proghowto

Move a Private Key Between Two JKS Keystores

admin — Thu, 12 Jan 2012 15:15:31 +0000

The previous version of the article showed how to move a private key between two JKS key stores.

The solution consisted in writing a Java program that would use the KeyStore class to retrieve the key from a JKS keystore and store it in another one. The destination keystore would be completely rewritten.

With the tool keytool bundled with JDK versions 1.5 and newer, the process is possible without writing any program. The -importkeystore command line parameter of the new keytool does just this. Please see the keytool documentation for more information.

Here is the part of the keytool help presenting in detail all the parameters for importkeystore:

-importkeystore [-v] [-srckeystore ] [-destkeystore ] [-srcstoretype ] [-deststoretype ] [-srcstorepass ] [-deststorepass ] [-srcprotected] [-destprotected] [-srcprovidername ] [-destprovidername ] [-srcalias [-destalias ] [-srckeypass ] [-destkeypass ]] [-noprompt] [-providerclass [-providerarg ]] ... [-providerpath ]

AXIS Client Request and Response Logging

admin — Fri, 30 Dec 2011 14:10:59 +0000

You have a Java application consuming a remote SOAP web service and you want to use AXIS 1.* framework. You want to see / log the raw SOAP request / response.

In a development or testing environment there are methods that don’t involve any configuration or code change for example a sniffer (if the TCP channel is not encrypted).

There are situations however when logging the soap requests and response/fault is needed in production on a continuous basis, usually for reconciliation purposes. In case of some integration issues, the party providing the service will want to see the actual SOAP messages.

The problem is solved by creating a custom handler and either register it programmatically, or use the client configuration file (WSDD).

I believe that adding a custom handler is not enough to justify attaching a client configuration file, therefore will show here the code related solution. BTW, the configuration oriented approach rather than the code based one reduces in my opinion the maintainability (you don’t see what happens by looking at the code, you cannot add breakpoints everywhere etc).

The steps are as follows:

Obtain the WSDL document. Copy it locally if you don’ t mind and refer to the local copy when generating the client, so that the project will build even if you are not connected to internet.
Generate the client by using org.apache.axis.tools.ant.wsdl.Wsdl2javaAntTask ant task
Compile the generated code then pack everything in a jar file for easy handling (“client.jar”)
Create a class implementing javax.xml.rpc.handler.GenericHandler
Register the class in the client

For testing purposes I found a test web service published on web that does some simple math calculation. The WSDL was from the url http://soaptest.parasoft.com/calculator.wsdl. The service endpoint is at the url http://ws1.parasoft.com/glue/calculator.

Although I don’t want to get in details about how to actually generate the classes, here is the build script I used:

I had issues generating the client, that were fixed by removing all the occurences of the attribute parameterOrder in the WSDL.

The port type used has the QName with the following parameters:

Namespace: http://www.parasoft.com/wsdl/calculator/
Name: ICalculator

The approach without the logging handler

Following is the code:

1    package com.proghowto.wsclient.test;
2    
3    import java.net.MalformedURLException;
4    import java.net.URL;
5    import java.rmi.RemoteException;
6    
7    import javax.xml.rpc.ServiceException;
8    
9    import com.parasoft.www.wsdl.calculator.CalculatorLocator;
10   import com.parasoft.www.wsdl.calculator.ICalculator;
11   
12   public class TestClient {
13       public static void main(String[] args) {
14           try {
15               new TestClient().start();
16           }
17           catch(Exception e){
18               e.printStackTrace();
19           }
20       }
21   
22       private void start() throws MalformedURLException, ServiceException, RemoteException {
23           // get the web service locator and then the service instance.
24           // The url of the endpoint is provided
25           CalculatorLocator locator = new CalculatorLocator();
26           ICalculator service = locator.getICalculator(new URL("http://ws1.parasoft.com/glue/calculator"));
27   
28           // we calculate the total between two float parameters
29           float x = 12.21f;
30           float y = 3.35f;
31   
32           // call the web service
33           float result = service.add(x, y);
34   
35           // and here is the result
36           print("x = " + x);
37           print("y = " + y);
38           print("res = " + result);
39       }
40   
41       private void print(Object current) {
42           System.out.println(current);
43       }
44   }
45

Now, assuming we created the class TestHandler that extends GenericHandler, this is how we write the actual client invocation:

void start() throws MalformedURLException, ServiceException, RemoteException {
28           CalculatorLocator locator = new CalculatorLocator();
29           HandlerRegistry handlerRegistry = locator.getHandlerRegistry();
30           QName qname = new QName("http://www.parasoft.com/wsdl/calculator/", "ICalculator");
31   
32           @SuppressWarnings("rawtypes")
33           List chain = handlerRegistry.getHandlerChain(qname);
34   
35           HandlerInfo info = new HandlerInfo();
36           info.setHandlerClass(TestHandler.class);
37   
38           chain.add(info);
39   
40           ICalculator service = locator.getICalculator(new URL("http://ws1.parasoft.com/glue/calculator"));
41   
42           float x = 12.21f;
43           float y = 3.35f;
44   
45           float result = service.add(x, y);
46   
47           print("x = " + x);
48           print("y = " + y);
49           print("res = " + result);
50       }

Please note the following:

The handler registry instance is retrieved from the locator
The handler list is filtered to retrieve only the ones associated to the port type in use. The port type is specified by the fully qualified QName (namespace and name).
The TestHandler class is registered by being wrapped in an instance of javax.xml.rpc.handler.HandlerInfo. A new instance of TestHandler is created every time a service call is placed through the indicated port type.

And now the handler class. Basically there are three methods we are interested in, handleFault, handleRequest, handleResponse. All three methods give the opportunity to change the message on the fly, nevertheless our purpose is to only log it.

Here is the full class. I used logging to stdout for testing purposes, in production will replace this with a call to log4j.

