ADF Security Revisited (Again Again)

This is a revisit of the ADF Security features under JDeveloper 11g and subsequent deployment to WLS. There are plenty of good examples and documentation on this feature and readers are encouraged to seek those out. This post is my cut of implementing ADF Security to make sure I've all the moving pieces clearly defined in my head. As usual I thought this post may be of interest to readers.

Assumptions

Readers understand the security concepts of authentication and authorization, and readers are familiar with the WLS security "myrealm" concept.

Sample Application

What I find difficult with the JDev 11g Fusion Guide is the raw depth of information to read and assimilate around the security space. Section 29 has 80 odd pages on security which is a lot to digest. Without a doubt security is an important topic but trying to understand the full 80 pages leaves me wiped out.

To make the discussion on ADF Security easier, let's discuss an extremely simple application and then describe what we're attempting to achieve in terms of security.

Consider the following application:


... and the following page flow:


The diagram reveals the following points about our application:

1) The Splash page is a landing page for our application where new unauthenticated sessions will land as they access the application for the first time. This page will be a simple web page with no ADF Bindings. It will provide links to the other 3 pages.

2) ViewBookings, a page showing data using ADF Bindings, will be a secured page. Only authenticated users will be able to access the page and they must have the ADMIN role.

3) ViewEvents, another databound ADF page using ADF Bindings, will also be a secured page. Only authenticated users will be able to access the page, but there are no role restrictions on the page, giving any authenticated user the right to access the page.

4) ViewOrganisations, another databound ADF page using ADF Bindings, will not be secured. Therefore authenticated and non-authenticated users will be able to access the page, and implicitly via this, there are no role restrictions on the page.

(You'll note in the above points I've been careful to identify databound pages that have ADF Bindings (ie. ViewBookings) and those that don't (ie. Splash). The ADF Security mechanisms *only* work for pages that have ADF Bindings and the relating pagedef files. A page that doesn't have ADF Bindings is not secured. This implies how we treat the unbound Splash page vs the bound ViewOrganisations page is different. The mechanisms for this will become apparent further in this post.)

Best practice side note: as a general recommendation while this article demonstrates a page that is totally unsecured via the ADF Bindings mechanism, readers should give strong consideration to create PageDef files for all pages regardless if they are databound or not. This is done by selecting the Page Definitions option from the page's context menu, then allocating them the anonymous-role making them accessible to anyone as explained later in this article. Implementing this gives you a number of advantages:

a) Improved control of the public page's content, displaying different content for authenticated vs unauthenticated users
b) A consistent security implementation across all pages
c) Easier to audit the security implementation

In order to support our application as described in the points above, we'll need a number of security "parts" for our application. Following is a summary of those parts, of which we'll describe in detail next in this document

1) A login page to authenticate users
2) An application role called ADMIN
3) An application role that identifies authenticated users
4) An application role that identifies a user regardless if they're authenticated or not
5) The ability to secure the ViewBookings page for users with the ADMIN role
6) The ability to secure the ViewEvents page for users who are authenticated
7) A mechanism to create users, create roles and assign users roles

Luckily JDeveloper provides a number of features to make this easy.

We'll add one other further security requirement. Though our application will internally make use of a role named ADMIN, once deployed to our application server the role will be called ADMINISTRATOR. As such our additional requirement is:

8) Map the application role ADMIN to the enterprise role ADMINISTRATOR.

A final point before continuing, in order to keep this example simple I've steered away from the ADF Task Flow features of JDev 11g, specifically bounded task flows. In this simple example I've stuck to the default single unbounded task flow with separate pages in order to aid understanding. In reality both task flows and pages are treated in a similar fashion so what you learn here will apply to both.

Configure ADF Security

The ADF Security wizard implements a number of the security features we require. For our open application selecting the Application menu -> Secure -> Configure ADF Security option invokes the Configure ADF Security wizard. This wizard has been described in a number of other documents and examples, so I'll not talk through all it's options, but rather just show the options picked for our example.

