Skip to main content

Home/ SoftwareEngineering/ Group items tagged Messages

Rss Feed Group items tagged

kuni katsuya

Threats - salesforce.com - 0 views

  • Security Best Practices Webinar for All Salesforce.com Customers
  • Designate a security contact within your organization so that salesforce.com can more effectively communicate with you
  • Consider using other two-factor authentication techniques
  • ...14 more annotations...
  • activate IP range restrictions
  • Implement IP Restrictions in Salesforce.com
  • Two-Factor Authentication
  • second-level authorization, including requiring secure IT tokens
  • does not protect against “man-in-the-middle” attacks, where messages are intercepted
  • applications that may be integrated with salesforce.com are not protected by two-factor authentication
  • Strengthen Password Policies
    • kuni katsuya
       
      salesforce.com password policies: - password expiry period - password history (reuse) enforcement - minimum password length - password complexity requirement - forgotten password hint question requirement
  • Require Secure Sessions
  • mandating that all sessions are encrypted and secure
  • Decrease Session Timeout Thresholds
  • Identify a Primary Security Contact
  • identify a person in your company who is responsible for application security
  • should have a thorough understanding of your security policies
  • single point of contact for salesforce.com
kuni katsuya

UML Profile Diagrams Examples - 0 views

  • Java EJB 3.0 UML Profile
  • [UML Profile for Java and EJB. Version 1.0]
  • Java 1.3, EJB 1.1 and most likely UML 1.4, so it could be only of some interest
    • kuni katsuya
       
      ancient java and ejb versions!
  • ...8 more annotations...
  • simplified and unofficial UML Profile for EJB 3.0 with support for
  • session
  • entity
  • message-driven
  • Enterprise JavaBeans
  • stateful
  • stateless
  • session beans
kuni katsuya

7. Logging - Confluence - 0 views

  • Granite Data Services uses log4j
  • If you need other logging implementation support, you may extend the org.granite.logging.Logger abstract class and register your custom logger with the org.granite.logger.impl system property:
    • kuni katsuya
       
      eg. logback implementation
  • <category name="org.granite.messaging.webapp.AMFMessageServlet"> <priority value="DEBUG" /> </category>
  • ...2 more annotations...
  • -Dorg.granite.logger.impl=path.to.my.CustomLogger
  • 7. Logging
  •  
    how to enable graniteds debug logging
kuni katsuya

Dependency Injection in Java EE 6 - Part 1 - 0 views

  • Dependency Injection in Java EE 6 - Part 1
  • high-level look at CDI, see how it fits with Java EE overall and discuss basic dependency management as well as scoping.
  • CDI is designed to solve
  • ...21 more annotations...
  • highly type-safe
  • consistent
  • portable
  • CDI enhances the Java EE programming model in two more important ways
  • allows you to use EJBs directly as JSF backing beans
  • CDI allows you to manage the scope, state, life-cycle and context for objects in a much more declarative fashion, rather than the programmatic way
  • CDI has no component model of its own
  • set of services that are consumed by Java EE components such as managed beans, Servlets and EJBs.
  • well-defined create/destroy life-cycle that you can get callbacks for via the @PostConstruct and @PreDestroy annotations.
  • Managed beans
  • @ManagedBean
  • annotation
  • CDI also integrates with JSF via EL bean name resolution
  • CDI does not directly support business component services such as transactions, security, remoting, messaging
  • Dependency Injection for Java
  • JSR 330
  • JSR 330 defines a minimalistic API for dependency injection solutions and is primarily geared towards non-Java EE environments.
  • Figure 1 shows how CDI fits with the major APIs in the Java EE platform.
  • none of this uses string names that can be mistyped and all the code is in Java and so is checked at compile time
  • Qualifiers
  • are additional pieces of meta-data that narrow down a particular class when more than one candidate for injection exists
kuni katsuya