1    package com.proghowto.wsclient.test;
2    
3    import java.io.ByteArrayOutputStream;
4    
5    import javax.xml.namespace.QName;
6    import javax.xml.rpc.handler.GenericHandler;
7    import javax.xml.rpc.handler.MessageContext;
8    import javax.xml.rpc.handler.soap.SOAPMessageContext;
9    
10   public class TestHandler extends GenericHandler {
11   
12       private static final long serialVersionUID = -1088299597212448917L;
13       private String timeStamp;
14   
15       public TestHandler(){
16           timeStamp = Long.toString(System.currentTimeMillis());
17       }
18   
19       @Override
20       public QName[] getHeaders() {
21           return null;
22       }
23   
24       @Override
25       public boolean handleFault(MessageContext context) {
26           System.out.println(timeStamp + "_fault: " + getStringMessage(context));
27   
28           return super.handleFault(context);
29       }
30   
31       private String getStringMessage(MessageContext context){
32           String res = null;
33   
34           try {
35               SOAPMessageContext ctx = (SOAPMessageContext) context;
36   
37               ByteArrayOutputStream stream = new ByteArrayOutputStream();
38               ctx.getMessage().writeTo(stream);
39               byte[] items = stream.toByteArray();
40   
41               res = new String(items);
42           }
43           catch(Exception e){
44               // nothing - just ensuring the method will not throw an exception in case something is wrong.
45           }
46   
47           return res;
48       }
49   
50       @Override
51       public boolean handleRequest(MessageContext context) {
52           System.out.println(timeStamp + "_request: " + getStringMessage(context));
53   
54           return super.handleRequest(context);
55       }
56   
57       @Override
58       public boolean handleResponse(MessageContext context) {
59           System.out.println(timeStamp + "_response: " + getStringMessage(context));
60   
61           return super.handleResponse(context);
62       }
63   
64   }
65

Here are a logged request and response (for readability I added some new lines, however normally they were on one line both of them)

Request

1325213680787_request: 


12.213.35

Response

1325213680787_response: 


15.559999

Final notes

Log one artifact on one line only

You want to ensure that whatever you log (request, response, fault) will be logged on one line only, or else, in a multithreaded environment it will be difficult to tell the lines from a transaction from the ones from another transaction. Search for any end of line in the logged result and change it to something else, like \N or similar.

Pair the transaction artifacts

Usually for one transaction there are two items logged, either the request and the response, or the request and the fault. You need a reliable method to pair the two artifacts.

A solution: for each transaction, a new instance of the handler (here TestHandler) is created. I created a class attribute that is initialized with some unique value in the class constructor and then ensured this is logged together with the request, response or fault. In our case, for simplicity, I chose system timestamp as the attribute value, however in production you should go for something really unique, like a random guid generator – one can be found here

Iptables redirect port 80 to port 8080

admin — Fri, 25 Nov 2011 19:01:07 +0000

The problem:

You have a linux server
Install tomcat or any other application server
You don’t want the application server to run as root, therefore it cannot listen to any of the ports 80 (http) or 443 (https)
From outside, though, the application server must be accessible on ports 80 / 443

The most popular approach:

Create an ordinary user specificaly for the application server (ex: tomcat)
Configure it to listen to a port bigger than 1024 – actually Tomcat comes by default configured to 8080 instead of 80 and 8443 instead of 443
Redirect the incoming connections from port 80 to 8080

The redirection is done by using the following iptables commands issued in sequence. The first one will configure the machine to accept incoming connections to port 80, the second does the same for port 8080 and the third one will do the actual rerouting. Please proceed in a similar manner for ports 443 forwarded to 8443

iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j ACCEPT
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

One thing: iptables command is reserved for the root user. For any other user, the command will not be recognized. Please ensure you are root when trying to update the routing tables, also double check each command before submitting it as the impact is high.

Failed to load java type corresponding to e=web-app@http://java.sun.com/xml/ns/javaee

admin — Mon, 16 May 2011 16:55:44 +0000

Working with various versions of Weblogic application server, you might have encountered the error partially described in the title. The error would not appear during the build but during deployment. A more complete stack trace of this error is presented below:

com.bea.xml.XmlException: failed to load java type corresponding to e=web-app@http://java.sun.com/xml/ns/javaee
        at com.bea.staxb.runtime.internal.UnmarshalResult.getPojoBindingType(UnmarshalResult.java:325)
        at com.bea.staxb.runtime.internal.UnmarshalResult.determineTypeForGlobalElement(UnmarshalResult.java:292)
        at com.bea.staxb.runtime.internal.UnmarshalResult.determineTypeForGlobalElement(UnmarshalResult.java:302)
        at com.bea.staxb.runtime.internal.UnmarshalResult.determineRootType(UnmarshalResult.java:283)
        at com.bea.staxb.runtime.internal.UnmarshalResult.unmarshalDocument(UnmarshalResult.java:153)
        at com.bea.staxb.runtime.internal.UnmarshallerImpl.unmarshal(UnmarshallerImpl.java:65)
        at weblogic.descriptor.internal.MarshallerFactory$1.createDescriptor(MarshallerFactory.java:136)
        at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:280)
        at weblogic.descriptor.DescriptorManager.createDescriptor(DescriptorManager.java:248)
        at weblogic.application.descriptor.AbstractDescriptorLoader2.getDescriptorBeanFromReader(AbstractDescriptorLoader2.java:749)
        at weblogic.application.descriptor.AbstractDescriptorLoader2.createDescriptorBean(AbstractDescriptorLoader2.java:378)
        at weblogic.application.descriptor.AbstractDescriptorLoader2.loadDescriptorBeanWithoutPlan(AbstractDescriptorLoader2.java:720)
        at weblogic.application.descriptor.AbstractDescriptorLoader2.loadDescriptorBean(AbstractDescriptorLoader2.java:729)
        at weblogic.servlet.internal.WebAppDescriptor.getWebAppBean(WebAppDescriptor.java:134)
        at weblogic.servlet.internal.WebAppModule.loadDescriptor(WebAppModule.java:775)
        at weblogic.servlet.internal.WebAppModule.prepare(WebAppModule.java:272)
        at weblogic.application.internal.flow.ScopedModuleDriver.prepare(ScopedModuleDriver.java:176)
        at weblogic.application.internal.flow.ModuleListenerInvoker.prepare(ModuleListenerInvoker.java:93)

This was very strange at first. It seemed that the DTD currently mentioned in the web.xml file corresponding to a web module was not correct. The problem was that the project had worked before, with the same Weblogic version.

Trying to remove the DTD definition and actually make the web.xml compliant with the latest standards (xml schema, qualify the elements with the adequate namespaces) did not fix the problem. I would not have gone with such a solution anyway, as the project works for at least one year in the current configuration.

Eventually I found the issue: The build was done pointing to the wrong Weblogic version (used the weblogic.jar from 10.3 instead of 9.2) No code changes were actually necessary to fix the problem just a rebuild while pointing to the right library repository.

