Tech Stuff, Stay Curious

What is base64 encoding ?

2013-01-11T06:44:00.001-08:00

Ref : http://stackoverflow.com/questions/201479/what-is-the-use-of-base-64-encoding

It's a textual encoding of binary data where the resultant text has nothing but letters, numbers and the symbols "+", "/" and "=". It's a convenient way to store/transmit binary data over media that is specifically used for textual data.
But why Base-64? The two alternatives for converting binary data into text that immediately spring to mind are:

Decimal: store the decimal value of each byte as three numbers: 045 112 101 037 etc. where each byte is represented by 3 bytes. The data bloats three-fold.
Hexadecimal: store the bytes as hex pairs: AC 47 0D 1A etc. where each byte is represented by 2 bytes. The data bloats two-fold.

Base-64 maps 3 bytes (8 x 3 = 24 bits) in 4 characters that span 6-bits (6 x 4 = 24 bits). The result looks something like "TWFuIGlzIGRpc3Rpb...". Therefore the bloating is only a mere 4/3 = 1.3333333 times the original.

sonar 2.4 and 2.5

2010-12-30T12:55:00.000-08:00

Excited about Sonar's new features to set Architectural rules in version 2.4, and upcoming Track violations over time, differential views, manual code review in 2.5.

This surely will make my life little easier when doing daily code reviews.

http://www.sonarsource.org/roadmap/
http://www.infoq.com/news/2010/12/sonar-2.4

Thank you sonar source

Java Autoboxing - Auto-unboxing

2010-12-22T07:36:00.000-08:00

Java 1.5 onward auto-boxing and auto-unboxing were added. This allows you to covert primitives and boxed types primitives back and forth with simple assignment vs calling special functions or constructors.

Lets look at some examples.

int primitiveInt = 1000;                   //primitive int
Integer wrapperInt = new Integer(1000);    // wrapper Integer, boxed type primitive.
Integer autoBoxedWrapperInteger = 1000;    // Autoboxing, primitive is autoboxed to Integer, an
                                            //Object is bing created
int autoUnboxedPrimitiveInt = wrapperInt;  //Auto-unboxing, primitive is being assigned a value by auto-unoxing

//Comparing a primitive to boxed type, boxed type is autoboxed to primitive so the results is
// two primitives are being compared using === as opposed to 2 Objects are being ref compared
// using ==
System.out.println("primitiveInt == wrapperInt  :" +
            (primitiveInt == wrapperInt ? true : false));
//Two object references are being compared using ==, therefore the result is false
System.out.println("wrapperInt == autoBoxedWrapperInteger  :" +
            (wrapperInt == autoBoxedWrapperInteger ? true : false));
System.out.println("primitiveInt == autoBoxedWrapperInteger  :" +
           (primitiveInt == autoBoxedWrapperInteger ? true : false));
System.out.println("primitiveInt == autoUnboxedPrimitiveInt  :" +
           (primitiveInt == autoUnboxedPrimitiveInt ? true : false));

Output

primitiveInt == wrapperInt  :true
wrapperInt == autoBoxedWrapperInteger  :false
primitiveInt == autoBoxedWrapperInteger  :true
primitiveInt == autoUnboxedPrimitiveInt  :true

Here are some tips based on reading from Effective Java 2nd edition.

Prefer primitives over boxed primitives.

When you mix primitives and boxed primitive in single opeartion - boxed-primitive is auto-unboxed.

When mixing primitives and wrapper types in expression watch out for "==" comparision.

Performance hit due to autoboxing and unboxing, a new object is created when autoboxing is performed.

Unboxing can throw NullPointerException

HTTP Notes

2010-12-15T12:26:00.000-08:00

Keep alive/Persistent Connections : HTTP 1.1 introduced keep alive to keep the connection between web client and server alive and reuse it to serve subsequent requests. In HTTP 1.0 a new connection had to be created for serving each request.

Servlet 3.0 Asynchronous Processing

2010-12-15T11:58:00.000-08:00

Came across a great post on Servlet 3.0 asynchronous processing at http://www.javaworld.com/javaworld/jw-02-2009/jw-02-servlet3.html?page=1

Following are some notes based on the post.

Important thing to note is that it is not a fire and forget mechanism, as in put a request on a queue and return the response right away. The web client has to wait however long the request processing take place.

It is a way to free up request handling server threads from long running code. Instead the work in offloaded to be handled by manually created thread(s) by application code.

Client response stream can be open for extended period of time, and server can write to response to implement "push" model.

Following are some of the important methods from ServletRequest API from Servlet 3.0 .

