Friday, July 27, 2012

JAX-RS Tip of the Day: Basic Client Authentication

This is the second part of the JAX-RS Tip of the Day: Basic Authentication with JDBC. If you have not already done the pre-requisites, please examine the other article first.

Abstract

Unless you are developing a public service where authentication is not required like weather, or time services. This means that you will require authentication, and authorization. This application demonstrates how to perform basic authentication. This may be all that is required for your application, as long as, it is operating in a secure environment, or using secure transport (HTTPS).

Technical Details

If you have already completed creating a secure service, then you will really like how easy it is to create a basic authentication client for that service.

Requirements

As you can see from the code below. The most important item is to add a HTTPBasicAuthFilter to allow you to authenticate. Its that simple... really.

ExampleResourceClient.java

package com.bluelotussoftware.jersey;

import com.sun.jersey.api.client.WebResource;
import com.sun.jersey.api.client.filter.LoggingFilter;

/**
 * REST Basic Authentication Client Application
 *
 * @author John Yeary
 * @version 1.0
 */
public class BasicAuthenticationClient {

    public static void main(String[] args) {
        ExampleResourceClient erc = new ExampleResourceClient();
        erc.setUsernamePassword("jyeary", "test");
        System.out.println(erc.getMessage());
        erc.close();
    }

    static class ExampleResourceClient {

        private com.sun.jersey.api.client.WebResource webResource;
        private com.sun.jersey.api.client.Client client;
        private static final String BASE_URI = "http://localhost:8080/secure-jdbc-rest-service/resources";

        public ExampleResourceClient() {
            com.sun.jersey.api.client.config.ClientConfig config = new com.sun.jersey.api.client.config.DefaultClientConfig();
            client = com.sun.jersey.api.client.Client.create(config);
            client.addFilter(new LoggingFilter());
            webResource = client.resource(BASE_URI).path("example");
        }

        public String getMessage() throws com.sun.jersey.api.client.UniformInterfaceException {
            WebResource resource = webResource;
            return resource.accept(javax.ws.rs.core.MediaType.TEXT_PLAIN).get(String.class);
        }

        public void putMessage(Object requestEntity) throws com.sun.jersey.api.client.UniformInterfaceException {
            webResource.type(javax.ws.rs.core.MediaType.TEXT_PLAIN).put(requestEntity);
        }

        public void close() {
            client.destroy();
        }

        public void setUsernamePassword(String username, String password) {
            client.addFilter(new com.sun.jersey.api.client.filter.HTTPBasicAuthFilter(username, password));
        }
    }
}

Thursday, July 26, 2012

JSF Tip of the Day: <facelet-taglib /> Schema Declaration Issue

This is not so much as a tip as a warning. If you are trying to use the published schema at Java EE : XML Schemas for Java EE Deployment Descriptors and specifically the facelet-taglib schema from the definition, it has a typo in the declaration.

INCORRECT

CORRECT

Do you see the error?

It is in the schemaLocation. They misspelled library as libary in web-facelettaglibrary_2_0.xsd.

I try to confirm the schema from the source rather than copying it from some other non-authoritative source. This time I found a problem with the cannon source.

JAX-RS JUG Demo CDI and @Singleton Usage

This is the last demonstration I gave at the Greenville Java Users Group (GreenJUG) on CDI and JAX-RS. I cleaned up the code, but not as much as you would think. I managed to code this in about 15 minutes during the meeting live while everyone watched. It was a fun experience, but the best part is that it worked during a live un-rehearsed demo.

It goes to show you that CDI and JAX-RS are simple enough in combination to use in a live high stress demo environment. Imagine what it could do for you in your code. This code was written using NetBeans 7 IDE which may be responsible for the simplicity as much as the other technologies.

Here is the source code: cdi-example.zip

The code below demonstrates some interesting bits. The source code above contains the less interesting POJOs.

PersonResource.java

PersonDB.java

JAX-RS JUG Demo Examples (@QueryParam and @PathParam)

I gave a demo of JAX-RS using @QueryParam and @PathParam annotations, and created a client to connect with the resources and display the results. I promised to post the code. So here it is along with some cleanup.

