The intersection of identity, integration, API management, and application security. Notes, tutorials, and field reports from Robert Broeckelmann.https://rcbj.net/en-ushttps://rcbj.net/blog/of-daffy-bastards-and-goofy-f-cks-in-the-land-of-the-2026/https://rcbj.net/blog/of-daffy-bastards-and-goofy-f-cks-in-the-land-of-the-2026/Some organizations keep following the same legacy, bad practices even though they know better. They keep doing it right up until the unfortunate happens.Mon, 23 Feb 2026 08:32:17 GMTj2eewar-storiesgovernanceintegrationsecurityRobert Broeckelmannhttps://rcbj.net/blog/what-is-digital-privacy/https://rcbj.net/blog/what-is-digital-privacy/Privacy (and Digital Privacy) is one of those terms that I’ve thrown around a lot in the last few years. However, I never took the time to define it.Mon, 23 Feb 2026 08:00:17 GMTapplication-securityauthenticationauthorizationdata-protectiondigital-sovereigntyprivacyRobert Broeckelmannhttps://rcbj.net/blog/data-privacy-laws-regulations-around-the-world/https://rcbj.net/blog/data-privacy-laws-regulations-around-the-world/Disclosures: AI (ChatGPT) assisted with summarizing this information.Fri, 20 Feb 2026 16:05:34 GMTregulationaiprivacyRobert Broeckelmannhttps://rcbj.net/blog/my-nas-appliance-just-turned-ten-years-old/https://rcbj.net/blog/my-nas-appliance-just-turned-ten-years-old/I’ve been waiting a couple of years to write this post. In November, 2015, I bought a Synology RS815 NAS appliance to replace the DIY solution that I had been using for years before that. A month ago, that NAS appliance turned ten years old. It’s been in daily use for the past decade. At the six…Sat, 20 Dec 2025 05:03:54 GMTpersonalinfrastructureRobert Broeckelmannhttps://rcbj.net/blog/using-curl-with-spnego/https://rcbj.net/blog/using-curl-with-spnego/Recently, I had to setup a SPNEGO example to demonstrate a Kerberos identity integration. The details aren’t important, but I spent a bit of time figuring out how to use curl’s SPENGO support. So, we have the next blog post topic.Sat, 22 Nov 2025 13:58:00 GMTkerberosintegrationidentityRobert Broeckelmannhttps://rcbj.net/blog/software-supply-chain-security-ci-cd-ct-pipelines-and-security-tools-part-a5515d/https://rcbj.net/blog/software-supply-chain-security-ci-cd-ct-pipelines-and-security-tools-part-a5515d/This is part two of a two part blog post on Software Supply Chain Security. If you haven’t read Part 1 yet, starting there is recommended.Mon, 29 Sep 2025 15:09:34 GMTci-cdsupply-chain-securitysecurityRobert Broeckelmannhttps://rcbj.net/blog/software-supply-chain-security-ci-cd-ct-pipelines-and-security-tools-part/https://rcbj.net/blog/software-supply-chain-security-ci-cd-ct-pipelines-and-security-tools-part/The DevOps movement of the last decade more-or-less led to the DevSecOps movement of this decade. This focus on automation to create efficient, end-to-end software publishing pipelines combined with incidents like the SolarWinds Hack in 2020 and the recent ‘S1ngularity’ attack on the NPM ecosystem…Mon, 29 Sep 2025 15:03:22 GMTci-cdsupply-chain-securitysecurityRobert Broeckelmannhttps://rcbj.net/blog/practical-business-continuity-for-the-small-organization/https://rcbj.net/blog/practical-business-continuity-for-the-small-organization/For the small business owner, should the power going out mean you can’t make money? Should the computer system going down for 20 minutes mean a restaurant can’t take or cook orders any longer? Some basic level of preparation for anything other than ideal circumstances and commonsense needs to be…Wed, 04 Sep 2024 21:12:40 GMTbusiness-continuitydisaster-recoverynetworkingsecurityRobert Broeckelmannhttps://rcbj.net/blog/practical-business-continuity/https://rcbj.net/blog/practical-business-continuity/For the small business owner, should the power going out mean you can’t make money? Should the computer system going down for 20 minutes mean a restaurant can’t take or cook orders any longer? Some basic level of preparation for anything other than ideal circumstances and commonsense needs to be…Wed, 04 Sep 2024 14:11:00 GMTbusiness-continuitydisaster-recoverysecurityRobert Broeckelmannhttps://rcbj.net/blog/static-credentials-must-not-be-used-in-the-browser/https://rcbj.net/blog/static-credentials-must-not-be-used-in-the-browser/Authentication is described in this post.Sat, 10 Aug 2024 20:38:51 GMTauthenticationweb-application-securityRobert Broeckelmannhttps://rcbj.net/blog/datastore-security-requirements/https://rcbj.net/blog/datastore-security-requirements/This post will introduce a generic set of database / datastore security requirements that be used as a starting point when developing a database security strategy.Sat, 10 Aug 2024 20:34:56 GMTdata-securitysecurityRobert Broeckelmannhttps://rcbj.net/blog/application-front-ends-must-not-make-authorization-decisions/https://rcbj.net/blog/application-front-ends-must-not-make-authorization-decisions/First, let’s get the usual introductions out of the way. For an in-depth discussion of what Authorization is, check out this post. For a complete introduction to Authorization concepts see my Authorization Series. This post continues my long-running Authorization Series. In this post, we’re going…Tue, 06 Aug 2024 07:34:10 GMTapi-gatewayapplication-securityauthorizationci-cddebuggingrestRobert Broeckelmannhttps://rcbj.net/blog/api-gateways-and-multiple-consumer-types/https://rcbj.net/blog/api-gateways-and-multiple-consumer-types/Sometimes at client sites, I see a separation of APIs advertised on an API Gateway based upon consumer type. Sometimes, this is unavoidable, but there should be a core set of APIs and a general push to create APIs that are reusable. Reusability of APIs is a foundational building block of API…Fri, 24 May 2024 04:18:09 GMTapi-gatewayapisRobert Broeckelmannhttps://rcbj.net/blog/rfc-9068-a-jwt-based-oauth2-access-token-format-standard/https://rcbj.net/blog/rfc-9068-a-jwt-based-oauth2-access-token-format-standard/For anyone who has been paying attention, this blog post has been a long-time coming for multiple reasons. First, this is my first blog post in a couple of years — I’ve been heads down on a couple of projects for awhile now. This is literally the first time I’ve “come up for air” since the last…Thu, 23 May 2024 12:53:00 GMTaccess-tokensjwtoauth2iamRobert Broeckelmannhttps://rcbj.net/blog/making-authorization-decisions/https://rcbj.net/blog/making-authorization-decisions/This blog post continues our discussion of Authorization in the API space. It will explore common authorization patterns with API Gateways and the backend API Providers. Generally, the API Gateway will apply a Coarse Grained Authorization (CGA) decision and the API Provider will implement Fine…Sat, 06 Feb 2021 07:37:40 GMTapi-gatewayauthorizationapisRobert Broeckelmannhttps://rcbj.net/blog/delegation-a-general-discussion/https://rcbj.net/blog/delegation-a-general-discussion/This blog post expands on delegation and related concepts introduced in my Kerberos Delegation blog post. It also brings together two blog series I’ve been working on over the years: SAML2 vs. JWT Series and Kerberos and Windows Security Series. Delegation is a critical building block of end-to-end…Sat, 06 Feb 2021 07:33:03 GMTdelegationjwtkerberossamlsecurityRobert Broeckelmannhttps://rcbj.net/blog/kerberos-and-windows-security-delegation/https://rcbj.net/blog/kerberos-and-windows-security-delegation/In this next post in the Kerberos and Windows Security Series, we are going to explore a very useful, but abstract feature of the Kerberos Authentication Protocol: Delegation. In particular, we are going to focus on the Windows implementation of this feature. Delegation allows downstream actors to…Sat, 06 Feb 2021 07:32:22 GMTauthenticationdelegationkerberossecurityRobert Broeckelmannhttps://rcbj.net/blog/http-post-vs-get-is-one-more-secure-for-use-in-rest/https://rcbj.net/blog/http-post-vs-get-is-one-more-secure-for-use-in-rest/The use of HTTP POST vs HTTP GET for read-only (or query) operations in REST APIs recently came up in a conversation. For this particular shop, there had been a long-standing ban on the use of GET requests for use in homegrown applications. This had been the case since before REST APIs were in…Sat, 06 Feb 2021 07:31:12 GMTresthttpapissecurityRobert Broeckelmannhttps://rcbj.net/blog/oauth2-access-tokens-vs-api-keys-using-jwts/https://rcbj.net/blog/oauth2-access-tokens-vs-api-keys-using-jwts/There are several approaches to securing APIs. Every API Gateway vendor supports the same core set of API security mechanisms. API Keys and OAuth2 are two examples of these authentication (plus authorization) mechanism. When should one be used over the other? What are the differences between the…Wed, 15 Jul 2020 08:03:23 GMTaccess-tokensapi-gatewayapi-securityauthenticationoauth2apisRobert Broeckelmannhttps://rcbj.net/blog/identity-protocols-hosted-login-uis-and-custom-login-uis/https://rcbj.net/blog/identity-protocols-hosted-login-uis-and-custom-login-uis/There are many ways to implement user authentication in a modern application (mobile, desktop, tablet, web, etc). I have previously explored Authentication, Federation, and SSO; that post introduces several key concepts that are assumed here. At the intersection of user experience, authentication,…Mon, 13 Jul 2020 03:01:03 GMTauthenticationfederationssoidentityRobert Broeckelmannhttps://rcbj.net/blog/differences-between-azure-active-directory-and-red-hat-sso-v7-1/https://rcbj.net/blog/differences-between-azure-active-directory-and-red-hat-sso-v7-1/I recently finished implementing OAuth2 and OIDC support for Azure Active Directory in my OAuth2 + OIDC Debugger. Previously, we implemented support for Red Hat SSO v7.1 and 3Scale. This post compares the two product’s implementations of these protocols (OAuth2 and OIDC). In particular, it looks at…Sat, 30 Dec 2017 09:50:31 GMT3scaleactive-directoryapi-managementazurekeycloakssoRobert Broeckelmannhttps://rcbj.net/blog/oauth2-resource-owner-password-credential-grant-with-3scale-and-red-hat-sso/https://rcbj.net/blog/oauth2-resource-owner-password-credential-grant-with-3scale-and-red-hat-sso/This blog post continues demonstrating (and documenting) the use of the OAuth2 + OIDC Debugger with 3Scale API Management and Red Hat SSO. Now, we are going to look at the OAuth2 Resource Owner Password Credential Grant with 3Scale and Red Hat SSO.Fri, 08 Dec 2017 09:09:20 GMT3scaleapi-managementdebuggingkeycloakoauth2ssoRobert Broeckelmannhttps://rcbj.net/blog/oauth2-implicit-grant-with-3scale-and-red-hat-sso/https://rcbj.net/blog/oauth2-implicit-grant-with-3scale-and-red-hat-sso/This post demonstrates the OAuth2 Implicit Grant with 3Scale SaaS, APICast Gateway, and Red Hat SSO v7.1. In the last post, we introduced these components and demonstrated a functioning OAuth2 Authorization Code Grant (and OpenID Connect Authorization Code Flow). This is all part of my 3Scale API…Mon, 