AsyncContext getAsyncContext()
Gets the AsyncContext that was created or reinitialized by the most recent invocation of startAsync() or startAsync(ServletRequest,ServletResponse) on this request.

boolean     isAsyncStarted() Checks if this request has been put into asynchronous mode.
boolean isAsyncSupported() Checks if this request supports asynchronous operation.
AsyncContext     startAsync() Puts this request into asynchronous mode, and initializes its AsyncContext with the original (unwrapped) ServletRequest and ServletResponse objects.
AsyncContext     startAsync(ServletRequest servletRequest, ServletResponse servletResponse)
Puts this request into asynchronous mode, and initializes its AsyncContext with the given request and response objects.

HashMap Implementation notes

2010-11-17T08:55:00.000-08:00

Implements Map interface

Permits null values and null key

None of the methods of HashMap are synchronized, so if you are adding or deleting keys - you must synchronize in multi threaded environment. Synchronize on some object, if external object is not available use Collections.synchronizedMap(new HashMap())

Collections.synchronizedMap(new HashMap()) synchronizes all map operations using a internal mutex. However synchronization every single method is not enough, some client side locking is also required.

Iterators of HashMap are fail-fast when underlying map is modified (add/delete key) - ConcurrentModificationException is thrown.

Ordering of keys is not guaranteed to be same over time.

Access for get and put is time constant.

Max Capacity ~ 1.07 billiion

Default Initial capacity = 16

Uses hash function to disperse keys around.--

Uses Array to store elements.

Try and provide capacity as part of initialization.

Executing Asynchronous Actions in a Web Application

2010-03-29T18:35:00.000-07:00

Web applications need to provide instant response to end users, however not all requests can be served instantly due to a variety of constraints on infrastructure the application must live with. In an enterprise web applications there could a variety of long running tasks initiated by user request. To handle such task, the request could be queued for later processing and user is presented with a message to check status at a later time. For some requests a part of necessary processing could be done instantly and remaining could be done at a later time.

Queuing a request requires adding extra infrastructure to web applications. Request could be queued in a single instance of share data structure across the application. Application threads running in background can read the queue data structure and act on queue messages. Rather than writing this framework/infrastructure enterprise class open source libraries could be utilized. ActiveMQ provides a robust queuing solution and Apache Camel provides processing queued actions. Both libraries can be used in embedded or standalone fashion.

Architecture:

ServletContextListener initialize the ActiveMQ Broker and CamelContext, queues and routes are setup.

Have web action/controller write to ActiveMQ queue.

Write classes/camel routes to read from queue .

uuid

2010-02-19T20:05:00.000-08:00

UUID - Universally unique id is a 128 bit is a reasonably unique value. UUID was standarized by Open Software Foundation and Distributed Computing Environment. Purpose of UUID is to generate a universally unique identifier without contacting a central identifier generation system.

UUID are relavant to distributed computing, each machine can have 10 million UUID per second as per IETF REFC 4122 . Implementation for generating UUID are widely available in various programming language libraries and in DBMS.

JDK 1.5 provides classes to generate UUID.

Oracle SYS_GUID() , MySQL UUID() , SQL Server NEWID()

Apache Camel File Polling

2010-02-19T17:36:00.000-08:00

Just

Open source CSV reader

2010-01-20T06:20:00.000-08:00

A useful library can be used to read a CSV file or simply parse a CSV string. A huge time saver.

http://opencsv.sourceforge.net/project-summary.html

Maven Dependency
GroupId: net.sf.opencsv
ArtifactId: opencsv
Version: 2.1
Type: jar

Code sample, input could be 

CSVParser parser = new CSVParser();
String values[] = parser.parseLine(lineText);                    

Sample input
This, "is", a. "huge time save utility. Handles this comma , nicely "

Contract First Vs Code First

2010-01-18T11:22:00.000-08:00

Contact-first is one of design principles for achieving SOA. I came across an informative discussion on Contract First Vs Code First web service

http://tssblog.blogs.techtarget.com/2007/04/11/contract-first-or-code-first-design-part-1/

Discussion is structured around following 4 arguments for using Contract first

Code-first interfaces may not be well suite for the demands of remote traffic.

Implementation code typically changes at a faster rate than the interface.

Generated WSDL leads to interface bloat and duplicated and incompatible type definition.

Code-first doesn’t work in a multi-lingual development organization.

After being enriched by this discussion, here is my take on the these points

Code-first interfaces many not be well suited for demands of remote traffic.

Web Service interface should not contain chatty methods. Number of method calls invoked during conversation needs to be limited for performance reasons. It does not mater whether you use Contract-first or Code-first approach, as a web service interface designer you need to keep number of method calls to minimum. In code first approach WSDL is auto generated, however web service interface is your decision. On the Contract-first side as well you could end up with chatty web service, it is you who has to design the WSDL.

Implementation code typically changes at a faster rate than the interface.

If interface is remaining same and implementation is changing, one approach is not necessarily better than other. Changes could made to back-end without changing the interface. Implementer of Code-first needs to be careful when changing the implementation not to inadvertently affect the generated WSDL by exposing extra methods.

