Mojo

Kids Videos with Time Control

2021-02-15T14:01:00.001-08:00

Terms & Conditions Terms & Conditions

By downloading or using the app, these terms will automatically apply to you – you should make sure therefore that you read them carefully before using the app. You’re not allowed to copy, or modify the app, any part of the app, or our trademarks in any way. You’re not allowed to attempt to extract the source code of the app, and you also shouldn’t try to translate the app into other languages, or make derivative versions. The app itself, and all the trade marks, copyright, database rights and other intellectual property rights related to it, still belong to Mojo Kith.

Mojo Kith is committed to ensuring that the app is as useful and efficient as possible. For that reason, we reserve the right to make changes to the app or to charge for its services, at any time and for any reason. We will never charge you for the app or its services without making it very clear to you exactly what you’re paying for.

The Kids Videos with Time Control app stores and processes personal data that you have provided to us, in order to provide my Service. It’s your responsibility to keep your phone and access to the app secure. We therefore recommend that you do not jailbreak or root your phone, which is the process of removing software restrictions and limitations imposed by the official operating system of your device. It could make your phone vulnerable to malware/viruses/malicious programs, compromise your phone’s security features and it could mean that the Kids Videos with Time Control app won’t work properly or at all.

The app does use third party services that declare their own Terms and Conditions.

Link to Terms and Conditions of third party service providers used by the app

You should be aware that there are certain things that Mojo Kith will not take responsibility for. Certain functions of the app will require the app to have an active internet connection. The connection can be Wi-Fi, or provided by your mobile network provider, but Mojo Kith cannot take responsibility for the app not working at full functionality if you don’t have access to Wi-Fi, and you don’t have any of your data allowance left.

If you’re using the app outside of an area with Wi-Fi, you should remember that your terms of the agreement with your mobile network provider will still apply. As a result, you may be charged by your mobile provider for the cost of data for the duration of the connection while accessing the app, or other third party charges. In using the app, you’re accepting responsibility for any such charges, including roaming data charges if you use the app outside of your home territory (i.e. region or country) without turning off data roaming. If you are not the bill payer for the device on which you’re using the app, please be aware that we assume that you have received permission from the bill payer for using the app.

Along the same lines, Mojo Kith cannot always take responsibility for the way you use the app i.e. You need to make sure that your device stays charged – if it runs out of battery and you can’t turn it on to avail the Service, Mojo Kith cannot accept responsibility.

With respect to Mojo Kith’s responsibility for your use of the app, when you’re using the app, it’s important to bear in mind that although we endeavour to ensure that it is updated and correct at all times, we do rely on third parties to provide information to us so that we can make it available to you. Mojo Kith accepts no liability for any loss, direct or indirect, you experience as a result of relying wholly on this functionality of the app.

At some point, we may wish to update the app. The app is currently available on Android – the requirements for system(and for any additional systems we decide to extend the availability of the app to) may change, and you’ll need to download the updates if you want to keep using the app. Mojo Kith does not promise that it will always update the app so that it is relevant to you and/or works with the Android version that you have installed on your device. However, you promise to always accept updates to the application when offered to you, We may also wish to stop providing the app, and may terminate use of it at any time without giving notice of termination to you. Unless we tell you otherwise, upon any termination, (a) the rights and licenses granted to you in these terms will end; (b) you must stop using the app, and (if needed) delete it from your device.

Changes to This Terms and Conditions

I may update our Terms and Conditions from time to time. Thus, you are advised to review this page periodically for any changes. I will notify you of any changes by posting the new Terms and Conditions on this page.

These terms and conditions are effective as of 2021-02-15

Contact Us

If you have any questions or suggestions about my Terms and Conditions, do not hesitate to contact me at mojo.kith@gmail.com.

This Terms and Conditions page was generated by App Privacy Policy Generator

Kids Videos with Time Control

2018-01-05T12:45:00.008-08:00

Mojo Kith built the Kids Videos with Time Control app as a Free app. This SERVICE is provided by Mojo Kith at no cost and is intended for use as is.

This page is used to inform visitors regarding my policies with the collection, use, and disclosure of Personal Information if anyone decided to use my Service.

If you choose to use my Service, then you agree to the collection and use of information in relation to this policy. The Personal Information that I collect is used for providing and improving the Service. I will not use or share your information with anyone except as described in this Privacy Policy.

The terms used in this Privacy Policy have the same meanings as in our Terms and Conditions, which is accessible at Kids Videos with Time Control unless otherwise defined in this Privacy Policy.

Information Collection and Use

For a better experience, while using our Service, I may require you to provide us with certain personally identifiable information. The information that I request will be retained on your device and is not collected by me in any way.

The app does use third party services that may collect information used to identify you.

Link to privacy policy of third party service providers used by the app

Log Data

I want to inform you that whenever you use my Service, in a case of an error in the app I collect data and information (through third party products) on your phone called Log Data. This Log Data may include information such as your device Internet Protocol (“IP”) address, device name, operating system version, the configuration of the app when utilizing my Service, the time and date of your use of the Service, and other statistics.

Cookies

Cookies are files with a small amount of data that are commonly used as anonymous unique identifiers. These are sent to your browser from the websites that you visit and are stored on your device's internal memory.

This Service does not use these “cookies” explicitly. However, the app may use third party code and libraries that use “cookies” to collect information and improve their services. You have the option to either accept or refuse these cookies and know when a cookie is being sent to your device. If you choose to refuse our cookies, you may not be able to use some portions of this Service.

Service Providers

I may employ third-party companies and individuals due to the following reasons:

To facilitate our Service;
To provide the Service on our behalf;
To perform Service-related services; or
To assist us in analyzing how our Service is used.

I want to inform users of this Service that these third parties have access to your Personal Information. The reason is to perform the tasks assigned to them on our behalf. However, they are obligated not to disclose or use the information for any other purpose.

Security

I value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. But remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and I cannot guarantee its absolute security.

Links to Other Sites

This Service may contain links to other sites. If you click on a third-party link, you will be directed to that site. Note that these external sites are not operated by me. Therefore, I strongly advise you to review the Privacy Policy of these websites. I have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

Children’s Privacy

These Services do not address anyone under the age of 13. I do not knowingly collect personally identifiable information from children under 13 years of age. In the case I discover that a child under 13 has provided me with personal information, I immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact me so that I will be able to do necessary actions.

Changes to This Privacy Policy

I may update our Privacy Policy from time to time. Thus, you are advised to review this page periodically for any changes. I will notify you of any changes by posting the new Privacy Policy on this page.

This policy is effective as of 2021-02-15

Contact Us

If you have any questions or suggestions about my Privacy Policy, do not hesitate to contact me at mojo.kith@gmail.com.

This privacy policy page was created at privacypolicytemplate.net and modified/generated by App Privacy Policy Generator

Privacy Policy

2018-01-05T12:42:00.001-08:00

OpenId Connect Quick Start

2017-03-02T13:59:00.002-08:00

Quick review of OAuth 2

OAuth 2 is a protocol for authorization provider.
Authorization provider means it grants access control for resources (RestFul APIs for example).
OAuth 2 Provider is consisted with 2 components. Authorization Server and Resource Server. Resource Server can be local or remote.
The resources within the Resource Server are protected by scopes. Scopes is like the catalogs within a supermarket. When you obtain an access_token, it bears the scopes that are granted. You can use your access_token for only those granted scopes and also within the expiry times. You have option to use refresh_token to renew the access_token. The refresh_token is optionally issued together with access_token.
Client Application as the holder of access_token. Client Application doesn't have to manage the Resource Owner's credential, but still have safe way to access resources on behalf of the Resource Owner. The following diagram depicts the relationship between each roles.

The typical flow will be:
User tries to use Client Application, and Client Application needs to access some personal information from Resource Server to achieve personalized user experience.
The Client Application then send request to Authorization Server to obtain an access_token in order to access resources on behalf of Resource Owner.
The Authorization Server then challenges the user's credential and also optionally ask for user to grant for the scopes required to the Client Application, at the end the Client Application obtains the access_token.
Then Client Application uses the access_token to access the protected resources on behalf of Resource Owner.

How to request an access_token from Authorization Server?

The REST-like authorization endpoint is for requesting access_token, but it could be two steps of getting access_token. When the authorization endpoint triggers two steps flow, the token endpoint is for finally getting the access_token.

Authorization endpoint

This is always the start point for whoever needs to acquire an access_token. Depends on the parameters sent with the endpoint, if it is two steps flow, then the following request to token endpoint will be necessary.
URL: /authorize. It depends on implementation.
Required Parameters:
response_type: It can be "code" or "token", or registered extension value. "code" will triggers a two-steps flow to obtain access_token. "token" means to return access_token in one step.
redirect_uri: the Client Application's absolute uri after authorization flow is finished, the user agent will be used to redirect to.

Token endpoint

The token endpoint is used by the client to obtain an access token by presenting its authorization grant or refresh token.
URL: /token. It depends on implementation.
Required Parameters:
grant_type: It tells how the Authorization Server should trust the request in order to issue access_token.
refresh_token: If the grant_type is refereh_token, then you need to provide refresh token.
redirect_uri: This has to be identical with the one sent from authorization endpoint.

What OAuth 2 provider is not?

OAuth 2 Provider is not authenticating user for the Client Application (only authenticate user for its own). Client Application has to use its own machoism to authenticate user if needed and manage the authenticated session. Resource Owner can be anonymous to the Client Application. For example, the Client Application has only age requirement, so instead to ask user to provide age, the Client Application can request user to grant access to Facebook to verify the age from the Facebook, then user can freely use application. This Application doesn't require identify from user and no need for an authenticated session either.

Reference reading: An introduction to OAuth2

OpenId Connect is an Authentication Layer on top of OAuth 2 for Client Applications

OpenID Connect is a simple identity layer on top of the OAuth 2.0 protocol, which allows computing clients to verify the identity of an end-user based on the authentication performed by an authorization server, as well as to obtain basic profile information about the end-user in an interoperable and REST-like manner.
OIDC uses OAuth 2 extension to define a scope called "openid".
OIDC defines an extension for response_type called "id_token" in addition to default "code" and "token".
The ID Token is a security token that contains Claims about the Authentication of an End-User by an Authorization Server when using a Client. ID Token can potentially contains other requested Claims as well. ID Token is usually returned together with access_token from Authorization Server.
OIDC defines another endpoint "user_info" endpoint, this endpoint is protected by "openid" scope. This is the endpoint on OIDC Provider to return Claims of End-User.

Response type in Authorization endpoint

Response_type indicates what will be returned from authorization endpoint. There're 3 options: "code", "token", and "id_token" with any combination.
Code. This triggers two steps flow to obtain access_token. Code first, then use code to exchange token from token endpoint.
Token.
So total combinations will be 3 + 3 + 1 = 7.
You want to use OIDC for either authorization only or authorization and authentication.
For authorization only, your goal is to get an access_token.
For authentication only, you goal is to get an id_token.
For authorization and authentication, your goal is to get access_token and id_token.
Based on what goal you want to achieve and what response_type you are requesting, it will end up different process flow. Mainly:
If the response_type is "code" only, it will trigger "authorization code" flow.
If the response_type has no "code", it will trigger "implicit" flow.
If the response_type has "code" and anything else as combination, it will trigger "hybrid" flow.

Grant Types in Token endpoint

The OAuth 2 specification describes five grants for acquiring an access token:
Grant type Description
Request Parameters
(To token endpoint)
Response Values
Link to Specification
Authorization code grant
This is used in authorization code flow. A back channel /token endpoint request.
`NOTE: to authorization endpoint`
`response_type=code`
`client_id=lient identifier>`
`redirect_uri` with the client redirect URI. This parameter is optional, but if not send the user will be redirected to a pre-registered redirect URI.
`scope` a space delimited list of scopes
`state` with a CSRF token. This parameter is optional but highly recommended. You should store the value of the CSRF token in the user’s session to be validated when they return.
`code` with the authorization code
`state` with the state parameter sent in the original request. You should compare this value with the value stored in the user’s session to ensure the authorization code obtained is in response to requests made by this client rather than another client application.
(section 4.1)

`Then to token endpoint`
`grant_type=authorization_code. The code from previous step`
`client_id=<`client identifier>
client_secret=
`token_type` with the value `Bearer`
`expires_in` with an integer representing the TTL of the access token
`access_token` the access token itself
`refresh_token` a refresh token that can be used to acquire a new access token when the original expires
Implicit grant This is used in implicit flow. There's no token end point is allowed to access.
`NOTE: to authorization endpoint`
`response_type` with the value `token`
`client_id` with the client identifier
`redirect_uri` with the client redirect URI. This parameter is optional, but if not sent the user will be redirected to a pre-registered redirect URI.
`scope` a space delimited list of scopes
`state` with a CSRF token. This parameter is optional but highly recommended. You should store the value of the CSRF token in the user’s session to be validated when they return.
`token_type` with the value `Bearer`
`expires_in` with an integer representing the TTL of the access token
`access_token` the access token itself
`state` with the state parameter sent in the original request. You should compare this value with the value stored in the user’s session to ensure the authorization code obtained is in response to requests made by this client rather than another client application.
(section 4.2)
Resource owner credentials grant
This grant is a great user experience for trusted first party clients both on the web and in native device applications.
`grant_type` with the value `password`
`client_id` with the the client’s ID
`client_secret` with the client’s secret
`scope` with a space-delimited list of requested scope permissions.
`username` with the user’s username
`password` with the user’s password
`token_type` with the value `Bearer`
`expires_in` with an integer representing the TTL of the access token
`access_token` the access token itself
`refresh_token` a refresh token that can be used to acquire a new access token when the original expires
(section 4.3)
Client credentials grant
The simplest of all of the OAuth 2.0 grants, this grant is suitable for machine-to-machine authentication where a specific user’s permission to access data is not required.
`grant_type` with the value `client_credentials`
`client_id` with the the client’s ID
`client_secret` with the client’s secret
`scope` with a space-delimited list of requested scope permissions.
`token_type` with the value `Bearer`
`expires_in` with an integer representing the TTL of the access token
`access_token` the access token itself
(section 4.4)
Refresh token grant This grant is used to refresh the access_token with refresh_token
`grant_type` with the value `refresh_token`
`refresh_token` with the refresh token
`client_id` with the the client’s ID
`client_secret` with the client’s secret
`scope` with a space-delimited list of requested scope permissions. This is optional; if not sent the original scopes will be used, otherwise you can request a reduced set of scopes.
`token_type` with the value `Bearer`
`expires_in` with an integer representing the TTL of the access token
`access_token` the access token itself
`refresh_token` a refresh token that can be used to acquire a new access token when the original expires
(section 1.5)

Grant type	Description	Request Parameters (To token endpoint)	Response Values	Link to Specification
Authorization code grant	This is used in authorization code flow. A back channel /token endpoint request.	`NOTE: to authorization endpoint` `response_type=code` `client_id=lient identifier>` `redirect_uri` with the client redirect URI. This parameter is optional, but if not send the user will be redirected to a pre-registered redirect URI. `scope` a space delimited list of scopes `state` with a CSRF token. This parameter is optional but highly recommended. You should store the value of the CSRF token in the user’s session to be validated when they return.	`code` with the authorization code `state` with the state parameter sent in the original request. You should compare this value with the value stored in the user’s session to ensure the authorization code obtained is in response to requests made by this client rather than another client application.	(section 4.1)
`Then to token endpoint` `grant_type=authorization_code. The code from previous step` `client_id=<`client identifier> client_secret=	`token_type` with the value `Bearer` `expires_in` with an integer representing the TTL of the access token `access_token` the access token itself `refresh_token` a refresh token that can be used to acquire a new access token when the original expires
Implicit grant	This is used in implicit flow. There's no token end point is allowed to access.	`NOTE: to authorization endpoint` `response_type` with the value `token` `client_id` with the client identifier `redirect_uri` with the client redirect URI. This parameter is optional, but if not sent the user will be redirected to a pre-registered redirect URI. `scope` a space delimited list of scopes `state` with a CSRF token. This parameter is optional but highly recommended. You should store the value of the CSRF token in the user’s session to be validated when they return.	`token_type` with the value `Bearer` `expires_in` with an integer representing the TTL of the access token `access_token` the access token itself `state` with the state parameter sent in the original request. You should compare this value with the value stored in the user’s session to ensure the authorization code obtained is in response to requests made by this client rather than another client application.	(section 4.2)
Resource owner credentials grant	This grant is a great user experience for trusted first party clients both on the web and in native device applications.	`grant_type` with the value `password` `client_id` with the the client’s ID `client_secret` with the client’s secret `scope` with a space-delimited list of requested scope permissions. `username` with the user’s username `password` with the user’s password	`token_type` with the value `Bearer` `expires_in` with an integer representing the TTL of the access token `access_token` the access token itself `refresh_token` a refresh token that can be used to acquire a new access token when the original expires	(section 4.3)
Client credentials grant	The simplest of all of the OAuth 2.0 grants, this grant is suitable for machine-to-machine authentication where a specific user’s permission to access data is not required.	`grant_type` with the value `client_credentials` `client_id` with the the client’s ID `client_secret` with the client’s secret `scope` with a space-delimited list of requested scope permissions.	`token_type` with the value `Bearer` `expires_in` with an integer representing the TTL of the access token `access_token` the access token itself	(section 4.4)
Refresh token grant	This grant is used to refresh the access_token with refresh_token	`grant_type` with the value `refresh_token` `refresh_token` with the refresh token `client_id` with the the client’s ID `client_secret` with the client’s secret `scope` with a space-delimited list of requested scope permissions. This is optional; if not sent the original scopes will be used, otherwise you can request a reduced set of scopes.	`token_type` with the value `Bearer` `expires_in` with an integer representing the TTL of the access token `access_token` the access token itself `refresh_token` a refresh token that can be used to acquire a new access token when the original expires	(section 1.5)

3 Authentication Flows

Different response_type presented within authorization endpoint determines different authentication flow.

Comparison of 3 different Authentication Flow

Authentication Flow
response_type
grant_type
Description
Typical Scenario
Authorization Code Flow
code
authorization_code
All tokens returned from Token Endpoint
Tokens not revealed to User Agent
Web application with backend support.
Implicit Flow
id_token
id_token token
implicit
implicit
All tokens returned from Authorization Endpoint
Client can not be authenticated
Refresh Token is not possible
Communication in one round trip
Implicit grant type is actually there's no access token request
Native mobile application. It doesn't require user authentication, and also it doesn't need to refresh the access token.
Hybrid Flow
code id_token
code token
code id_token token
authorization_code, implicit
authorization_code, implicit
authorization_code, implicit

Authentication Flow	response_type	grant_type	Description	Typical Scenario
Authorization Code Flow	code	authorization_code	All tokens returned from Token Endpoint Tokens not revealed to User Agent	Web application with backend support.
Implicit Flow	id_token id_token token	implicit implicit	All tokens returned from Authorization Endpoint Client can not be authenticated Refresh Token is not possible Communication in one round trip Implicit grant type is actually there's no access token request	Native mobile application. It doesn't require user authentication, and also it doesn't need to refresh the access token.
Hybrid Flow	code id_token code token code id_token token	authorization_code, implicit authorization_code, implicit authorization_code, implicit

Authorization Code Flow

Implicit Flow

(As reference only, it can be very different based on different combination of response_type)

Hybrid Flow

(As reference only, it can be very different based on different combination of response_type)

ID Token

The ID token resembles the concept of an identity card, in a standard JWT format, signed by the OpenID Provider (OP). To obtain one the client needs to send the user to their OP with an authentication request.
Features of the ID token:
Asserts the identity of the user, called subject in OpenID (sub).
Specifies the issuing authority (iss).
Is generated for a particular audience, i.e. client (aud).
May contain a nonce (nonce).
May specify when (auth_time) and how, in terms of strength (acr), the user was authenticated.
Has an issue (iat) and an expiration date (exp).
May include additional requested details about the subject, such as name and email address.
Is digitally signed, so it can be verified by the intended recipients.
May optionally be encrypted for confidentiality.
The ID token statements, or claims, are packaged in a simple JSON object:
`{`
  `"sub"`       `:` `"alice",`
  `"iss"`       `:` `"https://openid.c2id.com",`
  `"aud"`       `:` `"client-12345",`
  `"nonce"`     `:` `"n-0S6_WzA2Mj",`
  `"auth_time"` `: 1311280969,`
  `"acr"`       `:` `"c2id.loa.hisec",`
  `"iat"`       `: 1311280970,`
  `"exp"`       `: 1311281970,`
`}`

The ID token header, claims JSON and signature are encoded into a base 64 URL-safe string, for easy passing arround, for example as URL parameter.
`eyJhbGciOiJSUzI1NiIsImtpZCI6IjFlOWdkazcifQ.ewogImlzcyI6ICJodHRw`
`Oi8vc2VydmVyLmV4YW1wbGUuY29tIiwKICJzdWIiOiAiMjQ4Mjg5NzYxMDAxIiw`
`KICJhdWQiOiAiczZCaGRSa3F0MyIsCiAibm9uY2UiOiAibi0wUzZfV3pBMk1qIi`
`wKICJleHAiOiAxMzExMjgxOTcwLAogImlhdCI6IDEzMTEyODA5NzAKfQ.ggW8hZ`
`1EuVLuxNuuIJKX_V8a_OMXzR0EHR9R6jgdqrOOF4daGU96Sr_P6qJp6IcmD3HP9`
`9Obi1PRs-cwh3LO-p146waJ8IhehcwL7F09JdijmBqkvPeB2T9CJNqeGpe-gccM`
`g4vfKjkM8FcGvnzZUN4_KSP0aAp1tOJ1zZwgjxqGByKHiOtX7TpdQyHE5lcMiKP`
`XfEIQILVq0pc_E2DzL7emopWoaoZTF_m0_N0YzFC6g6EJbOEoRoSK5hoDalrcvR`
`YLSrQAZZKflyuVCyixEoV9GfNQC3_osjzw2PAithfubEEBLuVVk4XUVrWOLrLl0`
`nx7RkKU8NXNHq-rvKMzqg`

You can read more about the JWT data structure and encoding in RFC 7519.

JWT (JSON Web Token)

For example:
With JWT
eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJlNWI2NTIzZC02OWVmLTQ0NjItYmYxOC1mZTUwNDg1ZTJiMTAiLCJhdWQiOiIxMTE3NTkyMi1hNmI5LTRmMGQtOGY3Zi1mNzg3ZGM2ZGJmNDkiLCJhdXRoX3RpbWUiOjE0ODM4OTYyMzEsImtpZCI6InJzYTEiLCJpc3MiOiJodHRwczpcL1wvd3d3Lm1hcGxlLmNvbVwvb2lkYyIsImV4cCI6MTQ4Mzg5NzY2NywiaWF0IjoxNDgzODk3MDY3LCJub25jZSI6IjExZmU2NWZiZDM1YmIiLCJqdGkiOiJmN2M4NzZhNC0yZmQzLTQwMWEtODc4Ni01MGEyYWQwZjU5MjEifQ.RL_48lqbsAzJfaRK5y-sE-CAcMS5x1nIegI-rIbEg2fcUTpV-jprxLDBcKclBB-uz7XdblNtOMLYz4UKUwregxV16sMaYKB0QOMpbt7VXi-Tlarg7lQZMuwCnh3-pDR7i2Bd1mChkB02NHzB3GZxNYj7z1jQG5upiHAqGGiqOaw
This represents:
Part 1 Header eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ
{
"kid": "rsa1",
"alg": "RS256"
}
Part 2 Payload
eyJzdWIiOiJlNWI2NTIzZC02OWVmLTQ0NjItYmYxOC1mZTUwNDg
1ZTJiMTAiLCJhdWQiOiIxMTE3NTkyMi1hNmI5LTRmMGQtOGY3Zi
1mNzg3ZGM2ZGJmNDkiLCJhdXRoX3RpbWUiOjE0ODM4OTYyM
zEsImtpZCI6InJzYTEiLCJpc3MiOiJodHRwczpcL1wvd3d3Lm1hcG
xlLmNvbVwvb2lkYyIsImV4cCI6MTQ4Mzg5NzY2NywiaWF0IjoxND
gzODk3MDY3LCJub25jZSI6IjExZmU2NWZiZDM1YmIiLCJqdGkiO
iJmN2M4NzZhNC0yZmQzLTQwMWEtODc4Ni01MGEyYWQwZjU5
MjEifQ
{
"sub": "e5b6523d-69ef-4462-bf18-fe50485e2b10",
"aud": "11175922-a6b9-4f0d-8f7f-f787dc6dbf49",
"auth_time": 1483896231,
"kid": "rsa1",
"iss": "https://www.maple.com/oidc",
"exp": 1483897667,
"iat": 1483897067,
"nonce": "11fe65fbd35bb",
"jti": "f7c876a4-2fd3-401a-8786-50a2ad0f5921"
}
Part 3 Signature RL_48lqbsAzJfaRK5y-sE-CAcMS5x1nIegI-rIbEg2fcUTpV-jprxLDBcKclBB-uz7XdblNtOMLYz4UKUwregxV16sMaYKB0QOMpbt7VXi-Tlarg7lQZMuwCnh3-pDR7i2Bd1mChkB02NHzB3GZxNYj7z1jQG5upiHAqGGiqOaw HMACSHA256(base64enc(header) + '.' + base64enc(payload), secretKey)

Claims

Claims is the information about a user.

There are 3 types of claims

Normal claims.
`{`
   `"name":` `"Jane Doe",`
   `"given_name":` `"Jane",`
   `"family_name":` `"Doe",`
   `"email":` `"janedoe@example.com",`
   `"picture":` `"http://example.com/janedoe/me.jpg"`
  `}`
Aggregated claims.
`{`
   `"address": {`
     `"street_address":` `"1234 Hollywood Blvd.",`
     `"locality":` `"Los Angeles",`
     `"region":` `"CA",`
     `"postal_code":` `"90210",`
     `"country":` `"US"},`
   `"phone_number":` `"+1 (310) 123-4567"`
  `}`

`{`
   `"name":` `"Jane Doe",`
   `"given_name":` `"Jane",`
   `"family_name":` `"Doe",`
   `"birthdate":` `"0000-03-22",`
   `"eye_color":` `"blue",`
   `"email":` `"janedoe@example.com",`
   `"_claim_names": {`
     `"address":` `"src1",`
     `"phone_number":` `"src1"`
   `},`
   `"_claim_sources": {`
     `"src1": {"JWT":` `"jwt_header.jwt_part2.jwt_part3"}`
   `}`
  `}`
Distributed claims.
`---- Claims from here https://bank.example.com/claim_source`
`{`
   `"shipping_address": {`
     `"street_address":` `"1234 Hollywood Blvd.",`
     `"locality":` `"Los Angeles",`
     `"region":` `"CA",`
     `"postal_code":` `"90210",`
     `"country":` `"US"},`
   `"payment_info":` `"Some_Card 1234 5678 9012 3456",`
   `"phone_number":` `"+1 (310) 123-4567"`
  `}`

`---- Claims from https://creditagency.example.com/claims_here`
`{`
   `"credit_score": 650`
  `}`

`---- Aggregated claims`
`{`
   `"name":` `"Jane Doe",`
   `"given_name":` `"Jane",`
   `"family_name":` `"Doe",`
   `"email":` `"janedoe@example.com",`
   `"birthdate":` `"0000-03-22",`
   `"eye_color":` `"blue",`
   `"_claim_names": {`
     `"payment_info":` `"src1",`
     `"shipping_address":` `"src1",`
     `"credit_score":` `"src2"`
    `},`
   `"_claim_sources": {`
     `"src1": {"endpoint":`
                `"https://bank.example.com/claim_source"},`
     `"src2": {"endpoint":`
                `"https://creditagency.example.com/claims_here",`
              `"access_token":` `"ksj3n283dke"}`
   `}`
  `}`

There are 2 ways to retrieve claims

Request Claims from Scope. The each scope can have claims associated with.
Request claims with claims "request parameter" or "claim parameter" in the authorization endpoint.

There are 2 ways of returning the claims

Returning claims within ID_token. When a response_type value is used that results in an Access Token being issued. However, when no Access Token is issued (which is the case for the response_type value id_token), the resulting Claims are returned in the ID Token.
Returning claims within UserInfo endpoint. When no access_token is being issued, the claims will be returned from UserInfo endpoint.

Claim parameter in Authorization endpoint

OpenID Connect defines the following Authorization Request parameter to enable requesting individual Claims and specifying parameters that apply to the requested Claims:

claims OPTIONAL. This parameter is used to request that specific Claims be returned. The value is a JSON object listing the requested Claims.
The claims parameter value is represented in an OAuth 2.0 request as UTF-8 encoded JSON (which ends up being form-urlencoded when passed as an OAuth parameter). When used in a Request Object value, the JSON is used as the value of the claims member.
A claim request example:
`{`
   `"userinfo":`
    `{`
     `"given_name": {"essential":` `true},`
     `"nickname": null,`
     `"email": {"essential":` `true},`
     `"email_verified": {"essential":` `true},`
     `"picture": null,`
     `"http://example.info/claims/groups": null`
    `},`
   `"id_token":`
    `{`
     `"auth_time": {"essential":` `true},`
     `"acr": {"values": ["urn:mace:incommon:iap:silver"] }`
    `}`
  `}`

The follow 2 requests should result the same, either use scope or use claims to request individual claims.
Use claim request.
`https://server.example.com/authorize?`
  `request_type=code&scope=openid`
  `&claims=%7B%0A%20%20%20%22userinfo%22%3A%0A%20%20%20%20`
  `%7B%0A%20%20%20%20%20%22given_name%22%3A%20%7B%22essential`
  `%22%3A%20true%7D%2C%0A%20%20%20%20%20%22nickname%22%3A%20`
  `null%2C%0A%20%20%20%20%20%22email%22%3A%20%7B%22essential`
  `%22%3A%20true%7D%2C%0A%20%20%20%20%20%22email_verified%22`
  `%3A%20%7B%22essential%22%3A%20true%7D%2C%0A%20%20%20%20%20`
  `%22picture%22%3A%20null%2C%0A%20%20%20%20%20%22http%3A%2F`
  `%2Fexample.info%2Fclaims%2Fgroups%22%3A%20null%0A%20%20%20`
  `%20%7D%2C%0A%20%20%20%22id_token%22%3A%0A%20%20%20%20%7B%0A`
  `%20%20%20%20%20%22auth_time%22%3A%20%7B%22essential%22%3A`
  `%20true%7D%2C%0A%20%20%20%20%20%22acr%22%3A%20%7B%22values`
  `%22%3A%20%5B%22urn%3Amace%3Aincommon%3Aiap%3Asilver%22%5D`
  `%20%7D%0A%20%20%20%20%7D%0A%20%20%7D`
Decoded claims request is like below

`{`
   `"userinfo":`
    `{`
     `"email": null,`
     `"email_verified": null`
    `}`
  `}`

Use scope to request claims.
`https://server.example.com/authorize`
    `?request_type=code&scope=openid email`

Request parameter in Authorization endpoint

OpenID Connect defines the following Authorization Request parameters to enable Authentication Requests to be signed and optionally encrypted:

request OPTIONAL. This parameter enables OpenID Connect requests to be passed in a single, self-contained parameter and to be optionally signed and/or encrypted. The parameter value is a Request Object value, as specified in Section 6.1. It represents the request as a JWT whose Claims are the request parameters.
request_uri OPTIONAL. This parameter enables OpenID Connect requests to be passed by reference, rather than by value. The request_uri value is a URL using the https scheme referencing a resource containing a Request Object value, which is a JWT containing the request parameters.
Requests using these parameters are represented as JWTs, which are respectively passed by value or by reference. The ability to pass requests by reference is particularly useful for large requests. If one of these parameters is used, the other MUST NOT be used in the same request.
Example of "request" parameter
`{`
   `"iss":` `"s6BhdRkqt3",`
   `"aud":` `"https://server.example.com",`
   `"response_type":` `"code id_token",`
   `"client_id":` `"s6BhdRkqt3",`
   `"redirect_uri":` `"https://client.example.org/cb",`
   `"scope":` `"openid",`
   `"state":` `"af0ifjsldkj",`
   `"nonce":` `"n-0S6_WzA2Mj",`
   `"max_age": 86400,`
   `"claims":`
    `{`
     `"userinfo":`
      `{`
       `"given_name": {"essential":` `true},`
       `"nickname": null,`
       `"email": {"essential":` `true},`
       `"email_verified": {"essential":` `true},`
       `"picture": null`
      `},`
     `"id_token":`
      `{`
       `"gender": null,`
       `"birthdate": {"essential":` `true},`
       `"acr": {"values": ["urn:mace:incommon:iap:silver"]}`
      `}`
    `}`
  `}`

Example of authorize request with "request" parameter:
`https://server.example.com/authorize?`
    `response_type=code%20id_token`
    `&client_id=s6BhdRkqt3`
    `&redirect_uri=https%3A%2F%2Fclient.example.org%2Fcb`
    `&scope=openid`
    `&state=af0ifjsldkj`
    `&nonce=n-0S6_WzA2Mj`
    `&request=eyJhbGciOiJSUzI1NiIsImtpZCI6ImsyYmRjIn0.ew0KICJpc3MiOiA`
    `iczZCaGRSa3F0MyIsDQogImF1ZCI6ICJodHRwczovL3NlcnZlci5leGFtcGxlLmN`
    `vbSIsDQogInJlc3BvbnNlX3R5cGUiOiAiY29kZSBpZF90b2tlbiIsDQogImNsaWV`
    `udF9pZCI6ICJzNkJoZFJrcXQzIiwNCiAicmVkaXJlY3RfdXJpIjogImh0dHBzOi8`
    `vY2xpZW50LmV4YW1wbGUub3JnL2NiIiwNCiAic2NvcGUiOiAib3BlbmlkIiwNCiA`
    `ic3RhdGUiOiAiYWYwaWZqc2xka2oiLA0KICJub25jZSI6ICJuLTBTNl9XekEyTWo`
    `iLA0KICJtYXhfYWdlIjogODY0MDAsDQogImNsYWltcyI6IA0KICB7DQogICAidXN`
    `lcmluZm8iOiANCiAgICB7DQogICAgICJnaXZlbl9uYW1lIjogeyJlc3NlbnRpYWw`
    `iOiB0cnVlfSwNCiAgICAgIm5pY2tuYW1lIjogbnVsbCwNCiAgICAgImVtYWlsIjo`
    `geyJlc3NlbnRpYWwiOiB0cnVlfSwNCiAgICAgImVtYWlsX3ZlcmlmaWVkIjogeyJ`
    `lc3NlbnRpYWwiOiB0cnVlfSwNCiAgICAgInBpY3R1cmUiOiBudWxsDQogICAgfSw`
    `NCiAgICJpZF90b2tlbiI6IA0KICAgIHsNCiAgICAgImdlbmRlciI6IG51bGwsDQo`
    `gICAgICJiaXJ0aGRhdGUiOiB7ImVzc2VudGlhbCI6IHRydWV9LA0KICAgICAiYWN`
    `yIjogeyJ2YWx1ZXMiOiBbInVybjptYWNlOmluY29tbW9uOmlhcDpzaWx2ZXIiXX0`
    `NCiAgICB9DQogIH0NCn0.nwwnNsk1-ZkbmnvsF6zTHm8CHERFMGQPhos-EJcaH4H`
    `h-sMgk8ePrGhw_trPYs8KQxsn6R9Emo_wHwajyFKzuMXZFSZ3p6Mb8dkxtVyjoy2`
    `GIzvuJT_u7PkY2t8QU9hjBcHs68PkgjDVTrG1uRTx0GxFbuPbj96tVuj11pTnmFC`
    `UR6IEOXKYr7iGOCRB3btfJhM0_AKQUfqKnRlrRscc8Kol-cSLWoYE9l5QqholImz`
    `jT_cMnNIznW9E7CDyWXTsO70xnB4SkG6pXfLSjLLlxmPGiyon_-Te111V8uE83Il`
    `zCYIb_NMXvtTIVc1jpspnTSD7xMbpL-2QgwUsAlMGzw`

OpenId Connect Protocol Suite

Get ViewPager's current fragment

2014-05-25T19:25:00.001-07:00

I often want to implement dialog callback inside fragment class rather than the activity. So in the attach() method, I'll need find current fragment from activity.

Here is the way to do that:

public Fragment getCurrentFragment() {

return getSupportFragmentManager().findFragmentByTag("android:switcher:" +

R.id.vp_edit_reward_entries + ":" + mViewPager.getCurrentItem());

}

But one culprit is that the ViewPager adapter has to be FragmentPagerAdapter not the FragmentStatePagerAdapter.

KidzTube - A kids friendly YouTube player App

2014-01-20T13:07:00.001-08:00

My son started to use YouTube at age of 2. I have to say YouTube taught my son letters, numbers and more. One thing I realized at the beginning, I can't just be an irresponsible father and leave everything to YouTube. I have to guide my son to use YouTube to let him enjoy and learn. First and most important thing is the content. At the age of two I don't have to worry much about sexual and violent contents, at least he won't intentionally searching those content behind of me. But I have to find

Why is Fetch(join) is not working with HQL?

2013-12-04T13:54:00.001-08:00

@Fetch(JOIN) will be ignored if you use the Query interface (e.g.: session.createQuery()) but it will be properly used if you use the Criteria interface.

This is practically a bug in Hibernate which was never resolved. It is unfortunate because a lot of applications use the Query interface and cannot be migrated easily to the Criteria interface.

If you use the Query interface you always have to add JOIN FETCH statements into the HQL manually.

Hibernate Fetch plan and Fetch Strategies

2013-12-04T13:35:00.001-08:00

The Hibernate Relations Works with different Fetch Strategies..!!

Hibernate provides 4 strategies for retrieving data:

SELECT

  @OneToMany(mappedBy="tableName", cascade=CascadeType.ALL)  @Column(name="id")   @Fetch(FetchMode.SELECT)

In this Method there are Multiple SQLs fired. This first one is fired for retrieving all the records in the Parent table. The remaining are fired for retrieving records for each Parent Record. This is basically the N+1 problem. The first query retrieves N records from database, in this case N Parent records. For each Parent a new query retrieves Child. Therefore for N Parent, N queries retrieve information from Child table.

JOIN

  @OneToMany(mappedBy="tableName", cascade=CascadeType.ALL)  @Column(name="id")  @Fetch(FetchMode.JOIN)

This is similar to the SELECT fetch strategy except that fact that all database retrieval take place upfront in JOIN fetch unlike in SELECT where it happens on a need basis. This can become an important performance consideration.

SUBSELECT

   @OneToMany(mappedBy="tableName", cascade=CascadeType.ALL)   @Column(name="id")   @Fetch(FetchMode.SUBSELECT)

Two SQLs are fired. One to retrieve all Parent and the second uses a SUBSELECT query in the WHERE clause to retrieve all child that has matching parent ids.

BATCH

  @OneToMany(mappedBy="tableName", cascade=CascadeType.ALL)  @Column(name="id")  @@BatchSize(size=2)

The batch size maps to the number of Parent whose child are retrieved. So we can specify the number of records to be fetched at a time.But Multiple queries will be executed.!!

one-to-many & many-to-many allows - join, Select and SubSelect

many-to-one & one-to-one allows - Join and Select

Hibernate also distinguishes between (when is the associations are fetched)

1.Immediate fetching -

an association, collection or attribute is fetched immediately, when the Parent is loaded. (lazy="false")

2.Lazy collection fetching -

a collection is fetched when the application invokes an operation upon that collection. (This is the default for collections.(lazy="true")

3."Extra-lazy" collection fetching -

individual elements of the collection are accessed from the database as needed. Hibernate tries not to fetch the whole collection into memory unless absolutely needed (suitable for very large collections) (lazy="extra")

4.Proxy fetching -

a single-valued association is fetched when a method other than the identifier getter is invoked upon the associated object. (lazy="proxy")

5."No-proxy" fetching -

a single-valued association is fetched when the instance variable is accessed. Compared to proxy fetching, this approach is less lazy.(lazy="no-proxy")

6.Lazy attribute fetching -

an attribute or single valued association is fetched when the instance variable is accessed. (lazy="true")

one-to-many & many-to-many allows Immediate, Layzy, Extra Lazy

many-to-one & one-to-one allows Immediate Proxy, No Proxy

Make log4j display which file it used to configure itself?

2013-05-17T10:06:00.001-07:00

Notes to myself:

simply add log4j.debug to the JVM system variables. For example:

java -Dlog4j.debug -cp ... some.class.name

Log4j FAQ

Could not create plugin of type 'MatrixTestingPlugin'

2013-04-30T09:09:00.002-07:00

After forked and cloned Hibernate-orm project from Github, I tried to compile the project using



./gradlew clean build

But I'm kept getting error:



Could not create plugin of type 'MatrixTestingPlugin'

I checked my environment, I have "JAVA_HOME" configured. I even have had previously installed gradle removed.

Eventually, I figured the problem is that the path of "JAVA_HOME" has the empty space, and gradle 1.5 failed to recognize that. So after moved Java into a location with no space in the path, the problem solved.

Very quick takeout of Gradle

2013-04-24T11:48:00.001-07:00

Gradle is a DSL created with Groovy.
Gradle build script is simply Groovy code that drives the Gradle API.
As a Java developer, to think of build.gradle script is writing main() method in a class that implemented Project interface.
Gradle scripts are made of "task"s, an equivalent of "target" in Ant, or "goal" in Maven.
There are Plugins available for different languages which includes the "task"s based on languages convention. Such as Java, after added plugin, try gradle tasks to verify what tasks are available.
apply plugin: 'java'
To understand the basic of Gradle, read User Guide chapter 6 Build Script Basics.
The ultimate reference for Gradle DSL, all the elements of scripts.
To start write build script for Java project. Read User Guide chapter 23. The Java Plugin.

Understand most basic concepts of Encryption

2013-04-23T09:17:00.001-07:00

When I'm orgnizing my notes, I found this artical. I lost track of origin, but thanks to the author.

1. Traditional encryption(Symmetric): Use the same key to encrypt and decrypt messages.
Problem 0: How to deliver key to the recipients safely?

2. Solution: Asymmetric encryption - A pair of keys, one for encryption(public key), one for decryption(private key). Anybody can have the public key, only the one who has the private key can decrypt the information. The message transformation process becomes the recipient generates a key pair and keeps private key safely, then deliver the public key to the sender(the safety of delivering is not so much concern).
Is it a perfect solution? no.
Problem 1: How could message sender knows the public key is from the recipient wanna be. For example, a spy can capture the carrier and forge a pair of key, and send his or her public key to the sender, then after the encrypted message comes back, decrypt it, do some damages then use the original public key to encrypt it, then send to real recipient.

3. Solution: Need a way to identify the public key is from the real recipient wanna be. Think of money, it is actually just a piece of paper, but why everyone accepts the value that money represents, because it is issued by government. Government has the ultimate power(it supports by police and army), with his authorization, everyone accepts it, otherwise will be punished. The same concept, if a party has this kind of ultimate power can put a signature to prove the owner of the public key. Then message sender can trust the public key is from right person who claims to be. Fortunately, there's this kind of parties, but they are not supported by any kind of police or army, it is supported by conceptually unbreakable security and well respected reputation. This kind of party called CA(Certification Authority). Sound like not that reliable like government.

Then the public key is not the only thing to be delivered to message sender, you deliver a bundle with: Public key to be used to encrypt message, the public key issuer's personal information, issuer's signature, and CA's signature of course. This bundle called Digital Certificate.

Is it perfect now? no.
Problem 2: Asymmetric encryption and decryption is 1000 times slower then symmetric algorithm. Looks how impatient today's people are.

4. Solution: Combination of symmetric and asymmetric to speed up. You can do like, encrypt the original message with traditional way(symmetric) with a random generated key, but encrypt this one time random key with public key, then send encrypted message together with asymmetric encrypted key. Because for asymmetric algorithm, the smaller message, the faster encryption. The symmetric key is most time much smaller than the original message.

Digital digest (Hash functions) - A very short message(digital digest) can be generated from no matter how big the original message is. For example, 160-bits. The magic is that this short message is reproducible with the same algorithm, and even a tiny little bit change in the original message, the digital digest will be completely different.

How to query on key of map collection in Hibernate?

2013-04-23T09:04:00.001-07:00

Until Hibernate implements JPA's key() function (see HHH-5396), you can use the index() function:


Query q = session.createQuery("select a from TestA a join a.testBMap m where index(m) = :key");
q.setParameter("key", "test1");
q.list();

Matrix Parameters and Query Parameters

2013-04-23T08:37:00.001-07:00

Just to remind myself the concepts of:
Query parameters: http://example.com/apples?order=random&color=blue
Matrix parameters: http://example.com/apples;order=random;color=blue

- Maxtrix parameters is not commonly used.

- Matrix parameters can make RESTful URL more expressive.

- JAX-RS supports matrix parameters. Spring MVC supports it since 3.2.

- Servlet container uses ;jsessionid=xxx in the URI when client cookies is disabled, this is called URL-Rewriting.

SwitchingToUbuntuFromLinuxRedHatEnterpriseLinuxAndFedora

2011-10-27T08:19:00.001-07:00

Contents

It is easy to apply your existing knowledge of Red Hat Enterprise Linux orFedora to Ubuntu. The key differences between them are covered in this article.

Administrative Tasks

In Red Hat Enterprise Linux and Fedora by default, each administrative user needs to know the root password, in addition to their own password.

In Ubuntu, each user only has one password. Users in the admin group can run command line and graphical applications with elevated privileges. Graphical admin tools prompt for this password when run, and command line tools can be run with root-privileges using sudo.

Package Management

Ubuntu has more packages available than Fedora, so you'll have a better chance of finding what you want in the repositories. As with Fedora, graphical applications will put a link into the Applications menu.

Graphical Tools

The Synaptic package Manager is an excellent tool for finding, fetching and installing packages. Press System -> Administration -> Synaptic Package Manager to start Synaptic.

Command Line Tools

Ubuntu uses apt-get instead of yum, up2date and so on to find, download, and install packages and their dependencies.

Note that, unlike yum, apt-get is only for packages available in repositories - it cannot handle packages you have already downloaded. The dpkg command is used instead.

Table of Equivalent Commands

Below is a table of equivalent commands for package management on both Ubuntu/Debian and Red Hat/Fedora systems.

Task	Red Hat/Fedora	Ubuntu
Adding, Removing and Upgrading Packages
Refresh list of available packages	Yum refreshes each time it's used	apt-get update
Install a package from a repository	yum install package_name	apt-get install package_name
Install a package file	yum install package.rpm rpm -i package.rpm	dpkg --install package.deb
Remove a package	rpm -e package_name	apt-get remove package_name
Check for package upgrades	yum check-update	apt-get -s upgrade apt-get -s dist-upgrade
Upgrade packages	yum update rpm -Uvh [args]	apt-get dist-upgrade
Upgrade the entire system	yum upgrade	apt-get dist-upgrade
Package Information
Get information about an available package	yum search package_name	apt-cache search package_name
Show available packages	yum list available	apt-cache dumpavail
List all installed packages	yum list installed rpm -qa	dpkg --list
Get information about a package	yum info package_name	apt-cache show package_name
Get information about an installed package	rpm -qi package_name	dpkg --status package_name
List files in an installed package	rpm -ql package_name	dpkg --listfiles package_name
List documentation files in an installed package	rpm -qd package_name	-
List configuration files in an installed package	rpm -qc package_name	-
Show the packages a given package depends on	rpm -qR package_name	apt-cache depends
Show other packages that depend on a given package (reverse dependency)	rpm -q -whatrequires [args]	apt-cache rdepends
Package File Information
Get information about a package file	rpm -qpi package.rpm	dpkg --info package.deb
List files in a package file	rpm -qpl package.rpm	dpkg --contents package.deb
List documentation files in a package file	rpm -qpd package.rpm	-
List configuration files in a package file	rpm -qpc package.rpm	-
Extract files in a package	rpm2cpio package.rpm \| cpio -vid	dpkg-deb --extract package.deb dir-to-extract-to
Find package that installed a file	rpm -qf filename	dpkg --search filename
Find package that provides a particular file	yum provides filename	apt-file search filename
Misc. Packaging System Tools
Show stats about the package cache	-	apt-cache stats
Verify all installed packages	rpm -Va	debsums
Remove packages from the local cache directory	yum clean packages	apt-get clean
Remove only obsolete packages from the local cache directory	-	apt-get autoclean
Remove header files from the local cache directory (forcing a new download of same on next use)	yum clean headers	apt-file purge
General Packaging System Information
Package file extension	*.rpm	*.deb
Repository location configuration	/etc/yum.conf	/etc/apt/sources.list

Some of the information in this table was derived (with permission) from APT and RPM Packager Lookup Tables.

More technical information about Debian-style packaging can be found in Basics of the Debian package management system and the Debian New Maintainers' Guide.

Services

Services on Ubuntu are managed in a broadly similar way to those on Red Hat.

Graphical Tools

Services can be configured by clicking System -> Administration -> Services. A tool called Boot-Up Manager is also available.

Command Line Tools

Below is a table of example commands for managing services. The apache/httpd service is used as an example.

Task	Red Hat / Fedora	Ubuntu	Ubuntu (with sysv-rc-conf or sysvconfig)
Starting/stopping services immediately	service httpd start	invoke-rc.d apache start	service apache start
Enabling a service at boot	chkconfig httpd on	update-rc.d apache defaults	sysv-rc-conf apache on
Disabling a service at boot	chkconfig httpd off	update-rc.d apache purge	sysv-rc-conf apache off

Note: Whereas Red Hat and Fedora servers boot into runlevel 3 by default, Ubuntu servers default to runlevel 2.

Note: The service and invoke-rc.d commands call init scripts to do the actual work. You can also start and stop services by doing e.g. /etc/init.d/apache start on Ubuntu, or /etc/init.d/httpd start on Red Hat/Fedora.

Network

Graphical Tools

Fedora/RHEL have system-config-network, ubuntu pre 10.04 had gnome-nettool to edit static ip address, since 10.04 nm-connection-editor is the best choice. For Ubuntu 10.04 Studio there is only manual editing of files since NetworkMontor is not included

Command Line Tools

* ubuntu networking for basic and advanced users

Original post

Centering a Div in IE8 Using margin:auto

2011-10-27T08:16:00.001-07:00

Original post

On the count of 3 everybody scream "MICROSOFT SUCKS AND I HATE INTERNET EXPLODER".

1, 2, 3, go.

I've been working on revamping my Sticky Footer code for IE8 compatibility when I ran into a little bug of sorts. If you are using margin:0 auto; to center a div it will cause problems in IE8 if the parent element has either no width already set, or you've not set text alignment to center for that parent div, or you are using the wrong doc type declaration.

These are the three fixes I know of;

Width:100%

Set your containing element to width:100%; so then your centered div inside of that one will actually center. Like this;

#container {width:100%;}
#centered {width:400px; margin:0 auto;}

Text-Align:Center

If you apply text-align:center to the containing div IE8 will obey the margin:auto. You then have to un-center your text content inside that centered div with text-align:left. Kind of convoluted, I know. Apparently some web designer have been doing it like that for years as this was an issue with IE5.

#container {text-align:center;}
#centered {width:400px; margin:0 auto;text-align:left;}

Use Transitional Doc Type

If you are using XHTML 1.0 Strict as your doc type, IE8 will not obey the margin:auto method for centering an element, unless you use one of the above hacks. You can also just change your doc type declaration at the top of your page to be XHTML 1.0 Transitional. IE8 will then obey the margin:auto statement.

Here's a link to doc type declaration syntax.

Oh the joys of cross browser web design.

How to reset Mirth admin user.

2011-01-05T13:35:00.001-08:00

Type: java -cp derbytools.jar;derby.jar org.apache.derby.tools.ij

ij> connect 'jdbc:derby:c:/program files/Mirth/Mirthdb';
ij> update person set password = 'NdgB6ojoGb/uFa5amMEyBNG16mE=', salt='Np+FZYzu4M0=' where username = 'admin';
ij> exit;

A JAAS LoginModule for ActiveMQ

2010-07-22T09:50:00.001-07:00

In order to let ActiveMQ to use the existing authentication repository, I created a JAAS plugin for ActiveMQ serve the purpose.

1. change <ActiveMQ_HOME>/conf/activemq.xml to enable JAAS authentication.


<jaasAuthenticationPlugin configuration="activemq-domain" />

2. change <ActiveMQ_HOME>/conf/loging.conf, add login module definition.
activemq-domain {
    com.zeon.auth.CmdJdbcLoginModule Sufficient
                                debug=true
                                com.zeon.db.url="jdbc:mysql://localhost:3306/userdb"
                                com.zeon.db.driver="com.mysql.jdbc.Driver"
                                com.zeon.db.username="user"
                                com.zeon.db.password="pass";
                org.apache.activemq.jaas.PropertiesLoginModule Sufficient
        debug=true
        org.apache.activemq.jaas.properties.user="users.properties"
        org.apache.activemq.jaas.properties.group="groups.properties";
};

3. finally, the class that extended from javax.security.auth.spi.LoginModule

package com.zeon.sync.auth;

import java.io.IOException;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.HashSet;
import java.util.Map;
import java.util.Properties;
import java.util.Set;

import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
import javax.security.auth.callback.CallbackHandler;
import javax.security.auth.callback.NameCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.UnsupportedCallbackException;
import javax.security.auth.login.FailedLoginException;
import javax.security.auth.login.LoginException;
import javax.security.auth.spi.LoginModule;

import org.apache.activemq.jaas.GroupPrincipal;
import org.apache.activemq.jaas.UserPrincipal;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

import com.zeon.jdbc.JDBCException;
import com.zeon.jdbc.JDBCUtils;
import com.zeon.jdbc.UniqueResultHandler;

public class CmdJdbcLoginModule implements LoginModule {

    private static final Log log = LogFactory.getLog(CmdJdbcLoginModule.class);
    private static final String[] ROLE = {"hs", "users"};
    private Subject subject;
    private CallbackHandler callbackHandler;
    private boolean debug;
    private String user;
    private Set principals;

    private JDBCUtils jdbcUtils;

    public CmdJdbcLoginModule() {
        principals = new HashSet();
    }

    public void initialize(Subject subject, CallbackHandler callbackHandler,
            Map sharedState, Map options) {
        this.subject = subject;
        this.callbackHandler = callbackHandler;

        debug = "true".equalsIgnoreCase((String) options.get("debug"));
        String url = (new StringBuilder()).append(
                (String) options.get("com.hs.db.url"))
                .append("").toString();
        String username = (new StringBuilder()).append(
                (String) options.get("com.hs.db.username"))
                .append("").toString();
        String password = (new StringBuilder()).append((String)options
                .get("com.zeon.db.password")).append("").toString();
        String driver = (new StringBuilder()).append((String)options
                .get("com.zeon.db.driver")).append("").toString();

        Properties props = new Properties();
        props.setProperty("jdbc.user", username);
        props.setProperty("jdbc.password", password);
        props.setProperty("jdbc.driver", driver);
        props.setProperty("jdbc.url", url);

        try {
            jdbcUtils = new JDBCUtils(props);
        } catch (SQLException e) {
            log.error("connect to db failed.", e);
        }
        if (debug)
            log.debug((new StringBuilder()).append("Initialized debug=")
                    .append(debug));
    }

    public boolean login() throws LoginException {
        Callback callbacks[] = new Callback[2];
        callbacks[0] = new NameCallback("Username: ");
        callbacks[1] = new PasswordCallback("Password: ", false);
        try {
            callbackHandler.handle(callbacks);
        } catch (IOException ioe) {
            throw new LoginException(ioe.getMessage());
        } catch (UnsupportedCallbackException uce) {
            throw new LoginException((new StringBuilder()).append(
                    uce.getMessage()).append(
                    " not available to obtain information from user")
                    .toString());
        }
        user = ((NameCallback) callbacks[0]).getName();
        char tmpPassword[] = ((PasswordCallback) callbacks[1]).getPassword();
        if (tmpPassword == null)
            tmpPassword = new char[0];
        String password = null;
        try {
            password = findPassword(user);
            log.debug("=============the password for user " + user + " is " + password);
        } catch (JDBCException e) {
            throw new FailedLoginException("DB access failed.");
        }
        if (password == null)
            throw new FailedLoginException("User does exist");
        if (!password.equals(new String(tmpPassword)))
            throw new FailedLoginException("Password does not match");
        if (debug)
            log.debug((new StringBuilder()).append("login ").append(user)
                    .toString());
        return true;
    }

    @SuppressWarnings("unchecked")
    private String findPassword(String user) throws JDBCException {
        String sql = "select JMSpassword from DoctorSyncMap where DoctorID='" + user + "'";
        String result = (String)jdbcUtils.query(sql, new UniqueResultHandler() {

            @Override
            public Object handle(ResultSet rs) throws JDBCException {
                String result = "";
                try {
                    if (rs.next()) {
                        result = rs.getString(1);
                    }
                } catch (Exception e) {
                    log.error("query db failed.", e);
                    throw new JDBCException(e);
                }
                return result;
            }

        });
        return result;
    }

    @SuppressWarnings("unchecked")
    public boolean commit() throws LoginException {
        principals.add(new UserPrincipal(user));
        for (String r : ROLE) {
            principals.add(new GroupPrincipal(r));
        }
        subject.getPrincipals().addAll(principals);
        log.debug("commit");
        return true;
    }

    public boolean abort() throws LoginException {
        user = null;
        if (debug)
            log.debug("abort");
        return true;
    }

    public boolean logout() throws LoginException {
        subject.getPrincipals().removeAll(principals);
        principals.clear();
        if (debug)
            log.debug("logout");
        return true;
    }

}

Configurable Auditing Interceptor for Hibernate

2010-07-22T09:03:00.000-07:00

If Hibernate provides a configurable audit log function, that would be very nice. Think if we can do this:

In Hibernate.properties:
hibernate.audit_log=true

In Entity definition:
@column(audit="true")
public String name;

Then Hibernate will log the changes for the specified columns.

Before we have this function. We can use hibernate interceptor to create a configurable audit logging function. Here is my implementation.

Interceptor Configuration.

<interceptor>
    <package name="com.zeon.model">
        <class name="Dog" all="true">
            <exclude name="supersedeTime"/>
        </class>

        <class name="Cat" >
            <property name="name"/>
            <property name="gender"/>
        </class>
    </package>
</interceptor>

Interceptor Implementation

package com.zeon.interceptor;

import java.io.InputStream;
import java.io.Serializable;
import java.sql.Connection;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
import java.util.Iterator;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;

import org.apache.commons.beanutils.BeanUtils;
import org.apache.commons.lang.ArrayUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.hibernate.CallbackException;
import org.hibernate.EmptyInterceptor;
import org.hibernate.HibernateException;
import org.hibernate.Session;
import org.hibernate.Transaction;
import org.hibernate.metadata.ClassMetadata;
import org.hibernate.proxy.HibernateProxyHelper;
import org.hibernate.type.Type;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.NodeList;

import com.zeon.util.HibernateUtil;

public class AuditLogInterceptor extends EmptyInterceptor {

    private static Log log = LogFactory.getLog(AuditLogInterceptor.class);
    /**
     *
     */
    private static final long serialVersionUID = 7650719606049698363L;

    enum Event {
        insert, update, delete
    }

    private Session session;
    private Long userId;

    private Set<AuditTrail> inserts = new HashSet<AuditTrail>();
    private Set<AuditTrail> updates = new HashSet<AuditTrail>();
    private Set<AuditTrail> deletes = new HashSet<AuditTrail>();

    private static Map<String, Set<String>> auditableClasses;
    private static Map<String, Set<String>> excludedProperties;
    private static List<String> includeAllClasses;

    static {
        auditableClasses = new HashMap<String, Set<String>>();
        excludedProperties = new HashMap<String, Set<String>>();
        includeAllClasses = new ArrayList<String>();
        try {
            pareseInterceptorConfig();
        } catch (Exception e) {
            log.error("parse interceptor configuration failed...", e);
            throw new RuntimeException(e);
        }
    }

    public AuditLogInterceptor() {
    }

    private static void pareseInterceptorConfig() throws Exception {
        InputStream inStream = null;
        try {
            DocumentBuilderFactory domFactory = DocumentBuilderFactory
                    .newInstance();
            domFactory.setNamespaceAware(true);
            DocumentBuilder builder = domFactory.newDocumentBuilder();
            inStream = AuditLogInterceptor.class.getClassLoader()
                    .getResourceAsStream("InterceptorConf.xml");
            Document doc = builder.parse(inStream);

            NodeList packList = doc.getElementsByTagName("package");
            for (int i = 0; i < packList.getLength(); i++) {
                Element pack = (Element)packList.item(i);
                String packName = pack.getAttribute("name");
                NodeList clazzes = pack.getElementsByTagName("class");
                for (int j = 0; j < clazzes.getLength(); j++) {
                    Element clazz = (Element)clazzes.item(j);
                    String clazzName = clazz.getAttribute("name");
                    String fullClassName = packName + "." + clazzName;

                    String includeAll = clazz.getAttribute("all");
                    if (!StringUtils.isEmpty(includeAll) &&
                            includeAll.equalsIgnoreCase("true")) {
                        includeAllClasses.add(fullClassName);
                    }

                    //set exclude list
                    NodeList excludes = clazz.getElementsByTagName("exclude");
                    Set<String> exclList = new HashSet<String>();
                    for (int p = 0; p < excludes.getLength(); p++) {
                        Element excl = (Element)excludes.item(p);
                        String exclName = excl.getAttribute("name");
                        exclList.add(exclName);
                    }
                    if (!exclList.isEmpty()) {
                        excludedProperties.put(fullClassName, exclList);
                    }

                    //set prop list
                    NodeList props = clazz.getElementsByTagName("property");
                    Set<String> propList = new HashSet<String>();
                    for (int k = 0; k < props.getLength(); k++) {
                        Element prop = (Element)props.item(k);
                        String propName = prop.getAttribute("name");
                        if (exclList.contains(propName)) {
                            continue;
                        }
                        verifyProperty(fullClassName, propName);
                        propList.add(propName);
                    }
                    if (!propList.isEmpty()) {
                        auditableClasses.put(fullClassName, propList);
                    }
                }
            }
        } finally {
            inStream.close();
        }
    }

    @SuppressWarnings("unchecked")
    private static void verifyProperty(String fullClassName, String propName)
            throws Exception {
        Class clazz;
        try {
            clazz = Class.forName(fullClassName);

        } catch (ClassNotFoundException e) {
            throw new Exception("no class " + fullClassName + " found.", e);
        } catch (SecurityException e) {
            throw new Exception("no permission to access class " + propName
                    + " in class " + fullClassName, e);
        }

        List<Class> classList = new ArrayList<Class>();
        classList.add(clazz);
        while (true) {
            Class tmpClazz = clazz.getSuperclass();
            if (tmpClazz.getName().equals("java.lang.Object")) {
                break;
            } else {
                classList.add(tmpClazz);
                clazz = tmpClazz;
            }
        }

        boolean flag = false;
        for (Class c : classList) {
            try {
                c.getDeclaredField(propName);
                flag = true;
                break;
            } catch (NoSuchFieldException e) {
                log.debug("property " + propName + " is not in class "
                        + c.getName());
            }
        }

        if (!flag) {
            throw new Exception("no property " + propName + " in class "
                    + fullClassName);
        }
    }

    public void setSession(Session session) {
        this.session = session;
    }

    public void setUserId(Long userId) {
        this.userId = userId;
    }

    public boolean onSave(Object entity, Serializable id, Object[] state,
            String[] propertyNames, Type[] types) {
        String key = entity.getClass().getCanonicalName();
        Iterable<String> it = getAuditableProperties(key, propertyNames);
            for (String prop : it) {
                int idx = ArrayUtils.indexOf(propertyNames, prop);
                if (isNotAuditable(types[idx])) {
                    continue;
                }
                Object newVal = state[idx];
                if (newVal != null) {
                    newVal = types[idx].isEntityType()?
                            getEntityId(newVal) : newVal;
                    AuditTrail lr = new AuditTrail(entity, Event.insert.name(),
                        key, prop, null, null, newVal.toString(), userId);
                    inserts.add(lr);
                }
            }

        return super.onSave(entity, id, state, propertyNames, types);
    }

    private Iterable<String> getAuditableProperties(String key,
            String[] propertyNames) {
        Iterable<String> it = new ArrayList<String>();
        if (auditableClasses.containsKey(key) || includeAllClasses.contains(key)) {

            if (includeAllClasses.contains(key)) {
                List<String> propList = new ArrayList<String>();
                for (String p : propertyNames) {
                    propList.add(p);
                }
                propList.removeAll(excludedProperties.get(key));
                it = propList;
            }else {
                it = auditableClasses.get(key);
            }
        }
        return it;
    }

    private boolean isNotAuditable(Type type) {
        if (type.isAnyType() || type.isCollectionType()) {
            return true;
        }else {
            return false;
        }
    }

    public boolean onFlushDirty(Object entity, Serializable id,
            Object[] currentState, Object[] previousState,
            String[] propertyNames, Type[] types) throws CallbackException {
        String key = entity.getClass().getCanonicalName();
        Iterable<String> it = getAuditableProperties(key, propertyNames);
            for (String prop : it) {
                int idx = ArrayUtils.indexOf(propertyNames, prop);
                if (isNotAuditable(types[idx])) {
                    continue;
                }
                boolean isEntity = types[idx].isEntityType();
                Object oldVal = previousState[idx];
                Object newVal = currentState[idx];
                if (oldVal == null && newVal == null) {
                    continue;
                }

                AuditTrail lr;
                if (oldVal == null) {
                    newVal = isEntity? getEntityId(newVal) : newVal;
                    lr = new AuditTrail(entity, Event.update.name(), key, prop,
                            (Long) id, null, newVal.toString(), userId);
                } else if (newVal == null) {
                    oldVal = isEntity? getEntityId(oldVal) : oldVal;
                    lr = new AuditTrail(entity, Event.update.name(), key, prop,
                            (Long) id, oldVal.toString(), null, userId);
                } else if (newVal.equals(oldVal)) {
                    continue;
                } else {
                    newVal = isEntity? getEntityId(newVal) : newVal;
                    oldVal = isEntity? getEntityId(oldVal) : oldVal;
                    lr = new AuditTrail(entity, Event.update.name(), key, prop,
                            (Long) id, oldVal.toString(), newVal.toString(),
                            userId);
                }

                updates.add(lr);
            }
        return false;
    }

    public boolean onDelete(Object entity, Serializable id,
            Object[] currentState, Object[] previousState,
            String[] propertyNames, Type[] types) throws CallbackException {

        String key = entity.getClass().getCanonicalName();
        Iterable<String> it = getAuditableProperties(key, propertyNames);
            for (String prop : it) {
                int idx = ArrayUtils.indexOf(propertyNames, prop);
                if (isNotAuditable(types[idx])) {
                    continue;
                }
                Object oldVal = previousState[idx];
                if (oldVal == null) {
                    continue;
                }
                if (types[idx].isEntityType()) {
                    oldVal = getEntityId(oldVal);
                }
                AuditTrail lr = new AuditTrail(entity, Event.delete.name(), key, prop,
                            (Long) id, oldVal.toString(), null, userId);

                deletes.add(lr);
            }

        return false;
    }

    @SuppressWarnings("unchecked")
    public void postFlush(Iterator iterator) throws CallbackException {
        Connection connection = session.connection();
        Session tmpSession = HibernateUtil.getSessionFactory().openSession(
                connection);
        try {

            for (AuditTrail at : inserts) {
                at.setEntityId(getEntityId(at.getEntity()));
                tmpSession.save(at);
            }

            for (AuditTrail at : updates) {
                tmpSession.save(at);
            }

            for (AuditTrail at : deletes) {
                tmpSession.save(at);
            }

            tmpSession.flush();

        } catch (HibernateException ex) {
            log.error("save audit trail failed....", ex);
            throw new CallbackException(ex);
        } finally {
            reset();
            tmpSession.close();
        }
    }

    private Long getEntityId(Object entity) {
        Class clazz = HibernateProxyHelper.getClassWithoutInitializingProxy(entity);
        ClassMetadata cm = HibernateUtil.getSessionFactory().getClassMetadata(
                clazz);
        String idPropName = cm.getIdentifierPropertyName();
        Long val = 0L;
        try {
            val = Long.valueOf(BeanUtils.getProperty(entity, idPropName));
        } catch (Exception e) {
            //
            log.error("can't read id from entity " + entity.getClass().getCanonicalName());
        }

        return val;
    }

    public void reset() {
        inserts.clear();
        updates.clear();
        deletes.clear();
    }

    @Override
    public void afterTransactionCompletion(Transaction transaction) {
        reset();
        super.afterTransactionCompletion(transaction);
    }

}

AuditTrail class

package com.zeon.interceptor;

import java.io.Serializable;
import java.sql.Timestamp;

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.PrePersist;
import javax.persistence.Transient;

@Entity
public class AuditTrail implements Serializable{

    /**
    *
    */
    private static final long serialVersionUID = -8352980040419810241L;

    private Long id;

    private String entityName;

    private String propertyName;

    private Long entityId;

    private String event;

    private String oldValue;

    private String newValue;

    private Timestamp dateCreated;

    private Long userId;

    private Object entity;

    public AuditTrail() {

    }

    public AuditTrail(Object entity, String event, String className,
            String propName, Long entityId, String oldVal,
            String newVal, Long userId) {
        this.entity = entity;
        this.event = event;
        this.entityName = className;
        this.propertyName = propName;
        this.entityId = entityId;
        this.oldValue = oldVal;
        this.newValue = newVal;
        this.userId = userId;
    }

    @Id @GeneratedValue(strategy=GenerationType.AUTO)
    public Long getId() {
        return id;
    }

    public void setId(Long id) {
        this.id = id;
    }

    @Column
    public String getEntityName() {
        return entityName;
    }

    public void setEntityName(String entityName) {
        this.entityName = entityName;
    }

    @Column
    public String getPropertyName() {
        return propertyName;
    }

    public void setPropertyName(String propertyName) {
        this.propertyName = propertyName;
    }

    @Column
    public Long getEntityId() {
        return entityId;
    }

    public void setEntityId(Long entityId) {
        this.entityId = entityId;
    }

    @Column
    public String getEvent() {
        return event;
    }

    public void setEvent(String event) {
        this.event = event;
    }

    @Column
    public String getOldValue() {
        return oldValue;
    }

    public void setOldValue(String oldValue) {
        this.oldValue = oldValue;
    }

    @Column
    public String getNewValue() {
        return newValue;
    }

    public void setNewValue(String newValue) {
        this.newValue = newValue;
    }

    @PrePersist
    public Timestamp getDateCreated() {
        return dateCreated;
    }

    public void setDateCreated(Timestamp dateCreated) {
        this.dateCreated = dateCreated;
    }

    @Column
    public Long getUserId() {
        return userId;
    }

    public void setUserId(Long userId) {
        this.userId = userId;
    }

    public void setEntity(Object entity) {
        this.entity = entity;
    }

    @Transient
    public Object getEntity() {
        return entity;
    }

}

Sugar custom logic hook

2010-04-13T13:47:00.001-07:00

Hooks for modules
Define hooks in custom/modules/<module_name>/logic_hooks.php
Event type
before_save
after_save
before_restore
after_restore
process_record ------ when loads a row of data into instance of a bean
before_retrieve ------ fetches a single row of data given the primary key
after_retrieve

Generic Hooks
Generic hooks should be defined in custom/modules/logic_hooks.php
Event Type
after_ui_frame
after_ui_footer

Well-known Java System Properties

2010-03-24T12:54:00.001-07:00

For security manager:

-Djava.security.manager              //To enable java security manager
-Djava.security.policy=mypolicy      //specify the location of policy file
//This can be replaced by adding a line like policy.url.3=file:/C:/Test/mypolicy into file <Java_home>\jre\lib\security\java.security.

For SSL Connection:
-Djavax.net.debug=ssl                               //Enable ssl debug information
-Djavax.net.ssl.keyStore=/path/to/client.ks     //specify the location of key store
-Djavax.net.ssl.keyStorePassword=password    //password for keystore
-Djavax.net.ssl.trustStore=/path/to/client.ts    //specify the location of trust store

For java.util.logging (See more detail)
-Djava.util.logging.config.class
-Djava.util.logging.config.file        //Location of the configuration file, by default JVM will read <Jre_home>lib/logging.properties

-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager

-Djava.endorsed.dirs=/opt/apache-tomcat-6.0.26/endorsed  //The Java SE runtime environment will use classes in such JAR files 
                                                                                 //to override the corresponding classes provided in the 
                                                                                 //Java platform as shipped by Sun.

Use SSL in Java

2010-03-24T11:37:00.001-07:00

The default password for the Java default keystore file $JAVA_HOME/lib/security/cacerts is 'changeit'

Setting up the Key and Trust Stores

Using Java keytool, create a certificate for the Server:

keytool -genkey -alias broker -keyalg RSA -keystore broker.ks

Export the broker's certificate so it can be shared with clients:

keytool -export -alias broker -keystore broker.ks -file broker_cert

Create a certificate/keystore for the client:

keytool -genkey -alias client -keyalg RSA -keystore client.ks

Create a truststore for the client, and import the broker's certificate. This establishes that the client "trusts" the broker:
```
keytool -import -alias broker -keystore client.ts -file broker_cert
```

Starting the Server

Using the javax.net.ssl.* System Properties

Before starting the broker's VM set the SSL_OPTS enviorment variable so that it knows to use the broker keystore.

export SSL_OPTS = -Djavax.net.ssl.keyStore=/path/to/broker.ks -Djavax.net.ssl.keyStorePassword=password

Starting the Client

When starting the client's VM, specify the following system properties:

javax.net.ssl.keyStore=/path/to/client.ks
javax.net.ssl.keyStorePassword=password
javax.net.ssl.trustStore=/path/to/client.ts

How to change default sugar report entries per page?

2010-03-22T09:15:00.000-07:00

Sugar read variable list_report_max_per_page from config.php, but this variable doesn't exist in that file by default. So simply add 'list_report_max_per_page' => 500, into config.php to change sugar report entries per page.

Hibernate Annotation and MultipleHiloPerTableGenerator

2010-02-26T21:16:00.000-08:00

This is the example of how to define hilo generator by using annotation that I found in Hibernate Annotation document.

@Id @GeneratedValue(generator="hibseq")
@GenericGenerator(name="hibseq", strategy = "seqhilo",
    parameters = {
        @Parameter(name="max_lo", value = "5"),
        @Parameter(name="sequence", value="heybabyhey")
    }
)
public Integer getId() {

But when I apply to MultipleHiloPerTableGenerator, I always get exception. The way I do is like below.

@Id @GeneratedValue(generator="hibseq")
@GenericGenerator(name="hibseq", strategy = "org.hibernate.id.MultipleHiloPerTableGenerator",
    parameters = {
        @Parameter(name="max_lo", value = "100"),
    }
)
public Integer getId() {

Since no short name for MultipleHiloPerTableGenerator, I have to put the full class name into strategy according to documentation. The reason we use this generator is based on following reasons.We often have huge amount of insertion jobs, like inserting 1M records in one operation. If we use auto-increment primary key, what Hibernate does is issue a database access to get the id when you call save(object) method, then 1M insert statement will generate 2M database access, which extremely slows down the process. MultipleHiloPerTableGenerator use a table(default name is hibernate_sequences) to save a hi value for each entity that use this generator. It uses a separate session to retrieve the hi value, at the same time update the hi value to current hi + max_lo, when the save(object) is called, it assigned the id as hi plus sequence number, the max value of sequence number is defined by property max_lo. If the sequence number reaches to the max, the generator will retrieve another hi value. In a short explanation, each session gets pre-assign a chunk of id pool. So, this generator can reduce the time consumption on retrieving id. When the insertion is huge, it saves a great deal of time.

The correct way is to add strategy attribute for @GeneratedValue. To modify the annotation like this.

@Id @GeneratedValue(generator="hibseq", strategy=GenerationType.TABLE)
@GenericGenerator(name="hibseq", strategy = "org.hibernate.id.MultipleHiloPerTableGenerator",
    parameters = {
        @Parameter(name="max_lo", value = "100"),
    }
)
public Integer getId() {

Easy, but I spent a whole afternoon tracing the Hibernate source code to find that out.

How does SSL work?

2009-12-03T12:47:00.001-08:00

How Does SSL Work?

Every modern web browser has built into it a very sophisticated encryption system that allows secure "conversations" with webservers equipped with an SSL secure server (See endnote).

This is about to get pretty technical so I am simplifying it greatly. If you find your eyes glazing over, don't worry. The main message here is that SSL ensures an encrypted communication between the customer's web browser and the merchant's webserver. This produces both customer confidence and a very secure communication system. Use it!

But some of you want to know how it works, so here goes.

Keys and Identities

You remember the Decoder Ring you found in a cereal box when you were a kid? It consisted of a wheel with the alphabet on each of two rotating discs. If you someone sent you a message where the "key" is A=L, you'd set the A above the L, and then determine that B=M and C=N, etc. Modern cryptography uses a very complex algorithm or formula to encode messages using a key. Rather than A=L, the key will be very large number used to scramble the text. If you were to give the key to your friend, he would be able to decode the messages you encode with it and visa versa.

Two problems present themselves, however, when you don't have face-to-face contact with a trusted friend.

Who is your friend and who is the evil hacker? The Internet is a anonymous place where people are not always whom they seem. If you've spent any time in chat rooms, you know that "Pixiebabe" just might be a middle-aged man in Toledo. How do you know that you're speaking to the real online store, or just a mimic of it? That's where a Digital Certificate comes in, to identify the store as authentic, verified by a trusted Third Party (called the Certificate Authority).
In addition, on the Internet you can't physically hand over a key, and whatever key you send electronically could be intercepted by an evil hacker. Enter a complex technology called Public Key encryption.

Private Keys and Public Keys

The way SSL solves this problem is to have two keys: a private key (that you never disclose to anyone) and a public key (which you may distribute freely to the general public). This is how it works: You send your friend your public key and he uses it to send you an encrypted message that only you can decode when you use your private key. Your friend can only encode the message; he wouldn't be able to decode it, since he only has your public key, not your private key. Confused yet?

You may be, but your web browser can keep it straight, and comes with the ability to encode and decode messages sent to and from an SSL-secure webserver.

Getting to Know You

The merchant's in-house webserver (or the merchant's web hosting service) has a Digital Certificate or Digital ID that identifies it as the authentic owner of a certain domain name. The Digital Certificate contains the several pieces of information, including the merchant's public key, signed by the Certificate Authority (such as VeriSign).

The customer's web browser has built into it a list of recognized Certificate Authorities (such as VeriSign) and their unforgeable digital signatures, so it can verify if a merchant's Digital Certificate is valid or a forgery.

Now the customer's web browser and the merchant's website begin a getting-to-know-you exchange, kind of like fax machines squawking as they're getting in synch with each other. Here are some of the important steps in this mating ritual:

The customer's web browser requests a secure page, such as https://www.yourcompany/orderform.htm
The merchant's webserver responds by sending the customer's web browser the Digital Certificate containing all its information.
The customer's web browser checks to be sure that the Digital Certificate is valid, hasn't expired, and matches the Certificate's domain name and the list of digital signature of Certificate Authorities the web browser has on file. Then it replies by encrypting a message using the merchant's public key. In this message will be a unique Session Key generated by the web browser from a random number.
The merchant's webserver decodes the unique Session Key using the merchant's Private Key. Now both the customer and the merchant have the same unique Session Key. If you were an evil hacker listening in, you could hear both the messages from the webserver and the customer, but you couldn't decode the customer's message to the webserver, since you don't possess the merchant's Private Key. (I'm skipping over some other checks performed at this time.)

Now the merchant's webserver uses the unique Session Key to encode a message to customer's webserver, and visa versa. The two are in step and the dance has begun, dancing to a tune that only they can hear. They can whisper sweet nothings to each other encoded with this unique Session Key, and no one can tell what they're saying.

So long as the evil hacker can't guess the unique Session Key, he can't decode the messages being passed back and forth. It is gobbldy-gook so far as he is concerned. Now the customer can give his credit card number safely and the web server can echo it back for verification without any chance of an evil hacker kidnapping it on the way by.

That's how SSL works. Actually that's the kindergarten version of an extremely complex subject. But I hope it's enough to give you some confidence in the process. It really works quite smoothly and securely.

Note: SSL stands for "Secure Sockets Layer." "Socket" is a technical term that refers to an application programming interface, or API, which is used to communicate between two computers. "Layer" refers to the level or layer of this communication between the computers.

Part 1	Header	eyJraWQiOiJyc2ExIiwiYWxnIjoiUlMyNTYifQ	{ "kid": "rsa1", "alg": "RS256" }
Part 2	Payload	eyJzdWIiOiJlNWI2NTIzZC02OWVmLTQ0NjItYmYxOC1mZTUwNDg 1ZTJiMTAiLCJhdWQiOiIxMTE3NTkyMi1hNmI5LTRmMGQtOGY3Zi 1mNzg3ZGM2ZGJmNDkiLCJhdXRoX3RpbWUiOjE0ODM4OTYyM zEsImtpZCI6InJzYTEiLCJpc3MiOiJodHRwczpcL1wvd3d3Lm1hcG xlLmNvbVwvb2lkYyIsImV4cCI6MTQ4Mzg5NzY2NywiaWF0IjoxND gzODk3MDY3LCJub25jZSI6IjExZmU2NWZiZDM1YmIiLCJqdGkiO iJmN2M4NzZhNC0yZmQzLTQwMWEtODc4Ni01MGEyYWQwZjU5 MjEifQ	{ "sub": "e5b6523d-69ef-4462-bf18-fe50485e2b10", "aud": "11175922-a6b9-4f0d-8f7f-f787dc6dbf49", "auth_time": 1483896231, "kid": "rsa1", "iss": "https://www.maple.com/oidc", "exp": 1483897667, "iat": 1483897067, "nonce": "11fe65fbd35bb", "jti": "f7c876a4-2fd3-401a-8786-50a2ad0f5921" }
Part 3	Signature	RL_48lqbsAzJfaRK5y-sE-CAcMS5x1nIegI-rIbEg2fcUTpV-jprxLDBcKclBB-uz7XdblNtOMLYz4UKUwregxV16sMaYKB0QOMpbt7VXi-Tlarg7lQZMuwCnh3-pDR7i2Bd1mChkB02NHzB3GZxNYj7z1jQG5upiHAqGGiqOaw	HMACSHA256(base64enc(header) + '.' + base64enc(payload), secretKey)

Mojo

Kids Videos with Time Control

Kids Videos with Time Control

Privacy Policy

OpenId Connect Quick Start

Quick review of OAuth 2

How to request an access_token from Authorization Server?

The REST-like authorization endpoint is for requesting access_token, but it could be two steps of getting access_token. When the authorization endpoint triggers two steps flow, the token endpoint is for finally getting the access_token.

Authorization endpoint

Token endpoint

What OAuth 2 provider is not?

OpenId Connect is an Authentication Layer on top of OAuth 2 for Client Applications

Response type in Authorization endpoint

Grant Types in Token endpoint

3 Authentication Flows

Different response_type presented within authorization endpoint determines different authentication flow.

Comparison of 3 different Authentication Flow

Authorization Code Flow

Implicit Flow

(As reference only, it can be very different based on different combination of response_type)

Hybrid Flow

(As reference only, it can be very different based on different combination of response_type)

ID Token

JWT (JSON Web Token)

Claims

Claims is the information about a user.

There are 3 types of claims

There are 2 ways to retrieve claims

Request Claims from Scope. The each scope can have claims associated with.Request claims with claims "request parameter" or "claim parameter" in the authorization endpoint.

There are 2 ways of returning the claims

Claim parameter in Authorization endpoint

Request parameter in Authorization endpoint

OpenId Connect Protocol Suite

Get ViewPager's current fragment

KidzTube - A kids friendly YouTube player App

Why is Fetch(join) is not working with HQL?

Hibernate Fetch plan and Fetch Strategies

Make log4j display which file it used to configure itself?

Could not create plugin of type 'MatrixTestingPlugin'

Very quick takeout of Gradle

Understand most basic concepts of Encryption

How to query on key of map collection in Hibernate?

Matrix Parameters and Query Parameters

SwitchingToUbuntuFromLinuxRedHatEnterpriseLinuxAndFedora

Administrative Tasks

Package Management

Graphical Tools

Command Line Tools

Table of Equivalent Commands

Services

Graphical Tools

Command Line Tools

Network

Graphical Tools

Command Line Tools

Centering a Div in IE8 Using margin:auto

Width:100%

Text-Align:Center

Use Transitional Doc Type

How to reset Mirth admin user.

A JAAS LoginModule for ActiveMQ

Configurable Auditing Interceptor for Hibernate

Sugar custom logic hook

Well-known Java System Properties

Use SSL in Java

The default password for the Java default keystore file $JAVA_HOME/lib/security/cacerts is 'changeit'

Setting up the Key and Trust Stores

Starting the Server

Using the javax.net.ssl.* System Properties

Starting the Client

How to change default sugar report entries per page?

Hibernate Annotation and MultipleHiloPerTableGenerator

How does SSL work?

How Does SSL Work?

Keys and Identities

Private Keys and Public Keys

Getting to Know You

Request Claims from Scope. The each scope can have claims associated with.
Request claims with claims "request parameter" or "claim parameter" in the authorization endpoint.