By Jim White (Directory of Training and Instructor)

A few weeks ago while teaching Hibernate, a student (thanks Dan) asked me about whether version numbers can be generated by the database.  The answer is - Yes, in some cases.  I thought the question and an expanded discussion of Hibernate's versioning property would be a good topic for this week's blog entry.

The <version> property (or @Version annotation)

For those of you that use Hibernate today, you are probably aware that Hibernate can provide optimistic locking through a version property on your persistent objects.  Furthermore, the version property is automatically managed by Hibernate.

To specify a version for your persistent object, simply add a version (or timestamp) property in your mapping file and add a version attribute to your persistent class.  Here is an example on a Product class.

public class Product {

    private long id;

    private String name;

    private String model;

    private double cost;

    private long version;

...

}

<hibernate-mapping package="com.intertech.domain">
  <class name="Product">
          <id name="id">
            <generator class="native" />
        </id>
        <version name="version" type="long" />
        <property name="name" not-null="true" />
        <property name="model" not-null="true" />
        <property name="cost" type="double"/>
  </class>
</hibernate-mapping>

For those using annotations, just mark the version property's getter in the class with the @Version annotation.

@Version
public long getVersion() {
    return version;
}

The version property on the class can be numeric (short, int, or long) or timestamp or calendar.  However, when a better configuration element is provided for timestamps or calendars (covered below).

With automatic versioning (and version set to a numeric), Hibernate will use the version number to check that the row has not been updated since the last time it was retrieved when updating the persistent object (Product in this example).  Notice the extra where "and version = X" clause below, when a product from above is updated.

Hibernate:
    /* update
        com.intertech.domain.Product */ update
            Product
        set
            version=?,
            name=?,
            model=?,
            cost=?
        where
            id=?
            and version=?

If the version has been updated, Hibernate throws a StaleObjectStateException and the transaction (and any persistent object changes) rollback.  If the update commits without issue, Hibernate also increments the version number automatically (note the "set version = ?" as part of the update clause above).

Hibernate versus the Database Managing the Version

Under this configuration and in this example, Hibernate (from within your Java application) is managing the version number.  However, some DBA's may prefer to have the version controlled by database rather than Hibernate, especially when the database may be a timestamp and the application is distributed to multiple systems (maybe even timezones).  If the Hibernate application is on different systems that are not time synchronized, the timestamp generated by each system might be different thereby generating improper optimistic lock success or failures.  To inform Hibernate to have the database manage the version, include a generated="always" attribute in the Hibernate mapping of the persistent object.

<hibernate-mapping package="com.intertech.domain">
  <class name="Product">
          <id name="id">
            <generator class="native" />
        </id>
        <version name="version" type="long" generated="always"/>
        <property name="name" not-null="true" />
        <property name="model" not-null="true" />
        <property name="cost" type="double"/>
  </class>
</hibernate-mapping>

Hibernate will now defer to the database to generate the necessary version and update the persistent object's row accordingly.  A warning is in order however.  This will cause Hibernate to issue an extra SQL to get the version number back from the database after a successful update or insert.  Note the extra SQL issued below after a successful update of a product (Hibernate even comments it to indicate why it is needed).  You might also note that the version number is not set as above when updating the product.  Again, Hibernate is now totally deferring to the database to manage this property.

Of important note, not all dialects (i.e. databases) support the managing of the version number.  HSQLDB, for example, does not allow the version number to be controlled from the database.

Hibernate:
    /* update
        com.intertech.domain.Product */ update
            Product
        set
            name=?,
            model=?,
            cost=?
        where
            id=?
            and version=?
Hibernate:
    /* get generated state com.intertech.domain.Product */ select
        product_.version as version8_
    from
        Product product_
    where
        product_.id=?

Timestamps for Version

In many situations, your DBA or organization may prefer a timestamp to be used as the version indicator.  In theory, the timestamp is a little less safe than a version number.  This is because a timestamp can, in theory, be updated by two transactions at the exact same time (depends on the precision of the database) and allow both to update causing a last in wins scenario (violating the optimistic lock).  It can also be argued that timestamps also take up more space in the database.  Depending on the dialect, the use of a timestamp may incur an additional hit of the database to get the timestamp.  However, on the plus side, timestamps provide useful information about the "when" a row was last altered.  In cases of auditing or record tracking, this might be important information.  Version numbers don't provide any context for when an update occurred.

If a timestamp is useful, change your version property to be a java.util.Date or Calendar and use a <timestamp> (rather than using a <version>) element in the mapping file.

public class Product {

...

    private Date version;

...

}

<hibernate-mapping package="com.intertech.domain">
  <class name="Product">
          <id name="id">
            <generator class="native" />
        </id>
        <!--<version name="version" type="timestamp" generated="always"/>-->
        <timestamp name="version" source="db"/>
        <property name="name" not-null="true" />
        <property name="model" not-null="true" />
        <property name="cost" type="double"/>
   </class>
</hibernate-mapping>

The <version type=timestamp"> and <timestamp> are equivalent, but it might help the reader to better see/understand that the version is an effectivity timestamp versus a numerical indicator.

You might also notice the source="db" in the mapping configuration above.  The source attribute can be set to "vm" (for virtual machine) or "db" (for database).  When set to "db", the database creates and manages the version timestamp (equivalent to generated="always") above.  As mentioned above, in the case of the database managing the version timestamp, your application may incur an additional hit of the database as Hibernate must first retrieve the timestamp before updating the row.  Further, as the Hibernate documentation says:  "Not all Dialects are known to support the retrieval of the database's current timestamp."

Optimistic Locking without a Version

Your application may need to deal with a legacy database and the database cannot be altered to contain a version (numeric or timestamp) column.  In this case, Hibernate provides two additional options for optimistic lock management.  You can use all the fields of the persistent object to check that nothing in a row was modified before updating a row.  Set the optimistic-lock="all" attribute (and dynamic-update="true") in the <class> element to use this approach.  The SQL issued by Hibernate will then use each property as a check in the where clause as shown below.

