Cathay Cargo Terminal · Cloud Modernisation

WebLogic 12.x → JBoss 8
Oracle → PostgreSQL · On-prem → AWS

End-to-end migration reference for Cathay Cargo Terminal (CCT) — application server modernisation, database replatforming, and AWS cloud landing zone for internal, external, and mobile cargo operations at Hong Kong International Airport.

WebLogic 12.x → JBoss EAP 8 Oracle → Aurora PostgreSQL On-prem → AWS ap-east-1 Azure Entra ID SSO SITA · ACCS · GLS · HKIA One Cathay Pacific interfaces
scroll ↓
Section 01

Programme Overview

A three-axis modernisation programme for Cathay Cargo Terminal — replatforming the Java application tier, migrating the Oracle data tier to PostgreSQL, and relocating workloads from on-premises data centres to AWS.

Scope summary: CCT operates mission-critical cargo terminal systems supporting import/export cargo handling, trucking, airline messaging, and regulatory compliance at HKIA. The current stack runs on Oracle WebLogic Server 12.x with Oracle Database hosted on-premises. The target state is JBoss EAP 8 (WildFly-based) on AWS with Amazon Aurora PostgreSQL, while preserving integrations with aviation industry platforms (SITA, ACCS, GLS, HKIA One Data Platform) and Cathay Pacific Airways corporate systems.

Three migration axes

Axis 1 — Application server

WebLogic 12.x → JBoss EAP 8

Repackage Java EE / Jakarta EE applications (WAR/EAR), remap JNDI and datasources, migrate JMS, and retarget deployment descriptors from WebLogic-specific to portable or JBoss-specific configuration.

Axis 2 — Database

Oracle → PostgreSQL

Schema conversion, PL/SQL to PL/pgSQL, sequence and identity migration, Oracle-specific SQL rewrite, and cutover with minimal downtime using CDC and dual-write strategies.

Axis 3 — Infrastructure

On-premises → AWS

Landing zone, VPC networking, compute (EC2/EKS), managed database (Aurora), load balancing, WAF, observability, and hybrid connectivity during transition.

Source → target map

On-prem
Oracle WebLogic 12.x
Clustered managed servers, Node Manager, JNDI, JMS queues, Work Managers
→
AWS
JBoss EAP 8
Standalone or domain mode on EC2/EKS. Undertow servlet container. Elytron security. Messaging via ActiveMQ Artemis.
On-prem
Oracle Database 11g/12c/19c
RAC or single-instance. PL/SQL packages, sequences, synonyms, materialised views, DB links to CPA systems
→
AWS
Amazon Aurora PostgreSQL
Multi-AZ, read replicas, automated backups, Performance Insights. pglogical or DMS for migration.
On-prem
Physical / VMware infrastructure
Data centre at HKIA vicinity. Firewalls, load balancers, internal DNS, file shares, batch schedulers
→
AWS
AWS ap-east-1 (Hong Kong)
VPC, ALB/NLB, Route 53, CloudFront, WAF, Secrets Manager, CloudWatch, Direct Connect / VPN hybrid
On-prem
AD FS / legacy SSO
Internal user authentication for terminal staff applications
→
Cloud IdP
Azure Entra ID (Entra ID)
SAML 2.0 / OIDC for internal web & mobile apps. Conditional Access, MFA, group-based RBAC.
Section 02

Application Portfolio

CCT operates multiple user-facing channels segmented by audience, network zone, and authentication model. Each channel maps to one or more deployable units on the application server tier.

🏢
Internal

CCT Internal Web Application

Terminal operations for CCT staff — cargo acceptance, build-up/break-down, ULD management, warehouse control, and supervisor dashboards. Authenticated via Azure Entra ID (corporate SSO).

📱
Internal

CCT Internal Mobile Application

Rugged-device and tablet apps for ramp, warehouse, and gate staff. Offline-capable where required. Entra ID via MSAL / OAuth 2.0 mobile flows. API backend on JBoss.

🌐
External — Internet

Agents & Freighters Portal

Public-facing web portal for freight forwarders and general sales agents (GSAs). Booking enquiries, status tracking, document upload. Internet zone with WAF, rate limiting, and separate security realm.

🚛
External — Mobile

Trucker Mobile Application

Driver-facing app for truck entry/exit, e-form submission, queue management, and cargo collection at CCT gates. Integrates with ACCS and terminal access control.

✈️
Airline

Airline Web Application

Dedicated portal for airline users — flight manifests, cargo allocations, special handling requests, and messaging. Role-based access per airline code (IATA).

