Things happened in my life

I've been exposing to Gradle for a couple of weeks and really like it. As a Maven user, I found that Gradle is a refreshing methodology on how a build tool should be. But one thing I miss from the Maven land: the ability to generate the initial structure for a project (I mean the 'archetype' plugin of Maven). Luckily, due to the plugin architecture of Gradle, a Gradle user has developed a plugin just for that purpose. It's called the 'tempaltes' plugin. The wiki page of the plugin gives you all the details you need to install, but the global installation section is confusing and did not work. Here is how I did to make it work:

• Create a file called templates.gradle in the ~/.gradle/init.d/ folder (actually you can name it whatever you want as long as it has the extension .gradle)
• Edit that file and paste this little code snippet:

gradle.beforeProject { prj ->
   prj.apply from: 'http://launchpad.net/gradle-templates/trunk/latest/+download/apply.groovy'
}

Now, you can create a project structure event without a build.gradle with the command:

gradle createJavaProject

Happy coding!

The title says it all. This post will show you how to configure Spring Security with Digest authentication and encoded password. But first, here is the Spring Security documentation about digest authentication and encoded password:

The configured UserDetailsService is needed because DigestAuthenticationFilter must have direct access to the clear text password of a user. Digest Authentication will NOT work if you are using encoded passwords in your DAO. The DAO collaborator, along with the UserCache, are typically shared directly with a DaoAuthenticationProvider. The authenticationEntryPoint property must be DigestAuthenticationEntryPoint, so that DigestAuthenticationFilter can obtain the correct realmName and key for digest calculations.

It's not all true. Let's take a look at the source code of DigestAuthenticationFilter

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
    // omit code for simplicity
    
    // Compute the expected response-digest (will be in hex form)
    String serverDigestMd5;

    // Don't catch IllegalArgumentException (already checked validity)
    serverDigestMd5 = DigestAuthUtils.generateDigest(passwordAlreadyEncoded, username, realm, user.getPassword(),
                    request.getMethod(), uri, qop, nonce, nc, cnonce);
    // omit code for simplicty
}

Digging a little more into the method generateDigest of the class DigestAuthUtils, we have:

static String generateDigest(boolean passwordAlreadyEncoded, String username, String realm, String password,
                                        String httpMethod, String uri, String qop, String nonce, String nc, String cnonce)
            throws IllegalArgumentException {
    String a1Md5 = null;
    String a2 = httpMethod + ":" + uri;
    String a2Md5 = md5Hex(a2);

    if (passwordAlreadyEncoded) {
        a1Md5 = password;
    } else {
        a1Md5 = DigestAuthUtils.encodePasswordInA1Format(username, realm, password);
    }
   
   // The rest of the code

A little more into encodePasswordInA1Format of DigestAuthUtils:

static String encodePasswordInA1Format(String username, String realm, String password) {
    String a1 = username + ":" + realm + ":" + password;
    String a1Md5 = md5Hex(a1);

    return a1Md5;
}

From here, if we set the property passwordAlreadyEncoded of DigestAuthenticationFilter to true and create a suitable password encoder and salt source, we can make Spring Security digest authentication work with our tailored password encoder, salt source. Let's create them:

package com.mycompany.myproject;

import org.springframework.beans.factory.InitializingBean;
import org.springframework.security.authentication.dao.SaltSource;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.util.Assert;

public class DigestAuthenticationAwareSaltSource implements SaltSource, InitializingBean {
 
    private String digestRealm;
 
    @Override
    public void afterPropertiesSet() throws Exception {
        Assert.hasText(digestRealm, "A Digest Realm must be set");  
    }

    @Override
    public Object getSalt(UserDetails user) {
        return String.format("%s:%s:", user.getUsername(), digestRealm);
    }

    public void setDigestRealm(String digestRealm) {
        this.digestRealm = digestRealm;
    }
}

package com.mycompany.myproject;

import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

import org.springframework.dao.DataAccessException;
import org.springframework.security.authentication.encoding.PasswordEncoder;
import org.springframework.security.core.codec.Hex;

public class DigestAuthenticationAwarePasswordEncoder implements PasswordEncoder {

    @Override
    public String encodePassword(String rawPass, Object salt) throws DataAccessException {
        String a1 = salt + rawPass;
        return md5Hex(a1);
    }

    @Override
    public boolean isPasswordValid(String encPass, String rawPass, Object salt) throws DataAccessException {
        String calculatedPass = md5Hex(salt + rawPass);
        return calculatedPass.equals(encPass);
    }
 
    private String md5Hex(String data) {
        MessageDigest digest;
        try {
            digest = MessageDigest.getInstance("MD5");
        } catch (NoSuchAlgorithmException e) {
            throw new IllegalStateException("No MD5 algorithm available!");
        }

        return new String(Hex.encode(digest.digest(data.getBytes())));
    }
}

And now you can do Digest Authentication with encoded password in Spring Security!

