Nandana Mihindukulasooriya's Blog

Call for Participation - 2nd International Evaluation Campaign for Semantic Technologies 2012

2012-01-27T05:25:00.000-08:00

Following the success of the first campaign in 2010 , we are pleased to announce the Second International Evaluation Campaign for Semantic Technologies which will be conducted in Spring 2012. This campaign is organised by the Semantic Evaluation At Large Scale (SEALS) Project.

We cordially invite you to participate in the this campaign in one or more of the five core areas shown below. Participation is open to anyone who is interesting in benchmarking a semantic technology tool. Detailed information regarding each area's campaign together with terms and conditions and general information about SEALS can be found on the SEALS Portal.

The Campaign

The SEALS Evaluation Campaign is open to all and will focus on benchmarking five core technology areas on the basis of a number of criteria such as Interoperability, Scalability, Usability, Conformance to Standards, and Efficiency. Each area's campaign will be largely automated and executed on the SEALS Platform thus reducing the overhead normally associated with such evaluations.

Why get involved?

Broadly speaking, the benefits are threefold.

Firstly, participation in the evaluation campaigns provides you with a respected and reliable means of benchmarking your semantic technologies. It provides an independent mechanism for demonstrating your tool's abilities and performance to potential adopters / customers.

Secondly, since you will have perpetual, free-of-charge access to the SEALS Platform, it gives you the highly valuable benefit of being able to regularly (and confidentially) assess the strengths and weaknesses of your tool relative to your competitors as an integral part of the development cycle.

Thirdly, your participation benefits the wider community since the evaluation campaign results will be used to create 'roadmaps' to assist adopters new to the field to determine which technologies are best suited to their needs thus improving general semantic technology market penetration.

How to get involved

Joining the SEALS Community is easy and poses no obligations. Indeed, by being a member of the community you receive the latest information about the evaluation campaign including details of newly published data sets, tips and advice on how to get the most out of your participation and the availability of results and analyses. Join SEALS Community now.

Timeline for the campaign

now	Registration
	Data, documentation available
	Participants upload tool(s)
March - April 2012	Evaluation executed (by SEALS)
April 2012 - May 2012	Results analysis (by SEALS)
June 2012	ESWC 2012 workshop

The technology areas

Ontology Engineering Tools

Addresses the ontology management capabilities of semantic technologies in terms of their ontology language conformance, interoperability and scalability. The main tools targeted are ontology engineering tools and ontology management frameworks and APIs; nevertheless, the evaluation is open to any other type of semantic technology.

Ontology Storage and Reasoning Tools

Assesses a reasoner's performance in various scenarios resembling real-world applications. In particular, their effectiveness (comparison with pre-established 'golden standards'), interoperability (compliance with standards) and scalability are evaluated with ontologies of varying size and complexity.

Ontology Matching Tools

Builds on previous matching evaluation initiatives (OAEI campaigns) and integrates the following evaluation criteria: (a) conformance with expected results (precision, recall and generalizations); (b) performance in terms of memory consumption and execution time; (c) interoperability, measuring the conformance with standard such as RDF/OWL; and (d) measuring the coherence of the generated alignments.

Semantic Search Tools

Evaluated according to a number of different criteria including query expressiveness (means by which queries are formulated within the tool) and scalability. Given the interactive nature of semantic search tools, a core interest in this evaluation is the usability of a particular tool (effectiveness, efficiency, satisfaction)

Semantic Web Services

Focuses on activities such as discovery, ranking and selection. In the context of SEALS, we view a SWS tool as a collection of components (platform services) of the Semantic Execution Environment Reference Architecture (SEE-RA). Therefore, we require that SWS tools implement one or more SEE APIs in order to be evaluated.

Details of each area's evaluation scenarios and methodology can be found at:
http://www.seals-project.eu/seals-evaluation-campaigns/2nd-seals-evaluation-campaigns

About SEALS
The SEALS Project is developing a reference infrastructure known as the SEALS Platform to facilitate the formal evaluation of semantic technologies. This allows both large-scale evaluation campaigns to be run (such as the one described in this communication) and ad-hoc evaluations by individuals or organisations.

Find out more
More information about SEALS and the evaluation campaign can be found from the SEALS portal.

If you would like to contact us directly:
SEALS Coordinator: Asuncion Gomez-Perez (asun@fi.upm.es)
Evaluation Campaign Coordinator: Fabio Ciravegna (f.ciravegna@dcs.shef.ac.uk)

Sakai CLE WebDAV support

2011-03-21T03:48:00.000-07:00

Sakai is an open source Collaboration and Learning Environment (CLE) software a.k.a. Learning Management System (LMS) or Course Management System (CMS) developed by the Sakai Foundation. Sakai has WebDAV support which allows mounting site's files and other uploaded content as a network folder so that you can use drag and drop to upload and download files and folders to and from Sakai Resources. I tried out this feature in Sakai and this post explains the steps that I followed.

Great thing about Sakai is that there are many organizations that host Sakai instances which you can use to try out Sakai online without installing anything. In this post, I will use Free Test Drive Sakai 2.7 from Unicon. Once you create an account and login, you can navigate to My Workspace --> Resources --> Upload-Download Multiple Resources to try out WebDAV support in Sakai.

It includes a step by step guide on how to mount volume in Windows and Mac OS. But if you are Linux user, you can use the following commands with appropriate paths to mount the volume under Linux. I have just listed the commands, please refer to this post for more details.


$sudo apt-get install davfs2
$sudo dpkg-reconfigure davfs2
$sudo mount -t davfs https://testdrivesakai.com/dav/~nandana /home/nandana/sakai

However, with Linux (Ubuntu 10.10), I had a strange observation. I could login and mount the volume, the folder gets synced and everything seems to work fine. But whenever I tried to add a resource, it gives me an error message saying "No such file or directory". I wanted to isolate the problem, so I decided to try with Windows 7, and everything worked fine. So I went back to Linux and surprisingly everything started to work perfectly. Out of curiosity, I wanted to make sure that it was not a timing issue or any coincidence. So I created another account on Test Drive, and tried to reproduce this. And yes, Linux file uploading started to work as soon as you connect it once with Windows.

I am not sure whether the problem is in the server side or the client side, but a little Googling showed not only Sakai, but some other projects with WebDAV support also have the same problem.

WSO2 SOA Summer School - Security in SOA : The brain friendly edition of complex security specs

2009-07-01T03:00:00.000-07:00

If you are not registered already, you can register now. Like all SOA summer school classes, this course is FREE.

Topics covered : "Security in SOA" webinar will focus on key security standards and identity management for SOA with regards to two emerging user centric identities, OpenID & Information Cards, and also XACML for fine-grained authorization. In contrast to traditional security webinar, this will be conducted in a brain friendly manner without making you getting lost in the SOA acronym cloud.

Presenter : Prabath Siriwardena, Technical Lead and Security Team Manager, WSO2 Inc.
Prabath is the security guru in WSO2 and he is famous for explaining complex things in a very simple manner. Want to see a proof of above statement ? “Understanding OpenID“ and “Identity as a Service“ webinars shows how capable he is explaining security stuff in a simple manner.

WSO2 SOA Summer School : “WSO2 SOA Summer School program is to help the many IT professionals worldwide whose careers are being impacted by the global recession. These free classes will enable enterprise IT architects and developers to become more familiar with SOA concepts, technologies, and best practices—expanding the expertise they bring to either current or prospective employers. WSO2 has developed a wealth of knowledge on SOA best practices through the professional consulting, design and training it provides customers. The same senior technical experts delivering WSO2’s onsite and online training are leveraging their SOA implementation expertise to create and teach eight customized courses for the SOA Summer School. With this program. WSO2 is opening its doors to all individuals who want to boost their SOA knowledge directly from some of the industry’s leading experts—thousands of dollars worth of professional training at zero cost. “.

Deploying Apache Axis2 / Rampart on JBoss

2009-04-16T02:04:00.001-07:00

Recently I noticed some users raising questions on how to deploy Apache Axis2 / Rampart on JBoss and wanted to give it a try. I was able to deploy Apache Axis2 / Rampart on Jboss without much a problem and was able to successfully deploy and invoke a secure web service. Here are the steps.

1.) Download the latest distributions of the required software.

Note : I am using JDK 1.5.0_14.

2.) Extract the jboss-5.0.1.GA.zip to a preferred location on your hard drive. We will refer to this folder as JBOSS_HOME from now onwards.

3.) Deploy Axis2 on JBoss.

We will use the Exploded WAR Deployment. Extract the axis2.war file in to /server/default/deploy directory. By default it will be extracted to a directory named “axis2” and you need to rename it to “axis2.war”. Then delete xml-apis-1.3.04.jar and xercesImpl-2.8.1.jar from from Axis2 war due to the issue mentioned here.

4.) Deploy Rampart.

Copy the jar libraries in lib directory of Rampart binary distribution to WEB-INF/lib directory of axis2.war. Also copy the bouncycastle library to WEB-INF/lib directory.
Copy the rampart-1.4.mar and rahas-1.4.mar to WEB-INF/modules directory.
The deployment structure is illustrated below.

And that's it. Now you can deploy the secure services by copying them to WEB-INF/services directory.

If you want to learn how to secure Axis2 web services using Apache Rampart module, following tutorials may help you to get started.

A few frequently used SSL commands - openssl and java keytool

2009-01-06T20:43:00.000-08:00

Brusten Philip & Van der Velpen Jan have published a nice list of frequently used SSL commands here.

"WEP 64/128-bit Hex" issue in Ubuntu Intrepid (8.10)

2009-01-04T21:33:00.000-08:00

After upgrading to Interpid, today I tried to access the WLAN for the first time and faced a problem with the network manager. In the Ubuntu Intrepid network manager, there is no option to provide "WEP 64/128-bit Hex" configuration. This issue is discussed in this forum. Of course, I was able to connect to the WLAN using iwconfig. Other option is to use Wicd network manager. You can find how to install Wcid here.

Setting up Sun java plugin in Mozilla Firefox

2008-12-29T20:02:00.000-08:00

I just installed Ubuntu 8.10 and was wondering how to configure the java plugin in firefox. I already had unzipped jdk, so I just wanted to configure the java plugin in firefox. It was easier than I thought, you only need to follow 2 steps ...

* Go to the Java Plugins folder (~/jre1.5.0_X/plugin/i386/ns7) that has been created and using GNOME, right-click and "Make Link" to "libjavaplugin_oji.so".
* Drag and drop the newly created Link to "~/.mozilla/plugins".

And that's it. You can check whether plugin is correctly installed using "about:plugins" command in the address bar or you can test it on java.com

Making Good SOA Great : The WSO2 story of componentization

2008-12-24T04:06:00.000-08:00

making_good_soa_great

View SlideShare presentation or Upload your own.

