Developers Tutorials

automatic document classification with Alfresco Part 2

2010-12-04T06:51:00.000-08:00

In the first part of this article, i explained how you can use Lucene to query a document (Word, PDF etc...), and find matches for specific keywords, which was necessary for us in order to automatically identify the document's category based on its content.

We've chosen a simple approach to demonstrate the automatic classification extension : if a document contains the name of a category, then it belongs to it, of course we can use other approaches like assigning multiple keywords to a category, example : if a document contains one of the following words "java, .Net, c#..." then assign it to category "Software development", it can easily be implemented once you finish reading and understanding this article, and of course how you implement it depends on your specific needs, you might need some more advanced classification algorithm.

The first question we might ask is : Where does the code to customize Alfresco goes? meaning, which class should we extend or modify in order to add the automatic classification logic? , if you want it applied all across the repository, you should extend the implementation of "NodeService", especially the method "createContent", if you want to be applied only for the JSF web-client users, you will need to extend the managed bean of the "Add content" dialog :

 import org.alfresco.web.bean.content.AddContentDialog;

Now we will create our own custom version of "AddContentDialog" :

 /**  
  *  
  * @author Haltout Sohaib  
  */  
 public class CustomAddContentDialog extends AddContentDialog{ 
 }

As for all other Alfresco Dialogs, the business logic is implemented in the method :

 protected String finishImpl(FacesContext context, String outcome) throws Exception;

Meaning that's the method we should override in order to add our own custom classification logic, that will be executed right after the document node is created at the repository :

   @Override  
   protected String finishImpl(FacesContext context, String outcome) throws Exception {  
     //We fetch any change in the navigation outcome  
     String outc = super.finishImpl(context, outcome);  
     addCategories();  
     return outc;  
   }

Now we will implement the method "addCategories()" :

   private Map<String,NodeRef> getAvailableCategories(){  
     Map<String,NodeRef> categories = new HashMap<String,NodeRef>();  
     //Get the nodeService  
     NodeService nodeService = this.getNodeService();  
     //We fetch a collection of all available categories  
     Collection<ChildAssociationRef> assoc =   
          categoryService.getCategories(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE,   
           ContentModel.ASPECT_GEN_CLASSIFIABLE, CategoryService.Depth.ANY);  
     for(ChildAssociationRef child : assoc){  
       NodeRef node = child.getChildRef();  
       //Get the name of the category from nodeService  
       String name = (String) nodeService.getProperty(node, ContentModel.PROP_NAME);  
       //Add the category to the map  
       categories.put(name, node);  
     }  
     return categories;  
   }

First we fetched all the available categories defined in Alfresco, searched the content of the uploaded document finding matching categories using the "SearchUtils" class we defined in the previous article, and then add each one to the created node.
We will now implement the method "getAvailableCategories()" :

   private Map<String,NodeRef> getAvailableCategories(){  
     Map<String,NodeRef> categories = new HashMap<String,NodeRef>();  
     //Get the nodeService  
     NodeService nodeService = this.getNodeService();  
     //We fetch a collection of all available categories  
     Collection<ChildAssociationRef> assoc =   
          categoryService.getCategories(StoreRef.STORE_REF_WORKSPACE_SPACESSTORE,   
           ContentModel.ASPECT_GEN_CLASSIFIABLE, CategoryService.Depth.ANY);  
     for(ChildAssociationRef child : assoc){  
       NodeRef node = child.getChildRef();  
       //Get the name of the category from nodeService  
       String name = (String) nodeService.getProperty(node, ContentModel.PROP_NAME);  
       //Add the category to the map  
       categories.put(name, node);  
     }  
     return categories;  
   }

In the method "addCategoriesToNode()" we will add the provided list of categories to the created node :

   private void addCategoriesToNode(ArrayList<NodeRef> foundCategoriesRef) {  
     //Get the nodeService  
     NodeService nodeService = this.getNodeService();  
     if(!nodeService.hasAspect(this.createdNode, ContentModel.ASPECT_GEN_CLASSIFIABLE))  
     {  
       HashMap<QName, Serializable> props = new HashMap<QName, Serializable>();  
       props.put(ContentModel.PROP_CATEGORIES, foundCategoriesRef);  
       nodeService.addAspect(this.createdNode, ContentModel.ASPECT_GEN_CLASSIFIABLE, props);  
     }  
     else  
     {  
       nodeService.setProperty(this.createdNode, ContentModel.PROP_CATEGORIES, foundCategoriesRef);  
     }  
   }

