We at AJUG are humming along preparing for DevNexus (March 8-9, 2010). Today we got confirmation that Jason van Zyl from Sonatype is speaking at our event. He is the founder of Apache Maven and Sonatype. I added his bio and abstract to the website tonight. Thus, check out our presentation line-up for details.
Also, we got our very own Twitter account (Many thanks to Barry Hawkins for organizing this!!). Over the next few day I will add it to the DevNexus website and we will post noteworthy updates through that channel.
Thus, start following us at: http://twitter.com/devnexus/
Tuesday, February 2, 2010
Saturday, January 30, 2010
Plaxo OpenID Recipe
Plaxo was probably one of the first main sites where I saw OpenID support for your user credentials. But only today did I notice that they also have a really nice write-up of of their OpenID implementation, which could serve you as a guide/recipe for implementing your own OpenID supporting user registration process.
Check it out at: http://www.plaxo.com/api/openid_recipe
Check it out at: http://www.plaxo.com/api/openid_recipe
Wednesday, January 27, 2010
Automating User Registrations with OpenID and Spring Security 3.0 - Part 3
Preparing heavily for DevNexus 2010, I did not have as much time as I hoped for in order to continue my series on using OpenID with the new SpringSecurity 3.0 (See Part 2 for details) Thus, today I would just like to cut and paste some of the code from my little 'home-POC'. In the coming weeks I still hope to incorporate it properly into jRecruiter.
Here is the JSP snippet for the OpenID login form:
Here is the relevant piece of my Spring context file:
I did some customization:
For example, if the OpenID authentication succeeds it does not necessarily mean that your account exists, yet. Therefore, if OpenID authentication succeeds (if (status == OpenIDAuthenticationStatus.SUCCESS)), I try loading the user from my application's database (userDetailsService). If then a UsernameNotFoundException is thrown I collect a series of OpenID attributes from the org.springframework.security.openid.OpenIDAuthenticationToken. Once finished, I am throwing a custom AuthenticationSucessButMissingRegistrationException. I use it to redirect to the registration page and pre-populate the registration form with some of the collected OpenID attributes.
I hope this gives you some ideas of how you can integrate OpenID into your SpringSecurity infrastructure. I am myself still in the early learning phase regarding OpenID and I still need to figure out how to best manage multiple authentication realms within my application. But that may be a reason for another blog post.
Here is the JSP snippet for the OpenID login form:
<div id="openid-registration">
<form name='oidf' action='/jrecruiter-web/j_spring_openid_security_check' method='POST'>
<fieldset id="openIdLoginSection">
<legend>Login with OpenID Identity</legend>
<div class="required">
<label for="openid_identifier">Identity</label>
<s:textfield id="openid_identifier" name="openid_identifier" required="true" maxlength="80" tabindex="1" size="30"/>
</div>
<div class="submit">
<input type="submit" value="Login"/>
</div>
</fieldset>
</form>
</div>
Here is the relevant piece of my Spring context file:
<security:http auto-config="true" access-decision-manager-ref="accessDecisionManager" >
<security:intercept-url pattern="/s/admin/**" access="ADMIN" requires-channel="https"/>
<security:intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY" requires-channel="any" />
<security:form-login login-page="/login.html" default-target-url="/admin/index.html"
authentication-failure-url="/login.html?status=error" />
<security:logout logout-url="/logout.html" invalidate-session="true" logout-success-url="/show.jobs.html"/>
<security:session-management>
<security:concurrency-control max-sessions="1" error-if-maximum-exceeded="false"/>
</security:session-management>
<security:custom-filter ref="openIDFilter" position="OPENID_FILTER" />
</security:http>
<bean id="openIDFilter" class="org.jrecruiter.web.security.RegistrationAwareOpenIDAuthenticationFilter">
<property name="authenticationManager" ref="authenticationManager"/>
<property name="consumer" ref="attributeAwareOpenIDConsumer"/>
<property name="authenticationSuccessHandler" ref="openIDFilterSuccess"/>
<property name="authenticationFailureHandler" ref="openIDFilterFailure"/>
<property name="registrationTargetUrlRequestHandler" ref="openIDFilterRedirectToRegistration"/>
</bean>
<bean id="openIDFilterRedirectToRegistration" class="org.jrecruiter.web.security.RegistrationTargetUrlRequestHandler">
<property name="defaultTargetUrl" value="/registration/signup.html"/>
</bean>
<bean id="openIDFilterSuccess" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler">
<property name="defaultTargetUrl" value="/admin/index.html"/>