In step 1 of 5 we pick the ADF Authentication and Authorization option:


Step 2 of 5 we'll get JDev to create a login and error login page for us, such that the user will see an in-page login page in our application to authenticate themselves:


Step 3 of 5 we'll ask JDev to blanket grant privileges to our existing pages. We'll tidy this up in a later step. Typically we wouldn't use this option but rather the "No Automatic Grants". No grants forces developers to explicitly think about each page and what privileges to define. For demonstration purposes we're showing the other option:


Step 4 of 5 we'll leave the "Redirect" option unselected. When selected this option provides the ability to have all authenticated users redirected to a standard landing page:


Step 5 of 5 tells you what changes JDev will make on your behalf to implement the features. This screen is useful as it gives you a good understanding of what configurations are required to make ADF Security work.


Once completed the most important JDeveloper screen from here for configuring security in your application is the jazn-data.xml editor. It's accessible by opening the file under Application Resources -> Descriptors -> META-INF -> jazn-data.xml, or the Application menu -> Secure -> ADF Policies. Ensure the Overview tab at the bottom of the editor is selected. On first opening the jazn-data.xml file you'll see:


As our application includes no bounded task flows, just web pages, select the Web Pages tab at the top of the editor. For our specific application it reveals:


From here you can see three of our four pages. As the Splash screen has no ADF Bindings, it does not display and therefore has no options for defining grants and priviliges. This is because as we mentioned early in the post, only databound pages are secured by ADF Security. If we alternatively select one of our databound pages we see:


In this case the ViewBookings databound page has the role "test-all" with "View" access granted to it. In a similar fashion ViewEvents and ViewOrganisations will have the same mappings. The role "test-all" and blanket assignments to each page was generated by step 3 of the Configure ADF Security wizard.

At this stage, of our initial 8 security requirements, we've implemented #1 only. Obviously the last few steps have set up a lot of internal infrastructure and configuration for us behind the scenes which assist the next sections of work.

Application Roles vs Enterprise Roles

Our application has the security requirement to create a role called ADMIN and secure the ViewBookings page with that role. In JDeveloper security "speak" this sort of role is referred to as an *Application Role*, effectively a role that the application defines and wants to enforce against certain resources, namely web pages and task flows in our ADF application. At deployment time this role is essentially private to the application.

Application Roles are distinctly different from Enterprise Roles as they have a finer level of granularity, they only apply to one application. Conversely Enterprise Roles map to user groups within an organisation and can apply across applications, though they allow the flexibility of a 1 to 1 mapping with Application Roles too.

Another way to categorize the difference between Application Roles and Enterprise Roles is where they're implemented. Application Roles are implemented in the application at hand, while Enterprise Roles are configured in our application server or higher level identity management systems such as LDAP, MS Active Directory, OID and more.

This distinction becomes important as we configure our Application Roles, as we need to define both the Application Role, the Enterprise Role, and the mappings between them. If we don't do this, when the application is deployed, and a user accesses the system with the Enterprise Role ADMINISTRATOR, the application server has no way of knowing that this maps to the application's ADMIN role.

As per the previous section the JDeveloper security wizard predefines an Application Role named "test-all" for us. From the jazn-data.xml editor this is evident on the existing grants to pages and task flows. The intention is for development and testing purposes, any user granted the test-all role has unlimited access to the application. For a production environment this role is not suitable as it is granted to all anonymous users; any user accessing the application is already a member of this role allowing unrestricted access.

To see where the Applications Roles are defined select the User and Roles tab on the bottom of the jazn-data.xml page, followed by the Application Roles node on the left hand side:. This will display the Edit JPS Identity & Policy Store dialog:


You'll note you can see the "test-all" role defined under the Application Roles node. In our case we'll add a new ADMIN role, and remove the "test-all" role as follows:


From here we want to map the Application Role to the Enterprise Role. Remember again that Enterprise Roles exist within our application server, while the Application Role is defined within our application.

We now move to creating the ADMINISTRATOR Enterprise Role under the same left node menu option:


Next we need to map the Enterprise Role to the Application Role. With the ADMINISTRATOR Enterprise Role selected, select the Assigned Roles tab on the right, followed by the plus sign and the Assign Application Role option. In the resulting Select Roles dialog select the ADMIN Application Role. The result:


Protecting our pages with Application Roles

On completing the previous steps, on returning to the ADF Policies tab followed by the Web Pages tab, we'll note that because we removed the test-all role, none of the databound pages have roles assigned to them (identified by the fact they no longer have arrows to the right of them):


To allow users with the ADMIN Application Role to access the ViewBookings page, we simply select the page, the plus button allows us to pick the ADMIN role from the appropriate dialog, and finally we select the View option on the right hand side:


The 4 other privileges, Customize, Edit, Grant and Personalize are relevant to MDS and not applicable to this post. As such the remaining View privilege tells us ADF Security via the jazn-data.xml file is at it's most basic determining if a user can access the page or not. It's not concerned with any other privileges.

