One of the best Podcasts I have come across, on Web Services concepts...
Lecture 11: Web Services, SOAP 1.2, and WSDL 1.1
Harvard Extension School\'s Computer Science E-259: XML with J2EE
perl -e '@q=stat($ARGV[0]); print time-$q[9]' file1
ls -ltr
#!/usr/bin/perl
#^ PROGRAM DESCRIPTION
#^ -------------------
#^ This program prints the modification times and names of files.
#^ It uses the following format: inodetime.pl filename
#^ It will accept: inodetime.pl filename1 filename2 filename3
#^ inodetime.pl /tmp/file*
#^ The format of the output is: YYYYMMDDhhmmss filename
#^ example:
#^ $ inodetime.pl /tmp/t*
#^ 19961115105425 /tmp/test.sql
#^ 19970116113616 /tmp/tststat.pl
#^
#^###################################################################
# Get the (next) input from the command line
while ($curfile = $ARGV[0])
{
# Do following code block only if $curfile exists
if (-e $curfile)
{
# stat structure into variables
($dev,$ino,$mode,$nlink,$uid,$gid,$rdev,$size,
$atime,$mtime,$ctime,$blksize,$blocks) = stat("$curfile");
# time structure into variables
local($sec,$min,$hr,$day,$mon,$yr,$wday,@dntcare) = localtime($mtime);
$yr = ($yr>=70) ? $yr+1900 : $yr+2000;
$yr="$yr";
$mon = (++$mon < 10) ? "0$mon" : "$mon";
$day = ($day < 10) ? "0$day" : "$day";
$hr = ($hr < 10) ? "0$hr" : "$hr";
$min = ($min < 10) ? "0$min" : "$min";
$sec = ($sec < 10) ? "0$sec" : "$sec";
# Rearrange in the YYYYMMDDhhmmss format and assign to $dte variable
$dte = join('',$yr,$mon,$day,$hr,$min,$sec);
# Print modification date and filename
print ("$dte $curfile\n");
}
# Shift to next position in command line
shift (@ARGV);
}
#! /usr/bin/ksh
typeset -Z2 d m
Jan=1 Feb=2 Mar=3 Apr=4 May=5 Jun=6 Jul=7 Aug=8 Sep=9 Oct=10 Nov=11 Dec=12
date "+%Y %m" | read year month
for i ; do
line=$(ls -dl $i)
line=${line##+([! ])+([ ])}
line=${line##+([! ])+([ ])}
line=${line##+([! ])+([ ])}
line=${line##+([! ])+([ ])}
line=${line##+([! ])+([ ])}
set -A stamp $line
d=${stamp[1]}
eval m=\$${stamp[0]}
y=${stamp[2]}
((${#y} != 4)) && ((y=year-(m>month)))
echo $y $m $d $i
done
exit 0
Adding Custom Events
Goal: Provide a mechanism to suspend a task for a period of time, and automatically resume the task after the time period is up.
Solution: Add custom Events for task suspend and task resume, override the suspend and resume methods in a custom task instance to fire the suspend and resume events.
1) Optional - Add two new EVENTTYPEs for suspend and resume to the org.jbpm.graph.def.Event class. (not necessary however, just a convenience)
public static final String EVENTTYPE_TASK_SUSPEND = "task-suspend";
public static final String EVENTTYPE_TASK_RESUME = "task-resume";
2) Optional - Add these to the supported EventTypes in the org.jbpm.graph.def.Task class. (not necessary since jBPM determines event-types dynamically).
static final String[] supportedEventTypes = new String[]{
Event.EVENTTYPE_TASK_CREATE,
Event.EVENTTYPE_TASK_ASSIGN,
Event.EVENTTYPE_TASK_START,
Event.EVENTTYPE_TASK_END,
Event.EVENTTYPE_TASK_SUSPEND,
Event.EVENTTYPE_TASK_RESUME
2) Subclass .jbpm.graph.exe.TaskInstance
Override Suspend and Resume
public void suspend(String date) {
super.suspend();
if ( (task!=null)
&& (token!=null)
) {
ExecutionContext executionContext = new ExecutionContext(token);
// the TASK_SUSPEND event is fired
executionContext.setTaskInstance(this);
executionContext.setTask(task);
executionContext.getTaskInstance().setVariable("suspendUntilDate", date);
task.fireEvent(Event.EVENTTYPE_TASK_SUSPEND, executionContext);
}
}
public void resume() {
super.resume();
if ( (task!=null)
&& (token!=null)
) {
ExecutionContext executionContext = new ExecutionContext(token);
// the TASK_RESUME event is fired
executionContext.setTaskInstance(this);
executionContext.setTask(task);
task.fireEvent(Event.EVENTTYPE_TASK_RESUME, executionContext);
}
}
3) Configure the timer on the task
<process-definition
xmlns="urn:jbpm.org:jpdl-3.1"
name="simple">
<action name="resume" class="com.sample.action.ResumeActionHander" />
<start-state name="start">
<transition name="" to="Create Order"></transition>
</start-state>
<end-state name="end"></end-state>
<task-node name="Approve Order" create-tasks="true">
<task name="approve" description="Review order">
<assignment class="com.sample.assignment.SomeAssignmentHandler"
</assignment>
<event type='task-suspend'>
<action name="Suspend Timer" class="com.sample.action.CreateTimerActionHandler">
<action>resume</action>
</action>
</event>
<event type="task-resume">
<action name="SendMessage" class="com.sample.action.MessageActionHandler">
<message>resumed the task instance</message>
</action>
</event>
<controller class="com.sample.taskinstance.CustomTaskControllerHandler"></controller>
</task>
<transition name="" to="end"></transition>
</task-node>
...
</process-definition>
4) Implement CreateTimerActionHandler
public class CreateTimerActionHandler implements ActionHandler {
private String action;
private static final long serialVersionUID = 1L;
/** {@inheritDoc} */
public void execute(ExecutionContext executionContext) throws Exception {
Timer timer = new Timer(executionContext.getToken());
timer.setName(executionContext.getAction().getName());
TaskInstance taskInstance = executionContext.getTaskInstance();
String dueDate = (String)taskInstance.getVariable("suspendUntilDate");
// parse the due date
DateFormat format = DateFormat.getDateTimeInstance(DateFormat.SHORT,
DateFormat.SHORT);
Date date = format.parse(dueDate);
timer.setDueDate(date);
// retrieve a named action from the process definition
Action action = executionContext.getProcessDefinition().getAction(
this.action);
timer.setAction(action);
// set the TaskInstance so the resume action knows what taskInstance to resume
timer.setTaskInstance(taskInstance);
SchedulerService schedulerService = (SchedulerService) Services
.getCurrentService(Services.SERVICENAME_SCHEDULER);
schedulerService.createTimer(timer);
}
}
5) Implement ResumeActionHandler
public class Resume implements ActionHandler {
public class ResumeActionHandler implements ActionHandler {
private static final long serialVersionUID = 1L;
public void execute(ExecutionContext executionContext) throws Exception {
System.out.println("resuming taskInstance");
TaskInstance taskInstance = executionContext.getTaskInstance();
System.out.println("TaskInstance is " + taskInstance);
CustomTaskInstance cti = (CustomTaskInstance) executionContext.getJbpmContext().getSession().load(CustomTaskInstance.class, new Long(taskInstance.getId()));
cti.resume();
}
}
NOTE: This example has not been updated to work with jBPM versions 3.2 or greater.