27 Nov 2017 21:17:23 GMT3scaleapi-managementauthorizationkeycloakoauth2ssoRobert Broeckelmannhttps://rcbj.net/blog/oauth2-configuration-in-3scale-api-management-and-apicast-with-red-hat-sso/https://rcbj.net/blog/oauth2-configuration-in-3scale-api-management-and-apicast-with-red-hat-sso/This tutorial builds on the capabilities we explored in the “Red Hat SSO + 3Scale API Management” series and in particular in the first tutorial. In this post, we will:Wed, 22 Nov 2017 23:23:56 GMT3scaleapi-managementkeycloakoauth2ssoapisRobert Broeckelmannhttps://rcbj.net/blog/red-hat-sso-v7-1-oauth2-client-credentials-grant/https://rcbj.net/blog/red-hat-sso-v7-1-oauth2-client-credentials-grant/This post continues our exploration of OAuth2 Authorization Grants with Red Hat SSO v7.1. In previous posts, we looked at:Thu, 16 Nov 2017 14:34:02 GMTauthorizationkeycloakoauth2ssoRobert Broeckelmannhttps://rcbj.net/blog/red-hat-sso-v7-1-oauth2-resource-owner-password-credential-grant-support/https://rcbj.net/blog/red-hat-sso-v7-1-oauth2-resource-owner-password-credential-grant-support/In this post, we will look at an example of the OAuth2 Resource Owner Password Credential Grant using Red Hat SSO v7.1. In previous posts, I described the Red Hat SSO setup for OpenID Connect authentication and OAuth2. We have also looked at examples of:Mon, 13 Nov 2017 16:37:40 GMTauthenticationkeycloakoauth2openid-connectssoRobert Broeckelmannhttps://rcbj.net/blog/red-hat-sso-and-3scale-api-management-series/https://rcbj.net/blog/red-hat-sso-and-3scale-api-management-series/This post contains a collection of links to blog posts I’ve written about the use of OAuth2 and OpenID Connect with Red Hat SSO and 3Scale API Management.Sun, 12 Nov 2017 15:29:55 GMT3scaleapi-managementkeycloakssoseriesapisRobert Broeckelmannhttps://rcbj.net/blog/oauth2-implicit-grant-with-red-hat-sso-v7-1/https://rcbj.net/blog/oauth2-implicit-grant-with-red-hat-sso-v7-1/In my last post, we looked at how to configure Red Hat SSO v7.1 for OpenID Connect. That post also introduced a web-based OAuth2 + OIDC debugger and the OIDC Authorization Code Authentication Flow. The Red Hat SSO configuration that was created in that post also allows the OAuth2 Implicit Grant to…Sun, 12 Nov 2017 15:29:15 GMTauthenticationauthorizationdebuggingkeycloakoauth2ssoRobert Broeckelmannhttps://rcbj.net/blog/red-hat-sso-v7-1-spec-support/https://rcbj.net/blog/red-hat-sso-v7-1-spec-support/Red Hat SSO v7.1 provides support for OAuth2, OpenID Connect, and SAML2. There are numerous other identity protocols, but these are quite common and can handle a wide variety of use cases.Sun, 12 Nov 2017 15:25:05 GMTkeycloakoauth2openid-connectsamlssostandardsRobert Broeckelmannhttps://rcbj.net/blog/what-is-authorization/https://rcbj.net/blog/what-is-authorization/In a previous post, I gave a definition of Authentication. In this post, we’re going to explore authorization, which is typically the next step in the processing pipeline after authentication. The concepts described here can apply equally to traditional web applications, SPA apps, mobile apps,…Sun, 12 Nov 2017 15:00:13 GMTauthenticationauthorizationci-cdsupply-chain-securityRobert Broeckelmannhttps://rcbj.net/blog/openid-connect-authorization-code-flow-with-red-hat-sso/https://rcbj.net/blog/openid-connect-authorization-code-flow-with-red-hat-sso/This post was originally published as “White Paper: OpenID Connect (Authorization Code Flow) with Red Hat SSO” on the Levvel Blog.Sat, 11 Nov 2017 03:27:55 GMTauthorizationkeycloakopenid-connectssoRobert Broeckelmannhttps://rcbj.net/blog/application-security-models/https://rcbj.net/blog/application-security-models/I like to start system design (at the application level) with the security model that will be used to protect the system. Application security models have several attributes that need to be addressed at each layer of the application.Sun, 05 Nov 2017 14:00:35 GMTapplication-securitysecurity-architecturesecurityRobert Broeckelmannhttps://rcbj.net/blog/digital-signature-series/https://rcbj.net/blog/digital-signature-series/The following blog posts are part of a series I wrote on digital signatures.Sun, 05 Nov 2017 13:42:13 GMTdigital-signaturesseriescryptographyRobert Broeckelmannhttps://rcbj.net/blog/performance-tuning-methodology/https://rcbj.net/blog/performance-tuning-methodology/I’m taking a brief excursion from my usual identity and API-centric posts to answer a question about performance tuning that someone asked me earlier this year. In a previous incarnation of my career, I was focused on performance tuning and diagnostics — particularly involving Java systems.…Sun, 05 Nov 2017 12:06:46 GMTperformancetroubleshootingjavaapisidentityRobert Broeckelmannhttps://rcbj.net/blog/understanding-ws-federation-passive-requestor-profile/https://rcbj.net/blog/understanding-ws-federation-passive-requestor-profile/There are several identity protocols that are commonly supported by Identity Providers today — OAuth2, OAuth2 Token Exchange, OIDC, SAML2 Browser Profile, WS-Trust, WS-Federation, etc. The OAuth2 and OIDC protocols are relative newcomers. The other protocols have been around longer — and, tend to…Wed, 18 Oct 2017 16:20:40 GMTfederationidentity-provideroauth2openid-connectsamlws-federationRobert Broeckelmannhttps://rcbj.net/blog/summary-of-azure-active-directory-oauth2-authorization-grant-and-oidc-authentication-flow/https://rcbj.net/blog/summary-of-azure-active-directory-oauth2-authorization-grant-and-oidc-authentication-flow/A while back I needed a summary of which protocols were supported/recommended in different situations by Azure Active Directory while I was researching the “When To Use Which (OAuth2) Grants and (OIDC) Flows” post. So, I am summarizing it here.Sun, 24 Sep 2017 12:03:53 GMTactive-directoryauthenticationauthorizationazureoauth2openid-connectRobert Broeckelmannhttps://rcbj.net/blog/authentication-vs-federation-vs-sso/https://rcbj.net/blog/authentication-vs-federation-vs-sso/Authentication. Federation. Single Sign On (SSO). I’ve mentioned these concepts many times. I haven’t actually formally defined what each of these terms mean even though I’ve used these many times throughout my writing — these concepts are closely related.Sun, 24 Sep 2017 10:53:49 GMTauthenticationfederationssoRobert Broeckelmannhttps://rcbj.net/blog/how-to-submit-your-security-tokens-to-an-api-provider-pt-2/https://rcbj.net/blog/how-to-submit-your-security-tokens-to-an-api-provider-pt-2/This post was originally published as “How to Submit Tokens to an API Provider, Pt 2” on the Apigee Blog.Sun, 17 Sep 2017 05:31:23 GMTapi-managementapigeeapissecurityRobert Broeckelmannhttps://rcbj.net/blog/how-to-submit-your-security-tokens-to-an-api-provider-pt-1/https://rcbj.net/blog/how-to-submit-your-security-tokens-to-an-api-provider-pt-1/This post was originally published as “How to Submit Tokens to an API Provider, Pt 1” on the Apigee Blog.Sun, 17 Sep 2017 05:19:29 GMTapi-managementapigeeapissecurityRobert Broeckelmannhttps://rcbj.net/blog/saml2-vs-jwt-a-comparison/https://rcbj.net/blog/saml2-vs-jwt-a-comparison/This post concludes our discussion of SAML2 and JWT. Here we look at a comparison of the features and use cases of the two technologies. It’s difficult to make a direct comparison of JWT and SAML2. As we’ve seen through this series, one must take into account the specifications that work in…Wed, 19 Jul 2017 16:45:07 GMTjwtsamlRobert Broeckelmannhttps://rcbj.net/blog/jwt-use-cases/https://rcbj.net/blog/jwt-use-cases/This post explores the equivalent JWT use cases corresponding to the five SAML2 use cases that were explored earlier in this series. We had to build up our tool set to get to this point — including exploring JWT, OAuth2, OpenID Connect, and the supporting specs. To be ready for this moment, we’ve…Thu, 13 Jul 2017 12:34:04 GMTjwtoauth2openid-connectsamlRobert Broeckelmannhttps://rcbj.net/blog/openid-connect-logout/https://rcbj.net/blog/openid-connect-logout/The OpenID Connect (OIDC) family of specs supports logout (from a single application) and global (or single) logout (from all applications that the user has logged into through the OpenID Provider, OP), but these features are optional or in draft status (as of Q2, 2017). So, these spec features may…Wed, 12 Jul 2017 16:28:12 GMTapi-gatewayapplication-securityauthenticationccompilersopenid-connectRobert Broeckelmannhttps://rcbj.net/blog/saml2-use-cases/https://rcbj.net/blog/saml2-use-cases/The following blog posts discuss SAML2 use cases that have been explored in this series:Sun, 09 Jul 2017 06:24:44 GMTjwtrestsamlsoapssoweb-servicesRobert Broeckelmannhttps://rcbj.net/blog/identity-propagation-in-an-api-gateway-architecture/https://rcbj.net/blog/identity-propagation-in-an-api-gateway-architecture/The power of end-to-end user security context with APIsSat, 17 Jun 2017 13:54:05 GMTapi-gatewayapisidentitysecurityRobert Broeckelmannhttps://rcbj.net/blog/when-to-use-which-oauth2-grants-and-oidc-flows/https://rcbj.net/blog/when-to-use-which-oauth2-grants-and-oidc-flows/Update(07/01/2019): This is by far my most popular post. I’ve continued to update this article based on feedback and things that I have noticed. I’m trying to keep it relevant.Please leave feedback in the comments section.Sun, 21 May 2017 10:33:24 GMToauth2openid-connectRobert Broeckelmannhttps://rcbj.net/blog/an-alternative-to-delegated-access-in-the-enterprise/https://rcbj.net/blog/an-alternative-to-delegated-access-in-the-enterprise/Extending OAuth2 and OpenID Connect as the enterprise standard for API securityMon, 24 Apr 2017 12:31:53 GMTapi-securitydelegationoauth2openid-connectapissecurityRobert Broeckelmannhttps://rcbj.net/blog/understanding-openid-connect-series/https://rcbj.net/blog/understanding-openid-connect-series/The following blog posts make up my series on OpenID Connect. This is part of the SAML2 vs JWT series.Wed, 29 Mar 2017 14:09:19 GMTjwtopenid-connectsamlseriesRobert Broeckelmannhttps://rcbj.net/blog/saml2-vs-jwt-understanding-openid-connect-part-3/https://rcbj.net/blog/saml2-vs-jwt-understanding-openid-connect-part-3/In part 1 and part 2 of Understanding OpenID Connect, core concepts and the first Authentication Flow (Authorization Code Grant Flow) were introduced. In part 3, we look at the remaining Authentication Flows (Implicit Flow and Hybrid Flow) and some other features of the OIDC specification.Sat, 25 Mar 2017 08:42:08 GMTauthenticationauthorizationjwtopenid-connectsamlRobert Broeckelmannhttps://rcbj.net/blog/saml2-vs-jwt-understanding-openid-connect-part-2/https://rcbj.net/blog/saml2-vs-jwt-understanding-openid-connect-part-2/This post continues our discussion of OpenID Connect (OIDC). We look at one of the three Authentication Flows defined by the OIDC spec — the Authorization Code Grant Flow.Sat, 25 Mar 2017 08:40:09 GMTauthenticationauthorizationjwtopenid-connectsamlRobert Broeckelmannhttps://rcbj.net/blog/saml2-vs-jwt-understanding-openid-connect-part-1/https://rcbj.net/blog/saml2-vs-jwt-understanding-openid-connect-part-1/This post builds upon what we learned about OAuth2 and JWT in previous posts. OpenID Connect will give us the final building block for the JWT-related use cases that this series will explore. The goal of this blog post is to provide a deep understanding of the OpenID Connect spec without having to…Sat, 25 Mar 2017 08:38:58 GMTjwtoauth2openid-connectsamlRobert Broeckelmannhttps://rcbj.net/blog/design-principles-for-seamless-user-authentication/https://rcbj.net/blog/design-principles-for-seamless-user-authentication/This post was originally published as “Design Principles for Seamless User Authentication” on the Apigee Blog.Tue, 07 Mar 2017 13:31:37 GMTapi-managementapigeeauthenticationRobert Broeckelmannhttps://rcbj.net/blog/keeping-your-apis-secure-for-multiple-user-types/https://rcbj.net/blog/keeping-your-apis-secure-for-multiple-user-types/This post was originally published as “Keeping Your APIs Secure for Multiple User Types” on the Apigee Blog.Tue, 14 Feb 2017 23:29:45 GMTapi-managementapigeeapissecurityRobert Broeckelmannhttps://rcbj.net/blog/the-tools-of-api-management-the-full-stack/https://rcbj.net/blog/the-tools-of-api-management-the-full-stack/In the first three API Management posts I wrote, we discussed “What are APIs?