Here are the Apache Maven projects and code:
simple-queryparam-example.zip
simple-queryparam-client-example.zip

Example.java

SimpleExampleClientApplication.java

Wednesday, July 25, 2012

JAX-RS Tip of the Day: Basic Authentication with JDBC

Abstract

Unless you have a public API like a weather service, or perhaps barometric pressure measurements. You will likely need some form of authentication, and authorization for your service. A tried and tested mechanism is to use JDBC Realm based authentication. In this example I will create a set of database tables on Apache Derby, set up the security realm on GlassFish 3.1.2.2, and configure basic authentication on a RESTful web service. The majority of the work will be done using the NetBeans IDE 7.2.

Requirements

NetBeans 7.2
secure-jdbc-rest-project Maven project

Database

The first thing we need to do is to set up our database tables which we will use for authentication. These tables can contain more information, but in my example I will keep them simple.

Creating Tables

First we will need to create a Users table which will contain our username and password. Using the sample database in NetBeans do the following:

Select the Services Window, and open the Databases selection
Right click on the Java DB icon, and start the server if it is not already started
Right click on the sample database connection: jdbc:derby://localhost:1527/sample [app on APP] and connect.
Right click on the sample connection and select Execute Command.
Execute the create table commands and create index commands below.

CREATE TABLE users ( username varchar(255) NOT NULL, password varchar(255) DEFAULT NULL, PRIMARY KEY (username) );

CREATE TABLE groups ( username varchar(255) DEFAULT NULL, groupname varchar(255) DEFAULT NULL);

CREATE INDEX groups_users_idx ON groups(username ASC);

Create Tables

Add Users and Groups

We need to add at least one user and group to our table. Since I am using GlassFish as the container, I will use SHA-256 to hash my password. That way it is not visible in plain text.

Right click on our new USERS table, and select View Data
Click on the Insert Records Icon
Add a user, and add a SHA-256 hash of the password.
Note:An online generator can be found at SHA-256 hash calculator
Repeat the same process as above to open the GROUPS table
Add the username and a group called users

That completes all we need for our JDBC authentication.

GlassFish JDBC Realm

Using the NetBeans IDE perform the following:

Go to the Services window and expand the Servers selection.
Right click on GlassFish 3.1.2 server and select Start.
Right click and select View Domain Admin Console.
On the Admin console web page on the tree on the left select Configurations » server-config » Security » Realms.
Add a new realm called jdbc with the following properties:
- Name: jdbc
- Class Name: com.sun.enterprise.security.auth.realm.jdbc.JDBCRealm
- JAASContext: jdbcRealm
- JNDI: jdbc/sample
- User Table: users
- User Name Column: username
- Password Column: password
- Group Table: groups
- Group Table User Name Column: username
- Group Name Column: groupname
- Database User: app
- Database Password: app
- Digest Algorithm: SHA-256
- Encoding: Hex
- Charset: UTF-8
Note: the parameters are case sensitive.
Navigate to Configurations » server-config » Security
Change the Default Realm to jdbc
Check the Default Principal To Role Mapping checkbox to enabled
Click Save and Restart server.

The security mapping configuration for automatic mapping makes it so that our application will not require a glassfish-web.xml file as part of our deployment.

JAX-RS Application

Finally we have completed all of the requirements on the server side for securing our applications. This security mechanism can be used by more than the application we will are preparing to deploy. We need to set up the security constraints in our web.xml file as shown below. If you have downloaded the code you can simply open it in NetBeans and examine it.

web.xml

Using NetBeans, you can simply run the application and it will prompt you for an application server. Select the current GlassFish server we have set-up, and it will deploy in a few seconds. You will come to a index.jsp page.

Click on the link for the application.wadl, or navigate to http://localhost:8080/secure-jdbc-rest-service/resources/example and you will be prompted to login. Once you login, you should get this message from the REST service.

This is an example message

Thursday, July 12, 2012

JSF Tip of the Day: Creating Composite Components

The NetBeans IDE is a great tool for doing Java EE development. One feature that I think is overlooked is the ability to refactor your XHTML pages into composite components. The video below demonstrates how to do it. The code was developed using NetBeans IDE and GlassFish.