Use-Case
Suppose you receive an order on 2006/10/05 and some related task is created on 10/7; the task needs to be done within 5 days of recieving the order. How do we do that?
jBPM's definition language, JPDL, does not provide a packaged mechanism for dynamically setting Due Dates on Timers and Tasks based on arbitrary data. However, it is not too difficult to work up a solution that brings us the flexibility we need. Here is an example that takes advantage of an ActionHandler? to set these due dates dynamically based on a process instance variable:
<?xml version="1.0" encoding="UTF-8"?>
<process-definition name="Due date Test">
<start-state name='START' >
<transition name='done' to='NODE1'/>
</start-state>
<task-node name='NODE1'>
<task name='task1'/>
<event type='node-enter' >
<create-timer name='myTimeout' duedate='2000 days' >
<script>System.out.println("I reset my timer!");</script>
</create-timer>
<!-- Dynamically set due date of the timer created in the line above.
(This ActionHandler can also be used to dynamically set a Task's due date
by substituting the <timerName> tag with a <taskName> tag) -->
<action name='setThisTimer' class='com.???.UpdateDueDateAH'>
<timerName>myTimeout</timerName>
<!-- Process instance variable containing a java.util.Date. This value will
be used as a base value for calculating the Timer's new due date. If not
provided, the current time will be used. -->
<baseTimeVar>testDate</baseTimeVar>
<!-- The 'baseTimeVar' Date can be modified by optionally adding a period of
time. The value is a valid jBPM Duration styled string -->
<addDuration>2 minutes</addDuration>
</action>
</event>
<event type='node-leave' >
<!-- To mimic the 'node context' of the short hand timer syntax <timer>, we
would need to ensure that our timer is cancelled on node exit. -->
<cancel-timer name='timeout' />
</event>
<event type='task-create'>
<!-- Use UpdateDueDateAH here to dynamically set a task's due date -->
<action name='setDueDate' class='com.???.UpdateDueDateAH'>
<taskName>task1</taskName>
<baseTimeVar>testDate</baseTimeVar>
<addDuration>5 minutes</addDuration>
</action>
</event>
<transition name='done' to='NODE2'/>
<transition name='_sys_redoNode' to='NODE1'/>
</task-node>
<state name='NODE2'>
<!-- Timers with this syntax are created on node-enter and cancelled on node-leave.
If timer creation is needed from within an event element or the timer should continue
after the node has exited, then use <create-timer> instead -->
<timer name='thisNodeOnlyTimeout' duedate='5 minutes' transition='done' />
<transition name='done' to='END'/>
</state>
<end-state name="END" />
</process-definition>
...and here is the UpdateDueDateAH? class:
/*
* UpdateDueDateAH.java
*
*
*/
package com.???;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.jbpm.graph.def.ActionHandler;
import org.jbpm.graph.exe.ExecutionContext;
import org.jbpm.graph.exe.Token;
import org.jbpm.taskmgmt.exe.*;
import org.jbpm.calendar.BusinessCalendar;
import org.jbpm.calendar.Duration;
import org.jbpm.svc.Services;
import org.jbpm.scheduler.SchedulerService;
import org.jbpm.db.SchedulerSession;
import org.jbpm.scheduler.exe.Timer;
import java.io.*;
import java.util.Calendar;
import java.util.Date;
import java.util.List;
public class UpdateDueDateAH implements ActionHandler{
//-- variables set by process def action parameter elements --
private String baseTimeVar = null;
private String addDuration = null; //a jbpm Duration styled string
private String timerName = null; //either this OR taskName should be set
private String taskName = null; //either this OR timerName should be set
private ExecutionContext ec = null;
public Log log = LogFactory.getLog(this.getClass());
public UpdateDueDateAH() {
}
/*Execute the action handler*/
public void execute(ExecutionContext executionContext){
ec = executionContext;
try{
Token token = ec.getToken();
Date newDueDate = null;
if(timerName != null) {
SchedulerSession schedulerSession = ec.getJbpmContext().getSchedulerSession();
//apparently throws an exception if no timer is found...
List timers = schedulerSession.findTimersByName(timerName, token);
for(Object o : timers) {
Timer timer = (Timer)o;
try{
newDueDate = this.calculateDueDate();
timer.setDueDate(newDueDate);
}catch(Exception e) {
throw new Exception("Timer '" + timer.getName() + "' due date was not updated to " +
newDueDate + "': " + e);
}
schedulerSession.saveTimer(timer);
log.info("Timer '" + timer.getName() + "' due date updated to " + timer.getDueDate());
}
}else if(taskName != null) {
TaskMgmtInstance tmi = ec.getTaskMgmtInstance();
for(Object o : tmi.getTaskInstances()) {
TaskInstance task = (TaskInstance)o;
//if wildcard is specified, update all tasks...
if(taskName.equals("*")) {
try{
newDueDate = this.calculateDueDate();
task.setDueDate(newDueDate);
}catch(Exception e) {
throw new Exception("Task '" + task.getName() + "' due date was not updated to " +
newDueDate + "': " + e);
}
log.info("Task '" + task.getName() + "' due date updated to " + task.getDueDate());
}else{
if(taskName.equals(task.getName())) {
try{
newDueDate = this.calculateDueDate();
task.setDueDate(newDueDate);
}catch(Exception e) {
throw new Exception("Task '" + task.getName() + "' due date was not updated to '" +
newDueDate + "': " + e);
}
log.info("Task '" + task.getName() + "' due date updated to "+task.getDueDate());
}
}
}
}
}catch(java.lang.Exception e){
log.error(e.getMessage(), e);
}
}
private Date calculateDueDate() throws Exception {
Date dueDate = null;
Calendar cal = Calendar.getInstance();
//if a baseTime is specified, we'll use that; otherwise, we'll just use the current time
if(baseTimeVar != null && baseTimeVar.length() > 0) {
Object baseTime = ec.getContextInstance().getVariable(baseTimeVar);
if(baseTime != null) {
if(baseTime instanceof String) {
throw new Exception("Could not calculate Due Date: the variable '" + baseTimeVar + "' should be a type of java.util.Date.");
}else if(baseTime instanceof Date) {
cal.setTime((Date)baseTime);
}else{
throw new Exception("Could not calculate Due Date: baseTimeVar '" + baseTimeVar +
"' was specified but no valid date/time data was found.");
}
}else{
throw new Exception("Could not calculate Due Date: baseTimeVar was specified but no data was found.");
}
}
if(addDuration != null) {
BusinessCalendar businessCalendar = new BusinessCalendar();
Duration duration = new Duration(addDuration);
dueDate = businessCalendar.add( cal.getTime(), duration );
}
return dueDate;
}
public void setTimerName(String timerName) {
if(timerName != null && timerName.trim().length() > 0) this.timerName = timerName;
}
public void setTaskName(String taskName) {
if(taskName != null && taskName.trim().length() > 0) this.taskName = taskName;
}
public void setBaseTimeVar(String baseTimeVar) {
this.baseTimeVar = baseTimeVar;
}
/*
* Takes a jbpm Duration styled string
*/
public void setAddDuration(String addDuration) {
this.addDuration = addDuration;
}
}
Softwares used : JBoss JBPM JPDL 3.2.2, XML
Steps to deploy the jbpm-console on Weblogic 9.1 and Oracle 9i
Note: I didnt try this effort using latest JBoss JBPM Version,if you run into issues with new version,let me know..