Testing

This presents a good time to test our solution. Before we can test our solution we need to create a user with the appropriate roles.

There's two ways we can do this. In WLS we can create the user and Enterprise Role ADMINISTRATOR, and allocate the role to the user.

For development purposes JDeveloper presents a "cheats" way of doing this. We return to the jazn-data.xml editor and select the Users and Roles tab followed by selecting the Users node on the left. From here we can define users and their passwords (aka Credentials) and then via the Assigned Roles section we can select the ADMINISTRATOR Enterprise Role:


(Note if you have trouble defining the user's password, where JDeveloper shows a red box around the password field, this is because passwords must be a minimum length of 8 characters)

For testing purposes we'll also create a 2nd user who isn't allocated any roles at all:


Normally we wouldn't be creating such users in our JDev application, they'd be created in our WLS server or a connected LDAP server or similar. JDeveloper allows us to get away with this because of the following option. If you select the Applications menu -> Deployment node, you'll see JDev has autoconfigured an EAR deployment descriptor for you, with a number of options below:


In particular the Users and Groups check box means that JDev will attempt to deploy the Enterprise Role ADMINISTRATOR and the two users we created CMUIR and JDOE to the server when the application is deployed.

On running our app for the first time we can happily land on the Splash page.


(ok, ok, it's a very uninspiring application. If you want whiz bang go read a post on DVT controls)

Clicking the View Bookings link, the user is interrogated for their credentials via the logon screen:


Of note in the JDev log window you'll see the authorisation challenge as follows:

[JpsAuth] Check Permission
PolicyContext: [ADFSecurityDemo#V2.0]
Resource/Target: [view.pageDefs.ViewBookingsPageDef]
Action: [view]
Permission Class: [oracle.adf.share.security.authorization.RegionPermission]
Result: [FAILED]
For more information on this failure, please set -Djps.auth.debug.enable=true

Presumably this is the mechanism that tells the ADF application to show the login page.

If we log in as CMUIR allocated with the ADMIN role we see the View Bookings page in all it's glory. Alternatively if we log in as JDOE without the ADMIN role we see the rather flattering exception:

oracle.adf.controller.ControllerException: ADFC-06000: The ADF Controller caught exception {0} while performing control flow routing. See the stack trace for details.
 at oracle.adfinternal.controller.util.Utils.createAndLogControllerException(Utils.java:203)
 at oracle.adfinternal.controller.state.SuspendedNavigationState.resume(SuspendedNavigationState.java:54)
 at oracle.adfinternal.controller.application.LoginSuccessHandler.resumeNavigation(LoginSuccessHandler.java:117)
 at oracle.adfinternal.controller.application.LoginSuccessHandler.doCreateView(LoginSuccessHandler.java:61)
 at oracle.adfinternal.controller.application.BaseRequestHandlerImpl.createView(BaseRequestHandlerImpl.java:57)
-snip-
oracle.adf.controller.security.AuthorizationException: ADFC-0619: Authorization check failed: '/ViewBookings.jspx' 'VIEW'.
 at oracle.adf.controller.internal.security.AuthorizationEnforcer.handleFailure(AuthorizationEnforcer.java:147)
 at oracle.adf.controller.internal.security.AuthorizationEnforcer.checkPermission(AuthorizationEnforcer.java:126)
 at oracle.adf.controller.internal.security.AuthorizationEnforcer.checkRead(AuthorizationEnforcer.java:363)
 at oracle.adfinternal.controller.activity.ViewActivityLogic.execute(ViewActivityLogic.java:77)
 at oracle.adfinternal.controller.engine.ControlFlowEngine.doRouting(ControlFlowEngine.java:876)
-snip-

This is also recorded in the WLS logs. While it doesn't look nice, effectively ADF Security is telling JDOE to get nicked because he doesn't have the ADMIN role. If you wish to handle this in a more graceful way you can make use of the ADF controller's declarative exception handler to route the user to a "friendly" denied-access page, or alternatively we wouldn't have given the user the option to navigate to this page in the first place. Of course this article shows the above for learning purposes.

