Profiling Heap Stats of Java Applications - Java Flight Recorder(JFR)

Java Flight Recorder (JFR) is a tool for collecting diagnostic and profiling data about a running Java application. In this post, I am going to explain how create detailed profile including heap and class statistics of your java application. As you may already know, JFR will be executed via JCMD Utility which sends diagnostic command requests to the JVM.

jcmd.exe comes by default with JDK installation which you can find in $JAVA_HOME\bin directory. What JFR does is collecting low level and detailed run time information of java applications that runs on top of JVM. JFR comes with a default profiler which has generic recording templates that you can find in below directory of the JDK installation.

$JAVA_HOME\jre\lib\jfr

Using below in command prompt, you can collect general profiling information which used default setting.

jcmd.exe ProcessID JFR.start duration=600s filename=FileName.jfr

Above command will use "default.jfc" which is written to collect below run-time statistics.

Now let's see how to conduct a detailed profiling by changing these settings. To do this, open the recording that first collected using default settings. This will open up "Oracle java Mission Control" UI. Now select "Window -> Flight Recording Template Manager" from the menu.

Select "Default" and then click "Duplicate". Then select newly created template and click "Edit". You can then make changes highlighted in below image and click OK. This will add a new template "DetailedProfiling" which we can now use for detailed profiling.

Now open the command prompt and execute below command.

jcmd.exe ProcessID JFR.start settings=C:\Java\jdk1.7.0_80\jre\lib\jfr\DetailedProfiling.jfc duration=600s filename=FileName.jfr

This will now start the recording and once the profiling duration is completed, you can open it and see statistics related to Memory, Code, System, etc which will really be useful in finding memory leakages and performance improvements of java applications.

Single Sign On - SAML

In this article, I am going to explain how to enable Single Sign On(SSO) capability of a java application using SAML 2.0. To implement SSO, I recommend to use the SAML toolkit provided by Onelogin SSO

They provide open source library toolkit for many languages, tools to decode/encode certificates, keys and most importantly, they offer an IDP server account which we can configure and can use to test out service provider application. Following is a screenshot of IDP configuration provided by Onelogin.

First of all, download the SAML toolkit for Java hosted in Github. This is a Maven project, so that, you can customize dependencies and test cases as you needed. Open the toolkit in whatever the IDE you have and build the project.

PS: you can disable building test cases of this project by adding following block to the pom.xml.

                       

Next, we need to modify the metadata of the Service Provider(SP) and Identity Provider(IDP). All these information can be configured in the property file located at "java-saml-tookit-jspsample\src\main\resources\onelogin.saml.properties". Following are the basic properties that you are needed to modify;

Identifier of the SP entity  (must be a URI)

onelogin.saml2.sp.entityid

Service Provider return URL. Specifies info about where and how the message MUST be returned to the requester.
onelogin.saml2.sp.assertion_consumer_service.url
                         
Identifier of the IdP entity  (must be a URI)
onelogin.saml2.idp.entityid

SAML 2.0 Endpoint (HTTP)/ SSO endpoint info of the IdP. (Authentication Request protocol)
URL Target of the IdP where the SP will send the Authentication Request Message
onelogin.saml2.idp.single_sign_on_service.url

Public x509 certificate of the IdP
Put your IDP's certificate details here. You can either provide certificate or fingerprint with algorithm
onelogin.saml2.idp.x509cert

If a fingerprint is provided, then the certFingerprintAlgorithm is required in order to let the toolkit know which Algorithm was used. Possible values: sha1, sha256, sha384 or sha512
This can be easily customized in the IDP provided by onelogin
onelogin.saml2.idp.certfingerprint
onelogin.saml2.idp.certfingerprint_algorithm

Above few properties are the all you need to run the basic set up. As your requirement, you can set other attributes like signing, validation, etc.

Note: If you are using Mozilla Firefox as teh browser, there is a addon called "SAML Tracer" in which facilitates you to trace SAML request/response messages.

• If I describe what is actually happening here;First, when user comes to the login page, it automatically redirect the HTTPRequest to IDp. This us called "Authentication Request". For more details about the, SAML request have a look on below screenshot.

• Then, the request reaches the IDP and checks for available user session corresponding to received HTTPRequest. If there is an active session for the particular user, then this data will be sent back to SP as a SAML response. Otherwise, IDP will urge teh user to login first and captures the user data  which will be then sent to SP.
  

