This first presentation will take about one hour and will be held at Bucharest Hubb.

Highlights:

• General Overview
• SDK Features
• Uniqueness
• Application Architecture and Life Cycle
• Activity Life Cycle
• Creating Applications
• Start building ATPNews – small application that brings the latest from APT World Tour

See you there on April the 13th, at 6.30 PM!

This post documents two possible approaches on how to use HttpURLConnection and particularly KSOAP2 to repeatedly communicate with a server over HTTPS.

Briefly, KSOAP2 uses HttpURLConnection object to communicate with the remote source. First the connection is created and afterwards this connection is used to send requests and receive response information:

.....
HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
.....
connection.setRequestProperty("Connection", "close");
.....
connection.setRequestMethod("POST");
.....
connection.connect();

OutputStream os = connection.openOutputStream();
os.write(requestData, 0, requestData.length);
os.flush();
os.close();

InputStream is = connection.openInputStream();
.....

This mechanism proved to work without any issues when the communication was on HTTP. On HTTPS though, a quite strange behavior was experienced. The first call worked as expected, but on a second attempt, even if using the same class instance or creating a separate instance of it, the connection was not being made. Moreover, no data was sent to the server and an empty response came back without throwing any exception.

What the documentation says

Usually when an application finishes reading the response body or when an application calls close() on the InputStream returned by URLConnection.getInputStream(), the JDK’s HTTP protocol handler will try to clean up the connection and if successful, put the connection into a connection cache for reuse by future HTTP requests.

The support for HTTP keep-Alive is done transparently. However, it can be controlled by system properties http.keepAlive, and http.maxConnections, as well as by HTTP/1.1 specified request and response headers.

The system properties that control the behavior of Keep-Alive are:

• http.keepAlive
  default: true

  Indicates if keep alive (persistent) connections should be supported.

• http.maxConnections
  default: 5

  Indicates the maximum number of connections per destination to be kept alive at any given time.

HTTP header that influences connection persistence is:

• Connection: close

If the “Connection” header is specified with the value “close” in either the request or the response header fields, it indicates that the connection should not be considered ‘persistent’ after the current request/response is complete.

Solutions

Having read the previous section, there are two possible solutions:

• Set the http.keepAlive system property to “false” before creating the connection, if the “Connection” header specifies that the connection is not persistent.

  .....
  System.setProperty("http.keepAlive", "false");
  HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
  .....
  

• Do not set the “Connection” property to “close”.

In this post I will pass the database server installation steps (that can be found in various other sources, e.g. Oracle Documentation) and focus on the final steps that need to be accomplished to actually start the server. If on a Windows server this job is automatic, as the Oracle database server (re)starts on its own, on a Linux box, there are a few manual command line commands that need to be provided in order to (re)start it.

Below there are the exact steps a user must fulfill in order to (re)start an Oracle database server on a Linux machine, particularly on Ubuntu. The Oracle database server I am currently using is 10.2.0 but the steps are likely to be quite similar for newer versions.

• Change to oracle user. If not logged as root, the system will ask for the sudo password.

  $ sudo su oracle
  
  Password:  <enter the password>
  

• Start the LISTENER

  [oracle] $ lsnrctl start
  
  LSNRCTL for Linux: Version 10.2.0.1.0 - Production on 02-MAR-2010 10:09:10
  
  Copyright (c) 1991, 2005, Oracle.  All rights reserved.
  
  Starting /home/oracle/oracle/product/10.2.0/db_1//bin/tnslsnr: please wait...
  
