If There's A God In The Sky Looking Down What Can He Think Of What We've Done To The World That He Created (Is This The World We Created - Queen)

Hello, this week I have reached 25K visits. Not long ago, I wrote that I have reached 10K visits during Japan earthquake. Now thankful  Japan nuclear crisis seems that has passed.

I would like to say thank you to all people that have read my blog, specially people from theserverside.com and springsource for publishing my posts on their site, and also people that have become followers of my blog.

For now that all, I wish I reach 100K as soon as possible, thank you very much all of you for your support.

Alex.
Music: http://www.youtube.com/watch?v=pUOrAengPH8

Mornië Utúlië, Believe And You Will Find Your Way (May It Be - Enya)

A CAPTCHA is a program that can generate and grade tests that humans can pass but computer programs "cannot". One of strategies followed are showing an image to user with distorted text, and user should write text in input area. If showed text is the same as input by user, then we can "assure" that a human is on computer. A captcha example:

Captchas have several applications for practical security, for example:

• Preventing Spam in comment fields.
• Protecting from Massive User Registration.
• Preventing Dictionary Attacks.
• ...

These distorted texts are acquired as follows:

1. Digitizing physical books/newspaper. 
2. Pages are photographically scanned, and then transformed into text using "Optical Character Recognition" (OCR). 
3. OCR is not perfect, each word that cannot be read correctly by OCR is placed on an image and used as a CAPTCHA.
4. Word that cannot be read correctly by OCR is given to a user with another word for which the answer is already known. Then is asked to read both words, if user solves the one for which the answer is known, the system assumes their answer is correct for the new one. The system then gives the new image to a number of other people to determine, with higher confidence, whether the original answer was correct.

Now you know how captcha works, the problem is that if you want to use captchas in your website, you should implement yourself process described above, and of course this is not easy and tedious work is required digitalizing works. For this reason there are some "captcha providers" that have done this work for us. One of these providers is reCaptcha http://www.google.com/recaptcha. reCaptcha is a free captcha service that provides us these captchas ready to be used in our site. As developers we only have to embedded a piece of code in client side for showing captcha image and text area, and in server side, calling a function for resolving input data. reCaptcha provides plugins for dealing with lot of programming languages like Java, PHP, Perl, ...

This post will guide you on how to use reCaptcha in Spring MVC web application. The application consists in a form to register a new user. This form contains a captcha for avoiding a bot starts a massive registration attack.

First step is open an account to reCaptcha site (you can use your google account or create a new one). 

Once you have entered go to My Account - Add New Site.

Then at domain box you should write the domain which will contain captcha validation. For this example I have entered localhost and I have checked Enable this key on all domains (global key). Of course information provided here is for testing porpoise and in production environment should be different. After you have registered your site, two keys are provided, private key (XXXX) and a public key (YYYY).

Before coding, let me show basic life-cycle of a reCAPTCHA challenge. Diagram is from reCaptcha web:

Second step is create a Spring MVC application, no secret here, I am going to explain only parts that are implied in reCaptcha integration. Apart from SpringMVC dependencies, recaptcha4j API should be added:

recaptcha4j.jar is an API that provides a simple way to place a captcha on your Java-based website. The library wraps the reCAPTCHA API.

Integrating reCaptcha into a form, requires two modifications:

• One in client side, for connecting to reCaptcha server and get the challenge.
• Second one in server-side for connecting to reCaptcha server to send the user's answer, and give back a response.

Client side:

For client side a tagfile has been created to encapsulate all logic of reCaptcha API in a single point, so can be reused in all JSP forms.

reCaptcha class requires the private key (XXXX) and the public key (YYYY) provided by reCaptcha in step one. The method createRecaptchaHtml(...) creates a piece of html code to show the challenge. In fact it generates something like:

And finally a JSP page with a form and captcha information:

See that form is generated as usual using Spring MVC taglib, but also we are using created tagfile (<tags:captcha>) for embedding captcha into form.

Server Side:

Server side is even simpler than client side. When a captcha is created using createRecaptchaHtml, two form element fields are created, recaptcha_challenge_field that contains information about the challenge presented to user, and  recaptcha_response_field that contains the user answer to the challenge.

Apart from these two parameters, recaptcha4j requires remote address too. ServletRequest interface has a method (getRemoteAddr()) for this porpoise.

reCaptcha object is injected using Spring. It is important to note that UserInfo (data entered by user in form) does not contain any information about captcha, it only contains "business" data. Using @RequestParam reCaptcha information is retrieved by Spring and can be used directly into reCaptcha object.

The other important part is isValid() method. This method simply checks if response of reCaptcha site is that user has been passed the challenge or not. Depending on result you should act consequently, if challenge is not passed returning to previous page is a good practice.

This bean definition is simply for instantiating reCaptcha class with your private key. Using @Autowire bean is injected into controller.

Step Three:

Last step is watch that created form shows the captcha image and controller redirects you to page depending on what you have entered into captcha text area.

Extra Step:

Now you have a basic notion of how to work with reCaptcha, next step (out of scope of this post) is instead of showing again form without any error message, you could use BindingResult in Controller for notifying to user an error message:

result variable is an attribute passed to submitForm of type BindingResult. Of course JSP should be changed with <form:errors path="captcha"/> for showing the error message.

Another improvement is creating  a HandlerInterceptor for validating forms with captchas. For example  ReCaptchaHandlerInterceptorAdapter would contain reCaptcha management. preHandle method would return true if captcha challenge is resolved correctly by user (allowing defined controller do its work), or false and redirecting to an error page.

With previous handler configuration all forms would have captcha validation.

Hope you find useful this post, and now you can start protecting your web forms from spam or bots.

Download Eclipse Project.

Music: http://www.youtube.com/watch?v=XOykCYDMKBs

This Is a Flash Of Pure Inspiration, Més I Més I Messi, Però Més Però Molt Més (The Feet Continue To Dance - The Wizard Of Ox)

Git is a distributed revision control system, where every working directory is a full-fledged repository with complete history and full revision tracking capabilities. 

Git is categorized as DVCS (Distributed Version Control System), because is not dependant on a central server. So the academic way for working with Git is pushing/pulling data from/to each developer repository. This works in small teams or in a highly distributed development (open source projects that people are working around the world), but in mid-size teams or business companies, that require a central repository because of infrastructure/workflow process like Continuous Integration System, QA Checks before delivering, Environment Backups, External Manual Audits... seem that a traditional SCM should be desired. But this claim is far from reality, Git is still your VCS; how about creating a theoretical central repository? I say theoretical because in Git there is no central repository at a technical level. This repository will act as central because of convention. I call, and in many other posts also call this repository origin.

