Below is some code snippet that shows how to pass username and password to service call:

import org.apache.axiom.om.OMElement;
import org.apache.axiom.om.OMNamespace;
import org.apache.axiom.soap.impl.dom.SOAPHeaderBlockImpl;
import org.apache.axiom.soap.impl.dom.soap11.SOAP11Factory;
import org.apache.axiom.soap.impl.dom.soap11.SOAP11HeaderBlockImpl;
import org.apache.axis2.AxisFault;
import org.apache.axis2.client.ServiceClient;
import org.apache.axis2.databinding.types.NonNegativeInteger;
import org.apache.axis2.databinding.types.PositiveInteger;

ServiceClient client = stub._getServiceClient();
SOAP11Factory factory = new SOAP11Factory();
OMNamespace SecurityElementNamespace = factory.createOMNamespace(”http://schemas.xmlsoap.org/ws/2002/04/secext”, “wwlm”);

OMElement usernameTokenEl = factory.createOMElement(”UsernameToken”, SecurityElementNamespace);
OMElement usernameEl = factory.createOMElement(”Username”, SecurityElementNamespace);
OMElement passwordEl = factory.createOMElement(”Password”, SecurityElementNamespace);
usernameEl.setText(”username”);
passwordEl.setText(”password”);
usernameTokenEl.addChild(usernameEl);
usernameTokenEl.addChild(passwordEl);

SOAPHeaderBlockImpl block = new SOAP11HeaderBlockImpl(”Security”, SecurityElementNamespace, factory);
block.addChild(usernameTokenEl);

client.addHeader(block);

I will try to post other way to pass username/password to web service.

Thanks,
~Kumar

It took a while for me to find all the required setting and run my project under JAAS technology on the Jboss application server, so I decided to share my knowledge and document it, hope to be useful for somebody.

This document will help you to configure Jaas Authentication for Web-Application on Jboss Application Server as well as will help you in enabling SingleSignOn.

Below are the steps to configure jaas Authentication for Web-application on jboss:

Step-1: Define a new application policy in login-config.xml (C:\Software\jboss-4.2.3.GA\server\default\conf\login-config.xml)

To define an application policy, you need to modify login-config.xml to add the application policy: Below is the example policy.

<application-policy name = “web-console”>

<authentication>

<login-module code=”org.jboss.security.auth.spi.UsersRolesLoginModule”

flag = “required”>

<module-option name=”usersProperties”>props/web-console-users.properties</module-option>

<module-option name=”rolesProperties”>props/web-console-roles.properties</module-option>

</login-module>

</authentication>

</application-policy>

Add web-console-user.properties file in props folder (C:\Software\jboss-4.2.3.GA\server\default\conf\props) containing user and password information. Below is the example content in this file:

admin=admin

kumar=kumar

Add web-console-roles.properties file in props folder (C:\Software\jboss-4.2.3.GA\server\default\conf\props) containing user and role information. Below is the example content in this file:

admin=Administrator,user

kumar=user

Step-2: Create Security Domain

To define a security domain, you need to create a file named jboss‐web.xml in the

WEB‐INF directory of your web application.

Example of jboss‐web.xml:

<?xml version=”1.0″ encoding=”UTF-8″?>

<jboss-web>

<security-domain>java:/jaas/web-console</security-domain>

<context-root>/jaasTest</context-root>

</jboss-web>

web-console in the above example is the name of the defined application policy in the first

step.

Step-3: Secure the Application

In this step we secure the web application. For this we need to modify the web.xml file in the WEB‐INF directory.

These are changes need to apply to the web.xml file:

1. Authentication: We should tell JBoss to authenticate users before allowing them to enter the application. This is done by adding <login‐config> element to the web.xml.

<login-config>

<auth-method>FORM</auth-method>

<realm-name>web-console</realm-name>

<form-login-config>

<form-login-page>/login.jsp</form-login-page>

<form-error-page>/login.jsp?error=yes</form-error-page>

</form-login-config>

</login-config>

In this example we tell JBoss that we need a form‐based authentication (redirects users to our own login form). login.jsp is the designed login page and if the authentication fails, users are redirected to loginfail.jsp.