We used the bean "categoryService()", we will need to add the getters and setters for dependency injection :

   private CategoryService categoryService;  
   /**  
    * Get the value of categoryService  
    *  
    * @return the value of categoryService  
    */  
   public CategoryService getCategoryService() {  
     return categoryService;  
   }  
   /**  
    * Set the value of categoryService  
    *  
    * @param categoryService new value of categoryService  
    */  
   public void setCategoryService(CategoryService categoryService) {  
     this.categoryService = categoryService;  
   }

And finally, now that our bean is ready, we will need JSF to be aware of it, let's open the file "faces-config-custom.xml" located in the "Web-Inf" directory, and add our bean definition :

 <managed-bean>  
    <description>  
      Custom bean that backs up the Add Content Dialog  
    </description>  
    <managed-bean-name>AddContentDialog</managed-bean-name>  
    <managed-bean-class>com.hsohaib.alfresco.CustomAddContentDialog</managed-bean-class>  
    <managed-bean-scope>session</managed-bean-scope>  
       <managed-property>  
      <property-name>categoryService</property-name>  
      <value>#{CategoryService}</value>  
    </managed-property>  
    <managed-property>  
      <property-name>nodeService</property-name>  
      <value>#{NodeService}</value>  
    </managed-property>  
    <managed-property>  
      <property-name>fileFolderService</property-name>  
      <value>#{FileFolderService}</value>  
    </managed-property>  
    <managed-property>  
      <property-name>searchService</property-name>  
      <value>#{SearchService}</value>  
    </managed-property>  
    <managed-property>  
      <property-name>navigator</property-name>  
      <value>#{NavigationBean}</value>  
    </managed-property>  
    <managed-property>  
      <property-name>browseBean</property-name>  
      <value>#{BrowseBean}</value>  
    </managed-property>  
    <managed-property>  
      <property-name>contentService</property-name>  
      <value>#{ContentService}</value>  
    </managed-property>  
    <managed-property>  
      <property-name>dictionaryService</property-name>  
      <value>#{DictionaryService}</value>  
    </managed-property>  
   </managed-bean>

Note that the bean name must be "AddContentDialog", otherwise Alfresco will use the already defined bean for managing the "Add Content" dialog.

That's it folks, the extension should be working now, you can test it by adding documents containing the names of multiples categories you have defined, and they should all be classified automatically without your intervention.

Alfresco automatic document classification : Part 1

2010-11-30T16:32:00.000-08:00

Alfresco is capable of handling multiple classifications, or hierarchies of classification, it's a very useful feature, and can make your life a lot easier when looking for documents, especially the ones with no indexed content like pictures, scanned documents etc...

Classifying a document in Alfresco can be as easy as few clicks on the browser, however it can be very time-consuming process if you are uploading many documents every day, or if you are migrating to Alfresco : Imagine having to manually classify a few thousands of documents!

If you are still classifying documents manually, analyzing their content, and sorting them into categories, you might be interested in finding out how you can extend Alfresco to automatically classify your documents for you.

Once a user uploads a document to the repository, our extension will fetch the list of all defined categories, and then crawls the document looking for matches, ex : if a document contains the word 'Software', and there is a category named 'Software' defined in Alfresco, this document will be added to it. This is the simplest approach, a more advanced one will be explained in later posts.

That said, we will create a SearchUtils helper class that will handle searching the document for keywords, in order to search all types of documents we will be using Apache Lucene, a powerful search engine, already integrated in Alfresco, to lookup the categories in the document.

