Finding the ring in the Land of Mordor

Loosing himself in the World Wide Web looking for the right search terms, Ted falls asleep and starts dreaming…

He finds himself in a bare cold land – alone and freezing, only with his Modeling IDE on his laptop. In the far distance he sees his destination: Mount Doom. A shiver runs down his spine. But being a brave developer, Ted starts to find his way through the Land of Mordor. He keeps his distance from all the beasts, struggeling to find his path. His idea: separating model and code! But then, some rather deep pitfalls are becoming evident, more and more single guards (like his team mates) are gathering. The horde is rising! Finally, a good man comes along, a sage. He tells Ted to think of the solution, not the problem. “Ted, you need help to find your way through Mordor. Find your Sam!”

Suddenly, Ted wonders why his modeling tool is no aid at all. It screws up his changes when generating code and jumbles his model when reverse engineering. “What if it was never meant to match model and code?” For a second Ted’s pale grey laptop seems to have a wicked evil grin.

At the orc camp

Ted takes a rest to think his mission through. An idea is growing in a corner of his mind. He needs help, he needs another tool! Being a good software engineer, he starts to work out his solution. He starts to build yet-another-case-tool! His idea, now: matching code and model as he, the typical enterprise software developer, wants! Ted thinks about pattern and best practices, about all the things his tool will be able to do. He gets really excited about his tool, his precious tool – his one ring…

At the beginning, Ted works out a new kick-ass code generator. In fact, there are many pretty good code generators out there as Ted knows, but he wants his own precious “friend”. So, Ted works hard until it is done. His ring … err, tool … uses templates for code generation. They allow him to stay agile by adapting the code generation to his changing project needs. He develops his own template language – instead of using Xpand/Xtend.

Then, Ted starts working on the reverse engineering: first, he builds a tool to merge all his code changes back into his model. Just having finished (and being a bit jumpy), Ted starts running his tool – and it works! All his code changes were transferred into his model. The model grew and became more detailed. But then, Ted realizes the problem: his model got flooded with implementation details. Getters, setters, toString, iteratorOfStuff … they all got into his pure model – his beautiful clear model, it became ugly and senseless.

After thinking of protected regions – and discarding this non-solution –, Ted starts writing a parser. The parser is meant to recognize code patterns and merge them back into his model. After reverse engineering his project again, Ted gets really excited. “Yes, I did it!” His model looks as expected, pretty and simple, – and it seems to contain his manual changes, doesn’t it? So, Ted continues developing by modeling some more classes, changing some property names and dragging some new associations. Generating code again, the word “easy” crosses his mind. Still dreaming, Ted takes a look at the code: “FFFFUUUUUUUUUU… What a nightmare!” His precious tool screwed up his code again! Somewhere in the guts of the parser there is a mismatch between the details the code generator adds to the code and the details the parser hides from the model.

Suddenly, it hits Teds mind: “Why not useing the same code generation templates for reverse engineering?”

Awakening

Ted awakes with a start and does a quick google search for “template-based round-trip-engineering”: … “Hmm, a scientific paper… another one … come on, I just had that idea, it ain’t rocket science! Wait, what’s that? UML Lab?”

*clicketiclick*

Ted quickly skimms the section on “Round-Rrip-Engineering NG”. Having a look at the screenshots and videos, he decides to download UML Lab ( from the eclipse marketplace | as a RCP ). The tool tour takes him through a simple example, giving him an idea of template-based reverse engineering, modeling, code generation and hacking. He leans back smiling, finally having reached his goal: truly agile modeling and coding.

His nightmare long forgotten, Ted ( coded | modeled ) happily ever after.

1. Use SecurityContext in your Java code to access the authentication information.
2. To enable HTTP Basic Auth add a <security-constraint> section to your web.xml
3. Map user roles to GlassFish groups by creating a sun-web.xml
4. Configure a FileRealm / JDBCRealm in GlassFish to store user passwords

I will detail the steps with a simple deleteRating() example and xml snippets.

The REST bean

First, let me show you the current deleteRating() implementation:

import javax.ws.rs.DELETE;
import javax.ws.rs.Path;
import javax.ws.rs.PathParam;
import javax.ws.rs.core.Context;
import javax.ws.rs.core.Response;

@Path("/api/")
public class RestBean {

    @DELETE
    @Path("ratings/{id}")
    public Response deleteRating( @PathParam("id") int id ) {
        // code here: delete the rating, no matter what
    }

}

Right, no security whatsoever. We need to change that!

