My Devoxx 2009

The following is my schedule for the Devoxx conference. In red the presentations I will attend. If you would like to suggest me other presentations you would like to hear about from me, send me a line and I will try to attend them.

Build or simply compile?

With Parancoe I already have a very productive environment for the development of my applications. I can have unit tests on most of the code, so I rarely need a full build and redeploy.

But sometimes it would be nice (and necessary) to just code and try the result in the browser. With JavaRebel you can do this simply compiling the new code, without the need of a full build and redeploy of your application.

For example, in my current parancoe-based project, I modified a method in the the HomeController, and some code (even adding a new method) in the UserProfileBo class.

Then I just recompiled the project, in 3 seconds:

NetBeans: Executing 'mvn -Dnetbeans.execution=true compiler:compile'
NetBeans:      JAVA_HOME =/usr/lib/jvm/java-6-sun
Scanning for projects...
Searching repository for plugin with prefix: 'compiler'.
------------------------------------------------------------------------
Building minimark Web Application
   task-segment: [compiler:compile]
------------------------------------------------------------------------
[compiler:compile]
Compiling 2 source files to /home/lucio/MyWorks/minimark/minimark/target/classes
------------------------------------------------------------------------
BUILD SUCCESSFUL
------------------------------------------------------------------------
Total time: 3 seconds
Finished at: Sun Aug 09 08:14:56 CEST 2009
Final Memory: 18M/144M
------------------------------------------------------------------------

When I refreshed the page in the browser, the log of my Tomcat showed:

JavaRebel: Reloading class 'com.benfante.minimark.controllers.HomeController'.
JavaRebel-Spring: Reconfiguring bean 'homeController' [com.benfante.minimark.controllers.HomeController]
JavaRebel: Reloading class 'com.benfante.minimark.blo.UserProfileBo'.
JavaRebel-Spring: Reconfiguring bean 'userProfileBo' [com.benfante.minimark.blo.UserProfileBo]

Notice the classes not only have been reloaded, but also the spring-managed annotation-configured beans have been reconfigured.

The configuration of JavaRebel (in this case) is very easy.

In my Maven pom.xml:

  org.zeroturnaround
  javarebel-maven-plugin
  
    
      generate-rebel-xml
      process-resources
      
        generate
      
    
  

The Tomcat configuration is:

CATALINA_OPTS="-XX:PermSize=32m -XX:MaxPermSize=200m -Xmx256m -Dfile.encoding=UTF-8 -noverify -javaagent:/home/lucio/local/javarebel-2.0/javarebel.jar -Drebel.spring_plugin=true"

Gregorio

Gregorio
Inserito originariamente da Lucio Benfante

Un benvenuto a Gregorio, fratellino di Carlo e Silvia, che gli fanno tanti auguri e non vedono l'ora che arrivi a casa.

Sì, al momento è tranquillo come appare, speriamo continui così

Mutable authorities with Spring Security and CAS

Recently I worked on an application with the following requisite:

The logged user must select its current role among the roles for which he's authorized.

A simple requisite, and (apparently) it's easy to implement it with Spring Security: write an UserDetails class in which you can select the returned authority(ies). For example:

public class LoggedUserWithSelectableRole extends User {
    private GrantedAuthority currentAuthority;

    public LoggedUserWithSelectableRole(String username, String password,
            boolean enabled, GrantedAuthority[] authorities) throws IllegalArgumentException {
        super(username, password, enabled, authorities);
    }

    public void setCurrentAuthority(GrantedAuthority currentAuthority) {
        this.currentAuthority = currentAuthority;
    }

    @Override
    public GrantedAuthority[] getAuthorities() {
        if (Arrays.asList(super.getAuthorities()).contains(currentAuthority)) {
            return new GrantedAuthority[] {currentAuthority};
        } else {
            return new GrantedAuthority[0];
        }
    }

    public GrantedAuthority[] getAllAuthorities() {
        return super.getAuthorities();
    }
}

Now you can select an authority for the logged user (for example, in a controller):

@RequestMapping
public String selectRole(@RequestParam(value = "role") int role) {
    LoggedUserWithSelectableRole user =
            (LoggedUserWithSelectableRole) SecurityContextHolder.getContext().
            getAuthentication().getPrincipal();
    user.setCurrentAuthority(user.getAllAuthorities()[role]);
    return "redirect:/";
}

Unfortunately this is not sufficient, as the authorities used by Spring Security for checking the user authorization are not (usually) stored in the principal object, but it the Authentication object.

It would be nice to write something like:

/* WARNING: The method setAuthorities  doesn't exist */
SecurityContextHolder.getContext().getAuthentication().
        setAuthorities(user.getAuthorities());

But the Authentication token is mostly immutable, so the setAuthorities doesn't exist. Worst, in the AbtractAuthenticationToken class, the base class of most of the token implementations, the authorities attribute is private, so you can't easily implement by yourself an alternative token implementation extending the original token class.

