raphael Bereh

Got it !
The mySQl SHA-1 return a Hex encoded byte array, so hex - encoding the bytes from MessageDisgester solves the issue.

Thanks .

Hi,
I am implementing a simple authentication module. I am using a mySQL Db where the user password is stored using one-way encryption SHA-1. The password is stored as a BLOB in the DB.
Then in my Java App I am trying to valide the user entered password against the password in the DB :
try { Class.forName("com.mysql.jdbc.Driver").newInstance(); Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/ac_test?user=root&password=") ; String sql = "SELECT userID,password FROM ac_user WHERE userID='raphael'"; Statement stmt = conn.createStatement(); ResultSet rs = stmt.executeQuery(sql); while(rs.next()) { String uName = rs.getString("userID"); Blob pass = rs.getBlob("password"); long a = pass.length(); //int b = a; System.out.println("length " + a); byte[] pwd = pass.getBytes(1,40); MessageDigest md = MessageDigest.getInstance("SHA-1"); assert md != null:"digest should not be null !"; byte[] pwd1 = md.digest("azarias20".getBytes()); System.out.println("UName " + uName); if(Arrays.equals(pwd,pwd1)) { System.out.println("Pass OK"); } else { System.out.println("Pass failed !"); } }

This code always fails and I don't know why. Please help

Thanks.

JAAS is another java API that deals with this kind of this. J2EE has support for JAAS . I think you can hook things like LDAP to JAAS.

Bill Venners: Is the value of patterns, then, that in the real world when I feel a particular kind of pain I'll be able to reach for a known solution?

Erich Gamma: This is definitely the way I'd recommend that people use patterns. Do not start immediately throwing patterns into a design, but use them as you go and understand more of the problem. Because of this I really like to use patterns after the fact, refactoring to patterns. One comment I saw in a news group just after patterns started to become more popular was someone claiming that in a particular program they tried to use all 23 GoF patterns. They said they had failed, because they were only able to use 20. They hoped the client would call them again to come back again so maybe they could squeeze in the other 3.

Trying to use all the patterns is a bad thing, because you will end up with synthetic designs�speculative designs that have flexibility that no one needs. These days software is too complex. We can't afford to speculate what else it should do. We need to really focus on what it needs. That's why I like refactoring to patterns. People should learn that when they have a particular kind of problem or code smell, as people call it these days, they can go to their patterns toolbox to find a solution.

How to Use Design Patterns,A Conversation with Erich Gamma ..

This article is very instructive about the use of patterns : Use them to solve a problem when refactoring your code.

So the best way to find the pattern to apply is knowing to problem you are facing. So what is the exact problem ?

Bill Venners: Is the value of patterns, then, that in the real world when I feel a particular kind of pain I'll be able to reach for a known solution?

Erich Gamma: This is definitely the way I'd recommend that people use patterns. Do not start immediately throwing patterns into a design, but use them as you go and understand more of the problem. Because of this I really like to use patterns after the fact, refactoring to patterns. One comment I saw in a news group just after patterns started to become more popular was someone claiming that in a particular program they tried to use all 23 GoF patterns. They said they had failed, because they were only able to use 20. They hoped the client would call them again to come back again so maybe they could squeeze in the other 3.

Trying to use all the patterns is a bad thing, because you will end up with synthetic designs�speculative designs that have flexibility that no one needs. These days software is too complex. We can't afford to speculate what else it should do. We need to really focus on what it needs. That's why I like refactoring to patterns. People should learn that when they have a particular kind of problem or code smell, as people call it these days, they can go to their patterns toolbox to find a solution.

How to Use Design Patterns,A Conversation with Erich Gamma ..

This article is very instructive about the use of patterns : Use them to solve a problem when refactoring your code.

So the best way to find the pattern to apply is knowing to problem you are facing. So what is the exact problem ?

Well you could see the apps as different modules and this in fact what they are. Each one was developped separatly to ease testing but now they need to go back together as explained earlier.

Hi,
Just a qyick question about the war file structure : Most of the time static ressources (jsp,html) are in the top level directory. Is that the only place they can be ? I mean I won to logically organise a set of applications into just one war file like
<pre> /root ( distribution menu) | /----------/---------------------/---------/ App1 App2 App3 WEB-INF </pre>
The problem is that I can refer to file in the root from any of the App and some of the resource like JDO metadata are not found either.
Thanks.
[ April 25, 2005: Message edited by: raphael Bereh ]

jsp: redirect ?

Ordered from Amazon UK since early June. Still waiting ..

A very good idea !
It will be good if it is open source.
I will participate if it is open source.

Just to elaborate on RMI and Threads .
RMI has support for multi-threading even if the RMI spec. does specify how this is implemented .

The Stubs are RMI/IIOP compatible objects, hence they have to be thread- safe, specially when they do handle state : this is the case with Statefull beans.

I think you are only taking the client side stub into account. But these client side stubs all 'talk' to one ( no ?) stub on the server side !: I think this is where you should be looking for concurrent access, not on the client side ! HF has great picture diagram for the communication (life cycle ) between client / server.

So consider the server side stub being accessed concurrently by multiple threads (this is where you get the Exception, so the scenario is well possible), if the stub is not thread safe, this could result in corruption of state. You know how to fix that kind of issue in J2SE ! But , in EJB ...
Well, no threads, let the container do that for you !

Would be interresting to see the implementation of the ejbObect ( as this is the container's responsibility), this might give us a big clue as to how the container enforces the thread-safety .

I think you need to have a look at RMI Objects and their support for threads !

Hi there,
I'm not an expert, but will try to give you a couple of answers :
Q 3 : Activation is about restoring the client conversational state (deserialisation ), so why would the container activate a bean just to kill it ? For instance , when a bean times out while passivated, it is removed without bean activated. I think the same apply here, to optimised the overhead of activating the bean.

Q4-Q1 : I don't think the container cares that much about the client. Instead the conatiner manages the Bean, and generally uses LRU algorithmes to see which bean has been inactive for a good while . The reason why the bean remainded inactive could be anything including client time-out. Eventually, you bean itself might time-out, and this is the configurable parameter on the container . see your server documentation on how to do that.

Q2 : The Handle is a serializable object. You could get the handle, serialise it to a file, transport you file to a different machine , deserialise it and use it to get a reference to the bean .

Any comments on my answers welcome.

I can't see you point !
A multithreaded client call a bean in each thread, then each thread get a different bean instance to run business methods on, no ? Note that statefull bean are kind of pooled as well : this is what happens when the bean is passivated/ativated, the bean instance could return to the pool and service other clients. So why should what you say about stateless beans (pool size, etc..) not apply ?

The client (of an EJB) generally have a stub that performs the RMI communication (i.e marshall unmarshall parameters). There is another stub on the server side for the same purpose.