WSO2 Synergies: Introducing WSO2 Carbon

2008-12-19T23:10:00.000-08:00

WSO2 Carbon is the new component-based open source SOA platform on top of OSGi by WSO2. Using new carbon platform users/developers can mix and match components as they wish according to their requirements. Future versions of WSO2 products,

WSO2 Web Services Application Server 3.0
WSO2 Enterprise Service Bus 2.0
WSO2 Business Process Server 1.0
WSO2 Registry 2.0

will all be based on WSO2 Carbon platform and will have the same user experience across all the products. Here is Paul Fremantle, Co-Founder & Chief Technology Officer (CTO) at WSO2, introducing the WSO2 Carbon platform.

How to write a dynamic client for a web service in Apache Axis 2

2008-11-04T06:04:00.000-08:00

In Apache Axis2, the are several ways to write a client for a web service. One approach would be to use WSDL2Java, the code generation tool provided with Axis2 generate a stub for the web service and use that stub to consume the web service. Other option is to write a dynamic client. This is how you can write a dynamic client for a web service.

We will you expose a simple POJO as a web service.


package org.wso2.training;

public class CalculatorService {
  
   public int add (int a, int b) {
       return a + b;
   }
  
   public int multiply(int a, int b) {
       return a * b;
   }
  
}

Exposing this as a web service is a matter of 2 lines of code ...


    AxisServer axisServer = new AxisServer();
    axisServer.deployService(CalculatorService.class.getName());

Now, the WSDL for this web service will be available at


http://localhost:6060/axis2/services/CalculatorService?wsdl

Now let's see how we can write a dynamic client for this web service


        //Create a service client for given WSDL service by passing the following four parameters
        //ConfigurationContext - we keep it as null
        //wsdlURL - The URL of the WSDL document to read
        //wsdlServiceName The QName of the WSDL service in the WSDL document 
        //portName        The name of the WSDL 1.1 port to create a client for. 
        
        RPCServiceClient dynamicClient = new RPCServiceClient(null, new URL(
                "http://localhost:6060/axis2/services/CalculatorService?wsdl"), new QName(
                "http://training.wso2.org", "CalculatorService"),
                "CalculatorServiceHttpSoap12Endpoint");

        // We provide the parameters as an object array and return types as an class array
        Object[] returnArray = dynamicClient.invokeBlocking(new QName("http://training.wso2.org","add"),
                new Object[] { 1, 2 }, new Class[] { Integer.class });
        
        System.out.println("1 + 2 = " + returnArray[0]);
        
        returnArray = dynamicClient.invokeBlocking(new QName("http://training.wso2.org","multiply"),
                new Object[] { 1, 2 }, new Class[] { Integer.class });
        
        System.out.println("1 X 2 = " + returnArray[0]);

.

Identity as a service (IdaaS)

2008-10-29T21:10:00.000-07:00

Sometimes back I blogged about a webinar on OpenID by Prabath Siriwardhana, the product manager of WSO2 Identity solution. I was able attend another webinar by him, this time on “Identity as a service”. His webinars are really cool and he has a unique way of presenting, which makes it easy to grasp even the deeper concepts. I would really recommended both webinars to any one who is interested in the above subject.

In this webinar, he talks about

What is identity
Laws of identity
User centric identity : Cardspace / OpenID
Identity as a service
Authorization with XACML
Provisioning with SPML
Auditing with XDAS
Identity Governance

Identity as a Service

View SlideShare presentation or Upload your own. (tags: cardspace identityopenidsoa)

You can watch the video here.

Automatic module engagement in Apache Axis2 according to WS Policies

2008-10-24T05:43:00.000-07:00

Apache Axis2 allows us to plug-in "modules" that extend their functionality for features such as security and reliability. Most of these modules are configured via WS Policy. So one of the cool features in Axis2 is automatic module engagement when relevant assertions are present in the effective policy.

How does Axis2 Engine know which assertions are relevant to a particular module ?

This is defined in the module.xml which is the descriptor file for a module using supported-policy-namespaces element. This tells Axis2 engine what policy assertions this module can handle.


<module name="my-module" class="org.apache.axis2.modules.MyModule">
<Description>
   My simple module
</Description>

<supported-policy-namespaces namespaces="http://wso2.org/policy/v1 http://wso2.org/policy/v2"/>

</module>

Module interface (org.apache.axis2.modules.Module) in Axis2 has 3 important method relevant to policy. These are used by the module classes to express whether they can handle a specific assertion instance and also get notified when they are engaged to some AxisDescription. AxisMessage, AxisOperration, AxisService ... are some examples of elements in Axis2 description hierarchy.


/**
* When engaging this module to some service or operation , module will be notify by calling this
* method there module author can validate , add policy and do any thing that he want , and he can
* refuse the engage as well
*
* @param axisDescription
* @throws AxisFault
*/
void engageNotify(AxisDescription axisDescription) throws AxisFault;

/**
* Evaluate whether it can support the specified assertion and returns true if the assertion can
* be supported.
*
* @param assertion the assertion that the module must decide whether it can support or not.
* @return true if the specified assertion can be supported by the module
*/
public boolean canSupportAssertion(Assertion assertion);

/**
* Evaluates specified policy for the specified AxisDescription. It computes the configuration that
* is appropriate to support the policy and stores it the appropriate description.
*
* @param policy the policy that is applicable for the specified AxisDescription
* @throws AxisFault if anything goes wrong.
*/
public void applyPolicy(Policy policy, AxisDescription axisDescription) throws AxisFault;

When we apply a policy to an element in Axis2 description heirachy, it does five things.

1) Engage whatever modules necessary to execute new the effective policy of this AxisDescription instance.
2) Disengage whatever modules that are not necessary to execute the new effective policy of this AxisDescription instance.
3) Check whether each module can execute the new effective policy of this AxisDescription instance.
4) If not throw an AxisFault to notify the user.
5) Else notify each module about the new effective policy.

This is one good example of easy extensibility features in Apache Axis2 Design.

Rampart 2 - A High Performance Security Module for Apache Axis2

2008-10-16T05:10:00.000-07:00

Apache Rampart is the security module of Apache Axis2. Even though it supports almost all the WS-Sec* specifications and highly interoperable it has some performance issues due to two issues.

1.) Rampart uses DOM as it is built on top of WSS4J/XMLSec. So for security processing it does a DOOM conversion before pass the message to WSS4J/XML Sec.
2.) Rampart uses the two phase validation model. This makes it does extra work in the case if the message violates the policy as that only found in the second phase.

Four students of University of Moratuwa, Saliya Ekanayake, Isuru Suriarachchi, Sameera Jayasoma and Kalani Ruwanpathirana took the tough challenge of reimplementing the complete XML Security and SOAP Security layers on top of AXIOM as their final year project and successfully implemented and tested Apache Rampart 2. They have already contributed their Axiom based C14N to Apache and hope they will contribute the rest of their work too.

Isuru has written an article about the the processing model they used in Rampart 2 and it describes the advantages of making the WS Security validation policy aware.

How to expose a web service protected by HTTP Basic Authentication using WS - Security via a proxy service?

2008-10-15T21:13:00.000-07:00

Sometimes we want to expose web services protected by HTTP Basic Authentication using WS – Security. In this post we will see how to do this using WSO2 ESB and WSSecBasicAuth mediator without doing a single change to the existing web service. We will do this by setting up a proxy service and WS Security clients will be talking to the proxy service and not the real service.

Then we do a simple mediation using WSSecBasicAuth mediator. What WSSecBasicAuth mediator does is

1.) extract the username/password from the Username token
2.) Set the the “Authorization” transport header using that username/password
3.) Remove the WS Security header from SOAP Message

and that's it.

So let's see how to do this using WSO2 ESB. First we need to define a proxy service that will have the WSSecBasicAuth mediator in in sequence. You can easily do this using WSO2 ESB web console.

First we define a new sequence with the WSSecBasicAuth mediator.

Then we define a new proxy service, using that sequence as the in sequence.

WSO2 ESB Documentation describes how to setup a proxy service in detail. Final configuration will look like this.



<syn:definitions xmlns:syn="http://ws.apache.org/ns/synapse">
...
<syn:proxy name="Version" startOnLoad="true">
  <syn:target inSequence="WSSecBasicAuth">
      <syn:endpoint>
          <syn:address uri="http://127.0.0.1:9090/axis2/services/Version"/>
      </syn:endpoint>
  </syn:target>
</syn:proxy>
<syn:sequence name="WSSecBasicAuth">
  <syn:class name="org.wso2.esb.mediators.WSSecBasicAuthMediator"/>
</syn:sequence>
...
</syn:definitions>

Final step would be to modify the WSDL of the original service to reflect the WS Security requirements. WSDL can be modified by simply attaching the following policy to the SOAP bindings of the WSDL.



<wsp:Policy xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"     wsu:Id="username_token">
<wsp:ExactlyOne>
  <wsp:All>
      <sp:SupportingTokens xmlns:sp="http://schemas.xmlsoap.org/ws/2005/07/securitypolicy">
          <wsp:Policy>
              <sp:UsernameToken/>
          </wsp:Policy>
      </sp:SupportingTokens>
  </wsp:All>
</wsp:ExactlyOne>
</wsp:Policy>

An example of modified WSDL for the Axis2 version service can be found here.

Then we can attach the modified WSDL to the proxy service using the WSO2 WSB console.

Now we are all set. If we want to try this out using a Axis2 client, all we have to do is code generate against the proxy service. The security requirements will be automatically injected to the stub using the policies. So a client for the proxy service would look like this.



ConfigurationContext ctx = ConfigurationContextFactory
.createConfigurationContextFromFileSystem("client-repo");
VersionStub stub = new VersionStub(ctx);

ServiceClient sc = stub._getServiceClient();
sc.engageModule("rampart");

sc.getOptions().setUserName("nandana");
sc.getOptions().setPassword("nandana");

stub.getVersion();

Message from the client to proxy service


POST /soap/Version HTTP/1.1
Content-Type: application/soap+xml; charset=UTF-8; action="urn:getVersion"
User-Agent: Axis2
Host: 127.0.0.1:8280
Transfer-Encoding: chunked

<?xml version='1.0' encoding='UTF-8'?>
<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
<soapenv:Header>
 <wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="true">
   <wsse:UsernameToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="UsernameToken-6011238">
     <wsse:Username>nandana</wsse:Username>
     <wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText">nandana</wsse:Password>
   </wsse:UsernameToken>
 </wsse:Security>
</soapenv:Header>
<soapenv:Body />
</soapenv:Envelope>

Message from from proxy service to the real service


POST http://127.0.0.1:9090/axis2/services/Version HTTP/1.1
Host: 127.0.0.1:9090
Authorization: Basic bmFuZGFuYTpuYW5kYW5h
Content-Type: application/soap+xml; charset=UTF-8; action="urn:getVersion"
Connection: Keep-Alive
User-Agent: Synapse-HttpComponents-NIO

<?xml version='1.0' encoding='UTF-8'?>
<soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope">
<soapenv:Body />
</soapenv:Envelope>

Securing web apps deployed in Apache Tomcat using HTTP Basic Authentication

2008-10-06T05:58:00.000-07:00

If you want to protect set of resources in a web app using HTTP Basic Authentication, it is pretty easy. You only need to modify the web.xml which is located at wepAppRoot/WEB-INF/web.xml and add the following entries.