If interface is varying, then the comparison comes into picture what does it involve

In Contract-first approach, interface changes requires collaboration on interface , data type change amongst development personal from multiple applications. Possibilities of contention are lot more when you change schema type definitions common to multiple application. Multiple applications have to conform to same Schema type definition, which in itself could be limiting due to tight coupling. Let say CRM application requires changes to representation of Address/Contact, now rest of the applications that have Address/Contact domain model associated with common Address/Contact schema type has to be change and redeployed whether they want CRM address/contact change to be reflected in their application or not. On the flip side if we were to use code first approach only the applications that have something to do with CRM Address/Contact have to be changed. Change in Contract-first is much more involved and impact is lot larger than code-first approach. Down side of code first approach is that the representation are different across the applications and mapping code for common fields in Address/Contact need to be maintained. As times goes by, Address/Contact representations across the application will grow further apart due to number of changes over the years. It is will get harder to maintain the mappings code.

I would go with code-first approach in terms of time/efforts/resources required to make a change. Changes to mapping code/new representation could still be communicated to other application groups and put on their to-do list, as opposed to expecting them to drop everything and comply with super urgent change for your application.

If you can pull off the alignment of development resources and the collaboration needed to do Contract-first approach, contract-first approach is better and will keep data type uniform across the systems. Can you do it over a prolonged period ?

Generated WSDL leads to interface bloat and duplicated and incompatible type definition.

This point again depends on skills of code-first interface designer, a well designed interface won't generate bloated WSDL. Duplicate and Incompatible data type goes back to 2nd argument discussed earlier. The time and resources required to collaborate over common data type/data type reuse will be lot more over the years.

Code-first doesn’t work in a multi-lingual development organization.

If the language provide auto-generation tools, why not.

JAXB

2010-01-15T11:53:00.000-08:00

Data representation is a core component of communication between enterprise applications. There are a number of formats for data exchange - XML, CSV, JSON, proprietary to name a few. XML is a common format when working with web services and is also fundamental to SOA. Working with XML in Java applications often requires transformation between Java objects and XML documents. There are many open source tools (JAXB, XMLBeans, Xstreme, JiBX, Zeus, etc.) to achieve this transformation . This post explores JAXB. JAXB API is part of J2SE 1.6,

Convert XML Document into Java Objects (Unmarshal)

Converting a XML document into Java objects is a common use case. XML document that is being transformed to Java objects is required to have a XML Schema to produce bindings. Following steps will achieve the transformation . As you go through these steps you will notice use of auto generated classes to get XML data, you do not have to write XML parsing code using DOM or SAX. In some cases your application may already have predefined domain classes which closely match the XML schema representation or somewhat match XML representation and you may not not like using of auto generated classes, for these cases there are ways to minimize use of auto generated classes, using some mapping libraries or using JAXB Customizations.

Step 1: At compile time, use XML Schema associated with XML document and JAXB tool auto generate Java classes, this is called binding (Tool lets you specify a package name and generates java Interface and Implementation source file and an ObjectFactory class which provides methods to create generated types.

Use following command..(for generating code using Maven scroll down)

jdk\bin\xjc.exe -p com.mypkgname appscheama.xsd

INPUT Schema

I have used following XML Schema to model NFL scores

xml version="1.0" encoding="UTF-8"?>
xmlns="http://www.w3.org/2001/XMLSchema" targetNamespace="http://www.example.org/SportsSchema"
xmlns:xs="http://www.w3.org/2001/XMLSchema" xmlns:nfl="http://www.example.org/SportsSchema"
elementFormDefault="qualified">

<xs:complexType name="TeamType">
     <xs:attribute name="name" type="xs:string"/>
     <xs:attribute name="location" type="xs:string" />
<!--xs:complexType>

<xs:complexType name="FootballScoreType">
   <xs:sequence>
      <xs:element name="firstTeam" type="nfl:TeamType" />
      <xs:element name="secondTeam" type="nfl:TeamType" />
      <xs:element name="firstTeamPoints" type="xs:int"  />
      <xs:element name="secondTeamPoints" type="xs:int" />
   <!--xs:sequence
<!--xs:complexType>

<xs:element name="scores">
   <xs:complexType>
     <xs:sequence>
         <xs:element name="score" type="nfl:FootballScoreType" maxOccurs="unbounded" />
    <!--xs:sequence>
   <!--xs:complexType>
<!--xs:element>
</schema>

AUTO GENERATED CODE

Upon running the xjc tool, various Java classes representing XML schema are generated. Following is an example of generated for one of the element in schema. Notice the annotations on Java classes, this what make the binding work. Generated code also a ObjectFactory which is used to create instances of various auto generated types.

