SOAP

Like http is text based protocol having header and body…in similar way soap is protocol that define data in xml….SOAP defines the XML-based protocol for exchange of information in a distributed environment, specifying the envelope structure, encoding rules, and a convention for representing remote procedure calls and responses. So, SOAP, originally defined as Simple Object Access Protocol, is a protocol specification for exchanging structured information in the implementation of Web Services in computer networks. It relies on Extensible Markup Language (XML) as its message format and usually relies on other Application Layer protocols, most notably Remote Procedure Call (RPC) and HTTP for message negotiation and transmission

JAX-RPC provides a Java API for developers to invoke remote procedure calls, by abstracting and hiding the low-level SOAP semantics associated with RPC from applications.

Jini

Jini - a lightweight environment for dynamically discovering and using services on a network. The technology is used mostly in reference to allowing “network plug and play” for devices. It allows devices such as printers to dynamically connect to and download drivers from the network and register their services as being available. The goal in developing Jini was to create a dynamically networked environment for devices, services, and applications. In this environment, services and devices could be added to and removed from the network dynamically.

How to find first and last entry of HashMap

http://forums.sun.com/thread.jspa?threadID=403658&tstart=81825
How come Hashtable / HashMap have search order constant . ?
/**
* The table, resized as necessary. Length MUST Always be a power of two.
*/
transient Entry[] table;
// and here's the method that intrests you
public Object get(Object key) {
Object k = maskNull(key);
int hash = hash(k);
int i = indexFor(hash, table.length);
Entry e = table[i];
while (true) {
if (e == null)
return e;
if (e.hash == hash && eq(k, e.key))
return e.value;
e = e.next;
}
}
so, as you see, if you have one Entry per bucket, then it's as easy as taking from an array, but if you have more that one entries in one bucket, then it has to loop that while for a while.

USE OF SINGLETON

Assume that we have a web based system that allows users to log in to secure areas of a web server. Such a system will have a database containing user names, passwords, and other user attributes. Assume further that the database is accessed through a third party API. We could access the database directly in every module that needed to read and write a user. However this would scatter usage of the third party API throughout the code, and would leave us no place to enforce access or structure conventions.

Some notes for JSF

The three points that we discussed were:

1. Mutliple render kits:

Now a days there are many devices that are web enabled. So application developers have challenge to develop components that can work across various platforms. For example, if we have an application that works on standard web browser and we want to extend it to make it enable to work on a WAP device. So, to handle this case we need components to be rendered in more than one way. Here JSF can help you . It is a simple task for JSF. Solution is to develop separate renderers for the component. JSF components use different renderers depending on the device used.

Render kit can target a specific device like phone, PC or markup language like HTML,WML, SVG. This is one of the best benefit of JSF because JSF doesn't limit to any device or markup.

2. Controller Flexibility/Event Handling

JSF is a component/event oriented approach, and Struts is an action oriented approach.

One of the major goals of Struts was to implement a framework that utilized Sun's Model 2 framework and reduced the common and often repetitive tasks in Servlet and JSP development. The heart of Struts is the Controller. Struts uses the Front Controller Pattern and Command Pattern. A single servlet takes a request, translates HTTP parameters into a Java ActionForm, and passes the ActionForm into a Struts Action class, which is a command. The URI denotes which Action class to go to. The Struts framework has one single event handler for the HTTP request. Once the request is met, the Action returns the result back to the front controller, which then uses it to choose where to navigate next.
JSF uses the Page Controller Pattern. Although there is a single servlet every faces request goes through, the job of the servlet is to receive a faces page with components. It will then fire off events for each component and render the components using a render toolkit. The components can also be bound to data from the model. JSF is the winner in this area, because it adds many benefits of a front controller, but at the same time gives you the flexibility of the Page Controller.

JSF can have several event handlers on a page while Struts is geared to one event per request. In addition, with Struts, your ActionForms have to extend Struts classes, creating another layer of tedious coding or bad design by forcing your model to be ActionForms. JSF, on the other hand, gives developers the ability to hook into the model without breaking layering.

3. JSF Component Tree
The user interface can be by nature hierarchical, and we can structure the code to reflect that. For very dynamic parts of the user interface, programmatic manipulation is useful. But, this is certainly the uncommon case. Most user interfaces are extremely static except at the level of individual controls. JSF helps you even in this uncommon case, since it lets you directly manipulate the JSF component tree in Java code. And of course, you can always fall back to writing JavaScript code that works with the browser's DOM.

Message from my java group...it would be much helpful in understanding on this topic

Struts a bit excessive and using it was like trying to fit a square peg in a round hole.

In Struts 1.x, you can only have String objects in ActionForms. Whereas, in JSF, you
can even have Date, BigDecimal, Integer, etc. in the ManagedBeans.

The JSF ManagedBeans are a combination of Struts ActionForm and Action both rolled into one. Again, in Struts Action, only the execute method is ever exposed. Whereas, in JSF, you can have any method being called by the front-end.