</bean>
<bean id="openIDFilterFailure" class="org.springframework.security.web.authentication.SimpleUrlAuthenticationFailureHandler">
<property name="defaultFailureUrl" value="/login.html?status=error"/>
</bean>
<bean id="attributeAwareOpenIDProvider" class="org.jrecruiter.web.security.AttributeAwareOpenIDProvider" scope="prototype">
<constructor-arg ref="userService"/>
</bean>
<bean id="attributeAwareOpenIDConsumer" class="org.jrecruiter.web.security.AttributeAwareOpenIDConsumer"/>
I did some customization:
public class AttributeAwareOpenIDConsumer extends OpenID4JavaConsumer {
public AttributeAwareOpenIDConsumer() throws ConsumerException {
super(Arrays.asList(UsedOpenIdAttribute.FIRST_NAME.getOpenIdAttribute(),
UsedOpenIdAttribute.LAST_NAME.getOpenIdAttribute(),
UsedOpenIdAttribute.EMAIL.getOpenIdAttribute(),
UsedOpenIdAttribute.AX_FIRST_NAME.getOpenIdAttribute(),
UsedOpenIdAttribute.AX_LAST_NAME.getOpenIdAttribute(),
UsedOpenIdAttribute.NAME_PERSON.getOpenIdAttribute()));
}
}
I also created a custom class AttributeAwareOpenIDProvider which extends org.springframework.security.openid.OpenIDAuthenticationProvider. It overrides public Authentication authenticate(Authentication authentication) Thus, I can hook into the actual authentication process and inject my own logic.For example, if the OpenID authentication succeeds it does not necessarily mean that your account exists, yet. Therefore, if OpenID authentication succeeds (if (status == OpenIDAuthenticationStatus.SUCCESS)), I try loading the user from my application's database (userDetailsService). If then a UsernameNotFoundException is thrown I collect a series of OpenID attributes from the org.springframework.security.openid.OpenIDAuthenticationToken. Once finished, I am throwing a custom AuthenticationSucessButMissingRegistrationException. I use it to redirect to the registration page and pre-populate the registration form with some of the collected OpenID attributes.
I hope this gives you some ideas of how you can integrate OpenID into your SpringSecurity infrastructure. I am myself still in the early learning phase regarding OpenID and I still need to figure out how to best manage multiple authentication realms within my application. But that may be a reason for another blog post.
Friday, January 22, 2010
Remote Profiling of JBoss using VisualVM
I ran into an issue while trying to setup profiling (using VisualVM) of a remote JBoss server instance. It turns out that the default steps I have found on the internet, assume that your target server (Where JBoss is running on) is accessible via the hostname not only by IP address. Well, just in case you live in an environment where you can access your server via IP but not via hostname, this blog post may hopefully save you an hour googling the solution. In order to setup remote profiling I did:
To my run.conf file (JBoss/bin) I added:
JAVA_OPTS="$JAVA_OPTS -Xdebug -Xrunjdwp:transport=dt_socket,address=8787,server=y,suspend=n"
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=6789"
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.ssl=false"
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.authenticate=false"
JAVA_OPTS="$JAVA_OPTS -Djava.rmi.server.hostname=IP_ADDRESS_OF_MY_JBOSS"
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.port=6789"
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.ssl=false"
JAVA_OPTS="$JAVA_OPTS -Dcom.sun.management.jmxremote.authenticate=false"
JAVA_OPTS="$JAVA_OPTS -Djava.rmi.server.hostname=IP_ADDRESS_OF_MY_JBOSS"
Anyway, once these lines were added, you need to configure jstatd. I created a policy file (I called it tools.policy) for the JVM containing:
grant {
permission java.security.AllPermission;
};
Then, I would be able to start up jstatd:
jstatd -p 1099 -J-Djava.security.policy=tools.policy
And finally, I was able to startup JBoss and connect to my server from VisualVM.
Thursday, January 14, 2010
Registration Opens for DevNexus 2010
Here is an annoucement that I would like to get out regarding the Atlanta Java Users Group's (AJUG) professional developer conference:
The DevNexus conference will be held in Atlanta March 8–9, 2010 and registration is now open. DevNexus covers a wide range of the most exciting topics related to the Java™ platform.
This year, our sophisticated line-up of speakers covers dynamic programming languages such as Scala and Groovy, as well as Rich Internet Applications (RIA) such as Adobe Flex and Google Web Toolkit (GWT). Furthermore, we have a dedicated track on Google technologies, which not only covers GWT but also Google App Engine and Google Wave. Additionally, DevNexus has sessions covering popular open source projects such as Spring, Maven and HtmlUnit, as well as presentations on software architecture, agile software development methodologies and much more!
