1. Java web hosting at CERN Computing Seminar, 1 November 2005 Michał Kwiatek, IT-DES

2. 2 What we’ll be doing A few words about servlets and JSPs How to deploy them at CERN Scope, SLA and architecture of J2EE Public Service Some „advanced” examples

3. Michał Kwiatek, IT-DES3 What is a JSP? Age example <% String yearString = request.getParameter("year"); int year; if (yearString==null || yearString.equals("")) { out.print("Please specify your year of birth using year parameter"); } else { try { year = new Integer(yearString).intValue(); %>You are years old.<% } catch (NumberFormatException e) { %> Year of birth incorrect! <% } %>

4. Michał Kwiatek, IT-DES4 JSP implicit variables request session application response out

5. Michał Kwiatek, IT-DES5 What is a servlet? A java class that lives inside web container to serve client requests extends javax.servlet.http.HttpServlet defining one or more of the following methods: –doGet –doPost –doPut –doDelete –service –init –destroy Note: the same servlet object will be used simultaneously to serve many request!

6. Michał Kwiatek, IT-DES6 Your servlets should be thread-safe! package ch.cern.example; import... public class ServletA extends HttpServlet { SimpleDateFormat sdf = new SimpleDateFormat( "yyyy-MM-dd HH:mm:ss" ); public void service (HttpServletRequest request, HttpServletResponse response) { response.write("Current date and time is: "); response.write(sdf.format(new Date())); } Javadoc: Date formats are not synchronized. It is recommended to create separate format instances for each thread. If multiple threads access a format concurrently, it must be synchronized externally.

7. Michał Kwiatek, IT-DES7 JSP is a servlet! Welcome, you are visitor number Declaration! package ch.cern.example; import... public class MyServlet extends HttpServlet { int count = 0; public void service (HttpServletRequest request, HttpServletResponse response) { response.write(" Welcome, you are visitor number"+(++count)+" "); }

8. Michał Kwiatek, IT-DES8 Did you make a nice jack’o lantern?

9. Michał Kwiatek, IT-DES9 There’s more to JSP than just the pages Object-oriented programming Java libriaries, java beans Custom tag libraries Model-View-Controler model Java Server Faces It is vendor and platform independent

10. Michał Kwiatek, IT-DES10 How to deploy them at CERN? Go to CERN Web Service: http://webservices.web.cern.ch/WebServices/ http://webservices.web.cern.ch/WebServices/ Choose „java web application (servlet/jsp)” as site type

11. Michał Kwiatek, IT-DES11 So what is this WAR file? WAR file is simply a zip archive with a specific structure jar files go to WEB-INF/lib classes go to WEB-INF/classes Application configuration files The rest is regular web content Use your IDE or Ant to package your application

12. Michał Kwiatek, IT-DES12 J2EE Public Service server-side infrastructure for deployment of java (servlet/jsp) web applications provided by IT-DES we provide: –servlet/JSP container –support for deployment –backup, monitoring we don’t provide: –an EJB container –support for development –telnet/ssh/ftp access to the servers SLA: aimed for medium-sized, non-critical applications; full support within CERN working hours; the support outside working hours is provided on best effort basis.

13. Michał Kwiatek, IT-DES13 „Standard” approach !

14. Michał Kwiatek, IT-DES14 J2EE Public Service - approach !

15. Michał Kwiatek, IT-DES15 J2EE Public Server architecture software used: –Apache Tomcat 5.5 –JDK 1.5 –Apache httpd 2.0 –jpsmanager The architecture is open!

16. Michał Kwiatek, IT-DES16 Guess what! JDBC drivers to oracle are preinstalled (thin) 3 usage scenarios

17. Michał Kwiatek, IT-DES17 JDBC Connection conn = null; Statement stmt = null; ResultSet rset = null; try { Class.forName("oracle.jdbc.driver.OracleDriver"); conn = DriverManager.getConnection(url, user, password); stmt = conn.createStatement(); rset = stmt.executeQuery(query);... } catch(SQLException e) {... } finally { try { rset.close(); } catch(Exception e) { } try { stmt.close(); } catch(Exception e) { } try { conn.close(); } catch(Exception e) { } } 1. Basic example 2. Connection pooling

18. Michał Kwiatek, IT-DES18 JDBC (cont’d) // in Servlet, JSP, or simply a class: Connection conn = null; Statement stmt = null; ResultSet rset = null; try { Context initContext = new InitialContext(); Context envContext = (Context)initContext.lookup("java:/comp/env"); DataSource ds = (DataSource)envContext.lookup("jdbc/devdb"); conn = ds.getConnection(); stmt = conn.createStatement(); rset = stmt.executeQuery(query);... } catch(SQLException e) {... } finally { try { rset.close(); } catch(Exception e) { } try { stmt.close(); } catch(Exception e) { } try { conn.close(); } catch(Exception e) { } } 3. Connection pooling & JNDI (1/2)

19. Michał Kwiatek, IT-DES19 JDBC (cont’d) // in META-INF/context.xml: <Resource name="jdbc/devdb" auth="Container" type="javax.sql.DataSource" driverClassName="oracle.jdbc.driver.OracleDriver" url="jdbc:oracle:thin:@oradev.cern.ch:10521:D" username="XXXXX" password="XXXXX" maxActive="10" maxIdle="5" /> // in WEB-INF/web.xml:... 3. Connection pooling & JNDI (2/2)

20. Michał Kwiatek, IT-DES20 Authentication/authorisation Authentication: –my identity can be confirmed using my CERN id card Authorisation –using my identity and additional information (did I attend the security course?) the system will let me into the Computer Centre or not

21. Michał Kwiatek, IT-DES21 How to do it NICEly? method for authentication and authorisation –is provided by the container –uses existing mechanisms this method is NICE: –NICE login and password to authenticate –NICE groups to authorise (CERN Department/Group structure, or some project-specific groups)

22. Michał Kwiatek, IT-DES22 NICE authentication NICE authentication is set up by default in WEB-INF/web.xml you specify which areas of your application require authenticationWEB-INF/web.xml you also specify which groups of users are authorized to access these areas you can define these groups (and their members) at https://www.cern.ch/WinServices/Services/GroupManager/ https://www.cern.ch/WinServices/Services/GroupManager/ from your application, you may check who is logged on using: request.getUserPrincipal()

23. Michał Kwiatek, IT-DES23 Resources http://j2ee-public-service.web.cern.ch/j2ee-public- service/http://j2ee-public-service.web.cern.ch/j2ee-public- service/ –sla.html –faq.html –technical.html chapter 9, "Developing secure web applications" from SCWCD Exam Study Kit by Hanumant Deshmukh and Jignesh Malavia. SCWCD Exam Study Kit by Hanumant Deshmukh and Jignesh Malavia http://tomcat.apache.org/tomcat-5.5-doc/jndi- datasource-examples-howto.htmlhttp://tomcat.apache.org/tomcat-5.5-doc/jndi- datasource-examples-howto.html http://jakarta.apache.org/commons/dbcp/ http://ws.apache.org/axis/java/index.html j2ee tutorial: http://java.sun.com/j2ee/1.4/docs/tutorial/doc/inde x.html http://java.sun.com/j2ee/1.4/docs/tutorial/doc/inde x.html

24. Michał Kwiatek, IT-DES24 Questions?