1. Download the jbpm- jPDL Suite (jbpm-jpdl-3.2.1.zip) or the latest stable version jbpm-jpdl-3.2.2 from http://sourceforge.net/project/showfiles.php?group_id=70542&package_id=145174
2. Extract to C:\
3. Go to deploy folder at C:\jbpm-jpdl-3.2.2\deploy
4. Create a new Folder jbpm-console
5. Create a directory structure as,
C:\jbpm-jpdl-3.2.2\deploy\jbpm-console
\build
\dist
\src
\WebContent
\build.xml
6. The contents of build.xml are :
<project basedir="." default="create.war">
<property name="dist" value="dist" />
<target name="create.war">
<war destfile="dist/jbpm-console.war" webxml="WebContent/WEB-INF/web.xml" basedir="WebContent">
</war>
</target>
</project>
7. The contents of WebContent folder are, the directory structure is,
WebContent
\images
\META-INF
\sa
\ua
\WEB-INF
\index.jsp
Just copy the webapp contents from c:\jbpm-jpdl-3.2.2\deploy\webapp into WebContent folder
8.The contents of index.jsp file are :
<%
final String queryString = request.getQueryString();
final String contextRoot = request.getContextPath();
final String target = contextRoot + "/sa/processes.jsf";
if (queryString != null && queryString.length() > 0) {
response.sendRedirect(target + "?" + queryString);
} else {
response.sendRedirect(target);
}
%>
9. Go to WebContent folder and remove jboss-web.xml
10.Go to WebContent\WEB-INF\classes folder and edit hibernate.cfg.xml file
Add these lines ,
<property name="hibernate.dialect">org.hibernate.dialect.Oracle9Dialect</property>
<!-- JDBC connection properties (begin) -->
<property name="hibernate.connection.driver_class">oracle.jdbc.driver.OracleDriver</property>
<property name="hibernate.connection.url">jdbc:oracle:thin:@HOSTNAME:1521:SID</property>
<property name="hibernate.connection.username">USER</property>
<property name="hibernate.connection.password">PASS</property>
<!-- JDBC connection properties (end) -->
<property name="hibernate.cache.provider_class">org.hibernate.cache.HashtableCacheProvider</property>
<property name="hibernate.transaction.factory_class">org.hibernate.transaction.JDBCTransactionFactory</property>
Comment these lines in hibernate.cfg.xml
<!-- DataSource properties (begin) === -->
<!-- <property name="hibernate.connection.datasource">java:/JbpmDS</property>
==== DataSource properties (end) -->
Assumption:jbpm tables already created on the Oracle 9i application schema.
<!-- identity mappings (begin) -->
<!-- <mapping resource="org/jbpm/identity/User.hbm.xml"/>
<mapping resource="org/jbpm/identity/Group.hbm.xml"/>
<mapping resource="org/jbpm/identity/Membership.hbm.xml"/>
identity mappings (end) -->
<!-- logging properties (begin) ===
<property name="hibernate.show_sql">true</property>
<property name="hibernate.format_sql">true</property>
<property name="hibernate.use_sql_comments">true</property>
==== logging properties (end) -->
11. Copy the following jars from C:\jbpm-jpdl-3.2.1\server\server\jbpm\lib
to C:\jbpm-jpdl-3.2.1\deploy\jbpm-console\WebContent \WEB-INF\lib
commons-beanutils.jar
dom4j.jar
antlr-2.7.6.jar
ojdbc14.jar
hibernate3.jar
jboss-backport-concurrent.jar
commons-digester.jar
cglib.jar
jbpm-jpdl.jar
bsh.jar
jbossretro-rt.jar
commons-logging.jar
asm.jar
stax-api-1.0.jar
wstx-lgpl-2.0.6.jar
commons-collections.jarjboss-retro-1.1.0-rt.jar
cglib.jar
jbpm-jpdl.jar
bsh.jar
jbossretro-rt.jar
commons-logging.jar
asm.jar
stax-api-1.0.jar
wstx-lgpl-2.0.6.jar
commons-collections.jar
12. Edit the access.properties file in C:\jbpm-jpdl-3.2.2\deploy\jbpm-console\WebContent\WEB-INF and add the user roles the application needs, like
role.identities.user=manager,admin,user
role.identities.user.add=manager,admin,user
role.identities.user.delete=manager,admin,user
role.identities.user.modify=manager,admin,user
role.identities.group=manager,admin,user
role.identities.group.add=manager,admin,user
role.identities.group.delete=manager,admin,user
role.identities.group.modify=manager,admin,user
# Process definition operations
role.process.deploy=manager,admin,user
role.process.delete=manager,admin,user
role.process.start=manager,admin,user
# Process instance and token operations
role.execution.suspend=manager,admin,user
role.execution.edit=manager,admin,user
role.execution.delete=manager,admin,user
role.execution.end=manager,admin,user
# Task management operations
role.tasks=manager,admin,user
role.task.assign=manager,admin,user
role.task.assign.any=manager,admin,user
role.task.modify=manager,admin,user
# Job management operations
role.jobs=manager,admin,user
role.jobs.delete=manager,admin,user
13. Add weblogic.xml in C:\jbpm-jpdl-3.2.2\deploy\jbpm-console\WebContent\WEB-INF
The contents are :
<weblogic-web-app xmlns="http://www.bea.com/ns/weblogic/90"
xmlns:j2ee="http://java.sun.com/xml/ns/j2ee"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.bea.com/ns/weblogic/90 http://www.bea.com/ns/weblogic/90/weblogic-web-app.xsd
http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
<jsp-descriptor>
<debug>true</debug>
</jsp-descriptor>
<context-root>jbpm-console</context-root>
</weblogic-web-app>
14. Edit the web.xml file C:\jbpm-jpdl-3.2.1\deploy\jbpm-console\WebContent\WEB-INF
And comment these lines
<!-- <security-constraint>
<web-resource-collection>
<web-resource-name>Secure Area</web-resource-name>
<url-pattern>/sa/*</url-pattern>
<http-method>GET</http-method>
<http-method>POST</http-method>
</web-resource-collection>
<auth-constraint>
<role-name>user</role-name>
</auth-constraint>
</security-constraint>-->
<!-- Login configuration option #1 - use the login page ==>
<login-config>
<auth-method>FORM</auth-method>
<form-login-config>
<form-login-page>/ua/login.jsf</form-login-page>
<form-error-page>/ua/login.jsf?error=true</form-error-page>
</form-login-config>
</login-config>
<!== End Login configuration option #1 -->
<!-- Login configuration option #2 - use basic auth ==>
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>jBPM Administration Console</realm-name>
</login-config>
<!== End Login configuration option #2 -->
And ,
<!-- This section is so that the web console can deploy in the jbpm-enterprise.ear module -->
<!-- <ejb-local-ref>
<ejb-ref-name>ejb/LocalTimerServiceBean</ejb-ref-name>
<ejb-ref-type>Session</ejb-ref-type>
<local-home>org.jbpm.scheduler.ejbtimer.LocalTimerServiceHome</local-home>
<local>org.jbpm.scheduler.ejbtimer.LocalTimerService</local>
<ejb-link>TimerServiceBean</ejb-link>
</ejb-local-ref> -->
15. After making all these changes, run “ant build.xml” from C:\jbpm-jpdl-3.2.2\deploy\jbpm-console at command prompt and then “ ant create.war” to create the jbpm-console.war file in “C:\jbpm-jpdl-3.2.2\deploy\jbpm-console\dist”
16. Copy this war file in C:\bea91\user_projects\domains\PRJ_DOMAIN\autodeploy and start your application server to deploy jbpm console on weblogic
17. Go to http://localhost:7001/jbpm-console
18. Softwares Needed :
Ant 1.6.5/Ant1.7 , weblogic 9.0/9.1/9.2 , jbpm-jpdl-3.2.2 suite
19.While deploying this war file on weblogic if you get any exceptions listed below, follow the solutions given below
a) javax.enterprise.deploy.spi.exceptions.InvalidModuleException: [J2EE Deployment SPI:260105]Failed to create DDBeanRoot for application, 'C:\jbpm-jpdl-3.2.1\deploy\jbpmgui.war'
use 2.3 dtd instead of 2.4 xsd
<weblogic-web-app xmlns="http://www.bea.com/ns/weblogic/90" xmlns:j2ee="http://java.sun.com/xml/ns/j2ee" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.bea.com/ns/weblogic/90 http://www.bea.com/ns/weblogic/90/weblogic-web-app.xsd
http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">
b) error 503 service unavailable
Set the following Environment variables:
i) JAVA_HOME = c:\bea\jdk142_08\bin;C:\bea\jrockit81sp5_142_08\bin;
ii) ANT_HOME = c:\ant\bin
iii) CLASSPATH = c:\bea\weblogic91\server\lib;C:\bea\weblogic91\server\lib\Weblogic.jar;
(You might need to set some of these CLASSPATHS after building the WAR files)
Any questions, please leave comments and suggestions are more than welcome...