//

// This file was generated by the JavaTM Architecture for XML Binding(JAXB) Reference Implementation, v2.0.2-b01-fcs 
// See xml/jaxb">http://java.sun.com/xml/jaxb 
// Any modifications to this file will be lost upon recompilation of the source schema. 
// Generated on: 2010.01.08 at 02:37:52 PM EST
//

package com.spag.dataxchange.generated;

import java.math.BigInteger;
import javax.xml.bind.annotation.XmlAccessType;
import javax.xml.bind.annotation.XmlAccessorType;
import javax.xml.bind.annotation.XmlElement;import javax.xml.bind.annotation.XmlType;

/**
*
Java class for FootballScoreType complex type. *

* <p>The following schema fragment specifies the expected content contained within this class.
*/

        @XmlAccessorType(XmlAccessType.FIELD)
        @XmlType(name = "FootballScoreType", propOrder = { "firstTeam", "secondTeam", "firstTeamPoints", "secondTeamPoints"})

public class FootballScoreType {

 @XmlElement(required = true)
 protected TeamType firstTeam;

 @XmlElement(required = true)
 protected TeamType secondTeam;

 @XmlElement(required = true)
 protected BigInteger firstTeamPoints;

 @XmlElement(required = true)
 protected BigInteger secondTeamPoints;

 public TeamType getFirstTeam() {return firstTeam;}
 public void setFirstTeam(TeamType value) {this.firstTeam = value;}
 public TeamType getSecondTeam() {return secondTeam;}
 public void setSecondTeam(TeamType value) {this.secondTeam = value;}
 public BigInteger getFirstTeamPoints() { return firstTeamPoints; }
 public void setFirstTeamPoints(BigInteger value) {this.firstTeamPoints = value;}
 public BigInteger getSecondTeamPoints() {return secondTeamPoints;}
 public void setSecondTeamPoints(BigInteger value) {this.secondTeamPoints = value;}

Step 2: Now that we jave java XML bindings in place. We can use these classes to convert XML document into Java objects, aka unmarshaling. Unmarshaling is performed using JAXB API and auto generated classes from step 1. Following is sample code.

package com.spag.dataxchange;

import java.io.File;
import java.util.Iterator;
import java.util.List;
import javax.xml.bind.JAXBContext;
import javax.xml.bind.JAXBException;
import javax.xml.bind.Marshaller;
import javax.xml.bind.Unmarshaller;
import javax.xml.bind.Validator;
import com.spag.dataxchange.generated.*;

public class ScoreReader {
    public static void main(String [] args) {
       try {
           JAXBContext jaxbCtx =  JAXBContext.newInstance("com.spag.dataxchange.generated") ;
           Unmarshaller reader = jaxbCtx.createUnmarshaller();
           Scores obj = (Scores)reader.unmarshal(new File("src/main/resources/data/scores.xml"));
           List list = obj.getScore();
           Iterator iter = list.iterator();
           int i = 0;
           while(iter.hasNext()) {
                i++;
                FootballScoreType score = iter.next();
                System.out.println("Game " + i );
                System.out.println( score.getFirstTeam().getLocation()  + " - "  + score.getFirstTeam().getName() + ": " +                 score.getFirstTeamPoints());
                System.out.println( score.getSecondTeam().getLocation()  + " - "  + score.getSecondTeam().getName() + ": " +      score.getSecondTeamPoints());
           }          
        } catch (JAXBException e) {
           e.printStackTrace();
        }
    }
}

Consider the scenario where we already have domain classes defined, the challenge here is to either map the auto generated to classes to domain classes or to eliminate use of auto generated classes and go straight to domain classes. One way to eliminate/reduce use of auto generated classes is to use JAXB Customization. JAXB Customization tags lets you map XML schema to classes of your liking. Customizations can be specified inline with XML Schema code, however in most cases you won't be entitled to modifying the schema of XML document that being published by other application, that too referencing domain classes specific to your application. Thanks goodness customizations can be specified in external binding file (binding.xjb).

bindings.xjb allows you to map existing classes to domain classes, when invoking the xjc comipler specify the binding file that is being used. Binding customizations can be done at various xml schema element to class mapping,

<jxb:bindings version="2.0" xmlns:jxb="http://java.sun.com/xml/ns/jaxb"
 xmlns:xs="http://www.w3.org/2001/XMLSchema">
   <jxb:bindings schemaLocation="GolfSchema.xsd" node="/xs:schema"  >
        <jxb:bindings node="//xs:complexType[@name='golfRound']">
               <jxb:class ref="com.spag.dataxchange.golf.GolfRound"/>
        <!--jxb:bindings>
        <jxb:bindings node="//xs:complexType[@name='golfer']">
              <jxb:class ref="com.spag.dataxchange.golf.Golfer"/>
        <!--jxb:bindings>
   <!--jxb:bindings>
 <!--jxb:bindings>

Binding file could get unwieldy, there are other options to map auto generated class objects to domain class objects. Dozer is such a library that provides mapping from one JavaBean to other. This library could be utilized to convert between auto generated JAXB classes and your domain model.

Maven configuration for working with JAXB, including use of mapping files.

