Sashwat Gupta's blog

Using XPath with Oracle XMLType

2011-05-16T13:25:00.001+04:00

Example below shows the extraction of details from an Oracle AQ queue with datatype of XML Type using XPath.

SELECT
w.user_data.extract('//m:DeclarationNo/text()', 'xmlns:m="http://namespace/DPWClearance/2.1"').getStringVal() "DeclarationNo"
FROM CLEARANCE_QTAB w ORDER BY ENQ_TIME DESC

Dehydration store purging

2010-12-14T09:06:00.001+04:00

Interesting post for purging the dehydration store:

http://www.oracle.com/technetwork/middleware/bpel/learnmore/bpeldehydrationstorepurgestrategies-192217.pdf

Also a simple explanation of High watermark:
http://www.oracle.com/technetwork/middleware/bpel/learnmore/bpeldehydrationstorepurgestrategies-192217.pdf

Validating Date in java

2010-11-24T12:33:00.010+04:00

I recently ran into a peculiar problem while working with Dates in java. I need to validate an input date provided in the format (dd-MM-yyyy). This seems a very simple requirement.

Input: String
Output: Boolean indicating whether the provided date is in provided format

private static String DATE_FORMAT = "dd-MM-yyyy";
    public boolean validateDate(String date) {
        try {
            DateFormat df = new SimpleDateFormat(DATE_FORMAT);
            df.parse(date);
            return true;
        } catch (ParseException e) {
            e.printStackTrace();
            return false;
        }
    }

The following results were observed.

Input	Actual Output	Expected Output
01-01-9999	true	true
333-01-9999	true	false

As provided in the API documentation of DateFormat states

By default, parsing is lenient: If the input is not in the form used by this object's format method but can still be parsed as a date, then the parse succeeds. Clients may insist on strict adherence to the format by calling setLenient(false).

Thus the unexpected behavior while parsing the input '333-01-9999'. We now change the code to add

private static String DATE_FORMAT = "dd-MM-yyyy";
    public boolean validateDate(String date) {
        try {
            DateFormat df = new SimpleDateFormat(DATE_FORMAT);
            df.setLenient(false);
            df.parse(date);
            return true;
        } catch (ParseException e) {
            e.printStackTrace();
            return false;
        }
    }

The following results were observed.

Input	Actual Output	Expected Output
01-01-9999	true	true
333-01-9999	false	false
3a-01-9999	false	false
02-03-1@@@	true	false
02-03-18	true	false

And boom. The parsing of '02-03-1@@@' and '02-03-18' again provides us with an unexpected result. This seems to be a bug in the validation.

So I searched the Sun bug database. But strangely enough the bug has been rejected. The rationale provided is completely and utterly bull*&(#.
http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=5055568

The comments by the Bug submitter have been ignored.

Suppose the input to the method is supposed to be '01-01-2010' and the user provides '01-01-2o10' then the data will be converted into the date 01-01-0002. This after the seeing the setLenient documentation which states that:-

Specify whether or not date/time parsing is to be lenient. With lenient parsing, the parser may use heuristics to interpret inputs that do not precisely match this object's format. With strict parsing, inputs must match this object's format.

So the solution to this problem is to match the string using regular expression before validating with the parse method.

private static String DATE_FORMAT = "dd-MM-yyyy";
    private String REGEX_DATE_FORMAT = "^(0[1-9]|[12][0-9]|3[01])[- ](0[1-9]|1[012])[- ]\\d\\d\\d\\d$";
    public boolean validateDate(String date) {
        try {
            if(!Pattern.matches(REGEX_DATE_FORMAT, date)) {
                return false;
            }

            DateFormat df = new SimpleDateFormat(DATE_FORMAT);
            System.out.println(df.parse(date));
            return true;
        } catch (ParseException e) {
            e.printStackTrace();
            return false;
        }
    }

Input	Actual Output	Expected Output
01-01-9999	true	true
333-01-9999	false	false
3a-01-9999	false	false
02-03-1@@@	false	false
02-03-18	false	false

So we solve the problem.
Hoping some day java will include a simpler way of validation of dates.

Extending schema with redefine and Java

2010-07-08T12:17:00.000+04:00

Requirement

In this case a system which has an external interface (say a web service exposed to external clients) let us only consider the xsd for this example. Assume that the xsd is imported in a wsdl and used.Internally it needs to maintain an enhanced information model which adds multiple attributes to the provided complex types. The internal information model is not a new one it is just an enhanced model.Any additions or changes to the external xsd will require the changes in the internal xsd as well.

Possible solutions

Use a new xsd for external and internal interfaces copying all attributes. The disadvantage for this approach is the maitainanve of the xsds.Any change requires changes in both the places. The advantage is that the internal and external xsd become disconnected and can be maintained seperately. We do not require the advantage in our case since it would be a maintainance overhead

Import the external xsd and reuse the elements whereever possible by extending them or using them as is. It is not a very clean approach lot of repeated code would result but it would be lesser than option 1.

Redefine the elements enhanced and use it for further processing. Much cleaner approach is expected.

Detailed diffierence between xml schema extend vs redefine elements is explained below:

The external xsd and its sample xml is show below:-

Fig. external xsd

Fig. external sample xml

The external interface conatains an element Request with two elements name and child. The child is a complex type with an element t1. The internal interface needs to enhace the child complex type to add two more elements val1 and val2

While using the extend element the schema and the example xml will look like:-

Fig. internal xsd using extends construct

Fig. internal sample xml

As seen above the extends needs to redefine the parent attribute if the child element is extended. This leads to a very complicated xsd and the reusability of the defined types becomes very limited. This problem can be overcome if redefine construct is used as shown below.

Fig. internal xsd using redefine and extends construct

Fig. sample xml for the above xsd

Tool and API support:

JAX-RPC and redefine: According to the JAX-RPC 1.1 specifications (http://test.javaranch.com/ulf/jaxrpc-1_1-fr-spec.pdf):-

The following XML Schema features are not required to be supported and WSDL to Java mapping tools are allowed to reject documents that use them: xsd:redefine, xsd:notation, substitution groups.

The JDeveloper does not generate the proxy for the web service that contains the redefine element.
JAXB 1 and Redefine: The XML Schema redefine construct is not supported by JAXB and if such unsupported construct is included in a schema, an error will be generated when you try to generate Java classes from them with xjc.(ref:- http://onjava.com/pub/a/onjava/2004/12/15/jaxb.html)
JAXB 2 and Redefine: XJC for JAXB 2 successfully generates the proxy for the web service
SOAP-UI and redefine: SOAP UI does not support the use of redefine elements. I have raised the following bug
http://sourceforge.net/tracker/index.php?func=detail&aid=3019440&group_id=136013&atid=737763
XML SPY and redefine: I am using XML Spy 2008. This successfully generates a sample SOAP message from a WSDL containing the redefine element.
WS-Interoperability Basic Profile 1.1: This element is compliant and does not cause any errors.

Conclusion

The redefine construct does provide a flexible construct for extending the schema definations. The support is limited for the construct and is improving. The redefine schema construct cannot be used with JAX RPC, but is compliant with JAXB 2 so any other web services programming model that uses JAXB 2 like JAX WS or Spring Web Services can be used.

Anatomy of a signed SOAP message

2010-07-07T19:37:00.000+04:00

I will explain a WSS signed web service SOAP message,signed using a X509 certificate.

The sample signed message is:

The following illustrates the anatomy of the message
1. SignedInfo

The SignedInfo element describes the signed content of the message.

1.1. CanonicalizationMethod
The element CanonicalizationMethod is used to describe the canonicalization algorithm used on the xml for the generation of the digest.
1.2. SignatureMethod
The element SignatureMethod is used to describe the algorithm used for the generation of the SignatureValue from the output of the canonicalization algorithm.
1.3. Reference
The optional URI attribute for Reference element identifies the data object that was signed.

In the above case the body is being signed thus the URI attribute refers to the soap body.
Transform Algorithm indicates the transformation algorithm. I still need to understand why do we need a duplicate of the canonicalization algortithm?
DigestMethod Algorithm indicates the algorithm used to generate the digest value and DigestValue contains the computed digest value.
2.SignatureValue
SignatureValue contain the signature value, which is actually the encrypted digest value. This value is the output of the Signature Method Algorithm indicated

3.BinarySecurityToken
The signed data contain a core bare name reference (as defined by the XPointer specification [XPointer]) to the element that contains the security token referenced, or a core reference to the external data source containing the security token.
In this example the BinarySecurityToken contains the Base64Encoded public key that can be used for verification.

The signed content was created using a Microsoft file (.pfx) containing x509 certificates. The public key can be regenerated using the BinarySecurityToken element.
Sample code to generate .cer from BinarySecurityToken

// from tag BinarySecurityToken
    private static final String b64Str = "MIIECTCCAvGgAwIBAgICLy4wDQYJKoZIhvcNAQEFBQAwdjELMAkGA1UEBhMCQUUxETAPBgNVBAoTCEV0aXNhbGF0MSQwIgYDVQQLExtFdGlzYWxhdCBlQnVzaW5lc3MgU2VydmljZXMxLjAsBgNVBAMTJUNvbXRydXN0IFVzZXIgQ2VydGlmaWNhdGlvbiBBdXRob3JpdHkwHhcNMDkwMjEyMDQ0ODMxWhcNMTEwMjEyMDQ0ODMxWjCBqjELMAkGA1UEBhMCQUUxDjAMBgNVBAcTBUR1YmFpMQ8wDQYDVQQKEwZFVENEQzIxHjAcBgNVBAsTFURlbHV4ZSBJbnRsIENhcmdvIExMQzENMAsGA1UELhMENTgwODEnMCUGCSqGSIb3DQEJARYYZGVsdXhlcGFAZW1pcmF0ZXMubmV0LmFlMSIwIAYDVQQDExlBYmR1bCBTYXR0YXIgQWJkdWwgUmF3b29mMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDfge/HNFnO/SEVdvNPTQ0ziLEMDz/EKwSWWCBK94yU58y75AsTArK/QG4+wHSALd9HDW+wxaBLd7ZLz4mjMgAJgGEEWIP9XYMvSTO2li7SI9fKANQ3/uoXTgJU0N/CLyLBZkW2Z7Vb6bsdhN6HGzsFcd5SoDmxYDh+z26RenbtUQIDAQABo4HvMIHsMAkGA1UdEwQCMAAwIwYDVR0RBBwwGoEYZGVsdXhlcGFAZW1pcmF0ZXMubmV0LmFlMEwGA1UdIARFMEMwQQYLKwYBBAGyXQIBAQAwMjAwBggrBgEFBQcCARYkaHR0cDovL2NvbXRydXN0LmV0aXNhbGF0LmFlL2Nwcy5odG1sMA4GA1UdDwEB/wQEAwIE8DAfBgNVHSMEGDAWgBTOP/R2v2Tj4qbCev148AwSjFT9fjA7BgNVHR8ENDAyMDCgLqAshipodHRwOi8vY29tdHJ1c3QuZXRpc2FsYXQuYWUvY3JsL3VzZXJjYS5jcmwwDQYJKoZIhvcNAQEFBQADggEBAKO44b564tmzCLCZhlE5gQkGzQF1tgW954nJMcfthO89C9X3QuLbBoNLrrKeQoqumKYDMiODF5Rkn1pRlgJlGSWKOkjPwF+wB4PlHjd/BijNDnyv2VJUWw7gqE6uffu2E0c4kEfun2leNY03Qtcvu9FmUL7JDj0seibEhOXzy63r+o5rf5x5/vER8vUz1MBypHea3EWbCSJ2yAEw2fJ3Syq/vuihr4yP3VOb7KBeVXL353J5pdpql4UjAwlGAdmiihAAQMCKicE6qDZ2i4jC4bS+lSDv2wE/CiTCj1DN1eEyQnajuTWvFYq88ZAHtru7q5CrsMcHMa8WXENMrUzlKdM=";
 
    public static int decode(char c) {
        if (c >= 'A' && c <= 'Z')
            return c - 65;
        else if (c >= 'a' && c <= 'z')
            return c - 97 + 26;
        else if (c >= '0' && c <= '9')
            return c - 48 + 26 + 26;
        else
            switch (c) {
            case '+':
                return 62;
            case '/':
                return 63;
            case '=':
                return 0;
            default:
                throw new RuntimeException(
                        new StringBuffer("unexpected code: ").append(c)
                                .toString());
            }
    }
 
    public static byte[] decode(String s) {
 
        int i = 0;
        ByteArrayOutputStream bos = new ByteArrayOutputStream();
        int len = s.length();
 
        while (true) {
            while (i < len && s.charAt(i) <= ' ')
                i++;
 
            if (i == len)
                break;
 
            int tri = (decode(s.charAt(i)) << 18)
                    + (decode(s.charAt(i + 1)) << 12)
                    + (decode(s.charAt(i + 2)) << 6)
                    + (decode(s.charAt(i + 3)));
 
            bos.write((tri >> 16) & 255);
            if (s.charAt(i + 2) == '=')
                break;
            bos.write((tri >> 8) & 255);
            if (s.charAt(i + 3) == '=')
                break;
            bos.write(tri & 255);
 
            i += 4;
        }
        return bos.toByteArray();
    }
 
    public static void main(String[] args) throws Exception {
        byte[] back = decode(b64Str);
        OutputStream out = new FileOutputStream("aa.cer");
        out.write(back);
        //perform your exception handling  
        out.close();
    }