No issue was signaled during the build and I am sure that I could have deployed it on weblogic 10 without any issues, however on Weblogic 9 did not work.

As soon as the build was correctly executed, the problem disappeared. So if you experience the same behavior, first ensure your build runs with the adequate parameters and most important Weblogic libraries and only afterwards start applying code changes.

Configure Postfix

admin — Fri, 11 Mar 2011 15:45:29 +0000

Postfix is one of the most popular MTA (mail transfer agent) products on unix. This article presents a simple way of configuring postfix for virtual domains

Postfix is a complext product. Most likely a normal administrator will never need all the features. In fact the product is so complex it took a book to explain it all – http://www.amazon.com/Postfix-Definitive-Kyle-Dent-D/dp/0596002122/ref=sr_1_1?ie=UTF8&qid=1299778896&sr=8-1

We assume:

You got a machine and multiple domains hosted on it
The postfix on your machine receives email for all these domains
The domains are configured as virtual domains, each user has a folder configured and email is delivered in those folders

Installation

Postfix installation is simple: run your preferred package installer depending on your operating system distribution and postfix will be up and running in a matter of minutes

For a Debian linux system, the command apt-get install postfix as a root will get the module up and running in seconds

Details

Our machine is called vps20.info and we’ll install mail support for the following domains: vps20.info, vps100.info and vps12.info

The email we want delivered in sub-folders under the folder /usr/local/vmail

The user daniel@vps20.info will go to a specific folder. All the other mail will be delivered to the postmaster user associated with each domain (we will cofigure a postmaster user for each of the three domains)

We must ensure that no message relaying will be enabled. Only messages originating from the machine or messages that are sent to users belonging to the three domains are to be processed by our Postfix installation

In the end, we configure an external email address, let’s call it whatever@domainhere where the mail sent to daniel@vps20.info will be forwarded

Configuration Steps

folders

su as root and create the folder /usr/local/vmail This is the parent folder for all the subfolders where the mail will be delivered

Under the above mentioned folder, create one folder for each domain, let’s call the folders vps12.info, vps20.info and vps100.info.

Remember that for the vps20.info we will have two users, daniel and postmaster, and for the other two domains we will configure only one user for each, postmaster

For each one of the above mentioned users, we create a folder under the folder corresponding to the domain. Therefore we create folders daniel and postmaster under vps20.info folder, and postmaster folders under vps12.info and vps100.info

Now this is important: since you are root, change the owner and the group of the folders created at the previous step to postfix. The command
chown postfix:postfix _foldername_
will achieve this

For privacy, ensure that the folders are only accessible by postfix by the use of chmod command. In the end, the folders will have rwx rights for the owner (postfix user) and no other rights for the group and the “other” category

DNS

Your machine must be configured in DNS as being the recipient of the messages for the three domains. See where the domains are parked and modify the MX DNS entry for each of them to point to this machine. MX requires a fully qualified domain name, and not a machine IP address.

main.cf

/etc/postfix/main.cf is the Postfix main configuration file. We change the settings in the file to achieve the following:

Only mail originating from the machine will be relayed
Only incoming mail accepted and process is the one for the three domains
Any other messages or relay requests will be rejected.

Here is the listing of the main.cf

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

# Debian specific:  Specifying a file name will cause the first
# line of that file to be used as the name.  The Debian default
# is /etc/mailname.
#myorigin = /etc/mailname

smtpd_banner = $myhostname ESMTP $mail_name (Ubuntu)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

readme_directory = no

# TLS parameters
smtpd_tls_cert_file=/etc/ssl/certs/ssl-cert-snakeoil.pem
smtpd_tls_key_file=/etc/ssl/private/ssl-cert-snakeoil.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache

# See /usr/share/doc/postfix/TLS_README.gz in the postfix-doc package for
# information on enabling SSL in the smtp client.

myhostname = vps20.info
alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
myorigin = /etc/mailname
mydestination =
relayhost =
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all

mynetworks = 127.0.0.0/32
virtual_mailbox_domains = vps20.info vps100.info vps12.info
virtual_mailbox_maps = hash:/etc/postfix/virtual
virtual_mailbox_base = /usr/local/vmail
virtual_uid_maps = static:105
virtual_gid_maps = static:108
virtual_alias_maps = hash:/etc/postfix/alias

The entries are pretty standard, please note the following:

mynetworks – the list of networks that would get their messages relayed. The value ensures that only messages originating from the machine will be relayed
virtual_mailbox_domains – the list of domains that will get their messages processed. You can see all three domains listed here
virtual_mailbox_base – the parent of all the mailbox folders, previously created.
virtual_uid_maps and virtual_gid_maps – the user id and the group id of the postfix user. The posfix module runs as this user. It is very important the values are accurate. The uid can be taken from the /etc/passwd line that contains the definition of the postfix user, and the gid from the /etc/group line that contains the definition of the postfix group
virtual_mailbox_maps – a text file that contains the folder names associated with every domain.
virtual_alias_maps – a text file that contains email aliases

These are the current entries in our /etc/group and /etc/passwd files for the postfix user entry

The entry in /etc/group folder

postfix:x:108:

The entry in the /etc/passwd folder

postfix:x:105:108::/var/spool/postfix:/bin/false

Note about virtual and alias text files – the settings point to these text files, however postfix use them in a compiled form, alias.db and virtual.db.

The db file is obtained from the regular file, compiled with a special program called postmap. The command line postmap /etc/postfix/alias will compile the text file to /etc/postfix/alias.db. Same applies for the /etc/postifx/virtual file.