A Git remote repository is a repository without working directory. Only composed by  .git project directory and nothing else.

Nvie has created a nice schema of this topology:

See that each developer pulls and pushes to origin, but also may exchange data with other peers. For example, if two or more developers are working on a new feature, they can push changes between them before pushing stable version to origin repository.

Git is not tied to any particular transmission protocol, it supports transmitting changes via USB stick, email, ..., or traditional way like HTTP, FTP, SSH, ...

So although Git has broken the typical SCM hub architecture to peer-to-peer structure, we can still create (by convention) a central repository for uploading stable code. And let me write again, "This central repo is just another node in the peer not THE REPOSITORY".

What I am going to explain is how to install and configure this "central repo" in an Ubuntu Server.

We can say that Git only takes care of repository management and leaves transport operations to lower layers. A typical transport configuration for these central repos is using SSH protocol. So let's install and configure a SSH server. (if you have already installed skip to next step).

Install SSH Server:

$ sudo apt-get install openssh-server

after installed try:

$ ssh <username>@<servername>

Configure SSH Server:

In /etc/ssh/sshd_config configure to only use SSH Protocol 2: 

Protocol 2

Next step is to install Git: (You can skip this step if you have already installed).

Install Git (not git-core package):

$ sudo apt-get install git

Then execute Git command to check that has been installed correctly.

Next step is creating a bare repository for the project. By convention, bare repository directories end with .git. So first thing to do is create a .git directory of project. 

Creating a bare repository from existing repository:

$ git clone --bare my_project my_project.git

This command transforms the /my_project/.git to my_project.git.

Creating a new bare repository:

If you are starting a new project you can initialize it directly as bare repository using:

$ mkdir my_project.git

$ cd my_project.git

$ git --bare init

Now all structure is created and ready to be transferred. Case that initial project was started on developer computer you should copy this directory (using scp for example) to origin.

Then execute next command:

$ git init --bare --shared

This command will add propertly group read/write permissions.

And now it is time to clone created repository to developer computer, I assume that developer has already an account in server (for connecting using ssh). So go to developer computer (or open another terminal) and type next command:

$ git clone <username>@<servername>:/<directories>/my_project.git

If user has read permissions to my_project.git directory, repository will be downloaded to local computer. Write permissions are required for checking in changes.

And now I suppose you are thinking that it was so easy creating a remote repository, but now another problem arises. If your company is small you can manually create a new user into your server for each developer, it should be easy to manage, but if your company is bigger, then management of all users is hard. You must create an account for each one, and more important, they will have access to server shell using ssh (not only for uploading code) or ftp, ..., and this fact implies a problem with security, you should take care of what a user can do and what cannot do in his shell.

So arrived at this point, one can setup accounts for everyone, which is straightforward but can be cumbersome. Another way is using an LDAP or any other centralized system, but this is alien topic for this post.

A second method is to create an account called "git" on the server, and ask every user who will have  access, to send its SSH public key, and add that key to the .ssh/authorized_keys file of "git" user. I am sure that this approach sounds you familiar (github way?). So let's explain this way:

First of all each user should send you its public key, (they can find in .ssh directory *.pub file), or simply create new, using ssh-keygen command. See this tutorial for learning how to generate both keys http://github.com/guides/providing-your-ssh-key.

Setting up Git server with user public keys:

First step is create a git user with .ssh directory.

#from server
$ sudo adduser git
$ su git
$ cd
$ mkdir .ssh

Next step is create authorized_keys file where all public keys will be stored:

For example:

#from server
$ cat id_dsa.user1.pub >> ~/.ssh/authorized_keys
$ cat id_dsa.user2.pub >> ~/.ssh/authorized_keys

And now each developer, with public key published in authorized_keys and private key in his own .ssh directory, has access to repository. Let's try, open another terminal (would be developer machine in real scenario) and try to clone existing repo from server:

#from developer computer
$ git clone git@<servername>:<directories>/my_project.git

After repository is cloned to developer computer, modifications can be made and pushed them.

And now you can say, "Ok, I don't have to create one account for each developer but I am still having a problem with security", each developer still has access to shell. Yes it is true, but you can easily restrict the "git" user to only doing Git activities with a limited shell called git-shell. Next step is specifying git-shell instead of bash for Git user, in /etc/passwd.

$ sudo vim /etc/passwd

and change

git:x:1000:1000::/home/git:/bin/sh

to

git:x:1000:1000::/home/git:/usr/bin/git-shell

Now your server is secured, only Git operations are allowed using "git" account with users that have sent their SSH public key.

You have your central remote repository configured and ready to be used; at this point you may consider install Git tools like gitweb, gitosis or gitolite, but in this post are off topic.

I hope you have found this post useful.

Music: http://www.youtube.com/watch?v=q2AemC0cwy0

To Seek Out New Life And New Civilizations, To Boldly Go Where No Man Has Gone Before (TNG Soundtrack - Star Trek)

From Wikipedia: OAuth (Open Authentication) is an open standard for authentication. It allows users to share their private resources (e.g. photos, videos, contact lists) stored on one site with another site without having to hand out their credentials, typically username and password.

There are a lot of posts talking about OAuth from Client Side, for example how to connect to service providers like Twitter or Facebook, but there are less posts about OAuth but from Server Side, more specificaly how to implement an authentication mechanism using OAuth for protecting resources, and not for accessing them (Client Side Part).

In this post I will talk about how to protect your resources, using Spring Security (Spring Security OAuth). The example will be simple enough to understand the basics for implementing an OAuth service provider.

I have found this post that explains with a simple example, what OAuth is and how it works. I think it is a good starting point with OAuth http://hueniverse.com/2007/10/beginners-guide-to-oauth-part-ii-protocol-workflow/

Now it is time to start writing our service provider. First of all I will explain what our Service Provider will offer.

Imagine you are developing a website (called CV) where users will register and after that they will be able to upload their Curriculum Vitae. Now we are going to transform this website to a Service Provider where OAuth will be used for protecting resources (Curriculm Vitae of registered users). Imagine again that some companies have agreed with CV people that when they publish job vacances, users will have the possibility of uploading their curriculum directly from CV site to HR department instead of sending by email or copy & paste from document. As you can see here is where OAuth starts managing security between CV website and Company RH site.