1. Create Login Page: Login page is a very simple JSP page with a form where the action of the form is set to j_security_check and a text box, j_username for username and apassword box, j_password for Password. For Example

<form method=”POST” action=”j_security_check”>

Login: <input type=”text” name=”j_username”><br/>

Passwort: <input type=”password” name=”j_password”><br/>

<input type=”submit” value=”Login”/>

</form>

1. Secure Web Resources: Now we define our secured resources and required roles to access them. This is done by adding <security‐constraint> element to web.xml

<security-constraint>

<web-resource-collection>

<web-resource-name>CSF</web-resource-name>

<url-pattern>/*</url-pattern>

</web-resource-collection>

<auth-constraint>

<role-name>Administrator</role-name>

<role-name>user</role-name>

</auth-constraint>

</security-constraint>

In this example we are securing the entire pages of web-application.

Enable SingleSignOn on Jboss

SingleSignOn will help you in sharing user credential of one authenticated application to other applications that are deployed on same jboss server.

To enable SingleSignOn on jboss uncomment the following valve from server.xml (C:\Software\jboss-4.2.3.GA\server\default\deploy\jboss-web.deployer\server.xml)

<Valve className=”org.apache.catalina.authenticator.SingleSignOn” />

Thanks,

~Kumar

In this article I am going explain SSO and how to setup SSO in JBoss.

Single Sign On (SSO) is a specialized form of user authentication that enables a user to be authenticated once, and gain access to resources on multiple systems/web applications during that session.

The JBoss SSO framework is combination of three components:

1. Federation Server

2. Token Marshalling Framework

3. Identity Connector Framework

Following are the steps to setup JBoss SSO:

Step-1: Installation

Download JBoss from here : Download

Unzip/Untar the distribution on your machine e.g.: C:/jboss

Download JBoss Federated SSO from here : Download

Unzip/Untar the distribution on your machine egg C:/Jboss Federated SSO

Copy the jboss-sso.sar and jboss-federation-server.ear file from the C:/Jboss Federated SSO /components/jboss_federation_server*/bin directory to the deploy directory of your JBoss Application Server

Step2 - Configure the Identity Management Framework

Edit the file jboss-sso.sar/conf/sso.cfg.xml to set the Login provider like LDAP, Custom Login Provider or DemoLoginProvider bundled in jboss-identity-management.jar.

E.g.:

<identity-management>

          <login>

<provider id="si:jboss-sso:ldap:login" class="org.jboss.security.idm.ldap.LDAPIdentityProvider">

                    <property name="connectionURL">

                         jdbc:ldap://localhost:389/dc=jboss,dc=com?SEARCH_SCOPE:=subTreeScope&secure:=false&concat_atts:=true&size_limit:=10000000

                    </property>

                    <property name="username">cn=Admin,dc=jboss,dc=com</property>

                    <property name="password">jbossrocks</property>

                    <property name="identityOu">jbosssso</property>

                    <property name="roleOu">role</property>

               </provider>

          </login>                    

     </identity-management>

Or

<login>

<provider id="si:jboss-sso:demo:login" class="org.jboss.security.idm.demo.DemoLoginProvider"/>

</login>

Note: you can see or add users in users_en.properties file bundled in jboss-identity-management.jar.

Step3 - Configure the Federated SSO Trust Server

Edit the file jboss-sso.sar/conf/sso.cfg.xml to set the SSO trust server

<sso-processor>

                    <processor class="org.jboss.security.saml.JBossSingleSignOn">

          <property name="trustServer">http://node1.testsso.org:8080/federate/trust</property>

                    </processor>

</sso-processor>

Step4 - Configure your web application to activate Federated SSO

Step 4.1: Add the following context.xml under WEB-INF folder of your WAR file:

<?xml version="1.0"?>

    <Context>

       <!-- 

             logoutURL - URL for performing logout/signout function in your application

        -->        

       <Valve className="org.jboss.security.valve.PlainSSOAutoLogout" 

     logoutURL="{logoutURL of your application}"></Valve>

       <!-- 

             assertingParty - this is the partnerId of this application as a part of a federation of multiple partner sites

       -->

       <Valve className="org.jboss.security.valve.PlainSSOTokenManager" 

       assertingParty="{uniqueId to identify this web application in the federation}"></Valve>