⚙️
Backend

Integration & Batch Services

MDB listeners, scheduled EJB timers, file-drop processors, and REST/SOAP adapters for SITA, ACCS, GLS, HKIA One, and Cathay Pacific corporate interfaces. Runs as EAR modules on JBoss.

Network & security zones

Zone Applications Auth AWS placement
Corporate / Internal CCT Web, CCT Mobile (staff) Azure Entra ID (SAML/OIDC) Private subnets + ALB. AWS Client VPN or Direct Connect from CPA network
DMZ — Internet Agents & Freighters, Trucker Mobile API, Airline Portal Local accounts + MFA, API keys, airline SSO federation Public ALB + CloudFront + AWS WAF. Separate JBoss instances / namespaces
Integration SITA/ACCS/GLS adapters, CPA data feeds Mutual TLS, IP allowlists, message-level security Private subnets. NLB or VPC endpoints. No direct internet egress
Deployment recommendation: Segregate internal (Entra ID) and external (Internet-facing) workloads onto separate JBoss EAP clusters or EKS namespaces with distinct security domains. This mirrors the current WebLogic split between internal and DMZ managed servers and reduces blast radius for external-facing applications.
Section 03

External & Corporate Integrations

CCT sits at the centre of the HKIA cargo ecosystem. Migration must preserve message flows, SLAs, and regulatory data exchange with aviation industry platforms and Cathay Pacific Airways.

Integration landscape

SITA
Type B / MQ
↔
CCT JBoss
Integration tier
↔
ACCS
HK Customs
GLS
Logistics
↔
CCT JBoss
↔
HKIA One
Data Platform
Cathay Pacific
Corporate systems
↔
CCT JBoss
↔
Aurora PostgreSQL
SITA

SITA Messaging & Network Services

Industry-standard cargo messaging — FWB, FHL, FSU, FBL (cargo IMP messages). Typically via SITA MQ or Type B network. JBoss MDBs consume/produce messages. Migration impact: MQ connection factories move from WebLogic JMS foreign JMS to ActiveMQ Artemis or native IBM MQ client. IP whitelisting must be updated for AWS egress IPs or Direct Connect.

ACCS

Air Cargo Community System

Hong Kong Customs & Excise cargo clearance platform. Electronic cargo information submission, release notifications, and trucker gate pass validation. Migration impact: API endpoints and certificate-based authentication must be re-registered with ACCS for new AWS endpoints. Trucker mobile app is a primary consumer.

GLS

Global Logistics System

Logistics data exchange — shipment tracking, status updates, and inter-terminal messaging. Migration impact: Validate file-based vs API-based integration. SFTP drop zones may move to S3 with event-driven Lambda triggers replacing on-prem file watchers.

HKIA One Data Platform

HKIA Unified Data Platform

Airport Authority of Hong Kong (AAHK) data sharing platform for operational and analytics data. Migration impact: Re-establish data pipeline connectivity from AWS (API, SFTP, or Kafka). Confirm data residency and AA governance requirements for cloud-hosted sources.

Cathay Pacific Airways

Parent Company — Corporate Data Interfaces

Bi-directional data flows between CCT and Cathay Pacific corporate systems — flight schedules, cargo capacity, revenue accounting, HR/identity (Entra ID federation), and operational reporting. May include database links, REST APIs, ETL batch files, or enterprise service bus (ESB) messaging. Migration impact: Replace Oracle DB links with API-based integration or AWS PrivateLink / VPN to CPA network. Entra ID app registrations and SAML metadata must be updated for new JBoss callback URLs on AWS.

Integration cutover risk: External partners (SITA, Customs/ACCS, AAHK) require advance notice and parallel-run periods. Plan a connectivity freeze window per partner — do not migrate all interfaces in a single big-bang. Maintain on-prem integration endpoints as fallback during hypercare.
Section 04

WebLogic 12.x → JBoss EAP 8 Migration

JBoss EAP 8 is the supported enterprise distribution of WildFly, targeting Jakarta EE 10. Migration from WebLogic requires application assessment, descriptor changes, and infrastructure reconfiguration.