The main method is :

   public static List<String> search(File file, Set<String> keyWords) {  
     List<String> result = new ArrayList<String>();  
     RAMDirectory idx = new RAMDirectory();  
   
     try {  
       // Make a writer to create the index  
       IndexWriter writer =  
           new IndexWriter(idx, new StandardAnalyzer(), true);  
   
       // Add the Document Object  
       writer.addDocument(fileToDocument(file));  
   
       // Optimize and close the writer to finish building the index  
       writer.optimize();  
       writer.close();  
   
       // Build an IndexSearcher using the in-memory index  
       Searcher searcher = new IndexSearcher(idx);  
   
       // find to which categories this document belons  
       for(String keyWord :keyWords){  
         if(search(searcher,keyWord)) result.add(keyWord);  
       }  
       searcher.close();  
     } catch (IOException ioe) {  
   
       ioe.printStackTrace();  
     } catch (ParseException pe) {  
       pe.printStackTrace();  
     }  
       
     return result;  
   }

it takes as arguments the document, and a list of keywords to lookup, and returns a list of the keywords (categories) found in the document.

In order for Lucene to treat the document, we need to convert the file into a Document object recognized by Lucene, which is why we used another method "fileToDocument" in order to handle the conversion, this method is a part of Lucene's demos that can be found in source distribution in the official website :

   public static Document fileToDocument(File f)  
     throws java.io.FileNotFoundException {  
   
   // make a new, empty document  
   Document doc = new Document();  
   
   // Add the path of the file as a field named "path". Use a field that is  
   // indexed (i.e. searchable), but don't tokenize the field into words.  
   doc.add(new Field("path", f.getPath(), Field.Store.YES, Field.Index.NOT_ANALYZED));  
   
   // Add the last modified date of the file a field named "modified". Use  
   // a field that is indexed (i.e. searchable), but don't tokenize the field  
   // into words.  
   doc.add(new Field("modified",  
     DateTools.timeToString(f.lastModified(), DateTools.Resolution.MINUTE),  
     Field.Store.YES, Field.Index.NOT_ANALYZED));  
   
   // Add the contents of the file to a field named "contents". Specify a Reader,  
   // so that the text of the file is tokenized and indexed, but not stored.  
   // Note that FileReader expects the file to be in the system's default encoding.  
   // If that's not the case searching for special characters will fail.  
   doc.add(new Field("contents", new FileReader(f)));  
   
   // return the document  
   return doc;  
  }

And finally the method "search", that builds a Lucene Query Object, executes it, and returns true if any occurrences of the keyword are found.

   private static boolean search(Searcher searcher, String queryString)  
     throws ParseException, IOException {  
   
     // Build a Query object  
   
     Query query = new QueryParser().parse(  
       queryString, "content", new StandardAnalyzer());  
   
     // Search for the query  
     Hits hits = searcher.search(query);  
   
     // Examine the Hits object to see if there were any matches  
     int hitCount = hits.length();  
     if (hitCount == 0) {  
       return false;  
     }  
       
     return true;  
   }

With this, our class "SearchUtils" is complete, in my next post i will explain how to extend and customize Alfresco, and use what we learned today in order to automaticaly classify documents on the repository based on its content.

Getting started with Alfresco

2010-11-26T02:10:00.000-08:00

During my internship at TGR, one of the project's requirements was indexing and managing documents, and that was my first experience with Alfresco, which is an open source Enterprise Content Management (ECM), it combines a collection of content-centric technologies like Document Management (DM), Records Management (RM), and other technologies that should make your life, if your field of work is Content Management, easier.

Customizing Alfresco can be a bit tricky, and hard to grasp at first, but after doing it few times, you start to get the feel of it, and this post, as well as the future articles about Alfresco, are all here for you to get there.

Before you can customize Alfresco, you will need to get your development environment in order, so, first things first : I will show you how to obtain the Software Development Kit (SDK), and how to set it up in eclipse.

Prerequisites
Make sure you have the following developement tools installed first :

JDK 1.6.X.
Eclipse IDE 3.2+ (Recommended) .

Obtaining the SDK

You can either download the SDK from SDK Download Page at SourceForge, or check out the source code and build it. The SVN URL is : svn://svn.alfresco.com.

Setting up the SDK
Once downloaded, our next step is setting up the SDK in Eclipse :

Start Eclipse.
Select "File -> import".
Choose "General -> Existing Projects into WorkSpace".
Choose "Select root directory", and click on "Browse".
Navigate to the root directory where you unpacked Alfresco SDK, and select OK.
The Alfresco Projects are listed under "projects".

Only "SDK AlfrescoRemote" and "SDK AlfrescoEmbedded" are required, but it's a good idea to include the other SDK Samples in order to see how it works, and get the feel of it.