(The Technical Perspective)”, “What is API Management?”, and “The Anatomy of an API Management Solution”. Continuing with this theme, we will explore the API Management Stack. So, what do I mean by API Management Stack?Mon, 06 Feb 2017 10:19:38 GMTapi-managementapisRobert Broeckelmannhttps://rcbj.net/blog/saml2-vs-jwt-understanding-oauth2/https://rcbj.net/blog/saml2-vs-jwt-understanding-oauth2/This blog post continues the SAML2 vs JWT series. In the last post, we discussed JSON Web Tokens. Now, we are going to move on to OAuth2 and OpenID Connect, which provides some structure and protocol around the use of JWT. These protocols are used, along with JWT, to build the JWT use cases this…Mon, 23 Jan 2017 06:31:11 GMTjwtoauth2openid-connectsamlRobert Broeckelmannhttps://rcbj.net/blog/azure-active-directory-setup-for-api-actors/https://rcbj.net/blog/azure-active-directory-setup-for-api-actors/This post outlines how to setup an Azure Active Directory tenant with a Pay-As-You-Go or Free subscription (which only lasts for 30 days). This post is an ancillary post that gives the AAD configuration details needed for the Apigee and Azure Active Directory Integration — A JWT Story post to…Mon, 16 Jan 2017 07:37:35 GMTactive-directoryapi-managementapigeeazureinfrastructureapisRobert Broeckelmannhttps://rcbj.net/blog/saml2-vs-jwt-apigee-azure-active-directory-integration-a-jwt-story/https://rcbj.net/blog/saml2-vs-jwt-apigee-azure-active-directory-integration-a-jwt-story/In our next SAML2 vs JWT post, we are going to use a JWT with a very simple API that is proxied through Apigee Edge Public Cloud. The JWT token will be an OAuth2 access token generated by Azure Active Directory. In the last post in this series, we explored what JSON Web Tokens (JWTs) are and the…Sun, 15 Jan 2017 04:55:38 GMTactive-directoryapi-managementapigeeazurejwtsamlRobert Broeckelmannhttps://rcbj.net/blog/saml2-vs-jwt-understanding-json-web-token-jwt/https://rcbj.net/blog/saml2-vs-jwt-understanding-json-web-token-jwt/In this post, we begin our exploration of the JSON Web Token (JWT) specification as part of the SAML v2.0 vs JWT Series. To understand JWT use cases, we must also look at OpenID Connect v1.0, OAuth v2.0, and and a few related specifications — the JWT spec by itself is not very interesting or…Wed, 11 Jan 2017 03:48:06 GMTjwtopenid-connectsamlRobert Broeckelmannhttps://rcbj.net/blog/saml-v2-0-vs-jwt-saml2-single-logout/https://rcbj.net/blog/saml-v2-0-vs-jwt-saml2-single-logout/This post wraps our look at SAML v2.0 Use Cases. The first four use cases are described in “SAML v2.0 vs JWT: SAML2 Web Application SSO Use Cases” and “SAML v2.0 vs. JWT: SAML2 with SOAP Web Services and REST APIs”. The full list of SAML2 vs JWT-related blog posts can be found here.Sun, 25 Dec 2016 18:07:47 GMTjwtrestsamlsoapssoweb-servicesRobert Broeckelmannhttps://rcbj.net/blog/saml-v2-0-vs-jwt-saml2-with-soap-web-services-and-rest/https://rcbj.net/blog/saml-v2-0-vs-jwt-saml2-with-soap-web-services-and-rest/This post continues our look at SAML v2.0 Use Cases. The first two use cases are described in “SAML v2.0 vs JWT: SAML2 Web Application SSO Use Cases”. The full list of SAML2 vs JWT-related blog posts can be found here.Sun, 25 Dec 2016 07:10:40 GMTjwtrestsamlsoapweb-servicesapisRobert Broeckelmannhttps://rcbj.net/blog/saml-v2-0-vs-jwt-series/https://rcbj.net/blog/saml-v2-0-vs-jwt-series/This is a list of all the SAML2 vs JWT related posts I have written. This series explores SAML2 use cases, JWT use cases, the relevant specifications, and explores how the two technologies differ. The reader will see how identity federation technology has evolved over the past fifteen years.Sat, 24 Dec 2016 23:01:21 GMTfederationjwtsamlseriesidentityRobert Broeckelmannhttps://rcbj.net/blog/saml-v2-0-vs-jwt-saml2-web-application-sso-use-cases/https://rcbj.net/blog/saml-v2-0-vs-jwt-saml2-web-application-sso-use-cases/This post continues our look at SAML v2.0 and how it compares to JSON Web Tokens (JWT). In the last post, we looked at the history, specs, and basics of SAML v2.0. In this post, we begin exploring SAML v2.0 use cases in detail.Thu, 22 Dec 2016 02:43:54 GMTjwtsamlssoRobert Broeckelmannhttps://rcbj.net/blog/api-governance-in-the-enterprise/https://rcbj.net/blog/api-governance-in-the-enterprise/This post was originally published as “API Governance in the Enterprise” on the Levvel Blog.Fri, 28 Oct 2016 22:58:47 GMTapi-managementgovernanceapisRobert Broeckelmannhttps://rcbj.net/blog/saml-2-0-vs-jwt-understanding-federated-identity-and-saml/https://rcbj.net/blog/saml-2-0-vs-jwt-understanding-federated-identity-and-saml/This post was originally published as “SAML 2.0 VS. JWT: UNDERSTANDING FEDERATED IDENTITY AND SAML” on the Levvel Blog.Thu, 20 Oct 2016 05:12:16 GMTfederationjwtsamlidentityRobert Broeckelmannhttps://rcbj.net/blog/api-management-and-perimeter-security-for-cots-applications/https://rcbj.net/blog/api-management-and-perimeter-security-for-cots-applications/This post was originally published as “API Management and Perimeter Security for COTS Applications” on the Levvel Blog.Wed, 17 Aug 2016 16:34:18 GMTapi-managementapissecurityRobert Broeckelmannhttps://rcbj.net/blog/api-security-vs-web-application-security-part-2/https://rcbj.net/blog/api-security-vs-web-application-security-part-2/This post was originally published as “API Security vs. Web Application Security: Part 2” on the Levvel Blog.Tue, 17 May 2016 05:12:35 GMTapi-securityapplication-securityapissecurityRobert Broeckelmannhttps://rcbj.net/blog/api-security-vs-web-application-security-part-1-a-brief-history-of/https://rcbj.net/blog/api-security-vs-web-application-security-part-1-a-brief-history-of/This post was originally published as “API Security vs. Web Application Security Part 1: A Brief History of Web Application Architecture” on the Levvel Blog.Tue, 17 May 2016 04:42:35 GMTapi-securityapplication-securityapissecurityRobert Broeckelmannhttps://rcbj.net/blog/dsig-part-3-xml-dsig-vs-json-web-signature/https://rcbj.net/blog/dsig-part-3-xml-dsig-vs-json-web-signature/This post was originally published as “DSig Part 3: XML DSig vs. JSON Web Signtaure” on the Levvel Blog.Sun, 10 Apr 2016 06:45:35 GMTdigital-signaturesjwtxmlcryptographyRobert Broeckelmannhttps://rcbj.net/blog/dsig-part-2-json-web-signature-jws/https://rcbj.net/blog/dsig-part-2-json-web-signature-jws/This post was originally published as “DSig Part 2: JSON Web Signature (JWS)” on the Levvel Blog.Fri, 01 Apr 2016 18:30:03 GMTdigital-signaturesjwtcryptographyRobert Broeckelmannhttps://rcbj.net/blog/dsig-part-1-xml-digital-signature-and-ws-security-integrity/https://rcbj.net/blog/dsig-part-1-xml-digital-signature-and-ws-security-integrity/This post was originally published as “DSig Part 1: XML Digital Signature and WS-Security Integrity” on the Levvel Blog.Thu, 31 Mar 2016 05:34:18 GMTdigital-signaturesws-securityxmlcryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/nissan-leaf-api-security-who-owns-api-security-and-how-much-security/https://rcbj.net/blog/nissan-leaf-api-security-who-owns-api-security-and-how-much-security/This post was originally published as “Nissan LEAF, API Security, Who Owns API Security, and How Much Security Is Enough?” on the Levvel Blog.Mon, 14 Mar 2016 04:26:17 GMTapi-securitycareerapissecurityRobert Broeckelmannhttps://rcbj.net/blog/the-anatomy-of-an-api-management-solution/https://rcbj.net/blog/the-anatomy-of-an-api-management-solution/This post was originally published as “The Anatomy of an API Management Solution” on the Levvel Blog.Tue, 08 Mar 2016 06:45:04 GMTapi-managementapisRobert Broeckelmannhttps://rcbj.net/blog/what-is-api-management/https://rcbj.net/blog/what-is-api-management/This post was originally published as “What is API Management?” on the Levvel Blog.Sat, 27 Feb 2016 01:59:48 GMTapi-managementapisRobert Broeckelmannhttps://rcbj.net/blog/what-are-apis-the-technology-perspective/https://rcbj.net/blog/what-are-apis-the-technology-perspective/This post was originally published as “What are APIs? (The Technology Perspective)” on the Levvel Blog.Tue, 16 Feb 2016 06:24:48 GMTenvironmentsmemory-managementperformancerestsoapapisRobert Broeckelmannhttps://rcbj.net/blog/modernizing-soa-with-apis/https://rcbj.net/blog/modernizing-soa-with-apis/This post was originally published as “Modernizing SOA with APIs” on the Levvel Blog.Tue, 16 Feb 2016 05:57:42 GMTsoaapisRobert Broeckelmannhttps://rcbj.net/blog/protecting-server-resources-hosting-unauthenticated-apis/https://rcbj.net/blog/protecting-server-resources-hosting-unauthenticated-apis/This post was originally published as “Protecting Server Resources Hosting Unauthenticated APIs” on the Levvel Blog.Tue, 16 Feb 2016 05:30:15 GMTauthenticationapisRobert Broeckelmannhttps://rcbj.net/blog/convert-an-x509v3-binary-security-token-to-pem-format/https://rcbj.net/blog/convert-an-x509v3-binary-security-token-to-pem-format/This tutorial describes how to convert a Binary Security Token extracted from a SOAP message into a valid PEM format that can be read by openssl or similar tool. If you are ever troubleshooting the use of X509v3 certificates used with WS-Security, this can come in very handy.Sun, 30 Dec 2012 21:58:00 GMTpkitroubleshootingws-securityxmlcryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/ws-security-integrity-xml-digital-signature/https://rcbj.net/blog/ws-security-integrity-xml-digital-signature/This post continues exploring the use of XML Digital Signature; this time we look at WS-Security Integrity (use of XML Digital Signatures with WS-Security). Our examples show a digital signature and