The cleaned up and more polished code is provided for your enjoyment: sample-composite-component-demo.zip

Monday, July 09, 2012

JSF Tip of the Day: <ui:repeat /> Usage Example

Abstract

A common use case is to iterate over a collection of elements, and display them on a page. In the world of JSP, we would use a Java Standard Tag Library (JSTL) <c:forEach/>. This will work in JSF, but does have the same lifecycle as JSF which can cause issues if the data is dependent on the JSF lifecycle.
The solution is to use <ui:repeat/> to iterate over the collection. The <ui:repeat/> Facelets component is designed to work with JSF. It has the same lifecycle as the other JSF components on the page, and is a lot more flexible than the <c:forEach/> tag.

Description

The examples in this project demonstrate a number of methods to utilize the <ui:repeat/> in your own project.

Bug

There is a bug in versions of Mojarra less than 2.1.9 that the size includes the end element as per JAVASERVERFACES-2210.It was fixed as of version 2.1.9. Note: You will need to upgrade JSF libraries in GlassFish to see the corrections. Please see the release notes for Java Server Faces for upgrade procedures. The project was developed using NetBeans 7 IDE and Apache Maven. The project was tested on GlassFish 3.1.2.

The code for the project can be downloaded here: ui-repeat.zip

Code

index.xhtml

IndexBean.java

Sunday, July 08, 2012

JAX-RS Simple XML Service and Client Example

I thought that I would publish the information and code from a recent JUG meeting where I coded some simple JAX-RS examples on the fly to show how easy it can be to create RESTful web services.

This particular code for the service and client are nothing fancy, but I told the JUG members that I would publish it when I got a chance.

Code

The Apache Maven based projects were developed using the NetBeans 7 IDE and GlassFish 3.1.2. You will need to run the simple-xml-example project first before you can run the client application.

The code for the projects can be downloaded here: simple-xml-example.zip and simple-xml-example-client.zip

ExampleResource.java

SimpleXMLExampleClient.java

JSF Tip of the Day: @ViewScoped and @ConversationScoped Usage

Abstract

A question that often comes up is when and where to use a particular scope in JSF. This has become even muddier with the addition of CDI support in JSF. In the upcoming release of Java EE 7, there will be even more scopes to consider. This example code demonstrates using @ViewScoped and @ConversationScoped.

Explanation

@ViewScoped

If you want to have the information on the page to update, and you are not navigating away from the page; a clear choice is the use of @ViewScoped. This is particularly true when the page is heavily dependent on AJAX. This allows partial-page submission for validation for example without losing the data contained on the page.

@ConversationScoped

A @ConversationScoped scoped bean is for a long running process where there is a definite beginning and end. A perfect example is a wizard, or checking out of an online store.

The conversation begins when you click "Pay" and ends when you are given your receipt, or order information. Another example would be a complex series of wizards where there are multiple pages to complete the process. The point to keep in mind is that you have a clear bounds to start and end with.

Description

In this example code, I have a list of family members which are in different scopes depending on which example you pick. In the @ViewScoped bean you can delete people from the list and it maintains the list of changes unless you navigate away from the page. Then the list is reset back to the original values. In the @ConversationScoped bean, once you navigate to the page, a conversation begins. This will allow you to modify the list of names, and navigate to different pages and back without losing your data. Once you click on the End button, the conversation ends.

Code

The project was developed using NetBeans 7 IDE and Apache Maven. The project was tested on GlassFish 3.1.2.

The code for the project can be downloaded here: scope-examples.zip

viewscope.xhtml

conversation.xhtml

ViewScopeBean.java

ConversationBean.java

Friday, July 06, 2012

JSF 2.1 Custom PrimeFaces 3.3 Tree Example

Custom PrimeFaces Tree

I was looking at the default implementation of PrimeFaces <p:tree /> and <p:treeNode />. The default looks nice, but I wanted a different look with different icons.

The icons I picked look more like "nodes" and "documents. The icons are by Yusuke Kamiyamane in his Fugue Icon set. These icons are released under a Creative Commons 3.0 Attribution License.

I also wanted a more flexible tree model with a custom TreeNode implementation that uses node types (node, leaf), and a data component which is represented by an Object.