4. KeyInfo

In order to ensure a consistent processing model across all the token types supported by WSS: SOAP Message
Security, the element specify all references to X.509 token types in signature or encryption elements that comply with this profile.
The element contains a element that specifies the token data by means of a X.509 SubjectKeyIdentifier reference.
Reference:-
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0.pdf

Normalization and Canonicalization of XML

2010-07-07T09:16:00.001+04:00

Normalized xml is the XML stripped of white spaces.
Multiple methods can be applied by using the following schema types:-

xsd:normalizedString (http://www.w3.org/TR/xmlschema11-2/#normalizedString)
xsd:token(http://www.w3.org/TR/xmlschema11-2/#token)

These types do not restrict the use of white spaces rather are instructions to the processor to ignore the spaces (according to their respective rules).
e.g xsd:token is supposed to merge multiple white spaces into one, so for an element defined in xsd as

<xs:element name="tkn" type="xs:token"/>

the value can be provided as:-

<tkn>toks        en     </tkn>

This will not result in an schema validation error but the parser should treat it like a string with the following value:-

<tkn>toks en</tkn>

Canonical form of an XML
The canonical form of an XML document is physical representation of the document produced by the following method:-

The document is encoded in UTF-8
Line breaks normalized to #xA on input, before parsing
Attribute values are normalized, as if by a validating processor
Character and parsed entity references are replaced
CDATA sections are replaced with their character content
The XML declaration and document type declaration (DTD) are removed
Empty elements are converted to start-end tag pairs
Whitespace outside of the document element and within start and end tags is normalized
All whitespace in character content is retained (excluding characters removed during line feed normalization)
Attribute value delimiters are set to quotation marks (double quotes)
Special characters in attribute values and character content are replaced by character references
Superfluous namespace declarations are removed from each element
Default attributes are added to each element
Lexicographic order is imposed on the namespace declarations and attributes of each element

The rules for Canonical form of xsd are very detailed and do not cover the normalization of elements. Both of these forms supplement each other.

Canonical form is very useful while generating hash for the xml and are used in generating the WS-Security BinarySecurityToken.

Executable jar file from command line

2010-05-16T11:21:00.000+04:00

Executing an executable jar (the jar contains the name of the main file in manifest) from command line.

Simple?

Say the jar name is exec.jar and is located in c:\java.
Go to :-
c:\
cd c:\java
java -jar exec.jar

This executes fine.
But why do I need to go into the directory where the jar exists. Say I am in the drive c: I can always do:-
java -classpath c:\java\exec.jar -jar exec.jar
Unable to access jarfile exec.jar
No it does not work.

Lets try set classpath=.;c:\java\exec.jar;
and then execute
java -jar exec.jar
Still the same error

Now lets try
java -jar c:\java\exec.jar
Works fine...

But why is the classpath not working.
The reason is provided in the java tool documentation from the Sun site.

"-jar Execute a program encapsulated in a JAR file.
.....
......
When you use this option, the JAR file is the source of all user classes, and other user class path settings are ignored. "

The classpath option does not work with java -jar option.

ref: java tool documentation

Thus the options if you want to execute a jar file are:-

Go to the directory of jar and execute the java -jar exec.jar
From any other directory execute java -jar c:\java\exec.jar
If you want to read it from the classpath, use the workaround by retrieving the name of the main class from mainifest and executing it:-
java -classpath c:\java\exec.jar Main

Generating documentation with APT and Maven

2010-04-20T08:15:00.000+04:00

Purpose:-
Display the usage of APT to generate traceability matrix for requirement and test case.

This is not a fully implemented feature rather it displays the concepts and the setup.
This assumes basic understanding of APT and maven.

Steps:-
1. Setup project 'TestAnnotation' for annotation processor - change pom, write annotation and process classes
2. Update project 'Test' for annotation processing
3. execute apt

Step 1:

1.1 Create a new maven project 'TestAnnotation' and update the pom dependency to include tools.jar.


    <dependency>
        <groupid>com.sun</groupid>
        <artifactid>tools</artifactid>
        <version>1.4.2</version>
        <scope>system</scope>
        <systempath>${java.home}/../lib/tools.jar</systempath>
    </dependency>

1.2 Write the annotation class. This class needs to be shared with the Test project. This can be done by copying the source unto the project or having a common dependency between the projects.

package com.sash;

import java.lang.annotation.Documented;
import java.lang.annotation.ElementType;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;

@Documented
@Retention(RetentionPolicy.SOURCE)
@Target({ElementType.TYPE,
ElementType.METHOD,
ElementType.CONSTRUCTOR,
ElementType.PACKAGE,
ElementType.FIELD})
public @interface TestCaseDetails {
String code();
String description();
String useCase();
}

1.3 Create Annotation Processing Factory

The factory is responsible for creating processors for one or more annotation types. The factory is said to support these types.

package com.sash;

import java.util.Collection;
import java.util.Collections;
import java.util.Set;

import com.sun.mirror.apt.AnnotationProcessor;
import com.sun.mirror.apt.AnnotationProcessorEnvironment;
import com.sun.mirror.apt.AnnotationProcessorFactory;
import com.sun.mirror.apt.AnnotationProcessors;
import com.sun.mirror.declaration.AnnotationTypeDeclaration;

public class TestCaseDetailsProcessorFactory implements
      AnnotationProcessorFactory {

  public AnnotationProcessor getProcessorFor(
          Set <> declarations,
          AnnotationProcessorEnvironment env) {
      AnnotationProcessor result;
      if (declarations.isEmpty()) {
          result = AnnotationProcessors.NO_OP;
      } else {
          result = new TestCaseDetailsProcessor(env);
      }
      return result;

  }

  public Collection <> supportedAnnotationTypes() {
      return Collections.singletonList(TestCaseDetails.class.getName());
  }

  public Collection <> supportedOptions() {
      return Collections.emptyList();
  }
}

1.4 Create the annotation processor

package com.sash;

import java.util.Collection;
import java.util.Map;

import com.sun.mirror.apt.AnnotationProcessor;
import com.sun.mirror.apt.AnnotationProcessorEnvironment;
import com.sun.mirror.declaration.AnnotationMirror;
import com.sun.mirror.declaration.AnnotationTypeDeclaration;
import com.sun.mirror.declaration.AnnotationTypeElementDeclaration;
import com.sun.mirror.declaration.AnnotationValue;
import com.sun.mirror.declaration.Declaration;
import com.sun.mirror.util.SourcePosition;

public class TestCaseDetailsProcessor implements AnnotationProcessor {

  private AnnotationProcessorEnvironment environment;

  private AnnotationTypeDeclaration annotationTypeDeclaration;

  public TestCaseDetailsProcessor(AnnotationProcessorEnvironment env) {
      System.out.println("TestCaseDetailsProcessor.TestCaseDetailsProcessor()");
      environment = env;
      annotationTypeDeclaration = (AnnotationTypeDeclaration) environment
              .getTypeDeclaration(TestCaseDetails.class.getName());
  }

  public void process() {
      System.out.println("TestCaseDetailsProcessor.process()");
      Collection declarations = environment
              .getDeclarationsAnnotatedWith(annotationTypeDeclaration);
      for (Declaration declaration : declarations) {
          processNoteAnnotations(declaration);
      }
  }

  private void processNoteAnnotations(Declaration declaration) {
      System.out.println("TestCaseDetailsProcessor.processNoteAnnotations()");
      Collection annotations = declaration
              .getAnnotationMirrors();
      for (AnnotationMirror mirror : annotations) {
          if(mirror.getAnnotationType().getDeclaration().equals(
                  annotationTypeDeclaration)) {

              SourcePosition position = mirror.getPosition();
              Map values = mirror
                      .getElementValues();

              System.out.println("Declaration: " + declaration.toString());
              System.out.println("Position: " + position);
              System.out.println("Values:");
              for (Map.Entry entry : values
                      .entrySet()) {
                  AnnotationTypeElementDeclaration elemDecl = entry.getKey();
                  AnnotationValue value = entry.getValue();
                  System.out.println("    " + elemDecl + "=" + value);
              }
          }
      }
  }

}

2. Update the pom of project 'Test' for annotation processing to add apt maven plugin.


      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>apt-maven-plugin</artifactId>
        <version>1.0-alpha-3</version>
      </plugin>

Update the test case to use the annotations.

package com.test; import com.sash.TestCaseDetails;
public class Testing1 {
  @Test
  @TestCaseDetails(code="1", description="2", useCase="3")
  public void testing() {
//actual code goes here
  }
}

3. Execute the maven command 'mvn apt:test-process' to execute the command. The following output can be seen:-


Values:
  code()="1"
  description()="2"
  useCase()="3"

The example only shows a print into the console. This should be written into a file with the expected format.

The apt command can also be executed without maven using the following command.


apt \TestAnnotation-1.jar -factory com.sash.TestCaseDetailsProcessorFactory \Testing1.java

Note: The code provided has been written by using articles and documentation available. This is only an aggregation of information available online.

Reference and further reading:
http://www.oracle.com/technology/pub/articles/marx-jse6.html
http://www.javalobby.org/java/forums/t17876.html
http://mojo.codehaus.org/apt-maven-plugin/examples/configuring-a-factory.html

GoF Design Patterns with examples using Java and UML

2009-12-08T07:30:00.000+04:00

written by:
Benneth Christiansson (Ed.)
Mattias Forss,
Ivar Hagen,
Kent Hansson,
Johan Jonasson,
Mattias Jonasson,
Fredrik Lott,
Sara Olsson, and
Thomas Rosevall

Gof Design patterns

A very nice recap of the design patterns.

Notational Conventions

2009-07-25T11:24:00.000+04:00

Notational Conventions explained for many specifications:-
http://tools.ietf.org/html/rfc2119

Find Bugs

2009-07-07T12:03:00.000+04:00

Find Bugs is an eclipse plugin which shows the common errors in Java. I use the eclipse plugin, and as a Best Practice for java developers this should be used while development. :)

e.g.
For a piece of code the following error was received

When piece of code in given below:-

1. Long id = request.getId();
2.       
3. if(request == null || id == null) {
4.     throw new RuntimeException("id cannot be null");
5. }

Find the error if you can... :)

The check for request == null is fruitless, since if request is null the line 1 will fail. Below is provided the corrected code and thus removes the bug.