       <!-- 

          tomcat built-in AuthenticationTypes: FORM,BASIC,DIGEST,CLIENT-CERT

       -->

       <Valve className="org.jboss.security.valve.PlainSSOAutoLogin"></Valve>

   </Context>

Step 4.2: When the authentication usecase is executed within your web application via the login screen or some other mechanism, part of executing that process, when the login is successful, send a notification of this event to the SSO Engine using the following API call:

org.jboss.security.saml.SSOManager. processManualLoginNotification(HttpServletRequest request,String user)

Step 4.3 : When the SSOEngine performs an automatic login in response to a trusted SSOToken, it will send the following notification on your LoginProvider:

processSSOLoginNotification(LoginContext)

  Here, you can handle any web application environment necessary to setup an authenticated user session

Step5 – Run and test your application

· Note: On Windows add the following entries to your hosts file to simulate applications running on different web domains\ (On Vista hosts file is lying under C:\Windows\System32\drivers\etc folder)

o 127.0.0.1        node1.testsso.com

o 127.0.1.1        node1.testsso.org

• Deploy your web application in the ‘deploy’ directory of the ‘default’ configuration\

run -c default -b node1.testsso.com\

• Now create an exact same copy of ‘default’ configuration and name it ‘default2′\

run -c default2 -b node1.testsso.org

For more details please refer to link http://www.jboss.org/community/docs/DOC-12304

Thanks,

~Kumar

Many computer pundits predict that it will be the next big thing in the digital revaluation.

Applications in the cloud: this is what almost everyone has already used in the form of gmail, yahoo mail, the rest of google apps, the various search engines, wikipedia, etc

Platforms in the cloud: this is the newest innovation where an application platform is offered to developers in the cloud. Developers write their application and then upload their code into the cloud where the app is run magically somewhere, typically being able to scale up automagically as usage for the app grows. Example: Mosso, Google App Engine, etc

Infrastructure in the cloud: this is the most general offering that Amazon has pioneered and where RightScale offers its management platform. Developers and system administrators obtain general compute, storage, queueing, and other resources and run their applications with the fewest limitations. This is the most powerful type of cloud in that virtually any application and any configuration that is fit for the internet can be mapped to this type of service.

Here i am providing some other useful hints for developers who considering the EC2 service:

1. “Before spending too much time configuring and customizing an AMI, find one that suits your needs from the start so you won’t have to redo any work later on down the road. Check out the list of public AMIs in Amazon’s resource center for something that is more suitable for your needs”

2. “When packaging up your own image using the ‘ec2-bundle-vol’ command, make sure you specify a clean folder using the ‘–d’ flag otherwise bundling the same image twice will result in an error due to the conflicting sets of temporary files.”

3. “When working with your image, note that the main drive/partition (where the system files are) has a very limited capacity (10 GB in our case). So when dealing with large files/directories use ‘/mnt’ as it has over 100 GB.

4. “If a machine is terminated, all your data will be lost except for what was backed up from the last time you ran an ‘ec2-bundle-vol’”

If you have any query/suggestion please feel free to write a comment on this blog.

Thanks,
~Kumar

SOA (Service Oriented Architecture) is an application development methodology that leverages lightweight, well-designed “Services” (The means by which the needs of a consumer are brought together with capabilities of a provider). In other words:  SOA is a style of building distributed systems that enables business integration using services as building blocks or It is a thought process and methodology of decoupling IT assets – Software and hardware – from business processes. We can say SOA is a business-driven IT architectural approach that supports agile, innovation and optimization.

Building blocks of SOA:

·         Business level Services

·         Infrastructure level services

·         Services Management

·         Security

·         Services Directory

Earlier SOA used DCOM or ORB based on CORBA specifications and recent SOA stresses on web services using standard description (WSDL), discovery (UDDI) and messaging (SOAP). Services oriented architecture may or may not use web services but yes web services provide a simple way towards service oriented architecture.

                                   Service-oriented architecture

Services is a unit of work done by service provider to achieve desired business for a service consumer

Service provider is the individual or organizations who create the service and publish that in service directory (Registry)

Service Directory is a well-known directory of available services. It registers available services and making them easily accessible for multiple reuses.

Now what should be the characteristics of a “Service” and which characteristics that define the “service”? Service should have Syntax, Semantics, QoS and Business Traceability. Below are the lists of characteristics of a “Service”:

·         Well defined interface

·         Modular

·         Stateless

·         Connectionless

·         Coarse grained

·         Location transparent

Here is the list of design principles that drive SOA:

1.      Modularity

2.      Encapsulation

3.      Loose coupling

4.      Separation of Concerns

5.      Compos ability

6.      Single Implementation

Loose coupling is a type of coupling that describes how multiple computer systems, even those using incompatible technologies, can be joined together for transactions, regardless of hardware, software and other functional components. Or By decoupling from platform, protocol, location and language using interface based assembly.