Upon restart, postfix checks these files. Always *.db files must be newer than the original files. That confirms they contain the lastest info. If they are older, then a warning message is seen in the postfix logs

virtual and virtual.db

/etc/postfix/virtual (and after compilation with postmap /etc/postfix/virtual.db) is a file containing information about how the virtual mail has to be delivered. Basically for each email address for a domain, a folder (relative path to the /usr/local/vmail folder) is specified

In our case, the virtual text file contains the following

daniel@vps20.info     vps20.info/daniel/
@vps20.info     vps20.info/postmaster/
@vps100.info    vps100.info/postmaster/
@vps12.info     vps12.info/postmaster/

Please note the following:

The construct @domain_name is to process all the email messages that were sent to addresses within this domain and were not already processed
I am not sure whether it is mandatory to define the full blown email addresses before the catch all @domain_name is used, however I believe it is a good practice to do so
In the above list, for the vps20.info domain, all the emails sent to daniel@vps20.info will be written to the folder vps20.info/daniel/ while any other messages for addresses within the vps10.info domain will be written to the catch all folder, vps20.info/postmaster/
It is mandatory to put a forward slash at the end of the folder definition, otherwise postifx will believe we want the messages to be written in a file, not a folder.

alias and alias.db

alias (actually /etc/postfix/alias) is a text file containing email aliases. If you want that the email messages sent to a certain email address to be forwarded to another address, then an entry in the alias file is needed

The destination address does not have to be within the domains serviced by the postfix installation – for example I use alias entries to forward some emails on my address at @gmail.com so you can really use any email address

This is an example of alias file

daniel@vps20.info       whatever@domainhere

Note: while virtual file must define every single address (or catch all address) for all the domains serviced by the postfix installation, alias file can be empty. However, even when it is empty, you still have to compile it to alias.db using postmap program, while alias.db must be always newer than the original alias file

Apache Web Services Security Using WSS4J

admin — Fri, 18 Feb 2011 19:16:57 +0000

This document presents a practical approach of how to use WSS4J to add simple security headers to both client and web service implemented with Axis 1.*

Adding security at the UsernameToken level for a web service means adding a specific request header with the user name and password, with the password either in clear or encrypted (digest)

WSS4J is implemented to permit adding security headers without changing the actual web service code.

Libraries

The current implementation uses the following libraries:

Axis web service implementation version 1.4 download
WSS4J implementation from Apache download
XML security implementation, also from Apache download

Client

The client uses the axis libraries, the client stub classes generated for the specific service and the libraries for WSS4J and XML security plus dependencies.

The WSS4J handler must be registered to the client handler chain in order to manipulate the SOAP request and get the security headers in place. The handler receives the user name (principal) directly from the client code through properties, and the password through a callback class.

The client stub classes are generated with WSDL2Java class from the service wsdl file.

This is the code for the client / without security added

package service.test.client;

import java.net.URL;

import javax.xml.rpc.holders.StringHolder;

import com.services.www.data.Item;
import com.services.www.data.holders.ParametersHolder;
import com.services.www.services.InfoServiceLocator;
import com.services.www.services.InfoServicePortType;

public class TestClient extends BaseClient {
	public static void main(String[] args){
		try {
			new TestClient().start();
		}
		catch(Exception e){
			e.printStackTrace();
		}
	}

	private void start() throws Exception {
		// get the locator
		InfoServiceLocator locator = new  InfoServiceLocator();

		URL address = new URL("http://localhost:8000/service/services/InfoService");
		InfoServicePortType service = locator.getInfoService(address);

		// get the service
		StringHolder statusCode = new StringHolder();
		StringHolder comments = new StringHolder();
		ParametersHolder parameters = new ParametersHolder();

		// call the operation
		service.getInformation("name here", "test id",
				new Item[]{
					new Item("id1", "name1", "comments1"),
					new Item("id2", "name2", "comments2")
				},
				statusCode, comments, parameters);

		// show the results (a collection of helper methods
		// a
		display("status", statusCode.value);
		display("comments", comments.value);

		display(parameters);
	}
}

The request as generated with this client looks like this



	
		
			name here
			test id
			
				
					id1
					name1
					comments1
				
				
					id2
					name2
					comments2

Now the only thing to do is to add the security. As mentioned, adding security headers is accomplished without changing the actual service code. The process involves registering and configuring a handler and providing a callback class implementation.

There are two ways of registering the handler, as a part of the client configuration file (.wsdd) or programatically. Most of the time the application already has a configuration file, there should not be any reason to maintain another one, therefore the only approach presented here is the programmatical one.

Here is the client code that includes the security. Please note the following: when adding the security handler programmatically, the Axis framework expects a class that implements javax.xml.rpc.handler.Handler. When the handler is defined through the wsdd configuration file, then a class implementing org.apache.axis.Handler is expected. If this is not followed, the error triggered is something stating that “the handler cannot be created”, however this is a wrap around a ClassCastException

WSS4J implementation provides two classes implementing org.apache.axis.Handler, WSDoAllReceiver and WSDoAllSender, and one implementing javax.xml.rpc.handler.Handler which is WSS4JHandler

Below is the code, please note the method addSecurityHeaders. The handler chain object is retrieved from the locator object and a new handler is added

package service.test.client;

import java.net.URL;
import java.util.List;
import java.util.TreeMap;

import javax.xml.namespace.QName;
import javax.xml.rpc.handler.HandlerInfo;
import javax.xml.rpc.handler.HandlerRegistry;
import javax.xml.rpc.holders.StringHolder;

import org.apache.ws.security.handler.WSS4JHandler;

import com.services.www.data.Item;
import com.services.www.data.holders.ParametersHolder;
import com.services.www.services.InfoServiceLocator;
import com.services.www.services.InfoServicePortType;

public class TestSecureClient extends BaseClient {
	public static void main(String[] args){
		try {
			new TestSecureClient().start();
		}
		catch(Exception e){
			e.printStackTrace();
		}
	}

	private void start() throws Exception {
		// get the locator
		InfoServiceLocator locator = new  InfoServiceLocator();

		URL address = new URL("http://localhost:8000/service/services/InfoService");
		InfoServicePortType service = locator.getInfoService(address);

		// register the security handler and provide the attributes

		// get the service
		StringHolder statusCode = new StringHolder();
		StringHolder comments = new StringHolder();
		ParametersHolder parameters = new ParametersHolder();

		// add security headers
		addSecurityHeaders(locator);

		// call the operation
		service.getInformation("name here", "test id",
				new Item[]{
					new Item("id1", "name1", "comments1"),
					new Item("id2", "name2", "comments2")
				},
				statusCode, comments, parameters);

		// show the results (a collection of helper methods
		// a
		display("status", statusCode.value);
		display("comments", comments.value);

		display(parameters);
	}

	private void addSecurityHeaders(InfoServiceLocator locator) {
		HandlerRegistry registry = locator.getHandlerRegistry();
		QName portName = new QName("http://www.services.com/services", "InfoService");

		List chain = registry.getHandlerChain(portName);

		// create the new handler info for the WSS4J handler
		HandlerInfo info = new HandlerInfo();
		info.setHandlerClass(WSS4JHandler.class);