a timestamp in a WS-Security <Security> SOAP Header.Sun, 11 Nov 2012 22:00:00 GMTdigital-signaturessoapws-securityxmlcryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/xml-digital-signature-an-example/https://rcbj.net/blog/xml-digital-signature-an-example/In the last post, we looked at the steps involved in generating a digital signature using the XML Digital Signature spec. The algorithm to produce a signature and validate it were explored but no examples were given. In this post, we’ll look at an example that is given in the XML Digital Signature…Mon, 05 Nov 2012 00:04:00 GMTdigital-signaturessecurity-architecturexmlcryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/xml-digital-signatures/https://rcbj.net/blog/xml-digital-signatures/The XML DSig specification is used to provide digital signature functionality to XML Documents. It is is used by numerous other specs such as WS-Security and SAML2. This blog entry will describe how digital signatures work with an X509 private/public key pair.Mon, 29 Oct 2012 01:30:00 GMTauthenticationdigital-signaturespkixmlcryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/xml-editor/https://rcbj.net/blog/xml-editor/I was asked recently what XML, XSD and XSLT editor I use. Given that I am an independent/small consulting firm owner, spending $1000s of dollars on development tooling that will come out of my own pocket is not my first choice.Sun, 21 Oct 2012 23:35:00 GMTdebuggingtoolsxsltcareerxmlRobert Broeckelmannhttps://rcbj.net/blog/what-is-authentication/https://rcbj.net/blog/what-is-authentication/I’ve talked about authentication many times on ThinkMiddleware.com. It recently occurred to me that I have never devoted a blog post to defining authentication. I’ve had a section on the subject in a couple of different places, but I wanted to have an article to reference from other posts. So, here…Sun, 14 Oct 2012 23:32:00 GMTauthenticationj2eeweb-servicesintegrationsecurityRobert Broeckelmannhttps://rcbj.net/blog/datapower-soma-calls/https://rcbj.net/blog/datapower-soma-calls/The primary administration automation mechanism on IBM WebSphere DataPower appliances is the XML Management Interface. The XMI interface allows one to make SOMA (SOAP Configuration Management, assuming SOMA = SOap MAnagement) calls to perform various administration tasks. How to perform these…Wed, 10 Oct 2012 23:51:00 GMTdatapowersoapwebspherecareerinfrastructurexmlRobert Broeckelmannhttps://rcbj.net/blog/shrewsoft-vpn-client-has-problem-after-windows-7-laptop-sleeps-with-vpn/https://rcbj.net/blog/shrewsoft-vpn-client-has-problem-after-windows-7-laptop-sleeps-with-vpn/A few months ago I switched from using Cisco’s QuickVPN software to the ShrewSoft VPN Client for Windows. I’m not going to get into the issues that I had with QuickVPN-it wasn’t very reliable. I’ve had ShrewSoft VPN for Windows v2.1.7 connecting to a Cisco RV082 VPN router. ShrewSoft provides…Mon, 01 Oct 2012 23:49:00 GMTnetworkingsecurityRobert Broeckelmannhttps://rcbj.net/blog/soa-specs-visualized/https://rcbj.net/blog/soa-specs-visualized/In a previous blog post, I listed a number of SOA Specs and Security Specs that I thought were important to be familiar with when working with DataPower and other SOA technologies. In this post, I made a quick (and dirty) Visio diagram that I tend to draw up on a whiteboard when I’m at a new client…Sun, 23 Sep 2012 18:21:00 GMTsoasoaptlshttpstandardsnetworkingRobert Broeckelmannhttps://rcbj.net/blog/active-directory-return-codes/https://rcbj.net/blog/active-directory-return-codes/While working with DataPower and Active Directory (acting as the User Repository) I have often run into situation where AD returns an LDAP error code 49 plus a sub-code in the error string that is unique to AD. The sub-code can be very useful to troubleshooting, if you know what it means.Sun, 02 Sep 2012 21:26:00 GMTactive-directorydatapowerldaptroubleshootingsecurityRobert Broeckelmannhttps://rcbj.net/blog/some-simple-updates-to-a-datapower-xslt-stylesheet/https://rcbj.net/blog/some-simple-updates-to-a-datapower-xslt-stylesheet/In the last post, we saw how an XML Firewall in loopback mode could be used to return a valid SOAP response to a service message. The stylesheet used simply returned a static SOAP response that was independent of the input parameters. The stylesheet returns a response containing the sum of two…Fri, 27 Jul 2012 22:20:00 GMTdatapowersoapweb-servicesxsltxmlRobert Broeckelmannhttps://rcbj.net/blog/soap-web-service-mockup-tutorial-on-datapower/https://rcbj.net/blog/soap-web-service-mockup-tutorial-on-datapower/It is often the case that a DataPower developer will have work to do, but does not yet have a backend Service Provider to point the DataPower service at. In general, anything beyond trivial examples will need to point at something that returns a valid response. In order to satisfy this requirement,…Fri, 27 Jul 2012 18:14:00 GMTdatapowersoaptoolsweb-servicesnetworkingRobert Broeckelmannhttps://rcbj.net/blog/jboss-picketlink-ws-trust-client-and-third-party-security-token-services/https://rcbj.net/blog/jboss-picketlink-ws-trust-client-and-third-party-security-token-services/Another use-case that I touched on during my JBoss World 2012 presentation was using the PicketLink WS-Trust Client implementation to communicate with third-party Security Token Services. In particular, we discussed how the PicketLink SAML2STSIssuingLoginModule can communicate with the IBM Tivoli…Wed, 04 Jul 2012 04:39:00 GMTjbosssoaspeakingws-trustjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/jboss-and-ltpav2-support/https://rcbj.net/blog/jboss-and-ltpav2-support/I’ve been at a couple of different client sites where there was a heavy IBM product presence, the use of IBM’s proprietary token format-LTPA2, and the need for a non-IBM technology such as JBoss EAP. Given the nature of the LTPA2 technology (IBM proprietary protocol), there isn’t any direct support…Tue, 03 Jul 2012 07:19:00 GMTjbossspeakingintegrationjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/datapower-access-rental-maybe-datapower-in-the-cloud/https://rcbj.net/blog/datapower-access-rental-maybe-datapower-in-the-cloud/Ever since I was first started working with IBM WebSphere DataPower I was looking around for someone that was offering access to a IBM WebSphere Datapower, I was looking around for someone that was offering access to an Internet-facing appliance that I could use for experimenting and learning. I…Mon, 02 Jul 2012 05:25:00 GMTdatapowerwebspherecloudjavaRobert Broeckelmannhttps://rcbj.net/blog/jboss-world-2012-session-trusted-security-with-jboss-enterprise-application-platform/https://rcbj.net/blog/jboss-world-2012-session-trusted-security-with-jboss-enterprise-application-platform/It’s been a few weeks since I have posted any updates. I started a new project at the beginning of June; it always takes a few weeks to get up to speed on an extended project. Integrating the IBM Tivoli Security stack and JBoss EAP was the subject of my JBoss World 2012 presentation.Mon, 02 Jul 2012 05:11:00 GMTjaasjbossspeakingcryptographyintegrationsecurityRobert Broeckelmannhttps://rcbj.net/blog/fine-grained-authorization-versus-coarse-grained-authorization/https://rcbj.net/blog/fine-grained-authorization-versus-coarse-grained-authorization/I was recently involved in a conversation where someone asked the question what is FGA (Fine Grained Authorization) versus Coarse Grained Authorization(CGA)? From their perspective, there was just authorization. Further distinction was not needed.Wed, 06 Jun 2012 05:48:57 GMTauthorizationsecurityRobert Broeckelmannhttps://rcbj.net/blog/rbm-administrative-access-security-for-datapower/https://rcbj.net/blog/rbm-administrative-access-security-for-datapower/I generally recommend to clients that DataPower RBM (Role-Based Management) be configured to perform authentication and authorization of DataPower administrators and developers with LDAP. In particular, whatever respository serves as the central repository of user information should be used (of…Tue, 05 Jun 2012 05:52:00 GMTauthenticationauthorizationdatapowerldapinfrastructuresecurityRobert Broeckelmannhttps://rcbj.net/blog/datapower-appliances-hsms/https://rcbj.net/blog/datapower-appliances-hsms/I’ve been in a couple of shops that have used the HSM module option of DataPower for FIPS 140-2 v2 or v3 compliance. An HSM is a Hardware Security Module. My understanding is that there is a short list of IBM customers that are using this technology. I thought collecting all the information and…Fri, 01 Jun 2012 00:48:09 GMTdatapowerhsmkey-managementcryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/jboss-world-2012-session/https://rcbj.net/blog/jboss-world-2012-session/I will be presenting at JBoss World 2012 in Boston the last week of June. I’ll be presenting with Anil Saldana on JBoss Security, PicketLink, and Identity Management, JBoss Security Architect. A link to the description can be found here. The original abstract:Wed, 30 May 2012 00:56:00 GMTjbossspeakingjavaidentitysecurityRobert Broeckelmannhttps://rcbj.net/blog/datapower-exports-and-xml-files-referenced-by-stylesheets/https://rcbj.net/blog/datapower-exports-and-xml-files-referenced-by-stylesheets/I was recently presented with an opportunity to be clever while promoting DataPower objects from a development environment to a testing environment. The WS-Proxy object’s policy rules had a Transform Action that ran a custom stylesheet. The stylesheet referenced a configuration file that was kept…Tue, 29 May 2012 01:58:00 GMTdatapowerxsltxmlRobert Broeckelmannhttps://rcbj.net/blog/how-to-rename-a-ws-proxy-or-multi-protocol-gateway-object-on/https://rcbj.net/blog/how-to-rename-a-ws-proxy-or-multi-protocol-gateway-object-on/Anyone who has worked with DataPower for a while has gotten into a situation where they need to rename a service object (XML Firewall, WS-Proxy, Multi-Protocol Gateway, etc). There isn’t a rename button that I have ever found. This tutorial will describe two ways of renaming such objects.Tue, 22 May 2012 01:37:00 GMTdatapowerjbosscareerxmlRobert Broeckelmannhttps://rcbj.net/blog/thomas-erls-soa-book-series/https://rcbj.net/blog/thomas-erls-soa-book-series/I listed several of Thomas Erl’s books in my SOA Recommended reading list. A full list of Thomas Erl’s series of SOA books can be found here. Anyone working in the SOA space, regardless of vendor or technology stack, should read these books.Wed, 16 May 2012 01:41:00 GMTreading-listsoaseriesRobert Broeckelmannhttps://rcbj.net/blog/who-owns-datapower-within-an-organization/https://rcbj.net/blog/who-owns-datapower-within-an-organization/The definition of the word ownership has varying meanings across organizations, but there is always a group that retains control of the technology. It’s typically the group that sponsored the adoption of the technology and owns day-to-day support of it. But, sometimes, the