Key differences — WebLogic vs JBoss EAP 8

Area WebLogic 12.x JBoss EAP 8 Migration action
Deployment weblogic.xml, weblogic-application.xml jboss-web.xml, jboss-app.xml, jboss-deployment-structure.xml Remove WebLogic descriptors; add JBoss equivalents or use portable descriptors
DataSource JDBC stores in config.xml / console datasources subsystem in standalone.xml / CLI Export WL datasources; recreate in JBoss CLI. Update JNDI names (java:/ vs java:jboss/)
JMS WebLogic JMS Server / SAF ActiveMQ Artemis (embedded or remote) Remap queues/topics. Update @MessageDriven activation config. Test poison message handling
Security DefaultAuthenticator, embedded LDAP Elytron subsystem — SAML/OIDC/LDAP Configure Elytron OIDC client for Entra ID. Separate realms for internal vs external apps
Clustering Multicast / unicast clusters, replicated sessions Infinispan distributed cache, mod_cluster Evaluate session replication needs. Prefer stateless APIs + JWT where possible
Classloading prefer-application-packages in weblogic.xml jboss-deployment-structure.xml Resolve library conflicts (Hibernate, Jackson, Log4j versions)
Java version Java 8 (typical for WL 12.1.x) Java 17 / 21 (EAP 8 requirement) Code upgrade for removed APIs (javax → jakarta namespace in EE 10)

Application migration steps

Step 01

Discovery & inventory

Catalog all EAR/WAR deployments, shared libraries, JNDI bindings, JMS destinations, EJB timers, and WebLogic-specific code (weblogic.* imports).

Step 02

Compatibility assessment

Run Red Hat Migration Toolkit for Applications (MTA/MTA) or Windup against each module. Flag javax → jakarta, deprecated EJB APIs, and Oracle JDBC calls.

Step 03

Refactor & retarget

Update persistence.xml for PostgreSQL dialect. Replace WebLogic JMS with Artemis. Externalise config to MicroProfile Config or environment variables for 12-factor AWS deployment.

Step 04

Deploy & validate on JBoss

Deploy to JBoss EAP 8 on AWS dev environment. Run smoke tests per application channel. Compare response times and memory footprint against WebLogic baseline.

Azure Entra ID integration on JBoss

Internal user authentication flow
User → CCT Web/Mobile Redirect to Entra ID (OIDC) Token returned to JBoss (Elytron OIDC) RBAC via Entra groups → JBoss roles Session / JWT to API tier
Entra ID checklist: Register new app(s) in Azure portal · Configure redirect URIs for AWS ALB hostnames · Map Entra security groups to JBoss roles via oidc-role-mapper · Enable Conditional Access (MFA) · Update mobile app MSAL config with new API base URL · Coordinate with Cathay Pacific IAM team for federation trust
Section 05

Oracle → PostgreSQL Migration

Replatforming from Oracle to Amazon Aurora PostgreSQL reduces licensing cost and aligns with open-source database operations on AWS. This is typically the highest-risk axis due to PL/SQL, data types, and performance characteristics.

Common Oracle → PostgreSQL conversion patterns

Oracle construct PostgreSQL equivalent Notes
VARCHAR2 / NVARCHAR2 VARCHAR / TEXT Remove length semantics differences. Watch empty string vs NULL behaviour
NUMBER NUMERIC / INTEGER / BIGINT Choose appropriate precision per column
DATE / TIMESTAMP TIMESTAMP / TIMESTAMPTZ Oracle DATE includes time; PostgreSQL DATE does not. Use TIMESTAMPTZ for audit columns
SEQUENCE + trigger GENERATED ALWAYS AS IDENTITY or SERIAL Prefer identity columns in PG 15+. Migrate sequence current values
PL/SQL packages / procedures PL/pgSQL functions / procedures Manual rewrite required. Use AWS SCT or ora2pg for initial conversion, then refine
DECODE / NVL / SYSDATE CASE / COALESCE / NOW() Search-replace in application SQL and stored procedures
ROWNUM / CONNECT BY LIMIT / WITH RECURSIVE Hierarchical queries need rewrite. ROWNUM pagination → LIMIT/OFFSET or keyset
DBMS_LOB / BLOB BYTEA / Large Objects Consider S3 for document storage instead of DB blobs
Materialised views Materialised views (PG 12+) Refresh strategies differ. Validate CONCURRENTLY refresh
DB links to CPA Oracle postgres_fdw / API integration Avoid cross-DB links in cloud. Replace with REST/ETL to CPA systems

Migration tooling & approach

Schema

AWS Schema Conversion Tool (SCT)

Automated DDL conversion from Oracle to PostgreSQL. Generates assessment report showing unsupported objects. Use as starting point — expect 60–80% automation for typical cargo schemas.

Data

AWS Database Migration Service (DMS)

Full load + CDC replication from Oracle to Aurora PostgreSQL. Keeps target in sync during parallel-run. Monitor lag and table-level validation.