Hibernate:
    /* update
        com.intertech.domain.Product */ update
            Product
        set
            name=?
        where
            id=?
            and name=?
            and model=?
            and cost=?

comparison of the state of all fields in a row but without a version or timestamp property mapping, turn on optimistic-lock="all" in the <class> mapping

As a slight alternative to this approach, you can set optimistic-lock="dirty" and then Hibernate will only use modified columns as part of the optimistic check (see below).  This last approach actually allows to transactions to update the same object concurrently legally, but only if they are modifying different columns - something that might be advantageous in a larger application setting where many people are accessing the same objects (thus rows) but rarely updating the same properties (columns).

Hibernate:
    /* update
        com.intertech.domain.Product */ update
            Product
        set
            name=?
        where
            id=?
            and name=?

See the Hibernate documentation for more details on these alternatives to versioning.

Come join us to learn more about Hibernate!  Sign up for Complete Hibernate at Intertech.com here.

by Jim White (Intertech Director of Training and Instructor)

I attended fellow instructor Andrew Troelsen?s Complete Windows Communication Foundation (WCF) class last week (recently updated for .NET 4.0). Andrew is a gifted teacher with a deep deep knowledge of .NET. If you want to learn anything about .NET, you really need to take a class from Andrew. Regardless of the topic, you are going to learn more in a day with Andrew than you will reading an entire library of books on your own. For those not aware, WCF is Microsoft?s relatively new service oriented framework. In Java, this would be equivalent to your JAX-WS and JAX-RS more on that in a bit APIs.

If you had to put me in one of the software-centricities today, I guess you would say I am a ?Java developer.? I have been doing Java for over 14 years. However, I have recently ?crossed to the dark side? (as some of my Java friends would say) as I am participating in and leading Intertech?s Cloud Computing efforts ? most notably with Windows Azure (Microsoft?s cloud platform). WCF is at the heart of a lot of Azure capabilities and APIs. I took Andrew?s class to get better insight into this Azure foundational element.

However, as a Java developer, I was also curious to see how the other world treated SOA and Web services. When writing interoperable Web services or consumer applications, I am always very curious how non-Java applications might work with my Java service or Java consumer. After all, SOA and Web services are all about interoperability.  This week?s class gave me a much better appreciation for that, at least from the current Microsoft stack. Below, I have provided a kind of compare and contrast look at how Java and .NET provide developers with tools and APIs for wresting with services. For those that spend a lot of time in SOA worlds, I hope you find the discussion encouraging. The point of this post is not to highlight the differences, but to really spotlight the fact that the two have to address many of the same issues and are therefore more alike than you might think. In other words, there is more that binds us (pun intended) than separates us.

First, some of the differences I saw. Note, ?differences? doesn?t not mean better or worse ? just different.

Support for Multiple Bindings

Java has an API for everything. Unfortunately, that means for each job, you need a different API. The JAX-WS API provides a great environment for writing interoperable SOAP-based Web Services and Web Service Clients. What if you need to communicate Java-to-Java using a different (more Java centric) protocol? Well, then it?s probably another distributed technology API (like RMI or EJB) that you probably want to explore ? at least if you want the performance and Java objects passed around. Want to do REST in Java? You need JAX-RS. In the .NET world, its WCF - period. In fact, what I was impressed with is that WCF has taken over as the communications framework in the Microsoft camps. Gone (not deprecated, but certainly relegated to legacy support) are .NET Remoting, ASP.NET web services, and other such APIs. Everything is now WCF. .NET to .NET, or .NET to Java using SOAP, it?s all the same. WCF offers multiple bindings. Bindings dictate the protocols, encoding mechanisms, and the transport layer used between consumers and service providers. What?s more, when you write a WCF service, the code doesn?t know or care what binding you choose. The binding is taken care of through configuration and hosting operations. In class, we wrote simple services in our lab that ran SOAP over HTTP in one minute and in TCP or named-pipe, .NET-centric fashion the next minute. Java wonks will argue you can do multiple bindings with Java APIs too. Yes you can, just like I can cut my yard with scissors ? doesn?t mean I want to or that it?s a good idea either.

WCF Host vs. the App Server

In Java, you typically create your service as a simple Java object (POJO or plain old Java object as it is know) and hand it off (with some configuration) to a Java application server/container to do the rest of the work. While Java services (like those produced in JAX-WS) can run in multiple environments, by and large, they are really engineered to be simply packaged and deployed into a managed Java runtime container (a Java application server). Nicely, the container manages the lifecycle of the service, routes traffic to and from the service, and generally handles all the details of the service as it is deployed and running. In the WCF, once you have created the service (which is also just a simple object), your work may only be half done. Now, you need to pick and possibly build its host environment. You can choose something like IIS to host the service (your job is now simpler) or you may choose to have a custom Windows service, or console application, Windows Server (through Windows Activation Service) host your service objects. Some choices will require you to write the code that essentially manages your service at runtime. Other options just need some configuration. Choices are good.  Allowing for you to pick how and what manages the life of your service.  However, choices can also lead to some complexity. I can see that making the wrong choice (or coding the host inappropriately) could lead to some issues (like poor service performance).

To be fair and honest, as those in the Java community know, running in an application container is not always a picnic - i.e. seamless or easy.  Your Java Web services don't always deploy simply or easily in containers as it often requires special libraries and/or configuration.  In fact, there is even a JSR (JSR-109) that attempts to address the deployment issue interoperable Web services.

Development Approaches (top-down, bottom up)

As Java?s main Web service stack (JAX-WS) is all about interoperable SOAP-based Web services, it should come as no surprise that the IDEs, tools, and API support both top-down (a.k.a. WSDL or contract first) and bottom-up (a.k.a. code first) approaches to building Web services. I?ll leave the pros/cons of both approaches to material you can find on the Internet. However, both are supported with neither relegated to an ?alternate approach? status. While you can do top-down service development in WCF, you need to use a command prompt tool (SvcUtil) to generate code from the WSDL and related schema documents. This seemed a bit kludgey to me. I am sure the tool works fine and once you are used to working with it, you can make it do all sorts of neat tricks. However, when I have a WSDL URL, I?d like to point my IDE to the WSDL and say ? go generate skeleton code for my new service. I didn?t see anything like that in WCF, which leads me to feel that the top-down approach is relegated to second class status in .NET. However, remember again that WCF deals with multi-bindings and the service code itself doesn?t know or care that it is doing SOAP or .NET binary. Top-down development is about using a contract to drive development of consumers and services. In an all .NET world, a top-down contract approach probably isn?t going to be an option (no WSDL to leverage there).

