Java, same old problems!

[Sheridan]

Just when I thought we were going to see the back of java, we now have to redeploy it as part of one of the ICT courses requires them to insert a java applet into a html page.

 

Great - nothing like keeping the course up to date by using the most buggy, unfriendly, network unusable bit of kak in recent years!

 

Has anyone else managed to do this? With the current security overkill on java, you basically have to whitelist every page you want to allow java to run on, which would be a nightware trying to deploy to ict suites.

[jonnykewell1]

we still have java deployed but only the latest releases. Some of our programs require older java and older browsers as the latest browsers block the java applets. We have had to say sorry but we won't be deploying any older versions.

[Sheridan]

I was saying that but unfortuntely java seems to have become incorporated into one subjects coursework! Why don't they ask them to use Internet Explorer 6.0 as well!

[Arthur]

Has anyone else managed to do this?

I have. I can post details a bit later if required?

[robjduk]

I keep it upto date however my top moment of the year came when a few teachers who were working as examiners came to me with the exam boards Java 6 requirement.....

[Gardinho]

@Arthur would be great to see how you tackled it.

[Arthur]

would be great to see how you tackled it.

I use the PowerShell App Deployment Toolkit to deploy the 32-bit and 64-bit JREs through SCCM since our PCs have both IE and Chrome.

 

This method seems more reliable since you can perform additional tasks like closing all web browsers before the MSIs are installed/uninstalled and automatically uninstall existing JREs regardless of what version they are.

 

My Deploy-Application.ps1 file is too long to post so I have attached it below, along with the deployment.properties/config and exception.sites files I use. The .ps1 includes plenty of comments so it should be pretty self-explanatory, but if you have any further questions just ask.

 

The MSIs should be copied into the relevant x86 and x64 folders within the Files folder. When it comes to deploying an updated version of the JRE, the only thing that should need changing within the .ps1 is the version number for $appVersion.

 

+---AppDeployToolkit
|                   AppDeployToolkitBanner.png
|                   AppDeployToolkitConfig.xml
|                   AppDeployToolkitExtensions.ps1
|                   AppDeployToolkitHelp.ps1
|                   AppDeployToolkitLogo.ico
|                   AppDeployToolkitMain.ps1
|
+---Files
|        +---[color="#FF0000"]x64[/color]
|        |      Data1.cab
|        |      [url="http://javadl.sun.com/webapps/download/AutoDL?BundleId=95125"]jre1.7.0_67.msi[/url]
|        |
|        \---[color="#FF0000"]x86[/color]
|               Data1.cab
|               [url="http://javadl.sun.com/webapps/download/AutoDL?BundleId=95123"]jre1.7.0_67.msi[/url]
|
+---SupportFiles
|               [color="#FF0000"]deployment.config[/color]
|               [color="#FF0000"]deployment.properties[/color]
|               [color="#FF0000"]exception.sites[/color]
|
| Deploy-Application.exe
\ [color="#FF0000"]Deploy-Application.ps1[/color]

 

Install/Uninstall Commands (for SCCM)

Deploy-Application.exe Install

Deploy-Application.exe Uninstall

PSAppDeployToolkit_JRE_1.7.0_67.7z

Edited September 15, 2014 by Arthur

[Sheridan]

Thanks @Arthur, I'll have a look at your method!

 

Personally I would glad to see the back of java, but needs must!

 

Has anyone use the sites exception list to whitelist a network folder or home user folder to allow them to run downloaded applets?

Edited September 15, 2014 by Sheridan

[Sheridan]

Is it just me, or is java just completely broken?

 

I've managed to get it to install on some test PCs, and the exception.sites lists the path the the users network folder, but even a basic applet fails to load in IE/Chrome with the error:

 

 

And thats an admin, on an admin's computer with full rights!

[Arthur]

Is it just me, or is java just completely broken?

I think we need to invent a new swear word to describe how awful Java is. The current ones in the dictionary aren't sufficient!

 

even a basic applet fails to load in IE/Chrome with the error

Could your proxy be preventing the Java applet from loading properly?

[Sheridan]

Its not even hitting the proxy, all local files!

[free780]

I think you have to get the deployment.config just right. I'll have a look at ours as it works.

[Sheridan]

I've got the msi installing ok - and part of the group policy copies a deployment.config to the c:\windows\sun\java\deployment folder. In that file there is the following lines:

 

deployment.system.config=file://\\serverpath\java\deployment.properties

deployment.system.config.mandatory=false

 

In the deployment.properties file on the server is the following:

 

deployment.user.security.exception.sites=\\serverpath\java\exception.sites

deployment.security.level=MEDIUM

 

And in the exception.sites file is a list of whitelisted sites:

 

javatester.org

 

Obviously we want to put more sites in but this is a test currently.

 

The deployment.config file is getting copied down to the clients, but it is still ignoring the whitelisted sites - so java is always blocked.

[Arthur]

I copy all three files to C:\Windows\Sun\Java\Deployment. Never had any problems doing it that way.