In summary we have a Curriculum Vitae Service Provider (CV) with protected resource (document itself). Companies that offer users the possibility of acquiring directly their Curriculum Vitae from CV are the Consumers. So when a user visits company job vacancies (in our example called fooCompany) and wants to apply for a job, he only has to authorize FooCompany "Job Vacancies" website with permissions to download its Curriculum Vitae from CV site.

Because we will use Spring Security for OAuth authentication, first of all we are going to configure Spring Security into SpringMVC CV application. Nothing special here:

In web.xml file we define Security Filter:

And in root-context.xml we define protected resources and authentication manager. In this case In memory apporoach is used:

Next step, create an Spring Controller that returns the Curriculum Vitae of logged user:

This controller returns directly a String, instead a ModelView object. This String is sent directly as HttpServletResponse.

Now we have got a simple website that returns the Curriculum Vitae of logged user. If you try to access to /cvs resource, if you are not authenticated, Spring Security will show you a login page, and if you are already logged, your job experience will be returned. Works as any other website that are using Spring Security.

Next step is modifing this project for allowing external sites can access to protected resources using OAuth 2 authentication protocol.

In root-context.xml:

First bean, is an OAuth2ProviderTokenServices interface implementation with id tokenServices. The OAuth2ProviderTokenServices interface defines operations that are necessary to manage OAuth 2.0 tokens. These tokens should be stored for subsequent access token can reference it. For this example InMemory store is enough.

Next bean is <oauth:provider>. This tag is used to configure the OAuth 2.0 provider mechanism. And in this case three parameters are configured; the first one is a reference to a bean that defines the client details service, explained in next paragraph. The second one is token service for providing tokens, explained in previous paragraph, and the last one is the URL at which a request for authorization token will be serviced. This is the typically Authorize/Denny page where service provider asks to user if it permits the Consumer (in our case fooCompany) accessing to protected resources (its Curriculum Vitae).

Last bean is <oauth:client-details-service>. In this tag you define which clients you authorize to access to protected resources with previous authentication. In this case because CV company has agreed with foo company that they can connect to its Curriculum Vitae Service, a client is defined with id foo.

Now we have our application configured with OAuth. Last step is creating a controller for taking requests from /oauth/confirm_access URL.

This controller returns a ModelAndView object with client information and which page should be shown for granting permission to protected resources. This JSP page is called access_confirmation.jsp and the most important part is:

As you can see Spring Security OAuth provides helper classes for creating confirmation form and deny form. When the result is submitted, URL /cv/oauth/user/authorize (internally managed) is called, there OAuth decides if returns protected resource (String returned by loadCV() method) to caller or not depending on what option user has chosen.

And that's all about creating an OAuth 2 system using Spring Security OAuth. But I suppose you are wondering how to test it, so for the same price I will explain how to write the client part (Consumer) using Spring Security OAuth too.

Client application (called fooCompany) is also a SpringMVC web application with Spring Security.

 Spring Security part will be ignored here.

The client application contains a home page (home.jsp) that has a link to Spring Controller that will be responsible to download Curriculum Vitae from CV site, and redirecting content to a view (show.jsp).

As you can see is a simple Controller that calls a Curriculum Vitae service. This service will be responsible to connect to CV website, and download required Curriculum Vitae. Of course it deals with OAuth communication protocol too.

Service looks:

The suggested method for accessing those resources is by using Rest. For this porpose Spring Security OAuth provides an extension of RestTemplate for dealing with OAuth protocol. This class (OAuth2RestTemplate) manages connection to required resources and also manages tokens, OAuth authorization protocol, ...

OAuth2RestTemplate is injected into CVService, and it is configured into root-context.xml:

See that OAuth2RestTemplate is created using an OAuth resource that contains all information about where to connect for authorizing access to protected resource, and in this case is CV website, see that we are referencing an external website, although in this example we are using localhost. Also service provider URL (http://localhost:8080/cvs/cv) is set, so RestTemplate can establish a connection to content provider, and in case that authorization process ends successful, retrieving  requested information.

<oauth:resource> defines OAuth resources, in this case, the name of the client (remember that this value was configured in server side client details tag for granting access to OAuth protocol). Also userAuthorizationUri is defined. This is the URI to which the user will be redirected if the user is ever needed to authorize access to the resource (this is an internal URI managed by Spring Security OAuth). And finally accessTokenUri, the URI OAuth provider endpoint that provides the access token (internal URI too).

Also creating a consumer using Spring Security OAuth is simple enough.

Now I will explain the sequence of events that happens when a user wants to give access to foo company for retrieving its Curriculum Vitae.

First of all user connects to foo website, and click on post curriculum vitae link. Then getCV method from controller is called. This method calls cvService, that at the same time creates a connection to resource URI (CV) using OAuth2RestTemplate. And this class acts as a black box, from client side, you don't know exactly what this class will do but it returns your Curriculum Vitae stored in CV website. As you can imagine this class manages all workflow related to OAuth, like managing tokens, executing required URL redirections to get permissions, ... and if all steps are performed successful, stored Curriculum Vitae in CV site will be sent to foo company site.

And that's all steps required to allow your site to act as Service Provider using OAuth2 authorization protocol. Thanks of Spring Security folks, it is much easier that you may think at first.

Hope you find it useful.

Download ServerSide (CV)
Download ClientSide (fooCompany)

Are You Locked Up In A World That's Been Planned Out For You? Are You Feeling Like A Social Tool Without A Use? (She - Green Day)

From JBehave site: JBehave is a framework for Behaviour-Driven Development (BDD). JBehave allows developers, QA and non-technical or business participants, to write stories in a plain text file with minimal restrictions about grammar. Then a POJO is created for executing created story. This POJO should have the typical BDD structure Given, When and Then.

From Springsource site: Spring Framework is a Java platform that provides comprehensive infrastructure support for developing Java applications. Spring handles the infrastructure so you can focus on your application.

From Selenium site: Selenium is a suite of tools to automate web app testing across many platforms.


We have three technologies JBehave for acceptance tests, Selenium for web application testing and Spring dealing with infrastructure. In this post I will talk about integrating JBehave with Selenium 2 and Spring.

For this example I have created a very simple web application using Spring MVC. I know that business logic is not accurate to the reality, but it is simple enough to illustrate how to integrate all these technologies together.