SOA resolves four important dependencies that are:

·         Platform Dependence

·         Location Dependence

·         Implementation Dependence

·         Information Format Dependence

Benefits of SOA:

Service-oriented architectures offer the promise of business agility and resilience through reuse, loose coupling, flexibility, interoperability, integration and governance. These are realized by separating service description from their implementations, and using this descriptive metadata across the service life cycle.

·         Increased business responsibilities and agility

·         Ability to transcend organizational boundaries

·         Reduces product development cycle times

·         Exposes commodities in business processes

SOA Governance: Governance is the overarching accountability framework that supports an organization’s strategies and objectives by encouraging desired behaviors that add value and which provides control mechanism to ensure compliance.

”Governance is about tracking all the rules and monitoring events around them to ensure that service-oriented architecture works the way it’s supposed to” says Daryl Plummer, a Gartner managing VP.

We should address following technical issues while designing SOA:

1.      Interoperability

2.      Loose Coupling

3.      Location transparency

4.      Modular issues

5.      Reuse focus

6.      Integration issues

7.      Granularity

8.      Application assembly to model business process

9.      Intra company solutions using existing components

10.  External integration solutions using web-services

Service Modeling Techniques:

·         Top down approach

·         Bottoms up approach

·         Middle-out approach

I will keep writing about SOA and other learning and experience. You can write you valuable comment over it.

Thanks,

~Kumar

Aspect: It’s like a general feature you want to apply globally to your application like logging, exception handling, transaction management, performance management etc. It is also called Cross Cutting Concerns.

Advice: It is a piece of code/logic for implementing your advice.

Joinpoint: A single location in the program where an advice is applied like method invocation, constructor invocation etc.

Pointcut: A pointcut is set of Joinpoint where an advice is applied. In Spring set of method invocation is called Pointcut. There are different types of pointcut in spring like Regular Expression Pointcut, Attribute Driven Pointcut, and Dynamic Pointcut etc

Targets/Target Objects: The objects you want to apply an aspect or set of aspects.

As per me advice is very similar to Decorator. You can implement an advice by implementing org.aopalliance.intercept.MethodIntercept interface of spring. The MethodInterceptor interface is actually a child of the org.aopalliance.intercept.Interceptor interface, which is a child of another interface org.aopalliance.aop.Advice. In spring we generally use method interceptor. That is designed for method-invocation style advice. The MethodIntercept is really simple

public interface MethodInterceptor extends Interceptor {

            Object invoke(MethodInvocation invocation) throws Throwable;

}

Basically, when you write an advice for intercepting a method, you have to implement one method - the invoke method, and you are given a MethodInvocation object to work with. The MethodInvocation object tells us a bunch of stuff about the method that we’re intercepting, and also gives a hook to tell the method to go ahead and run.

public class LoginInterceptor implements MethodInterceptor {

           public Object invoke(MethodInvocation methodInvocation) throws Throwable {

               Log logger = LogFactory.getLog(methodInvocation.getClass());

               long startTime = System.currentTimeMillis();

               try {

                               Object[] args = methodInvocation.getArguments();

                               if (logger.isDebugEnabled()) {

                                    logger.debug(”Beginning method: ” +

                                                             methodInvocation.getMethod().getDeclaringClass() + “::” +

                                                             methodInvocation.getMethod().getName());

                                   if (null != args) {

                                               logger.debug(” with arguments: ” + args.toString());

                                   } else {

                                              logger.debug(” with no arguments”);

                                   }

                                    logger.debug(System.getProperty(”line.separator”));

                               } else if (logger.isInfoEnabled()) {

                                        logger.info(”Beginning method: ” + methodInvocation.getMethod().getDeclaringClass()

                                              + “::” + methodInvocation.getMethod().getName());

                                      logger.info(System.getProperty(”line.separator”));

                               }

                                              Object retVal = methodInvocation.proceed();

                               return retVal;

                      } finally {

                               if (logger.isInfoEnabled()) {

                               logger.info(”Ending method: ” +  methodInvocation.getMethod().getDeclaringClass() + “::” +