  TNSLSNR for Linux: Version 10.2.0.1.0 - Production
  System parameter file is /home/oracle/oracle/product/10.2.0/db_1/network/admin/l istener.ora
  Log messages written to /home/oracle/oracle/product/10.2.0/db_1/network/log/l istener.log
  Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1)))
  Listening on: (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=<host.domain>  )(PORT=1521)))
  
  Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
  STATUS of the LISTENER
  ------------------------
  Alias                     LISTENER
  Version                   TNSLSNR for Linux: Version 10.2.0.1.0 - Production
  Start Date                02-MAR-2010 10:09:12
  Uptime                    0 days 0 hr. 0 min. 0 sec
  Trace Level               off
  Security                  ON: Local OS Authentication
  SNMP                      OFF
  Listener Parameter File   /home/oracle/oracle/product/10.2.0/db_1/network/admin/listener.ora
  Listener Log File         /home/oracle/oracle/product/10.2.0/db_1/network/log/listener.log
  Listening Endpoints Summary...
    (DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1)))
    (DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=<host.domain>)(PORT=1521)  ))
  Services Summary...
  Service "PLSExtProc" has 1 instance(s).
    Instance "PLSExtProc", status UNKNOWN, has 1 handler(s) for this service...
  The command completed successfully
  
  The above steps may be useful also after a new instance has been installed and the Oracle server needs to be launched.
  

• Connect as sysdba to the instance

  [oracle]$ sqlplus connect as sysdba
  
  SQL*Plus: Release 10.2.0.1.0 - Production on Tue Mar 2 10:10:52 2010
  
  Copyright (c) 1982, 2005, Oracle.  All rights reserved.
  
  Enter password: <enter the database password>
  Connected to an idle instance.
  

• Start the server from SQL Plus command line

  SQL> startup
  
  ORACLE instance started.
  
  Total System Global Area 4294967296 bytes
  Fixed Size                  2026296 bytes
  Variable Size             654312648 bytes
  Database Buffers         3623878656 bytes
  Redo Buffers               14749696 bytes
  Database mounted.
  Database opened.
  

• After the above feed-back is obtained, exit SQL Plus

  SQL> exit
  
  Disconnected from Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
  With the Partitioning, OLAP and Data Mining options
  

• Start SQL Plus

  [oracle] $ isqlplusctl start
  
  iSQL*Plus 10.2.0.1.0
  Copyright (c) 2003, 2005, Oracle.  All rights reserved.
  Starting iSQL*Plus ...
  iSQL*Plus started.
  

• Start the Enterprise Management Console

  [oracle] $ emctl start dbconsole
  
  TZ set to Europe/Bucharest
  Oracle Enterprise Manager 10g Database Control Release 10.2.0.1.0
  Copyright (c) 1996, 2005 Oracle Corporation.  All rights reserved.
  
  http://host.domain:1158/em/console/aboutApplication
  
  Starting Oracle Enterprise Manager 10g Database Control ........................... started.
  ------------------------------------------------------------------
  Logs are generated in directory /home/oracle/oracle/product/10.2.0/db_1/host.domain_orcl/sysman/log
  

• Exit oracle account

  [oracle] $ exit
  

After performing all these steps and receiving command responses similar to the ones above, the Oracle database server should eventually be up and running.

In this post I will give a short overview on Web Services security using digital certificates, a possible Web Services security approach and afterwards, the commands used to import the certificate files.

Web Services Security Overview

As is true of all network-oriented information technologies, the subject of security is a crucial one for web services. For web services, as for other information technologies, security consists of understanding the potential threats an attacker may mount and applying operational, physical, and technological counter measures to reduce the risk of a successful attack to an acceptable level. Because an “acceptable level of risk” varies hugely depending on the type of transaction, and due to the costs of implementing counter measures is also highly variable, there can be no universal “right answer” for securing web services. Choosing the absolutely correct balance of counter measures and acceptable risk can only be done on a case by case basis.

The confidentiality of the exchanged data must be always taken seriously and so the security measures that must be put in place to provide the appropriate security. The W3C (World Wide Web Consortium) Web Services Architecture Requirements outlines the following six important security considerations for a comprehensive security
framework:

• Authentication: guarantees that the service is accessible for anyone with a verified identity.
• Authorization: guarantees that the authenticated person has the right to access the service or data.
• Confidentiality: guarantees that the data passed between the requester and provider is protected from eavesdroppers.
• Integrity: offers that the message was not modified in its path from requestor to provider.
• Non-repudiation: guarantees that the sender of the message cannot deny that he/she sent it at a later point in time.
• Accessibility: ensures that the service is always accessible and that it is not impaired by attacks, like denial-of-service (DoS), from outside or inside of the system hosting the service.