5. Exception Handling - Confluence - 0 views

  • Exception Handling
  • 5. Exception Handling
  • server exceptions
  • ...41 more annotations...
  • can be handled on the
  • client-side
  • by defining a
  • fault callback
  • each remote call
  • very tedious
  • possible to define common handlers for particular fault codes on the client-side, and exception converters on the server-side, to convert server exceptions to common fault codes
  • define an
  • ExceptionConverter
  • class
  • Converter
  • ExceptionConverter
  • accepts(Throwable t, Throwable finalException)
  • convert( Throwable t, String detail, Map<String, Object> extendedData)
  • t.getMessage(), detail, t
    • kuni katsuya
       
      * instead of *wrapping* the server-side exception and rethrowing it to the client, ** extract only details relevant to the client (eg. include: human-friendly error message and any helpful parametrized data, exclude: stack traces), ** "wrap" it in a generic ServiceException, which gets "thrown" remotely to the client * client can check ServiceException.getCode() to implement behavior tailored to server-side exception 'type'
  • ENTITY_NOT_FOUND
    • kuni katsuya
       
      ENTITY_NOT_FOUND - 'fault code' understood by client
  • This class will
  • intercept
  • all EntityNotFound exceptions on the server-side, and convert it to a proper ENTITY_NOT_FOUND fault event.
  • exception converter has to be
  • declared on the GDS server config :
  • scan="true" in granite-config.xml
  • META-INF/granite-config.properties
  • in the jar containing the exception converter class
  • granite-config.xml
  • <exception-converters> <exception-converter type="com.package.SomeExceptionConverter"/> </exception-converters>
  • Flex side
  • Handler
  • Handler
  • IExceptionHandler
    • kuni katsuya
       
      **I**ExceptionHandler??? really?  ;)
  • accepts(emsg:ErrorMessage)
  • handle(context:BaseContext, emsg:ErrorMessage)
  • register it as an exception handler for the
  • Tide context
  • in a static initializer block to be sure it is
  • registered before anything else happens.
  • addExceptionHandler(EntityNotFoundExceptionHandler);
  • ExceptionConverter
  • 5. Exception Handling
  • 5. Exception Handling
  • 5. Exception Handling
kuni katsuya

JBoss Developer Framework - 0 views

  • jta-crash-rec Crash Recovery, JTA Uses Java Transaction API and JBoss Transactions to demonstrate recovery of a crashed transaction
  • jts-distributed-crash-rec JTS Demonstrates recovery of distributed crashed components
  • cdi-injection CDI Demonstrates the use of CDI 1.0 Injection and Qualifiers with JSF as the front-end client.
  • ...13 more annotations...
  • bean-validation JPA, Bean Validation Shows how to use Arquillian to test Bean Validation
  • ejb-security Security, EJB Shows how to use Java EE Declarative Security to Control Access to EJB 3
  • payment-cdi-event CDI Demonstrates how to use CDI 1.0 Events
  • richfaces-validation RichFaces Demonstrates RichFaces and bean validation
  • ejb-in-war JSF, WAR, EJB Packages an EJB JAR in a WAR
  • greeter EJB, JPA, JSF, JTA, CDI Demonstrates the use of CDI 1.0, JPA 2.0, JTA 1.1, EJB 3.1 and JSF 2.0
  • helloworld-mdb EJB, MDB, JMS Demonstrates the use of JMS 1.1 and EJB 3.1 Message-Driven Bean
  • helloworld-rs JAX-RS, CDI Demonstrates the use of CDI 1.0 and JAX-RS
  • kitchensink BV, EJB, JAX-RS, JPA, JPA, JSF, CDI
  • servlet-async CDI, EJB, Servlet Demonstrates CDI, plus asynchronous Servlets and EJBs
  • servlet-security Security, Servlet Demonstrates how to use Java EE declarative security to control access to Servlet 3
  • shopping-cart EJB Demonstrates a stateful session bean
  • tasks Arquillian, JPA Demonstrates testing JPA using Arquillian
kuni katsuya