If everything went well, the SDK should be now up and working, in the next article we will see the first example on how to use it in order to customize Alfresco.

IOS 4.2 released

2010-11-23T05:41:00.000-08:00

Since yesterday, 18h, the latest release of IOS which is 4.2 is officially available for downloads.
New features :

AirPrint: print email, photos, web pages, and documents right from iPhone, iPad, or iPod touch.

AirPlay: stream digital media wirelessly from your iPhone, iPad, and iPod touch to your Apple TV and AirPlay-enabled speakers.

Find My IPhone: helps you locate your missing device and protect its data — is now free on any iPhone 4, iPad, or fourth-generation iPod touch running iOS 4.2.

smart Card tutorial : Part 2

2010-11-19T09:23:00.000-08:00

In my previous article smart Card tutorial : Part 1, i explained how you can use the Cryptographic Token Interface Standard PKCS#11 in order to access your smart card or USB Token, and perform some simple operations like listing the connected tokens, and displaying each device's informations (Serial Number, Vendor etc...).

This second part will cover some advanced usage of PKCS#11 like :

Generating on-card RSA Keypair.
Storing certificates and objects.

Generating on-card RSA Keypair

In order to use your smart card for authentication or digital signature, you need first to store your private key and certificate inside it, which obviously means you need to generate the Key-pair first! for that you can either generate a PKCS#12 keystore using Openssl, or your certificate authority management software like EJBCA , but in doing so, there is a chance that someone may intercept your ".p12" file, and therefore compromise your private key, not to mention that the admin can keep a copy of the file to himself.

A more secure way is generating the key-pair inside the smart card, this way the private key never leaves it, always protected, and more importantly : only the card holder will have access to the private key, and none else, not even the admin will have such access.

So, let's see how we can use PKCS#11 to achieve this, we will be working on the same "SmartCardTutorial" class that we created in the previous article.

First, we will define a method that returns the first available connected Token :

 public Token getFirstAvailableToken() {  
     Token result = null;  
     try {  
 //Get all available slots  
       Slot[] slots = this.getTokenSlots();  
       if (slots.length != 0) {  
 //Get the first available token  
         result = slots[0].getToken();  
       }  
     } catch (TokenException ex) {  
       Logger.getLogger(SmartCardTutorial.class.getName()).log(Level.SEVERE, null, ex);  
     }  
     return result;  
   }

Now we can define a method that generates the keypair on the card, and returns the public key for later use. We will need to define templates for both the private and public key that we want to generate : the public exponent, the keys length etc...

 public KeyPair generateKeyPair(Session session) throws Exception {  
     Mechanism keyPairGenerationMechanism = Mechanism.RSA_PKCS_KEY_PAIR_GEN;  
     RSAPublicKey rsaPublicKeyTemplate = new RSAPublicKey();  
     RSAPrivateKey rsaPrivateKeyTemplate = new RSAPrivateKey();  
     // set the general attributes for the public key  
     // We want keys of length 2048 bits  
     rsaPublicKeyTemplate.getModulusBits().setLongValue(new Long(2048));  
     // With public exponent equal 2^16 + 1  
     byte[] publicExponentBytes = {0x01, 0x00, 0x01};  
     rsaPublicKeyTemplate.getPublicExponent().setByteArrayValue(publicExponentBytes);  
     rsaPublicKeyTemplate.getToken().setBooleanValue(Boolean.TRUE);  
     byte[] id = new byte[20];  
     new Random().nextBytes(id);  
     rsaPublicKeyTemplate.getId().setByteArrayValue(id);  
     rsaPrivateKeyTemplate.getSensitive().setBooleanValue(Boolean.TRUE);  
     rsaPrivateKeyTemplate.getToken().setBooleanValue(Boolean.TRUE);  
     rsaPrivateKeyTemplate.getPrivate().setBooleanValue(Boolean.TRUE);  
     rsaPrivateKeyTemplate.getId().setByteArrayValue(id);  
     rsaPrivateKeyTemplate.getSign().setBooleanValue(Boolean.TRUE);  
     rsaPrivateKeyTemplate.getDecrypt().setBooleanValue(Boolean.TRUE);  
     rsaPublicKeyTemplate.getVerify().setBooleanValue(Boolean.TRUE);  
     rsaPublicKeyTemplate.getEncrypt().setBooleanValue(Boolean.TRUE);  
     rsaPublicKeyTemplate.getKeyType().setPresent(false);  
     rsaPublicKeyTemplate.getObjectClass().setPresent(false);  
     rsaPrivateKeyTemplate.getKeyType().setPresent(false);  
     rsaPrivateKeyTemplate.getObjectClass().setPresent(false);  
     KeyPair generatedKeyPair = session.generateKeyPair(keyPairGenerationMechanism, rsaPublicKeyTemplate, rsaPrivateKeyTemplate);  
     return generatedKeyPair;  
   }