REST

Formal REST support is something added to WCF with the latest release (.NET 4.0). Frankly, it kind of looks like it was added recently.  For example, a number of configuration simplifications were made for "normal" services in .NET 4.0.  However, RESTful Web services must use the older form of configuration.  Further, the WCF templates in Visual Studio 2010 may still require a few reference updates and configuration changes when creating a RESTful service project.  These are minor issues, and I think we can all presume that things will be better and different in a future release of WCF.  However, WCF is the framework for any type of "communications" - REST or otherwise.  So again, when building a service using WCF, you can create a simple class that performs some sort of offering and you can make it available as a Web service, .NET named-pipe, or RESTful Web service all with the same framework.  Java's RESTful API (JAX-RS which is relatively young itself) is a separate API (and implementation) from its other service types (notably JAX-WS).  While it might be possible to have a class implement both JAX-WS and JAX-RS simultaneously, you are really talking about two different frameworks and two APIs for Java Web vs. RESTful services.

Security

WCF leverages Microsoft's Role Based Security system for most in-house (.NET to .NET) types of services.  This makes security slick and easy for service providers and consumers.  The API for determining who is the caller and what access they have is built into the API as well as a declarative model that makes securing services pretty easy.  For externally facing services, authentication and authorization are, like Java, a bit more manual (generating, handling and passing credentials and/or certificates in the message), and takes a bit more work on the part of the service provider/consumer to setup.  However, WCF applications can leverage the SQL Membership Provider API.  The SQL Membership Provider API, for non-.NET developers, is an auto-generated custom database (at runtime) for registering users and granting access.

Proxy API

In both Java and WCF, proxy classes are generated for the consumer developer.  The proxy makes communicating with the service easy and abstracts away the details of the protocol being used or even the fact that it is distributed computing going on.  Working with a WCF proxy is so simple, as they say in the commercials, even a caveman can do it.

BasicMathClient proxy = new BasicMathClient();

Console.WriteLine("1 + 1 = {0}", proxy.Add(1, 1));

proxy.Close();

In Java, there are actually two types of proxies.  Using the dynamic proxy client (a generated proxy), is very similar to using the WCF proxy.  I think JAX-WS client proxy coding is a bit more complex, but also offers the ability (in theory) to use different ports on the service (e.g. SOAP vs. RMI). 

BasicMathService service = new BasicMathService();

BasicMath port - service.getBasicMathSOAPPort();

System.out.println("1 + 1 = " + port.Add(1,1));

Java also offers the Dispatch Client.  This client requires more work (a lot more work), but allows the developer to have more direct control of the raw message (typically SOAP).

More That's The Same Than Different

As mentioned, there is really more that is similar between Java and .NET's Web service frameworks than is different.

Services as Simple Classes

Both rely on objects that come from simple classes dictated by interfaces for implementing services.  Plain old Java, C#, or VB objects are running the SOA world!  In fact, I even found it interesting that both environments encourage but do not require the use of an interface for defining the service.  Of course, services can contain complex logic and complex calls to other classes to get business done, but the service structure itself is simple and easy to understand.

Annotations or Attributes

Both rely on metadata (Annotations in Java and Attributes in .NET) to demarcate the service, its operations, and much of its runtime behavior.  Its fun to see that there is almost a one-to-one correspondence in the metadata tags in both worlds.  If you were a Java developers, I dare say you could pick up a C# Web service and translate it into Java code with only a little assistance.  And of course the opposite holds true for .NET developers.

//C# attributes

[ServiceContract]

public class ServiceTypeAsContract

{

[OperationContract]

public void SomeMethod() { /* Some interesting code. */ }

[OperationContract(IsOneWay = true)]

public void AnotherMethod() { /* Some interesting code. */ }

}

//Java annotations

@WebService

public class ServiceTypeAsContract

{

@WebMethod

public void SomeMethod() { /* Some interesting code. */ }

@WebMethod

@OneWay

public void AnotherMethod() { /* Some interesting code. */ }

}

Serialization/Deserialization

The frameworks are largely responsible for the creation of the request and response messages and marshalling/unmarshalling data to the applications.  The days of manipulating raw XML, JSON, or other formatted requests and responses are over in any language.  Let the framework do the grunge work of distributed communications and data formatting. 

WS-* and WS-I adherence

Both Java (JAX-WS) and WCF are now fully WS-I compliant.  This is good news for everyone.  While you can certainly use annotations/attributes or configuration to construct non-interoperable services, it requires work (and presumably acknowledgement on your part) to implement only for a certain platform.  There are still many gotchas in Web service interoperability, but developers now have a fighting chance of making things work with other platforms without having to know every detail about the other platforms.

Exceptions as faults

Both WCF and the Java frameworks translate language exceptions into faults.  Both provide a similar means of creating application specific faults that can contain more details about what went wrong to the client.

Filters vs. Channel

Both the Java frameworks and WCF provide for pre and post processes to operate on in bound and out bound messages at both the consumer and service provider levels.  They have different names, but provide similar capability to alter the message on the way to and from its destination and even to alter message flow under the right circumstances (say authentication failure).  In Java, these processes are called handlers.  In .NET/WCF they are called channels, but they serve the same general purpose.

I am sure a more experienced practitioner in both the Java and .NET SOA worlds can provide you with more detailed and better comparisons than I have here.  Hopefully, you get the idea that the software community is more united in its approach to SOA than divided - at least when it needs to be.  Sure, you can write applications in Java or C# that just need to communicate with their ilk and then things often get simpler.  But the design, patterns and approach to building services, no matter the platform, is starting to get more similar and that's good news for everyone.

Sign up today for Complete WCF or Complete Java Web Services to learn more about SOA in any environment.

I have been working with Java and its related technologies since 1997 - the first two years managing a team using the pre-release, 1.0, and 1.1 versions (primarily for the cross-platform benefit to make new front ends for a Unix/C++ system) and the remainder years as a consultant with Intertech. One of my favorite things about Java is its ecosystem, having watched a number of things form (and fade!) during that time.