technology initiative…Tue, 08 May 2012 00:36:00 GMTdatapowercareerinfrastructurenetworkingsecurityRobert Broeckelmannhttps://rcbj.net/blog/datapower-and-terminal-servers/https://rcbj.net/blog/datapower-and-terminal-servers/DataPower has a serial port console that is used during initial bootstrap of the appliance, recovering from problems, and certain configuration changes. Having access to the serial console is the only feasible approach to resolving certain issues that arise with any appliance (or piece of network…Sun, 06 May 2012 00:27:00 GMTdatapowerinfrastructurenetworkingRobert Broeckelmannhttps://rcbj.net/blog/websphere-datapower-roles-and-responsibilities/https://rcbj.net/blog/websphere-datapower-roles-and-responsibilities/DataPower is a weird (but, wonderful) beast. It has a tendency to break some of the traditional IT silos that develop within infrastructure groups. That can lead to a lot of friction and amusing arguments in which everyone is simply talking past one another. In this post, I want to describe the…Fri, 04 May 2012 03:56:00 GMTdatapowerwebspherecareerinfrastructurejavaRobert Broeckelmannhttps://rcbj.net/blog/three-internal-architectures-designs-for-datapower-deployments/https://rcbj.net/blog/three-internal-architectures-designs-for-datapower-deployments/I have been in several different shops that are either deploying DataPower or are a few years after deploying DataPower. I’ve also had opportunities to talk to numerous different DataPower technical resources about how they have utilized DataPower. In the post, I want to describe what I’ve seen as…Thu, 03 May 2012 03:03:00 GMTdatapowersecurity-architecturesoaRobert Broeckelmannhttps://rcbj.net/blog/osi-7-layer-network-model/https://rcbj.net/blog/osi-7-layer-network-model/I’ve been playing with Cisco switches and routers recently at home to get a handle on VLANs-more about VLANs later. Some people I know who have gotten involved in DataPower started out in system administration or networking and worked their way up the technology stack to SOA Appliances (WebSphere…Tue, 01 May 2012 02:37:00 GMTdatapowerprotocolssoawebspherejavanetworkingRobert Broeckelmannhttps://rcbj.net/blog/symmetric-keys-addendum/https://rcbj.net/blog/symmetric-keys-addendum/A couple of weeks ago I wrote a brief post about how to generate symmetric keys that can be used with DataPower. It demonstrates how to generate shared keys of various lengths using the Unix dd command. Today, someone asked how a shared key (or symmetric key) can be generated using the openssl…Tue, 24 Apr 2012 22:50:00 GMTaesdatapowerkey-managementtlscryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/ssl-handshake-the-visual/https://rcbj.net/blog/ssl-handshake-the-visual/This is an old picture that I made for a 2010 JBoss World security presentation. It came in handy not so long ago when I was explaining the SSL Handshake to someone.Mon, 23 Apr 2012 23:23:00 GMTjbosspkitlscryptographyjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/ibm-impact-2012-client-panel-experiences-with-ibm-soa-stack-rollout/https://rcbj.net/blog/ibm-impact-2012-client-panel-experiences-with-ibm-soa-stack-rollout/I will be leading a discussion panel at IBM Impact 2012 in Las Vegas on Monday, April 30th, 3:45-4pm. More information can be found here. It will be an open ended discussion and Q&A session detailing experiences rolling out IBM technology for an ESB. I’ve done this at a couple of different…Sun, 22 Apr 2012 21:02:00 GMTdatapoweresbsoaspeakingintegrationRobert Broeckelmannhttps://rcbj.net/blog/datapower-extension-functions-and-elements/https://rcbj.net/blog/datapower-extension-functions-and-elements/Anyone who has spent time working with DataPower has had to write an XSLT stylesheet at some point. DataPower provides a library of functions and elements that provide access to various DataPower functionality.Thu, 19 Apr 2012 02:34:00 GMTdatapowerxsltxmlRobert Broeckelmannhttps://rcbj.net/blog/xslt-xpath/https://rcbj.net/blog/xslt-xpath/XSLT is the only scripting language supported by WebSphere DataPower appliances. It is the only way to customize DataPower functionality and behavior. So, anyone that works with DataPower for a while will sooner be writing XSLT stylesheets.Wed, 18 Apr 2012 02:32:00 GMTdatapowerquantum-computingwebspherexsltxmljavaRobert Broeckelmannhttps://rcbj.net/blog/sample-stylesheet-starting-point/https://rcbj.net/blog/sample-stylesheet-starting-point/I often have to go back and look up these details; so, I decided to post a standard starting point for a new stylesheet.Tue, 17 Apr 2012 02:33:00 GMTdatapowerxsltxmlRobert Broeckelmannhttps://rcbj.net/blog/protocol-transformations/https://rcbj.net/blog/protocol-transformations/Previously, I wrote a Wire Protocols post that outlined the common protocols that I’ve encountered when working with ESBs and SOA technology-especially DataPower. A primary function of an ESB is to provide the ability to convert service requests between these different protocols in a mostly…Fri, 13 Apr 2012 01:44:00 GMTdatapowerprotocolssoatlshttpintegrationRobert Broeckelmannhttps://rcbj.net/blog/privacy-policy/https://rcbj.net/blog/privacy-policy/I just added a Privacy Policy to ThinkMiddleware.com.Thu, 12 Apr 2012 01:45:17 GMTsite-newsprivacyintegrationRobert Broeckelmannhttps://rcbj.net/blog/what-is-a-web-service-what-is-a-service/https://rcbj.net/blog/what-is-a-web-service-what-is-a-service/I have watched this debate unfold at every client site I have visited in the past few years. There are several angles to this question. From a technical stand point, a service is a program that takes some type of input, performs a task, and return some type of output. This is vague. It can describe…Wed, 04 Apr 2012 03:33:00 GMTrestsoasoapweb-servicesRobert Broeckelmannhttps://rcbj.net/blog/generating-and-uploading-a-shared-key-symmetric-key-to-datapower-appliances/https://rcbj.net/blog/generating-and-uploading-a-shared-key-symmetric-key-to-datapower-appliances/DataPower does not seem to provide a tool to generate a Shared Key that can be used with 3DES or AES algorithms. DataPower does provide a tool for generating X509 private keys, certificate requests, and self-signed certificates-in the Crypto Tools section-but we are concerned with Shared Keys…Sun, 18 Mar 2012 01:16:00 GMTaesdatapowerkey-managementpkitlscryptographyRobert Broeckelmannhttps://rcbj.net/blog/service-mediation-vs-service-orchestration/https://rcbj.net/blog/service-mediation-vs-service-orchestration/I’ve wanted to define this term for a while, but, someone beat me to it several years ago. I generally agree with what these guys have to say. These terms are still in use today at client sites where DataPower and the IBM SOA stack is being deployed. Service Mediation logic is the application of…Sun, 11 Mar 2012 01:24:00 GMTdatapowersoaweb-servicesintegrationRobert Broeckelmannhttps://rcbj.net/blog/data-transformations/https://rcbj.net/blog/data-transformations/In a previous post, I described the different types of Data Formats that are commonly used with ESBs, XML Gateways, and SOA. Converting from one format to another is a common task performed by an ESB or XML Gateway. One can make arguments either way about whether this functionality should exist in…Sun, 04 Mar 2012 01:38:00 GMTdatapoweresbprotocolssoaxmlintegrationRobert Broeckelmannhttps://rcbj.net/blog/data-formats/https://rcbj.net/blog/data-formats/To follow up on the Wire Protocol post, the next logical step in our SOA exploration is Data Formats. A web service message’s Data Format describes how the data is organized in the message.Sun, 26 Feb 2012 02:10:00 GMTdatapowerprotocolssoaweb-servicesintegrationRobert Broeckelmannhttps://rcbj.net/blog/wire-protocols/https://rcbj.net/blog/wire-protocols/Like so much of our computer industry, the ecosystem around SOA has many acronyms, buzzwords, and phrases that are supposed to mean something. Likewise, this jargon may be poorly defined or ambiguous. The posts that I have made over the past few months are slowly building up a common vocabulary…Sat, 18 Feb 2012 23:15:00 GMTesbprotocolssoaweb-serviceshttpRobert Broeckelmannhttps://rcbj.net/blog/recommended-reading-material-for-soa/https://rcbj.net/blog/recommended-reading-material-for-soa/Following up on the recommended reading lists I’ve posted recently, this post contains a list of the books and specifications that I direct people to about SOA.Sun, 12 Feb 2012 01:59:00 GMTdatapowerreading-listsecurity-architecturesoaweb-servicesRobert Broeckelmannhttps://rcbj.net/blog/soa-security-reading-material/https://rcbj.net/blog/soa-security-reading-material/At nearly every client site, I’m asked to put together a recommended reading list on a variety of subjects. Web Services security is generally among them. SO, I’m putting together a list of the links that usually make it on that list.Sun, 05 Feb 2012 01:34:00 GMTaesreading-listsoaweb-servicescryptographysecurityRobert Broeckelmannhttps://rcbj.net/blog/soa-actors/https://rcbj.net/blog/soa-actors/When I am describing complex SOA or Web Service architectures, environments, and scenarios to clients, I often use the term “SOA Actors” to generically refer to components of such environments in the abstract. I will often do the same on Thinkmiddleware.com posts. Here, I define what I mean by this…Sun, 29 Jan 2012 04:18:00 GMTenvironmentsesbsoaweb-servicesintegrationRobert Broeckelmannhttps://rcbj.net/blog/what-is-a-service-consumer/https://rcbj.net/blog/what-is-a-service-consumer/A Service Consumer is any tier of an organization’s systems that calls web services. These services could be implemented by SOAP, REST, XML over HTTP, EJBs, JMS or MQ applications, RMI, RPC, invocation of COBOL programs on a mainframe with 3270 screen-scraping, communication over a custom TCP…Sun, 22 Jan 2012 04:17:00 GMTrestsoasoapweb-serviceshttpstandardsRobert Broeckelmannhttps://rcbj.net/blog/what-is-a-service-provider/https://rcbj.net/blog/what-is-a-service-provider/A Service Provider is any tier or system in an organization’s environment that hosts web services (or services of any kind).Sun, 15 Jan 2012 04:16:00 GMTsoaweb-servicesRobert Broeckelmannhttps://rcbj.net/blog/what-is-an-esb/https://rcbj.net/blog/what-is-an-esb/In the past year, I have stood in a conference room at more than one client fielding a question along the lines of exactly what is an ESB? I’ve found that there is a wide variety of impressions about what exactly makes something an ESB. I’m hardly the first person to post something on the Internet…Sun, 08 Jan 2012 04:16:00 GMTesbsecurity-architectureweb-servicesRobert Broeckelmannhttps://rcbj.net/blog/what-is-a-soap-web-service/https://rcbj.net/blog/what-is-a-soap-web-service/A SOAP Web Service is any web service that is compliant with the SOAP 1.1 or SOAP 1.2 specs. When referring to a SOAP Web Service we will use the capitalized Web Service. This convention is followed by most publications within