Wicket, is an open source, lightweight, component-based Java web framework
that brings the Java Swing event-based programming model to web development
Wicket allows you to easily customize this default behavior though. All user pages typically extend Wicket’s WebPage—a subclass of Wicket’s Page class. There needs to be a one-to-one correspondence between the HTML elements with a wicket:id attribute and the Page components
In Wicket,a model (an object implementing the IModel interface) acts as the source of data for a component..
Wicket could also be classified as an event-driven framework. Wicket HTML components
register themselves as listeners (defined through several Wicket listener interfaces) for requests originating from the client browser. For example, Wicket’s Form component registers itself as an IFormSubmitListener, while a DropDownChoice implements the IOnChangeListener interface. When a client activity results in some kind of request on a component, Wicket calls the corresponding listener method. For example, on an HTML page submit, a Form component’s onSubmit() method gets called, while a change in a drop-down selection results in a call to DropDownChoice.onSelectionChanged
With proper mark-up/logic separation, a POJO data model, and a refreshing lack of XML, Wicket makes developing web-apps in Java simple and enjoyable again. Swap the boilerplate, complex debugging and brittle code for powerful, reusable components written with plain Java and HTML.
The component’s id value must match the wicket:id attribute of the
template’s corresponding HTML component
During the page render phase, Wicket does the following:
1. It kicks off the page rendering process by calling the Page.render() method.
2. The Page locates the corresponding markup template and begins iterating over the
HTML tags, converting them into an internal Java representation in the process.
3. If a tag without wicket:id is found, it is rendered as is.
4. If a tag with wicket:id is found, the corresponding Wicket component in the Page is located, and the rendering is delegated to the component.
5. The Page instance is then stored in an internal store called PageMap. Wicket maintains one PageMap per user session.
In Wicket, the component hierarchy is specified explicitly through Java code—which allows you to modularize code and reuse components via all the standard abstraction features of a modern object-oriented language. This is quite different from other frameworks like Tapestry, wherein the page components are typically specified in an XML page specification file listing the components used in the page
WicketServlet expects to be supplied with an IWebApplicationFactory implementation in
order to delegate the responsibility of creating the WebApplication class. A factory implementation could be specified as a servlet initialization parameter in web.xml against the key application➥FactoryClassName. In the absence of such an entry, WicketServlet uses ContextParamWeb➥ApplicationFactory by default. As the name suggests, this class looks up a servlet context parameter to determine the WebApplication class name. The expected web.xml param-name in this case is
applicationClassName. ContextParamWebApplicationFactory works perfectly for majority of the cases Register the CompoundPropertyModel instance with the parent component,
* Form in this case, for the children to inherit from. So all the * remaining components will then use the UserProfile instance * as its model, using OGNL like 'setters' and 'getters'
Wicket’s CompoundPropertyModel allows you to use each component’s ID as a property-path expression to the parent component’s model
Wicket looks for the presence of a system property called wicket.configuration first. If it doesn’t find one, it looks for the value corresponding to a servlet initialization parameter named configuration. In the absence of the preceding settings, it looks for an identical servlet context parameter setting. If none of the
preceding listed lookups succeed, Wicket configures the application in development mode by default. Note that the value for configuration has to be either development or deployment identified by fields wicket.Application.DEVELOPMENT and wicket.Application.DEPLOYMENT, respectively
You must be curious about the parameter bookmarkablePage in the URL. Actually, there is nothing special that makes the page bookmarkable. Any page is considered bookmarkable if it has a public default constructor and/ or a public constructor with a PageParameters argument. A bookmarkable page URL can be cached by the browser and can be used to access the page at a later point in time, while a nonbookmarkable
page cannot be accessed this way. A non-bookmarkable page URL makes sense only in the
context it was generated. If the page wants to be bookmarkable and accept parameters off the URL, it needs to implement the Page(PageParameters params) constructor
After the page is rendered, it is put into a PageMap. The PageMap instance lives in session and keeps the last n pages ( this number is configurable through Wicket’s ApplicationSettings object). When a form is submitted, the page is brought back from PageMap and the form handler is executed on it. The PageMap uses a Least Recently Used (LRU) algorithm by default to evict pages—to reduce space taken up in session.
You can configure Wicket with your own implementation of the eviction strategy. Wicket specifies the strategy through the interface wicket.session.pagemap.IPageMapEvictionStrategy. You can configure
your implementation by invoking getSessionSettings().setPageMapEvictionStrategy
(yourPageMapEvicationStrategyInstance) in the WebApplication.init() method
Component.setResponsePage method can be used to direct the user to a different page after page submit feedback component using Wicket’s built-in ListView
Wicket has a FeedbackPanel component that can display all types of messages associated with components nested within a page
Note that Wicket does call validate() on the subsequent components,
even if a component featured ahead in the page hierarchy has failed validation, accumulating the error messages on the way.
Validation in Wicket is specified through the IValidator interface. Since you can attach any number of IValidator interface implementations to a Wicket component through the component’s overloaded add() method, Wicket developers have made sure that they can be chained as well Validators are thread-safe. It is OK to link the same validator instance with multiple components
It acts as a translation layer between HTTP request parameters
and your model class, and the way it does this is through converters
Wicket accesses the converters through a factory class and makes it centrally available through Wicket’s ApplicationSettings class
All converters are supposed to implement the IConverter interface. It has a single
method: public Object convert(Object value, Class c)
All components allow you to specify the custom converter through the
getConverter() method
FeedbackMessages acts as a container for messages logged at any level, namely debug, info, error, warn. You can access messages specified at a particular log level in the form of a list (java.util.List) by supplying a filter of the type IFeedbackMessageFilter to FeedbackMessages
Using BPM for Software Delivery
Traditional Approach:
1. Software projects go through requirements analysis. This phase involves talking to business and get individual requirements in document fashion and then are converted into software design and implementation decisions.
2. These requirements together form complete picture.
3. In that sense it is bottom-up design approach. Which leaves a lot to interpretation when it comes to how business and IT “see” the complete picture of organizational flow of information.
BPM Approach:
1. Main way it differs from traditional approach is that, it is top-down approach. Meaning it should start with Business Analysts and/or Users creating block diagrams to describe their overall flow of information in complete manner.
2. These blocks can be as abstract or detailed as Business can provide or wants them to be.
3. Each of these blocks interact with others via various synchronous/asynchronous mechanisms there by enabling Service Oriented Architecture (SOA) in the design and foundational infrastrure of all business requirements.
4. This also will automatically make sure all the sides involved “see” EXACT same “big picture” and can agree on the same.
5. Corollary effect of that is to allow all levels to drill down , see interdependencies, and make whole organization flexible, and more responsive to changes/updates.
6. Increased ROI, Risk-mitigation, reduced cost and other benefits follow the above.
***** BPM tool is ideal for flows of information that can be depicted as individual tasks that are controlled by some business logic or rules and can in general be described as a “process”
Most, if not all business process can be described in such a manner,
***
Implementation methodology:
To achieve BPM enabled software delivery following steps should be taken.