<web-app>

 <security-constraint>
   web resources that are protected
   <web-resource-collection>
     <web-resource-name>Axis2 web services</web-resource-name>
     <url-pattern>/services/*</url-pattern>
   </web-resource-collection>
   <auth-constraint>
     roles that are allowed to access the web resource specified above
     <role-name>ws-users</role-name>
   </auth-constraint>
 </security-constraint>

 <login-config>
   <auth-method>BASIC</auth-method>
   <realm-name>nandana.org</realm-name>
 </login-config>

</web-app>

In this case, we allow only users with the role “ws-users” to access this resource. You can define the roles and users tomcat-users.xml file which can be found in tomcatRoot/conf/tomcat-users.xml. So in the above case, it will be something like


<tomcat-users>
 <role rolename="tomcat"/>
 <role rolename="ws-users"/>
 <user username="nandana" password="nandana" roles="ws-users"/>
 <user username="chamanthi" password="chamanthi" roles="ws-users"/>
</tomcat-users>

And that's it. Now if we try to access a resource which fall in to given url pattern, we will be authenticated using HTTP Basic authentication.

Service Life Cycle Management in Apache Axis2

2008-09-28T20:18:00.000-07:00

Apache Axis2 provide a service life cycle management feature which can be used when we want to hook some logic when the service being deployed or when the system is shutting down. ServiceLifeCycle interface provides two methods startUp and shutDown which will be called during the service deployment time and during the system down.

So to use service life cycle management in Axis2, first we need a class implementing the ServiceLifeCycle interface. For the simplicity I will you the service implementation class.


package org.wso2.training;

import org.apache.axis2.context.ConfigurationContext;
import org.apache.axis2.description.AxisService;
import org.apache.axis2.engine.ServiceLifeCycle;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

public class MyService implements ServiceLifeCycle {

private static final Log log = LogFactory.getLog(MyService.class);

public MyService() {
log.info("My service instance is created ...");
}

public int add(int a, int b) {
return a + b;
}

public void shutDown(ConfigurationContext configctx, AxisService service) {
log.info( service.getName() + " is shutting down ...");

}

public void startUp(ConfigurationContext configctx, AxisService service) {
log.info(service.getName() + " is starting up  ...");
}

}

Then we need to define the ServiceLifeCycle management class in in the services.xml. You can do this using the class attribute of the service element.


<service name="MyService" class="org.wso2.training.MyService">
<parameter name="ServiceClass"
locked="false">org.wso2.training.MyService</parameter>
<operation name="add">
<messageReceiver class="org.apache.axis2.rpc.receivers.RPCMessageReceiver"/>
</operation>
</service>

Now if you deploy the service, you can see that startUp method being called.

and if we shutdown the server, we can see that shutDown method is being called.

Life cycle of the Axis Service and the service implementation class object is different. And Service Life Cycle management has no relation with the life cycle of the service implementation class object. Life time of the service implementation class object depends on the scope of the service. And in the above case, the service will be in default scope that is request scope and service implementation class object will be created for each request.

Installing a new component in WSO2 Data Services using Equinox OSGi console

2008-09-26T03:39:00.000-07:00

WSO2 Data services uses Equinox OSGi implementation. It allows us to easily install a new OSGi bundles in to WSO2 Data services through it's OSGi console. OSGi console of WSO2 Data services, is disabled by default. To enable OSGi console, you need to modify the file

/path/to/wso2-dataservices-1.0/webapps/ROOT/WEB-INF/web.xml

by uncommenting these lines


<init-param>
 <param-name>commandline</param-name>
 <param-value>-console 19444</param-value>
</init-param>

Now if you start data services, you will be able to connect to the OSGi console via telnet

Following are the most common Equinox OGSi commands.

install - Installs the bundle from the given URL
start - Starts the bundle with the given numeric or symbolic id
stop - Stops the bundle with the given numeric or symbolic id
ss - Reports a summary status of all installed bundles
diag - Reports any resolution problems for the bundle with the given numeric or symbolic id

So if you have a new component to be installed, you can simply install it using the install command.

Now if you look at the the status of the installed bundles, you can see the newly installed component it is not yet started (status is INSTALLED not ACTIVE)

Newly installed bundle can be started using the start command

and now if you check the status of the bundles again, you can see now the bundle is successfully started.

How to optimize your blog for code samples plus some cool widgets/tools

2008-09-26T00:38:00.000-07:00

Recently I have been posting more and more code samples in my blog and wanted to optimize my blog for code snippets . After some searching I found following widgets/tools very useful. And almost all these widgets/tools are related to blogger expect ones like statcounter and PinPoll-n-Ping.

Blogger Syntax Highlighter
This a nice widget that can be used to highlight syntax of the code you post in the blog.Languages supported at the moment are Java, C#, C++, PHP, Javascript, Python, Ruby, VB, Delphi, Sql, CSS and XML/HTML. You can very easily install this widget to your blog from here.

Changing the width of the blog
When you are posting code on your blog, it is nice if the width of the blog suits the code.You can find how to change the width of your blog here.

How to post an image in its original size to your blog
When you want to post screen shots of the products/tools you are using, 400 pixels may not be the best size for your images specially if you have already increased the width of your blog. You can find how to post an image in its original size here.

These information are not related to adding code snippets, but was very useful.

Adding Tag cloud
Nice way for let your readers to read the posts that interests them. If you want to add a tag cloud to your blog, you can find how to do it here

Social bookmarking links
If you want to add social bookmarking links to blogger to all your posts, you can find how to do it here. This widget includes links to Digg, StumbleUpon, del.icio.us, reddit, Facebook, newsvine, Google, Yahoo and Technorati.

Pinging search engines with PinPoll-n-Ping
PinPoll-n-Ping is a Multi-Pinging service that will ping blog directories and blog search engines when you make a blog post. It constantly monitors your blog and the RSS/Atom feed for changes, when a change is detected it will ping all the downstream services that you have selected to notify. The services it can ping includes Blog People, Blog Update, BlogFlux, Blogdigger, Bloglines, BulkFeeds, FeedBurner, Feedsky, Google, Ice Rocket, Moreover, NewsGator, Ping-o-Matic!, Syndic8, Technorati, WeBlogALot, Weblogs.com, Yahoo and blo.gs. You can register free for PinPoll-n-Ping from here.

DZone widget
Most of us submit our posts to Dzone. This DZone widget allows us to easily add our posts to DZone and also allows visitors to vote for them through this widget.

Tracking the visitors
Previously I used Google analytics to track visitors to my blog but then I found out statcounter has lot of cool features compared to Google analytics. You can find a live demo of statcounter here. Some of it's features are Popular Pages, Entry Pages, Exit Pages, Came From, Keyword Analysis, Recent Keyword Activity, Recent Came From, Visitor Paths, Visit Length, Returning Visits, Recent Pageload Activity, Recent Visitor Activity, Recent Visitor Map, Country/State/City/ISP, Browser and lot more.

And that's all that comes to my mind right now and I will update this post if I have forgotten any.

Accessing the username used for Authentication (Username Token / Rampart) with in a web service in Apache Axis2

2008-09-25T03:07:00.000-07:00

Sometimes we need to access the user name used for authentication with in a web service for auditing purposes, authorization and etc. As Rampart stores all the security related data in the Message context one can get the username used for authentication parsing those data but then you need to do lot of work and have to have an idea about the structure of those data. Users needed a much easier way to do this and feature request was made in the Apache Rampart JIRA. Now the username is stored as a Message Context property by Rampart module and can be easily obtained withing the service using following code


import org.apache.rampart.RampartMessageData;

public void myMethod() { 
 
   // Getting the current MessageContext 
   MessageContext msgContext = MessageContext.getCurrentMessageContext(); 
 
   // Getting HttpServletRequest from Message Context 
   String username = (String)msgContext 
           .getProperty(RampartMessageData.USERNAME); 

}

Podcast on WSF/Spring - Enterprise Spring

2008-09-24T20:34:00.000-07:00

WSO2 released WSF/Spring 1.5 recently. WSO2 WSF/Spring provides an amazingly simple Code First approach to create Web Services for the Spring user. This framework integrates the Apache Axis2 Web services engine into Spring. Thus, providing all the power and versatility of the Axis2 engine to the Spring user.
In this podcast Sanka Samaranayake, one of the lead developers in WSO2 WSF/Spring project talks about WSF/Spring project and the new features in WSF/Spring 1.5 release.

Podcast: Enterprise Spring: WSF/Spring

Two nice presentations on WS Policy

2008-09-24T07:03:00.000-07:00

If you want understand Web services policy framework, I highly recommend these two presentations from W3C.

Web services policy 1.5
Web services policy expression alternatives

XKMS features of WSO2 Web Service Application Server WSAS (WSO2 WSAS)

2008-09-23T10:31:00.000-07:00

WSO2 WebService Application Server (WSO2 WSAS) is an enterprise application server powered by Apache Axis2 and one of it’s main advantages is it’s rich set of built in security features. XKMS is one of those features that works out of the box with WSO2 WSAS. Let’s look at what are the XMKS capabilities of WSO2 WSAS.

XML Key Management Specification (XKMS)
WS - Security is build on top of XML Signature and XML Encryption specifications and those cryptographic operations are tightly integrated with public key infrastructure. For large scale web services involving large number of parties, key management becomes a major issue and has to be dealt with great effort. XML Key Management Specification tries to deal with this issue by defining a standard protocol for registering, distributing and processing public keys suitable for use in conjunction with XML Signature and XML Encryption. Main objective of XKMS Specification is to define XML based trust web services for processing and management of PKI-based cryptographic keys. Trust web services can be used to manage keys in a standard way on top of existing web service infrastructure. This allows web services to delegate the key processing functionality to XKMS trust web services reducing the complexity and making it more manageable. XKMS builds a layer of abstraction it allows the web services to switch between different PKI solutions.