I have divided this post in three main subsections:

• Integrating JBehave with Spring. There is no web application here, only business logic.
• Integrating Spring MVC with Selenium 2. Only to show how easy is implementing automated tests with Selenium 2.
• Integrating JBehave with Selenium 2. Web application used in previous example but instead of using only Selenium for automating testing, JBehave instructs to Selenium which steps should execute.

Application that I will use is a simple TraderService, (explained in JBehave page (http://jbehave.org/reference/stable/)). This TraderService generates Stocks, and if a Stock is traded below threshold, its alert status is OFF and if it is traded above, alert status is ON.

In this tutorial I assume that you have a basic idea of JBehave and Spring.

• Integrating JBehave with Spring:

In this case no web GUI is used, we are going to use JBehave for writing acceptance tests of business logic.

Basic classes are:

• TradingService, that defines a method for creating stocks. TradingServiceImpl is the implementation.
• Stock, that contains stock information and logic about its status.
• StockAlertStatus is Stock status Enum.

Acceptance test part:

First of all we should create a story. A story is where stakeholders, developers... should say what they want the application do, and which are the expected results for given parameters. In our case a story has been created for validating that alarm is OFF if trade value is under threshold, and ON otherwise.

The important parts of that file are: Scenario for describing what we are testing, all symbols between <> that are used as variables, and Examples that are values injected to previous "<>" variables. In this story file two examples are provided, so two executions will be produced, one for each row. As final note, Given, When, Then words should be placed at start and are reserved words, also more than one Given, When or Then could be used in each story.

Next step, create a class that transforms a story written in "natural language" to code. We could say that this class is equivalent of creating a junit class; In JBehave these classes are called Steps. Because we are integrating with Spring an annotation called Steps is created. This annotation extends from Component annotation so Spring component-scan can wire up step classes too.

And Steps annotation is used in TradingServiceSteps class.

In TradingServiceSteps is where all magic occurs. This class is responsible of transforming story file to an execution. Let's see:

@Steps because we want Spring creates automatically this bean. TradingService is the business logic we want to test, and is injected using Autowire annotation. And finally one method for each Given, When, Then. Explained quickly, when JBehave finds an @Given, it searches into loaded stories for a phrase starting with Given. After that checks if @Given string value matches the Given definition expressed in story file. If matches then inject the story parameters as method parameters, for example STK1 as string parameter, or 5 as double threshold parameter. Moreover, in this case because we are using Examples in our story file, @Named annotation for each parameter is required. The named parameters allow the parameters to be injected using the table row values with the corresponding header name. Each parameter is converted from String to required parameter type.

We have written stories, and how to execute them (TradingServiceSteps class). JBehave requires another class, that will be responsible of configurating it. Basically you should configure Step classes and story files location, and what kind of reports are generated.

In our case, because we are integrating JBehave with Spring, some information is provided using Spring Injection.

This class is where JBehave is configured and is responsible for running all stories. Let's examine the most important lines:

In line 1 we specify a JUnit runner for running JBehave stories with Spring.
In line 2 we are configuring JBehave with Enum parameter converter, see that StockAlertStatus is an enum, because it is not a primitive parameter, a converter should be provided. JBehave comes with some convertes, but we can implement ours too.
In line 3 the embedder that we will use. This is the standard embedder for JBehave. Embedder represents an entry point to all of JBehave's functionality that is embeddable into other launchers.
And finally with @UsingSpring we are providing two Spring files, one where step classes are defined, and the other one where JBehave is configured.

Configuration file is a standard Spring file injecting required JBehave parameters:

This is a generic configuration file, that I use in all projects. You configure the output, the classloader for Embedder and prefix for parameters

And finally a Spring context file where all step classes are defined. And you know what, thanks of Spring this is as simple as:

No magic, remember that each Step class has an @Steps annotation? Thanks of component-scan, you don't have to define each Step class in @UsingSteps annotation or using tags.

Now run previous class as JUnit, and reports with results are generated.

• Integrating Spring MVC with Selenium 2

Selenium 2 is a suite of tools to automate web app testing across many platforms. In this case WebDriver approach has been used. WebDriver is an interface for automating tests in a programmatic way. Selenium provides several implementations depending on browser where tests are run.

For this example I have created an Spring MVC application, that are composed of two pages, one form where all stock information is provided and a page where status of inserted stock is showed. Of course Spring MVC controller for managing all information is also implemented.

Controller of this small application is:

showForm method is used for showing the form where user will write stock information. submitForm method is called when submit button is pushed, and creates an stock and send to showstatus page the status of stock.

StockForm is simply a class with three attributes (stock, threshold and tradeAt price). No secret here.

Form page is also so simply but I will show it because form information will be used for configuring Selenium:

Page for showing status:

WebDriver is used in JUnit test for automatizing a sequence of events. In this case, the sequence will create an stock below threshold and assert that response page shows that alert status is OFF.

Most important sections of previous JSP are:

JSP taglibs <form:input path=""/> like <form:input path="name"/> in form, and <div id="result">. These fields are important because they are used by Selenium for filling form and asserting showed status.

For example, in Selenium class:

WebElement name = driver.findElement(id("name")) returns a "reference" to <input id="name" type="text"> element and using sendKeys method, you are sending keyboard chars to that component.

WebElement element = driver.findElement(id("result")), returns a "reference" to div element and using
assertThat(element.getText(), is(StockAlertStatus.OFF.name())); getText method, none tag characters of element are returned.

Now running this test is as simple as running TraderIsAlertedSelenium class as a simple JUnit test class. When running this class a browser (Firefox in this case) will be opened, and all programmed interactions will be executed on your screen.

At this point we just have to join both previous parts, and integration between JBehave with Spring and Selenium will be reality.

• Integrating JBehave with Selenium 2 and Spring

JBehave has a module called JBehave-Web, that is used for integrating JBehave with web pages. Base classes are WebDriverProvider and WebDriverPage. Both classes are used by JBehave for abstracting from browser, and also for providing common methods to test webpages. In this example I won't use jbehave-web for two reasons, first because Selenium 2 with WebDriver offers a level of abstraction that is enough for this example, and secondly because WebDriverPage is a class that implements some common funcionalities for testing, but it is abstract, I don't like using extension only for sharing common operations between classes, it is a bad practice (not discussed here), I prefer aggregation. So in this case I have preferred  implementing my class for implementing common functionalities.

