SSO : JOSSO VS CAS

JOSSO, CAS and openSSO are famous Java Single Sign-On in the open source world. The following are some comments on JOSSO and CAS.

CAS

• Architecture is simple to install. Security filtering is inside war file.
• Only work with SSL.
• Easily integrate in Spring security.

CAS + Spring Security integration guide


JOSSO
Architecture is hard to deploy. It consists of gateway and agent. Gateway is the project of SSO/login module. Agent need to be installed in all servers for security filtering. Thus, it tights the configuration to server and bunch of xml files in lib folder of tomcat. The security is configure in the server and not within the project. Even thought installation script is provided but it is just for all(agent, gateway,project) in one server. I got no idea how the configuration should be if more than one server is using...

JOSSO + Acegi integration
Look like outdated because have not upgraded to spring security.

Cross Platform Hibernate @Id Sequence setting

Cross platform @Id setting
@SequenceGenerator(name = "SEQ_HRMS_EMP", sequenceName = "SEQ_HRMS_EMP", initialValue = 1, allocationSize = 1)
@GeneratedValue(strategy = GenerationType.AUTO, generator = "SEQ_HRMS_EMP")
@Id
@Column(name = "user_id")
private Integer userId;

Schema export from hibernate

1. MySql
   create table HRMS_EMP (
   user_id integer not null auto_increment,
   
   MySql will ignore the generator = "SEQ_HRMS_EMP" setting because MySql does not have sequence.
2. Postgres
   create sequence SEQ_HRMS_EMP;
   
3. Oracle
   create sequence SEQ_HRMS_EMP;

Fluent Interface Design Pattern in IBatis3

I found the following coding style in ibatis3 tutorial. Look interesting about the coding.

private String selectPersonSql() {
BEGIN(); // Clears ThreadLocal variable
SELECT("P.ID, P.USERNAME, P.PASSWORD, P.FULL_NAME");
SELECT("P.LAST_NAME, P.CREATED_ON, P.UPDATED_ON");
FROM("PERSON P");
FROM("ACCOUNT A");
INNER_JOIN("DEPARTMENT D on D.ID = P.DEPARTMENT_ID");
INNER_JOIN("COMPANY C on D.COMPANY_ID = C.ID");
WHERE("P.ID = A.ID");
WHERE("P.FIRST_NAME like ?");
OR();
WHERE("P.LAST_NAME like ?");
GROUP_BY("P.ID");
HAVING("P.LAST_NAME like ?");
OR();
HAVING("P.FIRST_NAME like ?");
ORDER_BY("P.ID");
ORDER_BY("P.FULL_NAME");
return SQL();
}

IceSoft Name Card

Load Balance by using mod_jk + apache server2.0

1)Add following code to C:/Program Files/Apache Group/Apache2/conf/httpd.conf

# Include mod_jk configuration file

Include "C:/Program Files/Apache Group/Apache2/mod_jk/mod_jk.conf"

2)Create mod_jk.conf to C:/Program Files/Apache Group/Apache2/mod_jk/mod_jk.conf

# Load mod_jk module

# Specify the filename of the mod_jk lib

LoadModule jk_module "C:/Program Files/Apache Group/Apache2/mod_jk/mod_jk-1.2.28-httpd-2.0.52.so"

# Where to find workers.properties

JkWorkersFile "C:/Program Files/Apache Group/Apache2/mod_jk/workers.properties"

# Where to put jk logs

JkLogFile "C:\Program Files\Apache Group\Apache2\mod_jk/mod_jk.log"

JkLogLevel info

JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "

JkOptions +ForwardKeySize +ForwardURICompat -ForwardDirectories

JkRequestLogFormat "%w %V %T"

#Mount your webapps eg WebApplication1 using JkMount

# Add shared memory.

# This directive is present with 1.2.10 and

# later versions of mod_jk, and is needed for

# for load balancing to work properly

JkShmFile /var/log/apache2/jk.shm

JkMount /* router

<Location /router/>

JkMount router

Order deny,allow

Deny from all

Allow from 127.0.0.1

</Location>

3) Create worker.properties on C:\Program Files\Apache Group\Apache2\mod_jk\worker.properties