Validation

Data reconciliation

Row counts, checksums, and business-rule validation per table. Focus on cargo manifest, ULD, and customs declaration tables first.

Database cutover strategies

Recommended — Parallel run

Dual-write with DMS CDC

JBoss apps on AWS write to Aurora PostgreSQL. DMS replicates back to Oracle (or vice versa) during transition. Compare outputs for 2–4 weeks. Lowest risk for 24/7 cargo operations.

Alternative — Big bang

Maintenance window cutover

Stop writes, final DMS sync, switch JBoss datasource to PostgreSQL, resume. Requires extended maintenance window (typically weekend). Higher risk — only if cargo volumes allow.

Oracle-specific risks for CCT: Heavy use of PL/SQL business logic in stored procedures (cargo validation rules, customs calculations) · Oracle AQ or advanced queuing tied to JMS · Partitioned tables for historical cargo records · Fine-grained audit (FGA) triggers. Budget significant effort for stored procedure rewrite and performance testing on PostgreSQL.
Section 06

On-premises → AWS Cloud Architecture

Target landing zone in AWS Asia Pacific (Hong Kong) region — ap-east-1 — with hybrid connectivity to on-premises and partner networks during migration.

Target AWS architecture — layered

Users & clients
CCT staff (Entra ID) Freight agents (Internet) Truckers (mobile) Airline users Cathay Pacific corporate network
↓
Edge & security
Route 53 CloudFront (static/mobile assets) AWS WAF AWS Shield ACM (TLS certificates)
↓
Load balancing & compute
ALB — internal apps ALB — external DMZ apps EC2 Auto Scaling — JBoss EAP 8 EKS (optional) — containerised microservices
↓
Data & messaging
Aurora PostgreSQL (Multi-AZ) ElastiCache Redis (session cache) Amazon MQ (ActiveMQ) — SITA bridge S3 — document / file drops Secrets Manager — DB credentials, API keys
↓
Connectivity & observability
Direct Connect / Site-to-Site VPN Transit Gateway CloudWatch + X-Ray AWS CloudTrail GuardDuty + Security Hub

AWS service mapping from on-prem

On-prem
Hardware load balancer (F5 / Citrix)
SSL termination, traffic routing to WebLogic cluster
→
AWS
Application Load Balancer (ALB)
Path-based routing to internal vs external JBoss target groups. ACM-managed certificates.
On-prem
VMware / bare-metal servers
WebLogic managed servers, 4–8 vCPU, 16–32 GB RAM per node
→
AWS
EC2 (m6i.xlarge / m6i.2xlarge)
Auto Scaling Group across 2+ AZs. Golden AMI with JBoss EAP 8 + CloudWatch agent.
On-prem
Oracle RAC / single instance
SAN storage, RMAN backup, Data Guard standby
→
AWS
Aurora PostgreSQL
Automated backups (35-day retention), cross-region replica, Performance Insights, zero-downtime patching.
On-prem
IBM MQ / WebLogic JMS
SITA message queues, internal async processing
→
AWS
Amazon MQ (ActiveMQ) or self-hosted Artemis
Managed messaging with bridge to SITA network via VPN. Alternatively, embed Artemis in JBoss.
Hybrid period: During migration, maintain AWS Site-to-Site VPN or Direct Connect to on-premises and Cathay Pacific corporate network. JBoss on AWS can reach on-prem Oracle (via DMS) and on-prem MQ endpoints while integrations are progressively cut over. Decommission on-prem only after all partner interfaces are validated on AWS endpoints.
Section 07

Migration Phases & Timeline

A phased approach de-risks the three-axis migration. Recommended sequence: AWS landing zone first, then database migration, then application server cutover per channel.

Phase 0 — Foundation (8–12 weeks)

AWS landing zone & governance

  • AWS Organisation, accounts (dev/uat/prod)
  • VPC, subnets, security groups, NACLs
  • Direct Connect / VPN to on-prem & CPA
  • IAM roles, Secrets Manager, CloudTrail
  • CI/CD pipeline (CodePipeline / Jenkins)
  • Entra ID app registration for AWS URLs
Phase 1 — Assess (6–8 weeks)

Discovery & planning

  • Inventory all WebLogic deployments & configs
  • Oracle schema assessment (SCT report)
  • Integration dependency mapping (SITA, ACCS, GLS, HKIA One, CPA)
  • Non-functional requirements (RTO/RPO, peak TPS)
  • Migration wave plan per application channel
Phase 2 — Build (12–16 weeks)