The result is a nice looking tree that changes icons subtly on selection, or deselection of a node, and leaf nodes are displayed as document icons.

The Apache Maven project was developed using NetBeans 7, GlassFish 3.1.2, and PrimeFaces 3.3.1.

The source code can be downloaded here: primefaces-custom-tree.zip

index.xhtml

TreeNodeImpl.java

TreeNodeType.java

TreeBean.java

Thursday, July 05, 2012

Exporting Trusted Certificates in Java

I was trying to export some trusted certificates in Java, and I discovered that the default Java keytool will not do it much to my dismay. So I decided to write a little utility class to export the certificates into PEM files from X509 certificates so it would be easier to move them around.

I thought I would clean up my little tool, and share it with the world.

It requires the GlassFish webservices-osgi.jar which is located in the glassfish-3.1.2/glassfish/modules/ directory along with Apache commons-cli-1.2 and commons-io-2.1.

The application takes a couple of command line arguments to work. It has usages, but the project properties also shows all of them in action. You will need to set that up to match your environment in the IDE. Here is an example.

java -jar certificate-manager.jar -f /Applications/NetBeans/jboss-5.0.1.GA/server/default/conf/server.keystore -i "CN=John Yeary, OU=Development, O=Blue Lotus Software, L=Greenville, ST=South Carolina, C=US" -s 4f2ac2cf -p changeit -e

-----BEGIN CERTIFICATE-----
MIICgTCCAeqgAwIBAgIETyrCzzANBgkqhkiG9w0BAQUFADCBhDELMAkGA1UEBhMCVVMxFzAVBgNV
BAgTDlNvdXRoIENhcm9saW5hMRMwEQYDVQQHEwpHcmVlbnZpbGxlMRwwGgYDVQQKExNCbHVlIExv
dHVzIFNvZnR3YXJlMRQwEgYDVQQLEwtEZXZlbG9wbWVudDETMBEGA1UEAxMKSm9obiBZZWFyeTAe
Fw0xMjAyMDIxNzA3MjdaFw0xMjA1MDIxNzA3MjdaMIGEMQswCQYDVQQGEwJVUzEXMBUGA1UECBMO
U291dGggQ2Fyb2xpbmExEzARBgNVBAcTCkdyZWVudmlsbGUxHDAaBgNVBAoTE0JsdWUgTG90dXMg
U29mdHdhcmUxFDASBgNVBAsTC0RldmVsb3BtZW50MRMwEQYDVQQDEwpKb2huIFllYXJ5MIGfMA0G
CSqGSIb3DQEBAQUAA4GNADCBiQKBgQCa564RyVtq+i+L+BsA0YzmpY4WMkfEn++3s10AbUv/IidT
25TixYqc7ghOkA5HI0z893Gy/ozzB6sGJ6gk8W28VjlU0Y4r0NUhUALuDYnkReWeUiUp4ubPoj/G
71WWu8FFQul+DJWAL7c/963rui812HofQuEWnyZjenrXQMvAUwIDAQABMA0GCSqGSIb3DQEBBQUA
A4GBAECXGuLB/ZB33nGauRsW4kqjiPwpkUoc8N7h44JBVATGx210HzNufixYSqq+AQhW86X2DYJ0
yyBGawVQvpUWoBHCVmmNmu6XdYDfSaCUsPeEt0RoFezruTMz6kaedRwK4zP3H3gp6fHYyiq/mD2M
jTna0zCi4o25E3eiOGKvGBd9
-----END CERTIFICATE-----

The project was developed with NetBeans and GlassFish 3.1.2.

The NetBeans project files can be downloaded here: certificate-manager.zip

TrustedCertificatePEMExportUtility.java

PrimeFaces AJAX Enabled <p:selectOneMenu />

I saw a question posed on stackoverflow called Trouble with Primefaces 3.0.M2 SelectOneMenu Ajax behavior and I had just done an example a couple of months ago on a car trip so I decided to post my solution here, and reference it.

Essentially the problem is how to control the list of items in a second <p:selectOneMenu/< from the selection made in the first menu. The question comes up frequently enough that I decided to write up a demo application.