•  Service provider receives SAML Response and authenticates the message. In doing so, SP will use either IDP certificate or fingerprint configured in the metadata. To do this, SP will use several tags in SAMLResponse like  ds:SignatureValue, ds:X509Certificate, ds:DigestVauue

Now, all are customized in the sample project. After building sample application "OneLogin java-saml Toolkit Samples", you can place the .war file in whatever the server environment installed in your machine.

Add a Macro property in a Visual Studio Project and use it in the sorce code

1. In Property Manager of your project,  property page -> User Macros -> Add Macro

VERSION with value of "1.0"

2.  In property sheet, C/C++ -> Preprocessor -> Preprocessor Definitions, define a function macro.

PROJECTVERSION=VERSION(\"$(VERSION)\")

3.  In your sorce file, after all includes add following code snippet.


#ifdef  UNICODE  
#define VERSION(text) L##text
#else
#define VERSION(text) text
#endif




4. Then in your source code you can use "PROJECTVERSION" where ever you want to access the value of the defined macro.

Aligning text in java.awt.Graphics2D

Aligning text in java.awt.Graphics2D

@Override
public int print(Graphics g, PageFormat pageFormat, int pageIndex) throws PrinterException
{
Graphics2D g2 = (Graphics2D) g;
double pageWidth = pageFormat.getImageableWidth();

FontMetrics fm = g2.getFontMetrics(g2.getFont());
String title = "This is my title";
int titleWidth = fm.stringWidth(title);

g2.drawString(title, (int)pageWidth - titleWidth, 20);
}

Graphics2D class is often used to print pages in java. You can easily align text to left/right by using this method.

Limiting downloadable file sizes in SQUID server

Squid is a full-featured web proxy cache server application which provides proxy and cache services for Hyper Text Transport Protocol (HTTP), File Transfer Protocol (FTP), and other popular network protocols.

To install: sudo apt-get install squid squid-common

To manage the server configurations, all we need is to modify squid.conf file.
It contains in /etc/squid/squid.conf
Several parameters has to be modified as follows.

http_port can be change as our wish-according to the which port is used.
Then the variable acl (access control list) can be configured.

can make a acl group :
acl ucsc src 192.168.42.0/24
http_access deny !ucsc

The most important param has to be changed is reply_body_max_size which interpret the down loadable file size.

reply_body_max_size 1048576 // in bytes

You can check for errors of the file by using the following command.

squid -k parse // check errors

Finally after limitting the file size, if someone to download a file larger than the given threshold size, the request will be redirect to a error page. Set of error files contains in /etc/squid/errors diectory.

The error file regards to the larger file is ERR_TOO_BIG.
We can edit this page as we wish. We can access the attributed of the http request by using this file.
%U - contains the requested url by the user

Creating server logs with Log4j

By using Log4J, it can make log files on server side easily.

Log4j is a easy way to manage logs on server side. Mostly logs are written to a log file on the server to keep track of changes. We can write a log to a fie using two different methodologies. One is by using a XML file and the other is by using a property file.

• Using an XML file : xmllog4jconfig

Several attributes like file name, lay out and many others contains in xml file.

And then we have to use this xml file inside our codes as follows.

import org.apache.log4j.*;
import org.apache.log4j.xml.DOMConfigurator;
Logger logger;
try{
logger = Logger.getLogger("Update.class");


DOMConfigurator.configure(getServletContext().getRealPath("/") + "WEB-INF" + File.separator +"classes"+ File.separator + "xmllog4jconfig.xml");

logger.info("Log has been appended to your output.txt");
logger.info("device information changed from "+ imei_db +" to "+ imei);
System.out.println("succesfully written to output.txt");

}catch(Exception e){
System.out.println("Exception in log4j- "+e.getMessage());
}

• Using a property file : log4j

log4j.rootLogger=DEBUG, R

log4j.appender.R = org.apache.log4j.DailyRollingFileAppender
log4j.appender.R.File = $CATALINA_HOME/logs/oooutput.log
log4j.appender.R.Append = true
log4j.appender.R.DatePattern = '.'yyy-MM-dd
log4j.appender.R.layout = org.apache.log4j.PatternLayout
log4j.appender.R.layout.ConversionPattern = %d{yyyy-MM-dd HH:mm:ss} %c{1} [%p] %m%n

Configuring Message-Level Security in Web Services using Web Logic Server

Step 1 - Creating the key store and digital certificates

Since it is used Public Key Infrastructure here, it is needed to create public private key pairs for both service provider and client. Message authentication is accomplished through signing and message integrity is accomplished by encrypting the message. To sign the message it uses the private key of each party and public key is used in purpose of encrypting. It is required to have digital certificates to verify whether the requested party is trusted. Weblogic “certgen” command is used to generate digital certificates/ key pairs. Public key information is also used to generate digital certificates.