		TreeMap tmap = new TreeMap();

		tmap.put("send.action", "UsernameToken");
		tmap.put("receive.action", "NoSecurity");

		tmap.put("passwordCallbackClass", "service.test.client.SecureCallback");
		tmap.put("deployment", "client");

		// tmap.put("passwordType", "PasswordText");
		tmap.put("passwordType", "PasswordDigest");

		// tmap.put("flow", "request");
		tmap.put("user", "testuser");

		info.setHandlerConfig(tmap);

		chain.add(info);
	}
}

A couple of things about parameters.

passwordType has the value PasswordDigest. This will encrypt the password sent in the request as it is visible below. If PasswordText was used instead, the security layer would have passed the password “in clear”.

send.action and receive.action – they confirm the type of security header request and in the response respectively. When one is present, the other is also mandatory. In our case, the request (send.action) will contain UsernameToken security header, the response will not contain anything. As receive.action is mandatory, will be added with the NoSecurity value. The two parameters can be replaced with action when both request and response must be treated the same way. In the current case this is not possible as the response will not contain any security header

What happens if action was used with UsernameToken: the handler would create a Security element in the header and expect one in the response. As the response does not contain any security header, then the client would trigger the error with the message WSS4JHandler: Request does not contain required Security header That is a lot misleading as the security header is missing from the response, not from the request.

After adding this functionality, the request will contain the security header as per standard, with the password encrypted.






testuser
SwZD8+A6Jk2stfubiJR5d0MO+mU=

bMN8g5OcJgz9QbCSw8ix5g==

2010-09-13T16:57:27.876Z

	




name here
test id


	id1
	name1
	comments1


	id2
	name2
	comments2

The callback defined under the property passwordCallbackClass is a Java class that implements javax.security.auth.callback.CallbackHandler. The only purpose of this class is to provide the password associated with a principal. How the callback is implemented provides full flexibility.

Following is the code associated with this callback. getPassword is a custom method implemented by the programmer that actually returns the password given the principal. As this is specific to each situation, we left it out of the document.

	public void handle(Callback[] callbacks) throws IOException, UnsupportedCallbackException {
		// given the user, provide the password that will be sent in the
		// security header (clear format or digest)
		// we assume the provided callback array is not null
		for(int count = 0; count < callbacks.length; count ++){
			Callback crt = callbacks[count];

			/* our callback must be of type WSPasswordCallback for the UsernameToken */
			if(crt instanceof WSPasswordCallback){
				WSPasswordCallback pc = (WSPasswordCallback) crt; 

				String user = pc.getIdentifier();

				// implement getPassword to actually provide
				// the correct password for the specified principal
				pc.setPassword(getPassword(user));
			}
		}
	}

Server

For the server side the security handler is configured in the server-config.wsdd file, the web service configuration file.

Below is the transport tag, after configuring the handler. Note the fact the handler must implement org.apache.axis.Handler and not javax.xml.rpc.handler.Handler

In the current example WSDoAllReceiver is used. The parameters define the type of security header, including the way the password must be processed (PasswordDigest).

The callback class defined is identical with the one used on the client.

The action is defined under the property action. It is applied to the request only anyway, as the configuration is part of the . That is the reason it is declared different than on the client side, when we needed to specifically define the action for request and response.

This concludes the current example. Please ensure the latest version of xml security is used

Faces Context not Found getResponseWriter Will Fail

admin — Fri, 18 Feb 2011 19:13:35 +0000

Did you get the error in the title? This is a very common occurrence in JSF (Java Server Faces) applications. It is easy to get and easy to get rid off, you just have to be careful.

Here is a full error stacktrace:

javax.faces.FacesException: Faces context not found. getResponseWriter will fail.
Check if the FacesServlet has been initialized at all in your web.xml
 configuration fileand if you are accessing your jsf-pages through the correct mapping.
E.g.: if your FacesServlet is mapped to  *.jsf (with the -element),
you need to access your pages as 'sample.jsf'.
If you tried to access 'sample.jsp', you'd get this error-message.
	Javax.faces.webapp.UIComponentTag.setupResponseWriter(UIComponentTag.java:926)
	javax.faces.webapp.UIComponentTag.doStartTag(UIComponentTag.java:313)
	org.apache.myfaces.taglib.core.ViewTag.doStartTag(ViewTag.java:73)
	org.apache.jsp.index_jsp._jspx_meth_f_005fview_005f0(index_jsp.java:92)
	org.apache.jsp.index_jsp._jspService(index_jsp.java:67)
	org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
	javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
	org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:377)
	org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
	org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
	javax.servlet.http.HttpServlet.service(HttpServlet.java:717)

Why it appears: well, that is simple. It occurs when the FacesContext object is not found in the session. This object must be already in the session before the first JSF tag is processed (usually a f:view tag). We will analyse the situations when this object is missing.

JSF functionality revolves around a special servlet, called FacesServlet. The servlet is defined in the web.xml file. It can be initialized using various patterns, some popular ones being *.jsf, *.faces or /faces/*. When the servlet is accessed, it ensures the FacesContext object exist in the session, if not will ensure it will be created.

Session Startup

When a brand new session is started, the FacesContext does not exist. If you access a page with JSF tags and the FacesContext does not exist, you get the error.

There are two situations:

The application context is accessed

The welcome page will be then loaded.
This page must be a resource existent in the war, probably a jsp page. If the page contains JSF tags, because the faces servlet was not invoked, you get the error

The solution for this: The landing page will contain ONLY a tag that forwards to an URL through the faces servlet (ex: forwards to first.jsf which will load first.jsp AFTER triggering the faces servlet)

A bookmark is accessed

The user bookmarked one of the pages inside the application. If the session is brand new and the bookmarks do not trigger the faces servlet, then the error gets displayed.

Solution: obviously the user bookmarked an internal application link. If the internal link would have triggered the faces servlet (being for example in the format *.jsf) then the error would not have appeared. It is obvious then that all the internal links should trigger the faces servlet – consistently use *.jsf internal links rather than *.jsp and the problem is solved.

Session Expired

This is a little bit different than the previous, with the same result as the situation in which a bookmark is used.