To address these requirements digital certificates are used. A digital certificate is an electronic “credit card” that establishes the credentials when doing business or other transactions on the Web. Usually, it is issued by a certification authority (CA) and contains information like the holder’s name, a serial number, expiration dates, a copy of the certificate holder’s public key (used for encrypting and decrypting messages, and digital signatures) and the digital signature of the certificate-issuing authority so that a recipient can verify that the certificate is real.

Possible Web Services Security Policy

Usually, the security provisions are put in place to address the above requirements, as well as:

• Peer Identification and Authentication
• Data Origin Identification and Authentication
• Data Integrity
• Data Confidentiality

Web Services transactions take place using SOAP over any transport protocol such as HTTP. The server security framework may consist of a transport protocol layer and a SOAP message layer.

Transport Protocol Layer Security may use the simple HTTPS with SSL encryption between consumer and provider and X.509 certificate issued by a verifiable Certificate Authority (CA). Mutual authentication facility of HTTPS may be also assured for more sensitive transactions permitting the server to authenticate the consumer for non repudiation.

The server interface may use digital certificates to verify the request received from the customer system. This may be performed by checking the digital signature provided with the request against the digital certificate information provided by the client application. The digital signature may be a hexadecimal string calculated by the client’s system based on the contents of the request and the digital certificate information. The server gateway can then perform the same calculations and verify whether the request is authentic.

Importing the Server Root Certificates

1. Locate the local machine JRE file that is used to store the root certificates of signing authorities. It is usually located in JAVA_HOME/jre/lib/security/cacerts. It is stored in JKS format and should contain only certificates of the CAs that are trusted. Since it is a binary file it may be handled using the keytool utility. For viewing its content issue the following command:

   keytool -list -keystore JAVA_HOME\jre\lib\security\cacerts
   

   The default password for the cacerts file is changeit.

   Enter keystore password:
   
   Keystore type: JKS
   Keystore provider: SUN
   
   Your keystore contains 67 entries
   
   aolrootca2, Mar 26, 2008, trustedCertEntry, Certificate fingerprint (MD5): D6:ED:3C:CA:E2:66:0F:AF:10:43:0D:77:9B:04:09:BF
   deutschetelekomrootca2, Nov 7, 2008, trustedCertEntry,	Certificate fingerprint (MD5): 	74:01:4A:91:B1:08:C4:58:CE:47:CD:F0:DD:11:53
   ………………
   

2. Import the server side root certificates into the cacerts file of the JRE’s client machine by issueing the following command:

   keytool -import -trustcacerts -keystore cacerts -file <name_of_certificate>.cer -alias <file_alias>
   

Since Spring DispatcherServlet and Controllers treat views in an implementation-agnostic manner I thought of defining a view that presents the picture without impacting the Controller code which actually creates the picture object. This is possible by implementing the top most interface of the Spring views hierarchy – org.springframework.web.servlet.View.

public interface View {
   void render(Map model, HttpServletRequest request, HttpServletResponse response) throws Exception;
}

By implementing the interface, it means that given the model and the information on the request a view will generate the output that is rendered in the response.

Straightforward Approach

The simple approach would be to directly implement the View interface and by this inside the render method to delegate the view to both generate the content and return it to the client.

public class ByteArrayView implements View {
   public final void render(Map model, HttpServletRequest request, HttpServletResponse response) throws  Exception {
      File file = new File("C:\\image.jpg");
      FileInputStream fis = new FileInputStream(file);
      byte[] buffer = new byte[fis.available()];
      fis.read(buffer);
      fis.close();
      response.setContentType("image/jpeg");
      response.setContentLength(bytes.length);

      ServletOutputStream out = response.getOutputStream();
      out.write(bytes);
      out.flush();
   }
}

In this manner, the very basic requirement of the view is fulfilled, but the decoupling from the corresponding controller is not accomplished.

Decoupled Approach

Usually, creating the views programmatically is not a common option. Instead, views instances are defined in the configuration file and created automatically by the Spring framework.

