Signed Java Applets

Hey, welcome back with a new blog !! today I am talking about both Java and web, more clearly Java Applets

Let us see the problem. Days ago, I was developing a Java Applet that capture a snapshot for Desktop and send it to Flash movie embedded in the same HTML page to provide Desktop Sharing (viewing share not remote access) facility for our web application. I finished developing the applet on Eclipse IDE and it was running well. When embedding it in HTML page, it gave java.security.AccessControlException: access denied (java.awt.AWTPermission createRobot)
(as I used AWT package to capture the screen). So, what is the problem ?!!

I surfed the net for such problem and it was the first time to deal with Java security policy. This policy resides in java.policy file located at $JAVA_HOME\jre\lib\security. Problem is that Applets, unlike Applications, are not trusted by default by Java security policy. It is restricted for some operations like accessing the local file system, asking for socket connection,... etc. The solution is what called Signed Java Applet.

Before completing with Java Signed Applet, let us see why the applet run on Eclipse IDE the first time. When running the applet in Applet Viewer through Eclipse, Eclipse generates a policy file in the folder contains this applet called java.policy.applet and associate it with the applet. The content of the file (for my applet) was as following:

/* AUTOMATICALLY GENERATED ON Tue Apr 16 17:20:59 EDT 2002*/
/* DO NOT EDIT */

grant {
permission java.security.AllPermission;
};

It is clear that it allows the developer applet to do everything assuming that developers (which use Eclipse IDE) are mature enough to take care about disasters may harm their local computers. So everything is running on Applet Viewer.

Java Signed Applet is an applet associated with a digital certificate. Digital certificates are authored by trustworthy authorities. Signing an Applet needs to get a certificate from one of these authorities, which is most of time costs money for sure, so users can trust your applet and give it permission to do its operation. Digital certificate contains the holder party(which is you in this case) besides the certificate authority (e.g. Sun MicroSystems). No specific authorities monopoly giving certificates, but companies have good reputation or something like that can give this certificate. You can create your own certificate for developing and testing issues.

After singing the applet, browser will pop up a dialog to users when the applet is loading displaying the digital certificate associated with the applet and let the user permit the applet to be authorized on his computer or reject the certificate which let the applet behave like unsigned one.

We may talk about digital certificates in details later; but at a glance, it depends on public key encryption algorithms (e.g. RSA algorithm, click here to read more about RSA) that generates a pair of public and private keys and use this to verify the validity of the certificate within its expiration period.

Now, let us see how to sign our applets with our own digital certificate for development purposes:

1. Create your code for the applet as usual.
It is not necessary to set any permissions or use security managers in
the code.

2. Install JDK 1.5
Path for use of the following commands: $JAVA_HOME\bin
(commands are keytool, jarsigner)
Password for the keystore is any password.

3. Generate key:
keytool -genkey -keyalg rsa -alias tstkey
Enter keystore password: ******* (any password)
What is your first and last name?
[Unknown]: Your Name
What is the name of your organizational unit?
[Unknown]: YourUnit
What is the name of your organization?
[Unknown]: YourOrg
What is the name of your City or Locality?
[Unknown]: YourCity
What is the name of your State or Province?
[Unknown]: YS
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=Your Name, OU=YourUnit, O=YourOrg, L=YourCity, ST=YS, C=US
correct?
[no]: yes

(wait...)

Enter key password for tstkey
(RETURN if same as keystore password):

(press [enter])

4. Export key: keytool -export -alias tstkey -file tstcert.crt

Enter keystore password: *******
Certificate stored in file tstcert.crt

5. Encapsulate your applet in a JAR file (click here to read how to create JAR files).

6. Sign JAR:
jarsigner signedApplet.jar tstkey
Enter Passphrase for keystore: *******

8. Verifiy Signing: jarsigner -verify -verbose -certs signedApplet.jar

130 Thu Feb 12 13:04:12 GMT+02:00 2008 META-INF/MANIFEST.MF
183 Thu Feb 12 13:04:12 GMT+02:00 2008 META-INF/TSTKEY.SF
920 Thu Feb 12 13:04:12 GMT+02:00 2008 META-INF/TSTKEY.RSA
Thu Feb 12 12:58:28 GMT+02:00 2008 META-INF/
smk 849 Thu Feb 12 12:49:04 GMT+02:00 2008 SignedApplet.class

X.509, CN=Your Name, OU=YourUnit, O=YourOrg, L=YourCity, ST=YS, C=US
(tstkey)

s = signature was verified
m = entry is listed in manifest
k = at least one certificate was found in keystore
i = at least one certificate was found in identity scope

jar verified.