                               methodInvocation.getMethod().getName());

                               logger.info(”Method invocation time: ” + (System.currentTimeMillis() - startTime) + ”

                               msecs.”);

                               logger.info(System.getProperty(”line.separator”));

                                   }

                    }

           }

}

XML configuration for above interceptor is given below:

<bean id=”studentServiceTarget” class=”com.example.StudentServiceImpl”/>

<bean id=”myLogger” class=”com.example.LoginInterceptor”/>

<bean id=”studentService”

    class=”org.springframework.aop.framework.ProxyFactoryBean”>

    <property name=”proxyInterfaces”><value>com.example.StudentService</value></property>

    <property name=”target”><ref local=”studentServiceTarget”/></property>

    <property name=”interceptorNames”>

        <list>

            <value>myAdvisorLogger</value>

         </list>

    </property>

</bean>

Spring has multiple alternatives to the basic MethodInterceptor , however, (which is referred to in the Spring documentation as an ‘around’ advice) so that if you want to do more specific things, you can with less complication - these extensions come in the form of Spring-specific extensions to the Advice interface (siblings to the MethodInterceptor interface), and they include:

·         org.springframework.aop.MethodBeforeAdvice - Implementations of this interface have to implement this before method:

void before(Method method, Object[] args, Object target) throws Throwable;

·         org.springframework.aop.AfterReturningAdvice - This interface’s method will be called on the return from the invocation of a method. Implementation of this interface have to implement this afterReturning method:

            void afterReturning(Object returnValue, Method method, Object[] args, Object target) throws Throwable;

·         org.springframework.aop.ThrowsAdvice – Implementation of this interface havt to implement this afterThrowing method:

            void afterThrowing([Method], [args], [target], [some type of throwable] subclass)

 Below are hierarchy of Advice class:

In above article I have given only basic information about AOP. 

Reference Material:

·         http://static.springframework.org/spring/docs/1.2.x/reference/aop.html.

·        Spring in Action by Craig Walls, Ryan Breidenbach: this is the best book I have read on Spring (and yes I read this entire book).

Ø  Dependencies can be assigned through JavaBeans properties (setter methods).

Ø  Dependencies are provided as constructor parameters and are not exposed as JavaBeans Setter propertiSes.

Spring IOC Container

Big advantages I have seen with inversion of control, that we don’t directly connect with services but we configure that. Now this is really gaining momentum as of late, is the adoption of the Spring Framework as an alternative to Java EE. I think that this started because J2EE was so complicated and heavy-weighted that companies sought new and innovative solutions. Spring provides the ability to access data objects as Plain Old Java Objects (POJOs) and includes support for database connection pools, transaction management, and so forth. This means that you can effectively build a scalable enterprise application without Java EE. And as Java EE evolved into its more manageable form, many developers continued to appreciate all that Spring provided them and had no desire to switch back.

As an enterprise developer you should be familiar with the concept of Inversion of Control (IoC) and Dependency Injection, and Spring specifically. Whether you decide to embrace Java EE and EJB 3.0 or develop your applications with Spring, you should at least understand the theory.

Book Recommendations:

·              Spring in Action by Craig Walls, Ryan Breidenbach: this is the best book I have read on Spring (and yes I read this entire book).

Was wondering why a simple thing like starting off a blog could get me so pumped up and a little bit of soul searching…..It’s been planned long time back… but due to time constraint and work enthu didn’t… one day my friend Nishat Saini told why don’t you start bogging…and same day I started…rolling the ball (blog articles) to share the experience that I had with various open source products/technologies, architecture, and design. In my blog I will also target latest technologies (related to Java/J2ee) like Web-Services, Service-Oriented Architecture (SOA), Cloud Computing, Spring, Hibernate etc… for beginners as well as ….

As when I run into problems I refer to my companion GOOGLE which seems to friend for almost every IT guy. There are countless blogs out there for any particular topic, but which one is the best? Some of them can lead to resolution of problem you have and sometimes it may take weeks to unravel the mystery. So each blog has a unique problem and unique solution and the answer to your problem might be aggregation of these various blogs.

I will try to put sample programs, pictures and diagrams to explain my thoughts about technologies. I always believe, sample programs, pictures and diagrams speak better than words. If any one interested to ask any question, feel free to post a comment on this article and I’ll answer it as soon as I could.

Thanks,
~Kumar