1. Business users/Analysts will provide Block diagram describing the process in terms of individual steps, decisions and flows.
This is very much like the “flow-charts” that all are familier with. Any IDE based tool of BPM (Jboss JBPM Engine) provides an easy to use and quick to adapt designer (Eclipse based Graphical Process Designer (GPD)) that can be used for this purpose.
This tool will create a simple text (xml formatted) file. Please see attached diagram below for example of such an image.
2.These blocks are then filled with details of functionality that is represented by that block.This normally means business analyst and business users doing requirements analysis and create a simple document that will give following information.
a. Globally applicable rules for process flows.
a. – These might include details such as business units responsible and allowed to see this process.
b. What are global variables if any are there any rules or validation that apply when this process fits in bigger flow as a sub-process maybe. (for e.g. Create Employee Payroll process might be a sub-process to Hire New Employee Process and can only be run if new employee SSN is validated against legal dept’s validate SSN service”)
c. Global tasks needed which can be organization wide rules or task. (for. e.g. upon completion of each order above email may be sent to manager)
b. Each individual block should then be given detailed description with following pieces
a. What is the functionality? Describe actual task
b. Timers and notification info – Due date, (if any) escalation actions (might be emails to supervisors, automated DB updates) , Rules for sending emails on task start, completion, expiring of task due dates etc.
c. Assignment and management rules – What business roles should be able to start/complete/stop task. Is task automatically sent to some user or is there specific set of rule for doing so.
d. User Interface details – Does task have any specific screen that should be associated while performing that task.
e. Auditing information – What are the business Process measurement matrices that are needed. (for e.g. Number of Orders processed in a day? Total Orders not completed in time, How many employees have more than 10 tasks in their to-do list etc)
f. If there is existing application/code that already does a particular functionality depicted by a block it should be noted and it will be RE-USED in almost all cases.
g. After all the above are given, any other specific rules, details of tasks, out of ordinary requests etc should be noted in a separate section under each block details.
3. Block diagram and subsequent info then is sent to IT for analysis and IT will create design and solution.
a. After previous steps and input from them, IT basically has all the info needed. At this point IT will likely look for re-use, application integration of existing coded functionality, and custom coding of new or updated functionality. But even if individual step is missed or has bugs.. the “BIG PICTURE” will be exactly what business has in mind.
b. IT does not have to write code to follow business flow, BPM tools will automatically do that based on outcome of individual business steps.
c. Business performance matrices become automatically available. – For this BPM tool will integrate with outside monitoring tools as needed,
1) Check the version of CGLIB Jar Version deployed in container
And possible known classes in CGLIB which cause memory leak are present in Package - net.sf.cglib.proxy and these are the Classes with bugs
a) LazyLoader b) InvocationHandler c) Enhancer
The fix has been applied in CGLIB 2.2 JAR
2) If your application uses Spring Framework for Dependency Injection and JavaBeans Introspection,make sure the WebApp Domain, deployment descriptor "web.xml" has references to different Spring Listener classes like org.springframework.web.util.Log4jConfigListener & org.springframework.web.context.ContextLoaderListener
Spring offers another listener : org.springframework.web.util.IntrospectorCleanupListener
This is the Listener that flushes the JavaBeans Introspector cache on web app shutdown. Register this listener in "web.xml" to guarantee proper release of the web app class loader and the classes that it holds.
If the JavaBeans Introspector has been used to analyze application classes, the Introspector cache will hold a hard reference to those classes. Consequently, those classes and the web app class loader will not be garbage collected on web app shutdown!
Unfortunately, the only way to clean up the Introspector is to flush the entire cache, as there is no way to specifically determine the application's classes referenced there. This will remove cached introspection results for all other applications in the server too.
Note that this listener is not necessary when using Spring's beans infrastructure, as Spring's own introspection results cache will immediately flush an analyzed class from the JavaBeans Introspector cache.
Application classes hardly ever need to use the JavaBeans Introspector directly, so are normally not the cause of Introspector resource leaks. Rather, many libraries and frameworks do not clean up the Introspector..
Note that a single such Introspector leak will cause the entire web app class loader to not get garbage collected! This has the consequence that you will see all the application's static class resources (like singletons) around after web app shutdown, which is not the fault of those classes!
Possible Solution : Add this code in web.xml and place it before any other Spring Listeners
<listener>
<listener-class>
org.springframework.web.util.IntrospectorCleanupListener
</listener-class>
</listener>
3) Problem with DOM4J JAR
There's a problem with the use of ThreadLocals for caching, it's never cleaned up. If the ClassLoader is thrown away (e.g. if a webapp is reloaded), then the ThreadLocal stuff hold until the Thread dies, which might take a while in a Servlet container where the Threads are pooled. In such situation, DOM4J would prevent the webapp's ClassLoader to be garbage collected, which would creates a a memory leak and eventually an OOM if the webapp is reloaded too many times.
Workaround : if possible,avoid using ThreadLocal class(Programmatically it can be done)
4) Get the latest version of JDOM JAR...the latest version 1.1 has fix for known memory leak issues being caused by org.jdom.input.SAXHandler class in older versions
5) Last but not the least, make sure you have Java Profilers like Eclipse Profiler Plugin(this is the best as far as Iam concerned), JProbe ,VisualGC or JSTAT running against web application server...
Feel free to add any more known bugs which cause memory leaks.....!!
Declaring BPM Processes Instance Variables as "Separated"...
From my personal experience it has been seen so far that if the BPM Processes has big Instance Variables like Value Objects,Transfer Objects, Collection Objects, they consume lot of memory for processing each single instance and BPM Engine starts throwing Severe Exceptions like "Max Instance Size has exceeded",which will hinder the progress of execution of business activity.
Below is the short synopsis related to different ways of increasing Max Instance Size in ALBPM...
Advantages:
1)Enhance BPM Processes Execution
2)Lowering the BPM Message size can affect the performance of these processes specially...
Disadvantages of Higher Message size:
Each single process instance takes that much more time to persist to BPM DB and they are stored as Binary Objects(BLOB) in DB...so it will increase the cache memory/space consumed by these processes in DB
Workaround with 32KB Instance Size:
Declare these 'big' (10k or more) instance variables (VO/TO)as 'separated'. In ALBPM,while declaring variables,there is an attribute called 'Category' and the default value is 'Normal'. If you declare an instance variable as 'Separated' the data will be stored in another database table and it's size won't count towards the process instance size and it will not affect the BPM DB Cache Memory..
1)When registering/creating Java Libraries as part of External Resources in BPM Studio, we have two options :Versionable and Non-versionable
If we select "Versionable",then the JARS will be included in the Project Export from Studio and when the project is published and deployed into an Enterprise Environment, then these will be stored as binaries in the BPM Directory Service..The BPM Engine and Workspace applications will be pulling them and injecting into appropriate classloader...As per the configuration for the Java Libraries in the Enterprise Process Administrator,they are just there for a reference..The binding is determined at project publication time if we use "Versionable" Java Libraries..
2)On the other hand,if we use Non-Versionable Libraries for BPM Cataloging,then manually we need to include them into Process Administrator's Classpath...Most likely, these JARS wll need to be copied into Process Administrators' WEB-INF/lib directory.... and the path is, ~/albpm5.7/j2eewl/webapps/webconsole/WEB-INF/lib and then restart the BPM Server...
Basic principle to follow before you catalog BPM components in Studio is to make sure
1 )The "External Resources" does include "Versionable" libraries before publishing/deploying the BPM project to get the latest JAR files and make them run in ALBPM Enterprise Server. Right Click -> "External Resources" -> Select "Versionable" -> then do a publish/deploy project in Studio.