In this case abstraction from browser is acquired using WebDriver (Selenium) interface. Moreover all common operations are implemented into this class. The idea of this class is to be used in several projects and for that reason a better design should be desired, but for current example is enough.

Next group of classes are those that use PageUtils object. I have created one class for each page that Selenium should interact with. Acts as a facade to web.

For example class for dealing with page containing form to insert new stock is:

Three operations can be executed in this page, the first one is open the page. Because "insert a new stock" is accessed manually (in this case is the front page), an open method is provided with URL. Also a method for filling stock form and and another for submitting it are provided.

And finally a class that transforms an story written in "natural language" to code (also known as Steps class), this class would be the same used in first example (TradingServiceSteps) but adapted for dealing with web pages (using previous classes).

See that there is no differences between this class and the one created in first example, but using web page interfaces instead of business objects. 

Next modified files are:

Story file:

that has been modified to use web terminology.

Spring file:

that injects into TradingServiceWebSteps required beans.

Configuration file used in first example is the same, and Spring file for configuring JBehave is the same too.

In summary I can definitely say that integrating JBehave with Selenium 2 and Spring is not a difficult task, compared with the benefits that lead us having an automated acceptance test platform. I wish you have found this post useful.

Download Full Code

Everywhere I'm Looking Now I'm Surrounded By Your Embrace Baby I Can See Your Halo You Know You Are My Saving Grace (Halo - Beyonce)

Spring Security provides comprehensive security services for J2EE-based enterprise software applications. 

There are two important concepts in application security.  

• Authentication is the process of establishing a principal is who they claim to be, generally that information comes in form of username/password.
• Authorization refers to the process of deciding whether a user is allowed to perform an action within your application.

In Spring Security, and as summary, we can say that two classes are responsible of implementing each concept:

• Main interface for Authentication is AuthenticationManager. The default implementation is ProviderManager. This rather than handling request itself, it delegates it to a list of AuthenticationProviders which each one tries to perform the authentication against its back-end with username and password provided. An example of providers is DaoAuthenticationProvider, LdapAuthenticationProvider...
• Main interface for Authorization is AccessDecisionManager. Spring Security includes several AccessDecisionManager implementations that are based on voting. Three AccessDecisionManagers are provided: AffirmativeBase (grants access if any voter returns an affirmative response), ConsensusBased ("Consensus" here means majority-rule (ignoring abstains) rather than unanimous agreement (ignoring abstains)), and UnanimousBase (requires all voters to abstain or grant access). In fact voters are the most important concept of authorization process, because are the final responsible of granting or not access to a resource.

Imagine next problem, you have developed a website for an online television, where only during daylight programs are live broadcasted and recorded, and during night programs recorded during day are rebroadcasted. Because of bandwidth problem, only registered users with ROLE_USER can watch live programs, but the rest of the world (registered or not) can watch at night the programs recorded during the day.

There are many approaches for developing that requirement, but how about implementing a voter that votes affirmative when it is night and negative when it is day?

See that most important method is vote. This method receives the caller invoking method, the secured object and the configuration attributes associated with the method being invoked and only returns if it grants, if it denies or if it abstains access to resource. Because our requirements are as easy as comparing if it is day or night these attributes are not used.

And I suppose you are wondering, "Ok man so easy, but how I register this new voter to the AccessDecisionManagers object?". Well it is also easy, the only inconvenience is that namespaces does not provide this feature and beans should be configured as old-school spring security files.

At line 1 we are configuring the security to http calls as usually but instead of relying on default decision manager, we are referencing to an access decision defined below.

At line 5, an AffirmativeBased decision manager is created, with two voters, one that will grant access if user have required role (line 8) and another one that is NightVoter implemented above granting only access if it is night.

And finally Authentication Manager beans with inmemory approach.

I think is a clean solution of an authorization problem, and also shows how Spring Security can adapt to very different scenarios involving web security.

Download Example.

Another Shot Of Whiskey Can't Stop Looking At The Door Wishing You'd Come Sweeping In The Way You Did Before (Lady Antebellum - Need You Now)

With new release of JDK 7, a lot of really useful features has been developed, some of them I have write off before in this blog (JSR 203 and JSR 166y). In this post I am going to talk about one new small enhancement. This new feature is the addition of java.util.Objects class. This class is similar to java.util.Arrays or java.util.Collections but for objects instead of arrays or collections. 

This class offers nine methods grouped by four groups: equality, hashing, nullables, and toString. Let's examine all of them.

• compare(T a, T b, Comparator c):int => Returns 0 if the arguments are identical and c.compare(a, b) otherwise. Consequently, if both arguments are null 0 is returned.
• deepEquals(Object a, Object b):boolean => Returns true if the arguments are deeply equal to each other and false otherwise. Two null values are deeply equal. If both arguments are arrays, the algorithm in Arrays.deepEquals is used to determine equality. Otherwise, equality is determined by using the equals method of the first argument. This operation is useful if you want to compare two objects and you don't know exactly if Object is a "single" object or an array. This method manages this problem, and compares both instances correctly.
• equals(Object a, Object b):boolean => Returns true if the arguments are equal to each other and false otherwise. Consequently, if both arguments are null, true is returned and if exactly one argument is null, false is returned. Otherwise, equality is determined by using the equals method of the first argument. And I suppose you are wondering "nice but I have an equals method in object class". Yes you are right but look next example:

If foo is null, a NullPointerException is thrown. One can argue that you should check for null input parameters, this is a simple example, but I am sure all of us sometimes we have received a NullPointerException in an equals.

But see that:

Not And a Half is showed instead of throwing a NullPointerException.

• hash(Object... values):int => Generates a hash code for a sequence of input values. The hash code is generated as if all the input values were placed into an array, and that array were hashed by calling Arrays.hashCode(Object[]). This method is really useful in DTO objects. For example Hibernate "requires" that all objects implement equals and hashCode. It is typical that DTOs can contain lot of fields, take a look any of these classes how many lines of code can contain those hashCode methods. But see how simple is using this method:

• hashCode(Object o):int => Returns the hash code of a non-null argument and 0 for a null argument.
  
