Basic Authentication/Validation for Webservices using REST API and Interceptors

Hi All,
Thanks for reading this post...

Let's talk about how to implement a set of classes using REST concepts, and basic control access to the WebServices. An interceptor will be responsible for reading the request and manage the access control to the resources.

First of all, it will be necessary to define the pom.xml (maven resources) with the following dependencies:

        <dependency>
            <groupId>org.jboss.spec.javax.ws.rs</groupId>
            <artifactId>jboss-jaxrs-api_1.1_spec</artifactId>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>org.jboss.resteasy</groupId>
            <artifactId>resteasy-crypto</artifactId>
            <version>${resteasy.version}</version>
            <scope>provided</scope>
        </dependency>
       
        <dependency>
            <groupId>org.jboss.resteasy</groupId>
            <artifactId>resteasy-jaxb-provider</artifactId>
            <version>${resteasy.version}</version>
            <scope>provided</scope>
        </dependency>

JBoss EAP 6.4 and Resteasy API 2.3.10.Final were used to validate the sample code.

 - Rest Activator

@ApplicationPath("/rest")
public class WsRestActivator extends Application {
}

- Exception Class

public class ServiceAPIException extends Exception {

   public ServiceAPIException(String message) {
        super(message);
    }

    public ServiceAPIException(Exception e) {
        super(e);
    }

    public ServiceAPIException(String msg, Throwable t) {
        super(msg, t);
    }
}

@Provider
public class ExceptionHttpStatusResolver implements ExceptionMapper<ServiceAPIException> {

    @Override
    public Response toResponse(ServiceAPIException exception) {
        Response.Status httpStatus = Response.Status.INTERNAL_SERVER_ERROR;

        if (exception instanceof ServiceAPIException)
            httpStatus = Response.Status.BAD_REQUEST;

        return Response.status(httpStatus).entity(exception.getMessage()).build();
    }
}

- Annotation to allow access to the Webservice methods

@Documented
@Retention (RUNTIME)
@Target({TYPE, METHOD})
public @interface WsAccessMethodPermition {
}

- Service Abstracttion

public abstract class ServiceRest {

    protected void handleException(String msg, Throwable t) throws ServiceAPIException {
        throw new ServiceAPIException(msg, t);
    }
}

- Security Abstraction for Resource Classes

import java.io.ByteArrayInputStream;
import java.io.InputStream;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

import javax.servlet.http.HttpServletRequest;
import javax.ws.rs.core.MediaType;

import org.jboss.resteasy.security.smime.EnvelopedOutput;


public abstract class SecureResource extends ServiceRest {

    public static final String USER_CERTIFICATE = "user-certificate";
   
    private static CertificateFactory factory;

    static {
        try {
            factory = CertificateFactory.getInstance("X.509");
        } catch (Exception e) {

        }
    }

    protected X509Certificate extractCertificate(HttpServletRequest request) {
        try {
            InputStream is = new ByteArrayInputStream((byte[]) request.getAttribute(
                    SecureResource.USER_CERTIFICATE));
            return (X509Certificate) factory.generateCertificate(is);
        } catch (CertificateException e) {
            return null;
        }
    }
   
    protected EnvelopedOutput encryptResponse(HttpServletRequest request, Object result) {
        X509Certificate certificate = extractCertificate(request);
        return encryptResponse(certificate, result);
    }
   
    protected EnvelopedOutput encryptResponse(X509Certificate certificate, Object result) {
        // Object user = UserContext.getUser(result);
        EnvelopedOutput output = new EnvelopedOutput(
                new Object()/* your user object */, MediaType.APPLICATION_JSON);
        output.setCertificate(certificate);

        return output;
    }

}

- Interceptor

import java.io.IOException;
import java.lang.reflect.Method;
import java.util.HashMap;
import java.util.List;
import java.util.StringTokenizer;

import javax.annotation.security.DenyAll;
import javax.annotation.security.PermitAll;
import javax.inject.Inject;
import javax.ws.rs.WebApplicationException;
import javax.ws.rs.core.HttpHeaders;
import javax.ws.rs.ext.Provider;

import org.jboss.resteasy.annotations.interception.ServerInterceptor;
import org.jboss.resteasy.core.Headers;
import org.jboss.resteasy.core.ResourceMethod;
import org.jboss.resteasy.core.ServerResponse;
import org.jboss.resteasy.spi.Failure;
import org.jboss.resteasy.spi.HttpRequest;
import org.jboss.resteasy.spi.interception.AcceptedByMethod;
import org.jboss.resteasy.spi.interception.PreProcessInterceptor;
import org.jboss.resteasy.util.Base64;