In this case, there was a valid session, the user spent some time operating the application then for some reason the session was left to expire.
Then the operator issues another application request. In this case, if there is some security implementation in place, the application must forward to the login page with an error message “session expired, please log back in”.
However the FacesContext also vanished and instead of the above mentioned flow, instead of seeing the login page together with the error message, we get to see the one related to the missing FacesContext object.
The solution is identical with the one above: all the internal links (and the forwards) must point to urls targeting the faces servlet. Always page.jsf, never page.jsp

Final Conclusion

FacesContext is required for the entire life of a JSF session
The welcome page should access the faces servlet – usually forwarding to an URL with the faces servlet URL pattern. This creates the faces context object if is not existent
All the other internal links should follow the faces servlet URL pattern. In this way Faces Context will be recreated if needed – especially if it is accidentally destroyed by a session expiration

ASP.NET Controls from Scratch

admin — Fri, 18 Feb 2011 19:09:11 +0000

In this article is presented a step by step approach to create a fully rendered ASP.NET custom control.

Custom controls are a very important part of ASP.NET. They provide a very high level of encapsulation and reusability. There are roughly three types of controls, as follows:

Web User Control – involving a resource with .ASCX extension
Composite control – a custom control embedding other ASP.NET controls
Custom control – the fully rendered control, with full control on state management and rendering

There are many advantages related to the fully rendered custom control (the third category) as follows:

Full control of all the aspects of the control lifecycle
Full control of the rendering process
The final result can be delivered as a simple library – assembly – unlike the web user control where the .ascx file is a required deliverable

Most of the professional grade custom controls are distributed as fully rendered controls

Create the Class

The custom control is a regular .NET class, extending System.Web.WebControl. To start our test, create a new ASP.NET project, then add a new item and select “ASP.NET Server Control”. I removed the existent Text property from the created class (we start from scratch, remember?) and there is the result:

   1:  using System;
   2:  using System.Collections.Generic;
   3:  using System.ComponentModel;
   4:  using System.Linq;
   5:  using System.Text;
   6:  using System.Web;
   7:  using System.Web.UI;
   8:  using System.Web.UI.WebControls;
   9:
  10:  namespace TestControl
  11:  {
  12:
  13:      [ToolboxData("<{0}:TestControl runat=server>")]
  14:      public class TestControl : WebControl
  15:      {
  16:          protected override void RenderContents(HtmlTextWriter output)
  17:          {
  18:              output.Write("test control here");
  19:          }
  20:      }
  21:  }

Now compile the project and open your main page in design mode. Automatically the IDE toolbox will contain your component ready to use. Get the control and drag it to your page, and you will see the output from the RenderContents method there.

Finish the componet state related design:

Decide what are the attributes that define the control state (names, types, cardinality)
Decide which attributes will be part of form controls (editable)
Decide the attributes that will have static values – these will be saved into the ViewState object
In the end, decide how the componet will be rendered and finish the rendering method

For our purpose, we will have three attributes, address (string), number (integer), and fullName (string). The first two will be static, the third one editable.

We go ahead and implement these attributes as part of our class (two string attributes, one integer)

   1:  using System;
   2:  using System.Collections.Generic;
   3:  using System.ComponentModel;
   4:  using System.Linq;
   5:  using System.Text;
   6:  using System.Web;
   7:  using System.Web.UI;
   8:  using System.Web.UI.WebControls;
   9:
  10:  namespace TestControl
  11:  {
  12:
  13:      [ToolboxData("<{0}:TestControl runat=server>")]
  14:      public class TestControl : WebControl
  15:      {
  16:          private string address;
  17:          private int number;
  18:
  19:          private string fullName;
  20:
  21:          public string Address
  22:          {
  23:              get { return address; }
  24:              set { address = value; }
  25:          }
  26:
  27:          public int Number
  28:          {
  29:              get { return number; }
  30:              set { number = value; }
  31:          }
  32:
  33:          public string FullName
  34:          {
  35:              get { return fullName; }
  36:              set { fullName = value; }
  37:          }
  38:          protected override void RenderContents(HtmlTextWriter output)
  39:          {
  40:              output.Write("test control here");
  41:          }
  42:      }
  43:  }

Add the following interfaces as part of the interface list implemented by the control: INamingContainer and IPostBackDataHandler

INamingContainer does not have any methods, however any container that implements this interface will receive an uniqe identifier from its parent.

IPostBackDataHandler is very important for processing the state attributes that are rendered in http form controls. Its method LoadPostData is invoked when the controller should load the postback values from the request

Override the methods LoadViewState and SaveViewState from the parent; they will be invoked when the information should be saved to or loaded from the ViewState object.

ViewState

A lot of people say that ViewState is a very bad thing, which is not true. ViewState is an amazing way of preserving the page state across requests. Sometimes it is used in a wrong way and that is the bad thing.

Rule of thumb: if the state of a component is restored anyway from the database or the session every time the page is loaded, then turn its EnableViewState off. Look at each component from this perspective and you will never have problems with ViewState

Don’t forget to call the base class methods LoadViewState and SaveViewState with the appropriate information. You will not see any difference if you just started from scratch and the superclass is WebControl, however if you plan a more complex class hierarchy, you will avoid potential issues.

All the code samples from the internet use constructs as follows in order to save / retrieve information from the ViewState:

 1:              ViewState["whatevername"] = FullName;

In this case, both the name (whatevername) and the value (FullName) will be saved in the view state field increasing the page size. This is a waste of traffic. You don’t need this, there is a better way:

Create an ArrayList object
Add the objects you want to save in the array list
One of the objects in the ArrayList must be the one returned by the super class SaveViewState method
This should be the object returned by the SaveViewState method
This will be the object passed to LoadViewState when this method will be invoked (ok, not the very same instance, but an identical one anyway)
Process the stored values in the same order (it is easy to check, the two methods are a couple of lines away)
You are done!

Here is our implementation. Note the fact that we process the object for the super class (don’t forget that) and also we process our attributes in the very same order.