1. if(request == null || request.getId() == null) {
2.  throw new RuntimeException("id cannot be null");
3. }

Long id = request.getId();

A note of caution, the code inspection tools need to be used intelligently, it may sometimes flag code as bug that may have been done for some valid reason. Ignore them in this case.

Minimize memory footprint

2009-06-30T09:12:00.000+04:00

An application to minimize memory footprint.

Minimem

The application can optimize the memory used. Some applications when run over a long time start hogging a lot of memory, this tools optimizes the memory usage and free it.

Mozilla is a good example of such a process (at least I was facing the issue) but is irreplaceable. :)

Pitfalls of SOA adoption

2009-06-23T23:03:00.000+04:00

An old link about pitfalls of SOA adoption.

Pitfalls of SOA adoption - Thomas Erl

Most of the points are still valid, specially the performance impact.

OWSM setup for signature verification

2009-06-23T08:58:00.000+04:00

Purpose

Setup OWSM to perform signature validation

Prerequisites

JKS store should be setup and ready to use. Refer to http://tech-sash.blogspot.com/2009/06/keystore-setup-for-owsm.html for more details.
OWSM gateway is already created. To create refer http://download-uk.oracle.com/docs/cd/B31017_01/integrate.1013/b31007/gateways.htm

Steps

Step 1: Getting the wsdl URL for the service to be secured.

Login to the BPEL console.
Select the process to be secured and copy the wsdl url.
Move to the WSDL tab.
Remove the version from the wsdl location. http://server:port/orabpel/domain/BPELProcess1/1.1/BPELProcess1?wsdl to http://server:port/orabpel/domain/BPELProcess1/BPELProcess1?wsdl and copy the new wsdl url. This will ensure the OWSM is always pointing to the latest version of process deployed.
Remove the version from the endpoint location. http://server:port/orabpel/domain/BPELProcess1/1.1 to http://server:port/orabpel/domain/BPELProcess1 and copy the new endpoint location. This will ensure the OWSM is always pointing to the latest version of process deployed.

To secure a java web service (or any other web service), get the correct web service wsdl URL.

Step 2: Register the web service in

OWSM.

Login to OWSM.
Go to PolicyManager --> Register Services. Click on Services.
Click add new service.
Insert the required details. Please note enter the correct wsdl URL from step 1.4 without the version and then click next.

5. Click Finish and then commit.

6. Go back to RegisterSerices --> List Of Services, find the service created and click on edit.

Note the Service URL and the Service Endpoint URL. These will be provided to the client and also used for testing.

7. Click on Modify Policy

8. In the Request pipeline, click on 'Add Step Below' in the Log step and click OK.

9. Click on configure in the VerifySignature step. Fill in the appropriate values. Use serverpass for the value while creating the keystore and the alias as the value while importing the client certificate.

10. Click OK and the commit the changes. The update to the signature are done.

Keystore Setup for OWSM

2009-06-23T08:31:00.000+04:00

Purpose

Set up the keystore to be used by Oracle Web Services Manager (OWSM) to perform digitial signature validation.

Prerequisites

The client's public key (.cer file) should be provided.

Steps

Step 1: Creating server store.

Use the java keytool command to create a keystore.

keytool -v -genkey -keyalg RSA -keysize 1024 -keystore [keystore-name.jks] -storepass [serverpass]-alias server1 -keypass [server]

Example server output:-

keytool -v -genkey -keyalg RSA -keysize 1024 -keystore server-store-1jks -storepass serverpass -alias server1 -keypass server

What is your first and last name?

[Unknown]: SashCo

What is the name of your organizational unit?

[Unknown]: DPP

What is the name of your organization?

[Unknown]: SashWorld

What is the name of your City or Locality?

[Unknown]: Dubai

What is the name of your State or Province?

[Unknown]: Dubai

What is the two-letter country code for this unit?

[Unknown]: AE

Is CN= SashCo, OU=DPP, O= SashWorld, L=Dubai, ST=Dubai, C=AE correct?

[no]: Y

Generating 1,024 bit RSA key pair and self-signed certificate (MD5WithRSA)

for: CN= SashCo, OU=DPP, O= SashWorld, L=Dubai, ST=Dubai, C=AE

[Storing server-store-1jks]

Step 2

Add the provided public key to the java keystore.

keytool -import -noprompt -trustcacerts -keystore [keystore-file.jks] -storepass [serverpass] -alias [alias] -file [certificate-file.cer]

Example server output:-

keytool -import -noprompt -trustcacerts -keystore server-store-1.jks -storepass serverpass -alias sashwat -file sashwat.cer

Certificate was added to keystore

Step 3:

Use the following command to list the certificates in the .jks file

keytool -list -keystore -storepass

keytool -list -keystore [keystore-file.jks] -storepass [serverpass]

Acronym / Abbreviation

OWSM - Oracle Web Services Manager

keystore-name.jks - Name of the new java keystore

serverpass - password of the keystore

keypass - password of the private key

clientalias - alias for the client

certificate-file.cer - the certificate file provided by client

Helpful Links:-

Java keytool reference :-

http://java.sun.com/j2se/1.4.2/docs/tooldocs/windows/keytool.html

A very nice regular expression tool

2009-06-16T13:33:00.000+04:00

This a very useful regular expression verification tool.

Regex Coach

I haven't tried many but never needed to look further.

Changing the title of instance in BPEL Console and searching in 10.1.3.4

2009-04-30T12:36:00.000+04:00

Using the title,Index,Custom Key search in the BPEL console for 10.1.3.4 effectively.

After installation of the SOA suite I saw new search facility available in BPEL console, but could not find any documentation regarding this. This is not even provided in the new features.

I could see some new searches in the BPEL console, and thought that it could be useful for tracking.
Login to BPELConsole
Go to instances tab
Search by Title, Index/Custom Key are the new searches that have been added. To use this feature just add a java code snippet in the bpel.

  <bpelx:exec name="setIndexAndCommit" language="java" version="1.5">  
    <![CDATA[String ele =
 ((org.w3c.dom.Text)getVariableData(
        "inputVariable","payload",
        "/client:TestingCustomKeyProcessRequest/client:input/text()"))
        .getNodeValue();      

  setTitle(ele);]]>
  </bpelx:exec>

This sets the title that appears in the BPEL console. This can be used to set to search using the added feature of the BPEL console and make use of the BPEL console better.

Setting the title could have been done in previous release also, but the search option integrated with the BPEL console makes it very good for the support.

The problem I faced was while using the setCustomKey(String) in the java snippet. The error recieved was that the method was not found. Still to find the solution. Will post in the Oracle forums.

SOA suite upgrade 10.1.3.4 - Duplicate instances

2009-04-18T15:17:00.000+04:00

One of the new issues brought by the new version of SOA suite is the duplicate instances. If any asynchronous process is invoked from another process, in the tree finder sometimes even though a single call is made to the bpel process, the process can be seen multiple times.

This is a bug added :(

The cause of the bug is auto-recovery and impact can be minimised if auto recovery is turned off. This feature was introduced in SOA suite 10.1.3.4 and added a new bug, please do not enable this feature in production.

Bugs in Oracle SOA Suite 10.1.3.4

2009-03-21T23:12:00.000+04:00

While testing our application on 10.1.3.4 MLR5, two pieces of functionality broke. Both of them undocumented and still awaiting confirmation as bugs from Oracle.

1. We have a BPEL process that insets a message into a queue using AQ adapter. This fails, with an exception stating xsi not defined in the XML. I've encountered this error message while inserting message into the queue when the XML is invalid.

Strangely enough this xml was generated from a java client proxy, and the xsi definition (mapping xsi to its corresponding namespace) exists along with the soap header. xsi is usually used to denote nulls in xml. If the definition of xsi is moved into the body the error dissapears.

Strange. Very Strange.

2. Another BPEL process contains a task being created and then the same task updating the outcome of the task. No authentication information was passed since the credentials returned while creating the task were used to complete the task. It generates some sort of a token that does this, but this piece of functionality broker in the newer version. Authentication information is required to be passed, so needed to give the bpeladmin username/password. Not very nice.

Hoping no more undocumented isses arise. Will update this post based on the response provided by Oracle support regarding the issues.

SOA suite upgrade 10.1.3.4

2009-03-04T18:38:00.000+04:00

I just upgraded my developer system (windows XP) to SOA suite upgrade 10.1.3.4 MLR#5 running on OLite. Below are the special points from the release notes. I still need to test the stability and features of the new version.

Section 5.1.1, "Password Displays in Clear Text During Deinstallation"
Section 5.1.2, "Passwords Appear in Clear Text in /tmp Directory After Running IRCA.SH"
>>LOL

5.1.3 BPEL Process Instances Do Not Display in Oracle BPEL Control when Using Oracle Database Lite

“If you install Oracle BPEL Process Manager with the Basic Install option, Oracle Database Lite (Olite) is installed. If you then apply the 10.1.3.4 patch to this installation, BPEL process instances under the Instances tab in Oracle BPEL Control do not display.
As a workaround, use the Advanced Install option, which enables you to install a database other than Olite.”
>>WTF? Was it never tested? Or they have stopped making the tool developer friendly.

5.5.11 Removing or Changing the Passwords of Default User Accounts
>>Finally clearly stated

5.7.3 Fault Policy Changes Do Not Require a Restart of Oracle BPEL Server
>> Nice

5.9.5 BPEL Test Suite OnMessage Event Does Not Support Synchronous Operations
When reading section "Asynchronous Event Emulation" of Chapter 20, "Testing BPEL Processes" of the Oracle BPEL Process Manager Developer's Guide, note that the onMessage event does not support synchronous (that is, two way) operations.
>> never knew this !!!

Reset the user password for SOA suite (using jazn)

2009-01-27T16:18:00.000+04:00

To reset the password you need access to the server filesystem.

1. Open the file ORACLE_HOME\j2ee\home\config\system-jazn-data.xml

2. Look for the user you want to reset the password for.The below XML sample is for the user oc4jadmin

oc4jadmin

OC4J Administrator

AFAD02C0C4DD11DCBFFAA5E4969A5543

OC4J Administrator

{903}P9NehIbhq3t1b9xnuciu0z/YiMr1fF0T

3. Change the credentials

!welcome1

The password now becomes welcome1.

4. Restart the server

5.Login using the user oc4jadmin and password welcome1.

Now you will notice that after the server has started the credentials again become hashed.

Note to myself

2008-11-08T22:43:00.000+04:00

I sometimes take too long to answer comments. I will try to answer any queries that I know within maximum of 2 days from now on. Will try to maintain an average of 1 day.

Apologies to everyone whom I have given an delayed response.

Is your SOA suite is it secure?

2008-11-08T20:46:00.000+04:00

I was trying to see if the servers we have is secure enough. What I wanted to know is that wether we were making some errors or the facts were not documented clearly enough. I did find the documentation regarding most problems in some document or the other, but is it clear for admins was the question.

So to find the answer I started looking for SOA suite available online.

Probably this notion would seem stupid why will anyone expose the SOA suite online, I thought that too. But I did an inurl:BPELConsole search and found atleast 10 websites that have their consoles being resulted in the search. Tried a few search engines including google.

The commonly known users are oc4jadmin, but what about bpeladmin and the default users. Nearly 80% of the sites did not have the passwords changed for the users. Could log in some of them seemed to be production sites others were testing sites.

Also a common error was the OWSM user admin with the password as oracle. Sadly most of these users were available to use.

I don't know how to contact the admins of these sites, anyone reading this blog please change the passwords. Go to the user management in the Application Server Console and remove all users that are not used or atleast change the passwords.

All sites had their oc4jadmin passwords changed but it's simply not good enough. Why were these consoles exposed to the internet I have no idea, I don't think it should be done.

Another probability is Denial Of Service attacks or brute force. I don't think (cannot confirm this though) the username for oc4jadmin can be changed. It makes brute force hack even simpler.

Is security still an aferthought for organizations !!! This scares me.