Of note if we were to log in as CMUIR or JDOE and access either the ViewEvents or ViewOrganisations pages we'll also see the same error. This occurs because we haven't allocated any privileges to these pages yet.

We've now satisfied our original security requirements #1, #2, #5, #7 and #8.

Allowing any authenticated user access

Our next requirements #3 and #6 are to secure the ViewEvents page, allowing only authenticated users to access this page, regardless of which roles they've been allocated.

On returning to the jazn-data.xml editor, selecting the ViewEvents page and then the plus button, you'll note in the dialog that shows there are 2 other predefined roles besides our ADMIN role, namely "anonymous-role" and "authenticated-role":


Quoting straight from the JDev online help:

"The anonymous-role is a role you can use when you want to grant access privileges to unauthenticated users. All users, including unauthenticated users, for example, those not required to log on to the application, are automatically considered by Oracle Platform Security to be a member of the anonymous-role. The authenticated-role is a generic role that you can use to allow authenticated users to access the databound web pages of your application. The authenticated-role requires the user to be successfully logged on."

As such if we allocate the authenticated-role to the ViewEvents page, and....


Alllowing unauthenticated users access

...for our requirement #4, we allocate the anonymous-role to the ViewOrganisations page:


....we satisfy the remaining requirements.

Testing

Now on testing our application, landing on the Splash screen we discover:

a) cmuir user can access all 4 pages
b) jdoe can access Splash, ViewEvents and ViewOrganisations, but not ViewBookings
c) an unauthenticated user can access Splash and ViewOrganisations, but not ViewBookings or ViewEvents

Troubleshooting

Some developers may find regardless of the above post, they may still encounter ADFC-06000/ADFC-0619 errors when accessing a page with a user who has the appropriate application role. A common reason you can still get this error is you've forgotten to map the Enterprise Role to the Application Role as described in the last part of the Application Roles vs Enterprise Roles section.

Further to this it's possible to see further debug output out of the ADF security engine (implemented by something called OPSS) by following this post by Duncan Mills.

Credit

My thanks must go to Frank Nimphius for reviewing this article oh-so-long-ago back in September 2009. Apparently having a 2nd daughter has somewhat delayed publication of some of my articles. God knows how people with 3 kids get anything done.

read more

Developing MVC Applications Using ZK and Spring

The ZK framework provides a variety of paradigms to develop Web applications. One the one hand it is always nice to have options, but on the other this can cause un-intentional paradigm disparities when several developers are using the framework to develop an application without a consistent design. By and far, the Model View Controller pattern has been adapted by various Web applications and frameworks (like Apache Struts, Apache Beehive PageFlows) to develop quality Web applications. The following is an illustration of how an MVC based Web application can be developed using ZK and Spring. ZK has introduced a lot of features that enable easy integration with Spring. The source code of example application is available for download here.

read more

Seven Rules to Improve Your Application Performance Practices

In this article I discuss the seven most important steps to improve your application performance practices. These simple-to-follow practices will help you to improve the way you deal with application performance. Besides eventually improving the performance of your applications it will help you to avoid playing the classical blame game which normally happens when something goes wrong

read more

Red Hat’s Server & Desktop Virtualization Move in Together

Red Hat’s desktop virtualization has joined its server virtualization in the 2.2 rev of its standalone KVM hypervisor Red Hat Enterprise Virtualization (RHEV). Like 2.1 seven months ago, 2.2 can host and manage both Red Hat Linux and Windows VMs and now offers a single infrastructure for managing server and desktop virtualization deployments. RHEV for Desktops will deploy Hosted Virtual Desktop (HVD) configurations, a k a Virtual Desktop Infrastructure (VDI). It offers a web-based connection broker for users to access their hosted virtual desktops, coupled with the open source SPICE remote rendering technology for multimedia, including multiple monitors, HD-quality video and bi-directional audio/video for video conferences. Templating, thin provisioning and desktop pooling are also included.