First, please make sure you've already installed JDK on your Centos box. There are tons of tutorials on how to do that :). Now we will download and install Jetty, at the time of this writing, the latest version of Jetty is 7.4.5.v20110725. Every command listing below must be run as user root.

cd /opt
wget http://download.eclipse.org/jetty/stable-7/dist/jetty-distribution-7.4.5.v20110725.tar.gz
tar xzvf jetty-distribution-7.4.5.v20110725.tar.gz
ln -s jetty-distribution-7.4.5.v20110725 jetty

OK, we've just installed Jetty to /opt/jetty. Now we will setup Jetty to run on startup

cd /etc/init.d
ln -s /opt/jetty/bin/jetty.sh jetty
chkconfig --add jetty
chkconfig --level 345 jetty on

It's a good practice to run Jetty as a non-root user, let's create a normal user called jetty

useradd -m jetty
chown -R jetty:jetty /opt/jetty

Now edit the startup script of Jetty located at /opt/jetty/bin/jetty.sh to include the following lines at the beginning (right after a bulk of commented lines describing various variables for Jetty)

JAVA_HOME=/opt/java
JAVA=$JAVA_HOME/bin/java
JAVA_OPTIONS=" -server -Xms256m -Xmx1024m -XX:+DisableExplicitGC "
JETTY_HOME=/opt/jetty
JETTY_USER=jetty
JETTY_PORT=7070
JETTY_HOST=0.0.0.0 # If you don't set this to 0.0.0.0, jetty only listen on localhost
JETTY_LOGS=/opt/jetty/logs/

Now start up it:

service jetty start

Open your browser and navigate to http://:7070/ Hope this help!

I've maintained the ibus-unikey package in Arch User Repository (AUR) for a while and suddenly my package disappeared. While I was wondering what happened to my package, I received an email from a Trusted User (TU) of Arch saying that my package had been moved to the community repo of Arch. Kudo to the ibus-unikey team for such a great piece of software which are so useful for Vietnamese Arch Users!

A quick and dirty way to do this is using a built-in authentication mechanism of Tomcat (I'm using Tomcat 6.x).

 
  EntireApp
  /*
  GET
  POST
 
 
  client
 


  client



 BASIC

If you use Spring Security, remember to remove Spring Security filter in the web.xml file. Now in your context file (the context.xml file in your META-INF of your web archive or in ther conf/Catalina/localhost/ context file), adding the following:

Finally, edit the tomcat-users.xml (usually located at /conf/tomcat-users.xml) to include all the roles you've specified in the security constraint of you web application, my tomcat-users.xml looks like this (yours may be different):

Now, every time the clients access the demo site, the browser will pop up a dialog asking for username and password. After successfully authenticated, the clients will use the demo site as normal.
This authentication mechanism is the Basic access authentication. As the title said, this is a quick and dirty way to secure a web application on Tomcat 6.
Hope this saves you some time.

I've just come across a Grails plugin called PrettyTime and I find it's really interesting library. Basically, it's utility library to format Date/Time value in a human-friendly form (eg: "right now", "two days ago", "3 months from now"...), it also supports localization for many languages but Vietnamese. So I decide to write a small resource bundle class for it.

package com.ocpsoft.pretty.time.i18n;

import java.util.ListResourceBundle;