WSO2 WSAS as a XKMS trust web service

WSO2 WSAS ships with an in built XKMS trust web service which has built on top of XKMS specification and consists of 5 services which can be used to simplify key management.

i) Register service
ii) Locate service
iii) Validate service
iv) Revoke service
v) Recover service
vi) Reissue service

You can configure WSAS XKMS trust web Service very easily using the WSAS web management console. Please take a look at WSAS XKMS sample guide for information on how to use WSAS XKMS trust web service.

WSO2 WSAS as a XKMS client

WSO2 WSAS also lets you to use an external XKMS trust web service do you key management. If you want to delegate to the key management to a XKMS trust web Service all you got to do is uncomment these lines in the axis2.xml that is in the conf directory of WSO2 WSAS and fill in the necessary information.


<axisconfig name="AxisJava2.0">
<!--
Following parameter will enable the use of specified XKMS service to
locate, validate keys by the WS-Security provider
-->
  <parameter name="XKMSConfig" enabled="true">
      <URL>http://xkms_server_host_name:port/services/xkms</URL>
      <PassPhrase>secret</PassPhrase>
  </parameter>
</axisconfig>

When XKMS is not enabled, keys used for cryptographic operations retrieved from the key stores that are associated with a service. But when XMKS is enabled, ServerCrypto, the custom crypto implementation of WSO2 WSAS will try to retrieve the keys from the given XKMS service.

Mapping Axis2 enableMTOM parameter to MTOM Serialization Policy Assertion

2008-09-21T21:51:00.000-07:00

In Axis2, users can configure can configure whether outgoing messages should be MTOMised or not using enableMTOM parameter. Value of the enableMTOM parameter can be either true, false or optional. Let's look at the server side as client side is straight forward.

enableMTOM	Description
true	request : can be MTOMised or non - MTOMised response : will always be MTOMised
false	request : can be MTOMised or non-MTOMised response : will always be non-MTOMised
optional	request : can be MTOMised or non-MTOMised response : will be MTOMised only if request is MTOMised

If we look at the MTOM Serialization Policy Assertion (WS-MTOMPolicy), if this assertion is attached to a service ( more specially to a binding ), it defines a behavior in which an endpoint requires and generates messages serialized as specified in section 3 of the SOAP Message Transmission Optimization Mechanism [MTOM].

So if we try to map there two,

1.)In Axis2, there is no way to specify the requirement that incoming messages must be MTOMised. So according WS-MTOMPolicy assertion, it will be always

<wsoma:optimizedmimeserialization optional="true">

which is equivalent to two policy alternatives, one with and one without the assertion.

2.)According the WS-MTOMPolicy specification it should only be attached to either wsdl:binding or wsdl:port. So you can't specify this behavior at operational level or message level as it is currently possible with Axis2.

If will be a good thing if we can the MTOM behavior of the service using in WSDL using MTOMPolicy but we will have to do some work to sync these two or even introduce a new configuration parameter to control whether incoming message should be MTOMised.

Java Web Services (JAX–WS) made easy with WSO2 Web Services Application Server (WSO2 WSAS)

2008-09-21T02:43:00.000-07:00

The Java™ Web Services Tutorial at Sun web site is a guide to developing Web applications with the Java Web Services Developer Pack(Java WSDP). Chapter one of this tutorial describes how to write a JAX-WS web service and deploy it on Sun Java System Application Server Platform Edition 9 and also how to create a client for that service. I tried the same exact same sample on WSO2 Web Services Application Server (WSAS), found it very easy compared to Sun Java System Application Server. In this post, I list out steps you need to follow deploy a JAX-WS web service in WSO2 WSAS and how to write a client for that service.

I will be using the exact JSR 181 annotated service implementatio n class that is used by the java web services tutorial.


package helloservice.endpoint;

import javax.jws.WebMethod;
import javax.jws.WebService;

@WebService()
public class Hello {
private String message = new String("Hello, ");

public void Hello() {}

@WebMethod()
public String sayHello(String name) {
return message + name + ".";
}
}

First you need to compile this class and create a jar file.

Then you can use the web based Management Console to deploy the this service in WSO2 WSAS. All we need to do is go to "Upload POJO Artifact" in the "Add New Service" section.

And upload the jar file

And That's it. Now the service will be listed under available services. You will be able to access the WSDL 1.1 and WSDL 2.0 for this this service from there.

Let's see how we can write a client for this web service. You can use WSDL2Code tool comes with WSO2 WSAS to generate the Stub or a proxy to this service. This will generate the “HelloServiceStub” class which can used with in your client as a proxy to Hello service.

Then you can use that to implement a client for this web service.


package helloservice.endpoint;

public class HelloServiceClient {
  
   public static void main(String[] args) throws Exception {
      
       HelloServiceStub stub = new HelloServiceStub();
       String resoponse = stub.sayHello("Alice");
      
       System.out.println(resoponse);
       
   }
  

}

By deploying the service in WSO2 WSAS, you will get QoS functionalities like WS-Security and WS-ReliableMessaging for free. Further you can monitor the service, add throttling capabilities and configure logging very easily using the management console. Once you are done with the configuration, you can even completely disable the web management console.

You can download the latest build of WSO2 WSAS from here. Installation guide can be found here.

SOA is just for Java and .NET guys ? Not anymore.

2008-09-19T23:15:00.000-07:00

WSO2, The Open source middleware company is building web service stacks on most of the popular languages.

Java - WSO2 Web Services Application Server
C - WSO2 Web Services Framework for C
PHP - WSO2 Web Services Framework for PHP
Javascript - WSO2 Mashup server
C++ - WSO2 Web Services Framework for C++
Ruby - WSO2 Web Services Framework for Ruby
Python - WSO2 Web Services Framework for Python
Perl - WSO2 Web Services Framework for Perl
Jython - WSO2 Web Services Framework for Jython

Not like the existing stacks for these language, above stacks comes with full WS-* support. One good example is WSF/PHP 2.0. SD Times has published a nice comparison matrix on PHP web services stacks and it shows that WSF/PHP is the only PHP web services stack that has full support for WS – Security, WS – Reliable Messaging and Attachments.

What about interoperability? All these stacks are interoperable with each other. WSO2 StockTrader is a demo application is powered by WSO2 WSF/PHP, WSO2 WSF/Ruby, WSO2 WSF/Spring, WSO2 WSF/Perl, WSO2 WSF/Python and WSO2 WSAS which demonstrates interoperability between each these stacks and Microsoft Windows Communication Foundation (WCF). It is a stock trading sample application with functionality equivalent to the Microsoft .NET Stock Trader sample benchmark application and IBM WebSphere's Trade 6.1 sample application.

WSO2 Data Services 1.0 Released

2008-09-19T00:41:00.000-07:00

WSO2 Data Services is a convenient mechanism to provide a Web service interface for data stored in some data sources. Data sources such as relational databases, CSV files & Microsoft Excel files can be easily service enabled using Data Services. Now, the data can be exposed and accessed in a secure(using WS-Security) and reliable(using WS-ReliableMessaging) manner, and is also available for mashing-up with other Web services.

This presentation by Sumedha Rubasinghe , the WSO2 Data services guru is a great introduction to WSO2 Data services.

You can download WSO2 Data Services 1.0 from here. If you want to get started with WSO2 Data services, you may find these “WSO2 Data Services How To” tutorials very useful.

Accessing HTTP Request information with in a web service in Apache Axis2

2008-09-17T08:25:00.000-07:00

Sometimes you need to access the HTTP request information within the business logic of your web service. With Axis2, is this trivial as Axis2 keeps the HttpServletRequest as a MessageContext property. We can easily get hold of that extract the necessary information out of it. Here is a simple web service which demonstrates how do it.

Note: This only works in Axis2 war distribution. In standalone Axis2 this doesn't work.


public RequestInfo getInfo() {

   // Getting the current MessageContext
   MessageContext msgContext = MessageContext.getCurrentMessageContext();

   // Getting HttpServletRequest from Message Context
   Object requestProperty = msgContext
           .getProperty(HTTPConstants.MC_HTTP_SERVLETREQUEST);

   RequestInfo info = new RequestInfo();

   if (requestProperty != null
           && requestProperty instanceof HttpServletRequest) {

       HttpServletRequest request = (HttpServletRequest) requestProperty;

       // Extracting the properties from HttpServletRequest filling them in
       // RequestInfo bean
       info.setRemoteHost(request.getRemoteAddr());
       info.setCharacterEncoding(request.getCharacterEncoding());
       info.setUserAgent(request.getHeader("user-agent"));
       info.setLanguage(request.getLocale().getLanguage());

   }

   return info;
}

If you invoke this service via web browser, the output will be something like this.
http://localhost:9090/axis2 /services/RequestInfoService/getInfo

or you can try this out using soapui.

You can download the complete source of the this web service here. If you want the binary service archive to try this out, it can be downloaded here.

Want to run Apache Axis2 behind a proxy ?

2008-08-28T17:10:00.000-07:00

If you want to start the axis2 server behind a proxy, it is very simple. All you need to do is add the following entry to axis2.xml, the server's configuration file.


<axisconfig name="AxisJava2.0">
    ....
    <parameter name="Proxy">
        <Configuration>
                 <ProxyHost> proxy_ip</ProxyHost>
                 <ProxyPort> proxy_port </ProxyPort>
        </Configuration>
    </parameter>
    ..
</axisconfig>

This can become handy when you want to debug addressable ( dual channel ) scenarios where the axis2 server sends the reply in a separate channel and we want to monitor that reply through the TCPMon.

Writing your first Spring web service in WSO2 WSF/Spring

2008-08-12T07:03:00.000-07:00

WSO2 WSF/Spring is a project build on top of Apache Axis2 to provide an easy way to way to make Spring beans into Web services. I blogged about a WSF/Spring demo app in my last post and now I am going to use that demo app to expose a Spring bean as a web service using the code first approach.We will also invoke the service and make sure that it is working as expected. Good news is to try out all these, it won't take more than 10 minutes.

We are going to create StockQuote web service which will return quotes for given symbol. We will be using the WSO2 WSF/Spring demo application for this. Source code for this post can be found here. If you have not already read “WSO2 WSF/Spring - Apache Axis2 for spring web services developers”, please have a look at it first.

Oky now, let's look at the bean that we want to expose as a web service.


package org.wso2.training.wsfspring;

import java.util.Map;

public class StockQuoteService {

private Map quotesMap;

public Map getQuotesMap() {
 return quotesMap;
}

public void setQuotesMap(Map quotesMap) {
 this.quotesMap = quotesMap;
}

public String getQuote(String company) throws Exception {
 if (quotesMap.containsKey(company)) {
  return quotesMap.get(company);
 } else {
  throw new Exception("Ooops, " + company + " is not listed with us");
 }
}
}

So we have to put this java source file in the source directory [wsfspring/src/main/java/] under the correct package structure.