read more

Google vs. Apple Control Freakism

Rich Cannings, Android security lead, blogged about remotely removing an app from people’s Android phones. Recently, we became aware of two free applications built by a security researcher for research purposes. These applications intentionally misrepresented their purpose in order to encourage user downloads, but they were not designed to be used maliciously, and did not have permission to access private data — or system resources beyond permission. As the applications were practically useless, most users uninstalled the applications shortly after downloading them.

read more

IBM Demands Cloud Cover

IBM filed a breach-of-contract / misappropriation of trade secrets suit in New York Supreme Court last week seeking to hold Joanne Olsen to her non-compete and stop her from going to Oracle for a year. It’s gotten a temporary restraining order according to InformationWeek. Olsen, with IBM for 31 years, was a general manager in IBM’s services unit and was hired by Oracle as senior VP of on-demand services, the SaaS versions of its software, reporting to none other than Larry Ellison. IBM alleges that she knows too much about IBM, its operations, its growth strategies and its potential acquisitions to fall into Oracle’s hands. IBM has gone to court a couple of times in the last couple years waving its non-competes around.

read more

Azul Zings Its Java Hardware – Poof, It’s Software

Born to peddle pricey proprietary iron built around exotic multi-core chips that ratchet up the scalability of Java apps – a dangerous exercise that has demanded a $200 million investment from its backers – Azul Systems is now going to start selling software that does pretty much the same thing as its fancy appliances but it’s optimized for the latest class of cheap, ubiquitous, increasingly powerful x86 commodity servers. If the stuff clicks in the next year, eight-year-old Azul may be in a position to organize an orderly retreat from its hardware business, which, as it happens, reportedly just saw record Q1 earnings. It may have hundreds of widgets out there, but software’s an easier sell.

read more

Moyea Web Player V2.4.0.8

The latest Moyea Web Player V2.4.0.8 is released recently supporting JS application in navigation URL and auto-hide control bar in full-screen mode. Shenzhen P.R.C – Jun, 24th, 2010 - Moyea Software Co., Ltd. (http://www.moyeamedia.com): a rising developer of flash applications for the internet and multimedia software, today officially releases Moyea Web Player V2.4.0.8, which is the Moyea Web Player is one of the best flash video player creating and customizing programs for all-level users to make their own web player which can be embedded in multiple platforms like blogs, websites, forums and so on.

read more

SAP’s Roland Wartenberg to Present at Cloud Expo Silicon Valley

Like other desktop-centric technologies such as anti-malware, PC tune-up utilities (disk de-fragmentation, registry cleaners, junk removers, etc) have primarily been a localized technology that relied on the user installing software on the computer to analyze and resolve problems that affect performance. In his session at the 7th International Cloud Expo, Roland Wartenberg, Chief Virtualization Evangelist at SAP, will introduce a new approach that takes PC tune-up and security strategies to a new level utilizing the power of the cloud as a means of delivery. He will also discuss new methodologies for using the intelligence of the community and the power of the cloud to accomplish computer maintenance at a lower total cost of ownership than traditional desktop technologies.

read more

FinancialForce.com Announces VMforce Connector Service for Java Developers

On Tuesday FinancialForce.com announced a new VMforce connector service that will enable Java developers to quickly and easily build FinancialForce Accounting functionality into their own VMforce applications. The announcement was made at The Grape Escape analyst event in Boston. The FinancialForce VMforce connector provides pre-configured web services, opening the doors for VMforce Java developers that want fast, easy access to enterprise accounting functionality on the Force.com platform. It will significantly reduce configuration and set-up time of the FinancialForce Accounting web services layer. Out of the box, VMforce developers will have access to the accounting functionality they need to make their apps enterprise-ready quickly and easily.

read more

KonaKart v5.0 Released - Java eCommerce System

DS Data Systems UK Ltd. is pleased to announce the release of KonaKart v5.0.0.0, a Java-based eCommerce shopping cart application that provides an extensive set of features to enable retailers to successfully sell their products over the internet. KonaKart is a Java / JSP / XML based solution with easy to use Java APIs and a SOAP Web Service interface that allow you to quickly integrate eCommerce functionality into your existing systems. The customizable parts of KonaKart are Open Source and available under the GNU LGPL. The new version includes many new features as well as some bug fixes. Reward Point Functionality has been introduced which allows customers to receive and redeem points online. Support for recurring billing has been added for native billing or to use the recurring billing functionality of the payment gateway. A customer and administrator can now download invoices in PDF format and many new custom and other attributes have been added to the important objects of the system. Full details of the new features can be found at http://www.konakart.com/downloads/ver-5000-whats-new