public class Resources_vi extends ListResourceBundle
{
   private static final Object[][] OBJECTS = new Object[][] {
   { "CenturyPattern", "%n %u" },
   { "CenturyFuturePrefix", "" },
   { "CenturyFutureSuffix", " sau" },
   { "CenturyPastPrefix", "cách đây " },
   { "CenturyPastSuffix", "" },
   { "CenturyName", "thế kỷ" },
   { "CenturyPluralName", "thế kỷ" },
   { "DayPattern", "%n %u" },
   { "DayFuturePrefix", "" },
   { "DayFutureSuffix", " sau" },
   { "DayPastPrefix", "cách đây " },
   { "DayPastSuffix", "" },
   { "DayName", "ngày" },
   { "DayPluralName", "ngày" },
   { "DecadePattern", "%n %u" },
   { "DecadeFuturePrefix", "" },
   { "DecadeFutureSuffix", " sau" },
   { "DecadePastPrefix", "cách đây " },
   { "DecadePastSuffix", "" },
   { "DecadeName", "thập kỷ" },
   { "DecadePluralName", "thập kỷ" },
   { "HourPattern", "%n %u" },
   { "HourFuturePrefix", "" },
   { "HourFutureSuffix", " sau" },
   { "HourPastPrefix", "cách đây " },
   { "HourPastSuffix", "" },
   { "HourName", "giờ" },
   { "HourPluralName", "giờ" },
   { "JustNowPattern", "%u" },
   { "JustNowFuturePrefix", "" },
   { "JustNowFutureSuffix", " khắc sau" },
   { "JustNowPastPrefix", "cách đây " },
   { "JustNowPastSuffix", " khắc" },
   { "JustNowName", "" },
   { "JustNowPluralName", "" },
   { "MillenniumPattern", "%n %u" },
   { "MillenniumFuturePrefix", "" },
   { "MillenniumFutureSuffix", " sau" },
   { "MillenniumPastPrefix", "cách đây " },
   { "MillenniumPastSuffix", "" },
   { "MillenniumName", "thiên niên kỷ" },
   { "MillenniumPluralName", "thiên niên kỷ" },
   { "MillisecondPattern", "%n %u" },
   { "MillisecondFuturePrefix", "" },
   { "MillisecondFutureSuffix", " sau" },
   { "MillisecondPastPrefix", "cách đây " },
   { "MillisecondPastSuffix", "" },
   { "MillisecondName", "mili giây" },
   { "MillisecondPluralName", "mili giây" },
   { "MinutePattern", "%n %u" },
   { "MinuteFuturePrefix", "" },
   { "MinuteFutureSuffix", " sau" },
   { "MinutePastPrefix", "cách đây " },
   { "MinutePastSuffix", "" },
   { "MinuteName", "phút" },
   { "MinutePluralName", "phút" },
   { "MonthPattern", "%n %u" },
   { "MonthFuturePrefix", "" },
   { "MonthFutureSuffix", " sau" },
   { "MonthPastPrefix", "cách đây " },
   { "MonthPastSuffix", "" },
   { "MonthName", "tháng" },
   { "MonthPluralName", "tháng" },
   { "SecondPattern", "%n %u" },
   { "SecondFuturePrefix", "" },
   { "SecondFutureSuffix", " sau" },
   { "SecondPastPrefix", "cách đây " },
   { "SecondPastSuffix", "" },
   { "SecondName", "giây" },
   { "SecondPluralName", "giây" },
   { "WeekPattern", "%n %u" },
   { "WeekFuturePrefix", "" },
   { "WeekFutureSuffix", " sau" },
   { "WeekPastPrefix", "cách đây " },
   { "WeekPastSuffix", "" },
   { "WeekName", "tuần" },
   { "WeekPluralName", "tuần" },
   { "YearPattern", "%n %u" },
   { "YearFuturePrefix", "" },
   { "YearFutureSuffix", " sau" },
   { "YearPastPrefix", "cách đay " },
   { "YearPastSuffix", "" },
   { "YearName", "năm" },
   { "YearPluralName", "năm" },
   { "AbstractTimeUnitPattern", "" },
   { "AbstractTimeUnitFuturePrefix", "" },
   { "AbstractTimeUnitFutureSuffix", "" },
   { "AbstractTimeUnitPastPrefix", "" },
   { "AbstractTimeUnitPastSuffix", "" },
   { "AbstractTimeUnitName", "" },
   { "AbstractTimeUnitPluralName", "" } };

   @Override
   public Object[][] getContents()
   {
       return OBJECTS;
   }
}

Hopefully they will integrate this snippet into the next release of PrettyTime.

A couple months ago, I moved my blog from Blogger to Wordpress, that's because Wordpress offers some nice themes. Recently, I've bought a new domain (my first domain actually) and I want to use that domain for my blog but it costs me 10$/year to use custom domain in Wordpress! Searching around and I found that Blogger let you use your custom domain for free with hassle-free setup. Horay!
Then I moved back to Blogger, but the problem arises, the ugly theme! I think it's the right time for me to learn CSS and start hacking Blogger API. And after 2 weeks of hard working, I've finished my custom theme for Blogger based on Natural Power theme for Wordpress.
I'm quite happy with the result I've got so far. Not too bad for a CSS newbie.
From the normal user perspective, Wordpress provides many useful functionality out of the box, but if flexibility is your top priority, Blogger is your best choice so far.