Please join us for this exceptional event.
The organizers of DevNexus are focused on making sure the conference provides the best possible educational value by offering attendees a special early bird rate of $150 if they register between now and February 16. Regular admission for the two-day conference is $185, a group discount is also available. The ticket price includes the two-day conference pass as well as meals.
This is the second DevNexus event, which is the continuation of the annual AJUG developer conferences that started in 2004.
For further information: http://www.devnexus.com/
Tuesday, January 12, 2010
DevNexus 2010 Conference Updates
I have spent a few late nights lately, to get the preparations for the Atlanta DevNexus conference into the final stage. The line-up of speakers is getting fuller by the day. I am personally really excited that James Ward (Adobe), Keith Donald (SpringSource) and Lex Spoon (Google) are presenting and we have many, many more presenters covering a ton of material.
I will try my best to update the website (http://www.devnexus.com) with the current list of speakers and presentations, soon.
Which also reminds me to finalize our press-release to announce the conference...I hope to get all that done within the next 2 days. Thus, watch http://www.devnexus.com/ for updates. And please sign-up!
For that price, you won't get a better educational value (...brought to you by your friendly Atlanta Java Users Group)
I will try my best to update the website (http://www.devnexus.com) with the current list of speakers and presentations, soon.
Which also reminds me to finalize our press-release to announce the conference...I hope to get all that done within the next 2 days. Thus, watch http://www.devnexus.com/ for updates. And please sign-up!
For that price, you won't get a better educational value (...brought to you by your friendly Atlanta Java Users Group)
Friday, January 1, 2010
Automating User Registrations with OpenID and Spring Security 3.0 - Part 2
This is the continuation of part 1. See also part 3.
Spring Security provides support for OpenID out of the box. It is fairly easy to setup basic OpenID authentication. It even can automatically generate the respective login forms for you. But for my use case I wanted something more elaborate. Here is a basic flow of my "Spring Security OpenID integration solution" (early working draft):
Step 1: User starts the login process using OpenID.
Note that the 'OpenID' between providers varies quite a bit.
Of course I need to add some more sophistication around my user registration process. Nevertheless, I hope the general flow is clear. While OpenID is a fairly widely adopted standard, there seems to be a bit of fluctuation in regards to what data sets providers will allow you to fetch, as well as how to fetch them (e.g. different name-spaces). Thus, it looks like in order to automated an OpenID-supported registration process, you need to be aware (code for) specific providers. I need to explore that area a bit more.
In my next posting I will finally provide some source code. If find some time, take a look and play around with openid4java. The OSS project provides various examples, and the 'simple-openid' example is really helpful for understanding the actual openID registration process. Stay tuned.
Spring Security provides support for OpenID out of the box. It is fairly easy to setup basic OpenID authentication. It even can automatically generate the respective login forms for you. But for my use case I wanted something more elaborate. Here is a basic flow of my "Spring Security OpenID integration solution" (early working draft):
Step 1: User starts the login process using OpenID.
Note that the 'OpenID' between providers varies quite a bit.
- Google uses a generic login String that is the same for every user (http://www.google.com/accounts/o8/id)
- MyOpenID has a unique URI identifier for each user (e.g. http://mysupercoolusernmae.myopenid.com/)
Step 2: After pressing the Login button, Spring Security processes the request and using openid4java under the hood, you are redirected to the login page of your OpenID provider in this case Google.
Step 3: In step 2 you authenticated successfully (with Google in this case), but you don't have a valid account with jRecruiter itself, yet: In this instance, grab all the useful information that is available through the OpenID account/profile and then forward (Redirect) to the registration page. There pre-fill the form with the grabbed information (E.g. email, first name, last name etc.)
Of course I need to add some more sophistication around my user registration process. Nevertheless, I hope the general flow is clear. While OpenID is a fairly widely adopted standard, there seems to be a bit of fluctuation in regards to what data sets providers will allow you to fetch, as well as how to fetch them (e.g. different name-spaces). Thus, it looks like in order to automated an OpenID-supported registration process, you need to be aware (code for) specific providers. I need to explore that area a bit more.
In my next posting I will finally provide some source code. If find some time, take a look and play around with openid4java. The OSS project provides various examples, and the 'simple-openid' example is really helpful for understanding the actual openID registration process. Stay tuned.