9. Create HTML file for use of the Applet using tag

<"applet" code="SignedApplet.class" width=100 height=140 archive="signedApplet.jar">"</"applet">

where signedApplet.jar reside next to HTML file and SignedApplet.class encapsulated in it.


10. Run HTML page and test your applet.

I tested it on my PC using JDK 1.5 Update 8 to sign the applet and take the applet on my laptop and run well.

I hope this helps.

Accessing EJBs 2.0 in ORACLE JDeveloper 10.1.3.3.0

After creating your EJBs in JDeveloper 10.1.3.3.0, you need to use it to invoke your business logic in case of Session Beans or query the database in case of Entity Beans. Creation itself if somehow easy, we can take a quick overview about:
*select project you want EJBs , from menu File-->New-->Business Tier-->EJB
*Choose type of bean you need and follow wizard to complete creating your bean

Accessing EJB need to lookup it through JNDI APIs like following:

try{
Context c;
c = new InitialContext();
tstSessionEJBLocalHome creator = (tstSessionEJBLocalHome)c.lookup("localRefName");
tstSessionEJBLocal bean;
bean = creator.create();
result = bean.businessMethod1(parameter_list);
}
catch(NamingException ne){
result = "Naming Error";
}
catch(CreateException ce){
result = "Creation Error";
}

sure the above code will differ when you access the remote interface of the bean, but the key point here if JNDI name "localRefName" which we need to lookup the bean.

By default, you can use tstSessionEJB in the deployment descriptor ejb-jar.xml to lookup for remote home interface of Session Bean.

Generally speaking you need to add ejb-ref for looking up remote bean and ejb-local-ref for looking up local bean. This reference should be added in scope you need to call EJB within it.

May be the above words are so vague, I think following examples will be more OK.

Example1:
If you need to call local Entity Bean from a Session Bean, you need to add ejb-local-ref to the desired Entity Bean in EJB deployment descriptor scope inside this Session Bean tag like following



and then a method private EmployeeLocalHome getEmployeeLocalHome(); will be auto-generated by JDeveloper which you can use to call Entity Bean you need. Note that auto-generation of the method will occur if you use the wizard like described below.

Example2:
If you need to call remote Session Bean from a Servlet, you need to add ejb-ref in web.xml which is the scope of the site (scope serlvets work on) like following:



Now you can use ejb-ref-name to lookup EJB through JNDI APIs mentioned above.

Finally we want to know how to create these ejb-ref tags. If you need to add an ejb-ref to a called Bean in an existing caller Bean:
- double click the caller bean in the left handed Application Navigator of JDeveloper
- choose from the left handed bar "EJB References" or "EJB Local References" according what you need to call
- click Add button in the right and fill called bean info you asked for then OK

in case you need to add an ejb-ref to web.xml:
- Open web.xml
- Drag and Drop from right handed "Component Palette" ejb-ref or ejb-local-ref according bean you need to call
- fill called bean info you asked for then OK

Also you can use generated generated ejb-ref-name to lookup for bean you want.

Hope this helps

JAR Files

JAR file (or Java ARchive) is a ZIP file used to distribute a set of Java classes. It is used to store compiled Java classes and associated metadata that can constitute a program.

__________________________________________________________

How to Create JAR file :

*Traditional method:

check Sun Microsystems site http://java.sun.com/docs/books/tutorial/deployment/jar/build.html

*Quick Method:

1- put all your .class files and packages next to a folder named "META-INF" containing a file named "MANIFEST.MF"

2- open "MANIFEST.MF" using any text editor

3- write in "MANIFEST.MF" file

Manifest-Version: 1.0
Main-Class: MainClass

where MainClass is your main class

4- add your .class files and this folder to a ZIP archive ( not .RAR ) using WinRAR or any other program

5-change the extension of resulting file to .jar

*Preferred Method for me:
Generate it using IDE you use
In Eclipse 3.2, follow
File -> Export -> Java -> Jar File
and continue with the wizard specifying your main class and exported classes

_________________________________________________________________________

How to run a jar file:

*In case you have JDK 1.5 Updat 8 or above:

double click on JAR file or use the fllowing method.

*In case of older versions of JDK :

1- create a batch file ( you can create a text file and change its extension to .bat)

2- wirte in batch file "java -jar file.jar" to execute file.jar archive

3- double click on batch file

For more about JAR files, check

http://java.sun.com/j2se/1.3/docs/guide/jar/index.html