Importing Certificates to your token

This method defined above generates and stores the private key on the card, and returns the keypair, our next move would be generating a CSR (Certificate Signing Request) with the generated public key, and sending it to our certificate authority in order to get a digital certificate, and then store it in our token. However the part about generating and signing the CSR is out of scope, for now we will just create a dummy "getCertificateFromKeyPair' method that returns an X509Certificate, how to implement a real one will be explained in future articles about EJBCA web service API.

 public void storeCertificate(Session session, X509Certificate x509Certificate) throws Exception {  
     PublicKey publicKey = (PublicKey) x509Certificate.getPublicKey();  
     java.security.interfaces.RSAPublicKey rsaPublicKey = (java.security.interfaces.RSAPublicKey) publicKey;  
     RSAPrivateKey rsaPrivateKeySearchTemplate = new RSAPrivateKey();  
     byte[] modulus = iaik.pkcs.pkcs11.Util.unsignedBigIntergerToByteArray(rsaPublicKey.getModulus());  
     rsaPrivateKeySearchTemplate.getModulus().setByteArrayValue(modulus);  
     // We want to find objects on the card having the same properties as our template  
     session.findObjectsInit(rsaPrivateKeySearchTemplate);  
     // There is just 1 private key we stored, so we want just 1 result  
     Object[] foundKeyObjects = session.findObjects(1);  
     byte[] objectID = null;  
     if (foundKeyObjects.length > 0) {  
       //Get the found key  
       Key foundKey = (Key) foundKeyObjects[0];  
       //Get its ID  
       objectID = foundKey.getId().getByteArrayValue();  
     }  
     session.findObjectsFinal();  
     // create certificate object template  
     X509PublicKeyCertificate pkcs11X509PublicKeyCertificate = new X509PublicKeyCertificate();  
     Name subjectName = (Name) x509Certificate.getSubjectDN();  
     Name issuerName = (Name) x509Certificate.getIssuerDN();  
     String subjectCommonName = subjectName.getRDN(objectID.commonName);  
     String issuerCommonName = issuerName.getRDN(ObjectID.commonName);  
     char[] label = (subjectCommonName + "'s "  
         + ((issuerCommonName != null) ? issuerCommonName + " " : "") + "Certificate").toCharArray();  
     byte[] newObjectID;  
     // if we need a new object ID, create one  
     if (objectID == null) {  
       newObjectID = ((java.security.interfaces.RSAPublicKey) publicKey).getModulus().toByteArray();  
       MessageDigest digest = MessageDigest.getInstance("SHA-1");  
       newObjectID = digest.digest(newObjectID);  
     } else {  
       // we already got one from a corresponding private key before  
       newObjectID = objectID;  
     }  
     byte[] encodedSubject = ((Name) currentCertificate.getSubjectDN()).getEncoded();  
     byte[] encodedIssuer = ((Name) currentCertificate.getIssuerDN()).getEncoded();  
     pkcs11X509PublicKeyCertificate.getToken().setBooleanValue(Boolean.TRUE);  
     pkcs11X509PublicKeyCertificate.getPrivate().setBooleanValue(Boolean.FALSE);  
     pkcs11X509PublicKeyCertificate.getLabel().setCharArrayValue(label);  
     pkcs11X509PublicKeyCertificate.getId().setByteArrayValue(newObjectID);  
     pkcs11X509PublicKeyCertificate.getSubject().setByteArrayValue(encodedSubject);  
     pkcs11X509PublicKeyCertificate.getIssuer().setByteArrayValue(encodedIssuer);  
     pkcs11X509PublicKeyCertificate.getSerialNumber().setByteArrayValue(serialNumber);  
     pkcs11X509PublicKeyCertificate.getValue().setByteArrayValue(currentCertificate.getEncoded());  
     //And finaly store the certificate on the token  
     session.createObject(pkcs11X509PublicKeyCertificate);  
   }