 

deployment.config

deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
deployment.system.config.mandatory=true

 

deployment.properties

deployment.user.security.exception.sites=C\:/WINDOWS/Sun/Java/Deployment/exception.sites
deployment.browser.vm.iexplorer.locked
deployment.browser.vm.iexplorer=true
deployment.browser.vm.mozilla.locked
deployment.browser.vm.mozilla=true
deployment.webjava.enabled=true
deployment.webjava.enabled.locked
deployment.expiration.check.enabled=false
deployment.expiration.decision.suppression=true
deployment.expiration.decision=NEVER
deployment.javaws.jre.0.args=
deployment.javaws.associations.locked
deployment.javaws.associations=NEVER
deployment.javaws.autodownload.locked
deployment.javaws.autodownload=NEVER
deployment.javaws.shortcut.locked
deployment.javaws.shortcut=NEVER
deployment.javaws.uninstall.shortcut.locked
deployment.javaws.uninstall.shortcut=false
deployment.security.level.locked
deployment.security.level=MEDIUM
# deployment.security.mixcode.locked
# deployment.security.mixcode=HIDE_RUN
deployment.security.validation.ocsp=false
# deployment.insecure.jres=ALWAYS
deployment.system.tray.icon.locked
deployment.system.tray.icon=false
install.disable.sponsor.offers.locked
install.disable.sponsor.offers=true
java.quick.starter.locked
java.quick.starter=false

# Proxy settings
deployment.proxy.type=1
deployment.proxy.bypass.list=*.domain.internal
deployment.proxy.bypass.local=true
deployment.proxy.http.host=192.168.0.5
deployment.proxy.http.port=8080
deployment.proxy.same=true
deployment.proxy.socks.host=
deployment.proxy.socks.port=
deployment.proxy.bypass.local.locked
deployment.proxy.http.host.locked
deployment.proxy.http.port.locked
deployment.proxy.same.locked
deployment.proxy.socks.host.locked
deployment.proxy.socks.port.locked
deployment.proxy.type.locked

 

exception.sites

wordle.net
wordle.appspot.com

[Sheridan]

I wonder if it doesn't like my UNC pathnames for the properties and exception files? I'll try changing the path to use double slashes etc.

[free780]

All our files are local by gpp.

This is deployment.config

deployment.system.config.mandatory=true

deployment.system.config=file\:c\:\\windows\\Sun\\Java\\Deployment\\deployment.properties

[Arthur]

I wonder if it doesn't like my UNC pathnames for the properties and exception files? I'll try changing the path to use double slashes etc.

According to Oracle, the path to the deployment.properties file should look like this (and use forward slashes instead of back slashes):

 

file:///C:/Windows/Sun/Java/Deployment/deployment.properties

 

Source: http://docs.oracle.com/javase/8/docs/technotes/guides/deploy/properties.html

[Sheridan]

Ahhh I thinking I'm getting somewhere now!

 

I've changed the path in the properties file to use file://\\\\serverpath\\java\\etc and this seems to have made a difference. Now the user gets their default security set to Medium which is what is specified.

 

Only thing is, the exceptions aren't appearing in the users sites list in the java control panel applet - is that because the security setting is set to Medium, or it can't read the exceptions.sites file for some reason?

 

As it is java is running on all websites, but with the prompt appearing - which is a big step forward!

[enjay]

Sorry to resurrect an old thread, but I've hit the same problem as @Sheridan (are you also doing the CiDA course?).

 

Were you able to configure your PCs such that students could run Java applets from their own websites, and if so how? Where are the students saving their HTML files?

 

Please, please help me to deliver this for our students!!

[Sheridan]

What I did in the end was get a msi of the latest java and deploy that with a GPO.

 

Also in that group policy I copied a deployment.config file to the c:\windows\sun\java\deployment folder of the relevant PCs. (I did this in a batch file which also created the folder as it won't necessarily exist)

 

In that config file is two lines:

 

deployment.system.config.mandatory=true

deployment.system.config=file://\\\\servername\\java\\deployment.properties

 

So the config tells Java to look at the above file on a server to read the deployment.properties file

 

The deployment.properties on the server file contains:

 

deployment.user.security.exception.sites=file://\\\\servername\\java\\exception.sites

deployment.security.level=MEDIUM

deployment.webjava.enabled=true

 

Now this file is pointing to a exception.sites file (also on the network server)

 

The exception.sites file contains:

 

http://ipaddress

http://servername

etc

 

So I would put localhost in here as well.

 

You can put all of these files on the local machine path, but I set this up on a server so I can centrally add exceptions. Its a complete carry on and one reason we avoid java at all costs unless absolutely essential.

[SHimmer45]

doing the same thing with GPP annoyingly the test machine appears to be ignoring the config files and recreating the Sun\java\deployment folder in the users app data folder.

going on the documentation from Sun if the file's are present in C:\windows\... it will ignore anything else?

 

Java is horrid for deployment at the moment, we use it mainly for ECDL testing and even ECDL are apparently looking into other testing platforms which dont use java.

Edited March 19, 2015 by SHimmer45

[enjay]

Do I really want to add localhost to the exception.sites list? Isn't that an enormous security hole??

 

Saving to a central server isn't an option for this, as it is exam work so students mustn't be able to see each other's sites.

[Sheridan]

Those files could all be saved in the same folder if you're not using a server.

 

I guess you will have to allow localhost if its for testing local web development?