Skip to main content

Posts

Showing posts from August, 2014

Creating your own OAuth2 server and clients using spring security - part 3

So now it's time to test our configuration live!

we will need an apache tomcat server and mysql db server, I'll use tomcat 7 and wamp for db

but before that there is a few things to add to make our test meaningful, we will add an mvc-rest controller that will be protected by our security implementation:

https://gist.github.com/anonymous/8d009f61cb6dea140a27

then modify the mvc-dispatcher-servlet.xml to see this new controller by adding:

<context:component-scan base-package="com.blabadi">
<context:include-filter type="annotation" expression="org.springframework.stereotype.Controller"/>
</context:component-scan> which basically tells spring to scan for controller annotation under the base package

important points here:
- spring mvc requires to have a context for its servlets that is different than the context of the application, that's why we have a different configuration files : spring-beans and mvc-dispatcher-servlet.xml

- we d…

Creating your own OAuth2 server and clients using spring security - part 2

so we continue our OAuth2 journey, in this part I plan to explain the entries we have in spring-security.xml

lets start..
first part in the xml file is this: <oauth:resource-server id="resourceServerFilter"
resource-id="custom_app" token-services-ref="tokenServices" /> this defines that this is a resource server (secured information source) for OAuth2, which means this server will be accessed by OAuth2 clients to get infromation/data from.

<oauth:authorization-server
client-details-service-ref="clientDetails" token-services-ref="tokenServices"
user-approval-handler-ref="userApprovalHandler">
<oauth:authorization-code />
<oauth:implicit />
<oauth:refresh-token />
<oauth:client-credentials />
<oauth:password />
</oauth:authorization-server>  this part means that we want to create an authorization server that supports the listed OAuth2 flows:
1- authorization code
2- implicit
3- referesh to…

Creating your own OAuth2 server and clients using spring security - part 1

In this series of posts, I'll try to put together a simple working example on how to create your own OAuth2 server.

if you want to know more on OAuth2 and when to use it as authentication and authorization protocol then you can search about it on google and i'll put some URLs later.

Now I assume you are familiar with java web applications using Spring and maven.

to get started we need to create the server side with all dependencies required and i'll list them here, i'll use maven 2 to ease downloading dependencies for us.


Steps:

1- Create new maven project with arch type webapp:



2- Add the required depenedencies for spring, spring security, spring-oauth2, hibernate & other libraries (required for this tutorial only you can use other libraries if you like)

https://gist.github.com/anonymous/d33a31ddc3ba84375cf3

3- I used hibernate to automate the creation of the schema required by spring OAuth2 to manage tokens (it's required to have schema created in db if you a…

Amazon EC2 - I messed up system file and can't login or fix it

So you tried to be smart ..that's good but you didn't plan ahead

Unix is an OS that can be error intolerant and you can loose the access to your system with a simple change on a file like /etc/sudoers  this file contains infromation and password configuration to ask for password on some commands.

In Amazon EC2 you don't have root password so if you configure that file to require password on some commands like 'sudo' command itself that is required to access this file, you will be locked and can't revert back to the changes.

there is a way though to go around this problem, and basically it's by creating a new instance and attach the broken instance volume to this instance as device and fix what's wrong then relaunch your broken instance.

for example to fix a change on sudoers file with this solution follow the following steps:

1- stop instance we want to fix
2- de-attach it's volume
3- attach it to the new instance [/dev/sdh]
4- start new instance
5-…

EJB called from another, specifically Message driven bean with container transaction.

The other day I had a weird defect in the application I worked on, we had a Message driven bean [MDB] calling another EJB inside the message processing code and everything was working fine and passed two different testing periods.

after going live on production something happened, the MDB received a message and invoked the EJB to do some work, that work included calling a web service, this service client thrown time out exception and thrown an exception and the EJB couldn't finish its work because that's what is expected, the weird thing is that the exact same message was reprocessed by the MDB automatically.. we don't have anything in our code that did that.

this didn't happen before with other EJBs called from an MDB..

after thorough investigation I found the following :

1- The MDB uses container transaction [ found configuration in the ejb-jar.xml] (this is used in EJB2)
2-  The EJB method that was invoked also had container transaction configured with transaction a…

Object Oriented Programming .. complex or overrated

In Second year computer science major, I took a whole course on object oriented programming with Java, It was full of new concepts back then and the book was big, but now recently I have been reading a book called growing 'object oriented software guided by testing' .

it has been 3 years since I have graduated and worked in 3 different companies, and while reading that book, the idea that there are so many details and concepts in object oriented that we barely feel we are applying or use in enterprise or medium or small scale applications was on my mind the whole time.

OOP has taken its name from the basic unit of the design which is Objects. However in real applications objects play minor roles and most of the time as VOs (value objects) so the whole concept of objects becomes minor in you're everyday work, there is nothing new about it. Another point is that these objects code are usually IDE generated, for example in eclipse if you're programming Java it takes less …