That's pretty much it for today, i hope it was helpful, and will continue shortly with the "smart card Tutorials" series with more advanced topics. Until then, my best regards everyone.

smart Card tutorial : Part 1

2010-11-19T09:21:00.000-08:00

When your application handles or performs sensitive data or operations, security becomes a major concern, which is why some companies decides to use Strong Authentication for their applications, also known as 'two factors authentication' : one thing that you have (the smart Card, or USB token), and one that you know (the PIN or password).

This article will be the start of a series of tutorials about smart cards (USB Tokens are readerless smartcards, so the same applies) : how to access, manage, generate keys etc... at the end of the articles, tou should be able to write smart-card-based applications for authentication, digital signatures and PIN/PUK management.

All the code will be using Standard interfaces to communicate with the smart card, no vendor specific one, so it should work with any kind of equipment you have. In other words, we will be using PKCS#11, the Cryptographic Token Interface Standard.

In order to use PKCS#11, you can either write your own wrappers using Java Native Interface (JNI) to export the native functions to java (will write a tutorial about that later), or you can download a free open source wrapper like iaik PKCS#11 Wrappers, which we will be using in this tutorial.

Requirements for this tutorial :

- A smart Card or USB Token of course.
- PKCS#11 Wrappers for java.
- PKCS#11 implementation library.

So, first things first, start by downloading the PKCS#11 wrappers from iaik web site. For the implementation librarie you will need to get it from your vendor, it's a .dll for windows, or a .so for linux, in my case i will be working with SafeNet Etoken Pro, so the library name is "eTPKCS11.dll".

Let's start by creating our class "SmartCardTutorial" with a constructor taking the library path as arg :

 public class SmartCardTutorial {  
   private Module pkcs11Module;  
   public SmartCardTutorial(String librarayPath) {  
     try {  
       pkcs11Module = Module.getInstance(librarayPath);  
       pkcs11Module.initialize(null);  
     } catch (IOException ex) {  
       Logger.getLogger(SmartCardTutorial.class.getName()).log(Level.SEVERE, null, ex);  
     } catch (TokenException ex) {  
       Logger.getLogger(SmartCardTutorialclass.getName()).log(Level.SEVERE, null, ex);  
     }  
   }  
 }

in the code above we instantiated pkcs11Module, which will provide us informations about the connected smart cards/Tokens that we can access. Now, we will create a method that returns a list of all available slots, as we are not interested in empty slots, we will specify that we only want these with a token present :

 public Slot[] getTokenSlots() throws TokenException {  
     return pkcs11Module.getSlotList(Module.SlotRequirement.TOKEN_PRESENT);  
   }

Now let's write a simple method that will print on the console the informations about the present token in the first slot, like its Serial number, vendor etc...

 public void printTokenInfos() throws TokenException {  
     Slot[] slots = getTokenSlots();  
     if (slots.length == 0) { //No tokens connected  
       System.out.println("Sorry, Couldn't find any token");  
     } else {  
       //Let's get the first slot  
       Slot selectedSlot = slots[0];  
       //Let's get the connected token  
       Token token = selectedSlot.getToken();  
       //Get the token infos  
       TokenInfo tokenInfo = token.getTokenInfo();  
       System.out.println("Token : " + tokenInfo.getLabel());  
       System.out.println("Vendor : " + tokenInfo.getManufacturerID());  
       System.out.println("Serial Number : " + tokenInfo.getSerialNumber());  
     }  
   }

That's it for today folks, in the next article i will explain how to perform more advanced manipulation, like on-card RSA key-pair generation, storing and retrieving X509 certificates etc...

Java JNDI Tutoriel : Ldap query

2010-11-19T09:18:00.000-08:00

Our topic of discussion today will be JNDI (Java Naming and Directory Interface), which is a standard way to query directories for different kind of available informations.

We will see how you can use Java to interact with OpenLdap or any other directory (like Apache OpenDS etc...).