read more

IBM’s Dustin Amrhein to Present at Cloud Expo Silicon Valley

Face it, setting up Java EE application environments can be a time-consuming, error-prone, and highly variable process. A cloud computing approach to Java EE application environments can address these problems and more. In his session at the 7th International Cloud Expo, Dustin Amrhein, Technical Evangelist for Cloud Technologies at IBM, will describe how the IBM WebSphere test organization utilizes a cloud computing solution to enable the construction, deployment, and maintenance of Java EE application environments for testing purposes throughout the organization. This new cloud computing implementation means decreased environment setup times, elevated asset utilization, and increased test iterations. All of this adds up to make the IBM WebSphere test organization more responsive and agile than it has ever been.

read more

Cloud Expo Silicon Valley: Analytics for Enterprises Using Private Cloud

It is widely accepted that large enterprises will start cloud deployment via "private cloud" – that is to say, inside their firewall. But what kind of early applications will these be? Imagine you are the head of manufacturing at a Fortune 500 company running an Oracle Manufacturing application and multiple other source systems. You need to know critical production information instantly, several times a day. And you are moving around constantly. You have an iPad and just a touch gives you those critical nuggets of information. This is advanced analytics using the private cloud. Another example is Project Management, where many moving parts are involved. Again, using touchscreen devices like the iPad you can visualize all aspects of the projects at any instant and anywhere.

read more

Managing Persistent Entities with the JPA Persistence Entity Editor

Oracle Enterprise Pack for Eclipse allows you to view, create, and manage JPA entity relationships. The Entity Editor provides a centralized view of all entity relationships, allows you to modify entity properties, and allows you to navigate between the object model, mapping associations, and database schema layers. As described previously, the Entity Editor displays relationship diagrams for entities defined in the project.

read more

Tuscany SCA Java 2.0 Milestone 5 Released

We've just released the fifth milestone of our 2.0 Java SCA runtime, check out the release announcement for details of what's in it. It's been a little while since milestone four as we've been hard at work updating the runtime to make sure that we pass the proposed OASIS compliance tests for the Assembly, JCA and JCI specifications. Next we're working on some of the new compliance tests that are coming out of OASIS such as the Web service binding tests. In the mean time give milestone five a spin, you can get it from here , and we look forward to hearing your feedback.

read more

RichFaces – Wizard Inside Modal Panel

This is a 5-minute guide to creating a wizard inside a modal panel. We are going to use a4j:include together with rich:modalPanel. Start page (start.xhtml): <h:form> <a4j:commandLink oncomplete="#{rich:component('panel')}.show();" value="Open" reRender="panel"/> </h:form>   <h:panelGrid id="result"> <h:outputText value="#{bean.color}" /> <h:outputText value="#{bean.number}" style="COLOR: #{bean.color}"/> </h:panelGrid>   <rich:modalPanel id="panel"> <f:facet name="header">Wizard</f:facet> <f:facet name="controls"> <a href="#" onclick="#{rich:component('panel')}.hide();">Close</a> </f:facet> [...]

read more

Conditional Table Filters

Just ran across this and it is a nice technique for those situations where you are limited to table based filtering of data. Typically, I focus on data filtering as far up stream as possible. It is better to filter data at the source (in the where clause for JDBC). Next, I use DataSet based filtering. But sometimes you can't filter at the Source or the DataSet, which is where table based filtering comes in. The issue with table based filters is that there is no good way in the UI to implement conditional filtering. For instance, imagine you have a data driven parameter multi-select parameter and you want to limit the choices to the values from that parameter.

read more

Meg & Carly Win California Primaries

Silicon Valley’s two divas, former eBay CEO Meg Whitman and former HP CEO Carly Fiorina, won their respective Republican primaries in California Tuesday night. Whitman will run against Democratic nominee Jerry Brown, now the state’s attorney general, for governor, succeeding Arnold Schwarzenegger. And Fiorina will try to knock three-term incumbent Barbara Boxer out of the U.S. Senate come November. Both women ultimately won in a walk, largely on the back of their ad campaigns. Carly had the tougher go.

