Java Identity JSR: A positive step

The latest JSR on Java Identity is a very positive step in fostering security in Java applications. Since the JSR targets Java SE (as well as Java EE), it will have a very beneficial impact on Java applications running within the VM. You do not require a Java EE application server to avail the Identity services. A presentation on the JSR, given by the spec lead, Ron Monzillo is available at https://oracleus.wingateweb.com/published/oracleus2011/sessions/25171/S25171_139221.pdf A complaint I often hear from Java developers is the lack of consistent, standard API/annotations that they can use for securing their applications. JSR 351 aims to provide the necessary API as well as annotations. This should have happened long ago, but at least now, there is a positive attempt in the direction. I fervently hope that all the framework developers pay attention to this JSR (and not fall prey to the NIH syndrome). With the proliferation of Identity standards and the lack of coherence among them, it has become very hard for application writers to grasp the concepts of security. They usually take the easy way out (a simple password based system). I wish the JSR committee all the success. I am planning to be on the committee. You are welcome to participate. The proposed reference implementation is going to under the Apache 2.0 license and the tck will be free of charge. [Slide 10]

JavaOne11 Experiences :: JBoss AS7/PicketLink/SAML/OpenShift

I had the privilege of attending Java One in San Francisco this month. I had two talks this year.

Talks:
1) Venue: JBoss Booth. Title: Trusted Security with PicketBox and PicketLink
2) Venue: Regular Session. Title: Experiences with Java EE Paas

In my view, this was a great conference for me. I had the opportunities to show case the SAML based SSO on web applications running on top of JBoss AS7 in the Red Hat's OpenShift Paas environment.

I also showcased Facebook/Google login to web apps running on JBoss AS7 deployed in OpenShift environment.

As part of my sessions, I created the following cheatsheet.

http://community.jboss.org/wiki/CheatSheetForPicketLinkOnRedHatOpenShift/

You should definitely give OpenShift a try. :)

Tribute to Steve Jobs:
Scott Stark and I had just finished making our presentation at Java One. I got an alert from Associated Press on my iPhone: "According to Apple, Steve Jobs has died". It was a shock to me. I showed the alert to Scott who was in the middle of answering offline questions from attendees and he was shocked too. Around 5:40pm. :(

Deploy Java Applications In The Cloud

A couple of years ago, I had played with Google App Engine. I liked the ease of deployment via eclipse and the fact that I could code in Java and deploy a web app. Then it hit me. All the restrictions and JVM API blacklist was tiring. You had to modify your libraries or applications to tailor to GAE restrictions.

Another potential solution is Heroku. It is popular. But the latest post from Adam announcing Java support is filled with hatred for Java EE. I am unsure how they are going to provide support for Transactions, Security etc (without custom coding) as that is provided by Java EE. Rich Sharples does a good job at dissecting the post.

Coming back to my topic of deploying Java Applications in the cloud, I have been quite excited to try out Red Hat's PAAS offering, the OpenShift. A user can now deploy Java EE 6 applications in the cloud. OpenShift will only get better over time. The dream of running your Java EE applications in the cloud is a reality. Hopefully Java developers will embrace OpenShift. They get access to JBoss AS7 instance to host their apps. Now that's progress in the cloud.

Thank you OpenShift.

Reference:

How to videos for OpenShift.