@Provider
@ServerInterceptor
public class SecurityInterceptor implements PreProcessInterceptor, AcceptedByMethod {

    private static final String          AUTHORIZATION_PROPERTY = "Authorization";

    private static final String          AUTHENTICATION_SCHEME  = "Basic";

    private static final ServerResponse  ACCESS_DENIED          = new ServerResponse("Access Denied!",     401, new Headers<Object>());

    private static final ServerResponse  ACCESS_FORBIDDEN       = new ServerResponse("Access Forbidden!",  403, new Headers<Object>());

    private static final ServerResponse  SERVER_ERROR           = new ServerResponse("Internal Error!",    500, new Headers<Object>());

    @Override
    public ServerResponse preProcess(HttpRequest request, ResourceMethod methodInvoked) throws Failure, WebApplicationException {
        Method method = methodInvoked.getMethod();

        if (method.isAnnotationPresent(WsAccessMethodPermition.class) ||
                method.isAnnotationPresent(PermitAll.class)) {
            return null;
        }

        // Access denied for all
        if (method.isAnnotationPresent(DenyAll.class)) {
            return ACCESS_FORBIDDEN;
        }

        // Get request headers
        final HttpHeaders headers = request.getHttpHeaders();

        // Fetch authorization header
        final List<String> authorization = headers.getRequestHeader(AUTHORIZATION_PROPERTY);

        // If no authorization information present; block access
        if (authorization == null || authorization.isEmpty()) {
            return ACCESS_DENIED;
        }

        // Get encoded username and password
        final String encodedUserPassword = authorization.get(0).replaceFirst(
                AUTHENTICATION_SCHEME.concat(" "), "");

        // Decode username and password
        String usernameAndPassword;
        try {
            usernameAndPassword = new String(Base64.decode(encodedUserPassword));
        } catch (IOException e) {
            return SERVER_ERROR;
        }

        // Split username and password tokens
        final StringTokenizer tokenizer = new StringTokenizer(usernameAndPassword, ":");
        final String username = tokenizer.nextToken();
        final String password = tokenizer.nextToken();

        // Verify user access
        if (!isUserAllowed(request, username, password)) {
            return ACCESS_DENIED;
        }

        return null;
    }

    @SuppressWarnings("serial")
    private boolean isUserAllowed(final HttpRequest request, final String username, final String password) {
        UserWS user = new UserWS(username, password);
        if (user != null) {
            if (!user.getRoles().isEmpty() && !user.hasPermission()) {

                byte[] certificate = user.getCertificate();
                request.setAttribute(SecureResource.USER_CERTIFICATE, certificate);
                return true;
            }
        }
        return false;
    }

    @Override
    public boolean accept(@SuppressWarnings("rawtypes") Class declaring, Method method) {

        // bypass authentication - get methods for instance
        if (method.isAnnotationPresent(WsAccessMethodPermition.class) ||
                method.isAnnotationPresent(PermitAll.class)) {
            return false;
        }

        // Access denied for all
        if (method.isAnnotationPresent(DenyAll.class)) {
            // TODO here for instance log denied access
            return true;
        }

        return true;
    }
}

And now...the resource...