read more

Think Twice Before Declaring a Java Method as Final

To minimize the invocation time, final methods are optimized (inlined) first by Java compiler and then, during runtime by Just-In-Time (JIT) compiler. Because of this, making methods final is considered a best practice for optimizing performance. If you create classes that may be used by other developers, declaring methods as final will make them not overridable in the subclasses. While today, it may seem obvious to you that a particular method will never ever need to be overridden, you might not properly predict all use-patterns of this class. If this happens, some other developer will have to jump through the hoops to create another version of such a method in a subclass. If you don't want to be cursed in the future, think twice if you really really want to declare this method as final. Do you see any benefits in using final methods?

read more

Azul Systems Achieves Record First Quarter Bookings and Revenue

Azul Systems announced record first quarter bookings and revenue for its fiscal year 2011 ending April 30, 2010, with revenue up 64% over the prior quarter. Customers purchasing Azul appliances and services in the quarter included Farmers Insurance, Success Factors, Saks.com, TD Securities, Juniper Networks, Global Collect and many other Global 2000 companies. Azul Compute Appliances enable business-critical Java-based applications to achieve unprecedented levels of scalability, throughput and response times without the complex setup, management, or high operational costs associated with traditional computing models.

read more

Ehcache Tickled

Terracotta, the open source company focused on enterprise Java application scalability and availability, has tweaked Ehcache, the high-performance distributed caching widgetry. The new 2.1 release is said to be a significant upgrade. CEO Amit Pandey says that since Terracotta took Ehcache over last August adoption has accelerated; it currently claims 50,000 users and 100 companies paying for the enterprise version of the stuff including Adobe, News Digital Media, a division of News Corporation, and Raytheon. The hundred signed up in the last four months.

read more

IBM and Ariba Cut Cloud Deal

IBM has cut a cloud deal with Ariba, the B2B trading site that’s now billing itself as a cloud. Terms were not disclosed but their arrangement is supposed to enliven Ariba’s eHarmony-type buyer-and-seller matching service by integrating its newly restyled Commerce Cloud with IBM’s LotusLive. Ariba manages what its marketing folk call collaborative inter-enterprise commerce with its web-based Discovery sourcing and sales process solutions. LotusLive will give it cloud-based integrated e-mail, web conferencing, social networking and collaboration services.

read more

Richfaces Components Client-Side JavaScript API

Many rich components (from rich: tag library) provide client-side JavaScript API. Being client-side means it’s happening only in the browser. We would have to click submit or fire an Ajax request to submit the changes. How do you find what JavaScript functions are available on a particularity component? The place to find this information is [...]

read more

Sun Founder Signs Ex-UK Prime Minister

In a Carlyle Group kind of move, Britain’s former Prime Minister Tony Blair – he of the great rhetoric even if he was Labor – has become a senior advisor on public policy to Khosla Ventures, the $1.1 billion green VC fund run by Sun co-founder Vinod Khosla. Blair’s not merely decorative; he actually knows something about this stuff and is hopefully more honest about it than former US vice-president Al Gore, who’s a partner at Kleiner Perkins. He and his consulting firm Tony Blair Associates are there to pull strings. Meanwhile, RealNetworks chairman Rob Glaser has joined Accel as a venture partner. He will focus on digital media, social media and mobile services.

read more

Unisys to Present on “Storm Clouds” at Cloud Expo Europe

As much as information technology has changed in the last 10 years, the next decade promises even more significant change. And as cloud technology becomes more prevalent, IT enterprises will be driven to reconsider the status quo around just about everything we know, including physical infrastructure, virtualization, automation, service management, and security. Cloud technology and virtualization of virtually everything means rethinking the economic models around physical infrastructure, the emergence of a new class of providers as well as a greater degree of standardization around virtualized OS and middleware configurations. In his session at the 6th International Cloud Expo, David Milot, managing partner at Unisys, will discuss the increasing expectations from consumers of data center services – instant provisioning and de-provisioning, just for openers. And with a new generation of workers that expect anytime, anywhere access to corporate data, securing your data outside of your data center walls has become a greater business imperative albeit far more difficult. Learn what you need to consider to ensure your enterprise’s foray into cloud computing successfully and securely meets the needs of your enterprise.

read more