<dependency>
 <groupId>javax.xml.bind</groupId>
 <artifactId>jaxb-api</artifactId>
 <version>2.2</version>
 </dependency>
 
 <plugin>
     <groupId>org.codehaus.mojo</groupId>
     <artifactId>jaxb2-maven-plugin</artifactId>
     <version>1.3</version>
     <executions>
         <execution>
             <id>1</id>
             <goals>
                <goal>xjc</goal>
            </goals>
           <configuration>
                   <outputDirectory>${project.build.directory}/generated-sources</outputDirectory>
                   src/main/resources/schema/nfl
                  <schemaFiles>SportsSchema.xsd</schemaFiles>
                  <packageName>com.spag.dataxchange.generated</packageName> <!-- The name of your generated source package -->
           </configuration>
        </execution>
        <execution>
           <id>2</id>
           <goals>
             <goal>xjc</goal>
           </goals> 
           <configuration>
               <clearOutputDir>false</clearOutputDir>
               <outputDirectory>${project.build.directory}/generated-sources</outputDirectory>
                src/main/resources/schema/golf
               <schemaFiles>GolfSchema.xsd</schemaFiles>
               <packageName>com.spag.dataxchange.golf</packageName> <!-- The name of your generated source package -->
              src/main/resources/schema/golf
              <bindingFiles>bindings.xjb</bindingFiles>
           </configuration> 
      </execution>
 </executions>
  </plugin>

Convert Java Objects into XML document (Marshal)

To convert Java object into XML document, JAXB has schemagen tool which lets you create a Schema from your domain classes. Using Objects instances, generated XML schema and JAXB API you could generate the XML document easily. Here are some code snippets and maven configurations to ease your development.

<plugin>
 <groupId>org.codehaus.mojo</groupId>
 <artifactId>jaxb2-maven-plugin</artifactId>
 <version>1.3</version>
 <executions>
 <execution>
 <goals>
 <goal>schemagen</goal>
 </goals>
 </execution>
 </executions>
 <configuration>
 <outputDirectory>${project.build.directory}/generated-schema</outputDirectory>
 <includes>
 <include>com/spag/dataxchange/golf/*.java</include>
 </includes> <!-- The name of your generated source package -->
 </configuration>
 </plugin>

Further Pondering

JAXB is primarily used in webservices developed using existing Java classes.

What happens when the the schema changes / domain model changes ?

Explore of JAXB annotations.

Java to XML(WSDL)nges ?

Ref: https://jaxb.dev.java.net/tutorial/

http://blogs.sun.com/CoreJavaTechTips/entry/exchanging_data_with_xml_and1

Keep DAO clean using Hibernate Criteria /Criterion

2009-10-14T06:32:00.001-07:00

Hibernate Criteria/Criterion classes helps reduce the number of lines in DAO code. Have private methods returning the specific Criterion and in public DAO method compose complex criteria by calling private methods.

public List getSprints(Date afterDate, Date beforeDate) {
Criteria criteria = getSession().createCriteria(MyEntity.class);
criteria.add(getDateCriteria(afterDate, beforeDate));
return criteria.list();
}

public List getEntityByType(String type, Date afterDate, Date beforeDate) {
Criteria criteria = getSession().createCriteria(MyEntity.class);
criteria.add(getDateCriteria(afterDate, beforeDate));
criteria.add(Restrictions.eq("type", type));
return criteria.list();
}

private Criterion getDateCriteria(Date afterDate, Date beforeDate) {
if(beforeDate == null) { // Is parameter provided ?
beforeDate = new Date();
}
if(afterDate == null) { // Is parameter provided
Calendar cal = Calendar.getInstance();
cal.add(Calendar.YEAR, -1);
afterDate = cal.getTime();
}

Criterion start = Restrictions.between("startDate", beforeDate, afterDate);
Criterion end = Restrictions.between("endDate", beforeDate, afterDate);
return Restrictions.or(start, end);
}

Keep DAO clean using Hibernate Criteria /Criterion

2009-10-14T06:32:00.000-07:00

Web App + Security + Struts2

2009-07-18T09:41:00.001-07:00

When securing a web application there are few options for authentication and authorization of user/roles. You could write your custom logic, use container managed security, or use 3rd part libraries, or augment container managed security with custom logic.

Custom Security: Custom security is implemented by writing programming logic. For a pure Struts2 app (Where every url of the web application is served by Struts actions), typically user is authenticated using a custom HTML form backed by a custom LoginAction. LoginAction will validated username/password and then store the user information in session variable. This user/role information stored in session can be used control the logic for what URL/actions can be accessed by user. You can write a Struts2 interceptor and have every single request for struts2 resource go through this interceptor. When user tries to access a resource in the application, this interceptor will check if user is not logged by looking at certain data in user session. If data is not found user can redirected to login action. If user is logged in then you can check the role to make sure user has access to the resource, once the action is executed, you can use the user role information in view code (JSPs or other ) to hide/show certain section of view.