- WebService Implementation

@Path("/test")
@Consumes(MediaType.APPLICATION_JSON)
@Produces(MediaType.APPLICATION_JSON)
public class TestResourceWS extends SecureResource {

    @POST
    @Path("/info/")
    @Produces(MediaType.APPLICATION_JSON)
    @WsAccessMethodPermition
    @Override
    public String info() throws ServiceAPIException {
        return "Hello, Access OK!";
    }

    @POST
    @Path("/infodenied/")
    @Produces(MediaType.APPLICATION_JSON)
    @Override
    public void infodenied() throws ServiceAPIException {
        // "denied!";
    }
}

- Sample invocation

http://<host>/<app-name>/rest/test/info
OK!

http://<host>/<app-name>/rest/test/infodenied
Access Denied!

- WS Client Sample...post methods for instance

   MultiValueMap<String, String> headers = new LinkedMultiValueMap<String, String>();
   headers.add("Authorization", "Basic " + base64Creds);
   headers.add("Content-Type", "application/json");
   RestTemplate restTemplate = new RestTemplate();
   HttpEntity<ObjectToPass> request = new HttpEntity<ObjectToPass>(ObjectToPass, headers);
     restTemplate.postForObject("http://<host>/<app>/rest/test/info", request, Boolean.class);


Thanks a lot and regards!

JEE7 - Working with Asynchronous methods and Observer

Hi all,
Thanks for reading my posts.

Now, I would like to present some tips about Asynch implementation.
Let's see the following code below...

Environment:

Java EE 6/7 and Java SE 1.7/1.8
CDI 1.x
JBoss EAP/AS/Wildfly and so on...

- EJB Asynch


public interface CustomEvent extends Serializable {
    /**
     * Submit event execution
     *
     * @param event
     */
    void submit();
}

public class DispatchEvent implements CustomEvent {  private String name;
  protected int age;

  public DispatchEvent(String name, int age) {       this.name = name;
       this.age    = age;
  }


   public String getName() {
        return this.name;
   }   

   @Override
    public void submit() {
        // builder pattern sample...see other posts about this pattern
        StudentsBuilder studentsBuilder = new StudentsBuilder();
        studentsBuilder.addStudent()
                  .getCurrentStudentPosition()
                  .defineName(this.name)
                  .defineAge(this.age)
                  .build()
                  .print("Hello!!");
   }
}


public class Dispatch2Event extends DispatchEvent {
  private String nickname; 

  
  public Dispatch2Event(String name, int age, String nickname) {
       this.name = name;
       this.age    = age;
       this.nickname = nickname;
  }
  
  public String getNickname() {
        return this.nickname;
   }  
}
 
@Local
public interface StatelessEjbEventObserver extends Serializable {
    /**
     *  Observe the event execution...
     *
     * @param event
     */
    void onEjbAsynchEvent(@Observes DispatchEvent event);

    void onEjbEvent(@Observes Dispatch2Event event);
}

@Stateless
public class EjbStatelessEjbEventObserverImpl implements StatelessEjbEventObserver {
 
    /**
     * serial
     */
    private static final long serialVersionUID = 2264643954576089691L;

    @Asynchronous
    @Override
    public void onEjbAsynchEvent(@Observes DispatchEvent<E> event) {
        // do anything here...
        event.submit(); // execution
        System.out.println("Hello: " + event.getName());    }

    @Override
    public void onEjbEvent(@Observes Dispatch2Event<E> event) {
        // do anything here...
        event.submit(); // execution
        System.out.println("Hello2: " + event.getNickname());
    }




}


Pay attention if you need to work with Thread Safe...
The event will be fired from a CDI Object and after that the EJB will dispatch the "submit" method as an Asynchronous operation.  
Take it easy to avoid overhead on performance stuff, if you are using transactions, because the container must lost the control over Asynch method.

- CDI Service

public class PersonService {
   @Inject
    private Event<DispatchEvent> dispatcher;
 
    @Inject
    private Event<Dispatch2Event> dispatcher2;
  
   public dispatch(DispatchEvent event) {

        dispatcher.fire(event);  
    }

    public dispatch(Dispatch2Event event) { 
        dispatcher2.fire(event);  
    }

} 
- Singleton EJB (Startup)

@Singleton
@Startup
@TransactionAttribute(TransactionAttributeType.NOT_SUPPORTED)
public class EjbSingletonStartup {
   
   //@Inject // repository implementation...access person data information
   //private PersonRepository personRepo;
  
   @Inject PersonService pService;
 
   @PostConstruct
    protected void init() throws InterruptedException, ExecutionException, TimeoutException {
        //PersonLegacy p = personRepo.findById(0L); // ADMIN test sample
       
        pService.dispatch(new DispatchEvent("alvesfred", 38));
        pService.dispatch2(new Dispatch2Event("alvesfred", 38, "fred"));
   }
}


So, it is just a sample concept and not a real implementation or production code.
In JEE 7, I advice you to use services like ManagedExecutorService (see the assumptions over JSR-236 to know more about concurrency/multithread).