Recently I had another conversation about its amazing ecosystem, commenting on the various facets of it - such as the JVM, community, products, support, maturity. With the community, it is mind blowing how many free-open-source (FOS) framework and tool products exist and continue to emerge. Yes, many are junk, unfinished, or just interesting (or not!) experiments. However, there are some very useful, successful, proven, well-adopted, and supported ones. We talk about some of them in everyday conversation - Spring, Hibernate, Tomcat, Maven, Ant, Eclipse, et al - almost taking them for granted. The Java ecosystem has enabled many successful new, and expansion of existing, companies.

At the onset, FOS software were few, far-between, and disorganized. Out of chaos emerges organization. Forges, such as SourceForge, emerged to provide some organization and aggregation. Curators such as Apache emerged to help foster higher quality, support, and consistency levels. More recently, Google established Google Project Hosting. Java FOS is very alive and well - thriving in fact. SourceForge reports over 43,000 Java projects.

The community around the FOS products is very large. Most of the products, particularly active ones, will have one or more email lists for help and discussion of the product, and I've seen this support exceed some of the commercial product support! Some products have individuals and/or organizations also offering commercial support contracts for escalated support response and priority for new features and correcting defects. Additionally, organizations using well-adopted FOS products also have an easier time finding people with existing skillsets in them - often learned from and participating in the FOS community.  Just look at some of Intertech's Java training offerings - Eclipse, Spring, Hibernate, iBatis, Struts...!

Another interesting facet of FOS in general is the corporate involvement in creating and supporting it. Besides individuals donating their time and talent, companies such as Google open source their free products that their employees create. Many of us use the Eclipse IDE.  IBM initiated this product and subsequently donated it to the newly established Eclipse Foundation (Eclipse has a very impressive release track record - the processes, tools, and coordination required to is a topic of its own!).  I have had a number of business people ask me about this - fascinated that companies and we developers would do this - and this is yet another topic of its own! :-)

The core enabler of Java's ecosystem is the JVM. It is highly performant, stable, and many languages can run on it. Besides the Java language, better-known ones are Groovy, Scala, JRuby, and Jython. Even ColdFusion has migrated to a JEE application that runs the CF apps. An interesting browse is the VM Languages blog - this site has listed over 300 languages that run on the JVM as of Feb 22, 2010: http://www.is-research.de/info/vmlanguages

Targeting the JVM with your language(s) of choice provides a flexible runtime environment. Most of us also know that there are JVMs for many different platforms, such as Mobile, Windows, UNIX, GNU/Linux, and mainframes. This allows your applications to run on the correct class of hardware for needs such as scaling and operations team skills/support. It also allows developing on the developer workstation of choice, e.g. Mac, Windows, GNU/Linux Desktop, and deploying to a potentially different operations environment, such as Solaris, or a multi-platform runtime environment.

Java's innovating ecosystem expands to other platforms too. A number of its tools and frameworks have been ported to other languages/environments, particularly .Net. For example, Ant -> NAnt, Maven -> NMaven, Spring -> Spring .Net, JUnit -> NUnit, CPPUnit (and many others).

My goal in sharing this is not an in-depth essay of all the merits of Java's ecosystem, but to share some of the recurring conversational points I have had, possibly encouraging you to further explore any of them. Java is very popular and successful, and its ecosystem is simultaneously a contributor and a result of it.

Based on experiences in the field and in the classroom, here are the top 10 things Intertech consultants and instructors have identified that separate experienced and seasoned Java developers from "newbies." Experienced Java developers know and understand these concepts, topics and APIs. Newbies do not know or are weak in these areas.

Few of the items are core to any application, but many are used all the time in every-day applications. Junior developers often use these items without fully understanding what they do, how they work, or what impact is made without them. Java Masters fully understand them and know how and how not to apply them.

1. Serializable

- an understanding of this marker interface usually indicates the developer has experience in I/O, persistence, and/or distributed technologies.

2. XML Namespaces

- an understanding of namespaces usually indicates the developer has experience in XML configuration and/or SOAP based Web services.

3. Default and no argument constructor

- an understanding of what a no argument/default constructor is and when it exists (or doesn't) is important to working with basic Java as well as JavaBean-based API's like Hibernate and Spring.

4. equals() vs. ==

- a concept that indicates a person's understanding of object oriented technology and basic Java. An understanding of different forms of equal is the foundation for also having an understanding of how other things like HashSet and object identity in Hibernate work.

5. JSTL

- now part of the Java EE spec and one of the most widely used tag libraries; one that demonstrates a basic understanding of JSPs and tag libraries.

6. New Java 5 language features

- to include: 

• Annotations - a powerful feature added to Java 5 and one that indicates how current a developers skills are. Now used in almost every API from Hibernate to Spring.
• for-each loop - a new loop syntax added in Java 5 that indicates how current a developer's skills are as well as an understanding of basic iteration.
• generics – provide type information to collections and reduce the need for casts in code.

7. Unified Expression Language

- now part of basic JSP development but also used in JSF and Spring and indicates a developer's experience in Web development.

8. Design Patterns

- few people have memorized every pattern, but experienced developers know, understand and use the most popular of the patterns like Singleton, Factory Method, Chain of Responsibility. These patterns permeate most of the popular Java APIs like Hibernate, Spring, JSF, etc. If you understand basic design patterns, you have a better chance and understanding the construction (and often the documentation) of these now-important Java application cornerstones.

9. Regular Expressions

- regular expressions are used in String processing, validators, data converters, Web service processing and many other areas.

10. Runtime vs. Checked exceptions

- exception handling is a basic Java function. Many frameworks have started moving to runtime-based exceptions. Experienced Java developers understand the difference and when try-catch blocks or rethrowing exceptions are required.
If you are new to Java development, after you think you have grasped basic Java development, scan this list and see how you stack up. Not that an understanding of these topics graduates you to "Guru" status, but having these probably puts you in good company to tackle today’s application development. Need some help with these topics?

Take a look at Intertech’s curriculum. Give us a chance to knock off a few of these items from your need-to-know list.

By Jim White (Intertech Director of Training and Instructor)

Have you started to explore Spring 3!  It came out at the end of 2009 (December to be exact).  You can check out one of the easier features - formatting annotations - to add to your applications through an article I wrote for Developer.com.  It was just published to day:  http://www.developer.com/features/article.php/3879471/Spring-Framework-30-and-Annotation-driven-Formatting.htm.

Leave me comments or send me an eval on what you think and what other features of Spring 3.0 you'd like to learn/hear about.