the industry.Thu, 05 Jan 2012 01:32:00 GMTsoasoapweb-servicesRobert Broeckelmannhttps://rcbj.net/blog/what-is-a-web-service-what-is-a-web-service/https://rcbj.net/blog/what-is-a-web-service-what-is-a-web-service/This one has probably been addressed many times. But, I needed a place to link to whenever it comes up in other posts. For our purposes, a Web Service is SOAP Web Service and a web service is anything acting as a web service in the generic sense.Thu, 05 Jan 2012 01:32:00 GMTsoasoapweb-servicesstandardsRobert Broeckelmannhttps://rcbj.net/blog/what-is-a-rest-web-service/https://rcbj.net/blog/what-is-a-rest-web-service/REST web services are not nearly as formalized as their SOAP equivalent. A REST web service adheres to the principals laid out in Roy Fielding’s PhD Thesis. REST stands for Representational State Transition.Thu, 05 Jan 2012 01:31:00 GMTrestsoapweb-servicesstandardsRobert Broeckelmannhttps://rcbj.net/blog/what-is-an-xml-gateway/https://rcbj.net/blog/what-is-an-xml-gateway/An XML Gateway is an externally-facing DMZ tier of a web services platform. Generally, this DMZ tier will be facing the Internet, but it may simply be between business units or facing a leased line connecting one entity to another. It can be implemented using a software solution (such as web…Sun, 01 Jan 2012 04:15:00 GMTdatapowernetwork-securitysoaweb-servicesxmlsecurityRobert Broeckelmannhttps://rcbj.net/blog/what-is-an-appliance-what-is-a-soa-appliance/https://rcbj.net/blog/what-is-an-appliance-what-is-a-soa-appliance/I suppose I’m switching gears a bit here back towards something almost philosophical rather than my usual concrete technical info So be it. In the last six months, I’ve been at several clients sites that are using SOA appliances to build XML Gateway and ESB patterns. I answer quite a few client…Sun, 25 Dec 2011 02:31:00 GMTassemblydatapoweresbsoaxmlnetworkingRobert Broeckelmannhttps://rcbj.net/blog/jvm-heap-gc-tuning/https://rcbj.net/blog/jvm-heap-gc-tuning/So, obviously, I haven’t posted anything here in a while🙂. Life has been busy. Starting several months ago, I left my job of four years and began independent consulting. Among other things, this means that the variety of topics discussed on thinkmiddleware.com should be more varied. I’m also going…Mon, 10 Oct 2011 02:53:08 GMTgarbage-collectionjvmmemory-managementintegrationjavaRobert Broeckelmannhttps://rcbj.net/blog/ibm-announced-the-new-xg45-datapower-appliance/https://rcbj.net/blog/ibm-announced-the-new-xg45-datapower-appliance/This is the first post on thinkmiddleware.com where we discuss DataPower. Guess what I’ve been doing with my career lately🙂.Thu, 06 Oct 2011 03:18:00 GMTdatapowersoaintegrationsecurityRobert Broeckelmannhttps://rcbj.net/blog/jboss-4-x-and-datasource-configuration/https://rcbj.net/blog/jboss-4-x-and-datasource-configuration/On JBoss 4.x, a MySQL datasource looks something like:Sun, 12 Jun 2011 01:14:40 GMTdata-securityj2eejbossjavaRobert Broeckelmannhttps://rcbj.net/blog/secure-identity-propagation-using-ws-trust-ws-security-and-saml2-ibm-impact/https://rcbj.net/blog/secure-identity-propagation-using-ws-trust-ws-security-and-saml2-ibm-impact/On April 13th, 2011, Ryan Triplett and I spoke at IBM Impact in Las Vegas. The topic was “Secure Identity Propagation using WS-Trust, WS-Security, and SAML2“. The PowerPoint presentation can be found here. The original abstract:Sat, 16 Apr 2011 06:07:05 GMTsamlspeakingws-securityws-trustidentitysecurityRobert Broeckelmannhttps://rcbj.net/blog/secure-identity-propagation-using-ws-trust-ws-security-and-saml2/https://rcbj.net/blog/secure-identity-propagation-using-ws-trust-ws-security-and-saml2/I gave the following presentation at IBM Impact in April, 2011.Sat, 16 Apr 2011 00:01:00 GMTsamlsoaspeakingweb-servicesws-securitysecurityRobert Broeckelmannhttps://rcbj.net/blog/http-client-form-based-authentication/https://rcbj.net/blog/http-client-form-based-authentication/This article continues the discussion started in the Servlet Authentication article. Here we discuss Form-Based authentication; another common form of authentication when Servlet technology is used.Sat, 11 Sep 2010 23:48:09 GMTauthenticationj2eehttpjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/servlet-container-authentication/https://rcbj.net/blog/servlet-container-authentication/There are three required authentication mechanisms supported by a compliant Servlet Container: HTTP Basic Authentication, Form-based Authentication, and CLIENT_CERT authentication. There is a fourth authentication method, DIGEST, that isn’t used very often in my experience. This final…Sat, 11 Sep 2010 23:20:40 GMTauthenticationj2eehttpjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/summary-of-j2ee-specs/https://rcbj.net/blog/summary-of-j2ee-specs/If you were ever looking for a summary of each version of the J2EE Spec, it can take a few minutes to find it. So, here is a summary. The J2EE Specification is actually collection of numerous different Java-based technology specifications.Sat, 11 Sep 2010 22:58:22 GMTj2eestandardsjavaRobert Broeckelmannhttps://rcbj.net/blog/jbossworld-2010-session-securing-jboss-services/https://rcbj.net/blog/jbossworld-2010-session-securing-jboss-services/On June 24, 2010, I gave a presentation at JBoss World in Boston. This was my second time at JBoss World. The presentation covered Securing JBoss Services. It explored the use of JaasSecurityDomain MBeans to configure SSL in JBoss 4.3 (also relevent for newer versions of JBoss) for various…Thu, 01 Jul 2010 21:18:00 GMTjbosspkispeakingtlsjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/jax-ws-example-with-jbossws-server-side/https://rcbj.net/blog/jax-ws-example-with-jbossws-server-side/In previous article, a very simple Web Application was presented. In any complex environment, there will often be multiple tiers within an application or environments hosting code/services for different teams. A common way of communicating within such environments is through SOAP-based Web Services…Tue, 06 Oct 2009 02:40:46 GMTenvironmentssoapweb-servicesjavaRobert Broeckelmannhttps://rcbj.net/blog/running-jboss-on-an-openjdk6-build/https://rcbj.net/blog/running-jboss-on-an-openjdk6-build/Recently, I had some free time and set out to bring up JBoss on OpenJDK6. In particular, I wanted to Run JBoss on an OpenJDK build that I personally compiled.Mon, 31 Aug 2009 03:58:07 GMTjbossjvmjavaRobert Broeckelmannhttps://rcbj.net/blog/j2ee-security-series/https://rcbj.net/blog/j2ee-security-series/An Openldap Directory Server JBoss 4.3.x Setup Adding Groups To OpenLdap Using OpenLdap as a User Repository with JBoss 4.3.xWed, 26 Aug 2009 17:27:58 GMTj2eejbossldapseriesjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/securing-the-jboss-jaas-subject-reader-application-with-j2ee-security/https://rcbj.net/blog/securing-the-jboss-jaas-subject-reader-application-with-j2ee-security/This article continues the J2EE Security Series from the past few months. Here we expand the Simple J2EE Web Application that was introduced in this article to use J2EE Security.Tue, 25 Aug 2009 20:03:54 GMTj2eejaasjbossjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/http-s-urls-context-roots/https://rcbj.net/blog/http-s-urls-context-roots/What is a URL? What is a context root? It’s helpful to understand these things when writing or working with web applications.Tue, 25 Aug 2009 18:39:56 GMThttpnetworkingRobert Broeckelmannhttps://rcbj.net/blog/a-simple-web-application/https://rcbj.net/blog/a-simple-web-application/In order to test J2EE Security with the Security Realm and Openldap User Repository we created in the last article in this series, we need an application to protect. The focus of this article is to create a very simple web application that can be protected by J2EE Security.Tue, 25 Aug 2009 17:08:31 GMTj2eeldapjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/j2ee-security/https://rcbj.net/blog/j2ee-security/The article continues the series discussing J2EE Security and its related concepts. The following brings together the numerous concepts discussed in the past articles.Mon, 15 Jun 2009 02:03:09 GMTj2eejavasecurityRobert Broeckelmannhttps://rcbj.net/blog/role-mapping-j2ee-security/https://rcbj.net/blog/role-mapping-j2ee-security/The discussion of J2EE Security on the JBoss Application Server continues as Role Mapping is introduced.Mon, 15 Jun 2009 01:47:35 GMTj2eejbossjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/using-openldap-as-a-user-repository-with-jboss-4-3-x/https://rcbj.net/blog/using-openldap-as-a-user-repository-with-jboss-4-3-x/This article continues our discussion of setting up J2EE Security in a JBoss 4.3.x container. In the last article, we completed the setup of an OpenLdap database that can be used as a User Repository.Mon, 15 Jun 2009 01:42:14 GMTj2eejbossldapjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/adding-groups-to-openldap/https://rcbj.net/blog/adding-groups-to-openldap/This article describes how to setup an OpenLdap server and add inetperson user objects. However, the article didn’t describe how to add groups to OpenLdap and add users to the groups.Mon, 15 Jun 2009 00:46:36 GMTj2eeldapinfrastructuresecurityRobert Broeckelmannhttps://rcbj.net/blog/url-html-character-representation/https://rcbj.net/blog/url-html-character-representation/I’ve had to look up the HTML codes for special characters like space many times. In fact, while writing blog entries for Thinkmiddleware.com, I’ve had to stop and look up the HTML code for less-than sign and greater-than sign one to many times. I just haven’t bothered memorizing them.Wed, 13 May 2009 14:08:27 GMTjvmweb-application-securityhttpintegrationRobert Broeckelmannhttps://rcbj.net/blog/jboss-4-3-x-setup/https://rcbj.net/blog/jboss-4-3-x-setup/This article explains how to install and start the JBoss “default” server.Sun, 26 Apr 2009 11:37:39 GMTjbossinfrastructurejavaRobert Broeckelmannhttps://rcbj.net/blog/capturing-network-communication-between-two-processes-on-the-same-machine/https://rcbj.net/blog/capturing-network-communication-between-two-processes-on-the-same-machine/Have you ever run snoop on Solaris or tcpdump on Linux or AIX and discovered that these tools cannot capture IP-based communication that occurs between two processes on the same machine? Or, Wireshark (formerly, Ethereal) on Windows? Only to discover the same limitation?Tue, 07 Apr 2009 18:14:57 GMTlinuxtroubleshootingoperating-systemsjavanetworkingRobert Broeckelmannhttps://rcbj.net/blog/capturing-jvm-tcp-traffic/https://rcbj.net/blog/capturing-jvm-tcp-traffic/Any time you have a distributed application, there is network communication involved. Capturing this network traffic can be instrumental in diagnosing and solving problems. Generally, to capturing network traffic, superuser privledges, timing, and a bit of luck is needed. Often, the appropriate…Fri, 03 Apr 2009 23:38:19 