Going into this direction, after researching among several blogs and Spring forums, I found a solution that creates an abstract Controller able to handle resources of any content type (image/jpeg, text/html, x-application/pdf).

public abstract class AbstractContentTypeController extends AbstractController {
   private String viewName;
   private String contentType;

   protected abstract byte[] getData(HttpServletRequest req) throws Exception;

   @Override
   protected ModelAndView handleRequestInternal(HttpServletRequest req, HttpServletResponse resp) throws Exception {
      Map model = new HashMap();
      if (getContentType() == null)
         throw new IllegalArgumentException("contentType property must be set.");
      if (getViewName() == null)
         throw new IllegalArgumentException("viewName property must be set.");

      model.put("data", getData(req));
      model.put("contentType", getContentType());
      return new ModelAndView(getViewName(), model);
   }
   …
}

The controller that extends AbstractContentTypeController is injected two properties, one that specifies the content type of the resource (image/jpeg, here) and the view name that will render it (let’s call it img). Also, it defines the getData() method, that is entitled to create the resource (the image in this particular situation).

public class ImageController extends AbstractContentTypeController {

   @Override
   protected byte[] getData(HttpServletRequest req) throws Exception {
      File file = new File("C:\\image.jpg");
      FileInputStream fis = new FileInputStream(file);
      byte[] buffer = new byte[fis.available()];
      fis.read(buffer);
      fis.close();
      return buffer;
   }
}

The corresponding custom view is extended from AbstractView and has the responsibility of taking the image from the model and writing it to the response.

public class ByteArrayView extends AbstractView {

   public ByteArrayView() {}

   @Override
   protected final void renderMergedOutputModel(Map model, HttpServletRequest request, HttpServletResponse response) throws Exception {
      byte[] bytes = (byte[]) model.get("data");
      String contentType = (String) model.get("contentType");
      response.setContentType(contentType);
      response.setContentLength(bytes.length);

      ServletOutputStream out = response.getOutputStream();
      out.write(bytes);
      out.flush();
   }
}

In this way, the generation of the resource is the task of the controller, making the view unaware of this operation and also the controller knows nothing of the view.

The content that needs to be added in the xml configuration file is provided below.

<bean id="urlMapping" class="org.springframework.web.servlet.handler.SimpleUrlHandlerMapping">
   …
   <property name="mappings">
      <props>
       …
         <prop key="/imgFile.htm*">imageController</prop>
         …
      </props>
   </property>
</bean>

<bean id="imageController" class="com.asentinel.tem.mobile.ws.web.ImageController">
   <property name="contentType" value="image/jpeg"/>
   <property name="viewName" value="img"/>
</bean>

In order to completely decouple the view from the controller that is to make the controller totally unaware of what type of view will be used to render the model a ViewResolver will be configured in the xml configuration file.

<bean id="byteViewResolver" class="org.springframework.web.servlet.view.XmlViewResolver">
   <property name="order" value="1" />
   <property name="location" value="/WEB-INF/byte-views.xml" />
</bean>

Among the various types of view resolvers that Spring provides, XmlViewResolver was chosen. It creates views based on an XML definition file. This file (/WEB-INF/byte-views.xml) uses the Spring Beans DTD, which has the advantage of making view definitions both familiar and able to use the full power of Spring’s bean factories. The content added to the file for this view is below.

<beans>
   <bean name="img" class="com.asentinel.tem.mobile.ws.web.view.ByteArrayView"/>
</beans>

With this implementation, when a picture is requested by the client application, it simply needs to invoke imgFile.htm URL. On the server sidethe following actions take place:

• DispatcherServlet selects based on the mapping, the ImageController by calling handleRequest() method.
• ImageController creates the image and integrates it in the model object;
• DispatcherServlet invokes the configured ViewResolver (byteViewResolver) which creates the image view configured in the byte-views.xml file;
• DispatcherServlet renders the image found in the model in the corresponding view.

The DispatcherServlet manages the entire operation and the Controller plays no part in resolving the view and is entirely oblivious of the operation.

Conclusion

This post documents and presents a Spring MVC style solution for rendering byte content resources (particularly images), from a server to its requesting clients in a totally decoupled manner.