• requireNonNull(T obj):T => Checks that the specified object reference is not null. This method is designed primarily for doing parameter validation in methods and constructors. If obj variable is null a NullPointerException is thrown. Look next example:

I think it is a clean solution, avoid noise code, and it is more readable than if(foo == null) throw new NullPointerException();

• requireNonNull(T obj, String message): T => Checks that the specified object reference is not null and throws a customized NullPointerException using message parameter, if it is.
• toString(Object o): String => Returns the result of calling toString for a non-null argument and "null" for a null argument.
• toString(Object o, String nullDefault): String => Returns the result of calling toString on the first argument if the first argument is not null and returns the second argument otherwise. I find this method so useful for logging porpoises. Sometimes you are going to log some information that null value has a meaning. For example without using this class, a log line could be:

But would be more readable:

I am sure java.util.Objects would not go down in history as the best new feature added in JDK 7, but honestly, I find it so useful and it will help me so much developing code even more readable. Enjoy it.

Come On Let's Twist Again Like We Did Last Summer Yea, Let's Twist Again Like We Did Last Year (Chubby Checker - Let's Twist Again)

JPA 2 Criteria API allows criteria queries to be constructed in a strongly-typed manner, using meta-model objects to provide type safety. This is a useful feature because when a change occurs in database, for example a rename of a field, your queries will not compile, and you will see the problem in compilation time instead of running time.

Yes I have already talked about in my previous post http://alexsotob.blogspot.com/2011/01/deep-inside-you-cry-cry-cry-dont-let.html but there are an API that do the same as Criteria API, and is called QueryDSL. QueryDSL is a framework which enables the construction of type-safe SQL-like queries for multiple back-ends including JPA, JDO and SQL in Java. Working with QueryDSL and JPA is like working with HibernateMetamodel Generator because QueryDSL has an Annotation Processor that generates Meta-model information from JPA 2 annotated classes. So I suppose you are wondering, why I should use QueryDSL instead of JPA 2 Criteria API? In its site there are interesting posts about that http://source.mysema.com/forum/mvnforum/viewthread_thread,49.

What makes really different QueryDSL from JPA2 Criteria API, is that QueryDSL also works with JDBC applications. Yes you read it right, JDBC applications can take benefit from QueryDSL, and instead of creating queries as plain text, they can be constructed in a strongly-typed manner too.

Some of advantages of using QueryDSL in JDBC are:

• Code Completion in IDE.
• Almost no syntactically invalid queries allowed (type-safe on all levels).
• Domain types and properties can be referenced safely (no Strings involved!).
• Incremental query definition is easier.

If you visit its webpage you could see one example using QueryDSL with JPA, but also one for JDBC. What I am going to explain is how to use QueryDSL with Spring Jdbc Template. Most of us, when we develop a Spring application and want to use JDBC, we use JdbcTemplate class or one of its extensions.  For that reason I will explain how I use JdbcTemplate with QueryDSL.

First of all I implement an extension of JdbcTemplate class. I have called QueryDSLJdbcTemplate. This class has a simple method called queryForList(SQLQuery sqlQuery, RowMapper rowMapper, Expression... expressions) and has three parameters, the first one is a SQLQuery object, this is the main class where you define the query you want to execute (like JPA 2 Criteria), the next one is a RowMapper object as most of JdbcTemplate methods use, and the third one is an array of Expressions; these expressions represents each database fields we want to return as result, like id, name, age, ....

Implementation of this method:

At line 4, we are attaching a connection to given SQLQuery.

At line 6, the query is executed, and result set is returned.

At line 10, the result set is transformed to a list of required objects, using RowMapper.

Next step is creating a query. In this example I will use an Employee class that have two attributes, an id and a name. The query is finding an employee by name. So EmployeeDAO looks like:

Using JPA you specify which database engine is used injecting Database dialect. In our case it is a JDBC application so we should configure SQLQuery object with database engine used, so QueryDSL generates query syntax correctly. This is done with line 1 and 2.

Line 4 is an auto-generated class, similar to classes generated by Hibernate Annotation Processor. It contains all meta-information of an entity.

Line 5 is the query construction. See that we are not creating an SQL string (SELECT * FROM Employee as emp WHERE emp.name=?), but we are creating in a programmatic way. Look this line qEmployee.name.eq(name) because if we change field name to fullName, our code will not compile (qEmployee.name attribute does not exist now) meanwhile SQL string approach will compile, but crashing in runtime.

Line 7 is a simple RowMapper, and there the parameter name is also not specified as string but as an object, where native queries were rs.getString("name") and if name does not exists an SQLExpcetion was thrown, now a compilation error would be thrown too.

After RowMapper definition, we are executing the find method. The last two attributes are the fields we are looking for. Between SQL query and QueryDSL expression you can identify the FROM clause in both and the WHERE clause in both, but not the * of SELECT. This is the place where this information is passed.

Last method is for extracting real column name to result set.

Of course this is a basic implementation, for example Dialect should be injected rather than created each time, EmployeeRowMapper could not be an inner class, and getParameterName should be in a Util class, but because of clarity, all this code has been implemented in the same class.

And I suppose you are still wondering what is QEmployee class. Employee class is a simple DTO object. QEmployee is where all meta-information of Employee class is stored. In JPA usually JPA Providers have an Annotation Provider that read annotated model classes and generates Meta-model classes. In JDBC, there are no annotated model classes, but an alternative mechanism is provided for generating these classes. QueryDSL provides an ANT-task, a Maven-Task, and a Plain API. I will show you plain API configuration and same values should be provided for ANT and Maven tasks.

You must specify as input parameters, a connection to database and which schema contains business model. And as output parameters, which package should be generated meta-model classes, and root source code directory. The best approach for generating these classes is using Maven, so before compile goal is executed, all meta-data model is generated.

And Spring Application Context class looks as simple as:

Now you can take all benefits from using DSL for queries in JDBC applications.

'Cos The Only Thing Misplaced Was Direction And I Found Direction There Is No Childhood's End (Childhoods End - Marillion)

JSR 203 is a new specification implemented in JDK 7, and is about NIO 2.0. JSR 203 defines three points of improvement:

• Filesystem interface.
• Complete Socket-Channel Functionality.
• Support for Asynchronous I/O.

In this post I will talk about filesystem interface, because there are new classes that implements some file functionalities that more often than not I had developed myself in projects. In summary we will take a look to Path class and Files class.

Path is "an object that may be used to locate a file in a file system. It will typically represent a system dependent file path". Well in common language a path is the route to a resource. More or less like old File class, in fact java.io.File has a new method toPath() that returns a Path instance.