2) Then complete the BPM Catalog process manually from studio
Copy the Application JARS in BPM Webconsole and Portal WEB-INF/lib folder and regenerate BPM EAR to get latest versions of these files and then execute BPM cataloging from Studio using External Resources..
Android has been designed as a modern mobile platform that will enable applications to take full advantage of the mobile device capabilities. This session will break down the various components of the Android platform, examine how they work, and give developers a deeper understanding of the underlying technologies that drive the Android platform...
Source: The Server Side.....
Kenneth Saks is the specification lead for Enterprise JavaBeans 3.1 (JSR 318) . This talk will give the latest update on the contents of the EJB 3.1 specification , which will soon be released for Public Draft Review.
With its 3.0 release, the Enterprise JavaBeans™ (EJB™) architecture underwent a dramatic simplification targeted at ease of use for application developers. The purpose of the Enterprise JavaBeans 3.1 specification is to further simplify the EJB architecture by reducing its complexity from the developer's point of view, while also adding new features in response to the needs of the community.
Topics will include : .war packaging of EJB components, improved unit testing support, portable global JNDI names, singleton beans, startup/shutdown callbacks, a simplified(no interface) local view, asynchronous session bean invocations, automatic timer creation, and more
Live Video streaming by Ustream
Visa wants to become a part of your mobile phone, working with Nokia on realizing mobile payments and also announcing services for Google's Android platform.
The idea of using the mobile phone as a payment device has been around for along time, but has not yet encountered widespread success. With more than 3 billion mobile devices already in the market today, though, Visa sees a big opportunity to extend its reach, according to Elizabeth Buse, global head of product at Visa.
For future owners of the T-Mobile G1 and other upcoming Android phones, Visa will at first include three services, Alerts, Offers and Locator, which will be available for download before the end of the year.
With Alerts consumers will receive what Visa calls "near real-time" notification of purchase activity, based on rules defined by the cardholder.
Offers and Locator will make it possible for users to receive targeted offers, based on for example previous purchases, and show consumers nearby locations of shops or ATMs that accepts Visa. The two functions can also be combined. Consumers would opt in to the services, only activating those they choose, and would be able to opt out at any time, according to Visa.
The services will at first be offered to Chase Visa card holders in the U.S., and Visa says it plans to add more banks later.
Visa is also developing a payment application that will enable consumers to make mobile payments with Android phones.
Visa's work with Nokia is also about making payments possible using the mobile phone. Using the Nokia 6212 classic, expected to be available starting next month, users will be able to make contactless payments, remote payments, money transfers, as well as receive alerts and notifications, according to Nokia.
What makes all that possible is built-in support for a technology called NFC (Near-Field Communications), which lets consumers simply wave the phone within a few inches of a special point-of-sale reader to complete a transaction.
Nokia and Visa will first do trials with financial institutions, but for it to really take off the retail sector has to get onboard, and that is currently a blocking point, according to Richard Webb, directing analyst at Infonetics Research.
"Mobile payments are a good thing for the mobile sector, but there is no real gain for the retail sector, which would have to upgrade its systems for payments to work," said Webb.
Companies such as Nokia and Visa have to explain what's in it for retailers, but there are also other aspects that need to be addressed before mobile payments can take off, including security and trust, according to Webb.
Business Process Management ,the subject or concept which is gripping every major enterprise applications deployment now-a-days coupled with SOA/Web Services, has been part of my pedigree since more than a year now and the more I tend to learn about it, the more I feel like a naive,its such a vast concept . Many people have asked me how do you define a "Business Process Management"? and I tend to come up with different answers (not my fault...because each of the BPM solution providers have their own definition and meaning to it.
First thing first, as part of BPM initiatives so far I have been exposed to different products like Jboss JBPM(I still feel this is the best one,as far as IDE based BPM tools go,next best Intalio) , Albpm , Savvion & Intalio.
Currently Iam working on an enterprise application using ALBPM(Aqualogic BPM) from BEA as the BPM product and good thing is adopted by many leading companies and the thing which sometimes worries me about it is very little documentation and support from BEA(thats my perception) and coming from IDE background primarily for most of the development ,I feel it is behind Jboss Jbpm or Intalio because these products does support IDEs like Eclipse,which definitely makes my life easy as a Developer,Well BEA may argue with me that ALBPM Studio 6.0 has development environment similar to Eclipse or rather built on Eclipse IDE,but then Iam using ALBPM Studio 5.7 right now which doesnt come with full IDE support ...But I must say among commercial solutions this fits the bill...
And over the year,one thing which has worried me as a BPM Developer is how best I can make the Business Analysts or the business folks,understand the business processes which I have developed better,because in hindsight we expect them to be not technical savvy to really understand the workflow pattern being used nor how it has been developed since their major priority is how best this workflow/application fits their business needs .....For Example,l to overcome this situation,in one of my assignments while using Jboss Jbpm,I had to develop an EXE file or installer (something like Java Web Start)for BA and Testers,which simulates the workflow processes being developed without them having to worry about seeing it in action in a IDE ..And then as part of my curiosity and research,I realized there are different BPM solutions/products out there in IT industry that are so easy to understand ,that even non-technical folks can understand.And with this article Iam going to introduce such BPM products because most of them are browser based and not IDE based ...
Today we will be looking at 3 different BPM products that have been adopted by noted companies and how best they are serving the needs for workflow management and development.I will be giving an overview about each one of them,their features and benefits
I) Appian : Accidently I came across this product and it is definitely worth trying in any business process management effort. And when I see its customers list who have adopted Appian-Enterprise-based business process management (BPM) solution for their IT department it definitely must have some reason to it.Then I realized the advantages/benefits it brings to the table.From its legacy in the portal/knowledge-management (KM) space, Appian has built its functionality into a full blown BPM suite. In turn, it's built on a Java base following the Unified Modeling Language (UML) and the XML Process Definition Language (xPDL). (These are solid standards all, and which seem to be doing what standards should do without the interference of the European Union and Document Freedom Day groupies--. From an open source perspective, Appian comes with JBoss out of the box but of course works with WebSphere and WebLogic. It makes use of Lucene search engine as well. Not open source but Appian’s doing some real interesting stuff with KX Systems Kdb.
But the good news is that users don’t have to worry about all that technology stuff . Appian’s Form and Rules Designers and other real-user-facing components all work vis a straight Web interface (no need for Flash, plug-ins, etc.). That’s important for security requirements, which is key to many of Appian's government customers. But it is also good for ease of use for any customer. More important are the ease of Appian BPM implementation templates developed over the 10 years since it was founded. Examples are available for procurement in federal government, for wealth management with rules for credit scoring, a program with Instill to build a quality management solution for the food/service industry... I think the best place to know about Appian would be seeing its recorded webinars
Web Services,SOA,everywhere.Well,it certainly has so much positive impact on current IT community and proving its worth being adopted by leading industry players such as IBM, HP, Oracle, Microsoft, Novell, and Sun for different Web Services products.Yes Iam talking about SOA-Web Services which are here to stay and look set to dominate the deployment of major enterprise applications in the coming years.
IBM’s definition of Web Services states that “Web Services are self-contained, modular applications that can be described, published, located, and invoked over a network, generally, the World Wide Web.” In one of my previous articles,Web Services Patterns we looked at the advantages provided by SOA applications.
When the definition refers to Web Services being invoked over the World Wide Web, it means that they use HTTP as the transport layer and an XML-based message layer. However, Web Services do not actually require HTTP—XML-formatted data can be sent over other transport protocols (message queuing, for example), which may be more suited to mission-critical transactions.