In order to connect to an ldap directory server we will need to know :

The server url (in our case localhost)
The authentication used : Simple, Digest etc...
the base DN, or the root element.
Bind DN, the user we will connect to the directory as.
Bind password.

so let's add these fields to our class :

   private String serverUrl = "ldap://localhost:389";  
   private String authentication = "simple";  
   private String baseDN = "dc=myComp,dc=net";  
   private String bindDN = "cn=Admin";  
   private String bindPassword = "password";

We will need to get a DirContext Object which allows us to contact Ldap for adding or querying users or other form of entries, so lets add that field as well :

 private DirContext ldapContext;

now, inside the init() method, let's establish a connection to the ldap server, and get our DirContext :

     Hashtable ldapEnv = new Hashtable(11);  
     ldapEnv.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");  
     ldapEnv.put(Context.PROVIDER_URL, serverUrl);  
     ldapEnv.put(Context.SECURITY_AUTHENTICATION, authentication);  
     ldapEnv.put(Context.SECURITY_PRINCIPAL, bindDN + "," + baseDN);  
     ldapEnv.put(Context.SECURITY_CREDENTIALS, bindPassword);  
     ldapContext = new InitialDirContext(ldapEnv);

Now that we got our DirContext, let's query the directory for entries of class inetOrgPerson, of course you can change the query to get whatever entry you want :

 String query = "(objectclass=inetOrgPerson)";  
     SearchControls ctrl = new SearchControls();  
     //Search the sub tree  
     ctrl.setSearchScope(SearchControls.SUBTREE_SCOPE);  
     //Return all attributes  
     ctrl.setReturningAttributes(null);  
     //Query the directory  
     NamingEnumeration enumeration = ldapContext.search(baseDN, query, ctrl);

There we go, we got now an enumeration with all the search results our query returned.

EJBCA : a Step By Step install Guide

2010-11-19T06:52:00.000-08:00

As mentionned in my previous Article Presenting EJBCA, this article will explain how to have an In-House Certificate Authority up and running using EJBCA.

EJBCA needs a couple of componenets to be installed in order for it to work, we will be using :

EJBCA 3.9.5
Mysql Server 5
Apache Ant 1.7
OpenJDK 6 JDK
JCE (Java Cryptographique Extension) 6
JBoss Application Server 4.4
MySQL Java Connector 5

We will be using Ubuntu Server for the install.

Installing and configuring MySQL Server

install MySQL Server using the following Shell command :

$>sudo apt-get install mysql-server

once the install ends, open MySQL command line interface, and connect as the root user :

#>mysql -u root -p
#>Password: (enter your root password)

now we will create a database for EJBCA :

Mysql>CREATE database ejbca;

create a new user that will be used by ejbca to connect to MySQL, and authorize him access on ejbca database :

Mysql>USE ejbca;
Mysql>CREATE user 'ejbca'@'localhost' IDENTIFIED BY 'ejbca';
Mysql>GRANT SELECT,UPDATE,DELETE,CREATE on ejbca.* to 'ejbca'@'localhost';

Installing Apache Ant

install Apache Ant using the following Shell command :

$>sudo apt-get install ant

That's all there is to installing ANT :).

Installing JDK 6

for JDK you can either install sun jdk using

$>sudo apt-get install java-6-jdk-sun

Or install openJDK :

$>sudo apt-get install openjdk-6-jdk

Installing JCE

EJBCA needs to be able to generate keys of lengths greater than usualy supported by JCE, so you will need to download Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 6, and extract it to your "jre/lib/security/" in JAVA_HOME Directory.

Installing MySQL Java Connector

Download the connector from MySQL Java Connector download page, and keep it until we begin installing JBoss Application Server.

Installing JBoss Application Server

Download JBoss AS from JBoss AS Download Page.

Unzip the file downloaded, and copy it to "/opt/".

Copy the MySQL Java connector previously downloaded to "/opt/jboss/server/default/lib".

create a user and group "jboss", with working directory "/opt/jboss" using the following Shell commands :

#>groupadd jboss
#>useradd -d /opt/jboss -g jboss jboss
#>passwd jboss

Setting up environment variables

create a file 'ejbca.sh' in '/etc/profile.d' using :

#>touch /etc/profile.d/ejbca.sh

edit the file and add these lines to it :

#!/bin/sh
export JAVA_HOME=/usr/lib/jvm/java-6-openjdk
export JBOSS_HOME=/opt/jboss
export APPSRV_HOME=/opt/jboss
export ANT_OPTS=-Xmx512m
export JBOSS_HOST=0.0.0.0
export ANT_HOME=/opt/ant
export EJBCA_HOME=/opt/ejbca
export JBOSS_CONSOLE=/var/log/jboss.log
export JBOSSUS=jboss
export JBOSS_SERVER=default
export PATH=$JAVA_HOME/bin:$ANT_HOME/bin:$PATH

make the file executable using :

#>chmod +x /etc/profile.d/ejbca.sh

save the file, logout, and relogin.