GMTdebuggingjvmtroubleshootingjavanetworkingRobert Broeckelmannhttps://rcbj.net/blog/websphere-v6-x-classloaders/https://rcbj.net/blog/websphere-v6-x-classloaders/Building on the ideas introduced in the last article, a J2EE Application servers classloaders are explored in this installment. In particular, Websphere Application Server v.6.x Classloaders are introduced. The J2EE Spec provides some guidance regarding J2EE Application Servers, but as with so many…Sat, 21 Feb 2009 23:47:07 GMTclassloadersj2eejvmtroubleshootingwebspherejavaRobert Broeckelmannhttps://rcbj.net/blog/jee-6-draft-proposal-is-available-for-public-review/https://rcbj.net/blog/jee-6-draft-proposal-is-available-for-public-review/Check out JSR 316 and this article. There is also a Slashdot.org thread on the subject.Sun, 01 Feb 2009 03:36:37 GMTconcurrencyj2eestandardsjavaRobert Broeckelmannhttps://rcbj.net/blog/java-virtual-machine-classloaders/https://rcbj.net/blog/java-virtual-machine-classloaders/Classloaders are responsible for finding and loading classes that are requested in Java code executed inside a Java Virtual Machine. Classloader-related issues are among the most difficult to troubleshoot in the Java/J2EE technology stack.Mon, 19 Jan 2009 04:50:57 GMTclassloadersj2eejvmsecurity-architecturetroubleshootingjavaRobert Broeckelmannhttps://rcbj.net/blog/site-maintenance-clean-up/https://rcbj.net/blog/site-maintenance-clean-up/The older articles predating the use of WordPress are slowly being copied over to the WordPress format. This provides a common look & feel and allows WordPress seach functionality, RSS feeds, and other goodies to work properly with the older content.Sun, 11 Jan 2009 01:40:55 GMTsite-newsRobert Broeckelmannhttps://rcbj.net/blog/computer-measurement-prefixes-and-number-naming-conventions/https://rcbj.net/blog/computer-measurement-prefixes-and-number-naming-conventions/I always forget the quantity prefixes above “tera”. Even more interestingly, one rarely thinks about the numbers’ names. For example, consider the numberSat, 10 Jan 2009 12:02:54 GMTjvminfrastructureRobert Broeckelmannhttps://rcbj.net/blog/jvm-process-virtual-memory-usage-resident-set-size-on-a-linux-2/https://rcbj.net/blog/jvm-process-virtual-memory-usage-resident-set-size-on-a-linux-2/This article expands on the previous Virtual Memory post by exploring Resident Set Size growth while running a Java program that will consume all available Java Heap memory. Four different JVM implementations are used to compare results of these experiments. These JVMs come from two different…Thu, 01 Jan 2009 21:41:04 GMTjvmlinuxmemory-managementoperating-systemsjavaRobert Broeckelmannhttps://rcbj.net/blog/google-browser-security-handbook/https://rcbj.net/blog/google-browser-security-handbook/Google has released a Browser Security Handbook online. It can be found here.Thu, 01 Jan 2009 18:38:22 GMTreading-listweb-application-securitysecurityRobert Broeckelmannhttps://rcbj.net/blog/virtual-memory-linux/https://rcbj.net/blog/virtual-memory-linux/It has been a couple of weeks since the last article was published. Recently, I had to dig into Virtual Memory on AIX to work through some issues. I realized there were several details I needed to explore further to understand Virtual Memory implementations. In particular, the implementation…Sun, 28 Dec 2008 19:41:55 GMTlinuxmemory-managementtroubleshootingoperating-systemsRobert Broeckelmannhttps://rcbj.net/blog/dumping-the-contents-of-a-jaas-subject/https://rcbj.net/blog/dumping-the-contents-of-a-jaas-subject/In the last article, JAAS was introduced. An authenticated calling-entity (perhaps a user), has a JAAS Subject. This JAAS Subject contains some combination of Principals, Public Credentials, and Private Credentials. It can be very helpful to dump the contents of this JAAS Subject for debugging…Sun, 07 Dec 2008 08:07:26 GMTauthenticationdebuggingjaasjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/jaas-authentication-an-introduction/https://rcbj.net/blog/jaas-authentication-an-introduction/This article introduces JAAS authentication via a relatively simple example. The example presented here is based upon the Sun tutorial of the same subject. The thinkmiddleware.com example extends the tutorial to use LDAP to authenticate users.Sun, 30 Nov 2008 08:31:19 GMTauthenticationj2eejaasldapjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/an-openldap-directory-server/https://rcbj.net/blog/an-openldap-directory-server/The recent JNDI article and an upcoming JAAS article require an LDAP server. This tutorial will walk through the basic details of reproducing the Openldap Server used in these two articles.Sat, 29 Nov 2008 10:02:33 GMTj2eejaasldapjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/jndi-java-naming-directory-interface/https://rcbj.net/blog/jndi-java-naming-directory-interface/While researching an upcoming JAAS article, the decision was made to use JNDI to interact with the Openldap server that was stored user information. JNDI is used extensively in the J2EE landscape; so, exploring JNDI separately from JAAS seemed in order.Wed, 26 Nov 2008 23:34:15 GMTj2eejaasldapjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/ant-build-control/https://rcbj.net/blog/ant-build-control/I’ve mentioned that for larger projects/examples on thinkmiddleware.com, Ant would be used. The Java Security Manager article was the first time it was used. Although, the full details of the source code were not included, Ant was used.Sat, 22 Nov 2008 19:57:26 GMTintegrationjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/the-java-security-manager/https://rcbj.net/blog/the-java-security-manager/In the last post, the Java Standard Edition and Java Enterprise Edition security features were introduced. This is the second in a series of articles that introduces each Java security feature in depth. This article introduces the Java Security Manager and the sandbox it creates for a Java…Sat, 15 Nov 2008 13:16:06 GMTjvmjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/java-security-the-low-level-details-to-j2ee-security-and-beyond/https://rcbj.net/blog/java-security-the-low-level-details-to-j2ee-security-and-beyond/While researching details for a Java Security Manager article, it became obvious that I didn’t understand the mappings of all the different Java, security-related specifications to the technologies and acronyms I knew. Thus, was the beginning of this article. Below each security-related feature in…Sat, 08 Nov 2008 23:12:26 GMTj2eejvmjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/java-networking-api-vs-the-c-library-networking-api/https://rcbj.net/blog/java-networking-api-vs-the-c-library-networking-api/The original article is located here. In this article, I described what was involved in writing a server program in the C language. The details are not important, but I wanted to compare the details that are exposed in this relatively simple C network programming example with the equivalent Java…Sun, 02 Nov 2008 11:15:12 GMTccareerjavanetworkingapisRobert Broeckelmannhttps://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-4/https://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-4/The original article can be found here. IntroductionSat, 01 Nov 2008 00:14:09 GMTconcurrencyjvmperformancetroubleshootinghttpjavaRobert Broeckelmannhttps://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-3/https://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-3/This is part three of an exploration of how concurrency in networking APIs works in Unix-like operating systems and Java technology. This article now looks at the Java equivalents of several C-based server implementations that have been presented. If you haven’t read this series from the beginning,…Thu, 30 Oct 2008 18:10:24 GMTconcurrencyjvmperformancetroubleshootinghttpjavaRobert Broeckelmannhttps://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-2/https://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-2/In the second part of this series we continue to explore how Unix-like operating systems implement the networking API and threading API. In particular, we are supremely interested in how the kernel allows server programs accept incoming connections. Part two explores implementing concurrency in…Tue, 28 Oct 2008 01:00:45 GMTconcurrencyjbossjvmhttpjavanetworkingRobert Broeckelmannhttps://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-1/https://rcbj.net/blog/concurrency-and-server-side-networking-apis-part-1/This article explores how a Sun Hotspot JVM behaves when accepting incoming TCP/IP socket connections. The behavior of native server programs–written in C–are also explored to better understand how concurrency can be achieved. Then, a comparison of how these runtime environments implement…Sun, 26 Oct 2008 23:22:13 GMTconcurrencyjvmperformancehttpjavanetworkingRobert Broeckelmannhttps://rcbj.net/blog/threads-threads-everywhere-and-not-a-needle-in-sight/https://rcbj.net/blog/threads-threads-everywhere-and-not-a-needle-in-sight/Several terms have been used liberally throughout articles on thinkmiddleware.com. A moment should be taken to formally define them. I am going to attempt to present these concepts in as generic a sense as possible, but the truth of the matter is, every OS has its own threading model and…Sun, 19 Oct 2008 23:18:46 GMTconcurrencyjvmperformancetroubleshootingintegrationjavaRobert Broeckelmannhttps://rcbj.net/blog/mapping-an-lwp-using-excessive-cpu-time-to-a-java-thread/https://rcbj.net/blog/mapping-an-lwp-using-excessive-cpu-time-to-a-java-thread/It happens. End users are complaining about a slow system or a request that never returned. You log into a production middleware server and notice that a java process is consuming an entire CPU or worst every available CPU on the box. It has happened again–a thread(s) has gone into an infinite loop…Sun, 19 Oct 2008 21:16:50 GMTconcurrencyjvmtroubleshootingintegrationjavaRobert Broeckelmannhttps://rcbj.net/blog/configure-your-jvm-for-use-with-a-remote-debugger/https://rcbj.net/blog/configure-your-jvm-for-use-with-a-remote-debugger/As I’ve pointed out in several previous articles, I like the jdb command line debugger that is available with the Sun JDK. This debugger can actually be used with any spec-compliant JVM. The JPDA specification defines the interfaces and services that are used by remote debuggers and profiles. The…Sat, 18 Oct 2008 21:06:11 GMTdebuggingjvmtoolsinfrastructurejavaRobert Broeckelmannhttps://rcbj.net/blog/generating-thread-dumps/https://rcbj.net/blog/generating-thread-dumps/Thread dumps are the basic diagnostic tool for JVMs. Thread dumps present a partial state of each Java thread in a running JVM. I say partial because it doesn’t present all information that captures the state of a Java thread. The state of a running Java thread is stored in a series of data…Sat, 18 Oct 2008 20:57:13 GMTconcurrencyjbossjvmperformancetroubleshootingjavaRobert