# The advanced router LB worker

worker.list=router

# Define a worker using ajp13

worker.worker1.port=8009

worker.worker1.host=127.0.0.1

worker.worker1.type=ajp13

worker.worker1.lbfactor=1

# Define preferred failover node for worker1

worker.worker1.redirect=worker2

# Define another worker using ajp13

worker.worker2.port=8009

worker.worker2.host=127.0.0.1

worker.worker2.type=ajp13

worker.worker2.lbfactor=1

# Disable worker2 for all requests except failover

worker.worker2.activation=disabled

# Define the LB worker

worker.router.type=lb

worker.router.balance_workers=worker1,worker2

4) Download iso mod_jk-1.2.28-httpd-2.0.52.so from http://www.apache.org/dist/tomcat/tomcat-connectors/jk/binaries/win32/jk-1.2.28/

to C:\Program Files\Apache Group\Apache2\mod_jk\

5) For sticky session

Edit tomcat's server.xml for all tomcat

Comment <!-- <Engine name="Catalina" defaultHost="localhost"> -->

Uncomment <Engine name="Standalone" defaultHost="localhost" jvmRoute="worker1">

References

Step by step - http://www.devside.net/guides/windows/tomcat

Help for worker.properties

http://tomcat.apache.org/connectors-doc/reference/workers.html

http://tomcat.apache.org/connectors-doc/generic_howto/loadbalancers.html

JSF1 RichFaces Performance Tuning

1) JSF components tree state takes big enough memory. In the server-side
state saving ( default JSF behavior ) these objects are stored in the
session. For a many concurrent user connections every user gets own
session object. Possible solution - switch to the client-side state saving.
<context-param>
<param-name>javax.faces.STATE_SAVING_METHOD</param-name>
<param-value>client</param-value>
</context-param>

Other possible solution is Facelets behavior that allows to build view
before request processing instead of state saving, but that solution has
sometimes unpredictable side effects. Use web.xml init parameter
together with the <f:view transient="true" > attribute.
<context-param>
<param-name>facelets.BUILD_BEFORE_RESTORE</param-name>
<param-value>true</param-value>
</context-param>
As an intermediate solution, it is makes sense to create custom FaceletsViewHandler subclass with special state processing for a some pages like menus which does not depends for a saved state. That custom handler could call buildView method instead of real restoreView procedure for a such pages.
2) Facelets library in the "debug" mode stores information about
components and beans up to 5 times for an every user. To disable this mode:
<context-param>
<param-name>facelets.DEVELOPMENT</param-name>
<param-value>false</param-value>
</context-param>

3) Most filters use buffering for request processing. According to the
profile information, these buffers took big enough memory in the
application. I see a buffer-related parameter in the RichFaces Ajax filter:
<init-param>
<param-name>maxRequestSize</param-name>
<param-value>100000</param-value>
</init-param>
For a production server, it makes sense to reduce value to a real page
size or remove that parameter at all.
4) TIDY xml filter is DOM-based, thus it requires a lot of memory. It
would be better to use more optimized "NONE" or "NEKO" one :
<context-param>
<param-name>org.ajax4jsf.xmlparser.ORDER</param-name>
<param-value>NONE</param-value>
</context-param>

JSF Thing to cater for if you are JSF Developer

It is because JSF is component base(not simple as MVC direct request to action in controller layer).

Problem of coding style

1) DB query inside getter method of backing bean.

public List getUserRole(){
return userRoleDao.queryAllUserRole();
}

Issue : Getter may be call in restore view or apply request value or render response phase

• Table component, it wil cause the data being query 2 times.
• inputText/radio etc. component, it will check the previous submitted value store(JSF will store previous submitted value automatically) inside the inputText. If it is null, it will call the getter in backing bean to retrieve the value.

Following was the log.
[ INFO] 29-07-09 11:10:34 : BEFORE RESTORE_VIEW(1)
[ INFO] 29-07-09 11:10:34 : AFTER RESTORE_VIEW(1)
[ INFO] 29-07-09 11:10:34 : BEFORE APPLY_REQUEST_VALUES(2) Hibernate: select this_.role_name as ...
[ INFO] 29-07-09 11:10:34 : AFTER APPLY_REQUEST_VALUES(2)
[ INFO] 29-07-09 11:10:34 : BEFORE PROCESS_VALIDATIONS(3)
[ INFO] 29-07-09 11:10:34 : AFTER PROCESS_VALIDATIONS(3)
[ INFO] 29-07-09 11:10:34 : BEFORE UPDATE_MODEL_VALUES(4)
[ INFO] 29-07-09 11:10:34 : AFTER UPDATE_MODEL_VALUES(4)
[ INFO] 29-07-09 11:10:34 : BEFORE INVOKE_APPLICATION(5)
[ INFO] 29-07-09 11:10:34 : AFTER INVOKE_APPLICATION(5)
[ INFO] 29-07-09 11:10:34 : BEFORE RENDER_RESPONSE(6) Hibernate: select this_.role_name ...
[ INFO] 29-07-09 11:10:35 : AFTER RENDER_RESPONSE(6)

Solution : Only query DB when it is in render response phase.

public List getUserRole(){
if (FacesContext.getCurrentInstance().getRenderResponse())
return userRoleDao.queryAllUserRole();
else
return null;
}

or

public List getUserRole(){
if ( userRoleList!=null)
userRoleList = userRoleDao.queryAllUserRole();

return userRoleList;
}

JSF 2 going to have MVC lifecycle!!!