Files class is an utility class that implements common file operations like creating, finding (you say finding? yes), deleting, reading contents ...

For me typical operations that are implemented in Files class are:

* Delete a file (/tmp/test/sec.txt)

Path file = Paths.get("/tmp/test", "sec.txt");
Files.delete(file);

Files.delete method deleates passed file path, and that's important because with not empty directory a DirectoryNotEmptyException is thrown.

And how about deleting a directory with contents? let me introduce another new concept. FileVisitor interface. Files class has a method for walking along all directories tree. This is useful if you wanted for example implements the tree *nix command (prints all directory structure for given root directory). But in my case I will implement a complete delete function (*nix equivalent command would be rm -Rf /tmp/test).

Previous code is equivalent to command rm -Rf /tmp/test. SimpleFileVisitor is an implementation of FileVisitor. It implements default behavior for all FileVisitor methods, and in this case we override visitFile for deleting files. After all files of current directory are visited postVisitDirectory method is called and current directory can be deleted safetly. See that the result in this case is CONTINUE (continuing walking through tree, but as you can imagine you have other options like SKIP_SIBLINGS, SKIP_SUBTREE or TERMINATE).

* Copy a File

Files class has three main methods for copying files. It is important to note that you can copy files and directories, however files inside the directory are not copied, so the new directory is emptied even when the original directory contains files. 

Files.copy(source, target, REPLACE_EXISTING);

Moreover two methods are also present for copying files. Files.copy(InputStream, Path, CopyOptions...) and Files.copy(Path, OutputStream). As you can imagine first method takes an inputstream and copy its content into given Path, and the second one, reads given Path and sends file content to passed outputstream.

Same is applied for Files.move(Path, Path, CopyOption...).

For copying all directory structure with their files, a FileVisitor could be implemented as in previous example.


* Manage Metadata Information

Two main classes are created for managing files metadata. One class for reading metadata attributes like permissions, is hidden, is read-only, owner, modified-time, ... Because each OS manages file attributes in different manner, an implementation of that class are provided for each OS. For example there is an implementation for DOS systems, another one for POSIX systems, or even a helper class for implemting yourself attributes reader.

Posix example for printing group which belongs given Path:

The other class is FileStore. A FileStore represents a storage pool, device, partition, volume, concrete file system or other implementation specific means of file storage. This class is used for calculating disk usage.

* Reading, Writing, Random Access

Files class has methods for creating inputstreams, outputstream, readers, channels, ... because this features are not new I won't explain extensively. For example for acquiring an InputStream instance Files.newInputStream, Files.newOutputStream, ...

* Symbolic and Hard Link

With NIO 2.0 you can create a symbolic link http://en.wikipedia.org/wiki/Symbolic_link or a hard link http://en.wikipedia.org/wiki/Hard_link from a path.

Creating a symbolic link to a directory:

Creating a hard link to a file:

* Finding Files

Sometimes my programs should find all files with extension xml contained in a directory and manage them (for example create a zip with them). Before java NIO 2, a FileFilter was created and then create a matcher for only selecting those with xml extension. Now PathMatcher class can be used instead of creating yourself matcher. This matcher accepts Glob Syntax http://en.wikipedia.org/wiki/Glob_(programming) or Regular Expression. Glob syntax is easy to use and flexible and most of us have been used  (in console operations) although we didn't know it was Glob Syntax.

Let's implement the next *nix script ls -R *.html in java.

As you can see this implementation of FileVisitor follows all directories structure finding all html files. See that there are two important lines:

matcher = FileSystems.getDefault().getPathMatcher("glob:*.html");

where we are creating a matcher that only returns true if file ends with html.

if (name != null && matcher.matches(name))

that returns true if current file matches the the glob condition.

Thanks of FileVisitor and PathMatcher this routine can be reused for any kind of files (modifying glob expression). Think now if you should do the same with java.io.File class, you would create a FileFilter where if you wanted to create a flexible solution you should create a Pattern Matcher, iterate over matches, and deal with recursive navigation through directory tree. See with PathMatcher how easy is changing between selecting all files ending with html extension to selecting all files starting with word 'Test'.

* Watcher Service

This new feature is really useful for receiving events when a directory has been changed by creation, modification or deletion of a file. Before NIO 2.0 you should create an "infinite-loop" that was watching if a new file was created. And this was done listening all files and comparing modification date or comparing with previous loop execution. Now this service automatizes all logic, and simply throws an event when registered change occurs.

Two final notes, first is that events are only thrown for files not for directories, and second one, watch service is not recursive, so it will only throws an event in case of files created into /tmp not /tmp/my-directory. As with all java NIO 2.0 you have FileVisitor interface for dealing with recursive directory tree.


* Determine MIME Type

If your application requires to know MIME type, Files class  has a probeContentType. The implementation of this method is highly platform specific and is not infallible.

Path path = Paths.get("/tmp/dataset.xml"); System.out.println(Files.probeContentType(path));

It returns text/xml.


And those are all new features of NIO 2 that have changed my developer life when I have to develop an application where managing files are required. I wish you find them as usually as I do.

Teo Torriate Konomama Iko Aisuruhito Yo Shizukana Yoi Ni Hikario Tomoshi Itoshiki Oshieo Idaki

This week I have reached 10K visits. I would like to say thank you to everyone who have read this blog.

Also I would like to dedicate to Japanese people, and all heroes of Fukushima, without them the disaster could have been worse. 

I wish I will reach 25K visits as soon as possible and I could explain it with better news.

Alex.

A Te Che Sei Il Mio Grande Amore Ed Mio Amore Grande

Maven Verifier Plugin, is a Maven Plugin that is used for verifying the existence of certain conditions into files content. These conditions are expressed in form of regular expression, so if regular expression is matched in defined resources content, no error is showed, if not, build fails and error message is shown indicating which file does not matches the given expression.

Why I find this plugin useful? Usually my projects have three execution environments, one for unit testing, another for integration/acceptance test and production one. As you can imagine, each one has its configuration, like database configuration. Each environment has a different database, for example unit testing has a HSQL engine, while integration and production have a PostgreSQL. For dealing with that problem I usually create three different Spring files, each one loading required properties, and depending on environment, the applicationContext is modified for importing required resources. Let's look another example, in my work, I develop planners for instruments, in integration tests, an emulator is used, while in acceptance tests and production, as you can imagine we are using a real instrument. For that reason, we must inject into our business objects, which driver to use (emulator driver or real driver), and as you can imagine two spring files are created and are imported into application context depending on the stage of building.