Disadvantage of above approach is is that only struts actions are protected. Another approach will be to write a Servlet filter instead of a struts Interceptor. Other disadvantage is you will end up with lot of logic for protecting different url for various roles. You may write code to read a custom configuration file.

Following is sample code

struts.xml
---------------

<package extends="struts-default">

<interceptors>
<interceptor name="login" class="mypkg.AuthenticationInterceptor"/>
<interceptor-stack name="intStack">
<interceptor-ref name="login"/>
<interceptor-ref name="defaultStack"/>
</interceptor-stack>
</interceptors>

<default-interceptor-ref name="intStack"/>

Login form
---------------
<s:form action="login">
<table> <tr> <td >Username:</td> </tr>
<tr><td><s:textfield name="username"/></td> </tr>
<tr><td>Password:</td> </tr>
<tr><td><s:password label="Password" name="password"/></td></tr>
<tr><td><s:submit value="Login" /></td></tr>
</table>
</s:form>

LoginAction
----------------

public class LoginAction {

private User user;
private String username;
private String password;

public String execute() throws Exception {
Map session = ActionContext.getContext().getSession();

if (username == null) {
return "login";
}
user = yourDAO.getUser(username, password);
if (user != null) {
session.put("user", user);
return SUCCESS;
}
else {
return "login";
}
}
public void setUsername(String username){
this.username = username;
}
public String getUsername() {
return username;
}
public void setPassword(String password){
this.password = password;
}
public String getPassword() {
return password;
}
}

Interceptor code
----------------------

public class AuthenticationInterceptor implements Interceptor {

public String intercept(ActionInvocation invocation) throws Exception {

Map session = ActionContext.getContext().getSession();

//Check by looking at user's http session for certain data which you
// If not logged in redirect user to login.action
if (!session.containsKey("user") && !ActionContext.getContext().getName().equals("login")) {
return "login";
}

// If user is logged in then vcheck if user has access to requested url

String result = invocation.invoke();
return result;

}

}

Container managed security + Custom security: Servlet specification provides declarative security, access to web resources can be defined in web.xml. Once user is authenticated application servlet API could be used to access authenticated user / role information. Struts2 action can also be restricted to certain roles declarative style. One drawback is Roles information needs to be maintained in web.xml, If your application creates roles dynamically, new roles have to be also specified in web.xml (Needs rebuilding war file/application restart).

<security-constraint>
<web-resource-collection>
<web-resource-name>SecuredPages</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<auth-constraint>
<role-name>*</role-name>
</auth-constraint>
</security-constraint>

<security-role>
<description>Role required to see admin pages.</description>
<role-name>admin</role-name>
</security-role>
<security-role>
<description>Role with read only.</description>
<role-name>reader</role-name>
</security-role>

For autheticating form authentication can be used with a jsp specified in web.xml, the jsp includes a form action j_security_check. username/password are validated against the realm specified in web.xml. Realm represents the source of username/password and associated roles. There are a wide variety of Realms (JDBC, JNDI, xml file, Datasource) which are specific to servlet containers. For a web application deployed in Tomcat Realm is specified in context.xml under META-INF/ direcotory

<login-config>
<auth-method>FORM</auth-method>
<realm-name>JDBCRealm</realm-name>
<form-login-config>
<form-login-page>/login2.jsp</form-login-page>
<form-error-page>/error.jsp</form-error-page>
</form-login-config>
</login-config>
Login form
----------

<s:form action="j_security_check">
<table> <tr> <td >Username:</td> </tr>
<tr><td><s:textfield name="j_username"/></td> </tr>
<tr><td>Password:</td> </tr>
<tr><td><s:password label="Password" name="j_password"/></td></tr>
<tr><td><s:submit value="Login" /></td></tr>
</table>
</s:form>

META-INF/context.xml, login action will be validated against following Realm
-------------------------------------------------------------------------
<Context>
<Realm className="org.apache.catalina.realm.JDBCRealm"
driverName="org.gjt.mm.mysql.Driver"
connectionURL="jdbc:mysql://mydbserver/mydb_test2"
connectionName="myuser" connectionPassword="mypassword"
userTable="users" userNameCol="email"
userCredCol="password" digest="MD5"
userRoleTable="user_roles" roleNameCol="name"/>
</Context>

Above setup will provide for authentication and authorization for URL in web applications.

If you application requires further restrictions on struts Actions based on user roles, roles interceptor could be used and security could be declared in struts.xml.

