Skip to content

GlassFish doesn't start on Windows if running scripts is disabled #25429

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
OndroMih opened this issue Mar 26, 2025 · 6 comments · May be fixed by #25454
Open

GlassFish doesn't start on Windows if running scripts is disabled #25429

OndroMih opened this issue Mar 26, 2025 · 6 comments · May be fixed by #25454
Assignees
Labels
bug Something isn't working
Milestone

Comments

@OndroMih
Copy link
Contributor

OndroMih commented Mar 26, 2025

GlassFish version: 7.0.23
OS: Windows (any supported version)

When executing powershell scripts is disabled on Windows, execution of asadmin start-domain will give the following error:

[INFO] Resolved container artifact org.codehaus.cargo:cargo-core-container-glassfish:jar:1.10.15 for container glassfish7x
[INFO] Parsed GlassFish version = [7.0.23]
[INFO] GlassFish 7.0.23 starting...
[INFO] Executing: powershell.exe -File "C:\GitHub\cargotracker\target\cargo\configurations\glassfish7x\cargo-domain\config\gfstart.ps1" -BatchFilePath "C:\GitHub\cargotracker\target\cargo\configurations\glassfish7x\cargo-domain\config\gfstart.bat"
[INFO] Please look at the server log for more details...
[INFO] Waiting for cargo-domain to start
[INFO] Waiting finished after 371 ms.
[INFO] Error starting domain cargo-domain.
[INFO] The server exited prematurely with exit code 1.
[INFO] Before it died, it produced the following output:
[INFO]
[INFO] File C:\GitHub\cargotracker\target\cargo\configurations\glassfish7x\cargo-domain\config\gfstart.ps1 cannot be loaded
[INFO] because running scripts is disabled on this system. For more information, see about_Execution_Policies at
[INFO] https:/go.microsoft.com/fwlink/?LinkID=135170.
[INFO]     + CategoryInfo          : SecurityError: (:) [], ParentContainsErrorRecordException
[INFO]     + FullyQualifiedErrorId : UnauthorizedAccess
[INFO]  Error starting domain cargo-domain.
[INFO] The server exited prematurely with exit code 1.
[INFO] Before it died, it produced the following output:
[INFO]
[INFO] File C:\GitHub\cargotracker\target\cargo\configurations\glassfish7x\cargo-domain\config\gfstart.ps1 cannot be loaded
[INFO] because running scripts is disabled on this system. For more information, see about_Execution_Policies at
[INFO] https:/go.microsoft.com/fwlink/?LinkID=135170.
[INFO]     + CategoryInfo          : SecurityError: (:) [], ParentContainsErrorRecordException
[INFO]     + FullyQualifiedErrorId : UnauthorizedAccess
[INFO]
[INFO] Command start-domain failed.

Thanks to @m-reza-rahman for reporting this.

@OndroMih
Copy link
Contributor Author

Since 7.0.23, the launcher will create a temporary powershell file to start server on Windows, see:

private static List<String> prepareWindowsEnvironment(final CommandLine command, final Path configDir,

Launcher should catch this error and attempt to start the server using the old way.

@dmatej
Copy link
Contributor

dmatej commented Mar 26, 2025

That will not work, just limited for playing, but not on production.

The command line on windows is limited in length, when you start an instance in cluster, Windows will kill it on logout, etc. I did not do this because I was bored ...

At least print warning then. There is a lot of complaints about the windows behavior.

Also you should not catch the error, you should detect system capabilities first instead, before you do something with the expectation that it works reliably.

@dmatej
Copy link
Contributor

dmatej commented Mar 26, 2025

The link gives some advices, we should reflect that somehow. Not sure what is possible, I doubt we can set execution policies from GF. Can we sign the script? I have doubts about this too. So perhaps we can extend the "capabilities" class I created and add something like isPowerShellAvailable, call the command to check and then

@OndroMih
Copy link
Contributor Author

I agree. Check first, and then decide whether to execute using script or the old way. If execution using script still wouldn't work, maybe all give a user an option to force it using an env var.

@dmatej
Copy link
Contributor

dmatej commented Mar 26, 2025

Yeah, could be also some configuration to enforce chosen way. Especially when we don't have control over all Windows versions, configurations, patches, etc.

@dmatej dmatej added this to the 7.0.24 milestone Apr 11, 2025
@dmatej dmatej added the bug Something isn't working label Apr 11, 2025
@dmatej dmatej self-assigned this Apr 11, 2025
@dmatej
Copy link
Contributor

dmatej commented Apr 16, 2025

It is more complicated - because the GFLauncher is used by remote commands, and after many tests using many configurations and commands I have found that it is quite clear:

  • SSH node instance MUST use PowerShell and windows task scheduler, the instance would be killed otherwise once the SSH session ends.
  • DAS can be configured using the env option. By default it should be set for production, so it should use PowerShell and task scheduler to prevent killing the instance after user logout. The env option can be explicitly set in asenv.bat to make it clear and easy.
  • Local node can respect the asenv configuration just as DAS.

Any alternative to PowerShell still needs special permissions.

However, when testing I have found yet few other issues, which should be fixed in #25454 now. Some caused very confusing errors (and just on Windows) like:

  • Permission Denied when I just executed java.exe instead of the bat file. Caused probably by incorrect path quotation.
  • asadmin command froze waiting for instance stop - which stopped.
  • asadmin command crashed when stopping the local instance - which stopped. ConnectException.
  • nonexisting nadmin when using ssh node with GlassFish path with spaces.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants