Zheng Tech Blog

Logging Actual Client IP Address on the Apache Server

2020-10-23T11:16:00.008-05:00

To extract and log the actual client IP address from the X-Forwarded-For header of a request using an Apache server, make the following changes to the server:

Log into the Apache server.
Go to /etc/httpd/conf or /usr/local/apache2/conf path and open the file httpd.conf.
Search for the string: “LogFormat “%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined”
Change the %h to %{X-Forwarded-For}i. The string now appears as “LogFormat "%{X-Forwarded-For}i %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined”
Save the file and restart apache or httpd.

Command Line for Making EAR/WAR/JAR Changes on the Fly

2020-07-19T12:21:00.001-05:00

Extracting the Contents of the EAR

To extract the contents of the EAR:

Navigate to the directory containing the EAR, ear-file.
On the command line, enter the following to view the contents of the EAR:
```
jar tf ear-file
```
On the command line, enter the following to extract the contents of the EAR:
```
jar xf ear-file
```

Updating and Repackaging an EAR File

To update a file and repackage the contents into an EAR file:

Navigate to the base directory of all the files and folders that are to be part of the EAR.
On the command line, enter the following to extract the contents of the EAR:
```
jar cf ear-file input-files
```
For example,
```
jar cf myear.ear *
```

Implementation of ADF XML Menu Model

2020-04-01T12:38:00.002-05:00

This post will cover the coding details of implementing an ADF XML menu model.

Do you need to manage all your navigation menus in a centralized file including its label, URL, title and other custom attributes you may have? If so, the solution is to use ADF XML menu model.

ADF XML menu model is the same concept as the built in WebCenter Navigation Model in Oracle WebCenter Portal. It uses a XML file to hold the navigation metadata - id, label, title, destination/url and other custom attributes you may need.

The XML file is the data model layer. Using XML menu, you can generate various kinds of navigation user interface components, such as navigation links, bars, tabs, breadcrumbs, etc. You can also apply business logic to conditionally control the rendering of the navigation menu. The business logic including security can be applied at either the XML model layer or the UI presentation layer depending on where it fits your purpose. You can create multiple navigation hierarchy (nested navigations) in your XML menu model.

Without further ado, here are the details you like to know on implementation of such XML menu model in ADF application.

1. Create ADF Menu Model

ADF menu model is created on top of the unbounded task flow in application. By default one application comes with one unbounded task flow, but you can create additional if needed. If you have a use case requiring different independent sets of menu models, then you should create additional unbounded task flows as the unbounded task flow and menu model go as 1 to 1. At ADF runtime, multiple unbounded task flows will be compiled into one for the application they sit in.

Select the target unbounded task flow, right click on it and select "Create ADF menu model...". It would create an XML file placeholder.

2. Update Model with Your Data

The generated xml file is where you need to compile your navigation data. It comes with a top level "menu" element and inside it, it can be "itemNode", "groupNode" or "sharedNode".

itemNode: Specifies a node that performs navigation upon user selection. An itemNode can have children itemNodes.
groupNode: Groups child components; the groupNode itself does no navigation. Child nodes node can be itemNode or another groupNode.
sharedNode: References another XMLMenuModel instance. A sharedNode element is not a true node; it does not perform navigation nor does it render anything on its own.

An itemNode comes with a variety of build-in metadata. But they still can fall short for your use cases. A good thing about this model is you can create as many as custom attributes as needed. For example:

As exampled, you can use expression language as the attribute values.

3. Create Managed Bean for the Menu Model

During step 1, when creating the ADF menu model, a managed bean for XMLMenuModel will be automatically configured in faces-config.xml. This is all good if you don't have any custom attributes in the menu model. But in case you do, here is the info you like to refer to.

Create a Java bean extending "org.apache.myfaces.trinidad.model.XMLMenuModel", and in the bean, you will need to cover some key methods to expose the navigation node and custom attributes. Here is a pretty comprehensive example:

  private static Object getNodeById(XMLMenuModel menuModel, String nodeId) {
    Object returningNode = null;
    
    FacesContext context = FacesContext.getCurrentInstance();
    ELResolver resolver = context.getApplication().getELResolver();
    ELContext elContext = context.getELContext();

    if (menuModel == null) {
      return returningNode;
    }

    for ( int i = 0; i < menuModel.getRowCount(); i++)
    {
      menuModel.setRowIndex(i);
      Object parentNode = menuModel.getRowData();
      String parentNodeId = resolver.getValue(elContext, parentNode, "id").toString();
      if (parentNodeId.equals(nodeId)) {
        returningNode = parentNode;
        break;
      }

      if (menuModel.isContainer() && !menuModel.isContainerEmpty())
      {
        menuModel.enterContainer();
        for ( int j = 0; j < menuModel.getRowCount(); j++)
        {
          menuModel.setRowIndex(j);
          Object childNode = menuModel.getRowData();
          String childNodeId = resolver.getValue(elContext, childNode, "id").toString();
          if (childNodeId.equals(nodeId)) {
            returningNode = childNode;
            break;
          }
        }
        menuModel.exitContainer();
      }
    }
    return returningNode;
  }

  public static String getUrlById(String nodeId) {
    PortalMenuModel menuModel = (PortalMenuModel)ADFUtils.evaluateEL("#{portal_menu}");
    Object node = getNodeById(menuModel, nodeId);

    if (node == null) {
      return "";
    }

    String url = menuModel.getCustomProperty(node, "url").toString();
    url += "&" + getNodeIdUrlParam(node);
    return url;
  }

  public Map<String, String> getUrlById() {
      return new HashMap<String, String>() {
          @Override
          public String get(Object key) {
              String str = (String)key;
              str = getUrlById(str);
              return str;
          }
      };
  }

  public static String getLabelById(String nodeId) {
    PortalMenuModel menuModel = (PortalMenuModel)ADFUtils.evaluateEL("#{portal_menu}");
    Object node = getNodeById(menuModel, nodeId);
    
    if (node == null) {
      return "";
    }
    
    FacesContext context = FacesContext.getCurrentInstance();
    ELResolver resolver = context.getApplication().getELResolver();
    ELContext elContext = context.getELContext();
    return resolver.getValue(elContext, node, "label").toString();
  }

  public Map<String, String> getLabelById() {
      return new HashMap<String, String>() {
          @Override
          public String get(Object key) {
              String str = (String)key;
              str = getLabelById(str);
              return str;
          }
      };
  }

  public static String findURLByIdWithContextRoot(String nodeId) {
      return HTTPUtils.getContextPath()+getUrlById(nodeId);
  }

  public static void redirectToPageLinkId(String nodeId) {
      FacesContext fctx = FacesContext.getCurrentInstance();
      ExternalContext ectx = fctx.getExternalContext();
      try {
          String url = getUrlById(nodeId);
          ectx.redirect( HTTPUtils.getRequest().getContextPath() +  url); 
          fctx.responseComplete();
      } catch (IOException e) {
          logger.error("Exception occurred in PortalMenuModel while redirecting without url params:" + e.getMessage());
      } 
  }

  public static void redirectToPageLinkId(String nodeId, Map<String,String> urlParam) {
      FacesContext fctx = FacesContext.getCurrentInstance();
      ExternalContext ectx = fctx.getExternalContext();
      try {
          Iterator<String> paramIterator = urlParam.keySet().iterator();
          StringBuilder sb = new StringBuilder();
          while(paramIterator.hasNext()) {
              String key = paramIterator.next();
              sb.append("&"+ key + "=" + urlParam.get(key) );
          }
          String url = getUrlById(nodeId);
          ectx.redirect( HTTPUtils.getRequest().getContextPath() +  url + sb.toString()); 
          fctx.responseComplete();
      } catch (IOException e) {
        logger.error("Exception occurred in PortalMenuModel while redirecting with url params:" + e.getMessage());
      } 
  }

  public static String getNodeIdUrlParam (Object node) {
    FacesContext context = FacesContext.getCurrentInstance();
    ELResolver resolver = context.getApplication().getELResolver();
    ELContext elContext = context.getELContext();

    String nodeIdParam = resolver.getValue(elContext, node, "uniqueId").toString();
    return NODE_ID_PARAM + "=" + nodeIdParam;
  }

In the example, the menu model instance is retrieved by expression "#{portal_menu}" which you can define it in the unbounded task flow in a request scope.

4. Render the Navigation on UI

The last step is to put the XML menu model data reference into the UI layer. There are quite a few different UI components that can be used for this. Here is the cheat sheet for the ADF menu components.

Alternatively, you can use <af:iterator> to iterate through the menu model and render them using a simple go link. For example:

<af:iterator var="node" id="i1" value="#{portal_menu}">
  <af:goLink destination="#{portal_menu.urlById[node.id]}">
    <af:outputText id="ot1" value="#{Bundle[node.customPropList['navTitle']]}" escape="false"/>
  </af:goLink>
</af:iterator>

Setup Okta Custom URL Domain

2020-03-28T13:36:00.001-05:00

TL:DR

In this post, I will walk through the information and steps required to setup Okta custom domain. It also reveals the issues that may get in the way and how to address them.

Okta is a leading cloud IAM solution and offers a free developer account. Anyone can register and use its service as long as the active monthly user count doesn't go over 1000 in the developer's account. After registration, Okta will assign an URL domain in a format of "https://dev-xxxxxx.okta.com" (xxxxxx is a random number assigned), where you can login and manage your own Okta services. If you are a paid customer, then you would be able to choose a custom naming in such way as "https://custom.okta.com".

It's essential to setup a custom URL domain so that your Okta domain would look like a subdomain of your own such as "https://login.mydomain.com". Setting up a custom domain would provide you:

Use custom domain as the issuer for the Okta default or custom authorization server so that you can have the authorization process appears as the same domain as your web application
Customization of Okta SignIn widget and this cannot be done without a custom domain
Not necessarily exposing Okta as your IAM solution vendor

The prerequisite of setting up custom domain for your Okta account are:

Ownership of the domain and sub-domain to serve as the Okta custom domain
HTTPS/TLS certificate, private key and chain files that to be applied to your domain and sub-domain. The private key has to be PEM encoded in 2048 bits.

Most of the website management services such as Wordpress or hosting services such as Netlify, GoDaddy would provide the HTTPS out of the box for your site using "Let's Encrypt", but they would not allow to download the certificates behind the site. And, neither can you gain shell access to the servers to create and install your own certificates. Then the only option it leaves out is to create the certs in your own machine and upload them to the hosting servers, which most of the vendors would be able to provide on their management panel.

ZeroSSL is a free SSL tool just does the HTTPS/TLS certs generation. ZeroSSL offers the online tool to generate certificates and the private key. But the online tool only generates 4096-bit private key and Okta requires the private key to be PEM encoded in 2048 bits. Therefore we will have to download the tool and generate them manually with custom options.

Generate Certificates and Keys

Here are the steps required to creates HTTPS/TLS certs for your hosting site as well as Okta for custom URL domain.

1. Download ZeroSSL tool. For simplicity, take the windows version as it's portable and requires no installation at https://github.com/do-know/Crypt-LE/releases

2. Generate certs and keys using the following command:

.\le64.exe --key account.key --csr mydomain.csr --csr-key mydomain.key --crt mydomain.crt --domains "login.yourdomain.com,yourdomain.com" --generate-missing --handle-as dns --legacy --api 2 --live

Explanation:

account.key: account private key
mydomain.key: domain private key. account.key and mydomain.key are private keys and can be generated using openssl. The downloaded tool "le" can also generate them.
mydomain.csr: certificate signing request file for the domain requested
mydomain.crt: certificates for the domain requested
mydomain.ca: not in command line but will be generated at the end as option "--legacy" is used. This is called the issuer's certificate file, or CA certificate or intermediate cert.
handle-as dns: this option asks for domain verification instead of http verfication. Http verification will generate two files which need to be uploaded to your website. Domain verification option will generate challenge key/value pair for TXT record verification on your domain.
generate-missing: this option will generate specified files if they don't exist yet
legacy: this is important and it's mandatory to successfully upload generated certs to Okta custom domain setup. As Okta requires 2048 bit key, legacy option will result in using 2048 bit key and placing the issuer's certificate separately in its own .ca file.
api 2: this option will use version 2 API. Wildcard in domain is only supported in v2.0 such as "*.mydomain.com"
live: this option is used to run the actual generation process. It's advised to "test" the process without the live option first.

Check https://zerossl.com/usage.html for more reference if needed.

During the process, the command will generate two challenge key/value pairs as two domains (sub-domain and main domain) are defined in the command. The key/value pairs need to be inserted to your domain management using TXT record for verification. Only after the domain is verified, the subsequent certs can be generated successfully.

After the certs are generated, first thing to do is to update them in your own domain. Next I will show how to config the custom domain in Okta.

Note that the generated certs will expire in 90 days. It's important to renew the certificates a few days before it expires. Auto renew can be setup only if the shell access is available to your domain servers.

Config Okta for Custom URL Domain

Login your Okta account, and switch to "Developer Console" if you are in the Classic UI mode, by clicking the top left dropdown list.

Go to menu Customization and then "Domain Name", and Click on "Edit"

Click on "Get Started"

Enter the sub-domain that is used for Okta custom domain. In the example it is "login.mydomain.com"

Okta will generate a TXT record to be inserted to your domain for verification. After inserting the TXT record, click on "Verify". It will show "Verified".

Copy/Paste the certificate and key generated in the previous step. In this example,

Certificate: mydomain.crt
Private Key: mydomain.key
Certificate Chain: mydomain.ca

Make the custom domain as an alias for your Okta sign in host by creating a "CNAME" in your domain management.

Click "Finish" and then it completes the setup of custom URL domain.

With custom URL domain setup complete, I can login the Oka account by visiting the custom domain.

Note the "Not Secure" certificate warning is supposed to be cleared away in 48 hours after Okta propagates certificates over to the custom domain, but it could take longer in reality.

Now I can customize the sign in page to tailor it to my own brand, look and feel, etc. From the Okta menu, go to Customization and then "Signin Page".

I am also able to use the custom domain as the issuer for the Okta default or custom authorization server so that any clients assigned to the authorization server will go through the custom domain instead of okta domain.

To update your web app to use the custom authorization server, switch to "Classic UI", go to your application setup and Sign on page. Edit the OpenID Connect ID Token section, and choose the custom domain as the issuer. Now your application sign-in process will go through the custom domain.

This ends the complete process of setting up Okta custom domain.

About adfc_diagram files in ADF

2020-03-23T10:51:00.000-05:00

In short, files that end with "adfc_diagram" file type are metadata files to keep track of element position in an ADF task flow.

ADF task flow offers a process-flow like visual panel for developers to re-position the elements (page/fragment, router, Java bean methods, etc). The file ending with "adfc_diagram" is the one tracking the positions of all elements so that next time the task flow is open the saved visual positions are presented.

Another blog spot on the same matter:

http://javalopez.blogspot.com/2015/03/should-i-commit-adfcdiagram-files.html

Full Screen Youtube Video on Play - React

2020-03-21T12:24:00.000-05:00

Youtube video is ubiquitous. Embedding Youtube videos into a web page is as straightforward as it sounds. What also seems natural is to full-screen the video on touching the play icon of the video on mobile devices. This feature is important for mobile user experience as the full screen control is quite small to "aim".

Google results on this topic showed many people had been looking for a solution on this and couldn't get a simple way to work out, as Youtube doesn't provide an API to full screen videos.

In this post, I am showing a relatively simply way to achieve this user experience with fairly few lines of code. Code example is shown below.

In the example, I use React as there are many nice plugins ready to start. Here is a list of them:

screenfull: a simple wrapper of cross browser JavaScript implementation of full screen API. https://www.npmjs.com/package/screenfull
device-detector-js: a way of detecting user device with a wide range of device coverage. https://www.npmjs.com/package/device-detector-js
react-youtube: a thin layer of implementation of Youtube iframe player API. https://www.npmjs.com/package/react-youtube

 import React from "react";  
 import screenfull from "screenfull";  
 import YouTube from "react-youtube";  
 import DeviceDetector from "device-detector-js";  
 import PropTypes from "prop-types";  
 import { makeStyles } from "@material-ui/core/styles";  
 export default function YTPlayer(props) {  
  const dd = new DeviceDetector();  
  const mobile = dd.usesMobileBrowser();  
  const fullScreen = event => {  
   var iframe = event.target.getIframe();  
   if (screenfull.isEnabled) {  
    screenfull.request(iframe);  
   }  
  };  
  const opts = {  
   height: "100%",  
   width: "100%",  
   controls: "1"  
  };  
  const useStyles = makeStyles({  
   videoDiv: {  
    width: "100%",  
    height: "100%"  
   }  
  });  
  const classes = useStyles();  
  return (  
   <YouTube  
    containerClassName={classes.videoDiv}  
    videoId={props.id}  
    opts={opts}  
    onPlay={() => (mobile ? fullScreen : {})}  
   />  
  );  
 }  
 YTPlayer.propTypes = {  
  id: PropTypes.string  
 };

To use the above component, simply put the Youtube video id into it such as:

 <YTPlayer id="LjhCEhWiKXk" />

X11 doesn't work after sudo to another user

2019-11-15T09:43:00.005-06:00

This is kind of old trick but after years of not using X11 at all, I will need to refresh.

Most of the times at my client, linux access is given with my own user name with ability to sudo to a regular service user. On a need of X11 GUI, it's mandatory to add the authorization info of my own user name into the sudo user name so X11 window can be started on top of the sudo user.

But first of all, make sure the X11 forwarding is enabled by adding the following to /etc/ssh/sshd_config

X11Forwarding yes

Before the authorization info is added, the following error may show up in the terminal when trying to bring up X11 window.

X11 proxy: Authorisation not recognised

Here is how to add the authorization.

1. go back to the user who has access to the linux box and get the following info -

>> echo $DISPLAY
this will print out the display variable of the current user

>>xauth list
this will print out the authorization info to connect to the X server of the current user

2. sudo to the service user

>> export DISPLAY=Value_from_step_1

>> xauth add auth_info_from_step_1

3. test use "xclock"

JDBC Connection Leak in ADF app on a WebLogic Server

2019-08-26T11:40:00.000-05:00

It's an old topic but worthy to post as it happens frequent enough in codes that I observed.

The bottom line of the issue that I am going to describe here is a coding issue, to it applies to WebLogic 11g as well as 12c.

An ADF app deployed on a remote WebLogic Server went to an error page frequently. Checking the log, I found it's complaining on "JBO-26061: Error while opening JDBC connection". The next thing I did is checking the data source of the ADF App configured on the WebLogic Server console.

On the Data Source -> Monitoring -> Statistics, the "Active Connection Average Count", "Active Connections Current Count" and "Active Connection High Count" all showed "15", which is the default max capacity of a connection pool. This shows all the connections are taken and no more connection available. I go to Monitoring -> Testing, select on the affected server and click on "Test Data Source", such error will shown "weblogic.common.resourcepool.ResourceLimitException: No resources currently available".

At this moment, it's pretty clear that the ADF App takes all the connections and not releases them properly. In another word, there could be a JDBC connection leak. There is a column "Leaked Connection Count" in the same table as "Active Connections Current Count". It is showing "0" but don't let it fool you as it's no magic for the console to tell you there is a leak right now without doing some tweaking.

Now go to the data source Configuration -> Connection Pool, expand "Advanced", there will be a setting for "Inactive Connection Timeout" with default "0". As soon as I set it for "15", I started to see the "Leaked Connection Count" start to grow. This "15" means after "15 seconds" of the server detecting an idle JDBC connection, it forcefully release the connection back to the pool and then mark it as a leaked connection.

The culprit of the issue still resides in the application. Do a search for "connection" or "statement" in the application (model layer) and see if there is any usage of manual creation of any connection, statement or result set object without properly closing them.

A document reference on properly closing JDBC objects : https://docs.oracle.com/cd/E13222_01/wls/docs103/jdbc/troubleshooting.html#wp1024080

CONCUR INTEGRATION WITH INFORMATICA CLOUD: A TECHNICAL REVIEW

2018-05-30T16:20:00.004-05:00

Article originally published here.

Concur is one of the industry’s most widely used travel and expense management solutions, used by more than 32,000 organizations globally. For companies that are implementing or have implemented Concur, one critical step necessary to fully unleash the power of the platform is the integration process.

After implementing Concur, companies often spend a large amount of time on tedious manual work, such as adding new users on new hire events, user off-boarding, manager changes, department changes, etc. These "maintenance" tasks seem trivial at first, but they actually require a major time commitment from Concur administrators, who could be focusing on other critical tasks. Besides, managing Concur’s interaction with other systems, such as HR or financial ledger platforms, introduces more challenges, as these tasks are not straightforward and solutions are not directly provided by any of the applications involved in the integration.

Does this sound familiar? Many companies experience these challenges on a daily basis. Without a sound integration solution in place, managing such a powerful and efficient travel and expense system can be challenging.

Informatica Cloud is the industry-leading integration platform-as-a-service (iPaaS) and data management solution, designed to connect with enterprise-ready data and applications across cloud, on-premise, big data, social, and mobile environments. Primitive Logic is proud to be an award-winning Informatica Partner (Outstanding Partner of the Year 2016, Cloud Emerging Growth Partner of the Year 2015), with experience implementing hundreds of integrations. In this article, I’ll share our experience and the technical insights we gained in leveraging Informatica Cloud for successful Concur integrations.

Understand Integration Goals

When it comes to data integration, regardless of the applications involved, your first task is to understand the business and technical goals you want to achieve. You’ll also want to consider the other applications that will have to integrate with Concur.

To better understand the business goals of the integration — and the challenges involved — consider the following questions:

What business value (or return of investment) will this integration bring, in both the short and long term?
What is the current process we’re looking to integrate? What are the pain points?
What's the end state of this automated integration? Are we looking to roll out the integration in phases?

Gaining a better understanding of your business goals and how they align with technical needs is an important first step in designing a solid integration approach. To understand your technical needs, consider the following questions:

What are the data objects involved with the integration? Specifically, what types of data (data attributes on these objects) are involved? Are they structured, semi-structured, or unstructured?
How should the integration be triggered — real-time, event-based, scheduled, or on-demand?
What's the size of the data in scope? Will we need to run the integration in bulk mode?
How do we want to be notified on the outcome of the integration, and what information should this notification include?
How would this integration recover from exceptions — human intervention, auto-recovery, or a combination of both?

Answering these questions will help you further define the scope of the integration process and narrow down your design options for satisfying your requirements and achieving your goals.

Match the Approach to the Need

Let’s review the integration options around Concur — the thoughts behind each option, the reasons why each should be used in different scenarios, and how each ties back to the business and technical needs we discussed in the previous section.

Concur Connectors by iPaaS

Most iPaaS offerings provide pre-built application connectors that are ready to use — an important consideration when choosing your platform. Informatica provides two versions of Concur connectors, ConcurV1 and ConcurV2.

It's rare for a provider to offer multiple versions of connectors at the same time; however, with Concur connectors, there is a good reason for it. Most connectors are built by the iPaaS vendor on top of the API offered by the solution provider. Concur, as the solution provider, has multiple versions of its API (Concur API Portal) running at the same time for different sets of functions. That's why we see two versions of Concur connectors from Informatica.

It's essential to understand which Concur data objects are in the scope of your integration, as you can then evaluate the right connector for the right operation for these objects. For example, for the User object in Concur, different API endpoints offer different sets of functions:

Version 1 API offers three operations on the User object: read, create, and update. It also supports updating the user password (separate from other User attribute updates).
Version 3 API offers only the search operation on the User object. (Note: There is no Version 2 API for the User object.)

As noted, the two versions of API for User objects are designed for different services. Version 3 API provides robust search capability, while only limited user information can be retrieved in the output. Version 1 API on the User object is not as performant as Version 3, but provides a full span of user information with read, update, and create capabilities. To match the Concur connectors, Informatica wraps the Version 1 User API in ConcurV1 and Version 3 in ConcurV2.

As you can see, Concur Rest API is the backbone of all Concur connectors. However, since Concur connectors do not inherit all API functions, they pose several limitations:

Connectors lack support for custom attributes. Going back to the example of the User object in Concur, if you create a user with additional custom attributes that are not listed in the API reference doc, the connector will not work.
The connector can only deal with one object at a time. If you update users and user profiles in sequence (a common use case), the connector will not work.
Connector provisioning always incurs a licensing cost.

Concur Rest API

If you encounter limitations using Concur connectors for the above use cases, you may want to work with the Concur Rest API directly and design customized solutions to address your specific use cases.

Advantages of working with the Concur Rest API include

Custom Attributes: It’s common to set up custom attributes in Concur to fit records into your business use cases, which leaves the Concur Rest API as the only option for automating processes.
Working with Multiple Objects in Parallel or in Sequence: Most business processes involve multiple data objects. For example, for a new hire event, three objects need to be created: a user, a user profile, and a travel profile. The ability to orchestrate multiple object operations is critical for governing data integrity in an automated manner and keeping future maintenance work to a minimum.
Cost Reduction: As I mentioned above, each connector comes with a cost. Using generic connectors and the Concur Rest API or custom connectors (discussed in more detail below) are good alternatives to expensive application-specific connectors, leading to long-term savings.
Performance Benefits: With Rest API, you can choose to deal only with the data of interest instead of all data exposed by the API. This reduces the data size and results in improved performance of the overall transactions.

Informatica offers two options for implementing Concur Rest API:

Informatica Rest V2 Connector: This generic connector can be configured and set up to work with any Rest API endpoint. It supports a variety of authentication options and utilizes swagger definition to configure the data objects and operations involved in the transaction. The Rest connector can work as a source, a target, or a mid-stream in any typical integration operation of the Rest API call, such as read, write, or delete. It automatically converts hierarchy data from the application to relational data or vice versa, which can subsequently be used in downstream applications. (I recently published a technical talk with in-depth focus on the Rest V2 connector.)
Informatica Cloud Application Integration (ICAI, formerly Informatica Cloud Real Time): This option allows you to construct the Concur Rest API as a service in a service-oriented integration process, encompassing event processing, service orchestration and process management. ICAI allows you to streamline complex business use cases in a workflow-like process and invoke them in real or near-real time. As an output of the integration process, it also provides flexibility around custom error handling and customized notification content.

Concur SFTP

Concur SFTP can be used for both inbound and outbound integration, for data imports as well as exports. It is also a viable option for bulk data loads and extracts.

Concur SFTP works as either a source or a target within Informatica cloud integration and also interacts with other applications. You can implement it as a service in Informatica Cloud Application Integration and monitor it in real time, invoking an integration process upon a new file dropped on the SFTP site.

Although information on the data objects that the SFTP supports is not publicly accessible, it's clear that not all objects are supported. Concur SFTP is also an option with a relatively low cost.

Concur App Center Connectors

Concur manages a list of connectors in the Concur App Center, most of which were created by travel and expense partners. These connectors are designed mainly for consumers to import their personal data and aren't suitable for enterprise-level application or system integrations.

Avoiding Common Caveats

To conclude this overview, I'd like to share some caveats, or “gotchas,” that can complicate Concur integrations.

Skipping the Sandbox

To save on cost, some companies choose not to have a sandbox and to provision only the Concur production instance. This can create a problem, as Concur could be dealing with multiple sets of data that could become corrupted, and other integrated systems generally have both production and sandbox instances. By omitting the sandbox, you run the risk of production data becoming corrupted. Besides, certain objects in Concur cannot be deleted but only be disabled or set to “inactive.” This increases the amount of redundant, “noisy” data, which can be difficult to manage and may affect data integration with other systems, as data integrity will be compromised.

There is no ideal solution in this case other than getting a sandbox, even temporarily for integration design, development, and testing. Otherwise, specific considerations need to be taken on architecting and design to minimize the injection of redundant data — such as introducing a data flag to categorize individual transactions (update on existing data vs. create with new data) — so that we can reset these data accordingly after development and testing. Additionally, good planning is needed for test data to minimize the impact of the noisy data and avoid impacting data integrity.

Custom Fields Created in a Web Browser

As we discussed above, it's a common practice to customize the Concur application by adding custom data fields, which administrators can do through the Concur application in a web browser. However, not all custom fields created by web browsers are necessarily supported right away by the Concur Rest API. As a result, the API may not support all the custom attributes that are in use at any given time. You can submit a support ticket, but it could take some time before Concur releases an API update.

API Changes

Finally, the backbone of application integration is the underlying API, which evolves over time. It could definitely affect your integration if the API version is deprecated or even updated with different behavior during the process. Be mindful and stay on top of new API releases.

If your organization is planning to implement Concur, keep in mind that the integration process is a vital step that must be carefully and mindfully planned. Begin by clarifying your business goals and technical needs, then select the approach that will fit your requirements (and be sure to avoid the “gotchas”). Executing a well-designed integration will help ensure that your organization gets the most benefit out of this powerful platform.

A Quick Talk On Generic Cloud App Integration With Informatica Cloud

2017-08-04T13:22:00.000-05:00

The Informatica Cloud Integration platform is the industry's complete cloud integration platform as a service (iPaaS). Informatica has been continuously playing as the leader role in this space for the 4th consecutive year (Gartner's margic quadrant for enterprise integration platform). It's definitely your top choice for data integration management.

With the emerging SaaS application on the market, it's essential for integration platform to provide a flexible and efficient connector to integrate various cloud applications in a generic manner. Indeed there are many specific connectors built for individual applications by Informatica (Tier 1 and Tier 2 connectors) or vendors themselves (OEM connectors). But let's face it: most cloud applications evolves quickly on new features and their APIs get updated quicker than you realize. How quickly the connectors can turn around with the most recent API updates? The answer is definitely the connector update lags behind, as most connectors get updated once a year or longer than that.

For what's worth, Informatica introduced the Rest V2 connector in fall of 2016. The V2 connector is an successor of its ancestor which is just named as "Rest Connector". It allows to connect with the latest Rest API of the cloud application directly to read or write data. You can fully leverage it no matter the cloud application is a source, a target or a lookup system. It offers great improvements on flexibility, efficiency, ease of use besides performance. Considering the majority use of Rest API as the industry standard for emerging cloud services, this Rest V2 connector can fill in the role of a generic connector for cloud applications with Rest API. In this article, I will reveal the great features and caveats followed by uncovering some hidden gems of the Rest V2 connector that many may not have realized yet.

One of the great features of the Rest V2 is the introduction of hierarchy data support. As we know, the Rest API deals with either XML or JSON data which are hierarchy data structure. Before the appearance of Rest V2, transformation of hierarchy and relational data is cumbersome and even requiring writing your own script to transform the data as part of the integration process. At the Informatica fall release of 2016, the same time Rest V2 is introduced, the Hierarchy Builder/Parser is brought to life to fill the gap. Hierarchy builder is to build hierarchy data from relational data and hierarchy parse does the opposite way. Let's take a look at how hierarchy builder/parser works.

First, a hierarchy schema needs to be created. It is used by hierarchy builder/parser to present the data structure. To create a hierarchy schema, one will need to have a XML schema file (.xsd) or a JSON sample file (.json). Note the XML schema file is not necessarily provided by the vendor and one has to create it based on the XML payload.

After the creation of hierarchy schema, a hierarchy builder/parser can be used in a data mapping to map hierarchy data to relational data or vice versa.

That seems quite easy, compared to writing your own script to transform. But let's look at the Rest V2 connector as it's even better.

The core of Rest V2 connector configuration is the Swagger support. I have to thumb up on Informatica on the betting of Swagger because of its popularity and great potential as industry standard for API framework. Not all vendor provides swagger definition for their API. But no worry, Informatica provides this tool to you right inside your Informatica cloud web console. It's under Configure -> Swagger files. If you don't see this option, please contact with your Informatica support to enable it. You will need to have Rest V2 connector license to use it.

While creating the Swagger file, you basically defines the API details - URL, verb (POST/GET etc), authentication (username/password, token, etc), Headers, Query parameters, Body and sample response file. A couple of caveats in this process are:

The JSON response file is required even you are dealing with XML response. In this case, you will need to convert the XML response in JSON format. There are many online tools to do that.
If your raw body is XML format and you have issues creating the Swagger, after making sure nothing is wrong on your end, you may want to contact Informatica support requesting them to create the Swagger for you. Informatica support does have their own internal tool to create swagger file. Informatica will improve the Swagger tool based on my conversation with them and most likely it's no longer an issue soon.

After the Swagger file, create the Rest V2 connection which is quite easy as majority of the info needed for the API is filled in the Swagger file.

Now the Rest V2 Connector is ready to use in the data mapping. The Rest V2 can be used a source to read data or the target to write data in this case. Of course the API you put in the initial Swagger file has to comply with read or write operation. The hierarchy data mapping can be achieved in the Rest V2 Connector as a source/target itself. No need to use hierarchy builder or parser.

To save the best to the last, the great power of using Rest V2 connector is to use it as a midstream. Let's work on a use case: say I need to pull data from A system and push to B system via Rest API. If I were using Rest V2 as the target for B system. At the end of the flow, how do I know the data is successfully taken in B? I will need to start another pipeline or another data mapping task to examine the log file and take action from here. When using it as a midstream, the response of the Rest call can be transmitted to the next step for follow up action in the same streamline flow. This is a differentiator and made me believe all Rest V2 connector should not serve as target but midstream instead.

Another hidden gem on the Rest V2 connector as a midstream, is the capability of processing multiple Rest calls. This is definitely a great sweet feature. For any Rest call, one payload corresponds to one request and generates one response. If you have multiple payloads to be processed in one integration, essentially you need a loop function to loop through individual records and make the Rest call for each record. Without Rest V2 connector, this is impossible as there is no such loop function in Informatica data integration. The alternative would be to use Informatica Cloud Real Time (ICRT) which provides a workflow type of designer that a task can be jumped from one step to another based on certain condition - basically to achieve loop function. With Rest V2 connector, there is no additional configurations needed and it can process multiple records in one step - taking multiple records as inputs, make Rest calls for each record, and generate all response as outputs. While using it as a midstream, we can easily follow up on actions with the Rest call outputs in the same streamline flow.

WebCenter Portal and Jdeveloper Version Contrast

2016-08-24T14:47:00.001-05:00

For easy reference, here is a list of version contrast between patchset, WebCenter Portal, Jdeveloper with corresponding WebCenter extensions.

(the info is extracted from Oracle doc 1627574.1)

Patchset + Bundle Patch	WebCenter Portal	JDeveloper	WebCenter Extension
12c	12.2.1.0.0	12.2.1.0.0	Framework: 12.2.1.0.0.151013.2001 Core: 12.2.1.0.0.151005.0601
dot9 + BP3	11.1.1.9.160119	11.1.1.9.0	11.1.1.9.0.160107.0701
dot9 + BP2	11.1.1.9.8	11.1.1.9.0	11.1.1.9.0.151005.2311
dot9 + BP1	11.1.1.9.2	11.1.1.9.0	11.1.1.9.0.150701.0100
dot9	11.1.1.9.0	11.1.1.9.0*	11.1.1.9.0.150521.2301*
dot8 + BP8	11.1.1.8.8	11.1.1.7.0	11.1.1.8.0.150618.0701
dot8 + BP7	11.1.1.8.7	11.1.1.7.0	11.1.1.8.0.150331.0703
dot8 + BP6	11.1.1.8.6	11.1.1.7.0	11.1.1.8.0.141219.1406
dot8 + BP5	11.1.1.8.5	11.1.1.7.0	11.1.1.8.0.141001.1208
dot8 + BP4	11.1.1.8.4	11.1.1.7.0	11.1.1.8.0.140627.1403
dot8 + BP3	11.1.1.8.3	11.1.1.7.0	11.1.1.8.0.140404.0207
dot8 + BP2	11.1.1.8.2	11.1.1.7.0	11.1.1.8.0.131217.0204
dot8 + BP1	11.1.1.8.1	11.1.1.7.0	11.1.1.8.0.130926.1405
dot8	11.1.1.8.0	11.1.1.7.0	11.1.1.8.0.130707.1955
PS6 + BP1	11.1.1.7.1	11.1.1.7.0	11.1.1.7.0.130702.0214
PS6	11.1.1.7.0	11.1.1.7.0	11.1.1.7.0.130301.0422
PS5 + BP6	11.1.1.6.6	11.1.1.6.0	11.1.1.6.0.130326.0044
PS5 + BP5	11.1.1.6.5	11.1.1.6.0	11.1.1.6.0.121221.0259
PS5 + BP4	11.1.1.6.4	11.1.1.6.0	11.1.1.6.0.120928.1201
PS5 + BP3	11.1.1.6.3	11.1.1.6.0	11.1.1.6.0.120626.1201
PS5	11.1.1.6.0	11.1.1.6.0	11.1.1.6.0.111214.0952
PS4 + BP4	11.1.1.5.4	11.1.1.5.0	11.1.1.4.0.120306.2202
PS4	11.1.1.5.0	11.1.1.5.0	11.1.1.4.0.110415.0606
PS3	11.1.1.4.0	11.1.1.4.0	11.1.1.4.0.101223.1848
PS2 + BP3	11.1.1.3.3	11.1.1.3.0	11.1.1.3.0.101208.0400
PS2	11.1.1.3.0	11.1.1.3.0	11.1.1.3.0.100707.1000
PS1 + BP4	11.1.1.2.4	11.1.1.2.0	11.1.1.2.0.100510.1800
PS1	11.1.1.2.0	11.1.1.2.0	11.1.1.2.0.100311.1200

* Guide to Developing Portals with Oracle WebCenter Portal and Oracle JDeveloper refers to the vesion of WebCenter Portal extensions as 11.1.1.8.0 (Chapter 2, 2.2.2 Installing the WebCenter Portal Extension for JDeveloper). These extensions were renamed to be in sync with the version of JDeveloper used for Development.

Overview of "Profile" and "Folder" in WebCenter Content

2016-04-20T10:20:00.000-05:00

In this post, I will go over the basics of two features in WebCenter Content (WCC) - Profile and Folder - and then talk about their own design considerations and usages, and finally discuss their differences.

In WCC, the Profile (a.k.a metadata profile or content profile, to differentiate from user profile) is an approach of metadata modeling. The profile is a powerful tool that can be used to manage the metadata fields to achieve efficient processing of content items, such as check-in, update, search, etc.

Essentially, content profiles consist of set of rules that manage the display of the metadata fields of content items. Through content profiles, you can control what metadata fields should be displayed/hidden, required or not, read-only/editable, initialized with default value or not, and grouped based on the action to the content – whether you are viewing the content information, checking in, updating or searching. Profile provides the capability to customize the user interface of the metadata presented to the users. This is important as the profile can not only improve the user experience but also improve the data quality and accuracy. If a user is presented with too many irrelevant fields when dealing with a content item, the experience could be daunting and very likely the user would not provide quality data input. It doesn't need to take long before your content system filled with more and more irrelevant data and is abused in a sense. Bad profiling could definitely hurt searching experience as well. Consider a profile is defined in a way that captures irrelevant and inaccurate data, the overall search output would be misleading.

One of the frustrations I heard from customers was users wanted multiple profiles on a content item. In WCC, only one profile can be associated with a content item. You may find it a drawback from your unique business use cases or the way you handle the content processing. However, it’s designed in this way for a purpose. You can consider the profile is to define the type of a content item. Any content item belongs to a certain type but not more than one types. The capability of aggregating multiple profiles into one content item could very much likely lead to data abuse and subsequently many other undesired outcomes. Another frustration was “specific resources are required to build or update the profiles”. From what we have discussed, a new profile should be created only if there is a new type of content item required in the system. A profile should stay as static as possible and be updated only if the type of the content item changes with your business context. If the business context doesn’t require any new types of content or any existing types to be retired, the profile should not be built or updated frequently. You may need to look into the initial design and definition of the profiles to match the business needs. Since profile is the approach of metadata modeling, the proper metadata design is essential for daily content management. Metadata in WCC should match your enterprise taxonomy to achieve best outcome on content organization.

Speaking of the number of the profiles, there is no good or bad number. It just needs to fit your business needs. The 50-100 range is the average number of profiles for all US WCC implementations (the statistics is not published anywhere but from a technical summit with Oracle WCC team). The extreme case I have seen with a client is over thousands of profiles in the WCC system and it works just fine. There is a performance caveat with very high number of the profiles in the WCC system. I encountered such performance issue in one of my WCC implementations and the issue has been addressed by Oracle team. For details, please check here.

Folder, in WCC, is a way to structure and organize content items. It’s worthy to note that in WCC the folders are standalone “virtual” structures. Content items are not physically stored in any folder. Every content item in a folder has a metadata field (xCollectionId) to store a numeric folder ID that links the content item to a folder. It behaves like a symbolic link in WCC system.

Content folders offer a conventional hierarchy structure that provides easy access to a content item in WCC. They are just like the directories on your local laptop that point to virtual locations of the content system. With folders in WCC, you can just perform actions like you do in the conventional file system. Quoted in Oracle documentation, “The familiar folder and file model provides a framework for organizing and accessing content stored in the repository. Functionally, folders and files are very similar to those in a conventional file system. You can copy, move, rename, and delete folders and files. You can also create shortcuts to folders or files so you can access a content item from multiple locations in the hierarchy. You can think of the files in the Folders interface as symbolic links or pointers to content items in the repository. The operations you perform in the Folders interface, such as searching or propagating metadata, effectively operate on the associated content items.”

The hierarchical folder interface is achieved by a component installed in WCC. This component is called FrameworkFolders. It is a scalable enterprise solution and is intended to replace the earlier Contribution Folder interface (called Folders_g component). For a comparison of FrameworkFolders and Folders_g, you can visit this link for more details.

There are different types of folders can be used to organize content to fit your different needs. Traditional Folders: it’s the general folder we have discussed that you use to organize your content just like the one you use in your computer.
Query Folders: it’s a folder you can create based on a search/query result. It contains collections of document based on the search criteria you defined. You can save the query folder just like you create a regular folder.
Retention Folder: it’s a type of query folder with retention rules.

Comparison

Conceptually, the Folder and Profile are distinct on their functionality and their design purpose. Profile can be considered as a way to define a content “type”. Folder, like the conventional folder in your laptop, is a way to aggregate and organize content. You can store content items with the same profile in the same folder or different folders. You can have a folder containing content items with the same profile or different profiles. I will use an example to better illustrate the usage of the profile and folder. Say in your company you have the following types of content items: legal document, sales document, and reports. You also have the following departments: HR, IT and Sales. All departments may have their own legal documents and reports. Sales document would almost fall into the sales department not the other two. In this case, you may want to take the content types as the profiles and aggregate the content into folders as per the departments. You don’t want to create profile based on departments because the department can have all kinds of content items and it’s not just one static type. If somehow you define the profile as per department, you will find yourself in a way that has to create/update profiles all the time.

Folder and Profile do reveal some similarities in ways that how content is managed. You can manage content items based on a folder or a profile. For example, you can search content items either by a folder or a profile; you can batch process content items in a folder or a profile, such as manage workflow, govern security, update content information, etc. On the other hand, folder and profile do have many differences from the way they are designed.

Folder, just like a file, can have its own metadata. You can also propagate metadata from a folder to the subfolder and the content items within it. But for profile, it is a way to manage metadata and you cannot apply metadata on top of a profile.
Folder has its own security. Each folder has an owner who can modify its metadata and delete it if needed. But the folder owner doesn’t have any additional privileges over the content items inside the folder. Profile has little to do with security directly. But since Profile is to manage the metadata, it could manage profile indirectly. The “Security Group” and “Account” metadata can be used to manage security of a content item.
With folder, you can perform basic content retention scheduling by creating a retention query folder, assigning retention attributes to the folder, and then configuring the retention schedule. There is also a specific folder type – retention folder in WCC – which is based on query folder with rules for content retention. Since Profile is to manage the metadata, it has little to do with retention directly.
In workflow, actions can be applied on top of content items either within a folder or associated with a profile. In this perspective, folder and profile have similar effects.
WCC doesn’t have standalone tagging service. But you can create custom metadata for this purpose. Folder has its own metadata, so you can apply the custom tag on top of a folder. Profile, again, as a way to model metadata, can be used to manage any metadata field, including the tagging.

In a quick summary, Profile and Folder are two different concepts in WCC. Although they may reveal some level of similarities in how content can be managed, their design basis are quite distinct. Profile can be considered as a way to define the "type" of a content item and provide a customizable user interface for users to manage their content. Folder provides a virtual hierarchical structure just like the conventional file system in your computer to help to organize and manage content. They should be used and designed as per the essentials of their function, to avoid inefficient content management.

Build A Concurrent Web Page With A Simple Example

2016-04-11T16:20:00.003-05:00

Today, by using a simple example, I am going to demonstrate on how to build a concurrent web page in ADF using Jdeveloper.

From time to time, I see requirements from various contexts with such needs to build concurrencies on web pages. The performance can be greatly benefited since multiple processes are executed at the same time so that the response time is greatly improved. It's also very suitable for the use cases that the processes are not associated with any user interface interactions, such as sending an email to user after performing some action but the web page does not need to know if/when the email is sent. Such processes can be executed in a separate thread from the main thread dealing with the web page rendering and other user interactions. Even if you don't have hard requirement on such concurrency needs, why waste it? Nowadays, all servers are built with multi-core computation capabilities and designed for parallel processing. In years the speed of the CPU is not getting much faster but the number of the processing cores are getting more. If you are not taking advantage of it, it would be your waste.

Implementing such concurrency in Java EE application does not seem to be complicated, especially considering the fact that Java concurrency has been introduced since Java 1.5. But, such implementation seems to be somewhat formidable to the development team from my experience. The reason could be without careful handing and design of the Java concurrency, your expected performance gain could lead to an (much worse) opposite degradation. It could also be because there is a lack of examples to demonstrate such use case and that's definitely the purpose of this post to compensate it.

In this example, I have a page built in ADF with 3 sections - left, central and right section. Each section has their independent content and requires different period of time to process. Let's say the left will take 2 seconds, central will take 3 seconds and right will take 5 seconds to return the data.

I will start with the default approach (no concurrency) followed by two others on how to improve our web page response time.

The default

There is no concurrency here. Everything runs sequentially. My page looks like this:

Since everything runs in sequence, so the response time takes 2 (left) + 3 (central) + 5 (right) = 10 seconds minimal. It actually take 10.59 seconds - not a surprise.

If you are wondering what's the code behind the scene on the content rendering, here it is:

Now it's time to explore the better solution.

The Better

In this approach, I would use ExecutorService to mange the creation and termination of the Java threads to perform the parallel processing. Since there is 3 sections in the page that I need to run in parallel, I will create the thread pool with 3 threads. Then I would need to submit individual tasks to the executor service to perform. The task is basically the work unit that needs to be done for each section. Since our task needs return values, I am going to use Callable interface to implement the task. We can get a reference of the task submission which is the Future object. With the Future object, we can get the output of the task when it completes.

CentralContentTask codes -

As you can see, I only need to put the task code into the call() method that I need to implement which is defined by Callable interface.

In the managed bean to render the web page, here is the logic that used to manage threads by ExecutorService - task submission, termination, output retrievemcent, etc.

Please note: it is very important to shut down the ExecutorService after task submission. Otherwise the memory leak would happen. There is no need to wait until the task complete to shut down. You can also shut down the executor service immediately regardless of task complete status by using shutDownNow() but that's not we are going to pursuit.

After, we get the output of the task by get() on the Future object. This method will make the thread to wait until the task complete and return the output.

Let's run the page and see our response time -

It takes 5.37 seconds to load the page. As we are running 3 processes in parallel, the total time will be the one with the longest processing time, which is 5 seconds.

It's much better. But not enough? Can we push all 3 processes to the back without interfering the page rendering?

The Ultimate

The idea is to separate the main thread which is rendering the web page from the parallel processing the 3 sections. It's fairly simple and we actually have already done that in previous code. The only thing blocking the main thread is using the Future.get() to return the output of the task. We will need to avoid that in the main thread. So the question becomes how could we retrieve the output of the task that takes a period of time and push back to the web page we already rendered?

The answer is the ADF poll component. ADF poll can be used to various use cases that require pushing data to web pages after rendered. Here is how to leverage it in our use case.

First, we add a <af:poll> on the web page with an interval 1 second and makes all 3 sections listen to this component.

Second, we construct the refresh() method defined in the poll component to retrieve the output of the tasks.

Here we use Future.isDone() to check if the task is complete or not before getting the output, so that the thread is not waiting if the task is not complete yet.

Another note is after all 3 processes complete, we will need to stop the poll event. ADF poll offers a property "timeout" to expire the poll after a period of time. But at this time, this feature doesn't work well in ADF 11g including 11.1.1.9. This is a bug already filed but very likely it will NOT be fixed in ADF 11g. To disable the poll, we will use a workaround here to reset the poll interval to "-1" (negative) which will automatically disable the poll.

Let's take a look how long the page takes to render -

Yes, 407ms!

Now all 3 processes are running behind the page and when they are ready, it's pushed to the page individually. If you watch the page, you will see the left content comes first, then the central content and finally the right content.

In most time, the user perception is everything. In our last approach, we are able to give the user the page rendering with no time and gradually add the content when they are ready. It is an ultimate scenario. In cases that the user doesn't want to see the empty content to start with, we can put the process of the desired content back to the main thread with the page rendering, so that the web page always shows the desired content at the user's first sight. In that case the total response time will be a few hundreds of milliseconds plus whatever the process of the desired content will take.

The sample example demoed in the post can be downloaded here. It's built in Jdeveloper 11.1.1.9.

Caveat: URL Parameter in Navigation Model (WebCenter) Cannot Be Null Object

2015-12-18T12:51:00.000-06:00

In WebCenter Portal, you can define the URL parameter name/value pair in the URL parameters section in the Navigation Model. When you do that, the name/value pair will be added to the URL as a query string, such as "?name=value".

As the header suggests, the URL parameter in the Navigation Model of WebCenter Portal application cannot be a NULL object.

If the URL parameter is a static value, then it's not a concern. In case there is a need to dynamically populate the URL parameter in the navigation model, it's important to make sure the dynamical value cannot be NULL object. Because when the value is NULL, the navigation model does NOT know how to construct the query string. Note the NULL object is not equivalent to empty string. In this case, WebCenter Portal will not able to recognize the requested URL. In such case, it will redirect to the application context root which will induce the index page or whatever page you have define as the default page to render.

To work around it, simply return an empty string if the dynamic value could be null in your logic.

Work with the ADF Control State on External Link URL in WebCenter Portal Navigation Model

2015-09-04T22:40:00.003-05:00

In the Navigation Model of a WebCenter Portal application (11g), there is an option to define a navigation resource by "external link". In a normal case, you should NOT define any internal JSPX page using this option, but only if there is a need to navigate to a third party site - by what the name means, an external link. The internal JSPX page should be added to the Navigation Model by the "page" type.

The impact of defining internal JSPX page as an external link is, the redundant memory footprint due to the ADF control state token recreations every time this external link is clicked. ADF control token is an identifier used by the Controller to track user's state so that all in process task flows for the same user can be retrieved. Normally, this ADF control state should be not recreated for the same user. With the external link type, the navigation behaves like entering the application in a blank new context so every navigation with external link type will auto generate a new ADF control token. Within the same user session, the recreations of the ADF control token mean redundant memory use. The less negative thing is the ADF control state will be garbage collected after user session is invalidated. So this memory issue is only scoped within user sessions and will not accumulate over time - well this is assuming your application doesn't have a crazy long timeout setting nor your users would stay active for long time (long or short, is relative. It's impossible to name a threshold without doing some load testing and analyses on the application, as at the end of the day every application is different). In this regard, it's not a memory leak in time. However, when there is a high concurrency of users navigating the application, this issue could be a concern.

The main focus of this post is how to get around this memory issue with the external link type for internal JSPX page. You may ask what's the use case for this type of implementation - well, there is always some special unique use case down the road you might come across one day. Let's say one day you cannot use goLink and commandLink on the navigation model, but rather have to a programmatic redirect to some other page in your application with this ADF control state recreation issue.

The foremost thing is to understand the navigation model - why using navigation model API would keep the ADF control token intact throughout the application. Let's start with a new WebCenter Portal framework application and understand what navigation model API would do.

In the home.jspx page, add a navigation model goLink prettyURL syntax as the value of an output text like below.

It's basically printing out the navigation model prettyURL of the home page. When the page renders, you would see -

The navigation model prettyURL returns "/faces/home?_adf.ctrl-state=xxxxx". So the secret of navigation model capable of keeping the same ADF control token around is to attach it as a query string in the URL on every navigation.

After this is figured out, the rest should be easy. To use external link to reference an internal JSPX page, it's necessary to make the URL path relative so that your application can work properly on different environment. When defining an external link in navigation model, the URL field doesn't have the expression language facility (a nice popup that you can build objects using EL trees) but we still can use EL to construct the URL.

Using the home.jspx as an example, here is the syntax we should use:

#{request.scheme}://#{request.serverName}:#{request.serverPort}#{request.contextPath}/faces/home

Here is the External Link definition in the navigation model -

Note we need to add the "_adf.ctrl-state" URL parameter below. Alternatively, you can also define the URL parameters as part of the URL like

#{request.scheme}://#{request.serverName}:#{request.serverPort}#{request.contextPath}/faces/home?_adf.ctrl-state=#{facesContext.externalContext.requestParameterMap['_adf.ctrl-state']}

The source of the external link definition looks like below:

Note the actual prettyURL is not mandatory. "/faces/home" can also be replaced by "/faces/oracle/webcenter/portalapp/pages/home.jspx".

Now we can run the application. When clicking between the Home and "Home External Link", the ADF control state never changes.

Understand WebCenter/ADF Session Invalidation and Removal

2015-07-29T15:39:00.002-05:00

There are a couple of ways to invalidate the session in WebCenter Portal (or ADF) application. They are not the same. They all would invalidate the user session which is intended. The main difference is around whether the session will be removed after it's invalidated. In this post, I will walk through this.

In WebCenter Portal framework application, the built-in page template already has a logout function provided. Let's take a look at it.

Create a WebCenter portal application and open up the page template as below

In this JSPX file, you will find a logout command link with action specified as "#{o_w_s_l_LoginBackingBean.doLogout}". The source code of this bean is not available unless you trace back to the shipped libraries that were installed with Jdeveloper.

Let's take a look at the effect of the logout function. Run the portal application.

Open the local weblogic console, navigate to the deployment, find your application, go to application configuration, and select the monitor tab to look at the session statistics.

Before going forward, let's look at the definitions of the 3 columns we are interested in:

Sessions: Displays the current number of open sessions associated with this web application.
Sessions High: Displays the highest number of concurrent open sessions associated with this web application that have ever been reached since the weblogic instance was started.
Total Sessions: Displays the total number of open sessions ever associated with this web application.

We can see there is 1 current open session. At this time the user is not logged in yet. So it's anonymous session. Please note this is true for an type of pages - JSP, JSPX or HTML, as long as they are part of the web application (war or ear). If you may need to avoid this anonymous session, assuming your application entry page is not dynamic, you can consider build such login page in HTML and store it in web server. In this case, there will no session attached when such page is visited.

Let's login.

Check the session statistics again, we can see the current open session is still 1 but the session high and total session is 2. The anonymous session gets removed and a new authenticated user session created. That makes sense.

Let's logout and check the session statistics again. Now the open session is 2, session high is 2 and total session is 4. What does this mean?

Let's review the numbers. Total session increases from 2 to 4. That means 2 new sessions created. But the open session increases from 1 to 2. That means there are 2 current open session, increased only 1 from previous state. One thing to note is after the logout, the page lands on the entry page again just like the page before the login.

The explanation on above behaviors would be the previous authenticate session gets removed, but as soon as it's removed, an anonymous session is created. It's like the authenticated session gets converted to an anonymous session. Since the page is redirected to the login page, it's just like the initial rendering of the login page, there is a new anonymous session created. So it's 2 - one is not associated with the current UI (login page) and the other is associated. When the first anonymous session will be removed? It will be removed after the session timeout setting reached (set in web.xml). The second anonymous session will be removed after the server detects the user is idle for the session timeout setting reached.

Well, you may say that's not desired. Correct, it's not. Let's look how can we avoid the redundant anonymous sessions.

We have reviewed the second anonymous session is associated with page as it's part of the web application. Let's do a test and force the redirection to go to a page outside of the web application. To do such redirect, we will need to put in some custom code. I am going to reuse the WebCenter portal built-in logout function by taking the expression inside my managed bean.

Here is the custom managed bean associated with the command link:

Here is the logic for the custom managed bean:

Basically, I used an utility method to resolve the expression function to logout. Then issue a redirect to the server host. Here is the page landed after the logout.

Let's look at the session statistics again. Since the statistics are the same until the logout, here is just the statistics after issuing a logout.

Now we can see there is only 1 open session with total session of 3. This open session is the anonymous session converted from authenticated users session.

Next, let's look at how to avoid the anonymous session conversion but rather to remove it for good.

After some trials, none of the JEE related methods work as expected. This includes HttpSession.invalidate(), HttpSession.setMaxInactiveInterval(), and a few other methods. No mistaken, the session indeed get invalidated and there is no security concern, but the redundant anonymous session (not associated with any front-end) hanging around is the complaint.

The only working way is to use the ADF authentication servlet. Here is the code snippet to use:

In the code, I used "/adfAuthentication?logout=true&end_url=../" to call the ADF authentication servlet to invalidate the user (and remove the session) and redirect the page to host with parameter "end_url". The ADF authentication servlet is defined in web.xml by default:

Now let's use the new doLogout() method which uses ADF authentication Servlet to logout and review the session statistics after logout:

Great. There is 0 open sessions and no redundant session hanging around.

Summary:

1. To avoid anonymous session before login or after logout, please redirect to pages outside of web application.
2. To avoid anonymous session hanging around being converted from authenticated session, please use ADF authenticate servlet to logout.

Build Responsive ADF Web Application - Kscope15 Session

2015-07-21T14:49:00.000-05:00

My Kscope15 session - Build Responsive ADF Web Application - the presentation can be downloaded at https://drive.google.com/file/d/0Bx-fIQETbpw5MXRreDRkLVktYzg/view?usp=sharing

Thanks for those of you who provided the feedback.

Install JDeveloper 11.1.1.9 on OS X with JDK7

2015-07-19T00:05:00.002-05:00

The info is taken from this post: https://blogs.oracle.com/OracleWebCenterSuite/entry/install_jdeveloper_11_1_1

Thanks to Justin, it saved quite some efforts.

1 If you do not have Apple Java 1.6, download it here (Java for OS X 2014-001).

2 Start the JDeveloper 11.1.1.9.0 installer using Apple Java 1.6.

3 $(/usr/libexec/java_home -v 1.6)/bin/java -jar ~/Downloads/jdevstudio11119install.jar

4 Follow the screens and when you reach the portion of the installer that asks for the JDK, point it to your JDK 1.7 location. In my case, I have used JDK 7u80.

5 /Library/Java/JavaVirtualMachines/jdk1.7.0_80.jdk/Contents/Home

6 Complete the installation.

IE11 Support has come to WebCenter 11.1.1.8 BP5

2014-10-21T14:12:00.003-05:00

If you are on edge of using IE as your support browser, IE 11 support on WebCenter has come. The patch for it is initially released via BP4 and included in BP5. Please see the link for the details: https://support.oracle.com/rs?type=doc&id=19194669.8

Required Flag for the View Object Bind Variable

2014-10-07T23:37:00.002-05:00

When creating a bind variable for a view object in ADF, there are two properties can be configured - Updatable and Required.

The updatable flag should be enabled pretty much all the time as it allows you to change the bind variable value to run the query again. For the Required flag, it should be disabled unless you specifically need it - seems worthless to say ...

When the required is enabled, the bind variable will be defined as "Kind=where" - this can be examined in the view object xml file. This is pretty straightforward. "Kind=where" means this bind variable will always be added into the where clause when this VO is queried. Therefore it's always "required".

When the required is disabled, the bind variable will be defined as "Kind=viewcriteria". This means this bind variable is optional and can be added by applying the corresponding view criteria. Therefore it's not required.

In most cases, the bind variable should be optional. Unless this VO instance is meant to be queried with the specific where clause all the time.

Oracle WebCenter Portal Mobilizing – Responsive or Adaptive, or Both?

2014-09-02T15:14:00.002-05:00

With today’s quickly evolving web and advanced rendering capabilities, enterprise continues to seek applications with which to run massive amounts of transactional data on mobile devices. Few applications can support the increasing mobility of interfacing technologies, and those that do require teams of engineers to build and maintain them across multiple platforms. This extra layer of complexity and cost can prohibit some enterprises, and dissuade others seeking more flexible and wide-reaching data infrastructure.

IOUG Speaking - Build Your Responsive & Mobilized Enterprise Portal

2014-07-13T23:02:00.002-05:00

Hi there,

For those of you who missed out my Collaborate 14 presentation on WebCenter Responsive Web Design, here is another chance for you to regain the opportunity, for free!

Here is the summary of the talk. You can register the event by the link provided at the bottom.

Thanks!

Thursday, July 17th, 2014 12:00 p.m. - 1:00 p.m. CDT
Mobilizing emerges as a "must-have" feature for modern web experience. Oracle WebCenter Portal 11.1.1.8 introduces multi-channel portal experience to support mobilized web for smart devices. This session reveals the essential secret sauce of the new mobilizing support – responsive web design, and teaches how to extend the responsive template to support your custom needs. The session helps to determine your mobile enterprise portal strategy and teaches how to build the responsive from scratch to create your own mobilized enterprise portal on WebCenter Portal Framework applications. Further, the session analyzes real world customer cases to help you avoid the pitfalls and exploit first hand best practices.
Featured Speakers: JayJay Zheng, Director, Primitive Logic

You can register the event by clicking | Register Here |

Caveats on Using WebLogic Server with JDK7

2014-05-27T00:01:00.003-05:00

Now JDK 7 has been out for a while (JDK 8 is out too as of writing). There are some caveats using WebLogic Server with JDK 7 you might want to know, not matter it's on 10.3.6 or 12c.

1. Out of memory error on starting Admin Server. This error is caused by the fact that the new JVM requires more PermGen space. Depending on your RAM, you can set it >350m. In my case, I would set the perm size to 512M.

-XX:MaxPermSize=512m

2. In some cases, the new compiler generates larger byte code. It is possible that a large method may exceed the 64KB limit per method. In this situation, you may need to refactor the method. This seems to only affect WebLogic 10.3.6

3. Classes may have been removed that are from the internal package sun.*, or that have been marked as deprecated in a previous version of the JVM. If an application uses these removed methods, a ClassNotFound exception will occur.

4. JDBC 4.1 is introduced in JDK7. JDBC 4.1 methods are not currently supported in WebLogic Server with JDK 7. Calls to these methods will result in an SQLException indicating that the method is not supported.

If you are using WebLogic 10.3.6, after installing WebLogic Server, copy the following files from WL_HOME/modules to JAVA_HOME/jre/lib/endorsed, where WL_HOME is the WebLogic Server installation home directory:

javax.annotation_1.0.0.0_1-0.jar
javax.xml.bind_2.1.1.jar
javax.xml.ws_2.1.1.jar

Reference:

Using WebLogic Server 10.3.6 with JDK 7

Using WebLogic Server 12c with JDK 7

FrameworkFolders Support has come to Oracle WebCenter Portal

2014-05-26T23:40:00.002-05:00

As of late April 2014, FrameworkFolders support on Oracle WebCenter Portal has been enabled by Oracle WebCenter 11.1.1.8.3. Previously, Oracle WebCenter Portal only supported Folders_g.

Now it's time to review the essentials on what, why and how.

What's Framework Folders?

Introduced in WebCenter PS5, the framework folders (also called folders component) provide a hierarchical folder interface, similar to conventional file system, for organizing and locating some or all of the content in the repository. It's a scalable, enterprise solution and is meant to be a replacement for contribution folders (folders_g component).

Why it's better than Folders_g (FrameworkFolders vs. Folders_g)?

With the FrameworkFolders component as the underlying folder architecture, many functionalities and features have been made available.

Mass metadata updates with folders (metadata propagation): "Query Folders" is added in the FrameworkFolders component. Query folders are folders that are populated simply by a query. Query folders contain the actual repository content items returned by the query. The contents of query folders can change dynamically as the contents of the repository change. By using the query folder and the propagate function, one can make mass metadata updates of folders in a very easy way.
Unlimited content items: There is a limitation of 1000 content items in a folder or subfolders within a folder with Folders_g. There is no such limit with FrameworkFolders.
Enhanced search functionality: With frameworkFolders, several enhanced features are available to make search easier and more performant. User can save a query result in a query folder, as well as records management by using RetentionQuery folder. By default, you cannot search folders with folders_g. Now users can search for folders, content items within a folder with FrameworkFolders.
Personal folder support: Added personal folder for each user and the content within a personal folder is only available for the user himself/herself.
New user interface support: with the FrameworkFolders component, a new look and feel presentation layer of the content server is available. The new UI is built by ADF technology.

How to get it?

For an Oracle WebCenter Portal instance patched from an earlier release, you must continue to use Folders_g. For new installations of Oracle WebCenter Portal, it is recommended that you enable the FrameworkFolders component on Content Server for better performance and so as to be able to use any new Content Server features.

The FrameworkFolders component can be enabled only for the installations that meet the following criteria:

You must have a new Oracle WebCenter Portal 11.1.1.8.0 installation. Oracle WebCenter Portal must not have been patched from a previous release, that is, it should be a completely fresh instance.
You must have a new installation of Oracle WebCenter Content 11.1.1.8.0, with the FrameworkFolders component enabled. Oracle WebCenter Content must not have been patched from a previous release, that is, it should be a completely fresh instance.
Content Server should never have been configured to run with the Folders_g component. You must not enable FrameworkFolders if Folders_g was previously enabled.

To configure FrameworkFolders support for Oracle WebCenter Portal, you need to apply various patches to your new installations of Oracle WebCenter Content 11.1.1.8.0 and Oracle WebCenter Portal 11.1.1.8.0.

To prepare Oracle WebCenter Portal for FrameworkFolders support:

Ensure there is no content within Oracle WebCenter Content and Oracle WebCenter Portal
Download and apply the WebCenter Content MLR04 patch (latest as of today)
Download and apply the WebCenter Portal BP3 patch 18085041
Download and apply the WebCenterConfigure component patch 18387955

Reference:

11g Folders – organized, optimized, modernized
Mass Metadata Update with Folders
WebCenter Content 11.1.1.6 FrameworkFolders
Using Folders and WebDAV
Folder Services

Interview with Bob Rhubart on Responsive WebCenter Portal @ Collaborate 14

2014-04-22T00:13:00.000-05:00

Short after my presentation on Responsive WebCenter Portal @ Collaborate 14 in Vegas, I had a video interview with Bob Rhubart who runs Oracle ArchBeat - the official blog of the OTN Architect Community. In this 10 min talk, I had reviewed my presentation topic, the hot gossips in the hallway and the visions of hot topics in the next coming collaborate.