Sunday, December 27, 2009
Automating User Registrations with OpenID and Spring Security 3.0 - Part 1
Having a few days of vacation is nice. Besides spending some precious time with my family, it also gave me some time to work on jRecruiter. I upgraded Spring Security to the final 3.0.0 version, which was released just a few days ago.
The upgrade process was relatively painless, though it is not a simple Jar drop-in as the packages of many of the classes changed. But it was fairly straight-forward.
The biggest hassle, was upgrading Jasypt as the latest released version is not playing nice with Spring Security 3.0, yet. But the code is already committed to Jasypt's source code repository, and with minor modifications, I was able to compile a custom version.
But while I was looking through the changes of Spring Security 3, I started reading a little bit more about its support for OpenID.Which then let to the question, whether there is a good use case for OpenID in my home project.
Places where I saw the use of OpenID are:
Here is actually a pretty good blog post regarding OpenID:
http://www.codinghorror.com/blog/archives/001121.html
Security Concerns
Then of course, there are also a few security concerns regarding allowing for OpenID authentication:
Thus, while I probably wouldn't use OpenID for a banking application, I feel it is a nice fit for my home project, it is used by local recruiters to post job postings. Up to this point every account holder had to provide her own username (email) and a password.
None of the information stored by jRecruiter is extremely sensitive and thus, OpenID might actually help improve the user experience of people posting jobs through the system. Over the past few years I saw a common issue that account holder are unable to remember their password, or even their username (which made me to change over to more of a email-based username approach). Ultimately, there were quite a few duplicate registrations in the past.
An interesting question though is, is it advisable to restrict access to a limited amount of OpenID providers? (Such as myOpenID, Google or Yahoo)
Use Case
Well, this is were things are getting interesting, OpenID does not only define the notion of pure authentication but it can also gives you access to various pieces of your OpenID profile (e.g. first name, last name, email address etc.). This feature seems to vary, though, between providers (Have to see how that works out)
Thus, for jRecruiter I envision the following use case. When a user starts the login process:
In my next blog installment I would like to give you some insights of how I created a first draft implementation using Spring Security 3.0. Keep in mind that this is an ongoing (learning) process...Thus, if you see issues, let me know.
Continue with part 2.
The upgrade process was relatively painless, though it is not a simple Jar drop-in as the packages of many of the classes changed. But it was fairly straight-forward.
The biggest hassle, was upgrading Jasypt as the latest released version is not playing nice with Spring Security 3.0, yet. But the code is already committed to Jasypt's source code repository, and with minor modifications, I was able to compile a custom version.
But while I was looking through the changes of Spring Security 3, I started reading a little bit more about its support for OpenID.Which then let to the question, whether there is a good use case for OpenID in my home project.
Places where I saw the use of OpenID are:
Here is actually a pretty good blog post regarding OpenID:
http://www.codinghorror.com/blog/archives/001121.html
Security Concerns
Then of course, there are also a few security concerns regarding allowing for OpenID authentication:
- http://serverfault.com/questions/7005/is-there-a-danger-in-fake-openid-providers
- http://stackoverflow.com/questions/182258/are-there-any-security-risks-associated-with-me-using-openid-as-the-authenticatio
- http://www.identityblog.com/wp-content/images/2008/02/OpenID/Normal/OpenIDPhish.html
- http://stackoverflow.com/questions/86090/openid-providers-what-stops-malicious-providers
Thus, while I probably wouldn't use OpenID for a banking application, I feel it is a nice fit for my home project, it is used by local recruiters to post job postings. Up to this point every account holder had to provide her own username (email) and a password.
None of the information stored by jRecruiter is extremely sensitive and thus, OpenID might actually help improve the user experience of people posting jobs through the system. Over the past few years I saw a common issue that account holder are unable to remember their password, or even their username (which made me to change over to more of a email-based username approach). Ultimately, there were quite a few duplicate registrations in the past.
An interesting question though is, is it advisable to restrict access to a limited amount of OpenID providers? (Such as myOpenID, Google or Yahoo)
Use Case
Well, this is were things are getting interesting, OpenID does not only define the notion of pure authentication but it can also gives you access to various pieces of your OpenID profile (e.g. first name, last name, email address etc.). This feature seems to vary, though, between providers (Have to see how that works out)
Thus, for jRecruiter I envision the following use case. When a user starts the login process:
- she or he has a choice of either loggin in the traditional way using a username/password combination or
- by selecting the OpenID route.