IRC FAQ - Eclipsepedia - 0 views

  • Where are Eclipse preferences stored?
  • Preferences are stored in various places (this applies to Eclipse 3.1)
  • for each installation (but this may vary for multi-user installations), in files stored in <eclipse_home>/eclipse/configuration/.settings/
  • ...18 more annotations...
  • for each workspace, in files stored in <workspace>/.metadata/.plugin/org.eclipse.core.runtime/.settings
  • for each project --for project-level settings -- in files stored in a .settings sub-directory of your project folder
  • Is there an UML editor for Eclipse? An Eclipse Modelling project-based UML editor can be installed from the Eclipse update site "Modelling > UML2 Tools SDK". See Creating UML 2 diagrams with Eclipse UML2 Tools - Tutorial for an introduction.
  • How do I debug Eclipse? How can I see what plug-ins are being started? Why aren't the plug-ins I installed showing up in the UI? How do I start the OSGi console?
  • Debugging OSGi Bundle Loading Issues There are a few flags you can pass to Eclipse on the commandline or in your eclipse.ini file that might help: -consolelog - log everything in workspace/.metadata/.log to the console where you launched Eclipse as well -debug - more verbose console output -console - start the Equinox OSGi console to interact with OSGi directly -noexit - when Eclipse closes, keep the OSGi console running until you type 'exit' or hit CTRL-C so you can keep debugging See Where Is My Bundle? for an overview of how to use the OSGi console for diagnosing problems.
  • Debugging Eclipse Using Eclipse You can also debug an Eclipse instance from another instance through remote debugging: Start the instance to be debugged with "-vmargs -Xdebug -agentlib:jdwp=transport=dt_socket,server=y,address=8000". You should see a message like "Listening for transport dt_socket at address: 8000" Open Run → Debug Configurations... and create a Remote Java Application configuration with connection type "Socket Attach" and connecting to the client at port 8000. Set the project to a bundle project with the right dependencies for the bundles that you are trying to debug. Launch the configuration. The JDWP agent supports other useful arguments, like "suspend=n" so that the process does not suspend. For more details, see Oracle's Java Debug Wire Protocol (JDWP) connection docs.
  • I just installed Eclipse on my 64-bit system, but it does not start. What is the problem? Make sure that you have downloaded the 64-bit version of Eclipse (it should have x86_64 somewhere in its name) and have installed a 64-bit JVM. Likewise, if you run a 32-bit JVM, then you should use the 32-bit version of Eclipse.
  • When I start Eclipse it says "Workspace in use or cannot be created, choose a different one.", what should I do? There are a couple of things you can try. Delete the workspace/.metadata/.lock file. Check your running processes to make sure there aren't any remaining Java or Eclipse processes running. When in doubt, restart your computer. :) Try starting Eclipse on a different workspace (from the workspace selection dialog, or by using a command line argument like -data /home/user/tmp-workspace), then switch back to your original workspace.
  • How do I uninstall a plug-in? You can view your list of installed software by checking your installation details from about dialog. Help > About > Installation Details
  • I'm having memory, heap, or permgen problems, what can I do? FAQ How do I increase the heap size available to Eclipse? FAQ How do I increase the permgen size available to Eclipse?
  • Eclipse seems to be hanging on startup. How can I find out why? If none of the solutions outlined in this section reveal the problem, then you can try debugging an Eclipse instance as a debug target from another Eclipse instance. This is surprisingly easy: Start Eclipse in a "new" blank workspace (e.g., C:\TEMP\WS, or /tmp) Create a new Debug configuration: Run -> Debug Configurations; then click on "Eclipse Applications" and select the New Launch Configuration. If you believe it's something about a particular workspace, then set the workspace to your normal workspace. If you believe the hang is caused by a particular plugin, disable the plugin and verify. Launch and then see. Using this approach, you can break with the debugger to see where hangs are occurring. You can also change the selection of plugins that the instance is launched with.
  • I was working on a project and doing something or other does not work. Where should I start? Try refreshing your projects. Try cleaning your your projects using the menu item Project/Clean to trigger a rebuild. Try closing/reopening your projects. Try restarting Eclipse.
  • 4.2 Where are Eclipse's log files located?
  • Where are Eclipse's log files located? <workspace>/.metadata/.log You can view this workspace log as a view if you have PDE installed on your computer (which you would if you have downloaded the Eclipse SDK). You can open that view via Window -> Show View -> Other -> PDE Runtime -> Error Log. <eclipse install>/configuration/<sometimestamp>.log <eclipse install>/configuration/org.eclipse.update/install.log
  • Where are Eclipse preferences stored?
  • Where are Eclipse preferences stored?
  • Where are Eclipse preferences stored?
  • Where are update site bookmarks stored? It is within an XML file called <user_home>/.eclipse/org.eclipse.platform_3.1.2/configuration/org.eclipse.update/bookmarks.xml. Your Eclipse version may vary.
  •  
    Where are Eclipse preferences stored?
kuni katsuya