Now let's look at the applicationContext.xml [src/main/webapp/WEB-INF/applicationContext.xml] where all the Spring configuration is done. First we define the "StockQuote" bean.


<bean id="StockQuote" class="org.wso2.training.wsfspring.StockQuoteService">
<property name="quotesMap">
<map>
   <entry key="wso2" value="150"/>
   <entry key="ibm" value="100"/>
   <entry key="microsoft" value="100"/>
</map>
</property>

</bean>

Now we have defined the bean and we need expose it as a web service. We use “services” bean for that. Using the “serviceBean” property we refer to actual bean we want to expose as web service and "serviceName" defines the name of the service as given below.


<bean id="services" class="org.wso2.spring.ws.WebServices">
<property name="services">
<list>
<bean id="StockQuoteService" class="org.wso2.spring.ws.SpringWebService">
    <property name="serviceBean" ref="StockQuote"/>
 <property name="serviceName" value="StockQuoteService"/>       
</bean>
</list>
</property>
</bean>

And that is all you need to do to expose your Spring bean as a web service.

Oky, let's try this out. As described in the previous post all you got to do is run the maven build.

~../wsfspring$ mvn jetty:run

Now if you go to

http://localhost:8080/wsfspring/

you will be able to find StockQuoteService under services/available services.
So how can we invoke this service. Axis2 allows you to invoke the services through the web browser in a RESTful manner. So if we invoke StockQuoteService through the browser using

http://localhost:8080/wsfspring/services/StockQuoteService/getQuote?company=wso2

we will be able to see

and if we try a company that is not listed using

 http://localhost:8080/wsfspring/services/StockQuoteService/getQuote?company=oracle

So that's it. As you can see, it is very easy to create web services with WSO2 WSF/Spring. Next we will be look at how to secure WSF/Spring web services with Apache Rampart.Apache Rampart integration is a great advantage in WSF/Spring as Apache Rampart already supports most of the WS - Sec* specifications including

WS - Security 1.0 / 1.1
WS - Security Policy 1.1 / 1.3
WS - Secure Conversation 2005 / WS-SX
WS - Trust 2005 / WS-SX

specifications. So you will be able to get the full benefit of WS - Security using WSO2 WSF/Spring.

WSO2 WSF/Spring - Apache Axis2 for spring web services developers

2008-08-12T06:17:00.000-07:00

WSO2 WSF/Spring is a project build on top of Apache Axis2 to provide an easy way to way to make Spring beans into Web services. So why WSF/Spring ? Doesn't Axis2 have spring support ? Yes, but WSF/Spring does it 100% Spring way. So no more axis2.xml, services.xml etc and WSF/Spring is allabout Spring beans. So why not give it a try ?

In this post, we will look at a demo web application which is based on WSF/Spring to provide a basic introduction to WSF/Spring. The source of the demo application can be downloaded here. You need either Apache Ant or Apache Maven to build this demo application (Maven is preferred).

Before going in to more details, let's try out the demo application. So if you are using maven all you need to do is to do a maven build on root directory of the downloaded project
using the following command

~../wsfspring$ mvn jetty:run

The other alternative is to build the demo using Apache Ant

~../wsfspring$ ant

and deploy the generated war file [target/wsfspring.war]in a application server such as Apache Tomcat.

Now, if you go to following URL in the browser,


http://localhost:8080/wsfspring/

you will be able to see the home page of the demo application.

Using the "Services" link, you can see the web services currently deployed in WSF/Spring. Demo application comes with Version service and you will be able to see it if you to if you follow the "Services" link.

"Validate Axis2" link and be used to verify that Axis2 is working correctly. It checks whether libraries required for Axis2 are present and it even send request to the Version service to check whether it is working as shown below.

Now we got the demo application up and running and let's look at the source. First, let's look at the web application description file [wsfpsring/src/main/webapp/WEB-INF/web.xml]


<web-app id="WebApp_ID" version="2.4"
  xmlns="http://java.sun.com/xml/ns/j2ee"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://java.sun.com/xml/ns/j2ee http://java.sun.com/xml/ns/j2ee/web-app_2_4.xsd">

  <listener>
    <listener-class>
      org.springframework.web.context.ContextLoaderListener
    </listener-class>
  </listener>
    <context-param>
    <param-name>contextConfigLocation</param-name>
    <param-value>/WEB-INF/applicationContext.xml</param-value>
  </context-param>
   <servlet>
   <servlet-name>axis2</servlet-name>
   <servlet-class>
     org.wso2.spring.ws.servlet.SpringAxis2Servlet
   </servlet-class>
   <load-on-startup>1</load-on-startup>
 </servlet>
   <servlet-mapping>
   <servlet-name>axis2</servlet-name>
   <url-pattern>/axis2/*</url-pattern>
 </servlet-mapping> 
   <servlet-mapping>
   <servlet-name>axis2</servlet-name>
   <url-pattern>/services/*</url-pattern>
 </servlet-mapping>
   <welcome-file-list>
   <welcome-file>/axis2-web/index.jsp</welcome-file>
 </welcome-file-list>
</web-app>

SpringAxis2Servlet is defined as servelt in the web.xml and it's the servlet that takes care of all the Axis2 related stuff.

Now let's have look at the spring descriptor file [src/main/webapp/WEB-INF/applicationContext.xml] which will be the configuration file we will be working with most in WSF/Spring.


<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd">

<import resource="axis2Config.xml" />

<bean id="Version" class="org.wso2.spring.ws.Version">
<property name="version" value="Hello, I am WSO2 WSF/Spring version service. My version is SNAPSHOT"/>
</bean>
<bean id="services" class="org.wso2.spring.ws.WebServices">
<property name="services">
   <list>
       <bean id="VersionService" class="org.wso2.spring.ws.SpringWebService">
           <property name="serviceBean" ref="Version"/>
           <property name="serviceName" value="Version"/>
       </bean>
   </list>
</property>
</bean>

</beans>

First we have imported “axis2Config.xml” and all Axis2 related configurations goes in to this file. But for the moment, let's not worry about this.
And then we have the Version bean declared and WebServices bean is used to expose it as a web service.

Next we will look at how to expose a Spring bean as a web service in “Writing your first Spring web service in WSO2 WSF/Spring”;

How to send large files over the internet ?

2008-08-11T06:35:00.000-07:00

YOUSENDit and FileFlyer are two services which facilitates online transfers of lager files. These services come handy because most the emailing systems have limits on the attachment sizes. This diagram from YOUSENDit shows how this works. Right now, FileFlyer allows up to 1 GB file size for free accounts where as in YOUSENDit it is 100 MB. If you know any better services which provides this service, please share those.

Why can't we ship Apache Rampart as a standalone module all in one ?

2008-07-31T07:47:00.000-07:00

This questions pops up time to time in the mailing lits, so thought of digging to the question and see why really it is not possible. I totally agree that it would really handy if we can ship Rampart and all it's dependencies in a single mar file so deploying Rampart will be just a matter of dropping that mar file in to the module directory of the repository. So let's see what are the problems we have ? I see two problems here. So let's see what's the first one and it is the critical one. It's related to how Apache Neethi, which the policy implementation that Axis2 uses, loads the assertion builders. So let's see how it works. It uses Service Provider Interfaces (SPI), to load assertion builders. In SPI, we have services which are normally interfaces or abstract classes which defines the some service and service providers which are the concrete implementations of that service. So Neethi uses SPI, to get the correct assertion builder for a given assertion. So in this case org.apache.neethi.builders.AssertionBuilder is the Service. So how do we configure service providers. Each module in Axis2 which deals with WS-Policy can provider assertion builders for their domain assertions using a configuration file with the same name “org.apache.neethi.builders.AssertionBuilder” and putting it to the META-INF/services directory of the relevant domain specific jar file. For example of you look at the org.apache.neethi.builders.AssertionBuilder file in the META-INF/services directory of the rampart-policy-x.x.jar, you can see that it lists a set of service providers which implements org.apache.neethi.builders.AssertionBuilder interface. This is same with Sandesha 2 policy jar file. So what Neethi does is creates a map of Assertion QNames to Assertion builder instances, using this static code block in the org.apache.neethi.AssertionBuilderFactory .


   static {
       AssertionBuilder builder;

       for (Iterator providers = Service.providers(AssertionBuilder.class); providers
               .hasNext();) {
           builder = (AssertionBuilder) providers.next();

           QName[] knownElements = builder.getKnownElements();
            for (int i = 0; i < knownElements.length; i++) {
                registerBuilder(knownElements[i], builder);
            }
        }
        
        registerBuilder(XML_ASSERTION_BUILDER, new XMLPrimitiveAssertionBuilder());
    }

And Neethi doesn't use sun.misc.Service but uses it's own utility class, org.apache.neethi.util. Service to do this. So if we look at the Service class, it looks for org.apache.neethi.builders.AssertionBuilder files using the classloader of the org.apache.neethi.builders.AssertionBuilder.


   ClassLoader cl = null;
   try {
       // cls is AssertionBuilder.class in our case
       cl = cls.getClassLoader();
   } catch (SecurityException se) {
       // Ooops! can't get his class loader.
   }
   // Can always request your own class loader. But it might be 'null'.
   if (cl == null) cl = Service.class.getClassLoader();
   if (cl == null) cl = ClassLoader.getSystemClassLoader();

So here is the catchy part. It looks for the service provider configuration files using the classloader of AssertionBuilder class. So if we want our our service providers, that is domain specific assertion builders to be found they should be in the class path of the class loader of AssertionBuilder class which is in the Axis2 lib. So in this case, the Rampart jars which contains service provide r configurations files also need to go to in the Axis2 lib. AssertionBuilder must be able to load those service provider classes which are listed in the org.apache.neethi.builders.AssertionBuilder files. So until we solve this problem, having a standalone Rampart module is not possible.

Then the second problems is as we have two modules Rampart and Rahas, and if we we ship them as standalone modules we may have to ship all the rampart jars and dependency jars in both of those modules as those modules have their separate class paths when deployed in Axis2. Anyway this is not a blocker and may not be much of a problem.

When talking about this topic, some people tend to think that loading the password callback classes is also an issue here but is not. So the issue is service password callback handlers are packed in the service's archive (.aar) and the service has a separate class loader. But Rampart/WSS4J which lives in a separate module class loader needs to load these classes to get the passwords for various functions. But this not a problem because this explicitly handled by Rampart. So if we look at the code snippet that loads password callback handlers in org.apache.rampart.util.RampartUtil#getPasswordCB()

.