Followings are the steps;

1. “ClientCert” is the certificate file name which is of type “pem”. “ClientKey” is the private key file of type of “pem”. “ClientKey” is the password for key file and certificate. Same procedure is used for the server side.

• java utils.CertGen -certfile ClientCert -keyfile ClientKey -keyfilepass ClientKey

• java utils.CertGen -certfile ServerCert -keyfile ServerKey -keyfilepass ServerKey

2. Then it needs to create a key store comprises of keys and certificates. It imports the above created key files and certificates to “ClientIdentity.jks”. “ClientKey” is the key store password. The above password for the key file should be used as “keypass”.

• java utils.ImportPrivateKey -certfile ClientCert.der -keyfile ClientKey.der -keyfilepass ClientKey -keystore ClientIdentity.jks -storepass ClientKey -alias identity1 -keypass ClientKey
  

• java utils.ImportPrivateKey -certfile ServerCert.der -keyfile ServerKey.der -keyfilepass ServerKey -keystore ServerIdentity.jks -storepass ServerKey -alias identity2 -keypass ServerKey
  

3. Finally import the digital certificates to the server trust key store. First server certificate is imported to its own trust store and then client certificate. This step is required since we do not use a certificate authority.

• keytool -import -v -trustcacerts -alias identity1 -file ServerCert.der -keystore ServerTrust.jks -storepass ServerTrustStorePass
  

• keytool -import -v -trustcacerts -alias identity2 -file ClientCert.der -keystore ServerTrust.jks -storepass ServerTrustStorePass
  

Step 2 - Creating the Web service

- Create a java class for web service and create methods for functionalities of the web service.
- Right click on the class file and click on the “create web service…” option.
- Go through the wizard (select soap 1.2 binding).
- Select required policy files by selecting “WLS policies” at configure policies step. Our required
policies are as this
@Policies({
@Policy(uri = "Wssp1.2-2007-Wss1.0-X509-Basic256.xml"),
@Policy(uri = "Wssp1.2-2007-EncryptBody.xml")
})

Step 3- Next we have to configure the new keystores in WLS's identity and trust keystore for the use of web service.

STEPS:
- Start the weblogic server new instant
- Open server console and then go to
server->default server->general

- Enable Listen port

Then go to
- server->default server->Keystores

Set the key store type to “custom Identity and custom Trust” ,and set key store paths and their passwords

- Then go to SSL tab and set its setting

Step 4 - Creating the Client Proxy

Now we have to create a client for the above created web service. In doing so client proxy has to be created as;

New -> Web Service (locates under Business Tier) -> Web Service Proxy
For the “WSDL Document URL” you have to give the path of the wsdl file created from the web service.

Eg:-http://192.168.24.239:7101/BasicPolicy-Basic_ws-context-root/HelloSoap12HttpPort and “?WSDL” should be append at the end.

After creating the proxy, the generated client class contains the main method which calls the functions of web service and set of methods that guarantees the security of web service. Here client class is created as “HelloSoap12HttpPortClient” where Hello is the name given by you. We have to modify the “setPortCredentialProviderList()” method to suits with our configurations. Information regards to client and server key stores have to be given as the following example.

String username = "";
String password = "";
String clientKeyStore = "C:/Documents and Settings/Administrator/Desktop/fin/ClientIdentity.jks";
String clientKeyStorePassword = "ClientKey";
String clientKeyAlias = "identityc";
String clientKeyPassword = "ClientKey";
String serverKeyStore = "C:/Documents and Settings/Administrator/Desktop/fin/ServerIdentity.jks";
String serverKeyStorePassword = "ServerKey";
String serverKeyAlias = "identitys";

How to run
- Run the web service first
-Then run the client proxy.
-You can verify the security of data transferred, by using a network packet analyzer such as “Wireshark”.