Target environment & conversion

  • JBoss EAP 8 on EC2 — dev/UAT clusters
  • Aurora PostgreSQL — schema conversion & deploy
  • Application refactor (javax→jakarta, PG SQL)
  • DMS CDC setup Oracle → Aurora
  • Entra ID SSO integration on JBoss
Phase 3 — Test (8–10 weeks)

SIT, UAT & performance

  • Functional regression per application
  • Integration testing with SITA/ACCS sandboxes
  • Load testing — peak cargo handling scenarios
  • Security penetration test (external apps)
  • DR failover test (Aurora cross-region)
Phase 4 — Migrate waves (12–20 weeks)

Progressive cutover

  • Wave 1: Integration/batch services (lowest user impact)
  • Wave 2: Airline web portal
  • Wave 3: Agents & Freighters + Trucker mobile
  • Wave 4: Internal web & mobile (Entra ID)
  • Parallel-run & hypercare per wave
Phase 5 — Decommission (4–6 weeks)

On-prem retirement

  • Oracle license termination
  • WebLogic cluster shutdown
  • On-prem hardware decommission
  • Archive audit logs to S3 Glacier
  • Post-implementation review & handover
Indicative total duration: 12–18 months for a programme of this complexity, assuming a dedicated migration team of 8–12 engineers (app, DBA, infra, integration, QA) and active stakeholder engagement from Cathay Pacific IAM, SITA, and AAHK integration teams.
Section 08

Cutover, Risks & Testing Checklist

Cargo terminal systems operate 24/7. Cutover planning must account for peak import/export windows, flight schedules, and regulatory reporting deadlines.

Top risks & mitigations

Risk Impact Likelihood Mitigation
PL/SQL conversion gaps Data corruption, incorrect cargo calculations ▲ Medium Parallel-run with reconciliation. Dedicated DBA review of all stored procedures.
SITA/ACCS connectivity break Customs clearance delays, flight disruptions ▲ Medium Pre-register AWS endpoints. Maintain on-prem fallback. Partner-approved cutover windows.
Entra ID SSO misconfiguration Internal staff locked out of terminal systems ▲ Medium Test with pilot user group. Keep break-glass local admin accounts. Coordinate with CPA IAM.
Performance regression on PostgreSQL Slow gate processing, trucker queue backlog ▲ Medium Load test at 150% peak. Tune indexes, query plans. Aurora read replicas for reporting.
javax → jakarta breaking changes Application deployment failures on JBoss 8 ● High MTA/Windup scan early. Upgrade libraries. Consider intermediate step on JBoss EAP 7 (EE 8) if needed.
Data residency / compliance Regulatory non-compliance for HK cargo data ✕ Low Keep all data in ap-east-1. No cross-border replication without legal review. Encrypt at rest (KMS).

Pre-cutover testing checklist

Design rationale — frequently asked questions

Why migrate from WebLogic to JBoss EAP 8?
WebLogic licensing costs, end-of-support considerations, and alignment with open-source Java EE standards. JBoss EAP 8 provides enterprise support via Red Hat, runs on Java 17/21, supports Jakarta EE 10, and deploys natively on AWS without vendor lock-in to Oracle infrastructure.
Why PostgreSQL over Oracle on AWS?
Eliminates Oracle licensing in the cloud (CPU-based licensing is expensive on AWS). Aurora PostgreSQL is fully managed, supports Multi-AZ HA, and integrates with AWS DMS for migration. Open-source ecosystem reduces long-term TCO for CCT.
How do you handle 24/7 cargo operations during cutover?
Progressive wave migration with parallel-run periods. DMS CDC keeps Oracle and PostgreSQL in sync. Each wave has a rehearsed rollback plan. Integration partners get advance notice. Cutover windows align with lowest cargo volume periods (typically mid-week nights).
How does Azure Entra ID work with apps hosted on AWS?
Entra ID is cloud-agnostic for OIDC/SAML federation. JBoss Elytron OIDC client authenticates users against Entra ID regardless of where JBoss is hosted. Redirect URIs point to AWS ALB hostnames. Token validation uses Entra's JWKS endpoint over HTTPS.
What is the hardest part of this migration?
Typically the Oracle → PostgreSQL stored procedure conversion combined with preserving real-time SITA/ACCS integration SLAs. Application server migration (WebLogic → JBoss) is well-understood with tooling (MTA/Windup), but database and integration cutover require the most planning and testing for a cargo terminal environment.