     String cbHandlerClass = rpd.getRampartConfig().getPwCbClass();
       ClassLoader classLoader = msgContext.getAxisService().getClassLoader();
     
       log.debug("loading class : " + cbHandlerClass);
 
       Class cbClass;
       try {
           cbClass = Loader.loadClass(classLoader, cbHandlerClass);
       } catch (ClassNotFoundException e) {
           throw new RampartException("cannotLoadPWCBClass",
                   new String[]{cbHandlerClass}, e);
       }

So as you can see this is not a problem regarding this issue.

Internet & Privacy : Can a plain old web site decide whether I am a male or a female ?

2008-07-19T11:42:00.000-07:00

Do we have any privacy on Internet? For example, when I am searching something on Google or reading emails on my gmail account, obviously Google reads them too. Otherwise how can Google put advertisements most relevant to the content of my emails on the right hand side under sponsored links? So at the end of the day, Google knows what my interests are , who I am dealing with , what my greatest fears are and almost everything about me. Let’s wish that Google will always honor their motto, “Don't be evil”. Anyway let’s forget Google for a moment.
When I was in DZone, I came across an interesting post about a widget which tries to determine whether you are a male or a female according to your browsing history. I know what you will say, “What? You gave it your browser history?“ . No, I didn’t, a simple javascript just stole that information from me. So how did it work. The script is called Social History. Idea of social history script is pretty simple. It has a set of links of social sites such as Del.icio.us, Digg, Facebook, Reddit, Technorati, Slashdot, etc. etc and it decides whether I have visited those links based on their css style (the color of the link). So Aza Raskin is trying to use this to show bookmark links in an optimal way. Rather than having a static set of bookmark links like I have below under each blog post, he is suggesting to present bookmarks links to sites which the reader is actually using which can be found using his script, Pretty neat idea :).
Now, Mike Nolet has gone one step further and developed a widget that tries to determine your gender based on your browser history using a simple algorithm with a modified version of Social History script. It uses US top 10K sites for this. You can try out the widget here. For me, it correctly determined I am a male with a probability 97% even though it has not worked for some people, so you better try and find out.

You may also find following video interesting about today's Internet.

OpenID, Phishing & PAPE, Are we there yet ?

2008-07-18T06:38:00.000-07:00

When I get to know how OpenID works, I was really impressed with the idea. It is pretty simple and straight forward compared to WS – Sec* stuff that I am messing up with. And it seems OpenID is becoming the hype and sometimes we tend to think of it as a silver bullet. (At least I thought). OpenID is cool as a SSO solution. But what about phishing. Does it prevent phishing ? The answer is no. In fact, it seems to make phishermens life easy by providing him a new way of driving the fish in to the nets. Why ? Because the way OpenID works the phishing site gets the control of redirecting the user to impersonating openID provider without much suspicion and it can find enough information about your openID provider to automate this process.
If you want see how this really happens, you can try out OpenID Phishing demo . And if you don't want to try it out Mike Jones has illustrated how OpenID Phishing demo works in his blog post "Gone Phishing". Stefan Brands also summarizes security issues of OpenID in his post “The problem(s) with OpenID”. And further, Ben Laurie’s describes this problem in more detail in his post "OpenID: Phishing Heaven" . In response, Simon Willison suggests how OpenID providers can help to reduce the risk of phishing. The idea is to make users directly go to the OpenID provider without redirecting them or making them follow links. According to Simon, “Instead of displaying the login form directly, providers should show a page that looks something like this: To log in, please navigate to login.example.com. The page your are currently viewing should contain no links; if there are any links or this text is changed in any way you may become a victim of online identity theft.”. He also suggests that OpenID provider URLs should be short, distinctive and memorable to make this effective. Yes, most of people agree that the best solution to prevent phishing is to educate the users but then again is this really possible ? Will some ordinary person will remember this if he is forwarded impersonating web sites which will directly offer a login screen or a link. Will someone who don't care a thing about what is on address bar will notice that is is not http://myopenid.com ?
One way of doing this is OpenID providers forcing users to use bookmark to login to OpenID provider. My OpenID's SafeSignIn is one such solution. But if someone impersonating the OpenID provider puts up a nice message saying as a new feature now you can login directly without using the bookmark how many people will fall in to that. Another solution is to use some pre configured images or icons , so that only the real provider can present you with the image/icon you chose and if you don't see the image/icon you can notice that you have landed on a spoofed site. Yahoo Sign in Seal and My OpenID's Personal Icon are two such solutions. But again, this depends on how much user is aware of these features. VeriSign's OpenID SeatBelt Plugin is another approach taken to prevent phishing. This plugin has an “Enable Phish Detection” option and when it is enabled, it tries detect phishing attempts when we are redirected to OpenID providers and always redirect us to the legitimate OpenID provider. Another solution is to use OpenID with Infocards.Kim Cameron talks on how to prevent phishing attacks with Infocard in detail in his blog post "Integrating OpenID and Infocard" .There are seems to be many other custom efforts to avoid phishing attacks but OpenID seems to be moving to a standard solution.
OpenID Provider Authentication Policy Extension (PAPE) specification tries to solve this problem by enabling OpenID relying parties to request that a phishing-resistant authentication method be used by the OpenID provider and for providers to inform relying parties whether a phishing-resistant authentication method was used. So if the OpenID provider doesn't authenticate the user in a phishing resistant way, OpenID provider should let the relying party know that it didn't use phishing resistant authentication so the relying party can decide what to do. But is this completely bullet proof ? This only guarantees that OpenID provider used a phishing resistant authentication this time as replying party asked so and it doesn't necessarily mean that it always used a phishing resistant authentication. What if some phisherman, impersonated a relying party and user has already become a victim of a phishing attack. Then when the legitimate relying party asks the open id provider to do the authentication in a phishing resistant manner, still the phisherman can succeed as he has already got the necessary information.
So it seems, protecting an average user from phishing only using the technology (without educating him with security concerns ) is a pretty hard thing. And yeah, we have to agree it is an inherent problem and not a problem of OpenID itself. So will we be able to get rid of phishing without users support just using the technology ? May be we will, someday. Who knows ....

Make a difference in someone's life, The Smile Train

2008-07-08T03:53:00.000-07:00

Everyone loves to have a pretty smile. But for some people, nature has not been so far. The smile train organization is a charity helping those people. According to The smile train,
"Unlike many charities that do many different things, The Smile Train is focused on solving a single problem: cleft lip and palate. Clefts are a major problem in developing countries where there are millions of children who are suffering with unrepaired clefts. Most cannot eat or speak properly. Aren’t allowed to attend school or hold a job. And face very difficult lives filled with shame and isolation, pain and heartache. The good news is every single child with a cleft can be helped with surgery that costs as little as $250 and takes as little as 45 minutes.

This is our mission:
-To provide free cleft surgery for millions of poor children in developing countries.
-To provide free cleft-related training for doctors and medical professionals.
Until there are no more children who need help and we have completely
eradicated the problem of clefts."

You can find more information in The Smile Train web site.

Nice way to say "Service is down"

2008-07-01T23:41:00.000-07:00

"We've decided to take IM plurkbuddy to the clinic for a full body checkup. Plurkbuddy will be back soon. We're sorry for the inconvenience."

Temptation ( fake A wish )

2008-07-01T10:37:00.001-07:00

I was thinking twice whether it is oky to blog about this or not but finally I couldn't help it. I know this not professional or even may not be ethical but thought of blogging about it after all. Today one of friends send me a link in the chat and I was like " What ....... @#$#%@ ". Then I found out that it is a hoax site which generates funny content with your name. If you want to give a 1 second lasting shock to one of your friends , just visit fake A wish site and fill in the form with his/her first name , last name. Then fake A wish will generate some funny ( and offensive :( ) content with your friends name on them. Then you can just IM the url. According fake A wish "We use a DNS trick that plugs the name of your choice into a fake story. The 'victim' name is not stored on our servers - it's totally dynamic, the story is 100% fake and only exists while you have the browser window open viewing the page. ". So it is 100% a joke and nothing will be saved or cached.
Disclaimer : The content is pretty offensive. Only try with your closest friends.

A Flip Trick...

2008-07-01T10:22:00.000-07:00

Are you on a windows machine ? Then go ahead hit CTL+ALT+(down arrow) and your desktop will be flipped. Just tried on a Windows XP box and it worked. Hit CTL+ALT+(up arrow) to restore. BTW, I found this information from textflipper and it says "when your co-worker gets up for coffee, hit 'CTL+ALT+(down arrow)' to flip the display on his/her PC" and still didn't get a chance to see what will be the reaction. Should try tomorrow on someone else's PC. :D
textflipper also allows you to flip text, sıɥʇ ǝʞı1 ( like this) . Just try it out, it's fun.

Twitter vs Plurk

2008-07-01T08:44:00.000-07:00

Have you ever heard of twitter ? I know you would say ... Yeah , duhh. But in case if you haven't heard it is a micro blogging tool where you can let other people know what you are doing. According to twitter , "Twitter is a service for friends, family, and co–workers to communicate and stay connected through the exchange of quick, frequent answers to one simple question: What are you doing " . So if you go to my twitter url , you will be able to find the answer. Yeah cool. And then you have Plurk. In Plurk, you are no longer have a one single answer , but you have a timeline where you can say what you have been doing / thinking / saying etc... etc ... . So if you go to my plurk url , you will be able to see what I have been doing. I heard about them sometime back but just today I got a chance to check them out.Pretty cool. I think I am beginning to like plurk over twitter. Finally a warning !!! this seems quite addictive ;) .
And if you interested in reading more about up and downsides of these two, you may find more information in these blogs , "Twitter versus Plurk: Not Even in the Same League" and "Twitter vs Plurk, who wins? " .

Viewing .docx ( MS Office 2007 ) files in Open Office

2008-06-15T08:34:00.000-07:00

Have you ever wanted to open a MS Office 2007 .docx file with Open Office on Ubuntu ? Open office by default can't .docx files. Even MS Office 2003 can't by default. But you can make Open Office read .docx files by simply installing this convector.

First you need to download convector.

Then simply install the package

sudo dpkg -i odf-converter_1.0.0-2~getdeb1_i386.deb

And that's it. Now you can open .docx file in Open Office.

Simplest Axis2 web service

2008-06-12T04:50:00.000-07:00

Do you know how easy it is to make a Java class a web service using Axis2 ? You know what , you can even invoke the service from your web browser and test it.

Oky, this is my Java Class. Simple Java class with only one method.


      package org.axis2.simple;

      public class SimpleService {
          public String sayHello(String name) {
              return "Hello " + name;
          }
      }

So we need to expose this class as a web service. How much effort will it take. You won't believe, it is only four lines of code.