Web Services generally uses the HTTP and SSL ports (TCP ports 80 and 443, respectively) in order to pass through firewalls. In the early days of “Web Services,” vendors would say that their products were “firewall compliant.” This meant that firewalls would not block the Web Services traffic, whereas CORBA traffic attempting to use CORBA-specific ports may be blocked. Web Services make it easier to deploy distributed computing without having to open firewall ports, or having to “punch a hole in the firewall” as network administrators like to say. This “under the radar” deployment has serious security implications. Most firewalls are unable to distinguish Web Services traffic, traveling over HTTP and SSL ports, from Web browser traffic.
The word “Services” in Web Services refers to a Service-Oriented Architecture (SOA). SOA is a recent development in distributed computing, in which applications call functionality from other applications over a network. In an SOA, functionality is “published” on a network where two important capabilities are provided— “discovery,” the ability to find the functionality, and “binding,” the ability to connect to the functionality. In the Web Services architecture, these activities correspond to three roles: Web Service provider, Web Service requester, and Web Service broker, which correspond to the “publish,” “find,” and “bind” aspects of a Service-Oriented Architecture.
Web Services security focuses on the application layer, although security at the lower layers remains important. The implementation technologies on which we focus are HTTP and SOAP, although we will keep SMTP security in mind also since SOAP can be bound to SMTP as well as HTTP.It may not seem immediately obvious why security for SOAP presents such a challenge. After all, SOAP is generally bound to HTTP, which already has SSL for authentication and confidentiality. In addition, many Web authorization tools already exist. It is a reasonable question to ask why these aren’t enough, and the answer is made up of a number of reasons.The first reason is that, although frequently bound to HTTP, SOAP is independent of the underlying communications layers. Many different communications technologies can be used in the context of one multi-hop SOAP message; for example, using HTTP for the first leg, then SMTP for the next leg, and so forth. End-to-end security cannot therefore rely on a security technology that presupposes one particular communications technology. Even in the case of a single SOAP message targeted at a Web Service, transport-level security only deals with the originator of the SOAP request. SOAP requests are generated by machines, not by people. If the Web Service wishes to perform security based on the end user, it must have access to authentication and/or authorization information about the end user on whose behalf the SOAP request is being sent. This is the second reason for Web Services security.
SOAP is a technology used to enable software to talk to other software much easier than was previously possible. End users (that is, humans) do not make SOAP messages themselves. However, if access to the Web Service is to be decided based on the information about the end user, the Web Service must have access to the information that allows it to make this authorization decision. This information does not have to include the end user’s actual identity.How can this information about the end user be conveyed to the Web Service? Session layer or transport layer security between the application server and the Web Service doesn’t convey information about the identity of the end user of the Web Service. It merely conveys information about the application server that is sending the SOAP message. It may be the case that many of the requests to the Web Service originate from that application server.This challenge is addressed by including security information about the end user in the SOAP message itself. This information may concern the end user’s identity, attributes of the end user, or simply an indication that this user has already been authenticated and/or authorized by the Web server. This information allows the Web Service to make an informed authorization decision.This scenario is likely to be widespread where many Web Services are used to implement functionality “behind the scenes.” It shouldn’t be the case that the end user has to reauthenticate each time a SOAP request must be sent on their behalf. The challenge of providing this functionality is sometimes called “single sign-on” or “federated trust.”
WS-Routing provides a means for SOAP messages to route between multiple Web Services. WS-Routing defines how to insert routing information into the header of a SOAP message. This routing information can be thought of as equivalent to routing tables that operate at lower layers of the OSI stack for routing IP packets.WS-Routing means that one SOAP message may traverse multiple SOAP “hops” between the originator and the endpoint. The systems that implement these hops may have nothing in common apart from the ability to parse and route a SOAP message.When routing between Web Services, the requirement for confidentiality can apply from the originator through to the final SOAP endpoint. It may be a requirement that information be kept secret from SOAP intermediaries. There may be a chance that intermediaries may disclose the information either deliberately or through leaving “gaps” between one transport-level security session and the next. While the data is decrypted, it is vulnerable. This is the same problem that plagued the first release of the Wireless Access Protocol (WAP), in which data was decrypted in between the wireless encryption session and encryption on the fixed wire. This so-called “WAP gap” caused a loss of confidence in WAP security and was addressed in later releases of the WAP specification. Implementing encryption only at the transport level makes a “SOAP gap.”It is often noted that most security breaches happen not while data is in transit, but while data is in storage. This is the principle of least resistance—attempting to decrypt eavesdropped encrypted data from an SSL session is much more difficult than simply testing if a Web site maintainer has remembered to block direct access to the database where the credit card numbers are stored. If decrypted data is stolen from a database, the consequences are no less dramatic. Once data has reached its final destination, it must be stored in a secure state. Confidentiality for a SOAP transaction should not involve simply chaining instances of confidentiality together, since “SOAP gaps” of unencrypted data are available between each decryption and encryption.
Web Services Security Specifications
Confidential information in a SOAP message should remain confidential over the course of a number of SOAP hops.A number of industry specifications have been developed for this purpose. These specifications can be organized into two distinct categories:A standardized framework to include XML-formatted security data into SOAP messages.Standards for expressing security data in XML format. This security information should be used for the high-level principles of security: confidentiality, authentication, authorization, integrity, and so forth.
WS-Security
WS-Security has emerged as the de facto method of inserting security data into SOAP messages. Work on WS-Security began in 2001, was published by Microsoft, VeriSign, and IBM in April 2002, and was then submitted in June 2002 to the OASIS standards body in order to be made into an industry standard. WS-Security defines placeholders in the SOAP header in order to insert security data. It defines how to add encryption and digital signatures to SOAP messages, and then a general mechanism for inserting arbitrary security tokens. WS-Security is “tight” enough to present the definitive means of including security data into SOAP messages, but is “loose” enough to not place limits on what that security data can be.
XML Encryption
XML Encryption is a specification from the W3C. It provides not only a way of encrypting portions of XML documents, but also a means of encrypting any data and rendering the encrypted data in XML format. XML Encryption makes encryption functionality easier to deploy.XML Encryption is not a replacement for SSL. SSL is still the de facto choice for confidentiality between two entities that are communicating using HTTP. However, if the security context extends beyond this individual HTTP connection, XML Encryption is ideal for confidentiality. The capability to encrypt XML is nothing new, because XML is just text after all. However, the ability to selectively encrypt XML data is what makes XML Encryption so useful for Web Services. Encrypting an entire SOAP message is counterproductive, because the SOAP message must include enough information to be useful—routing information, for example. Selectively encrypting data in the SOAP message is useful, however. Certain information may be hidden from SOAP intermediaries as it travels from the originator to the destination Web Service.XML Encryption does not introduce any new cryptography algorithms or techniques. Triple-DES or RSA encryption may still be used for the actual encryption. XML Encryption provides a way to format the meta-information about which algorithm was used, and when the encryption occurred. This aids the Web Service in decrypting the data, provided the decryption key is available to it. This is important, because prior to XML Encryption the only standardization of encryption data was for e-mail messages (that is, S/MIME). If an organization wished to send encrypted data to another organization, both organizations would have to agree on the format of the encrypted data, how and which algorithms to use, and possibly also how to send an encrypted key. Now that information can be contained in an XML Encryption block.
XML Signature
XML Signature is a specification produced jointly by the W3C and the Internet Engineering Task Force (IETF). Like XML Encryption, it does not only apply to XML. As well as explaining how to digitally sign portions of an XML document, XML Signature also explains how to express the digital signature of any data as XML. As such, it is an “XML-aware digital signature.” PKCS#7 is a means of rendering encrypted data, and signed data, which predates XML Signature and XML Encryption. Rather than using XML, it uses Abstract Syntax Notation number 1 (ASN.1). ASN.1 is a binary format, renowned for its complexity. Producing or verifying a PKCS#7 signature requires not just cryptography software, but also an ASN.1 interpreter. XML Signature also requires cryptography software, of course, but an XML DOM replaces the ASN.1 interpreter.