One of the sites I could log into. I have tried to remove all the information regarding who owns the site.

Learning and implementing the Oracle Fault Management Framework

2008-11-01T22:23:00.000+04:00

Why?
The process has some external dependencies, due to a network failure the partner system is down for a few days. The message sent to the partner can be sent later but recovery mechnism can be difficult and redundant in BPEL.

How was it done before?
Without the framework solutions that were possible were
1. Assume that the partner system link or the system would rarely be down, in such cases the process would have to be handled manually. Data fix, using the test case feature etc. This is called wishful thinking.
2. Retry then create a worklist task whenever there is error, requires programming effort and redundancy in process.
3. Rollback using compensation handler may be an option based on design of your process.

What is it in a nutshell?
Instead of handling faults in BPEL by adding catches handle faults use the framework to handle it for you. Both can also be used together. Retry of failed activity, Replay of failed activity scope, Human intervention and many other ways of handling the faults can be provided.

In detail it can be read fro references stated below.

What is the advantage?
1. Generic framework can be reused without coding effort.
2. Will provide resume, retry, continue and modify functionalities.
3. No BPEL change required

Lessons learnt and opinions
While implement the fault handling using this framework, found rather suprisingly that it was very easy to use. The only trouble I had was that in my patch of 10.1.3.3 the post installation steps had not been executed. Without these steps the framework does not catch the fault.

It was rather suprising that the framework can override the fault handling defined in the process. It was a bit difficult to digest but I could not think of any way else it could be designed.

The best resource I could find was http://www.it-eye.nl/weblog/2007/09/10/oracle-bpel-10133-fault-policy-management/
A very good resource to begin.
Also use Oracle documentation http://www.oracle.com/technology/products/ias/bpel/pdf/10133technotes.pdf is of great help.

Using these resources when I started testing my processes I wanted all my faults remote faults to be retried and then sent for human intervention.

But then I started facing issues when an synchronous process is invoked and the process waiting for human intervention the calling process is timed out. So I had to have a seperate policy for synchronous processes which only contain retries and another for asynchronous processes which contain retry and human intervention.

This reminded me of some Oracle document which had said prefer Async process over sync (I think it said it because of performance reasons).

Then I stumbled over an article http://orasoa.blogspot.com/2008/03/bpel-fault-policies-best-practise.html which validated my understandings.

If this works(in production) I'm pretty sure it will (It's working on my PC but cannot celebrate until it goes to production) I will be very pleased.

The framework has limited extensibility only java tasks can be used to extend the framework. It leaves very less scope for out of the box thinking.

Also, the problem I faced was that the activities tab in the BPEL Console needs to be provided to support personnel, none of the other tabs should be accessible. Could not resolve this issue :(. From the information I could gather was that this can only be done by tweaking the code of BPEL Console. ref: http://chintanblog.blogspot.com/2007/12/i-saw-numerous-people-asking-about-bpel_290.html

Special thanks:
To the Oracle team to come up with this feature and the blogs of consultants I have mentioned and all the people who answer questions on the Oracle forum.

Sash IP Messenger

2008-08-04T12:12:00.000+04:00

Forces compelling to learn RCP:-
For quite some time I have been involved in creating helper projects, small projects that help in coding, generate code etc. This seemed to be a very nice and effective way of producing a very nice UI for them.
It’s eclipse; I like the IDE and is my IDE of choice for Java. Using RCP would mean I could integrate the tools written with eclipse.
I have done some Swing coding, it’s not a very easy to write a nice UI. RCP provided a dream of producing feature rich applications written in java fast and clean.
Since the release of eclipse 3 the documentation there have been major modifications in the way eclipse works (or so I have read) and made RCP integration easier. I started with reading a book Eclipse Rich Client Platform: Designing, Coding, and Packaging Java Applications - By Jeff McAffer, Jean-Michel Lemieux. Very nice book, made the journey simpler.
When I had just started coding one of my leads had told me, the best way to learn was to implement a small project. Execute it like a real project, and you would learn what are the where a tool can be best utilized, what is the effort required for implementation and any issues with the tool. Quite a few books are written in similar fashion where they build one application from start to the end. So does the book Eclipse Rich Client Platform. This book creates a chat application using the XMPP protocol and smack library.
I decided to create a UI for IP Messenger, since this is the messaging tool I usually use and it does not have any nice UI. This is a free messenger available and does not need a server.
I have just downloaded Ganymede so I created a new Eclipse plug-in project in Ganymede. I realized later that the version I should have used is Eclipse Europa since Ganymede is still to be used widely. I was able to convert the project into an eclipse 3.3 compatible plugin, the only drawback was that I could not use an image with menu manager. I had to replace

MenuManager helpMenu = new MenuManager("&Help", AbstractUIPlugin.imageDescriptorFromPlugin(Application.PLUGIN_ID, IImageKeys.HELP) ,"help");

I had to remove the image from the menu manager to use it with Eclipse Europa. Now it is compatible with both Eclipse Europa and Eclipse Ganymede.
The prerequisites for learning RCP are basic knowledge of Java, SWT and Eclipse. I am still learning new things about RCP everyday but creating a feature rich UI using RCP was fun and fast. The working RCP application can be found at: http://code.google.com/p/sashipmessenger/downloads/list
Features:-
Customized splash screen, the project uses a very simple splash screen. I have just replaced the splash.bmp file in the project. I decided not to use a progress bar, which can easily be added. More customizations are possible. While googling I also found a nice article that used the splash screen for login.

Saving the workbench state. Include the code in the class that extends WorkbenchAdvisor.

public void initialize(IWorkbenchConfigurer configurer) { super.initialize(configurer); configurer.setSaveAndRestore(true); }
This ensures that the windows appear in the same location as when you closed the views.

Use perspective to decide the initial layout of the application
Minimize to system tray. RCP provides a good level of integration with the system tray.

Also to provide a notification when a message has arrived and application is not visible or inactive, the icon changes to a message and a system beep is sound.

In the menu preferences have been added, the preferences configuration is as shown below. This integrates nicely with the eclipse editor if this is used as an eclipse plugin.

The configurations shown are the display name for the user, group name and the log folder. The messenger shows the chat history with a user. The broadcast address is used to specify address not in the same subnet.
The application has two different views and an editor. The contacts view shows all the users on IP Messenger. The console view at the bottom provides information about different events. The different events like message read event, user removed message added etc. can be seen. The editor is open whenever a message is sent or received from a user.

The messenger saves the chat log. When the editor is opened again the log is greyed out.

The views can be closed and moved around.

The view can be opened from the menu.

Users can be found from the find item on the top of contacts view.

The RCP application can be integrated with the existing eclipse. Just drop the plugin jar into the plugin folder of eclipse dump.

WS-BPEL 2.0

2008-05-20T14:24:00.000+04:00

Derived from : http://docs.oasis-open.org/wsbpel/2.0/Primer/wsbpel-v2.0-Primer.pdf

Copyright © OASIS Open 2007. All Rights Reserved.

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind, provided that the above copyright notice and this paragraph are included on all such copies and derivative works. However, this document itself may not be modified in any way, such as by removing the copyright notice or references to OASIS, except as needed for the purpose of developing OASIS specifications, in which case the procedures for copyrights defined in the OASIS Intellectual Property Rights document must be followed, or as required to translate it into languages other than English.

What’s new in WS-BPEL 2.0
As a result of the OASIS Technical Committee’s issues process, the original BPEL4WS 1.1 specification has received several updates. The following list summarizes the major changes that have been incorporated in the WS-BPEL 2.0 specification.

Data Access

Variables can now be declared using XML schema complex types

XPath expressions are simplified by using the ‘$’ notation for variable access, for example, $myMsgVar.part1/po:poLine[@lineNo=3]

Access to WSDL messages has been simplified by mapping directly mapping WSDL message parts to XML schema element/type variables

Several clarifications have been added to the description of the activity’s semantics

The keepSrcElementName option has been added to in order to support XSD substitution groups or choices

The ignoreMissingFromData has been added to automatically some of operation, when the from data is missing.

An extension operation has been added to the activity

A standardized XSLT 1.0 function has been added to XPath expressions

The ability to validate XML data has been added, both as an option of the activity and as a new activity

Variable initialization as part the of variable declaration has been added

Scope Model

New scope snapshot semantics have been defined

Fault handling during compensation has been clarified

The interaction between scope isolation and control links have been clarified

Enrichment of fault catching model

A activity has been added to fault handlers

The has been added to scopes

The exitOnStandardFault option has been added to processes and scopes

Message Operations

The join option has been added to correlation sets in order to allow multiple participants to rendezvous at the same process with a deterministic order

Partner link can now be declared local to a scope

The initializePartnerRole option has been added to specify whether an endpoint reference must be bound to a partner link during deployment

The messageExchange construct has been added to pair up concurrent and activities

Important differences between BPEL 1 and 2 as imported from wsbpel-v2.0-Primer.

Most of the features added seems to be lessons learn't, a good way to improve. It does not drastically change the specifications but seems to be more friendly for the developer. Many problems that I am facing with the current implementation with BPEL 1.1 would be removed using this specification when the product vendor decides to implement it.

Sadly one point was missing support for XPath 2.0 and XSLT 2.0. The FAQs [http://www.oasis-open.org/committees/download.php/23858/WS-BPEL-2.0-FAQ.html] clearly state 'WS-BPEL2.0 is based upon XPath 1.0 and XSLT 1.0'. I thought XSLT 2.0 and XPath 2.0 were huge advancements but not being supported I was very disappointed. I believe the product vendors would still support them along with XPath 1.0 and XSLT 1.0 as standard extensions.

Oracle SOA suite - Retrieving process information

2008-04-21T15:53:00.000+04:00

The problem statement
To retrieve the information of a process from dehydration store even when I did not have the instance id using data present in the request of the process. (This is a part of a bigger problem I am trying to resolve)

I have an a unique field in the BPEL input. How can I find the BPEL instance and the related instances (This BPEL is executed which in turn executes several other BPEL processes ). I could not modify the existing BPEL so I was left with only one option that was to use the Oracle BPEL Process Manager Client API. This API has very less documentation, most of the help I got was from some blogs specially http://orasoa.blogspot.com/2007/06/calling-bpelesb-webservice-from.html and the API documentation http://download-uk.oracle.com/docs/cd/B31017_01/integrate.1013/b28986/toc.htm.

Driving to the beach
The Marc Kelderman blog solved one of the biggest problems I faced the 'jar hell'. I had tried several other posts but was not successful in setting up the project correctly, but the jar files as specified by him worked wonderfully.

Finally my classpath contained :-
connector15.jar, ejb.jar, oc4j-internal.jar, optic.jar, orabpel.jar, orabpel-ant.jar, orabpel-boot.jar, orabpel-common.jar, orabpel-exts.jar, orabpel-thirdparty.jar, oracle_http_client.jar, orawsdl.jar, xmlparserv2.jar. I am using SOA Suite version 10.1.3.3.