    AxisServer axisServer = new AxisServer();
    axisServer.deployService(SimpleService.class.getName());
    System.in.read();
    axisServer.stop();

Now if you go to

http://localhost:6060/axis2/services/SimpleService?wsdl

in your web browser, you will be able to see the WSDL for the above wen service. So far, everything is cool. But how can I test whether this really works ? Yeah, you can test this service by invoking the service through the web browser. All you need to do is do a REST invocation. Say you do a simple HTTP GET with your name as a parameter.

http://localhost:6060/axis2/services/SimpleService/sayHello?name=Nandana

You will be able to get the response from the service as

<ns:sayHelloResponse xmlns:ns="http://simple.axis2.org">
<return>Hello Nandana</return>
</ns:sayHelloResponse>

and that's it. If you wanna learn more about Axis2, just visit Axis2 site or WSO2 oxygen tank.

What is OpenID ?

2008-06-10T22:21:00.000-07:00

I was thinking about writing a blog about OpenID for a long time but never ended up writing a one. Yesterday attended to a webinar done by Prabath Siriwardhana ( the OpenID Guru in WSO2 ) , so what a good time to for a blog about OpenID.

So what is an OpenID ? It is simply a URL ( or an XRI of course, let's forget about the XRI for the moment and simply look at the URL OpenIDs). For example, my OpenID is http://nandana.myopenid.com. Oky, why do I need an OpenID after all ? What problems does it solve ?

Let's take a practical scenario. We need to sign up for lots of web sites each day. So in each of these sites, I would like to have the username “nandana”. But in most of the cases, I can't because someone has already claimed it. So I will have to go for nandana83 and what if it is also gone, then nandanasm and then nandana.cse, etc. So I will eventually end up with hundreds of usernames and passwords. Not only username and password, most of these sites keep a profile of me. So if something like my address is changed I will have to go and change it in all my profiles. OpenID tries to solve this problem. If I am using OpenID to login to web sites, for all sites I only have a single OpenID, in my case that is http://nandana.myopenid.com and I just need to sign in once for all the sites ( and that is called SSO, single sign on ). Yes, I only need to sign in once at my openid provider, that is https://www.myopenid.com/ in my case and I only need to have a single username and password. Then that's it, I don't need to enter usernames, passwords to log in the web sites, I just need to provide my openid to other sites when I want to log in to them.

So let us look at how this really works. Let's start from the beginning. So I go to a site that uses OpenID for login and provide my openid , http://nandana.myopenid.com. So how does the web site know who my open id provider is. This process is known as Discovery. If you point your browser to http://nandana.myopenid.com and view the source of that html file, you fill find these information in the head section of html page.

<link rel="openid.server" href="http://www.myopenid.com/server" />
<link rel="openid2.provider" href="http://www.myopenid.com/server" />

These two standard attributes tell the web sites ( we call them relying parties ) , where the openid provider is. There two attributes one for OpenID 1.1 and one for OpenID 2.0. This process is called HTML based discovery where the web site ( Relying party), can do a simple HTTP GET to the OpenID url and find the OpenID provider using link elements found in the head element of the HTML documents. So I will be redirected to the my openid provider site ( only if you are not already logged in to the my OpenID provide site ). Pretty cool.

So my one and only id for all the sites is http://nandana.myopenid.com . But it is not under my control and it is under myopenid's (http://myopenid.com) control. This seems not good, say for example one day that I found out that my open id is compromised and I no longer want to use myopenid as my open id provider. It will be good if I can use an URL in my domain ( where I rule :) ) as my OpenID. This is possible with OpenID. In this case, what I do is use some URL that I own ( eg. http://mihindukulasooriya.org, if I buy this domain oneday ) as my OpenID and there at that URL I delegate the the OpenID functionality to a real OpenID provider. This can be done by having

<link href='http://www.myopenid.com/server' rel='openid2.provider openid.server'/>
<link href='"http://nandana.myopenid.com/' rel='openid2.local_id openid.delegate'/>

elements in the HTML document in the URL I own. In this case I use http://mihindukulasooriya.org as my OpenID and it is known as claimed identifier. I also have an account with myopenid.com and I delegate the OpenID functionality to myopenid.com using the openid I registered with them (http://nandana.myopenid.com) which is known as OP local identifier which is known to the open id provider. So if I want to switch the open id provider all I need to do is register with some other open id provider and change the above two values in my claimed id to point to the new open id provider and use my new open id I got from that provider as my op local identifier. So I am no longer locked to a single open id provider.

So is OpenID is a silver bullet ? So if I get an OpenID, am I safe from everything ? Nope, for example it doesn't address the problem of phishing. For example, if a site redirects you to something looks very similar to your OpenID provider and which is not, you may end up giving the username and password in the phishing site. You can avoid this possibility if you just sign in first to your open id provider before visiting any web sites. Yahoo's Sign-In seal is another approach that is used to prevent phishing at the OpenID provider side.

Oky, OpenID is cool. But where can I use it ? Web sites that allow OpenID login are increasing day by day. You can find a list of OpenID enabled sites here.

So what don't you get an OpenID and get rid of all the hassle of remembering hundreds of usernames and passwords ?

Real reward for writing articles

2008-05-22T03:29:00.000-07:00

Here in WSO2 where I work, we are always encouraged to write articles, tutorials, case studies etc. We are even given a financial reward for doing so.But the real reward for writing articles is the feedback you get in the mailing lists. I was so happy to see this in the Apache Rampart list and this in the Apache Axis2 list. But I think I am in the writer's block :( and it is so hard to start writing more articles.

Books Vs Movies

2008-03-10T04:08:00.000-07:00

I got three books for my last birthday even though I am not in to the habit of reading. My point is ( hmm , rather my point was ) you can buy a movie ( a DVD quality movie with 5.1 surround sound ) for 80 bucks ( and you can always download the latest movies free )and it only takes you 2 hours at most to finish it. On the other hand, if we go for a book it will cost you around thousand bucks and will take around good two days to finish it. So why should I go for a book ?
Just discovered that it is more fun reading a book than watching a movie. It gives more scope for imagination than a movie. You can imagine a lot about the characters, locations and almost everything. Like shall I put this guy a beard or what car I should give him if it is not already mentioned . Even better, you can think of people around you and make them the characters in the book. Believe me, it is fun.
BTW, I am currently reading the "The Undomestic Goddess" by Sophie Kinsella. It is about a highly ambitious workaholic woman (I am still in the middle of this book). Wanna a read part ?

"And I did just happen to notice that one of them came back missing a button" she adds. "The pink and white stripe."
"Oh,right" I say."Well... that's OK. I'll send it back. They won't charge."
"You can pop a button on yourself, dear!" Mrs.Farley is shocked."It won't take you two minutes. You must have a spare button in your workbox ?"
My what ?
"I don't have a workbox" I explain as politely as I can."I don't really do sewing."
"You can sew a simple button on, surely!" she exclaims.
"No,"I say, a bit rankled at her expression. "But it's no problem. I will send it back to the dry cleaners."
Mrs. Farley is appalled. "You can't sew a button on ? Your mother never taught you ? "
I stifle a laugh at the thought of my mother sewing on a button. "Er...no. She didn't."
"In my days" says Mr. Farley, shaking her head, "all well-educated girls were taught to how to sew a button. darn a sock, and turn a collar."
None of these means nothing to me. Turn a collar. It's gibberish.
"Well, in my days ... we weren't," I reply politely. "We were taught to study for our exams and get a career worth having. We were taught to have opinions. We were taught to use our brains," I can't resist adding.
Mrs. Farley doesn't seem impressed. "It's a shame" She says at last, and pats me sympathetically.
I'm trying to keep my temper, but I've worked for hours, I feel bone -tired and hungry, Ketterman is living two floors above me -- and now this old women's telling me to sew on a button ?
"It's not a shame," I say tightly.
"All right, dear," says Mr.Farely in pacifying tones, and heads across the hallway to her flat.
Somehow this goads me even more
"How is it a shame?" I demand, stepping out of my doorway."How? OK, may be I can't sew on a button. But I can restructure a corporate finance agreement and save my client thirty million pounds". That's what I can do."
Mrs. Farley regards me from her doorway. "It's a shame," She repeats, as though she didn't even hear me. "Good night, dear". She closes the door and emit a squeal of exasperation.
"Did you never hear of feminism ?" I cry at her door. But there's no answer.

A tribute to Defense Forces of Sri Lanka

2008-01-30T20:50:00.000-08:00

Your alarm goes off; you hit the snooze and sleep for another 10 minutes
He stays up for days on end

You take a warm shower to help you wake up
He goes days or weeks without running water

You complain of a "headache", and call in sick
He gets shot at as others are hit, and keeps moving forward

You put on your anti war/don't support the troops shirt, and go meet up with
your friends
He still fights for your right to wear that shirt

You talk trash about your "buddies" that aren't with you
He knows he may not see some of his buddies again

You walk down the beach, staring at all the pretty girls
He walks the streets, searching for insurgents and terrorists

You complain about how hot it is
He wears his heavy gear, not daring to take off his helmet to wipe his brow

You go out to lunch, and complain because the restaurant got your order
wrong
He doesn't get to eat today

Your wife/mother/ maid makes your bed and washes your clothes
He wears the same things for weeks, but makes sure his weapons are clean

You go to the mall and get your hair redone
He doesn't have time to brush his teeth today

You're angry because your class ran 5 minutes over
He's told he will be held over an extra 2 months

You call your girlfriend and set a date for tonight
He waits for the mail to see if there is a letter from home

You hug and kiss your girlfriend, like you do everyday
He holds his letter close and smells his love's perfume

You roll your eyes as a baby cries
He gets a letter with pictures of his new child, and wonders if they'll ever
meet

You criticize your government, and say that war never solves anything...
He sees the innocent tortured and killed by their own people and remembers
why he is fighting

You hear the jokes about the war, and make fun of men like him
He hears the gunfire, bombs and screams of the wounded - and of the
innocents who have no one to stand up for them

You see only what the media wants you to see
He sees the broken bodies lying around him

You stay at home and watch TV
He takes whatever time he is given to call, write home, sleep, and eat

You crawl into your soft bed, with down pillows, and get comfortable
He crawls under a tank for shade and a 5 minute nap, only to be awakened by
gunfire

You sit there and judge him, saying the world is probably a worse place
because of men like him
If only there were more men like him!

WHO is HE?

Perhaps people will change their attitude and behavior to support HIS
worthy cause... HE is sacrificing his today for our future Sri Lanka !!!

Star wars - The command line movie

2008-01-29T19:16:00.000-08:00

Have you ever watched a command line movie. If not, just type

telnet towel.blinkenlights.nl

in your command line. This is really cool. Here are some screen shots.

Live online training from WSO2 - Apache Rampart

2008-01-29T00:37:00.000-08:00

you can register for the training here.