Cryptography Features | Apache Shiro - 0 views

  • Hash Features
  • Deault interface implementations - Shiro provides default Hash (aka Message Digests in the JDK) implementations out-of-the-box, such as MD5, SHA1, SHA-256
  • Built-in Hex and Base64 conversion - Shiro Hash instances can automatically provide Hex and Base-64 encoding of hashed data via their toHex() and toBase64() methods
  • ...1 more annotation...
  • Built-in Salt and repeated hashing support
kuni katsuya

Spring Security - Features - 0 views

  • Domain object instance security: In many applications it's desirable to define Access Control Lists (ACLs) for individual domain object instances. We provide a comprehensive ACL package with features including integer bit masking, permission inheritance (including blocking), an optimized JDBC-backed ACL repository, caching and a pluggable, interface-driven design.
  • OpenID Support: the web's emerging single sign-on standard (supported by Google, IBM, Sun, Yahoo and others) is also supported in Spring Security
  • Easy integration with existing databases: Our implementations have been designed to make it easy to use your existing authentication schema and data (without modification). Of course, you can also provide your own Data Access Object if you wish. Password encoding: Of course, passwords in your authentication repository need not be in plain text. We support both SHA and MD5 encoding, and also pluggable "salt" providers to maximise password security.
  • ...5 more annotations...
  • Caching: Spring Security optionally integrates with Spring's Ehcache factory. This flexibility means your database (or other authentication repository) is not repeatedly queried for authentication information when using Spring Security with stateless applications.
  • Run-as replacement: The system fully supports temporarily replacing the authenticated principal for the duration of the web request or bean invocation. This enables you to build public-facing object tiers with different security configurations than your backend objects.
  • Tag library support: Your JSP files can use our taglib to ensure that protected content like links and messages are only displayed to users holding the appropriate granted authorities. The taglib also fully integrates with Spring Security's ACL services, and obtaining extra information about the logged-in principal.
  • User Provisioning APIs: Support for groups, hierarchical roles and a user management API, which all combine to reduce development time and significantly improve system administration.
  • Enterprise-wide single sign on using CAS 3: Spring Security integrates with JA-SIG's open source Central Authentication Service (CAS)
kuni katsuya

Chapter 3. Project Setup - 0 views

  • The configuration of a GraniteDS project will generally involve the following steps : Add the GraniteDS jars to the WEB-INF/lib folder of the WAR file or the lib folder of the EAR file Add the GraniteDS listener, servlets and filters in the standard WEB-INF/web.xml configuration file Define the internal configuration of GraniteDS in the WEB-INF/granite/granite-config.xml file Define the application configuration of GraniteDS (remoting destinations, messaging topics...) in the WEB-INF/flex/services-config.xml
  • You will always need granite.jar
  • jar for your JPA provider (granite-hibernate.jar for Hibernate)
  • ...11 more annotations...
  • granite-beanvalidation.jar if you want to benefit from the integration with the Bean Validation API
  • configuration file declares 3 differents things
  • Channel endpoint
  • Service factories
  • Service/destinations
  • destinations using this factory will route incoming remote calls to EJB 3
  • endpoint
  • factory 
  • destination
  • channel 
  • factory
kuni katsuya