Now I setup a new java project in eclipse with these jars in my classpath. I then setup a server configuration file

Getting your feet wet

## server_config.properties
java.naming.factory.initial=com.evermind.server.rmi.RMIInitialContextFactory
java.naming.provider.url=opmn:ormi://someserver.com:6004:oc4j_soadqa/orabpel
java.naming.security.principal=myname
dedicated.connection=true
java.naming.security.credentials=mypwd

Load the properties:-

 prop = new Properties();
InputStream resourceAsStream = BPELManagerControl.class
.getClassLoader().getResourceAsStream("server_config.properties");
prop.load(resourceAsStream);

The next piece of code I wrote was to retrieve all the instances of a specific BPEL process,

  Locator locator = new Locator("domainname", prop);
WhereCondition whereProcessId = new WhereCondition("process_id = ?");
whereProcessId.setString(1, "myprocessname");
IInstanceHandle[] instanceHandles = locator
                .listInstances(whereProcessId);

Taking the dive

And using the instance handles I could display the states and instance id's of the processes. Now this was just the beginning of learning of how to use the API. I needed to modify it to suite my requirements. The previous piece of code returns all record in no particular order, this would make my task very difficult. By trial and error I realized that the API was using a view admin_list_ci to query and all its fields could be used in the query. Thus I added the following to order by creation_date (My instance would be one of the current instances in the server) desc. The next problem was if there was an error the list would continue processing infinitely. So I decided that my instance would be one of the last 50 instance executed on the server. This was a safe assumption since I would be searching immediately after submission. Thus my code became:-

   Locator locator = new Locator("domainname", prop);
 WhereCondition whereProcessId = new WhereCondition("process_id = ?");
 whereProcessId.setString(1, "myprocessname");
     whereProcessId.append("ORDER BY  CI_Creation_Date desc");
 IInstanceHandle[] instanceHandles = locator
     .listInstances(whereProcessId,0,50);

The next problem to resolve was ho do I find if the given IInstanceHandle handle was the instance I was searching for. I needed to search if my application specific id was present in the request of the instance.

The IInstanceHandle object had a getField method which seemed to suite my requirements (get the request variable and get the xml from it), but I realized it could only be used for a process that is not finished, thus had to drop the idea of using this method.
The only other way to get the data I could find was using the debug and audit xmls. In the BPELConsole along with the flow of the executed instance it also can display the Audit and Debug xmls. Corresponding methods were getAuditTrail and getDebugTrace that gave the dump of the whole BPEL instance data. I decided to use the getAuditTrail as the debug trace referred to the XML as an id (probably a refernce to some other table) which I could not find. Audit trail seemed to be working thus I decided to use it.

   String auditTrailXML = instanceHandle.getAuditTrail();
  String XPATH = "//event[@label=\"receiveInput\"]/details/text()";
  String receiveInput = Utils.xPathEvaluator(auditTrailXML, XPATH);
  XPathFactory factory = XPathFactory.newInstance();
  XPath xPath = factory.newXPath();

  NamespaceContext ctx = new NamespaceContext() {
      public String getNamespaceURI(String prefix) {
          String uri;
          if (prefix.equals("ns1"))
              uri = "http://www.sash.com/Schema/Declaration";
          else
              uri = null;
          return uri;
      }

      public Iterator getPrefixes(String val) {
          return null;
      }

      public String getPrefix(String uri) {
          return null;
      }
  };

  xPath.setNamespaceContext(ctx);
  String XPATH2 = "//ns1:appid/text()";
  XPathExpression xPathExpression = xPath.compile(XPATH2);
  String appid = xPathExpression.evaluate(new InputSource(
      new StringReader(receiveInput)));

And from the appid compare with the appid we had and keep on looping until the instance is found. Thus I was successful in retrieving the instance id.

To find all the related instances find the current instance and get it's handle. Then use the following where condition to retrieve related instances:-

    WhereCondition wpi = new WhereCondition("ROOT_ID=?");
    wpi.setString(1, instanceHandle.getRootId());

Conclusion

The whole code was mostly based on trial and error and basic API documentation.
The API can be very helpful but very difficult to use
The view admin_list_ci in the BPEL dehydration store can be used to construct the where clause in the query.
Setting up the project is not very simple. The jars have to be correct.
Do you want to use the API? Depends on your requirement. I turned to this API when I had no other option and yes I was satisfied as it resolved my problem.

XSLT / XPATH 2.0

2008-03-28T22:22:00.000+04:00

In my current project I was trying to replace a java transformation service to an XSLT. I faced some speed breakers. Googling I came to references of XSLT 2.0 which solves the problems that I was encountering.We are using the Oracle SOA suite 10.3.x. the editor (JDeveloper) only supports XSLT 1.0, but the interesting part is that in text editor changing version of XSLT from 1.0 to 2.0 the parser supports the newer version also.

I just needed group by function like the database. In an array I had to do a grouping. XSLT 2.0 brings the new for-each-group construct. This missing feature from the older xslt version had been a major drawback.

Another simple requirement I had was a sum of products. Say I have multiple items and I need to calculate the total price.

 <items>
   <line_item>
       <price>20</price>
       <quantity>33</quantity>
   </line_item>
   <line_item>
       <price>10</price>
       <quantity>4</quantity>
   </line_item>
</items>

To calculate the product (20*33 + 10*4) we can calculate it by using XPath . Evalaution of XPath sum(for $a in (//line_item) return ($a/price * $a/quantity)) gives the result. We can use this in our XSLT to calculate the value. The new version of XSLT/XPath brings in features that were long waited.

Some other features include :

Output multiple documents from a single transformation

Type awareness

The resultant tree created by querying the doc, can be queried like any other element

custom functions

I hope these standards are adopted soon by everyone with better tool support.

EclipseWebEnabler by Alphaworks

2007-12-15T17:11:00.000+04:00

The eclipse plugin that would enable your eclipse for remote access using Mozilla browser.

Amazing idea, a very innovative eclipse plugin. It still needs a lot of work but definitely I would keep a track of its changes.

You need to see it to believe it.

It could change the way we use central repositories forever. I'm just waiting for it to be completely functional.

Download and try from http://www.alphaworks.ibm.com/tech/eclifox

Hourly Clock

2007-11-25T17:04:00.000+04:00

Announcing the availability of Hourly Clock a Google Gadget developed by me. It uses the nice Google gadget API to show a simple clock and give hourly reminders of the time. So don't let the time just pass by, use this gadget....

Non WS-I document literal web service

2007-11-25T10:51:00.000+04:00

A document literal web service with more than one parts specified for the same message is not WS-I compliant.

e.g.

<wsdl:message name="HelloDudeSoapIn">
      <wsdl:part name="name" element="tns:name"/>
      <wsdl:part name="age" element="tns:age"/>
 </wsdl:message>

The SOAP message would look like:

<soap-env:envelope>
     <soap-env:body>
              <m:name>Baby</m:name>
              <m:age>1</m:age>
     </soap-env:body>
</soap-env:envelope>

Why the restriction, think about validation of the message. I would have to extract the name and age elements seperately and then validate them against an XSD. If the elements were within a single tag...

<soap-env:envelope>
     <soap-env:body>
             <m:person>
                    <m:name>Baby</m:name>
                    <m:age>1</m:age>
             </m:person>
     </soap-env:body>
 </soap-env:envelope>

The person element can be completely validated after the person element is extracted.

XPath injection

2007-11-14T14:09:00.000+04:00

XPath injection

What is XPath?

XPath (XML Path Language) is an expression language for addressing portions of an XML document, or for computing values (strings, numbers, or boolean values) based on the content of an XML document.
For more information see XPath tutorial.

Understanding the attack

XPath injection is an attack where data is taken from the user without validation (or incomplete validation) and which modifies the behavior of the XPath expression by masquerading XPath as data.

Assume that we have user id and password stored in xml files and we use XPath for validating them. The xml containing the user id and password looks like:

<security-check>
<user>
<id>sash</id>
<password>sash123</password>
</user>
<user>
<id>abhinav</id>
<password>abhinav123</password>
</user>
</security-check>

To validate the user id and password against the xml we use the XPath expression
//user[id/text()='+ {input user id} +' and password/text()='+ {input password} +']
we execute the XPath and check if it returns any nodes, if it returns any nodes then the password is valid. If the entered used id is sash and the password is sash123 the XPath would become
//user[id/text()='sash' and password/text()='sash123']
and would return the user node and the password would be validated. If a wrong password is used no node would be returned and the validation would fail.

Now while injecting XPath in the password field ' or 'a' = 'a is entered. The XPath would become
//user[id/text()='sash' and password/text()='' or 'a' = 'a']
which would return multiple rows and the validation would pass.

Simulating the attack

Sample C# code

XmlDocument XmlDoc = new XmlDocument();
XmlDoc.Load("XPATH_INJECT.xml"); // use the same xml as above
XPathNavigator nav = XmlDoc.CreateNavigator();
XPathExpression expr = nav.Compile("//user[id/text()='"
+ textBox1.Text + "' and password/text()='" + textBox2.Text + "']");

XPathNodeIterator iterator = nav.Select(expr);
if (iterator.MoveNext())
{
result.Text = "passed";
}
else
{
result.Text = "failed";
}

Sample Java code

XPathFactory factory = XPathFactory.newInstance();
XPath xPath = factory.newXPath();
File xmlDocument = new File("XPATH_INJECT.xml");
InputSource inputSource = new InputSource(
new FileInputStream(xmlDocument));

String user = jTextField1.getText().trim();
String pwd = jTextField2.getText().trim();
XPathExpression expr = xPath.compile(
"//user[id/text()='" + user +
"' and password/text()='" + pwd +
"' ]");
Object result = expr.evaluate(inputSource, XPathConstants.NODESET);

NodeList nodes = (NodeList) result;

if(nodes.getLength()>0)
{
jLabel3.setText("Valid"); }
else
{
jLabel3.setText("Failed"); }
}

How to protect against the attack:

There are many ways of preventing this attack

Validate the input
Escape the ' or '' characters
This attack is similar to SQL injection, the most common solution to SQL injection attack is using a prepared statement, but something similar is not available in XPath. This though can be achieved using XQuery but XQuery is not directly supporeted without the use of external libraries in .Net or Java.

The best solution would be escaping the ['] characters, in our example if we replace a ['] with [']['] in the input, we would avoid the attack.
In the previous case our password text entered was ' or 'a' = 'a but this would be modified to '' or ''a'' = ''a
//user[id/text()='sash' and password/text()=''' or ''a'' = ''a']
and would not produce any results (and it is a valid XPath).

This XPath passes in Altova XML spy but not in Java 6 or .Net 2.0

So we still need to find an elegant solution to the problem!!!!

In all the proposed solutions solution (3) is the most elegant but the support is still very limited.

Whats left

Some of the databases now support XPath, in case your database supports XPath be very careful about the inputs (don't forget the validation).

References

http://www.ibm.com/developerworks/xml/library/x-xpathinjection.html
http://www.packetstormsecurity.org/papers/bypass/Blind_XPath_Injection_20040518.pdf

Practical SOA patterns

2007-10-25T14:12:00.000+04:00

The SOA patterns I have discussed do not talk about the organization IT policies but the practical SOA patterns:-
1.1 Avoid point to point Web Services:
Problem: Web Service point to point is STILL point to point; doing a bad practice in XML doesn't make it better.

Effect: An organization believes that they are creating next generation loosely coupled architecture just because they are using Web Services. Web Service calls are invoked directly, using a URI which is hard-coded into the WSDL. Having a highly disorganized and interdependent systems model leads to increased cost of change and a high degree of fragility of the enterprise. When one service is changed a number of other services either fail or behave in unpredictable ways. There is a lack of clarity as to how one service depends on another and what the impact of change is across these services. Consumers then start demanding multiple versions of services, and these add further to the spaghetti in the enterprise.

While designing a BPEL process the endpoints of the web service may not be known, there is no simple way to determine the web service endpoint dynamically.

Resolution: The first step is to indirect all of the calls and this can be done in a number of ways; the least invasive is to "proxy" all web-service requests via some form of mediation. So while the host application is still calling webservice.mycompany.com, this is proxied so mediation and routing can be applied if required. The next stage is to understand the different dependencies and identify those which are valid and those which should have been done in a more managed way. A clear governance plan then needs to be created to identify and manage dependencies and versions and to help manage the Web Service infrastructure.

Once this level of management has been created it is time to start considering what the enterprise Service model should be, that requires the creation of the business service architecture and then overtime evolving the current infrastructure to better represent the business that pays for it.
1.2 Use Business Rules to make your process flexible:

Problem: Orchestration Languages provide constructs that break the linear flow of control. These constructs alter the flow of service orchestration based on run time information. These constructs change often.