Before configuring Eclipse and Maven2 to work together, a few prerequisites are needed:

• Install Java 5 SDK or newer;
• Add Java installation directory as a system variable – JAVA_HOME.
• Include %JAVA_HOME%/bin the PATH system variable.

Installing Eclipse

Usually the following steps need to be performed:

• Download Eclipse distribution from here. The recommended package is Eclipse IDE for Java EE Developers, since it already contains the Eclipse Web Tools (usually needed in web applications).
• Extract the distribution into a directory on your local hard drive. Note that unlike programs, Eclipse does not have an installation process. Once unzipped, it is basically installed.
• Configure your workspace directory – the workspace directory contains the projects developed using the IDE.

Installing and Configuring Maven2

Usually the following steps need to be performed:

• Download Maven2 distribution from here.
• Extract the distribution into a directory on your local hard drive.
• Add Maven2 installation directory as a system variable – MAVEN2_HOME.
• Include %MAVEN2_HOME%/bin into the PATH system variable.

By now, the Maven2 installation it is complete and may be tested. If everything was configured as advised, when issuing

mvn –version

command in the system command prompt, an output similar to the below one should be displayed:

Maven version: 2.0.9
Java version: 1.5.0_15
OS name: "windows vista" version: "6.0" arch: "x86" Family: "windows"

After the previous steps are completed Maven2 will have created a local repository, usually under %HOME_PATH%/.m2

Installing Maven2 Plug-in inside Eclipse

Usually the following steps need to be performed:

• Add the Maven2 repository (%HOME_PATH%/.m2/repository) as user variable – MAVEN2_REPOSITORY.
• Create settings.xml file in the %HOME_PATH%/.m2/ directory. This file usually contains user-specific parameters that should not be shared by all users. If the application development is behind a firewall with a proxy, the proxy settings need to be configured so that Maven can download JARs from repositories on the Web. Add the following content to the file:

  <settings xmlns="http://maven.apache.org/POM/4.0.0"
            xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
            xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
  
  http://maven.apache.org/xsd/settings-1.0.0.xsd">
  
     <localRepository/>
     <interactiveMode/>
     <usePluginRegistry/>
     <offline/>
     <pluginGroups/>
     <servers/>
     <mirrors/>
     <proxies/>
     <profiles/>
     <activeProfiles/>
  </settings>
  

• From Eclipse:
  • Go to Help – Software Updates, Available Software tab and click the Add Site button.
  • Provide http://m2eclipse.sonatype.org/update/ URL.
  • After the sites appear, accept the license agreement and click Install All.

• Open a command prompt window and inform Eclipse about the local repository by issuing:

  mvn -Declipse.workspace=<path-to-eclipse-workspace> eclipse:add-maven-repo
  

Inside repository, a lot of JAR files are downloaded by maven.

Creating the Web Project

In order to perform this, both the command prompt and Eclipse will be used. Usually the following steps need to be performed:

• From command prompt, go to the workspace directory of Eclipse.
• Perform:

  mvn archetype:create -DgroupId=com.mycompany.domain -DartifactId=proj_name -DarchetypeArtifactId=maven-archetype-webapp
  

After the command finishes, a directory called proj_name is created inside the workspace. This directory contains a pom.xml (Project Object Model) file and a Maven2 project structure.

• Go to proj_name directory.
• Perform

  mvn compile

  to compile the project.

• Perform

  mvn package

  to create the application WAR file in the target directory.

• Perform

  mvn eclipse:eclipse

  to create the .project and .classpath files for Eclipse.

• From Eclipse:
  • Press File – Import, select Maven Projects from the list of projects and select the proj_name directory.
  • In Package Explorer tab, right-click on proj_name project and chose Maven – Enable dependency Management.
  • Right-click on proj_name project and chose Maven – Update Project Configuration;

Some additional steps that may be required to successfully compile and run the project:

• Inform the project to use J2SE JDK as the JRE system library.
• Set the Java Compiler compliance level to at least 1.5 and also synchronize the Java Project Facets to this version.

For more information on Maven2 and its commands the following resources may be useful:

• An Introduction to Maven2, a JavaWorld article by John Ferguson. 

• Maven Project Documentation