The problem with changing importing files in applicationContext depending on environment, resides that implies a manual human process, and because it is human, an error can occurs and delivery a version with incorrect configured application context. Meanwhile Spring Framework 3.1 is not released as stable version (Spring Profiles would resolve that problem), Maven Verifier Plugin can help us to avoid that problem.

In our Continuous Integration System, one of our steps before releasing a version is check that all configuration files are configured with correct values, keep in mind that I have showed only two examples, but some other values are changed between development environment and production environment, like time constants, file locations, log level ... Thanks of that plugin this checking procedure is executed automatically.

Let's see an example:

First of all pom.xml must be configured for using Maven Verifier Plugin:

<verificationFile&gt; tag is where you configure which files should be verified and which rules should be applied.

And verifications-rules.xml:

In this example we are verifying that property-placeholder defined in applicationContext.xml are loading properties from META-INF/spring and not from any other location. Same approach can be used for verifying injected beans, constants, log level ... case that any verification does not matches, the build result would be a fail.

Although I always though myself "hey men this could not happen to me", one day, and you don't know whyhappens, and you upload code not correctly configured, and when VVT department starts verifications, project starts to crash, and then all test protocol should be cancelled, you must change one line, upload one line change to repository, re-deploy all application, and start again.

Since that day, I always create a regular expression for assuring that when my code is deployed for production, all configuration files contains correct values.

When Spring Framework 3.1 sees the light all will be different, meanwhile and for legacy code, try Maven Verifier Plugin.

Sa Zebra Que Passa Un Semàfor I Com Se Desmunta Un Bidet, Cosmètics I Margaret Astor, Ja Sé Com S´escriu Juliette!!!

JDK 7 is coming, yes finally it seems that will see the light, without some really nice features like Closures, but with other nice improvements, like NIO 2.0, Project Coin, or auto-close resources. One new features that I really like is the inclusion of new concurrency classes specified in jsr166y. In this post I will summarize these new classes that can help us in parallel programming using Java.

Let's make a brief introduction of new classes and creates a simple example:


Interface TransfereQueue with its implementation LinkedTransferQueue. TransferQueue is a BlockingQueue which producers may wait until consumer receives elements. Because it is also a BlockingQueue, programmer can choose to wait until consumers receives elements (TransferQueue.transfer()) or simply put the element without waiting as done in jsr166 (BlockingQueue.put()). This class should be used when your producer sometimes await receipt of elements, and sometimes it should only enqueue elements without waiting.

An example where producer is blocked until consumer polls an element:





And the output is:
Before Transfer.
<producer thread wait 5 seconds>
Before Consumer.
Hello World!!
After Consumer.
After Transfer.
But what's happen if I change transfer call to put call? The output is:
Before Transfer.
After Transfer.
< producer thread wait 5 seconds>
Before Consumer.
Hello World!!
After Consumer.
Producer finishes its work just after enqueue Hello World message.

Class Phaser. This class is like CyclicBarrier class because it waits until all parties reach barrier point for continuing thread execution. The difference is that Phaser class is more flexible. The number of parties are not static like CycleBarrier, one can register and deregister dynamically at any time. Also each Phaser has a phase number which enables independent control of actions upon arrival at a phaser and upon awaiting others. New method like arrive, awaitAdvance are provided. In termination state Phaser also provides a method for avoiding termination, this method by default returns true, meaning that when all parties reach the barrier point barrier is terminated, but overriding onAdvance method you could modify this behavior, doing that all threads perform an iteration over its task.

Let's see an example of using Phaser as CountDownLatch, but as you notice some differences can be observed, first of all is that we initialize Phaser to 1 (self Thread) and then we register each parties dynamically. With CountDownLatch we should done the same but initializing statically to 15+1. arriveAndAwaitAdvance has the same behavior as we call CyclicBarrier.await, and getArrivedParties() returns how many parties have arrived to barrier point. See that in following example when second party arrives, does not call arriveAndAwaitAdvance() but calls arrive, this method notifies to Phaser that it has arrived to barrier point but it will not block, it is going to execute some extra logic, and only after that it will wait until all other parties have arrived to barrier point, calling method awaitAdvance.

I suppose you are wondering what is the returning value of  arrive method. Phaser.arrive method is the responsible of notifying that thread has arrived to barrier point and returns immediately. And it returns a phaser number. Phaser Number is an integer managed by Phaser class, initially is 0 and each time all parties arrive to a barrier point, that phaser number is incremented. Phaser.awaitAdvance stops thread execution until current phase number has been incremented.




Output of previous program:
Hello World 2
Hello World 0
<Thread that prints Hello World 0 are executing Thread.sleep(5000) >
Hello World 6
Hello World 10
Hello World 1
Hello World 3
Hello World 8
Hello World 4
Hello World 13
Hello World 11
Hello World 9
Hello World 14
Hello World 7
Hello World 12
<phase number == 0>
Hello World 5
<phase number == 1>
END
After Sleep
See that After Sleep is executed after all threads have been arrived to barrier point, including "the parent thread".

Class ForkJoinTask interface is a lightweight form of Future. Main intended use of this class is for computational tasks calculating pure functions or operating on purely isolated objects. The primary coordination mechanisms are fork(), that arranges asynchronous execution, and join(), that doesn't proceed until the task's result has been computed.

ForkJoinTask have two abstract implementations that can be extended RecursiveAction and RecursiveTask.  Imagine next isolated problem, we have a square matrix and we want to sum all its values. Imagine that this matrix is huge, and you want to partitioned it into much smaller matrix so calculations can be executed in parallel. For simplifying the problem and showing how to use ForkJoinTask the matrix will be an 2x2 square matrix, that obviously should not be parallelized in normal circumstances.

Sequential algorithm should be:





Result is 10.

And now parallel solution using RecursiveTask.





And of course the output is 10 too. Take a look that we are using ForkJoinPool for specifying the number of computer processors to maximize usage of system resources.
See how trivial solution cuts the recursive tasks returning a valid result,and how in not trivial solution what we are doing is dividing matrix into four small matrix, and executes the sum of these new matrix into different threads (calling fork()) and join method waits until compute method returns a result.


As you can see, there aren't a lot of new classes for concurrency in JDK 7, but I think that these new classes can help in common concurrency problems, specially ForkJoin classes.