Effect: In mortgage decisioning a conditional control structure implements the pre-screening step that determines whether the process performs decisioning or generates a rejection letter instead. The conditional verifies eligibility, determining how the orchestration unfolds based on whether the applicant's credit score is above a threshold. In effect, the condition associated with a control structure in the orchestration definition captures a business rule. In case the threshold changes, there is a change in the business process and the process needs to be changed and deployed again.

Resolution: Business rules complement processes. While business processes provide recipes for achieving results, business rules describe the operations, definitions and constraints that apply to an organization in achieving these results. For example a business rule might state that no credit check is required for existing Orchestra Bank customers. A business rules engine integrated with the BPEL manager can be used to solve the problem.

1.3 Use Composite Services to combine multiple services:

Problem: We need to combine the functionality of multiple services and make it available to consumers interested in is as a whole rather than the individual services implementing it.

Effect: Combining existing services could provide significant value over any individual service. In fact the recursive composition is key to the ability of adding value through combining functionality of the existing services. As the number of SOA adopters increases so does the number of choices.

Service consumers require functionality which can be implemented by suitably combining multiple existing services. They do not want to make multiple calls to the individual services and control the invocation flow.

Combining the functionality of existing business services (especially when they are provided by different organizations) requires a certain amount of know how and typically has sensitivities (e.g., the underlying services may change or different providers for these services can be selected). Exposing this knowledge to the service consumer introduces coupling.

Following mergers and acquisitions or through agreements with multiple partners several business services with similar functionality can be available to the enterprise (similarly to the credit check service from the context). These services can be distinguished by their interfaces and SLAs. The availability of multiple choices places the onus of selecting one service to the consumers, thus introducing coupling.

Solution: Expose the services involved in satisfying required functionality and their coordination as a separate service.
I was already using quite a few of these patterns but found them documented in Antipatterns and Orchestration patterns.

Java Annotations

2007-09-26T18:53:00.000+04:00

I was preparing a talk on annotations in java and ended up learning a few cool stuff.

I believe the utility of annotations would be the freedom from implementing interfaces like the JUnit test case and the EJB 3.0.

New and innovative uses for annotations are also likely to come up.

Annotations is cool if used intelligently. Now if a developer wants to use a annotations to save configuration values I ask can you blame annotations.

The problem lies sometimes in the fuzziness of what is configuration values. Say in hibernate in by bean I hard code my table name, is my table name configuration. I believe not, but in some cases it could be true. I haven't seen table names being different in production environment and development but using annotations makes it less flexible.

Sun could have made the creation of annotations more 'Java like' @interface to define an annotation and the definition of the default values....

The annotation processing tool is also very interesting. The tool ties us with the Sun jdk and probably would evolve as a part of standard SDK distribution.

Presentation is available at : http://sashwat.gupta.googlepages.com/Annotations.pdf
Example code is available at : http://sashwat.gupta.googlepages.com/annotation.zip

ClassCastException

2007-07-04T13:53:00.000+04:00

When do we get a ClassCastException?

The java documentation of ClassCastException states:-

Thrown to indicate that the code has attempted to cast an object to a subclass of which it is not an instance.
For example, the following code generates a ClassCastException:


     Object x = new Integer(0);
     System.out.println((String)x);

The statement seems to be a very simple, but not when different class loaders are involved. Another scenario when this exception occurs is when the class accesses an object of the same class loaded by another class loader hierarchy.

I was determined to write a simple code to simulate the exception.

So I wrote two classes to be loaded by different classloaders.

package classldr;

public class Tree {

  private String name = "sash";

  public String getName() {
      return name;
  }

  public void setName(String name) {
      this.name = name;
  }
}

//------ different file ----------//
package classldr;

public class Person{

  public void doIT(Object t)
  {
      //try to create the typecast exception here!!
      System.out.println("Tree planted : " + ((Tree)t).getName());
  }
}

I would try to load these classes using different classloaders and simulate the error.

So I created instances of URLClassLoader and did the same. I had to make sure that the class creating the class loaders could not access these classes, as it was the parent of the URLClassLoader and would have actually loaded the class due to delegation model followed by the classloaders.

package classldr;

import java.lang.reflect.Method;
import java.net.URL;
import java.net.URLClassLoader;

public class TestClassLoader {

   public static void main(String[] args) throws Exception {
      
       /*
        * Class loader 1 to create instance of Tree class. I have put the
  * Person and Tree classes in C:\classldr\ directory.        
        */
       ClassLoader cl1 = new URLClassLoader(new URL[] { new URL(
               "file:C:\\") });
       Class c = cl1.loadClass("classldr.Tree");
       Object treeNewInstance = c.newInstance();
      
       /*
        * Class loader 2 to create instance of Person and Tree class.
        */
       ClassLoader cl2 = new URLClassLoader(new URL[] { new URL(
               "file:C:\\") });
       Class treeClass = cl2.loadClass("classldr.Tree");
       Class personTreeClass = cl2.loadClass("classldr.Person");
       Object personTreeObj = personTreeClass.newInstance();
       Object treeClassObj = treeClass.newInstance();
       Method method = personTreeClass.getMethod("doIT",new Class[]{Object.class} );
      
      
       //pass the object of tree loaded by cl 1 to
       //person object loaded by cl 1
       method.invoke(personTreeObj,new Object[]{ treeClassObj});
      
       //pass the object of tree loaded by cl 1 to
       //person object loaded by cl 2
       //should throw a ClassCastException
       method.invoke(personTreeObj,new Object[]{ treeNewInstance});
   }
}

After I spent a lot of time on this I realized it could be demonstrated in a much simpler way. I decided that my URLClassLoader could be a child of the Bootstrap class loader, not necessarily the system class loader.

package classldr;

import java.net.URL;
import java.net.URLClassLoader;

public class TestClassLoader2 {

    public static void main(String[] args) throws Exception {
        
        //get current class location
        URL resource = TestClassLoader2.class.getClassLoader().getResource(".");
        
        //create a new classloader to load this class, 
        //have the parent of the classloader as null
        ClassLoader cl1 = new URLClassLoader(new URL[] { resource }, null);
        Class c = cl1.loadClass("classldr.TestClassLoader");
        
        //this throws ClassCastException
        TestClassLoader2 treeNewInstance = (TestClassLoader2) c.newInstance();
    }
}

This code was good enough to simulate the exception.

Finally I successfully generated the exception and was feeling very stupid about my first method. :(

Finding Class Version

2007-06-08T16:40:00.000+04:00

Facing class mismatch error, I decided to find the JRE version and the compiler version used to compile the class file.

Its easy to get the details of the JRE version using System.getProperties(). A more difficult task was to find out the version of the class file. I could not find any API which did it :(. But I did find out that these details were available in the class file, so I wrote a small code to determine if the class will run on the current version of JRE.

import java.io.DataInputStream;
import java.io.FileInputStream;

public class ClassRuntimeVersion {
    public static void main(String[] args) throws Exception {

        FileInputStream fis = null;
        DataInputStream dis = null;

        try {
            if (args.length != 1) {
                throw new Exception("specify the class file");
            }

            fis = new FileInputStream(args[0]);
            dis = new DataInputStream(fis);

            if (dis.readInt() != 0xCAFEBABE) {
                throw new Exception("not a class file");
            }

            short minorVersion = dis.readShort();
            short majorVersion = dis.readShort();

            System.out.println("Java Class version info");
            System.out.println("1.6    50");
            System.out.println("1.5    49");
            System.out.println("1.4    48");
            System.out.println("1.3    47");
            System.out.println("-------------------------");

            float classVersion = Float.parseFloat(majorVersion + "."
                    + minorVersion);
            System.out.println("Class file compiled version : " + classVersion);

            float jreJavaVersion = Float.parseFloat(System
                    .getProperty("java.class.version"));

            System.out.println("JRE version : " + jreJavaVersion);
            if (jreJavaVersion < classVersion) {
                System.err.println("You r dead dude, versions did not match");
            }
        } finally {
            if (fis != null) {
                fis.close();
            }
            if (dis != null) {
                dis.close();
            }
        }
    }
}

Sampling Java SE 6

2007-05-29T08:34:00.000+04:00

A lot of new features and API enhancements have been introduced in Java 6 (Mustang). Some of them are discussed briefly.

Compiler API

The new Java Compiler API allows invoking a compiler, gives access to diagnostics, and control over how files are read through a file manager. The file manager allows applications such as IDEs and JSP servers to keep all files in memory, which significantly speeds up compilation. Sun's open source Java EE implementation, GlassFish claims to have already benefited from this API.


 //get the java compiler reference 
 JavaCompiler compiler = ToolProvider.getSystemJavaCompiler();

 //compile the Java class
 int compilationResult = compiler.run(
                            null,null,null, "C:\\Person.java");

The code snippet shows how to compile a Java file using the Compiler API.

Web Service

The new web services stack provides support for writing XML web service applications. The java classes can be exposed as a .NET interoperable web service with a simple annotation. Java SE 6 adds new parsing and XML to Java object-mapping APIs, previously only available in Java EE platform implementations or the Java Web Services Pack.

To create a web service on Mustang create a java class, annotate it as shown below.


  @WebService
  @SOAPBinding(style = SOAPBinding.Style.RPC)
  public class Hello {
    public String echo() {
 return "Hello THBS";
    }
  }

To deploy the web service we just need to write the main method.


  public static void main (String [] args) throws Exception {
      Hello server = new Hello();
      Endpoint.publish("http://localhost:9090/Hello", server);
  }

The deployment can be verified by displaying the wsdl file on the browser
http://localhost:9090/Hello?wsdl. This feature is intended to be used for testing only.

Scripting for the Java Platform

Java SE 6 provides support for scripting, which enables the developers to integrate Java technology and scripting languages by defining a standard framework and interface to do the following:
• Access and control Java based objects from a scripting environment
• Create web content with scripting languages
• Embed scripting environments within Java technology-based applications

The Java Platform, Standard Edition (Java SE), does not mandate any particular script engine, but it does include the Mozilla Rhino engine for the JavaScript programming language.


  ScriptEngineManager mgr = new ScriptEngineManager();
  ScriptEngine jsEngine = mgr.getEngineByName("JavaScript");
  jsEngine.eval("function helloWorld(){" 
+ " println('Hello, world!'); "
  + " return 's';" + "}");

  Invocable invocableEngine = (Invocable) jsEngine;
  invocableEngine.invokeFunction("helloWorld", (Object[]) null);

The example shows how to invoke a JavaScript function using java.

See: Carpe diem: Mustang released

Database

The Java SE 6 development kit co-bundles the all-Java JDBC database, Java DB based on Apache Derby. Out of the box developers have a database that can be used that implements the latest version of JDBC and is embeddable within desktop Java applications. Java DB has a small memory footprint and is fully transactional.

Also provided is JDBC 4.0, a well-used API with many important improvements, such as special support for XML as an SQL datatype and better integration of Binary Large OBjects (BLOBs) and Character Large OBjects (CLOBs) into the APIs.

Desktop Development

Desktop application development just became simpler with Java 6. It provides better platform look-and-feel in Swing technology, LCD text rendering, and snappier GUI performance overall. Java applications can integrate better with the native platform with things like new access to the platform's System Tray and Start menu. At long last, Java SE 6 unifies the Java Plug-in technology and Java WebStart engines, just makes sense. Installation of the Java WebStart application got a much needed makeover.

A new class added to the Java platform is java.awt.Desktop. It allows Java applications to launch associated applications registered on the native desktop to handle a java.net.URI or a file.


 Desktop d = Desktop.getDesktop();
 //opens the application associated with the txt file in your OS
 d.browse(new URI("c:/text_file.txt"));

Similar enhancements have been made to make the development of a java desktop application simpler.