The application was developed using NetBeans 7.1.2 and PrimeFaces 3.2 originally. It has been updated to use PrimeFaces 3.3.1 which is the most current at the time of writing. I validated it on GlassFish 3.1.2.

The Apache Maven project can be downloaded from here: primefaces-ajax-selectone.zip

This demo wants the user to pick a state, and then a city. A key problem is not just the update, but not displaying city values if a state is not selected. Also erasing the selected city, if the state has changed.

index.xhtml

DataBean.java

Wednesday, July 04, 2012

Tip of the Day: Code Review Checklist

Over the last few days, I have published some code review tips of the day. This post actually contains a link to a Microsoft Word Document with those tips in checklist format.

Code Review Checklist.docx

Tip of the Day: Performance Code Review

Performance

Here are some general best practices to consider around performance code review.

These tips are by no means definitive, but serve as reminders to developers what they should consider in a checklist.

Note: performance code reviews are really not separate processes from a general code review.

Objects are duplicated only when necessary. If you must duplicate objects, consider implementing Clone and decide if deep cloning is necessary.
No busy-wait loops instead of proper thread synchronization methods. For example, avoid while(true){ ... sleep(10);...}
Avoid large objects in memory, or using String to hold large documents which should be handled with better tools. For example, don't read a large XML document into a String, or DOM.
Do not leave debugging code in production code.
Avoid System.out.println(); statements in code, or wrap them in a boolean condition statement like if(DEBUG) {...}
"Optimization that makes code harder to read should only be implemented if a profiler or other tool has indicated that the routine stands to gain from optimization. These kinds of optimizations should be well documented and code that performs the same task should be preserved." - UNKNOWN.

Note: I found this gem a few years ago, but it is so true. If anyone knows who said this, please comment.

Tuesday, July 03, 2012

Tip of the Day: Error Handling Code Review

Error Handling

Here are some general best practices to consider around error handling code review.

These tips are by no means definitive, but serve as reminders to developers what they should consider in a checklist.

Note: error handling and general code reviews are really not separate processes.

Invalid parameter values are handled properly early in methods (Fast Fail).
NullPointerException conditions from method invocations are checked.
Consider using a general error handler to handle known error conditions.
An Error handler must clean up state and resources no matter where an error occurs.
Avoid using RuntimeException, or sub-classes to avoid making code changes to implement correct error handling.
Define and create custom Exception sub-classes to match your specific exception conditions. Document the exception in detail with example conditions so the developer understands the conditions for the exception.
(JDK 7+) Use try-with-resources. (JDK < 7) check to make sure resources are closed.
Don't pass the buck! Don't create classes which throw Exception rather than dealing with exception condition.
Don't swallow exceptions! For example catch(Exception ignored) {}. It should at least log the exception.

Monday, July 02, 2012

Typed Query RESTful Service Example

This example demonstrates how to use a TypedQuery<T> in a JAX-RS (Jersey) application. The service implementation utilizes a @Stateless session bean to handle the transactions, and scale the application. The application was developed using NetBeans, and GlassFish 3.1.2.

The primary reason for using a TypedQuery<T> is to maintain type safety, and give the compiler a chance to determine if there are any problems with the code. This combined with a CriteriaQuery<T> provide additional safety and functionality that was not available in Java EE5 and JPA 1.0.

There is additional functionality in the application. There is an index page which leads to the examples.

The project can be downloaded here: TypedQueryExample.zip

Interesting Bits...

JavaFX 2.2 Pie Chart with JPA 2.0

Shipping Costs By Purchase Order

I saw an example of a Pie Chart using JavaFX. I thought that it looked really nice and I wondered how easy it would be to do using JPA 2.0, an example Apache Derby DB included in NetBeans, and NetBeans 7.2.

Well the first iteration took about 10 minutes, and the tweaking took another 15 minutes. Basically, if you asked me to do it again, I bet I could do it in under 5 minutes. My output looks really cool too.

I saw an old post using JavaFXScript to create a similar output which was used in JSF. I am wondering if I can do the same thing using version 2.2 of JavaFX, or if I should wait until the HTML libraries are complete.

The code for the project can be downloaded here: PieChartExample.zip

PieChartExample.java

Tip of the Day: Unit Testing Code Review

Testing

Here are some general best practices to consider around unit test code review.