By Jim White (Intertech Instructor and Director of Training)

Last Thursday (April 15th), I presented in our virtual classroom on RESTful Web Services in Java, an introduction to the new JAX-RS API.  You'll find links in this blog to the presentation and demo code shown in that talk.  During the talk, several attendees posted questions on RESTful Web services which I did not have time to answer during the session.  Below, I have tried to answer the remaining questions.

1.  Can you address security in RESTful services?

Since most RESTful Web services rely on HTTP, you can use HTTPS and/or existing HTTP mechanisms to secure your RESTful Web services.  By design, RESTful Web services are lighter-weight that their SOAP counterparts.  Therefore, the kinds of security standards that exist in WS-* specifications are formally available in RESTful settings.  Some RESTful advocates suggest RESTful Web services are actually more secure because they rely on the Internet's existing security infrastructure (see http://www.networkworld.com/ee/2003/eerest.html?page=1).  

In general, you pretty much have to adopt/roll your own with regard to security.  I have started to see some third party (many open source) packages that provide security options for RESTful Web services, but these are not guided by any standard.

2. How is Jersey ( JAX_RS)  different than Servlet based REST mechanism like Restlet. I can see Jersey has AdapterServlet too? Is Jersey  based on Servlet too then?

Jersey is an JAX-RS implementation.  RESTlet is a way to provide RESTful services in Java, but it is not guided by any standard.  In JAX-RS, your RESTful resource services are implemented as annotated POJO's.  In RESTlet, the resource service classes extend ServerResource so some consider this a bit of a burden and intrusive.

The RESTlet group does now have an extension package with allows implements the JAX-RS specification.  See here for more details.

For more comparisons of JAX-RS (and implementations like Jersey) to RESTlets, see the following links:

http://thestewscope.wordpress.com/2008/01/08/rails-jsr311-restlet-and-jersey/

http://stackoverflow.com/questions/80799/jax-rs-frameworks

Per part 2 of your question, yes a servlet does act as a controller to route traffic to the appropriate annotated Jersey resource service.  In that way, both RESTlet and Jersey are similar in their reliance of servlet technology.

3. What is the best way to supply the request=GetCapabilities for REST that one has in SOAP or WMS services to communicate meta-data of REST services?

Many RESTful advocates would say the "conventions" associated with RESTful services makes a capabilities listing unnecessary.  That is, the resource as noun and HTTP method as verb make the services very transparent and easy to work with.

That answer doesn't satisfy many.  There have been home grown solutions like that provided by ebay (see http://developer.ebay.com/products/shopping/) that provide a useful API/description for developers to use.  Others have found a way to wedge RESTful descriptions into WSDL.  However, a relatively new description language called Web Application Description Language (see http://searchsoa.techtarget.com/tip/0,289483,sid26_gci1265367,00.html) is being used in the RESTful community to provide a WSDL-like alternative in the RESTful arena.

4. Can we run a rest web service using https protocol?

Yes

5. How about Spring and REST?

As of Spring 3.0, Spring offers RESTful API, but it is not JAX-RS compliant.  See here for details.  In general, Spring makes use of the annotated MVC controllers to serve as RESTful resources.

6. is there simple/lightweight authentication capabilities with restful web services?

Per #1, again nothing formal is provided, but there are some 3rd party packages sprouting up and all the standard Web authentication mechanisms could be used

7. Is there a way to override the HTTP return error and give more detail?

Yes - to some extent.  For how to modify the message returned from the Jersey implementation see https://jersey.dev.java.net/nonav/documentation/latest/user-guide.html#d4e410.

8. A lot of time was spent on exposing a service using JAX-RS from the server.  On the client, what does REST provide (or not provide) as a 'contract' to be used to define the web service..similar to the WSDL, etc in SOAP (for client-side data binding, etc.).

As mentioned and demonstrated in my talk, JAX-RS does not provide for a client API or contract.  Since REST normally operates on HTTP, one could develop a client using java.....  However, many JAX-RS implementations (like Jersey and RESTEasy) offer client side APIs.  These are non-standard, but do offer a means to more easily communicate with RESTful services independent of implementation.

9. It should be noted to get JSON to output correctly for web-applications (i.e.. {'id':12} instead of {'id':'12'} - supporting primitives as primitives, or handling of arrays properly etc, you need to setup a JAXBContextResolver and dictate the notation to user / type.  JAXB will not 100% give this to you.  You need to map your JAXB annotation to a JSON mapping using a context resolver.   Jersey website/forums do have some notes on this and I have been very successful using Natural Notation with GWT/GXT clients.

Correct and thanks for the providing the extra insight.

10. Twitter's REST API is also pretty good reference if you're trying to grow your own app and don't know where to start. http://apiwiki.twitter.com/Twitter-API-Documentation.

I agree.

11. How do we handle streaming using REST based approach?

There is nothing specific in the current JAX-RS specification about how to handle streaming content.

12. client-side data binding?  Thoughts on Spring 3 MVC as an impl?

Per #5 above, Spring 3 through MVC annotations does provide a RESTful service API but it is not Java spec compliant.  If one was using Spring heavily, I could see an attraction to using the same annotated Spring controller classes for both human Web facing and machine RESTful facing clients.

Thanks for all the great questions, comments and feedback  on our presentation.  I hope you will consider attending our Complete Java Web Services class.

If you did not have a chance to catch the free Intertech Oxygen Blast training event on April 15th (RESTful Web Services in Java), you can get the slides and code from the links below.

Slide Presentation:  http://www.intertech.com/downloads/JAXRS-OxyBlast.pdf

Code Samples:  http://www.intertech.com/downloads/JAXRS-OxyBlast.zip

Also, the presentation was recorded and can be replayed at the link here.

by Jim White (Instructor and Director of Training)

Last week, I had a group of experienced Java developers attend my Complete Hibernate class.  They had several great questions, some of which I plan to highlight with a few blog posts over the next week or so.  In today's post, I would like to address how the overloaded load( ) methods work in Hibernate (this question was posed by Chris - thanks for the great questions Chris).

Retrieving A Persistent Instance in Hibernate

First off, a bit of background.  There are two methods that can be used on a Hibernate session (org.hibernate.Session) to retrieve a single instance of persistent object:  get( ) and load( ).  In fact, both methods are heavily overloaded, meaning there are several methods with the same name but that take different parameters.  So in fact there are far more than two methods.  While both get( ) and load( ) methods retrieve a persistent object by its identifier, these two types of methods operate a little differently.