The power of XML Signature for Web Services is the ability to selectively sign XML data. For example, a single SOAP parameter passed to a method of a Web Service may be signed. If the SOAP request passes through intermediaries en route to the destination Web Service, XML Signature ensures end-to-end integrity.WS-Security describes how to include XML Signature data in a SOAP message. An important feature of XML Signature is that it can be very selective about what data in an XML instance is signed. This feature is particularly useful for Web Services. For example, if a single SOAP parameter needs to be signed but the SOAP message’s header needs to be changed during routing, an XML Signature can be used that only signs the parameter in question and excludes other parts of the SOAP message. Doing so ensures end-to-end integrity for the SOAP parameter while permitting changes to the SOAP’s header information.
Security Assertions Markup Language (SAML) provides a means of expressing information about authentication and authorization, as well as attributes of an end user (for example, a credit limit) in XML format. SAML data may be inserted into a SOAP message using the WS-Security framework. SAML is used to express information about an act of authentication or authorization that has occurred in the past. It does not provide authentication, but can express information about an authentication event that has occurred in the past; for example, "User X authenticated using a password at time Y.” If an entity is authorized based on the fact that they were previously authorized by another system, this is called “portable trust.” SAML is important to address the challenge of multihop SOAP messages also, because separate authentication to each Web Service is often out of the question. By authenticating once, being authorized, and effectively reusing that authorization for subsequent Web Services, single sign-on for Web Services can be achieved.Note that this information in a SAML assertion may not indicate the end user’s identity. The user may have authenticated using a username and password, and the administrator of the Web site may have no idea of the user’s actual identity. It may simply be an indication that the user presented credentials and was authenticated and authorized. SAML allows information to be placed into a SOAP message to say “this person was authorized according to a certain security policy at a certain time." If the recipient of this SOAP message trusts the issuer of the SAML data, the end user can also be authorized for the Web Service. This SAML data is known as an “assertion” because the issuer is asserting information about the end user. The concept of security assertions has existed before SAML, and is already widely used in existing software.
XML Access Control Markup Language (XACML) is designed to express access control rules in XML format. Although the two technologies are not explicitly linked, XACML may be used in conjunction with SAML. An authorization decision expressed in a SAML assertion may have been based on rules expressed in XACML.
Microsoft’s Passport technology takes a different approach to single sign-on. The user authenticates to the passport infrastructure, either directly through www.passport .com or through an affiliate site that makes use of functionality provided by passport.com. Once the user is authenticated and authorized by Passport, their authentication status is also available to other Web Services that use Passport. Like SAML, this provides single sign-on. However, the model is different, relying on a central point of authentication rather than SAML’s architecture where authentication happens at an individual Web Service. By being implemented at the site of the Web Service itself, SAML authentication and authorization information may be based on role-based security. Role-based security means that access to resources is based on the user’s organizational role; for example, in a medical setting doctors may have access to certain information while nurses have access to different information.
In this article(from Web Services Security),I tried to just give an overview on the different specifications that can be used to achieve Web Services security,for a detailed understanding,I suggest get a good book like this one,"Web Services Security",to whom I owe these excerpts,and get a clear understanding as to implementing and using specifications for securing the web services you develop.And thanks to ,Mark O'Neil,for his inputs and allowing me to use some stuff from his book.
Recommended books :
Suggested Reading
Web Services provide an important building block for integrating disparate computing platforms and, indirectly, provide a mechanism to integrate their global value chains. You can build Web Services after the system was originally deployed, making them similar in many ways to today's EAI software, but you can also build them along with new software as the open Application Programming Interface (API) to the application.
Advantages of using Web Services
Using Web Services , you can build an API which islanguage- neutral and platform-neutral format, programmers can access data from one system and quickly move it to the other through the Web Service. There are several strengths to this approach:
Programmers can write the data-transfer programs in any language or platform with which they are comfortable.
The source and target systems can control the requests and updates of data in such a way that they do not interfere with a running system.
Suggested Reading
Today I would like discuss on Performance Management of Java applications and handling memory leaks in Java. Having spend some unnerving moments and time myself ,related to handling memory leaks (OutOfMemoryError) issues in one the enterprise application being already in production in a clustered environment recently,I was faced with having long meetings and discussions with the customer and the people in the higher hierarchy level at the company ,to fine tune their application which was the source of generating more revenue and profits to them and as a Senior Consultant , I was looked upon as source of providing guidance and technical tips to achieve that.And thats when I realized that not always the old paradigm that while using Java we need not worry about allocating and freeing memory of objects holds true...And here Iam not giving you an overview on the steps or the code I followed & wrote,better you learn yourself,but rather an overview on the tools you can use to manage and fine tune Java applications. To start with let us understand the term Garbage Collection in Java and in the process of submitting the proof of concept to the customer,the tools that can be used for handling such scenarios ,as part of my R&D I came across the tools mentioned below which will certainly help Java developers in fine tuning their applications and my personal favorite is YourKit Java Profiler.
Garbage Collection in Java
In Java ,you create objects, and JVM takes care of removing them when they are no longer needed by the application through a mechanism known as garbage collection.The job of the garbage collector is to find objects that are no longer needed by an application and to remove them when they can no longer be accessed or referenced. The garbage collector starts at the root nodes, classes that persist throughout the life of a Java application, and sweeps though all of the nodes that are referenced. As it traverses the nodes, it keeps track of which objects are actively being referenced. Any classes that are no longer being referenced are then eligible to be garbage collected. The memory resources used by these objects can be returned to the Java virtual machine (JVM) when the objects are deleted...And how best can you do that? Below is the brief synopsis of the tools you can use in Java for performance tuning.
Tools you can use for handling memory leaks and performance management
VisualGC- Visual Garbage Collection Monitoring tool
The visualgc tool attaches to an instrumented HotSpot JVM and collects and graphically displays garbage collection, class loader, and HotSpot compiler performance data.
JSTAT
The jstat tool displays performance statistics for an instrumented HotSpot Java virtual machine (JVM). The target JVM is identified by its virtual machine identifier, or vmid option described below.
Note:This utility is unsupported and may not be available in future versions of the J2SE SDK. It is not currently available on Windows 98 and Windows ME platforms.
HAT is a program that analyzes a heap dump file for Java programs. This tool can help a developer to debug and analyze the objects in a running Java program. It is particularly useful when debugging unintentional object retention. Starting with Java SE 6, HAT has been replaced with jhat, which is included with the standard Sun distribution. HAT is not being maintained in a stand-alone configuration. The Heap Analysis Tool (HAT) helps to debug unnecessary object retention (sometimes called "memory leaks") by providing a convenient means to browse the object topology in a heap snapshot, which is generated by the Java VM. HAT reads a hprof file, then sets itself up as a web server--therefore allowing you to run queries against a heap dump contained within the hprof file.For further information, read this article
JProbe is an enterprise-class Java profiler providing intelligent diagnostics on memory usage, performance and test coverage, allowing developers to quickly pinpoint and repair the root cause of application code performance and stability problems that obstruct component and integration integrity. With JProbe’s intuitive, unified UI, it’s easier to navigate and configure all JProbe analysis tools.JProbe also provides a powerful filtering mechanism for controlling the data display, including nine different metrics for sorting and coloring data for clutter-free, easier viewing.
Yourkit Java Profiler
digg
reddit
del.icio.us