These tips are by no means definitive, but serve as reminders to developers what they should consider in a checklist.

Note: unit testing and code reviews are really not separate processes.

Unit tests are added for each code path, and behavior. This can be facilitated by tools like Sonar, and Cobertura.
Unit tests must cover error conditions and invalid parameter cases.
Unit tests for standard algorithms should be examined against the standard for expected results.
Check for possible null pointers are always checked before use.
Array indices are always checked to avoid ArrayIndexOfBounds exceptions.
Do not write a new algorithm for code that is already implemented in an existing public framework API, and tested.
Ensure that the code fixes the issue, or implements the requirement, and that the unit test confirms it. If the unit test confirms a fix for issue, add the issue number to the documentation.

Sunday, July 01, 2012

JSF Tip of the Day: JSF 2.1 AJAX Examples with PrimeFaces 3.3 and Mojarra 2.1

I have been working with my team at the office to bring them up to speed on using JSF and AJAX. I have been encouraging them to use PrimeFaces to reduce the amount of code required to "AJAXify" JSF components. PrimeFaces has AJAX functionality built in, or uses a simple <p:ajax/> tag to enable it.

However, I think that it is important to be able to use the default Mojarra JSF RI implementation along with its <f:ajax/> functionality both as a tag, and as JavaScript. The code examples below use a combination of PrimeFaces and Mojarra to demonstrate the ease with which you can develop fully functional AJAX applications with JSF.

The examples are done using Apache Maven on NetBeans 7.2 RC 1 and deployed to GlassFish 3.1.2. using JSF 2.1.0 and PrimeFaces 3.3.1.

The code for the project can be downloaded here: ajax-examples.zip

index.xhtml

IndexBean.java

The pictures below demonstrate the before and after of clicking the checkbox, and radio buttons.

Before

After

Do You Remember When?... Closing Windows in Swing

I was just looking at some old Swing code. I mean some really old Swing code, and I found this interesting morsel of code which made me think back to when this was considered the standard mechanism for window management.

Today when we want to control the closing of a JFrame, we would use something like setDefaultCloseOperation(int operation). If we wanted the frame to close when someone clicked the "X", we would set it using setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE). The code I found was the old style of doing it, and it made me think about it. Here is the code snippet I found which would still work today.

Here are the rules for the implementation.

There are three elements that the event handling mechanism must employ:

It must implement a listener interface, or extend a class that implements a listener interface.
You must register an event handler class as a listener on one or more components.
The event handler class has code that implements methods in the listener interface.

Does it meet the requirements? It sure does, and the code works today. It is part of my code cleanup for code I have kept since 1995, and I am deciding what is useful.

Update: I found this comment in the code too. It is still true and relevant, but I must have thought it important to document since there are so many little event handlers. Since it was not in source control, I have no idea when I wrote this. Perhaps when Swing came on the scene (1997)? Interesting historical note.

The event handler code should be minimized to allow the program to remain responsive to user input. The event handling code is handled on a single thread - event-dispatching thread. This thread also handles the paint and repainting of components. This may also result in "gray screens" while the system is waiting to repaint a component.

Tip of the Day: Documentation Code Review

Documentation

Here are some general best practices to consider around documentation code review.

These tips are by no means definitive, but serve as reminders to developers what they should consider in a checklist.

Note: documentation and code reviews are really not separate processes.

All methods are commented in clear language. If it is unclear to the reader, it is unclear to the user.
All source code contains @author for all authors.
@version should be included as required.
All class, variable, and method modifiers should be examined for correctness.
Describe behavior for known input corner-cases.
Complex algorithms should be explained with references. For example, document the reference that identifies the equation, formula, or pattern. In all cases, examine the algorithm and determine if it can be simplified.
Code that depends on non-obvious behavior in external frameworks is documented with reference to external documentation.
Confirm that the code does not depend on a bug in an external framework which may be fixed later, and result in an error condition. If you find a bug in an external library, open an issue, and document it in the code as necessary.
Units of measurement are documented for numeric values.
Incomplete code is marked with //TODO or //FIXME markers.
All public and private APIs are examined for updates.