Any further customization could be programmed by writing additional struts interceptors or servlet filters. Following is an example of custom interceptor where a different struts result/view is presented to user based on role.

public class ReaderViewInterceptor implements Interceptor{

public void destroy() {
}

public void init() {
}

public String intercept(ActionInvocation invocation) throws Exception {

invocation.addPreResultListener(new PreResultListener() {
public void beforeResult(ActionInvocation invocation, String resultCode) {
Map resultsMap = invocation.getProxy().getConfig().getResults();
if( ServletActionContext.getRequest().isUserInRole("Reader") ) {
invocation.setResultCode("readonly_" + resultCode);
}
}
});

String result = invocation.invoke();
return result;
}

}

Web App + Security + Struts2

2009-07-18T09:41:00.000-07:00

MySQL InnoDB lock

2009-06-30T06:13:00.001-07:00

Recently I had to extract data from a number of large tables (MySql 5.0 InnoDB tables). Given the size of tables and number of joins, I used TEMP tables and stored procedure. When pushing data into temp tables I ran into locks on underlying SELECT tables. These queries were being run on a slave copy of MySQL replication. Lock on the select table were causing replication UPDATE/INSERT queries to time out and crash replication.

It turned out "INSERT INTO A_TEMP_TABLE select X, Y, Z from LARGE_TABLE1, LARGE_TABLE1 WHERE....." was locking large tables (InnoDB tables), even after specifying appropriate TRANSACTION ISOLATION LEVEL of READ COMMITTED.

MySQL documentation says the tables won't be locked, but they do get locked on 5.0.

"INSERT INTO T SELECT ... FROM S WHERE ... sets an exclusive index record without a gap lock on each row inserted into T. If innodb_locks_unsafe_for_binlog is enabled or the transaction isolation level is READ COMMITTED, InnoDB does the search on S as a consistent read (no locks)"

An ugly workaround was to use "SELECT INTO OUTFILE". Once you write to OUTFILE, you need to import it back in DB using LOAD DATE INFILE. It turns out you can not use LOAD DATA INFILE inside a stored procedure, so I had to fall back to Perl script to do the job.

Suggestions to MySQL.

1) Provide ability to ISSUE "INSERT INTO A_TEMP_TABLE select X, Y, Z from LARGE_TABLE1, LARGE_TABLE1 WHERE....." without locking tables when an apporpriate transaction level is specified. This probably is already fixed in 5.1.
2) Allow DATA LOAD INFILE from stored procedures.

MySQL InnoDB lock

2009-06-30T06:13:00.000-07:00

checked and unchecked exception

2009-04-29T19:57:00.000-07:00

Checked Exceptions. These are the exception that must be caught if you call a method that throws Checked exception. A method that may throw such exception, must explicitly declare it in method signature.

Unchecked exceptions: They can be thrown anytime, they not forced to be caught by compiler. Methods do not have to declare that they can throw an unchecked exception. Error and RuntimeException and their subclasses are treated as unchecked exceptions by java compiler.

Exceptions represent errors from which a program can potentially recover.
Exceptions and all its subclasses except RuntimeException are "Checked" exception
if you call a method that throws an exception you must have a catch block or declare your method to throw the exception.

Runtime exceptions should represent errors due to programming error, and a program is not expected recover from such exceptions. A program may catch the exception with Catch block but is not forced to catch it by compiler as Runtime excptions are "uncheck exceptions". Example ArrayIndexOutOfBound, NullPointerException, ClassCastException, NumberFormatException

Error class is also "unchecked exceptions". They represent errors from which program can not recover. Example is OutOfMemoryError.

One should try to reuse existing exception classes. There should be a real good exception to write a new exception class.

Following are commonly used exception. IllegalArgumentException, IllegalStateException, NullPointerException, IndexOutOfBoundsException, ConcurrentModificationException, UnsupportedOperationException.

Exception chaining: wrap an exception in a new one and throw new exception.

Try handling them at lower level.

Document exceptions thrown by a method.

Include detailed error message.

Validate and throw exceptions early on in a method.

Don't ignore exceptions

Reference: Effective Java, 2nd edition.

EJB Hibernate

2009-03-09T20:52:00.000-07:00

Love and hate regular expressions

2009-03-04T14:10:00.000-08:00

I had to look at thousands of lines of perl code packed full of regular expressions (some spanning multiple line). It is not a fun thing. Regular expression are extremely powerful, with power comes responsibility :).

I would use them with the consideration that the code I write will have to maintained by someone else few months/years down the line. I would place a few lines of documentation as to what the code is trying to do. It is very hard to document regular expression, placing a example text as to what RegEx is searching for helps.

If I am writing a one time script that won't be used by anyone else, I would unleash the full power for regular expressions.

Do check out this online tool to test your regular expressions. I can't thank enough the author of this tool. http://www.gskinner.com/RegExr/ , it made writing and testing the regular expression much less stressful.

Another great resource to learn regular expressions is at http://www.regular-expressions.info/engine.html

TODO: ADD cheatsheet of regex below!

Convention Over Configuration

2009-02-17T15:10:00.000-08:00

Convention Over Configuration refers to predefining conventions (for example a standard location where a file/directory is expected or following a naming schema for resources) for underlying frameworks/applications so that framework/application can work without having to specify these entries in configuration files. This enable end user of software to get going without lot of configuration, however a user/developer still has flexibility to configure in unconventional way.