Difference Between get( ) and load( )

The get( ) methods always hit the database.  Meaning, as soon as the call to get( ) occurs, Hibernate issues an SQL statement to the database in an attempt to fetch the associated data (usually a row in the database) to rebuild the requested persistent object.  A call to load( ), on the other hand, does not immediately incur a call to the database.  The load( ) method causes a proxy object to be constructed as a stand-in for the persistent object.  It is only after some state is requested from the proxy that Hibernate issues the appropriate SQL to the database and builds the real persistent object.  When using get( ), the method will return null if no data exists for the requested identifier.  Since the load( ) method does not immediately retrieve the object, if no data exists for the identifier used to retrieve the object, an ObjectNotFoundException is thrown once data is requested of the proxy.

Overloaded get( ) and load( ) Methods

As I mentioned, both the get( ) and load( ) methods are heavily overloaded.  There are four of each methods that take the same parameters:  the class (either a Class object or String name), persistent object identifier, and optionally a lock mode (for pessimistic locking).  The four methods of each are outlined in the table below.

get(Class clazz, Serializable id)

load(Class clazz, Serializable id)

get(Class clazz, Serializable id, LockMode lockMode)

load(Class clazz, Serializable id, LockMode lockMode)

get(String className, Serializable id)

load(String className, Serializable id)

get(String className, Serializable id, LockMode lockMode)

load(String className, Serializable id, LockMode lockMode)

An Extra load( ) Method

There is an additional load( ) method that was at the heart of Chris's question.  The last of the overloaded load( ) methods takes an existing instance of the persistent class and the identifier of the persistent instance to be retrieved.

load(Object object, Serializable id)

This load( ) method will read the persistent state of the requested object directly into the existing instance provided.  In fact, since you pass in the instance whose properties are to be set with state, the method returns void.  What's more, like the get( ) method, it will cause Hibernate to issue an SQL request immediately to the database.  Care must be taken with this method in that any state that exists in the object passed to the method will be replaced by data found in the database - even the id will be replaced by the id of the persistent object retrieved!

To see how load(Class clazz, Serializable id) differs from load(Object object, Serializable id), take a look at the two sections of code below, each followed by the output issued from the code when executed.

Example of using load(Class clazz, Serializable id)

public static void main(String[] args) {
    SessionFactory sf = new Configuration().configure()
            .buildSessionFactory();
    Session session = sf.openSession();
    Contact c = (Contact)session.load(Contact.class, 1L);
    System.out.println("Before any request of the proxy or persistent object -------.");
    System.out.println("Contact retrieved ---- >" + c);
    System.out.println("After a request of the proxy or persistent object -------.");
    session.close();
}

Output from example above

Before any request of the proxy or persistent object -------.
Hibernate:
    select
        contact0_.id as id0_0_,
        contact0_.first_name as first2_0_0_,
        contact0_.last_name as last3_0_0_,
        contact0_.date_of_birth as date4_0_0_,
        contact0_.married as married0_0_,
        contact0_.children as children0_0_,
        contact0_.org_id as org7_0_0_,
        contact0_.spouse_name as spouse8_0_0_,
        contact0_.spouse_date_of_birth as spouse9_0_0_,
        datediff('yy',
        contact0_.date_of_birth,
        curdate()) as formula0_0_
    from
        Contact contact0_
    where
        contact0_.id=?
Contact retrieved ---- >Jim White(1)
After a request of the proxy or persistent object -------.

Notice how, in this example, SQL is not issued until data from the Contact object is used (as part of the toString in the println request).

Example of using load(Object object, Serializable id)

public static void main(String[] args) {
    Contact c = new Contact();
    c.setId(1234L);
    c.setFirstName("John");
    c.setLastName("Doe");
    SessionFactory sf = new Configuration().configure()
            .buildSessionFactory();
    Session session = sf.openSession();
   session.load(c, 1L);
    System.out.println("Before any request of the proxy or persistent object -------.");
    System.out.println("Contact retrieved ---- >" + c);
    System.out.println("After a request of the proxy or persistent object -------.");
    session.close();
}

Output from example above

Hibernate:
    select
        contact0_.id as id0_0_,
        contact0_.first_name as first2_0_0_,
        contact0_.last_name as last3_0_0_,
        contact0_.date_of_birth as date4_0_0_,
        contact0_.married as married0_0_,
        contact0_.children as children0_0_,
        contact0_.org_id as org7_0_0_,
        contact0_.spouse_name as spouse8_0_0_,
        contact0_.spouse_date_of_birth as spouse9_0_0_,
        datediff('yy',
        contact0_.date_of_birth,
        curdate()) as formula0_0_
    from
        Contact contact0_
    where
        contact0_.id=?
Before any request of the proxy or persistent object -------.
Contact retrieved ---- >Jim White(1)
After a request of the proxy or persistent object -------.

Using load with an existing object, you see that SQL is issued immediately (even before a request of the object is made).  The data retrieved replaces all the existing data in the Contact object (referenced here as 'c') during the load operation.

As with other forms of the load( ) method, an ObjectNotFoundException is the result when you try to retrieve an object with an identifier that does not exist.  However, because SQL is immediately issued to populated the existing object, the exception is thrown on the call to load( ).  In contrast, the ObjectNotFoundException will be thrown when accessing the proxy produced by other forms of the load( ) method.

Wrap Up

So while get( ) and load( ) methods on Hibernate's session object each have the same ultimate purpose (to retrieve a persistent instance) both behave a bit differently.  And, in fact, as you've seen there are also some differences in the behavior of various forms of the overloaded load( ) method.  If you would like to learn more about Hibernate, I encourage you to take Intertech's Complete Hibernate course.  We'd love to have you in our classroom, but you can also take the class virtually.

By Jim White (Intertech Instructor and Director of Training)

It was Spring Framework training again this past week.  How fitting as it was also the first official week of spring and as pro-baseball's Spring Training was wrapping up.

