Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. By Abdelmonaim Remani Polymathic-coder.com Silicon Valley Code Camp v 4.0

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Enterprise Application Complex Functional Requirements Non-Functional Requirements Execution Performance Reliability Security Evolution Testability Maintainability Extensibility Scalability (Horizontal and Vertical)

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Modern Enterprise Application The Architecture N-Tier Application Presentation Layer Micro-Architecture (Commands, Valuators, etc..) MVC Pattern Service / Business Layer Data Access Layer Naked Objects Pattern Data Middleware Resource Lookup – Service locator pattern – Implicit Invocation – Cross-Cutting Concerns Aspect Oriented Programming

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Frameworks An Architecture A well defined structure to solve a problem Library Framework vs. Library Invoking you vs. Being Invoked Generic vs. Specific Tools Compiler, Debugger, Etc… Scaffolding and other utilities Etc…

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Frameworks Heavyweight vs. Lightweight The need for a platform or a stack (JEE as an example) The ability to load in-demand the only the necessary components The memory footprint The build size Deployment ease Etc…

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved.

What is Spring? Application Framework Java Other Implementations are available (Spring.NET) Open-Source Lightweight POJO Based By Rod Johnson Expert One-on-One J2EE Design and Development in, EE without EJB, 2004 Becoming the De Facto Standard of Java Enterprise Applications

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Features: Inversion Control The Problem Resource acquiring via Static method of a singleton factory Instantiation of an concrete class Directory Services API that allows for discorery and lookup (For example JNDI) Hard Dependencies are created Problems with reusing code with hard dependencies Painful Unit Testing in isolation

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Features: Inversion Control The solution Use parameterized classes Dependencies are decoupled from classes By Coding against interfaces Inversion of Control: Dependency Injection The Hollywood Principle “Don't call us, we'll call you.“ Wait a minute this a lot of work! Spring to the rescue

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. The Tradeoff Resource injection is done at runtime Usually done using reflection No static type checking

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Features: Agility If you read the Agile Manifesto, Agile is for the most part for a technical prospective Frequent deliverables Ability and ease of refactoring Decoupling, DRY, and TDD are key makes’em easier

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Features: AOP OOP creates a hierarchical object model by nature Cross cutting concerns are not necessary part of the application logic Occur across the object model in unrelated parts Logging Security Transaction management Etc… AOP (Aspect Oriented Programming) Modularization of cross cutting concerns

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Features: Libraries POJO Wrappers for most popular frameworks Allowing injection of dependencies into the standard implementation Struts JSF Apache Tapestry Etc… Full support of JEE Integration with other frameworks

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Features: Other Source:

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved.

Spring Core All you need to know is: The Container The Bean Factory Manage bean instances (POJOs)’ life cycle Configuring their dependencies Etc… Can be used a partially compliant EJB3 Container Spring Pitchfork

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved.

Spring MVC A Front Controller Pattern Dispatcher Request Routing Controllers are Spring beans (Managed POJOs) No session scope for scalability

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Spring MVC Views JSP, JSF, Flex Controllers Many types Custom controllers Model Service Layer DAO for persistence JDBC and ORM (Hibernate, iBATIS, etc...)

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Spring MVC Complements Spring Web Flow For Web Application that are More dynamic Non-linear without arbitrary end points Spring Portlet MVC A JSR 168 compliant Portlet environnent Large web application composed with subcomponents on the same web page

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved.

Security Terminology Authentication the verification of the user identity Authorization Permissions granted to the identified user Access Control By arbitrary conditions that may depend to Attributes of clients Temporal and Local Condition Human User Detection Other Channel or Transport Security Encryption

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Security Terminology Realm A Defined the authentication policy User A defined individual in the Application Server Group A defined classification of users by common traits in the Application Server. Role An abstract name of the permissions to access a particular set of resources in an application

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Available Frameworks Spring Security Former Acegi JAAS (Java Authentication and Authorization Service) jGuard Apache Shiro

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Spring Security Security is your responsibility Features: It is not the standard No class loader authorization capabilities Simple configuration Portable across containers Customizable and extendable Pluggable authentication and web request URI security Support method interception, Single Sign-On, and Swing clients

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Authentication Form-Based Basic Digest LDAP NTLM (NT LAN Manager) SSO (Single Sign-On) JA-SIG CAS Open ID Atlassian Crowd SiteMinder X.509

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Authentication Mechanisms Interact with the user Providers Check credentials Bundles details in a Thread Local security context holder Repositories Store roles and profile info In Memory JDBC LDAP Etc…

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Authorization Web Authorization URL-Based Which URL patterns and HTTP methods are allowed to be accessed by which role The rules are top-down with most specific at the top Paths are in Ant format by default Method authorization Reusable Protocol Angostic Uses AOP Annotations Support JSR 250 Spring Security 2.5 EL Support for Instance-based XML

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved.

Cross Cutting Concerns Logging Transaction Management Security Cashing Some Business Logic Etc…

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Aspect Oriented Programming The Problem Code Tangling No Cohesion Code Scattering Not DRY The Solution Aspect Oriented Programming AspectJ Modulation in Aspects and weaving into the application code

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Spring APO Spring AOP Java based AOP Framework Built on top of AspectJ Interception based

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. AOP Terminology Joint Point A point in the execution of the program Point Cut An expression that selects one or more joint point AspectJ Expression Language Advice The code to be weaved at a joint point Aspect Point Cut + Advice

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved. Types of Advices Annotations Before AfterReturning AfterThrowing After Around

Copyright (C) 2009 by Abdelmonaim Remani. All rights reserved.