Security annotations in the Java Code

To access the authentication information we have to add the @Context:

import javax.ws.rs.core.Context;
import javax.ws.rs.core.SecurityContext;
//...

@DELETE
@Path("ratings/{id}")
public Response deleteRating( @PathParam("id") int id, @Context SecurityContext context ) {
    String username = context.getUserPrincipal().getName();
    // code here: check if he is the owner of the rating
    // code here: deny the request or
    // code here: delete the rating
}

Using the SecurityContext we can get the authenticated username and start the authorization. So much for the easy part. On to xml configuration hell!

Security constrains in the web.xml

The SecurityContext remains useless until we add a <security-constraint> section to the web.xml. Eric Warriner has written up a tomcat example which leads to something like this:

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" id="WebApp_ID" version="2.5">
  <display-name>your service name</display-name>
  <welcome-file-list>
    <welcome-file>index.html</welcome-file>
  </welcome-file-list>
  <servlet>
    <servlet-name>Jersey REST Service</servlet-name>
    <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
    <init-param>
      <param-name>com.sun.jersey.config.property.packages</param-name>
      <param-value>de.uks.nt2od.service</param-value>
    </init-param>
    <!-- to use JSR 250 Role Based Authentication and annotations
         like @RolesAllowed uncomment the next init-param section -->
    <!--init-param>
      <param-name>com.sun.jersey.spi.container.ResourceFilters</param-name>
      <param-value>com.sun.jersey.api.container.filter.RolesAllowedResourceFilterFactory</param-value>
    </init-param-->
  </servlet>
  <servlet-mapping>
    <servlet-name>Jersey REST Service</servlet-name>
    <url-pattern>/*</url-pattern>
  </servlet-mapping>

  <!-- which resources should be protected -->
  <security-constraint>
    <web-resource-collection>
      <web-resource-name>Secure</web-resource-name>
      <!-- be specific about the urls and methods here -->
      <url-pattern>/api/ratings/*</url-pattern>
      <http-method>DELETE</http-method>
    </web-resource-collection>
    <auth-constraint>
      <description>has to be a USER</description>
      <role-name>USERS</role-name>
    </auth-constraint>
  </security-constraint>

  <!-- which realm to use for basic auth -->
  <login-config>
    <auth-method>BASIC</auth-method>
    <realm-name>your_realm_name</realm-name>
  </login-config>
  <security-role>
    <role-name>USERS</role-name>
  </security-role>
</web-app>

This would work in tomcat if a USERS role was defined in the tomcat-users.xml. For GlassFish we are not done yet…

Role mapping in the sun-web.xml

GlassFish uses principals and groups of a realm that have to be mapped to role names for the application.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE sun-web-app PUBLIC '-//Sun Microsystems, Inc.//DTD
Application Server 9.0 Servlet 2.5//EN'
'http://www.sun.com/software/appserver/dtds/sun-web-app_2_5-0.dtd'>
<sun-web-app>
  <security-role-mapping>
    <role-name>USERS</role-name>
    <group-name>USERS</group-name>
  </security-role-mapping>
</sun-web-app>

We are nearly done. Only one step left!

Setting up a GlassFish FileRealm

Open the admin console and navigate to Configuration -> Security -> Realms. Create a new security realm:

You can then add users to the realm which can be authenticated with HTTP Basic Auth as defined in the web.xml.

For a dynamic web application you may prefer to use the JDBCRealm, which is what we are going to set up next for nt2od.

I still need to think of a use for categories … so the site will be in flux a few more days. Lets see how google handles the new url, as http://blog.butonic.de now points to http://butonic.de, the new wordpress installation.

In the process  I also moved from serendipity to WordPress. Mainly because an Android app is availiable. I’ll take this as an opportunity to restart my blogging efforts. So, expect posts more often in the future.

Created by Train Horns

butonic;
n., Any political view or ideology reduced to a slogan designed to fit on a pin, button or other small clothing accessory, as either a symbol or as text. adj.. Describing a political stand which has been reduced, ad absurdam, to fit the limted intellectual or philosophical capacity of its proponent. Also butonism.
(Fr. boutonier: a decorative element worn in a buttonhole)

WTF?!?

I deactivated the fglrx driver and am now radeonhd only … yeah that will keep me from gaming … not a big issue currently anyway …

Here are the instructions to install from git.

Happy holidays!