Thanks a lot and regards.



 

Java Application Performance Management - inspectIT

Hi all...

Thanks again to stay here, reading my post.

Today i will show how to install and configure inspectIT. It is a good tool for java application performance management.

Let's see my environment:

- Ubuntu 15
- JBoss EAP 6.4
- inspectIT 1.5
- JDK 1.8

inspectIT Download

http://www.inspectit.rocks/

After complete the download of the jar file...

# java -jar inspectit.installer-all.linux.x64.jar

Install inspectIT and features by default...

Editing - inspectIT configuration file

# vim /opt/java/inspectIT/agent/config/inspectit-agent.cfg

Uncomment these lines:

$include common/ejb.cfg
$include common/http.cfg
$include common/hibernate.cfg
#$include common/struts.cfg
$include common/jsf.cfg
$include common/jpa.cfg
$include common/jta.cfg
$include common/webservice.cfg


Save the file...

Edit the JBoss Standalone configuration file

# vim $jboss-home/bin/standalone.conf

...
# Added for logging problem
JBOSS_MODULES_SYSTEM_PKGS="org.jboss.logmanager"

if [ "x$JBOSS_MODULES_SYSTEM_PKGS" = "x" ]; then
   JBOSS_MODULES_SYSTEM_PKGS="org.jboss.byteman"
fi

...

#inspectIT
INSPECTIT_AGENT_HOME="/opt/java/inspectIT/agent"
echo $INSPECTIT_AGENT_HOME

INSPECTIT_CONFIG_HOME="/opt/java/inspectIT/agent/config/"
echo $INSPECTIT_CONFIG_HOME

INSPECTIT_JAVA_OPTS="-Xbootclasspath/p:$INSPECTIT_AGENT_HOME/inspectit-agent.jar -javaagent:$INSPECTIT_AGENT_HOME/inspectit-agent.jar -Dinspectit.config=$INSPECTIT_CONFIG_HOME"
echo $INSPECTIT_JAVA_OPTS
...

# Sample JPDA settings for remote socket debugging
JAVA_OPTS="$INSPECTIT_JAVA_OPTS $JAVA_OPTS -agentlib:jdwp=transport=dt_socket,address=8787,server=y,suspend=n"

# Added for logging problem
JBOSS_HOME="/opt/java/jboss/jboss-eap-6.4.0"
JAVA_OPTS="$JAVA_OPTS -Djava.util.logging.manager=org.jboss.logmanager.LogManager -Xbootclasspath/p:$JBOSS_HOME/modules/system/layers/base/org/jboss/logmanager/main/jboss-logmanager-1.5.4.Final-redhat-1.jar"

Let's start JBoss...

# $JBOSS_HOME/bin/standalone.sh -c standalone-full-ha.xml

Let's start the Local CMR (repository)

# $INSPECTIT_HOME/CMR/startup.sh
(it will be possible to see that the service and 8182 port were initialized)

Now, local CMR is ready to receive informations about your application inside JBoss EAP Middleware, using inspectIT agents/sensors.

That's it!!
So, we need to manage the java application performance using inspectIT client...

# $INSPECTIT_HOME/inspectit/inspectIT

Thanks a lot and see you on the next post!

If you have any doubts or problems with java features, please let me know. I will do my best to help you.

Hibernate/JPA Entity Model

Hi All,

Thanks again to stay here reading my post.

I would like to help other developers to solve problems about Java and middleware implementations.

