Benefits of Ruby

For me, one of the real benefits so far is getting me back into the C world... I've been away for some time doing Java mostly so it's fun to get back into the swing of things.

I've just recently found the YARV project. From what I have seen so far, it appears to be working toward a multi-threaded version of Ruby which makes me very happy! Ruby is a very cool language and serves a good purpose. Rails is wonderful for getting things off the ground soo quickly... but in today's web world, non-thread safe languages pose a few barriers.

These barriers can definately be overcome (and are everyday) but the web is a multi-threaded world... if YARV does push Ruby into the MT way of things, I think it will only serve to boost the already crazy swirl surrounding the Ruby/Rails phenomenon.

The right place at the right time…

I had to replace the glass in one of my patio doors so I went up to Home Depot like any other average "think I'm a handy man" joe would do to try to buy a replacement. They don't carry replacement panes in stock, of course, so I had to order one which would run me approx. $96 dollars and would not come in for another 6 to 10 biz days.

We put up with the broken glass patiently awaiting the arrival of the replacement which eventually came in. I get the glass home, removed the broken piece and begin to lift the replacement into place... you can see it coming can't you... it didn't fit!!! It was too big! I was extremely upset to say the least. I took the "no good to me" glass pane back to Home Depot where I argued with the service department about who's fault it was and finally got my money back.

I decide to try my luck with Lowes which is farther from my house. I mentioned the situation to folks at the door department and asked what my options are... he replied "could be very good". Apparently someone had ordered a replacement pane for their patio door but had ordered the wrong size as well. I walked out of there with the replacement for $20!!!

I wonder if the person who's glass I got went to Home Depot and bought the pane I ordered... nice way to save some money! :)

So what’s this Ruby thing all about…

OK, I've broken down and am looking into the Ruby thing.

First thoughts, love the syntax, great to be back in scripting environment again after years away, love gems (cpan rip-off but very nice), hate the fact that Ruby is not thread-safe... yet???

In all, Rails is what brought me to this. I like the way things are convention over configuration...

I've only just started, have some ideas I want to try out... we'll see, just having fun for now... ;)

Disable Cert Validation for LDAP and HTTP over SSL

Have you ever been developing something requiring a connection to a development server over SSL? Was the server not under your control? And you had either an invalid, corrupt or possibly no cert at all to add to your trustStore?

We won't go into why this scenario may occur... but I know there are quite a few people out there asking how to bypass the cert validation for HTTPS and LDAP over SSL (LDAPS) connections.

The place to start is the SSLSocketFactory and more specifically the TrustManager you use.


In the sample reference file "BlindSSLSocketFactoryTest.java" we establish connections to HTTPS and Active Directory via SSL (LDAPS) servers without valid certs by using our own SSLSocketFactory. We need to come up with a SSLSocketFactory that will use a TrustManager list we specify as an alternative to the SSLSocketFactory that will be used by the JVM.

Our socket factory will create a real SSLSocketFactory using an X509TrustManager created as an anonymous inner class with methods designed to simply fall down on the job when asked to validate certificates. All of our implementations of the SocketFactory's methods will in turn call the created SSLSocketFactory's methods. To use this class when connecting to an Active Directory server over SSL, we simply have to specify the "java.naming.ldap.factory.socket" property in our ldap context environment.

The example below is taken from the main method of the BlindSSLSocketFactoryTest class:

[sourcecode language="java"]
boolean validateCert = false;

// ... clipped ...

// our environment
Hashtable env = new Hashtable();
// complete URL of Active Directory/LDAP server running SSL with invalid cert
String url = "ldaps://:636";
// domain is the Active Directory domain i.e. "yourdomain.com"
String domain = "";
// the sAMAccountName (i.e. jsmith)
String login = "";
String password = "";

env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, url);
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, login + "@" + domain);
env.put(Context.SECURITY_CREDENTIALS, password);

if (url.startsWith("ldaps") && !validateCert) {
env.put("java.naming.ldap.factory.socket", BlindSSLSocketFactoryTest.class.getName());
}

try {
LdapContext ctx = new InitialLdapContext(env, null);
System.out.println("Successfull bind to " + url + "!");
} catch (AuthenticationException e) {
System.out.println("The credentials could not be validated!");
} catch (NamingException e) {
e.printStackTrace();
}[/sourcecode]By using our "blind" SSLSocketFactory, we will be bypassing the cert validation when connecting to the Active Directory server.

Another use for our handy little class is to bypass cert validation when connecting to an HTTPS server. Another example from main method:

[sourcecode language="java"]
// host name of server running SSL with invalid cert
String host = "";
int port = 443;// modify this if other than default port.

try {
SocketFactory sslFactory;
if (validateCert) {
sslFactory = SSLSocketFactory.getDefault();
} else {
sslFactory = BlindSSLSocketFactoryTest.getDefault();
}

SSLSocket s = (SSLSocket) sslFactory.createSocket(host, port);
OutputStream out = s.getOutputStream();

out.write("GET / HTTP/1.0\n\r\n\r".getBytes());
out.flush();
System.out.println("Successfull connection to " + host + ":" + port + "!");
} catch (IOException e) {
e.printStackTrace();
}[/sourcecode]As the security zealots will tell you, the best practice is to get a valid certificate and install it in your trustStore using the keytool and I agree with this. But that being said, some of the scenarios described above still may occur during development and if you have a tight deadline to get a prototype out the door, this class/code may help. Corrupt certs from servers you don't manage can be painful when trying to get the other party to move on something that is not deamed mission critical in development.

So take this code, create your own BlindSSLSocketFactory class (don't be lazy and just plug this in!!!) and let me know if it works for you. (click here to download)

Comments welcome...

Housebreaking your Tomcat

If you have written a servlet or a single JSP, it is almost guaranteed that you have used Apache's Tomcat Server. Whether you use it for development, to run intranet applications, or to serve your production needs... Tomcat is ready and willing to step up to the plate.

There are many different ways to manage your Tomcat instance, but for a great "Web 2.0" interface with lots of bells and whistles, take a look at Tomcat Probe.

Tomcat Probe is the ultimate tool to manage and monitor your Tomcat instance. Lightweight web user interface, killer features, no-fuss installation and weekly updates. Tomcat Probe gives you total control over live Tomcat instances and applications.

The interface provides for the management of deployed webapps, JSP's within apps, and data sources. You can view all kinds of stats for threads, charts for traffic information, download log files, call the garbage collector and much more. All of this with a great looking interface.

Even if you don't have a need to use this tool, it is worth a look.