   1:          protected override void LoadViewState(object current)
   2:          {
   3:              // here we know the object must be a
   4:              // ArrayList, as this is the object saved by
   5:              // SaveViewState method
   6:              if (current is ArrayList)
   7:              {
   8:                  ArrayList list = (ArrayList)current;
   9:
  10:                  // we assume the array list is of length 3 (as saved in
  11:                  // SaveViewState, we also know exactly what is at each index
  12:                  // we just need to double check the SaveViewState to
  13:                  // confirm
  14:                  object baseObject = list[0];
  15:                  base.LoadViewState(baseObject);
  16:
  17:                  object adr = list[1];
  18:                  object nr = list[2];
  19:                  object fname = list[3];
  20:
  21:                  Address = adr == null ? null : adr.ToString();
  22:                  Number = (nr == null ? 0 : (int)nr);
  23:                  FullName = fname == null ? null : fname.ToString();
  24:              }
  25:              else
  26:              {
  27:                  throw new Exception("Wrong object in the LoadViewState");
  28:              }
  29:          }
  30:
  31:          protected override object SaveViewState()
  32:          {
  33:              ArrayList list = new ArrayList();
  34:
  35:              // superclass
  36:              list.Add(base.SaveViewState());
  37:
  38:              list.Add(Address);
  39:              list.Add(Number);
  40:              list.Add(FullName);
  41:
  42:              return list;
  43:          }

Load the postback data from the request

This step consists in implementing the method LoadPostData from the IPostBackDataHandler interface. You know what names you attached to the form controls, basically just look for these names and attach the values to the variables.

In order for this method to be invoked, you need to have a http field part of your component with the name identical with the component UniqueID. This is very important. Normally this will be a hidden text field with some hardcoded value as we’re only interested in its presence. Don’t store an empty value in it, just put something.

Here is the implemented method

   1:          public bool LoadPostData(string postDataKey,
                      System.Collections.Specialized.NameValueCollection postCollection)
   2:          {
   3:              // load the values componenet by component; we only have one
   4:              string fname = postCollection[UniqueID + "_full"];
   5:
   6:              // see if the state has changed - in FullName we already
   7:              // have the value loaded from ViewState, which is the value
   8:              // kept by FullName on the previous page display
   9:              bool stateChanged = false;
  10:              if (FullName == null)
  11:              {
  12:                  stateChanged = fname != null;
  13:              }
  14:              else
  15:              {
  16:                  stateChanged = ! FullName.Equals(fname);
  17:              }
  18:
  19:              FullName = fname;
  20:
  21:              return stateChanged;
  22:          }

In order to see if the component state changed, you need to see if the previous and current values for the editable controls are the same. This can be achieved in the following way:

Save the editable attributes in ViewState as well
The ViewState will contain the “previous” attribute value
The postback data will contain the actual value
Check to see whether they are equal or not, this will determine the value returned by LoadPostData method.
After the evaluation, emember to store the postback data in the attribute, because this is the actual value

Rendering

Basically the method RenderContents will actually generate the html for the component, based on the component state.

Here is the code; spot the hidden field at the beginning of the rendered content:

   1:          protected override void RenderContents(HtmlTextWriter output)
   2:          {
   3:              StringBuilder buffer = new StringBuilder();
   4:
   5:              buffer.Append("");
   8:
   9:              buffer.Append("");
  10:              buffer.Append("");
  11:
  12:              buffer.Append("");
  15:
  16:              buffer.Append("");
  19:
  20:              buffer.Append("");
  25:
  26:              buffer.Append("Item Value
Address ");
  13:              buffer.Append(Address);
  14:              buffer.Append("
Number ");
  17:              buffer.Append(Number);
  18:              buffer.Append("
Full Name ");
  27:
  28:              output.Write(buffer.ToString());
  29:          }

Final code

Here is how the component looks like rendered; upon postback, the editable field and the two static attributes will hold their values

Here is the final code; if you don’t need to track the state change, you can stop saving the editable fields in the ViewState and remove the comparison done in the LoadPostData method; just override the attribute with the actual value.

   1:  using System;
   2:  using System.ComponentModel;
   3:  using System.Web.UI;
   4:  using System.Web.UI.WebControls;
   5:  using System.Collections;
   6:  using System.Text;
   7:
   8:  namespace TestControl
   9:  {
  10:
  11:      [ToolboxData("<{0}:TestControl runat=server>")]
  12:      public class TestControl : WebControl, INamingContainer, IPostBackDataHandler
  13:      {
  14:
  15:          private string address;
  16:          private int number;
  17:
  18:          private string fullName;
  19:
  20:          public string Address
  21:          {
  22:              get { return address; }
  23:              set { address = value; }
  24:          }
  25:
  26:          public int Number
  27:          {
  28:              get { return number; }
  29:              set { number = value; }
  30:          }
  31:
  32:          public string FullName
  33:          {
  34:              get { return fullName; }
  35:              set { fullName = value; }
  36:          }
  37:          protected override void RenderContents(HtmlTextWriter output)
  38:          {
  39:              StringBuilder buffer = new StringBuilder();
  40:
  41:              buffer.Append("");
  44:
  45:              buffer.Append("");
  46:              buffer.Append("");
  47:
  48:              buffer.Append("");
  51:
  52:              buffer.Append("");
  55:
  56:              buffer.Append("");
  61:
  62:              buffer.Append("Item Value
Address ");
  49:              buffer.Append(Address);
  50:              buffer.Append("
Number ");
  53:              buffer.Append(Number);
  54:              buffer.Append("
Full Name ");
  63:
  64:              output.Write(buffer.ToString());
  65:          }
  66:
  67:          public bool LoadPostData(string postDataKey,
        System.Collections.Specialized.NameValueCollection postCollection)
  68:          {
  69:              // load the values componenet by component; we only have one
  70:              string fname = postCollection[UniqueID + "_full"];
  71:
  72:              // see if the state has changed - in FullName we already
  73:              // have the value loaded from ViewState, which is the value
  74:              // kept by FullName on the previous page display
  75:              bool stateChanged = false;
  76:              if (FullName == null)
  77:              {
  78:                  stateChanged = fname != null;
  79:              }
  80:              else
  81:              {
  82:                  stateChanged = ! FullName.Equals(fname);
  83:              }
  84:
  85:              FullName = fname;
  86:
  87:              return stateChanged;
  88:          }
  89:
  90:          public void RaisePostDataChangedEvent()
  91:          {
  92:              // not implemented for the current example
  93:          }
  94:
  95:          protected override void LoadViewState(object current)
  96:          {
  97:              // here we know the object must be a
  98:              // ArrayList, as this is the object saved by
  99:              // SaveViewState method
 100:              if (current is ArrayList)
 101:              {
 102:                  ArrayList list = (ArrayList)current;
 103:
 104:                  // we assume the array list is of length 3 (as saved in
 105:                  // SaveViewState, we also know exactly what is at each index
 106:                  // we just need to double check the SaveViewState to
 107:                  // confirm
 108:                  object baseObject = list[0];
 109:                  base.LoadViewState(baseObject);
 110:
 111:                  object adr = list[1];
 112:                  object nr = list[2];
 113:                  object fname = list[3];
 114:
 115:                  Address = adr == null ? null : adr.ToString();
 116:                  Number = (nr == null ? 0 : (int)nr);
 117:                  FullName = fname == null ? null : fname.ToString();
 118:              }
 119:              else
 120:              {
 121:                  throw new Exception("Wrong object in the LoadViewState");
 122:              }
 123:          }
 124:
 125:          protected override object SaveViewState()
 126:          {
 127:              ArrayList list = new ArrayList();
 128:
 129:              // superclass
 130:              list.Add(base.SaveViewState());
 131:
 132:              list.Add(Address);
 133:              list.Add(Number);
 134:              list.Add(FullName);
 135:
 136:              return list;
 137:          }
 138:      }
 139:  }