If you have any doubts or problems about Java/JEE or JBoss Midleware feel free to contact me (fredericocerqueiraalves@gmail.com). It will be a pleasure to help you.

Now, i would like to show you a model implementation to use hibernate entity beans.

These classes are implemented to support hibernate first or second level cache, audit with envers and native or named queries.

So, let's see...

- Base Model

package br.com.alvesfred.entity;
 
import java.io.Serializable;

/**
 * Base Model Interface
 *
 * @author alvesfred
 *
 */
public interface BaseModel<ID> extends Serializable {

    /**
     * Set ID definition
     *
     * @param id
     */
    void setId(ID id);
   
    /**
     * Get ID
     *
     * @return
     */
    ID getId();
}

- Entity Base Model

package br.com.alvesfred.entity;

import javax.persistence.Column;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.MappedSuperclass;

import org.apache.commons.lang.builder.EqualsBuilder;
import org.apache.commons.lang3.builder.HashCodeBuilder;
import org.hibernate.annotations.GenericGenerator;
import org.hibernate.annotations.Parameter;

/**
 * Model for Entities
 *
 * @author alvesfred
 *
 * @param <ID>
 */
@MappedSuperclass
public abstract class BaseModelEntity<ID> implements BaseModel<ID> {

    /**
     * serial
     */
    private static final long serialVersionUID = 3958601406206249649L;

    //@Id
    //@GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "default_id_generator")
    @Id
    @Column(name = "id")
    @GeneratedValue(strategy = GenerationType.SEQUENCE, generator = "hilo_sequence_generator")
    @GenericGenerator(
            name       = "hilo_sequence_generator",
            strategy   = "org.hibernate.id.enhanced.SequenceStyleGenerator",
            parameters = { // default parameters
                    @Parameter(name = "sequence_name",  value = "sq_id"),
                    @Parameter(name = "initial_value",  value = "1"),
                    @Parameter(name = "increment_size", value = "1"),
                    @Parameter(name = "optimizer",      value = "hilo")
    })
    protected ID id;

    public BaseModelEntity() {
    }

    public BaseModelEntity(ID id) {
        setId(id);
    }

    public ID getId() {
        return id;
    }

    public void setId(ID id) {
        this.id = id;
    }

    @Override
    public int hashCode() {
        HashCodeBuilder hcb = new HashCodeBuilder();
        hcb.append(this.id);

        return hcb.toHashCode();
    }

    @Override
    public boolean equals(Object obj) {
        if (obj == null || obj.getClass().isAssignableFrom(BaseModelEntity.class)) {
            return false;
        }

        @SuppressWarnings("unchecked")
        BaseModelEntity<ID> other = (BaseModelEntity<ID>) obj;

        EqualsBuilder eb = new EqualsBuilder();
        eb.append(this.getId(), other.getId());
       
        return eb.isEquals();
    }
   
}

- Version (Entity Base Model)

 package br.com.alvesfred.entity;

import javax.persistence.Column;
import javax.persistence.MappedSuperclass;
import javax.persistence.Version;

/**
 * Lock version entity - base model
 *
 * @author alvesfred
 *
 * @param <ID>
 * @param <VERSION>
 */
@MappedSuperclass
public abstract class BaseModelVersionEntity<ID> extends BaseModelEntity<ID> {

    /**
     * serial
     */
    private static final long serialVersionUID = 9205887194329558055L;

    //@Generated(GenerationTime.NEVER)
    @Version
    @Column(name = "versionId", nullable = false)
    private Long version;

    public Long getVersion() {
        return (this.version != null) ? this.version : this.hashCode();
    }

    public void setVersion(Long versao) {
        this.version = versao;
    }
}

- Finally Entity Class

 package br.com.alvesfred.entity;

import javax.persistence.AttributeOverride;
import javax.persistence.AttributeOverrides;
import javax.persistence.Column;
import javax.persistence.ColumnResult;
import javax.persistence.Entity;
import javax.persistence.Lob;
import javax.persistence.NamedNativeQueries;
import javax.persistence.NamedNativeQuery;
import javax.persistence.NamedQueries;
import javax.persistence.NamedQuery;
import javax.persistence.QueryHint;
import javax.persistence.SequenceGenerator;
import javax.persistence.SqlResultSetMapping;
import javax.persistence.SqlResultSetMappings;
import javax.persistence.Table;

import org.hibernate.annotations.Cache;
import org.hibernate.annotations.CacheConcurrencyStrategy;
import org.hibernate.envers.Audited;