Class file structure update:

The class file structure in Java SE 6 has been modified to provide a much faster and simpler class verification process. The idea is to split the old verification process into two phases: type inferencing (compile time) and type checking (runtime). The new verifier (called the type-checking verifier) no longer needs to infer types because it uses type information embedded in the Java class file to check byte code type consistency. Removing the type inferencing process from the verifier significantly reduces the complexity of verifier code and improves verification performance. This provides performance improvements in byte code verification and thus class loading and start up time.

Mustang :- The Desktop bonus

2007-05-21T17:53:00.000+04:00

One of the problems with java over the years is the lack on Desktop support. Sun has taken a major step with the release of Java 6.These changes have brought in a whole new flavour to the java desktop applications.

Java 6 now has system tray support.Now icons in the system tray can be added with menus and event handlers.Some applications that run in the background (eg mail client) can be seen in the system tray. Notifiers can also be provided to sent notification messages. The code demonstrates the use of the new functionality.

package com.sash.java6;

import java.awt.*;
import java.awt.TrayIcon.MessageType;
import java.awt.event.*;
import java.io.File;
import java.net.URI;

public class SystemTrayTest {

 public SystemTrayTest() throws Exception {

  if (SystemTray.isSupported()) {

   SystemTray tray = SystemTray.getSystemTray();
   //image for tray icon
   Image image = Toolkit
    .getDefaultToolkit().getImage("any_image.gif");
   
   ActionListener exitListener = new ActionListener() {
    public void actionPerformed(ActionEvent e) {
     System.exit(0);
    }};

   //pop menu for the tray
   PopupMenu popup = new PopupMenu();
   MenuItem alertItem = new MenuItem("Message");
   popup.add(alertItem);

   MenuItem defaultItem = new MenuItem("Exit");
   defaultItem.addActionListener(exitListener);
   popup.add(defaultItem);

   final TrayIcon trayIcon = new TrayIcon(image, "Tray Demo", popup);

   alertItem.addActionListener(new ActionListener() {
    public void actionPerformed(ActionEvent e) {
     trayIcon.displayMessage(
      "Finally", 
      "Desktop support for Java", 
      MessageType.INFO);
    }
   });

   trayIcon.setImageAutoSize(true);
   trayIcon.setToolTip("Tooltip test");
   tray.add(trayIcon);
  } else {
   System.err.println(
    "System tray is currently not supported.");
  }
 }

 public static void main(String[] args) throws Exception {
  
  //the system tray icon test
  new SystemTrayTest();
 }
}

Other enhancements include, the introduction of the Desktop API. Using this API now its very easy to open the default email client etc. It also provides an API to open any given file with the default application associated in the OS.


  Desktop d = Desktop.getDesktop();
  //guess what?
  //opens the application associated in your OS with the jpg file
  d.browse(new URI("c:/text_file.txt"));

This code opens the default program associated with the text files, on my windows system it opens the file in notepad.

API enhancements have been made to the getTotalSpace, getUsableSpace and getFreeSpace methods have been added. These are very useful enhancements made.

Very nicely done by the sun guys, finally adding some much needed support for the desktop applications.
:)

Source code generator

2007-04-20T18:34:00.001+04:00

Recently I had to write some code in Delphi .NET . Instead of using 'getters' and 'setters' like in java using properties is preferred. But writing the properties by hand is very painful.. Imagine having to write all the getters and setters in java by hand and your IDE ( I preferably use Eclipse ) not generate it. So I decided to write a code generator.

The first decision I had to make was which language to use. I can code in Java, C# and Delphi. I did not find any feature present in any of the languages that would make them preferable for the job, so I used Java since I am much more comfortable using this language.

The I had to decide what would be the input and output.

Input would be like :-

 // Make these properties!!!!!
 id : integer; // the id

 //blah blah comment
 id2 : integer;
 // so whats up

 line_code : string;
 rate : integer;

Output would be like:-

   //Variables :::::::

    _id  :  integer;
    _id2  :  integer;
    _line_code  :  string;
    _rate  :  integer;


    //Properties :::::::
    Property id : integer
         read _id
         write _id ;
    Property id2 : integer
         read _id2
         write _id2 ;
    Property line_code : string
         read _line_code
         write _line_code ;
    Property rate : integer
         read _rate
         write _rate ;

I also decided the coolest way to get the input and write the output was the clipboard. So I had to just copy the text into the clipboard and execute the java program. This would write the output into the clipboard.

Now the implementation specific details begin.
The first thing I needed to do was to remove the comments. Also what was needed was to get two lists, one containing the variable names and the other containing the variable types.

And then output it in any way wanted... My complete code is given below..


import java.awt.Toolkit;
import java.awt.datatransfer.Clipboard;
import java.awt.datatransfer.DataFlavor;
import java.awt.datatransfer.StringSelection;
import java.awt.datatransfer.Transferable;
import java.awt.datatransfer.UnsupportedFlavorException;
import java.io.IOException;
import java.util.ArrayList;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class SashClipboard
{

    public static final String NEWLINE = "\n";

    public static String TAB = "    ";

    public static void main(String[] args) throws UnsupportedFlavorException,
                                                                       IOException
    {

        //gets data from clipboard
        String data = copyFromClipboard();
        
        // System.out.println(data);

        //get the diff lies
        String[] lines = data.split(NEWLINE);
        
        // System.out.println(Arrays.asList(lines));
        //remove comments '//' and if two stmts exist on same line 
        ArrayList linesList = removeSingleLineCommentAndMultiStmt(lines);

        // System.out.println(linesList);

        ArrayList varNameList = new ArrayList();
        ArrayList varTypeList = new ArrayList();

        getVarAndType(linesList, varNameList, varTypeList);

        String output = createOutput(varNameList, varTypeList);

        System.out.println(output);
        
        //copy data to clipboard
        copyToClipboard(output);
    }

    private static void copyToClipboard(String output)
    {
        StringSelection ss = new StringSelection(output);
        Clipboard cb = Toolkit.getDefaultToolkit().getSystemClipboard();
        cb.setContents(ss, null);
    }

    public static String copyFromClipboard() throws UnsupportedFlavorException, 
                                                                        IOException
    {
        Clipboard cb = Toolkit.getDefaultToolkit().getSystemClipboard();
        Transferable contents = cb.getContents(null);
        Object transferData = contents.getTransferData(DataFlavor.stringFlavor);
        String data = transferData.toString();
        return data;
    }

    private static String createOutput(ArrayList varNameList,
            ArrayList varTypeList)
    {
        StringBuilder output = new StringBuilder();

        output.append("//Variables :::::::\n\n");
        for (int i = 0; i < varNameList.size(); i++)
        {
            output.append(TAB + "_" + varNameList.get(i) + " : "
                    + varTypeList.get(i) + ";" + NEWLINE);
        }

        output.append("\n\n//Properties :::::::\n");

        for (int i = 0; i < varNameList.size(); i++)
        {
            output.append(TAB + "Property " + varNameList.get(i) + ":"
                    + varTypeList.get(i) + NEWLINE + TAB + TAB + " read " + "_"
                    + varNameList.get(i) + NEWLINE + TAB + TAB + " write "
                    + "_" + varNameList.get(i) + ";" + NEWLINE);
        }
        return output.toString();
    }

    private static void getVarAndType(ArrayList linesList,
            ArrayList varNameList, ArrayList varTypeList)
    {
        for (int i = 0; i < linesList.size(); i++)
        {
            String line = linesList.get(i);
            String[] colonSeperated = line.split(":");
            if (colonSeperated.length != 2)
            {
                System.out.println("Something wrong " + line);
                continue;
            }

            String[] commaSeperated = colonSeperated[0].split(",");

            for (String var : commaSeperated)
            {
                varNameList.add(var);
                varTypeList.add(colonSeperated[1]);
            }
        }
    }

    /**
     * Remove comments '//' and if two stmts exist on same line
     * e.g a: integer; b:string;
     * 
     * if input on a line is
     * a:integer; b:integer; //to do something
     * 
     * it will give two lines i.e
     * a:integer; 
     * b:integer
     * 
     * @param lines multi lines
     * @return a list containg different lines 
     *  and without single line comments
     */
    private static ArrayList removeSingleLineCommentAndMultiStmt(
            String[] lines)
    {
        ArrayList linesList = new ArrayList();
        for (int i = 0; i < lines.length; i++)
        {
            String[] comment = lines[i].split("//");

            String[] multiStmt = comment[0].split(";");
            for (String str : multiStmt)
            {
                if (!str.trim().equals(""))
                {
                    linesList.add(str.trim());
                }
            }
        }
        return linesList;
    }
}

It was not just the fact that I code generate the properties and save time, I also loved writing this code..

I think the code is self explanatory. If any doubts please do post your doubts.

Java accesibility hack

2007-03-27T18:03:00.000+04:00

Invoking a private method/variable using reflection in java is very simple. In the example I invoke the private methodA of the class.


public class A
{
    private void methodA()
    {
        System.out.println("methodA");
    }
}

This is pretty simple. But can we achieve this by setting setAccessible(true) for the Method.


public class B
{
    public static void main(String[] args) throws Exception
    {
        A a = new A();
        Method method = A.class.getDeclaredMethod("methodA");
        method.setAccessible(true);
        method.invoke(a,new Object[]{});
    }
}

And the result is that methodA is printed on the console.

Now can we achieve this without the use of reflection? Yes we can and thats the java hack. I'll
explain how...

First write the class A, but mark the methodA as public. Then create a class B as


public class B
{
    public static void main(String[] args) throws Exception
    {
        A a = new A();
        a.methodA();
    }
}

Compile class A and class B.
javac A
javac B

Run class B.
java B

The output is methodA as expected.

But where is the hack?
Now it comes..

Change the class A and change methodA as private again. Compile class A again only.
javac A

Do not try to compile class B, it will result in an comilation error. Now run B
java B

The output is not an Runtime error, but is methodA.

You can decompile using any java decompiler and see that methodA is still private but still B can invoke it. The probable reason for this is that accessiblity is a compile time check not a runtime one. At runtime it cannot be determined whether it is invoked using this hack or reflection. I cannot think of any other reason this is not done.

The role of Representational State Transfer in Web Based computing

2007-03-14T12:07:00.000+04:00

A brief introduction to Representational State Transfer (REST)

REpresentational State Transfer or REST is an architectural style consisting of the set of constraints applied to elements within the network architecture. By examining the impact of each constraint as it is added to the evolving style, the properties induced by the Web’s constraints were identified.

But what does Representational State Transfer mean?

Representation
Resources are first-class objects; “object” is a subtype of “resource”. Resources are retrieved not as character strings or Blobs but as complete representations
A web page is a representation of a resource.

State means application/session state; is maintained as part of the content transferred from client to server back to client, thus any server can potentially continue transaction from the point where it had left off.

Transfer of State
Connectors (client, server, cache, resolver, tunnel) are unrelated to sessions and is an abstract mechanism which mediates communication, coordination, or cooperation among components. State is maintained by being transferred from clients to servers and back to clients.

REST is centered around two design principles:

Resource as URLs. A resource is something like a “business entity” which we wish to expose as a part of an API. Each resource is represented as a unique URL.

Operations as HTTP method. REST leverages the existing HTTP methods, particularly GET, POST, PUT and DELETE.

REST provides a set of architectural constraints that, when applied as a whole, emphasizes scalability of component interactions, generality of interfaces, independent deployment of components, and intermediary components to reduce interaction latency, enforce security, and encapsulate legacy systems.

Role of REST in web based applications

REST's "client-stateless-server" constraint forbids session state on the server. Designing within this constraint promotes the system properties of visibility, reliability, and scalability. But the server-side Web applications wish to provide a great deal of personalization to a single user, so they must choose between two designs. The first is to send a massive amount of state information with each client request, so that each request is context-complete and the server can remain stateless. A second simpler solution favored by application developers and middleware vendors alike is to send a simple user identity token and associate this token with a "user session" object on the server side. The second design directly violates the client-stateless-server constraint. It certainly enables desirable user functionality (especially personalization), but it places tremendous strain on the architecture.

