cleanly shutting down first This event indicates that some unexpected activity prevented Windows from shutting down correctly. Such a shutdown might be caused by an interruption in the power supply or by a Stop error. If feasible, Windows records any error codes as it shuts down.
1074 System has been shutdown by a process/user. This event is written when an application causes the system to restart, or when the user initiates a restart or shutdown by clicking Start or pressing CTRL+ALT+DELETE, and then clicking Shut Down.
6006 The event log service was stopped. The event is logged at boot time noting that the Event Log service was stopped.
6008 Unexpected system shutdown The previous system shutdown at Time on
Date was unexpected.