Course Summary:

Apache Rampart is an Axis2 module that supports various service security standards. This 3-hour course is designed to give an overview on Web services security for an audience who is new to this area.

Course Objectives:

Understand WS-Security concepts
Learn how to use Apache Rampart to meet different security requirements

Duration:

3 hours

Audience:

Beginners with a basic knowledge of XML and SOAP.

Prerequisites:

None.

Program:

XML-Signature
XML Encryption
WS-Security
- UsernameToken authentication
- Encryption
- Signature
Secure multiple messages with WS-Secure Conversation and WS-Trust
WS-Security Policy
Apache Implementations – WSS4J and Rampart
- Introduction to Apache WSS4J architecture
- Introduction to Apache Rampart architecture
Demonstration
- Different configuration approaches of Apache Rampart (Here we will explore all samples of the standard Apache Rampart release)
- Setting up clients and services with parameter based and policy based configurations.
- Securing services and clients using both dynamic and static configuration approaches.

Things I didn't know about GMail

2008-01-25T06:09:00.000-08:00

My email is in the format first.last@gmail.com format. So I thought if someone wants to send me a mail, he/she has to type the exact email address. But today only I found that, all the addresses given below will send the email to the same addy.

firstlast@gmail.com ( Omitted the dot )
First.Last@gmail.com ( Capitalized some letters )
first.last+TEST@gmail.com ( added +TEST to the end )

Quite interesting :)

Meanings of Apache votes

2008-01-25T02:32:00.000-08:00

If you are involved with an Apache project, you always see certain votes going in the mailing lists. Have you ever wonder, what each vote means ?

+0: 'I don't feel strongly about it, but I'm okey with this.'
-0: 'I won't get in the way, but I'd rather we didn't do this.'
-0.5: 'I don't like this idea, but I can't find any rational justification for my feelings.'
++1: 'Wow! I like this! Let's do it!'
-0.9: 'I really don't like this, but I'm not going to stand in the way if everyone else wants to go ahead with it.'
+0.9: 'This is a cool idea and i like it, but I don't have time/the skills necessary to help out.'

you can find more info here.

Installing java plugin for firefox on Ubuntu - Gusty

2008-01-24T18:42:00.000-08:00

I had tough time ( 2 days ), actually trying to install the sun java plugin in firefox. I installed the plugin using

sudo apt-get install sun-java6-plugin

everything seemed to be fine, but everytime i try to run an applet on the browser, firefox uses gcj java plugin (GUN java) instead of sun java plugin. So I couldn't get the applet running. Only possible work around was to remove the gcj java plugin, which made firefox to use the sun java plugin.

BTW, learned a quite useful set of firefox commands which made the efforts I put worthy. You can view the installed plugins and their details in firefox using the command

about:plugins

you have type the command in the address bar and firefox will list all the plugin details.

and you can test which version of java, your browser is using in this link.

AdRotator control in ASP.NET

2008-01-07T04:25:00.000-08:00

I always wanted to learn some .NET stuff (mainly web services), but I was always stuck with Java. Most of the time, I have to work with java stuff. So I started with ASP.NET web applications. Even though I am not a .NET fan, have to admit it can be handy when we want to create a web app in a rapid development environment. So I was writing "Hello world" in ASP.NET and found a handy controller. It is called "AdRotator" and it is simply cool .... , just take a look .

AdRotator

Wow, it is a nice view from space !!!

2008-01-07T04:11:00.000-08:00

View Larger Map

N95, N73 or good old 6230 ?

2007-12-11T19:29:00.000-08:00

This is the major question I have on mind these days. I badly need a 3G phone. Mobitel launched 3G two three days back and I wanna go 3G. Of course there are other reason too. There are people we wish would always be with us, but when it comes to reality we sometimes see then as rarely as once in a month. Yeah, yeah, I am talking about her, dude. So if I can go for a 3G phone at least I can see her everyday. So that is my requirement, plain and simple, 3G. So the main options I have is N73 and N95 as they are the most common ones here. N73 would be around 40K where as N95 would be 70K. So the obvious option is N73. Who would want to spend 70K for a phone. I would have said the same thing to 40K but what to do, after all I need a 3G phone. But you know, when you go through the specification of N95 you don't want to miss it. It is such a cool phone. Got everything. 5MP camera, 3G, WiFi, you name it. But when I went through the reviews user experience was not that good. So it at least give one good reason to go for N73 other than the cost factor. So next week, I might have a N73 ( or N95 ) with me :). Or shall I wait till the next year. Will see.

Back to blogging , Version 2 ;)

2007-12-10T18:57:00.000-08:00

Writing a random blog is easy. But making it a habit, I was not able to do it so far. When I travel in the morning, there are so many things in my head that I always think when I go to the office, I should blog about them. But when I come to the office, I just check mail and there are issues and other things, so never blog. Just start work right away. But now on, I am determined blog at least few lines each day, so that it would become a habit :). Wish me luck ......

Jackrabbit

2007-03-20T01:11:00.000-07:00

Jackrabbits are leporids belonging to the genus Lepus.They are very fast moving.Normally a shy animal, the European Brown Hare changes its behaviour in spring, when hares can be seen in broad daylight chasing one another around meadows; this appears to be competition between males to attain dominance (and hence more access to breeding females). Oooops, that is what the wikipedia says. But that is not what I am talking about.
Jackrabbit is an open source project that took my interest these days. When I was going through the Summer of Code proposals ( By the way, I should write a separate post on summer of code ) , I came across this project proposal to build a demo blog application on the jackrabbit JCR implementation. I really didn't know much about content repositories until I went through the JSR 170 specification. I knew about database , XML configuration files , property files but not content repositories. So it was a new thing ( to me ) so I was in interested. Jackrabbit site can be found at (http://jackrabbit.apache.org/). One thing about the Jackrabbit community, they are very supportive and helpful. These days I'm sending mails to the mailing list to grab some information, I really get a good feedback. Wish I can successfully complete this project and be a Guru in JCR.

Back to blogging

2007-03-16T21:37:00.000-07:00

Yep, it has been a long time since I wrote my last blog. I was doing my internship then. But when I came back to uni again , oh yeah, work work and more work as usual. So couldn't find much time to blog. You won't believe we did ten subjects with at least two three assignments a week. So life was tough and didn't feel like blogging. But anyway lot of things happened during that time. Some very happy moments which should have been blogged .....
These days most of my time is spent for my final year project, CMe a.k.a MyDiary, mblogging suite. I'm determined to update the blog regularly here onwards. So here I'm at Blogger again.

iKVM

2006-06-14T04:41:00.000-07:00

what ? you may probably heard of KVM ( K Virtual Machine ) , which is sun’s implementation of the Java 2 Micro Edition ( J2ME ) J2ME. But what is iKVM , (it has no relation with KVM as far as I know ) iKVM is an implementation of java for Mono and Microsoft .NET framework. Yes, that means you can use your java libraries in .NET or mono. Say you have implemented your business logic in java already and you want to migrate to C# , iKVM removes the necessity of re-implementing it in C# again and you and use iKVM and convert the necessary java libraries in to dll’s or exes . Further you can develop your .NET applications in java if you want.

iKVM consists of

IKVM.Runtime.dll (VM runtime)
IKVM.GNU.Classpath.dll (compiled version of GNU Classpath)
IKVM.JNI.[Mono|CLR-Win32].dll (JNI interface)
ikvm.exe (Starter executable)
ikvmc.exe (Static compiler)
ikvmstub.exe
IKVM.AWT.WinForms.dll

you can find more about these components from the official site.A little word about GNU Classpath , it is open source GNU project which creates free core class libraries for use with virtual machines and compilers for the java programming language. When I was writing this , GNU Classpath was almost compatible with JDK 1.4 .

Convert java libraries in to .net or mono assemblies

iKVM provides a with a easy to command tool, ikvmc which can be used to generate dll’s or exe’s from java class files or .jar archives. Usage of this tool is pretty simple.

ikvmc [-options] "class file or jar file" "more class fiels or jar files"

there are many options available but I will just mention a few. Use of most of the options is obvious from the name. For example –out option can be used to provide the name of the output file or –version to provide the version. And -reference: or in short –r: to make a reference to another assembly . Somewhat for important option would be –keyfile or –key . This options lets us to give the output assembly we are building a strong name. Strong name is the concept that .net uses to eliminate the problem commonly known as “dll hell”. If you want to add the dll you are creating in to the .net GAC ( Global Assembly Cache ) , having a strong name is a must. Actually I wasted two days figuring out a method to assign a strong name to the dlls I created, just because of I didn’t go through the usage well and that is why I thought I should mention little more about this option here.

References:

iKVM - http://www.ikvm.net/
GNU Classpath - http://www.gnu.org/software/classpath/home.html

Galle Face

2006-05-25T08:06:00.000-07:00

Today in the early morning, I went to galle face at about 5.30 am. If you haven't been there, at that time , just go once and see. It is so cool ... At that time there is no one there except for the few policemen at the police post. And such a breeze .... you got to experience it ..... You know what, I am going tomorrow too ...

XSLT

2006-05-24T08:00:00.000-07:00

If you don’t know what XSLT is or how it works, don’t worry , I also didn’t know anything about it yesterday, but is it pretty easy to catch up if you know little XML. XSLT ( eXtensible Stylesheet Language Transformations ) is a cool thing that allows us to transform XML documents into XHTML or XML or text documents. You may not see how a useful tool this is at the first sight but when you use it you come to get to know how useful and powerful tool that is. By the way, I won’t write my own tutorial for XSLT because there are so many great tutorials available in the web and I will just mention some good links ……

http://www.w3schools.com/xsl/ ( make sure to go through this )
http://incrementaldevelopment.com/xsltrick/
http://www.4serendipity.com/xml/testfiles/xmlexamples.html

If these links are not working just google “XSLT” , you will get more than enough tutorials and plenty of examples.

And as I believe, the best way to learn something is to get a hands in experience by playing with it a little, doing some example, changing some code and looking at what is happening. There was a great tool which allowed me to do these things , so I will mention it also here so that it will be useful if you want to write some XSLT and test them. This a GUI based program which is so easy to use and free to download J. It is called XRay2 XML editor. You can download it from here ….

http://www.architag.com/xray/

Believe me, when you get to know XSLT , you will see so many places where you can apply it . So why wait ……..

My First Blog

2006-05-24T05:47:00.000-07:00

Hi Everyone ,

This is my very fisrt blog , so nothing comes to mind at this moment. So let me tell you why I thought of having my own blog. I have learned a lot by reading other peoples blogs and what a wonderful idea to share our ideas , experience in a blog like this. So thought I should also contribute what I know, though the scope is so small, for the sake of others. So here I am ...