Another term used is "Configuration by exception", configure when there is exception to rule(convention).

Example of these are plenty,

Build tool Maven expect source files to be in certain conventional location (like java classes reside in main\java\src ), however user can still specify other location for source code.

Hibernate Data mappings can work without specifying mapping files by following convention for Table names matching Class names.

Advantages:
-End user/developer can get going without too much configuration or too much boiler plate code(code that is repetitive and standard).
-Provides structure/discipline to a projects, certain things should be done using conventions, like source files should be named certain ways. Convention makes it easier for developer who is familiar with convention to jump into a project, as the project is organized in a familiar way. (On the flip side a developer who is new to framework, need to learn conventions!)

Disadvantages:
Underlying framework/application has to write code for convention and for configuration.
Convention have to be learned.

Maven

2009-01-20T19:18:00.000-08:00

A few months back I started using maven for a project, and since then my appreciation for this tool has been on the rise as I discover various feature and new plugins. Maven help out with software development process as well with design. Following are some of the benefits I have experienced.

Maven adds structure to your code repository. There is a place to put different artifacts (java source, properties files etc, JUnit test cases), this structure brings consistency to how code is organized in version control system.

Maven promotes modular design thru its dependency management feature. You can break up you project into different modules, and then build other modules on top of other modules. Maven can bring these modules together at build time. For example you could separate out DAO/Data model code create a maven module, then create another maven module for business logic which uses DAO/Data module, maven lets you specify the dependencies. This way you are maintaining a modular code and this will help you avoid mix up between your Data model class and business classes, lower layer modules are usable in multiple project if you need them.

Maven also helps you manage dependencies on 3rd party modules. you don't have to manually download tonnes of 3rd part jars, instead provide minimum information (artifactId, groupId, version) about 3rd party components, and the associated jars will be downloaded for you, you won't have to keep track hundreds of jars coming for dozens for 3rd part components.

Another advantage of of Maven is it lets developers work with different environments like QA, development, staging, production with ease. Settings for different environments could be specified in respective properties files (for example where is QA DB ?) , and at build time simply include the property file or apply these properties to various configuration file and other resources by simply specify a profile switch as one of the maven command argument.

Maven lets you run JUnit tests associated with you project.

Maven provides command line interface, and also works very well with popular IDEs like Eclipse and Netbeans, and with automated builds tools.

A wide range of maven plugins are available to do various task like compile, packaging, generating code and lot more. For example generating axis WSDL code from existing java sources, you could create various packaging foo you projects, execute SQL script againsts database, deploy your application. These links provide plugin descriptions http://maven.apache.org/plugins/index.html, http://mojo.codehaus.org/plugins.html

When you are starting with Maven the terminologies could be daunting but once you start using it, it is a pleasant song.

Java Heap Error in Maven JUnit Eclipse Environment

2008-12-29T14:35:00.000-08:00

I encountered Java Heap Error (java.lang.outOfMemoryError) while running JUnit test cases using Maven plugin in Eclipse IDE. When maven build is run thru IDE, it forks another java process which kept running out of heap space after reaching only about 100M. After changing a number of different settings in IDE, Maven, OS environment variables and spending close to 8 hrs. Finally arrived at the solution.

First changed environment variable JAVA_OPTS to -Xms40m -Xmx1024m -XX:MaxPermSize=256m but no luck.

Second changed MAVEN_OPTS to -Xms40m -Xmx1024m -XX:MaxPermSize=256m but no luck.

Third changed eclipse.ini to have vm parameter -Xms40m -Xmx1024m -XX:MaxPermSize=256m but no luck. This file is so fragile, making changes here breaks eclipse pretty bad.

Fourth through IDE , Run Configuration -> Maven Build provided VM parameters -Xms40m -Xmx1024m -XX:MaxPermSize=256m -verbose but no luck.

Fifth changed IDE setting for JDK to use vm parameters -Xms40m -Xmx1024m -XX:MaxPermSize=256m but no luck

Sixth option worked like charmed, in maven pom.xml added following setting for the plugin that helps you run JUnit test cases. Added following to .pom file.

<plugin>
<groupid>org.apache.maven.plugins</groupid>
<artifactid>maven-surefire-plugin</artifactid>
<version>2.2</version>
<configuration>
<argline>-Xmx1024m</argline>
</configuration>
</plugin>

mysql replication

2008-12-13T18:58:00.000-08:00

MySQL provides ability to replicate a database in a Master/Slave fashion. All write and update operations are done on Master instance and are written to a binary log. This log is read by slave instances to replicate the changes. Replication is done in asynchronous mode, slaves keep track of the location within the log.

When would you use a replication ?
1) For high scalability, read off of slaves and writes on Master.
2) For backups.
3) For having a copy of data to resource intensive analytics without hindering master server performance.