This week, I had two students in my class that are getting ready to develop a new web application for their company.  This web application is going to be built with Spring and Spring MVC.  They have been given a prior web application as a project "template."  So this week's class gave them a great opportunity to learn Spring, and to figure out how to design and build their application around some of the features they have seen in the existing template project.  I love having students in class that have a very concrete purpose for learning the material.  I found these students are eager to learn, and they like challenging me with interesting problems that they want to apply in their applications.  It provides me the opportunity to do what I call "micro-consulting."  In the span of a class, I can't create an entire application, but I can sometimes help solve particular challenges students have.

One of the complex Spring MVC user interfaces my students, Mark and Senthil, know they will have to address deals with showing multiple records in an HTML table and allowing users to randomly edit the data in the table.  A checked checkbox at the front of each row is an indication, on the part of the user, that they have modified something in that row and want the new data provided in that row stored in the database.  A checkbox left unchecked means that the data in that row, regardless of any changes, to be left unsaved.  For demonstration purposes, I have shown a mock up of this kind of UI below for "customer contact" data.  As the contact data is brought up in the edit page, you can change all the data in each row and each field, but unless you also check the checkbox to the left (arrow identifying below), then no update of that row is made in the database.

Now, you can argue the merits of this user interface (I like to call it "table-o-data") all you would like.  However, as a practical matter, we all know that the companies we work with design and evolve user interfaces that the business has become comfortable with or find to be productive.  The question put forth to me was can a Spring MVC controller/command bean design be set up to accommodate such a UI?  The answer is absolutely yes!

Spring's MVC components are quite flexible to address all sorts of imaginable UIs.  The Command bean itself is really just the name we give to the set of objects that harvest and provide data from/to the view (which is usually in the form of HTML).

A More Complex Command Bean

          Note:  Code for this example is provided at the link at the bottom of this blog post.

So let's explore how a more complex command bean can be devised to deal with Mark and Senthil's "table-o-data" UI.  In this case, each row represents a single customer contact.  So, at first we build a simple Contact POJO.

public class Contact {
    private Long id = 0L;
    private String firstName;
    private String lastName;
    private Date dateOfBirth = new Date();
    private boolean married = false;
    private int children;
    private boolean updating = false;
    //getters, setters, constructors left off for brevity
}

The updating boolean property will hold the true/false checkbox indication that the Contact data should be updated/saved in the database.

Most Spring MVC references and books use a simple POJO like this one as the command bean behind a view that allows a user to edit a single instance of a contact.  However, in this case, a collection of these Contact beans must be in place to allow multiple rows to be edited.  To accomplish this task, we need another, more complex, "command bean."  Below is the code for a ContactList that servers as our command bean.  Notice that the ContactList wraps a list of Contact objects from above.

public class ContactList {
    private List<Contact> contacts;
    //getters and setters removed for brevity
}

Command beans do not have to be simple objects with no relationship to other objects.  Command beans can have relationships with other object, can be collections of objects, or even a map of data values (see http://forum.springsource.org/showthread.php?t=18687 for an example of a HashMap of data values captured from a UI).

The JSP - Using Spring Form Tags, JSTL with the Command Bean

The trick of using a more complex command bean is finding out how to access and reference it's properties, associated objects, etc. through the form tags in your JSP.  Spring MVC form tags allow you to use dot notation to access properties containing other objects.  You can also use square brackets [ ] to navigate around collections like our list above.  Here is the form portion of the editcontacts.jsp that displays the many customer contacts in the "table-o-data" example shown above.

<form:form action="editcontacts.request" method="post" commandName="contactList">
    <table border="1">
        <tr>
            <th>&nbsp;</th>
            <th>First name</th>
            <th>Last name</th>
            <th>Date of birth</th>
            <th>Married</th>
            <th>Children</th>
        </tr>
        <c:forEach items="${contactList.contacts}" var="contact" varStatus="x">
            <tr>
                <td><form:checkbox path="contacts[${x.index}].updating" value="true"/></td>
                <td><form:input path="contacts[${x.index}].firstName"/></td>
                <td><form:input path="contacts[${x.index}].lastName"/></td>
                <td><form:input path="contacts[${x.index}].dateOfBirth"/></td>
                <td><form:checkbox path="contacts[${x.index}].married" value="true"/></td>
                <td><form:input path="contacts[${x.index}].children"/></td>
            </tr>
        </c:forEach>
    </table>
    <input type="submit" value="Save" />
    <form:errors path="*"/>
</form:form>

Notice how I use JSTL to iterate through the many Contacts in the ContactList (the command bean) which is stored under the name "contactList."   In the form field tags, I use dot notation in the path attribute to access each contact and the properties within the contact (firstName property is accessed out of a contact bean below).  Using a little expression language and square bracket notation, I can access each Contact in the ContactList list.

path="contacts[${x.index}].firstName"

The Controller

What's left is to show you is the important parts of the controller.  In this example, I use a SimpleFormController and configure the controller's command bean as an instance of ContactList.  The XML Spring configuration of the controller is shown below.

</bean>
    <bean id="editContactController" class="com.intertech.controllers.EditContactController">
    <property name="contactService" ref="contactService" />
    <property name="commandClass" value="com.intertech.domain.ContactList" />
    <property name="commandName" value="contactList" />
    <property name="formView" value="editcontacts" />
    <property name="successView" value="confirm" />
</bean>

In the formBackingObject method of the EditContactController, I retrieve the existing Contacts and create the ContactList to populate the edit contacts JSP.

protected Object formBackingObject(HttpServletRequest request)
        throws Exception {
    List<Contact> contacts = contactService.getContacts();
    ContactList list = new ContactList();
    list.setContacts(contacts);
    return list;
}

Then in the doSubmitAction, when the form holding the "table-o-data" is submitted with a POST operation, simply iterate through each contact in the ContactList command bean and determine if the "updating" check box has been checked.  If so, update the contact in the database.

protected void doSubmitAction(Object command) throws Exception {
    ContactList myList = (ContactList) command;
    for (Contact c : myList.getContacts()) {
        if (c.isUpdating()){
            contactService.updateContact(c);
        }
    }
}

Spring MVC Controller Stereotypes

This example uses the Spring MVC 2.5.6 controller hierarchy.  With Spring 3.0, the controller hierarchy is being retired in favor of stereotype components and @Controller annotations.  However, use of command beans is still used in the new MVC architecture.  So the structure of the command bean and JSP does not change.  The controller becomes just a plain Java class with @Controller and @RequestMapping annotations.