Installing EJBCA

Download EJBCA from EJBCA Download Page, unzip it to '/opt/ejbca'.

rename the file 'database.properties.sample' in the conf directory to 'database.properties', and edit its properties to match the database of your choice (in our case MySQL).

Make sure JBoss is not running, then run these commands :

#>cd $EJBCA_HOME
#>ant clean
#>ant bootstrap

Now start JBoss AS :

#>cd $JBOSS_HOME/bin
#>chmod +x run.sh
#>./run.sh

once JBoss is running, start EJBCA Install task :

#>cd $EJBCA_HOME
#>ant install

once the install finished, and you get the "BUILD SUCCESSEFUL" message, shutdown JBoss, and start the deploy :

#>$JBOSS_HOME/bin/shutdown.sh -s
#>cd $EJBCA_HOME
#>ant deploy

after the deploy ends, start JBoss, and EJBCA should be up and running at http://localhost:8080/ejbca.

In order to access the administration interface, you will need to import the superadmin.p12 generated in the p12 directory of your EJBCA install.

Presenting EJBCA

2010-11-19T06:41:00.000-08:00

Your enterprise decided recently to start using digital Certificates for authentication, digital signatures, Server authentication etc... in other words, you need a Certificate Authority(CA) in order to deliver certificates for your servers and users.

Of course, you can choose to buy certificates from known vendors like VerSign,Thawte etc... but you will need to pay for every certificate a user or a server needs! a better approach would be hosting you own In-House certificate Authority, this way you can issue as many certificates as you need.
Now that you decided to host your own CA,have your own Public Key Infrastructure (PKI),
you need to be able to manage the certificates : delivering, revoking etc... for that you can either reinvent the wheel, and create your own web application for this purpose, using OpenSSL + Batches. Or, you can use an open source Certificate Authority Management Solution like EJBCA.

EJBCA is an enterprise class PKI Certificate Authority built on J2EE technology. It is a robust, high performance, platform independent, flexible, and component based CA to be used stand-alone or integrated in other J2EE applications.

The next Article will be a step by step guide on how to set up EJBCA.

A new Software Engineering Blog

2010-11-19T06:37:00.000-08:00

Hi and welcome everyone,

My name is Haltout Sohaib, a Moroccan Software Engineer, software building, engineering and security auditing always been my passion, although being a student right now, i did work as freelancer a couple of times, especially security related jobs.

My friends, and people i worked with, or helped, have always recommended me to start a blog, but never really had time to for various reasons, but decided finally to start one, because i believe that if we are where we stand today, it's all thanks to sharing knowledge, it's all about sharing!

So, starting today, i will write and share tricks, best practices, tutoriels, guides etc... on various topics like :

Security.
Software Engineering .
Public Key Infrastructure.
Enterprise Content Management (ECM), especially Alfresco.
J2ee, JEE5
Spring Security, MVC ....

And other frameworks, technologies i worked with.

If you need help with a project you're working on, or have a question feel free to contact me at : haltout.sohaib@gmail.com .

I'm currently transferring messages from my old blog hsohaib.com to this one.

Developers Tutorials

automatic document classification with Alfresco Part 2

Alfresco automatic document classification : Part 1

Getting started with Alfresco

IOS 4.2 released

smart Card tutorial : Part 2

Generating on-card RSA Keypair

Importing Certificates to your token

smart Card tutorial : Part 1

Java JNDI Tutoriel : Ldap query

EJBCA : a Step By Step install Guide

Installing and configuring MySQL Server

Installing Apache Ant

Installing JDK 6

Installing JCE

Installing MySQL Java Connector

Installing JBoss Application Server

Setting up environment variables

Installing EJBCA

Presenting EJBCA

A new Software Engineering Blog