The REST constraints provide scalability; say in a clustered environment if the state of client is maintained at the server side then the state has to be replicated across the servers which will be a huge performance overhead.

An AJAX application does not require full page refresh. The fact that Ajax lets us interact with a server without a full refresh puts the option of a stateful client back on the table. This has profound implications for the architectural possibilities for dynamic immersive Web applications: Because application resource and data resource binding is shifted to the client side, these applications can enjoy the best of both worlds the dynamic, personalized user experience we expect of immersive Web applications and the simple, scalable architecture we expect from RESTful applications.

Because the Ajax application engine is just a file, it's also proxyable. On a large corporate intranet, only a single employee might ever download a particular version of the application's Ajax engine, and everyone else just picks up a cached copy from the intranet gateway. So with regard to application resources, a well-designed Ajax application engine aligns with REST principles and provides significant scalability advantages versus server-side Web applications.

RESTful Web Services

The problem of interoperability is very fundamental and deals with what we call the “accidental architecture” where an organization consists of several different technologies and has to make them interoperable. The simpler the solution less will be the overhead in making such systems interoperable. The fundamental problem the web services world solves is interoperability. The question is whether to use SOAP based Web Services or REST web services.

Despite the lack of vendor support, Representational State Transfer (REST) web services have been very successful. For example, Amazon's web services have both SOAP and REST interfaces, and 85% of the usage is on the REST interface. Compared with other styles of web services, REST is easy to implement and maintain.

The SOAP based web services are standardized and standards have been published for the SOAP based web services. They can be used over several transports layer protocols like HTTP, JMS and FTP. REST makes the web service more WEB based. It uses only the HTTP protocol and thus can’t be used with JMS or FTP.

HTTP is not a transport protocol. SOAP treats HTTP as a transport protocol like TCP. HTTP only exists to carry bits, namely SOAP messages, with or without a method name. HTTP is an application protocol; it doesn't send bits, it transfers representational state.

REST isn't the best solution for every Web service. Data that needs to be secure should not be sent as parameters in URIs. If large amounts of data are used in the URI it can become very difficult to maintain and in extreme cases it can even go out of bounds. In such cases SOAP is a preferable solution. But it's important to try REST first and resort to SOAP only when necessary. This helps keep application development simple and accessible.

Fortunately, the REST philosophy is catching on with developers of Web services. The latest version of the SOAP specification now allows certain types services to be exposed through URIs (although the response is still a SOAP message). Similarly, users of Microsoft .NET platform can publish services so that they use GET requests. All this signifies a shift in thinking about how best to interface Web services.

Developers need to understand that sending and receiving a SOAP message isn't always the best way for applications to communicate. Sometimes a simple REST interface and a plain text response does the trick—and saves time and resources in the process.

Should we use REST ?

Arguments against non-REST designs

They break Web architecture, particularly caching. They don't scale well. They have significantly higher coordination costs

Scaling

What kind of scaling is most important is application-specific. Not all apps are Hotmail, Google, or Amazon Integration between two corporate apps has different scaling and availability needs
The right approach to one isn't necessarily the right approach to the other

The REST argument

A service offered in a REST style will inherently be easier to consume than some complex API:
• Lower learning curve for the consumer
• Lower support overhead for the producer

What if REST is not enough?

What happens when you need application semantics that don't fit into the GET / PUT / POST / DELETE generic interfaces and representational state model?

Nearly all the applications can fit into the GET / PUT / POST / DELETE resources / representations model. These interfaces are sufficiently general. Other interfaces considered harmful because they increase the costs of consuming particular services.

Asynchronous operations

There is no complete solution for asynchronous operations available for REST.
Notifications can be sent back as POSTs (the client can implement a trivial HTTP server). Piggyback them on the responses to later requests.

Transactions

The client is ultimately responsible for maintaining the transactions. Other designs for REST aren't much better.

The beginning

The use of REST is on the rise. The ease of use and scalability of the REST based applications stand apart. REST is the beginning of the next generation of Web based computing.

Running a class not in the classpath

2007-03-02T19:26:00.000+04:00

This piece of code displays the invocation of a class not in the classpath of the application. This can be used to write utilities.

Say I have a jar file present on my system in say a directory "c:/MyUtils" (I have used windows locations, no reason why this should not work on any other OS) named SystemUtils.jar which has a main class in a class com.sash.DoIt. This jar is not in my classpath and I need to execute it. The following piece of code executes the main method.

 File file = new File("c:\\MyUtils\\SystemUtils.jar");
 ClassLoader cl = new URLClassLoader(new URL[] { file.toURI().toURL()});
 Class cls = cl.loadClass("com.sash.DoIt");
 Method mainMethod = cls.getDeclaredMethod("main", new Class[]{String[].class});
 mainMethod.invoke(null, new Object[]{null});

Very interesting stuff. Never used it but waiting for the first oppertunity to use this in one of my projects :).

Mustang released

2007-02-27T08:08:00.000+04:00

The announcement made here is pretty old. It’s been in beta phase for some time and the final release has also been made some time back. Here I visit some of the new features in Mustang. I have been using Eclipse as a preferred java editor for a long time, though I've tried NetBeans, JDeveloper etc. Eclipse 3.2 has support for Mustang.
The feature I would talk about is the Scripting feature. This feature can be used to execute scripts in various languages. Mustang ships with the Rhino scripting engine for JavaScript. Its pretty interesting. I tried out various features of the Rhino Engine.

The major questions which I wanted an answer to were:
1. How to share data between Java and JavaScript?
2. Where is the utility of such scripting?
3. Can I add different Scripting engines?

The answer to the first question you can find in the example below. The sending of data from Java to Javascript was very simple and it even JavaScript recognized objects from user created classes (Java Car class has an object on which getName method could be invoked by the JavaScript). The return value also works. The List created in Java and modified in JS reflected in Java again. Awesome! Totally awesome!
Now the reasons given to use scripting language was what I am not convinced with.(Scripting for the Java Platform --> Reasons to Use a Scripting Language). I think the reasons to use scripting would be more specific, like using existing test scripts in some scripting language.
We can add different scripting engines according to specs.

Sample code explaining most of the concepts:-

import java.lang.reflect.Method;

import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;

import javax.script.Invocable;
import javax.script.ScriptEngine;
import javax.script.ScriptEngineManager;
import javax.script.ScriptException;

public class TheScript
{
    private final static String METHOD_HELLO = "function helloWorld(){"
            + " println('Hello, world!'); " + " return 's';" + "}";

    private final static String METHOD_HELLO_NAME = "function helloName(){"
            + " println('Hello,'+ name.getName() +' !'); " + " return 's';"
            + "}";

    private final static String METHOD_HELLO_LIST = "function helloList(){"
            + "var x;" + "var names = namesListKey.toArray(); "
            + " for(x in names)" + " {" + " println('Hello,'+ names[x] +' !');"
            + " }" + " namesListKey.add(\"king\");" + "}";

    private final static String THE_JAVA_SCRIPT = METHOD_HELLO
            + METHOD_HELLO_NAME + METHOD_HELLO_LIST;

    public static void main(String[] args) throws ScriptException,
            NoSuchMethodException
    {
        ScriptEngineManager mgr = new ScriptEngineManager();
        ScriptEngine jsEngine = mgr.getEngineByName("JavaScript");
        jsEngine.eval(TheScript.THE_JAVA_SCRIPT);

        // simple java method

        // invoke method METHOD_HELLO
        Invocable invocableEngine = (Invocable) jsEngine;
        invocableEngine.invokeFunction("helloWorld", (Object[]) null);

        System.out.println("---------------------------------");
        // simple java method where java objects are used by javascript

        // The parameter type is user defined object
        // which is converted into a javascript object
        // i.e I can use getName method of Car class
        Car car = new Car();
        car.setName("Sash");

        // invoke method METHOD_NAME
        jsEngine.put("name", car);
        Object invokeFunction = invocableEngine.invokeFunction("helloName",
                (Object[]) null);

        // the return type should have been mapped by script provider
        // Mozilla Rhino provides the mapping for number and string types
        System.out.println(" --------------------------------- "
                + invokeFunction + " ----");

        List namesList = new ArrayList(Arrays.asList(new String[] { "sash",
                "siva", "baldie" }));
        jsEngine.put("namesListKey", namesList);
        invocableEngine.invokeFunction("helloList", (Object[]) null);

        System.out.println(namesList);
        System.out.println("---------------------------------");

    }

    public static class Car
    {
        private String name;

        public String getName()
        {
            return name;
        }

        public void setName(String name)
        {
            this.name = name;
        }

    }
}

References:

http://www.mozilla.org/rhino/ScriptingJava.html
http://java.sun.com/developer/technicalArticles/J2SE/Desktop/scripting/

Invoker class

2007-01-11T15:05:00.000+04:00

For a long time I've been thinking how to write code to get the name of the calling class, some days back I was reading an article which arose my curiosity again. I was successful doing it in two ways.

1. Stacktrace method

One of the hints which I got was our exception class, whenever an exception is thrown we get the whole stack strace, which includes the invoking classes.

Throwable t = new Throwable(); 
StackTraceElement callerClass = t.getStackTrace()[1]; 
System.out.println(callerClass.getClassName());

Gets the class name :)

2. Security Manager method


class SM extends SecurityManager {     
    @Override  
    public Class[] getClassContext() {   
        return super.getClassContext();  
    } 
}


SM sm = new SM(); 
Class[] classContext = sm.getClassContext(); 
System.out.println(classContext[2].getName());

Bingo, got the class name. getClassContext() is a protected method, to use it we need to extend security manager or use it as I've done above.

XML hints

2006-11-26T16:01:00.000+04:00

These are some things needed to know about xml.....

Fact 1:
Comments should not have '--' in between.. This is a very common knowledge but what is not so common knowledge is that '--->' is an invalid end of comment.
ref:- http://www.w3.org/TR/2004/REC-xml-20040204/#sec-comments

Fact 2:
Do you know about dtd entities?

<!ENTITY copyright SYSTEM "http://www.w3schools.com/dtd/entities.dtd">

You define a dtd entity and then it can be used in the dtd anywhere, its like a constant being declared.

It can be used in xml as:-
<author>&writer;©right;</author>
ref:- http://www.w3schools.com/dtd/dtd_entities.asp

Fact 3
Now whats the difference between a/b and a[b] in XPath?

a/b selects the node b which is a child of node a.
a[b] selects node a which has a child b.

The difference is very subtile but the node selected is different.

Fact 4
What does the translate function in XSLT do:-
translate("abcdef--","ab-","AB")

will result in:-
ABcdef

ref:- http://www.w3.org/TR/xpath#section-String-Functions

Fact 5

Stylesheet Inclusion
It is an error if a stylesheet directly or indirectly includes itself.

Including a stylesheet multiple times can cause errors because of duplicate definitions. Such multiple inclusions are less obvious when they are indirect. For example, if stylesheet B includes stylesheet A, stylesheet C includes stylesheet A, and stylesheet D includes both stylesheet B and stylesheet C, then A will be included indirectly by D twice. If all of B, C and D are used as independent stylesheets, then the error can be avoided by separating everything in B other than the inclusion of A into a separate stylesheet B' and changing B to contain just inclusions of B' and A, similarly for C, and then changing D to include A, B', C'.

This can be tested by having templates of the same name in all the stylesheets and play around with importing the style sheets. Thus u'll notice
1. the curent style sheet takes the precidence
2. if more than one stylesheets are included then the last one imported takes precidence.

ref:- http://www.w3.org/TR/xslt#import

The start

2006-11-26T10:14:00.000+04:00

I created the blog to talk about the technologies and other things I work in. I have worked on some technologies and languages that include EJB, java, Delphi, Struts, Hibernate, Spring, Ajax, Web Services, SOA. I have a little understanding on C#. Right now I am working on SOA and related technologies, thus most of the blogs I put will be related to XML, Web Services, BPEL or the ESBs.