@Cache(usage = CacheConcurrencyStrategy.TRANSACTIONAL) // using JTA by container
@Entity
@Audited
@Table(name="person")
@SequenceGenerator(name = "hilo_sequence_generator", sequenceName = "seq_id_person", allocationSize = 1)
@AttributeOverrides({
    @AttributeOverride(name="id", column=@Column(name = "person_id", unique = true, nullable = false, scale = 0)),
})

@NamedQueries({
    @NamedQuery(
            name  = PersonEntity.LIST_BY_ID_NAME,
            query = "select new PersonEntity(p.id) "
                  + "from PersonEntity p "
                  + "where p.name = :name",
            hints = {
                    @QueryHint (name="org.hibernate.cacheable", value="true"),
            }
    ),
})

@NamedNativeQueries(
        value = {
            @NamedNativeQuery(
                name  = PersonEntity.LIST_NATIVE_BY_NAME,
                query = PersonEntity.SQL_NATIVE_BY_NAME,
                resultSetMapping = PersonEntity.MAPPING_NATIVE_BY_NAME),
})

@SqlResultSetMappings(
        value = {
            @SqlResultSetMapping(      
                    name    = PersonEntity.MAPPING_NATIVE_BY_NAME,
                    columns = {
                        @ColumnResult(name="size")}),
        }
)
public class PersonEntity extends BaseModelVersionEntity<Long> {

    private static final long serialVersionUID = -1355055022303449688L;

    // Named Queries
    public static final String LIST_BY_ID_NAME = "PersonEntity.listByIdName";

    // Native Named Queries
    public static final String LIST_NATIVE_BY_NAME = "PersonEntity.nativeListByIdName";

    // SQL
    protected static final String SQL_NATIVE_BY_NAME =
            " select count(*) as size "
          + " from person "
          + " where name = :name ";

    // MAPPING
    public static final String MAPPING_NATIVE_BY_NAME = "PersonEntity.mappingListByIdName";

    @Lob
    @Column(name = "jsonInfo", nullable = false)
    private String jsonInfo; // a complete file text information, using json jackson parser
   
    @Column(name = "name", nullable = false)
    private String name;

    @Column(name = "age", nullable = true)
    private int age;

}
 
That's it!
Thanks a lot and feel free to contact me for any help.

See you soon...

How to Analyse Java Performance using Red Hat Links

Hi All,

I would like to present links that I use to analyse java performance.
These links are important to know some details about JVM, but you need to subscribe on Red Hat Access Portal to see the details.

[IMHO] To subscribe on Red Hat Access Portal is a important action if you deploy applications over JBoss EAP. On this site, you can obtain a lot of concepts about JBoss and how to solve problems, especially for performance issues on your application running to JVM over JBoss EAP.

So, I enumerate some links to help you with Java and JBoss issues. These links help me a lot!

- Java Application High CPU

https://access.redhat.com/node/24830
https://access.redhat.com/solutions/46596


- Thread Dump

https://access.redhat.com/solutions/18178
https://access.redhat.com/solutions/317143

- Java Garbage Collection Performance

https://access.redhat.com/articles/1192773
https://access.redhat.com/node/19932
https://access.redhat.com/labs/garbagedog/
https://access.redhat.com/solutions/23735

- Application Unresponsive
https://access.redhat.com/solutions/18266
https://docs.jboss.org/author/display/AS7/High+Availability+Guide

- JVM Conf. Tool
https://access.redhat.com/labs/jvmconfig

If you have difficulties to know about java memory leak, I just suggest to read about jmap, jhat and MAT (Eclipse Memory Analyser). These tools are so important to detect a lot of issues about your application running on java virtual machine.

Thanks a lot for reading my post.
See you!!!