Chapter 16. Extensibilty - 0 views

  • 16.2. Writing a Security Service
  • login(Object credentials)
  • authorize(AbstractSecurityContext context)
  • ...20 more annotations...
  •  logout() 
  • An implementation of this interface must be thread safe
  • If authorization fails, either because the user is not logged in or because it doesn't have required rights, it must throw an appropriate org.granite.messaging.service.security.SecurityServiceException.
  • Writing a Security Service
  • SecurityService interface
  • nothing to do with a true Flex destination
  • only one instance of this service is used in the entire web-app and will be called by concurrent threads
  • configure
  • login
  • This method is called upon each and every service method call invocations (RemoteObject) or subscribe/publish actions (Consumer/Producer). When used with RemoteObjects, the authorize method is responsible for checking security, calling the service method, and returning the corresponding result.
  • authorize
  • logout
  • handleSecurityException
  • default implementation of this method in AbstractSecurityService is to do nothing
  • security services are not exposed to outside calls
  • configure
  • login
  • authorize
  • logout
  • handleSecurityException
kuni katsuya

Article Series: Migrating Spring Applications to Java EE 6 - Part 1 | How to JBoss - 1 views

  • In fact people still love those books without realizing that the world has changed dramatically ever since
  • The reality check here is to wonder whether the rhetorics set forth by Rod Johnson in his 2003/2004 books are still actual today
  • So if you still care about those books, the best way to show your appreciation is probably to use them as your monitor stand
  • ...21 more annotations...
  • The discussion whether or not to use Spring vs. Java EE for new enterprise Java applications is a no-brainer
  • Why migrate?
  • since then fallen a prey to the hungry minds of Venture Capitalists and finally into the hands of a virtualization company called VMware
  • While the different companies and individuals behind the Spring framework have been doing some work in the JCP their voting behavior on important JSRs is peculiar to say the least
  • outdated ORM solution like JDBC templates
  • some developers completely stopped looking at new developments in the Java EE space and might have lost track of the current state of technology
  • size of the deployment archive
  • fairly standard Java EE 6 application will take up about 100 kilobytes
  • comparable Spring application weighs in at a whopping 30 Megabytes!
  • Lightweight
  • Firing up the latest JBoss AS 7 Application Server from scratch and deploying a full blown Java EE 6 application into the server takes somewhere between two and five seconds on a standard machine. This is in the same league as a Tomcat / Spring combo
  • Dependency injection
  • Java EE 6, the Context and Dependency Injection (CDI) specification was introduced to the Java platform, which has a very powerful contextual DI model adding extensibility of injectable enterprise services
  • Aspect Oriented Programming
  • “AOP Light” and this is exactly what Java EE Interceptors do
  • common pitfall when taking AOP too far is that your code might end up all asymmetric and unreadable. This is due to the fact that the aspect and its implementation are not in the same place. Determining what a piece of code will do at runtime at a glance will be really hard
  • Testing
  • With Arquillian we can get rid of mocking frameworks and test Java EE components in their natural environment
  • Tooling
  • capabilities comparison matrix below to map Spring’s technology to that of Java EE
  • Capability Spring JavaEE Dependency Injection Spring Container CDI Transactions AOP / annotations EJB Web framework Spring Web MVC JSF AOP AspectJ (limited to Spring beans) Interceptors Messaging JMS JMS / CDI Data Access JDBC templates / other ORM / JPA JPA RESTful Web Services Spring Web MVC (3.0) JAX-RS Integration testing Spring Test framework Arquillian *
kuni katsuya

Comparison - 0 views

  • TomEE is a superset of OpenEJB
  • Tomcat
  • TomEE
  • ...5 more annotations...
  • TomEE+
  • OpenEJB
  • Java API for XML Web Services (JAX-WS) Java API for RESTful Web Services (JAX-RS) Java EE Connector Architecture Java Messaging Service (JMS)
  • Java Servlets Java ServerPages (JSP) Java ServerFaces (JSF) Java Transaction API (JTA)
  • Java Persistence API (JPA) Java Contexts and Dependency Injection (CDI) Java Authentication and Authorization Service (JAAS) Java Authorization Contract for Containers (JACC) JavaMail API Bean Validation Enterprise JavaBeans
kuni katsuya