Configure Apache, PHP and MySQL

admin — Fri, 18 Feb 2011 19:01:18 +0000

This is just another tutorial of how to configure a development machine for Apache, PHP and MySQL

There are packages bundling the three technologies (install the package and everything is there ready to go). They are good for start. However a serious developer should install the latest production bundles from scratch. Couple or reasons:

Have complete control of the process
Use the versions that you have or intend to have on the production machine
Learn how to configure everything. As a programmer, you eventually need to know that.

We are going to present the simplest approach to have all the three packages installed on your machine and have you up and running in the shortest time possible.

We assume you got a machine running Windows XP or 2000 or Vista, and you don’t have any of the required packages installed (if you tried to install them and it did not work, please start fresh).

Please install the packages in the order mentioned below. The reason: for example if you install PHP after you install Apache, then the PHP installation script will automatically integrate with Apache, saving you some time.

Please do not install in the default Windows Program Files folder. Instead, do it in a folder with a short name, directly under the root folder. We installed everything under a folder called c:\devweb

Install Apache

We recommend the use of a Windows msi installation kit. Please follow the installation steps:

Proceed to http://www.apache.org/
Follow the link “http server“
Then select “download from a mirror“
Download the installation kit for Apache 2.2 without Crypto. You don’t need SSL for a development machine at least not for this example
At the time of this writing, the file name we downloaded is: apache_2.2.11-win32-x86-no_ssl.msi

Now run the installation kit. Choose the installation folder under the c:\devweb as mentioned above. We chose: c:\devweb\apache2.2.11\

Install PHP

There are Windows installation kits .msi available for PHP as well. That means that the PHP installation is as simple as the one we just did for Apache http server.

Please follow the installation steps as follows:

Proceed to http://www.php.net/
Select the link under Stable Releases that points to the latest PHP version ready for production
Download and launch the installation kit
Select the folder where PHP will be installed; we chose C:\devweb\php\
When asked for which web server you require installation, please carefully select the web server that that will be used – as per the previous paragraph, we chose Apache 2.2
When asked, select the Apache subfolder where httpd.conf resides – in our case, c:\devweb\apache2.2.11\conf. The PHP installation kit will appropriately modify the Apache configuration file to point to the newly installed version
Select the extensions that are to be installed during the current process. Please consider that in this case less is more, and only select what you need. We selected only mysql and mysqli. If you need other extensions in the future, just run the PHP installation script again and add the required extensions (the current installation settings will not be affected)

The installation will then be completed. You are now ready to test it. Before doing so, please have a look at the file httpd.conf in the Apache configuration folder to see what are the changes operated during PHP installation. You will see the following lines added at the end:

#BEGIN PHP INSTALLER EDITS - REMOVE ONLY ON UNINSTALL
PHPIniDir "C:/devweb/php/"
LoadModule php5_module "C:/devweb/php/php5apache2_2.dll"
#END PHP INSTALLER EDITS - REMOVE ONLY ON UNINSTALL

Restart the Apache server using the Apache monitor (see the icon in the tray) or directly restart the corresponding Windows service using the management console

Rename the file index.html at the location c:\devweb\apache2.2.11\htdocs to index.php and open it for editing
Delete all the existent html and insert the following:

<html>
<head>
<title>Test functionality php</title>
</head>
<body>
<?php
  phpinfo();
?>
</body>
</html>

Access the index.php at the url http://localhost/index.php. You should show a lengthy table that contains all the PHP configuration information.
Please search for the extension names you mentioned at the PHP installation (we mentioned mysql and mysqli) and double check they are there.

At this moment you are done, and (almost) ready to start the development activity on your computer.

Install MySQL

We want a similar easy installation process for MySQL as well. Follow the steps:

Proceed to the address http://www.mysql.org
Click on “downloads”
Under the title MySQL Community Server, click on the “Download” button
Proceed with all the needed steps until you are in position to download the intallation kit. Under the Windows binaries, there are many options, please choose the msi insallation kit. At the time of this writing, the file we downloaded is mysql-5.1.34-win32.msi

Now you can proceed with the installation. There are many steps to follow, please run the installation kit and consider the following:

Don’t use “default configuration” or “default installation” as you will have to choose some of the settings different than the default ones
Install the MySQL under the same top folder as PHP and Apache. We installed ours in C:\devweb\mysql5.1
Choose it to run as a service. It is extremely convenient.
Choose a root password different than empty one (we chose the word “password”).
Just to be on the safe side, after the MySQL installation is done, please restart the Apache web server

Now we are in position to test the end to end installation. We already confirmed that Apache works nicely with our PHP installation, now we have to test that MySQL can be accessed from our PHP scripts

Edit again the file index.php under the folder c:\devweb\apache2.2.11\htdocs (the Apache default document root) and paste the script below. The script connects to the database using the root account you just created and lists the existent databases. Most likely this is the only time you will ever use this sql from a PHP page, however right now it will do the job by showing us we can access the database server from our PHP script.

prepare($sql);
	$statement->bind_result($val);
	$statement->execute();

	$items = array();
	while($statement->fetch()){
		$items[] = $val;
	}

	$html = "";
	$index = 0;
	foreach($items as $current){
		$index ++;
		$html .= "value at index:
			{$index} is:
			{$current} 
";
	}
?>


	Test database access

Now we are 100% done and ready to start the development. You have to update Apache configuration to have an alias for each project you work at, so that you will be able to work a couple of projects at a time without having to restart Apache every time, however this is just a detail, your main development environment is ready.

Item	Value
Address	"); 13: buffer.Append(Address); 14: buffer.Append("
Number	"); 17: buffer.Append(Number); 18: buffer.Append("
Full Name