In our application we are using CAS. The only solution I found (as far as I know...please send me a line if you see a better solution) was to extend the CasAuthenticationToken, provinding a costructor for coping an existing token (of course of the same type):

public class UpdatableCasAuthenticationToken extends CasAuthenticationToken {

    private final int keyHash;

    public UpdatableCasAuthenticationToken(CasAuthenticationToken token, GrantedAuthority[] authorities) {
        super("BOH", token.getPrincipal(), token.getCredentials(), authorities, token.getUserDetails(), token.getAssertion());
        this.keyHash = token.getKeyHash();
    }

    @Override
    public int getKeyHash() {
        return this.keyHash;
    }

}

As you can see, we also need to hide attributes and override methods not modifiable through the constructor of the base class.

Now I can substitute the original token with the modified one:

@RequestMapping
public String selectRole(@RequestParam(value = "role") int role) {
    LoggedUserWithSelectableRole user =
            (LoggedUserWithSelectableRole) SecurityContextHolder.getContext().
            getAuthentication().getPrincipal();
    user.setCurrentAuthority(user.getAllAuthorities()[role]);
    SecurityContextHolder.getContext().setAuthentication(
        new UpdatableCasAuthenticationToken(
            (CasAuthenticationToken) SecurityContextHolder.getContext().getAuthentication(),
            user.getAuthorities()));
    return "redirect:/";
}

As CAS ha no concerns with the user roles, I think CasAuthenticationToken should provide a way for updating authorities, and maybe the authorites attribute of AbstractAuthenticationToken should be declared as protected.

Cantucci

Oggi ho provato un nuovo "algoritmo" culinario: i cantucci. Ok, siamo un po' fuori stagione...ma non si può mica sempre aspettare Natale, no? :)

La ricetta originale l'ho presa da sito Misya.info, con gli opportuni adattamenti.

Partiamo dagli ingredienti:

• 270g di farina "0"


• 200g di zucchero


• un cucchiaino abbondante di lievito in polvere


• un bacello di vaniglia


• due uova intere


• 150g di mandorle

Sbattere le uova.
Aggiungere la farina, lo zucchero, il lievito, il contenuto del bacello di vaniglia e un pugno di mandorle.Impastare fino ad ottenere un impasto abbastanza sodo, eventualmente aggiungendo un po' di farina se dovesse risultare troppo appiccicoso.

Aggiungere la scorza dell'arancia e le mandorle. Formare due "diti" su una teglia ricoperta da carta da forno.


Cuocere in forno per circa 30 minuti a 180°C.

Tagliare i diti diagonalmente per formare i cantucci.

Infornare per un'altra quindicina di minuti, per far asciugare bene anche l'interno.
Mangiare. :P

Tiles 2, a cheaper configuration

In a previous post I described how to use Tiles 2 in a Parancoe/Spring MVC project. What is really irritating for me in Tiles is its configuration file, a long list of almost identical XML fragments. Moreover that configuration rarely needs to be changed, so it's in practice useless, and just a waste of time (and effort) during the development.

If your application, as usually, has a main layout, and only few pages adopt a specific layout, I think there could be an easy and pleasant solution.

I defined a new view class (CheapTilesView) that can be used with an UrlBasedViewResolver:

<bean id="viewResolver"
        class="org.springframework.web.servlet.view.UrlBasedViewResolver">
    <property name="viewClass" value="org.parancoe.plugin.tiles.CheapTilesView"/>
</bean>

Now the Tiles configuration file could be simply:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE tiles-definitions PUBLIC
       "-//Apache Software Foundation//DTD Tiles Configuration 2.0//EN"
       "http://tiles.apache.org/dtds/tiles-config_2_0.dtd">
<tiles-definitions>
    <definition name="template.main" template="/WEB-INF/tiles/templates/main.jsp">
        <put-attribute name="header" value="/WEB-INF/jsp/header.jsp"/>
        <put-attribute name="menu" value="/WEB-INF/jsp/menu.jsp"/>
        <put-attribute name="footer" value="/WEB-INF/jsp/footer.jsp"/>
    </definition>        
</tiles-definitions>

(compare with the configuration of the previous post)

All the omitted definitions are automatically created at runtime using the URL. For example, if the URL is admin/conf and a definition with that name doesn't already exist in your configuration file, the CheapTilesView class will generate (at runtime) this for you:

<definition name="admin/conf" extends="template.main">
    <put-attribute name="main" value="/WEB-INF/jsp/admin/conf.jsp"/>
</definition>

So in you configuration file you only need to write the definitions of your (usually few) pages with a specific layout.

The conventions used by the CheapTilesView can be customized passing some attributes to the view resolver. The following are the default values:

<bean id="viewResolver"
        class="org.springframework.web.servlet.view.UrlBasedViewResolver">
    <property name="viewClass" value="org.parancoe.plugin.tiles.CheapTilesView"/>
    <property name="attributesMap">
        <map>
            <entry key="org.parancoe.plugin.tiles.CheapTilesView.DEFAULT_TEMPLATE" value="template.main"/>
            <entry key="org.parancoe.plugin.tiles.CheapTilesView.DEFAULT_ATTRIBUTES" value="main"/>
            <entry key="org.parancoe.plugin.tiles.CheapTilesView.DEFAULT_PREFIX" value="/WEB-INF/jsp/"/>
            <entry key="org.parancoe.plugin.tiles.CheapTilesView.DEFAULT_SUFFIX" value=".jsp"/>
        </map>
    </property>
</bean>

The class is available in the Parancoe svn repository. Very soon it will be released as a Parancoe plugin. Stay tuned.