But thats not all. Validation is a big pain in Struts. It is tucked away in validation.xml or in some cases, in ActionForm or Action. Whereas, in JSF, you can have validation and conversion at front-end.

With all this going on, you might think that this is the best solution.

However, the trouble here is you still have the attributes being duplicated in your ManagedBeans and again in the Entities that you will persist.

For example, if you have a users table, you will end up having a Java Class Users for storing database entity and a Java Class UsersBean to use as your ManagedBean. And then just like the Struts days, where you write code to take ActionForm values and store them to the Entity before saving to database and vice versa when reading them from database, you will do same conversion from ManagedBean to Entity and
back in JSF.

In brief, the comparison as as follows:

Struts:

1. JSP with Struts tags
2. Configuration in struts-config. xml
3. Flow controlled by ActionServlet
4. Validation in validation.xml
5. Available for free
6. Only Apache implementation
7. No components available

JSF:

1. JSP with JSF tags
2. Configuration in faces-config. xml
3. Flow controlled by FacesServlet
4. Validation in the front-end
5. Available for free
6. Implementations - Apache MyFaces, Sun Reference Implementation
(recommended one for now)
7. Components available from RichFaces, IceFaces, AJAX4JSF and many
more

Now, just a small introduction to what Seam does here.

With JSF or Struts, you need beans on the front-end (ManagedBean or ActionForm) to hold front-end values and beans on the back-end to hold back-end values. And then you have to write plumbing code to transfer values back and forward between front-end and back-end beans.

Seam collapses the need for all this and allows you to expose entities directly onto the front-end.

It also makes use of Hibernate Annotations such as not-null for required fields and length to check for max-length of input fields.

If you are interested, I can post an article on a brief introduction to Seam and getting started with it. Must warn you a bit though that you do need about a month or so to get to grips with Seam like any other application such as Struts, Spring or Hibernate.

General Spring related

1. What is IOC? is it opposite of OOP?
2. what is pico,micro and spring container?
3. what is JDK Proxy?
4. what is main use of AOP?
5. what is jdk proxy?
6. what is convetion over configuration?
7. what is EH cache?
8. does remote transaction support in Spring?

http://java.sys-con.com/node/286882

All about JAAS

All about JAAS

Have you ever needed to create a login authentication mechanism for an application? Odds are, you have, and probably more than once, with each new implementation being close, but not identical, to the previous one. For example, one implementation might use an Oracle database, another might use an NT authentication, and another, an LDAP (lightweight access directory protocol) directory. Wouldn't it be nice to support all these security mechanisms without changing any application-level code?
Now in the Java world, you can with the Java Authentication and Authorization Service (JAAS). This relatively new API was an extension in J2SE (Java 2 Platform, Standard Edition) 1.3, is a core API in J2SE 1.4, and is also part of the J2EE (Java 2 Platform, Enterprise Edition) 1.3 specification.

Developing secure web applications

BASIC CONCEPTS
1. Authentication: Authentication is the process of identifying a person or even a system, such as an application and validating their credentials.
2. Authorization: Authorization is the process of determining whether a user is permitted to access a particular resource that she has requested.
3. Data integrity: Data integrity is the process of ensuring that the data is not tampered with while in transit from the sender to the receiver.
4. Confidentiality or data privacy: Confidentiality is the process of ensuring that no one except the intended user is able to access sensitive information. The difference between authorization and confidentiality is in the way the information is protected. Authorization prevents the information from reaching unintended parties in the first place, while confidentiality ensures that even if the information falls into the wrong hands, it remains unusable

5. Auditing: Auditing is the process of recording security-related events taking place in the system in order to be able to hold users accountable for their actions.

6. Malicious code: A piece of code that is meant to cause harm to computer systems is called malicious code. This includes viruses, worms, and Trojan horses.

7. Web site attacks: A web site may be attacked by different people for different reasons. For example, a hacker may attack for pleasure, a terminated employee may attack for revenge, or a professional thief may attack for the purpose of stealing credit card numbers.
Broadly, there are three types of web site attacks:
• Secrecy attacks—Attempts to steal confidential information by sniffing the communications between two machines. Encrypting the data being transmitted can prevent such attacks.
• Integrity attacks—Attempts to alter information in transit with malicious intent. If these attempts succeed, it will compromise the data integrity. IP spoofing is one of the common techniques used in integrity attacks. In this technique, the intruder sends messages to a server with an IP address indicating that the message is coming from a trusted machine. The server is thus fooled into giving access to the intruder. Such attacks can be prevented by using strong authentication techniques, such as public-key cryptography.
• Denial-of-service attacks (or availability attacks)—Attempts to flood a system with fake requests so that the system remains unavailable for legitimate requests. Creating network congestion by sending spurious data packets also comes under this category. Such attacks can be prevented by using firewalls that block network traffic on unintended ports.