Broeckelmannhttps://rcbj.net/blog/my-jvm-ran-out-of-memory-what-objects-are-consuming-all-of/https://rcbj.net/blog/my-jvm-ran-out-of-memory-what-objects-are-consuming-all-of/This article isn't a comprehensive JVM Java heap sizing and garbage collection tuning document; its goal is simply to outline options for identifying which type of Object(s) are consuming the majority of memory in a running JVM--troubleshooting memory leaks in the Java heap. As usual, I focus on…Thu, 16 Oct 2008 20:48:56 GMTgarbage-collectionjbossjvmmemory-managementtroubleshootingjavaRobert Broeckelmannhttps://rcbj.net/blog/troubleshooting-deadlock-conditions-with-monitor-locks-in-java-virtual-machines/https://rcbj.net/blog/troubleshooting-deadlock-conditions-with-monitor-locks-in-java-virtual-machines/In this article, I wanted to present a brief tutorial regarding troubleshooting deadlock conditions in JVMs. Before one can troubleshoot a deadlock condition, one needs to understand what it is; to this end, I have written a simple Java program called DeadLock.java, which is guaranteed to very…Tue, 14 Oct 2008 20:48:29 GMTconcurrencyjvmperformancetroubleshootingjavaRobert Broeckelmannhttps://rcbj.net/blog/the-definition-of-reverse-engineering-jvms-and-the-java-programming-language/https://rcbj.net/blog/the-definition-of-reverse-engineering-jvms-and-the-java-programming-language/I recently had a conversation with a colleague that reminded me of a another discussion with my Masters Project advisor a couple of years ago when I was exploring research topics. The topic under discussion was Reverse Engineering --in particular, Software Reverse Engineering. It sounds really…Sun, 12 Oct 2008 20:11:20 GMTreverse-engineeringjavaRobert Broeckelmannhttps://rcbj.net/blog/ejb-vs-web-services/https://rcbj.net/blog/ejb-vs-web-services/This article is by no means an exhaustive discussion on the subject of Web Services and EJBs. But, I have often found many of the points I bring up here missing from meaningful debate. Researching this article also gave me an opportunity to go over material I've been wanting to read for a while now.Mon, 06 Oct 2008 20:07:51 GMTj2eejbossperformanceweb-serviceswebspheresecurityRobert Broeckelmannhttps://rcbj.net/blog/the-java-instruction-set-assemblers-and-disassemblers/https://rcbj.net/blog/the-java-instruction-set-assemblers-and-disassemblers/Note: this is another article that I wrote a while ago using a Java Disassembler that no longer seems to be available--d-Java. There are numerous Java Disassemblers on the Internet. Two more that could be used are mentioned in the reference section: Jasper & Kimera. They can produce the Jasmin…Sun, 05 Oct 2008 20:03:19 GMTassemblyjvmjavaRobert Broeckelmannhttps://rcbj.net/blog/generating-thread-dumps-from-a-sun-or-ibm-jvm-running-as-a/https://rcbj.net/blog/generating-thread-dumps-from-a-sun-or-ibm-jvm-running-as-a/I was recently asked if there was a way to generate a Thread Dump from a JVM running as a Windows Service. It occured to me that I had a similar issue during my Masters Project when I was trying to generate a thread dump from a Cygwin xterm; Googling at the time turned up no good way of accomplishing the task. But, I knew that you could use the Java Debugger that ships with the Sun JDK, jdb, to generate a thread dump of all non-System Threads in a JVM. I posed this as a solution to generating Thread Dumps from a JVM running as a Windows Service.Mon, 29 Sep 2008 19:28:10 GMTdebuggingjvmlinuxtroubleshootingoperating-systemsjavaRobert Broeckelmannhttps://rcbj.net/blog/performance-tuning-in-industry/https://rcbj.net/blog/performance-tuning-in-industry/IT Professionals face an up hill battle in the realm of performance tuning. First, management must be convinced that time needs to be set aside for it. Next, the skill sets to successfully move through the performance tuning life cycle must be present. Then, the tools to effectively identify issues…Mon, 29 Sep 2008 19:16:15 GMTj2eeperformanceoperating-systemsjavaRobert Broeckelmannhttps://rcbj.net/blog/part-2-custom-client-server-java-application-that-communicatesover-a-mutually-authenticated/https://rcbj.net/blog/part-2-custom-client-server-java-application-that-communicatesover-a-mutually-authenticated/This is the second of a two-part series discussing Java and Mutually Authenticated SSL. This will gave you a taste of how a J2EE container is communicating (over SSL or MASSL) behind the scenes.Thu, 11 Sep 2008 19:02:01 GMTauthenticationj2eepkitlsjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/part-1-creating-your-own-ssl-certificates-for-a-custom-java-client/https://rcbj.net/blog/part-1-creating-your-own-ssl-certificates-for-a-custom-java-client/If you replace the steps for creating your own CA private key & certificate and signing your own certificate (with the CA) with having certificates signed by a legitimate Certificate Authority, you've got the basic idea behind creating/ordering certs for most situations.Wed, 27 Aug 2008 18:09:41 GMTkey-managementpkitlsjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/achieving-highly-available-http-database-session-persistence-spanning-multiple-cells-with-websphere/https://rcbj.net/blog/achieving-highly-available-http-database-session-persistence-spanning-multiple-cells-with-websphere/Websphere can provide HTTP Session data replication across multiple clusters and cells by using database session persistence.Sun, 24 Aug 2008 18:03:48 GMTj2eespeakingwebsphereinfrastructurejavaapisRobert Broeckelmannhttps://rcbj.net/blog/references-i-cited-in-my-masters-project/https://rcbj.net/blog/references-i-cited-in-my-masters-project/This week (er, quarter), I wanted to share the references I used while researching my Masters Project. It’s a collection of about fifty web links and books that I found helpful. Reading this stuff and staring at long sequences of numbers represents about eighteen months of my life. More information…Fri, 21 Mar 2008 03:13:00 GMTreading-listspeakingRobert Broeckelmannhttps://rcbj.net/blog/these-are-the-references-i-cited-in-my-masters-project-defense/https://rcbj.net/blog/these-are-the-references-i-cited-in-my-masters-project-defense/So, obviously, I haven’t been adding to this site nearly as often as I had hoped. This week (er, quarter), I wanted to share the references I used while researching my Masters Project. It’s a collection of about fifty web links and books that I found helpful. Reading this stuff and staring at long…Thu, 20 Mar 2008 06:05:16 GMTreading-listspeakingRobert Broeckelmannhttps://rcbj.net/blog/masters-project-defense/https://rcbj.net/blog/masters-project-defense/On November 29, 2007, I gave my Masters Project Defense before Dr. Chris Gill, Dr. Cindy Grimm, and Dr. Roger Chamberlain. This is the presentation. I’m posting it here because it involved analyzing low-level details of a Sun JVM running JBoss 3.x.Sun, 02 Dec 2007 03:11:00 GMTj2eejbossperformancespeakingjavasecurityRobert Broeckelmannhttps://rcbj.net/blog/masters-project/https://rcbj.net/blog/masters-project/On November 29, 2007, I gave my Masters Project Defense before Dr. Chris Gill, Dr. Cindy Grimm, and Dr. Roger Chamberlain. This is the presentation.Sat, 01 Dec 2007 06:03:27 GMTspeakingRobert Broeckelmannhttps://rcbj.net/blog/presentation-i-gave-to-the-cs450-video-game-programming-class-at-wash/https://rcbj.net/blog/presentation-i-gave-to-the-cs450-video-game-programming-class-at-wash/Here is the presentation.Mon, 15 Oct 2007 06:02:22 GMTpersonalspeakingRobert Broeckelmannhttps://rcbj.net/blog/flying-over-mars/https://rcbj.net/blog/flying-over-mars/I’ve had this one sitting on the shelf for a while. The last semester of my undergraduate program at Wash U., I created a flight simulator program that could be used to view Martian terrtain data. We created this by grabbing a series of still shots while the flight simulator was running.Fri, 09 Feb 2007 06:01:36 GMTpersonalRobert Broeckelmannhttps://rcbj.net/blog/the-first-1500-hamming-numbers/https://rcbj.net/blog/the-first-1500-hamming-numbers/I haven’t had a chance to post anything here since the beginning of last semester. I’m in a class at the moment where all of the programming assignments involves annoying little math algorithms. The most recent required us to generate the first N hamming numbers using an efficient algorithm that…Tue, 30 Jan 2007 05:59:51 GMTjvmmathematicsmemory-managementjavaRobert Broeckelmannhttps://rcbj.net/blog/jcup-jflex-with-ant/https://rcbj.net/blog/jcup-jflex-with-ant/I’ve been bogged down in work and school lately. So, it has been a while since I’ve written anything. This semester I’m taking an Instruction Set Architecture course at Wash U–basically, the final project is to design a processor with VHDL in ModelSim. I think I’m going to stick to software.…Sat, 18 Nov 2006 03:31:00 GMTassemblyccompilerspersonalRobert Broeckelmannhttps://rcbj.net/blog/using-jcup-jflex-with-ant/https://rcbj.net/blog/using-jcup-jflex-with-ant/I’ve been bogged down in work and school lately. So, it has been a while since I’ve written anything. This semester I’m taking an Instruction Set Architecture course at Wash U–basically, the final project is to design a processor with VHDL in ModelSim. I think I’m going to stick to software.…Fri, 17 Nov 2006 05:56:33 GMTassemblyccompilerspersonalRobert Broeckelmannhttps://rcbj.net/blog/linux-kernel-modules/https://rcbj.net/blog/linux-kernel-modules/I’m reading the book Linux Device Drivers to get up to speed on writing Linux modules; I’ll be using this for an upcoming project, if all goes according to plan. This isn’t much, but if you need to get the most basic of kernel modules built, this is what you need to do.Sun, 17 Sep 2006 05:58:39 GMTlinuxoperating-systemsRobert Broeckelmannhttps://rcbj.net/blog/examining-the-call-stack-with-gdb/https://rcbj.net/blog/examining-the-call-stack-with-gdb/This will be the second Blog entry I’ve made. I need to come up with a fancier welcome and introduction to each of these things. I started the forth semester of CS Masters program at Wash U. last week. I’ve got a lot of reading to do.Sun, 03 Sep 2006 05:54:35 GMTcdebuggingpersonalRobert Broeckelmannhttps://rcbj.net/blog/flex-bison-example-using-microsoft-visual-c-7-0/https://rcbj.net/blog/flex-bison-example-using-microsoft-visual-c-7-0/Well, I guess this is my first Blog entry. I’m at the tail end of the four weeks I’ve had between the end of summer school and the beginning of the Fall semester. I’m working on a CS Masters degree at Washington University in St. Louis.Mon, 28 Aug 2006 05:51:57 GMTccompilersRobert Broeckelmannhttps://rcbj.net/blog/universal-exterminator/https://rcbj.net/blog/universal-exterminator/I took CS450–Game Programming– at Wash U in Fall, 2005. This was the result. This was the end result. My group called themselves “Die Sphere, Die!”–you may notice our logo pop up occasionally.Mon, 21 Aug 2006 05:48:09 GMTpersonalainetworkingRobert Broeckelmann