- If the user logs in via OpenID and the authentication succeeds, but the user account within jRecruiter does not exists, yet, then the potential user is redirected to the registration pages and the fields of the registration form shall be pre-populated (as much as possible) using inforamtion from the user's OpenID profile.
In my next blog installment I would like to give you some insights of how I created a first draft implementation using Spring Security 3.0. Keep in mind that this is an ongoing (learning) process...Thus, if you see issues, let me know.
Continue with part 2.
Tuesday, December 8, 2009
Warbler and JRuby on Netbeans
Have been brushing up my Rails skills last night. I installed the latest Netbeans version (NetBeans IDE 6.8 Release Candidate 2)
Everything looked great but during project setup, I selected the option to use Warbler ('Add Rake Targets to Support App Server Deployment (.war)'). As it turns out, setting up Warbler during project setup just 'breaks'. I have been using the "Built-in JRuby 1.4.0". It seems to be a path issue on my Mac running Snow Leopard (there were some indications on the web).
Ultimately, I was able to solve that issue by installing a dedicated JRuby version that had a nice shorter path.
Before:
"/Applications/NetBeans/NetBeans 6.8 RC2.app/Contents/Resources/NetBeans/ruby2/jruby-1.4.0/bin/jruby" -S gem unpack warbler
rake aborted!
Command failed with status (127): ["/Applications/NetBeans/NetBeans 6.8 RC2.a...]
/Applications/NetBeans/NetBeans 6.8 RC2.app/Contents/Resources/NetBeans/ruby2/jruby-1.4.0/lib/ruby/gems/1.8/gems/rake-0.8.7/lib/rake.rb:995:in `sh'
(See full trace by running task with --trace)
After:
I haven been running into a few other issues to finally get a simple Rails deployment working on my Tomcat instance, but that is a new blog post to come...
Everything looked great but during project setup, I selected the option to use Warbler ('Add Rake Targets to Support App Server Deployment (.war)'). As it turns out, setting up Warbler during project setup just 'breaks'. I have been using the "Built-in JRuby 1.4.0". It seems to be a path issue on my Mac running Snow Leopard (there were some indications on the web).
Ultimately, I was able to solve that issue by installing a dedicated JRuby version that had a nice shorter path.
Before:
"/Applications/NetBeans/NetBeans 6.8 RC2.app/Contents/Resources/NetBeans/ruby2/jruby-1.4.0/bin/jruby" -S gem unpack warbler
rake aborted!
Command failed with status (127): ["/Applications/NetBeans/NetBeans 6.8 RC2.a...]
/Applications/NetBeans/NetBeans 6.8 RC2.app/Contents/Resources/NetBeans/ruby2/jruby-1.4.0/lib/ruby/gems/1.8/gems/rake-0.8.7/lib/rake.rb:995:in `sh'
(See full trace by running task with --trace)
After:
/Users/hillert/_APPS/jruby-1.4.0/bin/jruby -S gem unpack warbler
Unpacked gem: '/Users/hillert/NetBeansProjects/DX2010/vendor/plugins/warbler-0.9.14'
I haven been running into a few other issues to finally get a simple Rails deployment working on my Tomcat instance, but that is a new blog post to come...
Friday, December 4, 2009
Great Time at the Scala Meeting
I had a great time at the Scala meeting here in Atlanta, tonight. This was the first time for the Scala group to meet in a central location (Same place as the AJUG meetings) and the group was able to double their attendance to almost 20 attendees.
For me it was also very nice to meet Lex Spoon, co-author of 'the book' on Scala 'Programming in Scala'. Also, this is a small world - As a Java Posse fan, it was interesting to realize that John Weathers, the organizer for the Scala Meetup Group and Dick Wall worked together in Atlanta. Besides being a big advocate for Java, Dick is also very involved with the Scala scene in the Bay Area.
Anyway, seeing the potential of Scala combined with the talent we are having here in Atlanta, there is a great bright future for the Scala community, and with it the larger JVM community. These are exciting times!
For me it was also very nice to meet Lex Spoon, co-author of 'the book' on Scala 'Programming in Scala'. Also, this is a small world - As a Java Posse fan, it was interesting to realize that John Weathers, the organizer for the Scala Meetup Group and Dick Wall worked together in Atlanta. Besides being a big advocate for Java, Dick is also very involved with the Scala scene in the Bay Area.
Anyway, seeing the potential of Scala combined with the talent we are having here in Atlanta, there is a great bright future for the Scala community, and with it the larger JVM community. These are exciting times!
Subscribe to:
Posts (Atom)