Forgot Password Cheat Sheet - OWASP - 0 views

  • Forgot Password Cheat Sheet
  • no industry standard for implementing a Forgot Password feature
  • Step 1) Gather Identity Data or Security Questions
  • ...12 more annotations...
  • asks the user for multiple pieces of hard data that should have been
  • previously collected
  • send the password reset information to some
  • out-of-band side-channel
  • such as a (possibly different) email address or an SMS text number, etc. to be used in Step 3.
  • Step 2) Verify Security Questions
  • application verifies that each piece of data is correct for the given username
  • If anything is incorrect, or if the username is not recognized, the second page displays a generic error message such as “Sorry, invalid data”. If all submitted data is correct, Step 2 should display at least two of the user’s pre-established personal security questions, along with input fields for the answers.
  • Avoid sending the username as a parameter
  • Do not provide a drop-down list
  • server-side session
  • user's email account may have already been compromised
kuni katsuya

Christophe Herreman » Blog Archive » Spring ActionScript at FlexCamp 2008 Bel... - 0 views

  • endpoints externally configured
  • allows me to switch between different endpoints - different test or production servers for instance - just by specifying the ip and port in an external properties file
  • don't have to specify any compiler arguments that point to the services-config.xml or messaging-config.xml files.
kuni katsuya

Selling Weld and EE6 | Weld | JBoss Community - 0 views

  • regarding the issue of selling Weld and EE6 to developers/shops....
  • How bout a JdbcTemplate Spring equivalent in the case of projects using legacy db schemas
  • portable extension to Weld
  • ...32 more annotations...
  • William Drai
  • Honestly I don't see any value in switching to CDI if it is
  • to reproduce the same awful patterns
  • please not this Dao/Template mess
  • Gavin King
  • Their template pattern is a solution in search of a problem
    • kuni katsuya
       
      gold! :)
  • to reproduce the same awful patterns
  • please not this Dao/Template mess
  • Because, of course, there are no other well-known patterns for dealing with boiler-plate cleanup code and connection leaks.
  • This is exactly the kind of
  • brain-damage that Spring does to people!
    • kuni katsuya
       
      platinum!!!
  • It gives people a
  • half-assed solution
  • and somehow shuts down their brains so they
  • stop asking themselves how this solution could be improved upon
  • It's a very impressive magic trick, and I wish I knew how to do it myself. But then, I'm just not like that. I'm always trying to poke holes in things - whether they were Invented Here or Not.
  • but that might be too high-level for your taste. Their are other, less-abstract options.
  • exception handling, this is one area where Spring does a good job: "The Spring Framework's handling of SQLException is one of its most useful features in terms of enabling easier JDBC development and maintenance. The Spring Framework provides JDBC support that abstracts SQLException and provides a DAO-friendly, unchecked exception hierarchy."
  • Utter nonsense and dishonest false advertising
  • Automatic connection closing (and other boiler-plate code) is obviously a hard requirement to be handled by the fwk.
  • Pffffff. It's a trivial requirement which I can solve in my framework with two lines of code in a @Disposes method. Did you see any connection handling in the code above?
  • I mean, seriously guys. The Spring stuff is trivial and not even very elegant. I guess it's easier for me to see that, since I spent half my career thinking about data access and designing data access APIs. But even so...
  • I don't understand. You hate the ability to write typesafw SQL that much?
  • Gavin King
  • Methods with long argument lists are a code smell.
  • It's something Spring copied from Hibernate 1.x, back in the days before varargs
  • It's something we removed in Hibernate2 and JPA.
  • there are a bunch of people
  • who don't want to use JPA.
  • They don't understand, or see the value of, using managed objects to represent their persistent data.
  • Um. Why? Why would that be a bad thing? I imagine that any app with 1000 queries has tens of thousands of classes already. What's the problem? Why is defining a class worse than writing a method?
  • Are you working from some totally bizarre metric where you measure code quality by number of classes?
‹ Previous 21 - 39 of 39
Showing 20 items per page