Wrap Up

Command beans can be as complex or as simple as they need to be to capture (and possibly redisplay) data in your UI screens.  Don't limit your imagination to simple classes with primitive properties and Strings.  Understand your UI needs and develop a command bean that addresses the UI and not the reverse.

I'd like to thank my students Mark and Senthil for attending my class this week and for providing the idea for this week's blog entry.  The code for the example you see here (complete with DDL and batch files for HSQLDB) is available in a WAR file (optimized for Apache Tomcat 6) stored in a ZIP file (for transport over the Web) located here.  If you would like to learn more about Spring and be the next student that experiences micro-consulting, join me for a class at Intertech by signing up for Complete Spring Core or Complete Spring Web at Intertech.

by Jim White (Instructor and Director of Training)

For the last few months, I have had my head in the clouds.  Go ahead ? insert your favorite one-liner here. My wife has already impaled me with many.  The ?clouds? I speak of are those associated with cloud computing.

If you are in the information technology community and unless you have been living under a rock for the past year or so, I am guessing you have heard about cloud computing.  So, no need to provide a definition then. ? Oops, I can tell from the RCA-dog expression on a lot of reader faces out there that you may not know what cloud computing is!  So you have heard of cloud computing, but your still a little fuzzy on the definition?

This is certainly one of the challenges of cloud computing.  It hasn?t been really well defined yet.  I saw a television commercial a midst the NCAA basketball tournament that touted the benefits of "the cloud."  I'll bet very few people watching really knew what was being advertised.  In fact, even in IT circles the words "cloud computing" are overused to the point that there is no real consensus even where there might be understanding.  The term suffers from something I call illdefinitis:  lacking in clear definition but still used all over the place to sell product, service or other  charms (just like architecture, framework and Web 2.0).  Larry Ellison, in a now famous (or infamous) rant captured on YouTube, skewered cloud computing and called it ?nonsense? and ?water vapor.? While I don?t agree with all of his statements, Mr. Ellison makes a point.  Until cloud computing is well understood and really means something, it won't be taken seriously.  And folks - I am here to tell you, some cloud computing is serious computing!

So with this blog post, I would like to accomplish two goals.  One, try to give you a way to understand cloud computing (I don't want to say define - that might be too ambitious).  Second, I want to try to provide you a reason for exploring cloud computing - at least part of it.

My first task is to provide some help in clarifying what "cloud computing" means.  Cloud computing is about providing information, software and/or computing power as a utility.  How do you get or use electricity or water?  You turn it on when you need it and pay for what you use.  Cloud computing is about turning on and off information and computing "flow" as you need it and paying for what you use.  The problem with cloud computing is that you may need hardware, you many software, you may need all sorts of information or computing flow.  That it why its so hard to label cloud computing and why so many organizations claim to offer cloud computing resources.  Let me provide you with a picture of the general "types" or "categories" of cloud computing.

This categorization is being used by many in IT circles today.  You can point to any one (or many together) of the boxes in this diagram and claim "that's cloud computing."

IaaS is the traditional "data center" offered as a pay-for-capacity style of service.  In fact, it is often called a utility service as you order and pay for IaaS like any utility (electricity, water, gas, etc.).  IaaS offers servers, software, data storage, network equipment as virtualized computing power to host your applications and data.  You provide the software/information, the IaaS provider gives you the environment to run it on so that you never touch the hardware.  Flexiscale and GoGrid are two often referenced IaaS providers.

PaaS is IaaS on steroids.  I believe PaaS is the future of computing.  PaaS offers virtualized computing like IaaS.  However, imagine a data center that scales all parts of your hosted environment automatically as your system needs grow.  PaaS also provides a much more sophisticated runtime environment - complete with security, monitoring, testing, and other solutions that typically require tons of application developer time to solve.  PaaS is a utility-styled IaaS hosting environment, but also offers a set of tools and API in support of cloud application development.  These tools help developers address issues of enterprise scale with minimal work.  PaaS is often described as "cloudware" or an operating system for cloud computing as it helps manages all the details of your application beyond the actual business code.

Salesforce.com is the most commonly thought of SaaS.  Microsoft Exchange Online is also thought of as an SaaS.  SaaS is about making packaged commercial software available over the Internet under a subscription or pay-for-usage service.

Now - why should you be looking at cloud computing?  I have been working extensively lately with Microsoft's Windows Azure.  Azure qualifies as one of the PaaS in the diagram above.  I would certainly not call Azure nonsense or water vapor.  In fact, this is a serious platform that I believe will impact nearly all software development in years to come.  We may not all be developing software for this exact Azure cloud computing platform (it is still in its infancy), but we will be developing for a platform like it - whether it be Azure 2.0 (or other future version), IBM's recently announce public cloud service, or other similar PaaS.

Why?  Have you been involved in setting up the development environments, staging environments, runtime environments, and the deployment procedures to get from one environment to the next for a substantially large project?  If you found that task painful and overly time consuming you might want to check out Azure or other PaaS.  If you like designing and building software to help solve business problems, but find thinking about failover, scale, security and other such software issues unappealing, you might want to look at Azure or other PaaS that provides some ready made tools, API and solutions to these common tasks.  If you have ever had the pleasure (tongue firmly planted in cheek) of supporting an application that was about to undergo a challenge in load/scale waiting for the beeper to go off, you need to take a look at how Azure could make life better - much better.  If you have ever had to architect an application that would suffer large loads at certain times but you only had a "normal" load budget for the solution you might want to look into Azure or other PaaS.

Microsoft, IBM, and others are making a big bet on PaaS cloud computing.  Chris Hay and Brian Prince describe Microsoft's work and investment in Azure and Microsoft data centers in support of cloud computing in their book Azure in Action.  I encourage you to explore Chapter 3 of that book, or if you like, take a look at the video on Microsoft's future data centers.  There investment is huge.  Cloud computing in the form of PaaS leaves the details of hardware, operating system, even system architecture, and the other non-business related details of software in the hands of the experts in an economical pay-for-what-you-use form.

I encourage you to take the time to explore cloud computing in all its forms, but particularly PaaS.  I think you'll find that it will soon be time to turn out the lights in our server rooms and data centers and it's time to turn on the cloud computing services.

To learn more about Azure and cloud computing in the Twin Cities area, I invite you to sign up for a free Azure bootcamp offered by Tim Star and I in May.  See here for details.