We're a bearer token company

It was mentioned in a meeting in my first week that we're a bearer token company. The more I learn about my job and the different aspects of our company, the more I realize how true it is.

I've used tokens in the past and they have many definitions. Just type define: token in Google search.

Tokens in computer software - and in our company - provide identity delegation. They can be proxies for you so you don't have to keep logging into different sites with the same username/password, which is the idea behind SSO (Single-Sign On).

A user logs in once and a token is then used in their place when they want to use a service that's outside of their initial domain where they logged in first. Ping Federate bears the brunt of creating the token and passing it between disparate domains, saving the expense. For example, a user would login to United Airlines to buy a round-trip ticket. That user would also need to rent a car so United would use our SSO Ping Federate solution to allow a token to be passed from United to Hertz so the user could rent a car and not have to login again when transfered to the Hertz rental site.

Since tokens are the basis of communication between our federated servers, they can be quite simple, from passing on basic user credentials, or the more complex, providing further information or attributes to a requesting service provider.

In the beginning I had a bit of confusion with some terms that really meant the same thing. Since a lot of terms overlap I'll just list them here.

We use SAML tokens. These are the same as SAML assertions (or to be exact, are enclosed within a SAML message), which are basically XML documents sent over the wire. Whether you use token, assertion, SAML message, SAML assertion, XML assertion, in many ways, they are all synonymous terms. They provide the mechanism to proxy for an initial sign-in and pass that sign-on to another domain. By passing on the initial sign-on we are forwarding assertions about the initial users credentials.

Assertions are also called claims. Since tokens contain assertions/claims, you can have simple claims that state who you are (basic authentication) to more extensive assertions/tokens/claims (see how I interchange them?) that also authenticate you and/or provide more attributes about who you are. It all depends on what you want an assertion/token to do and what is requested by the service you are trying to access.

This is the basis of what we do.

find and locate

I've been using Unix find on the command line for many years and it's certainly saved me some time trying to find files or strings within files.

Here's an example usage that I've liked to use:

find . -name "*.java" -exec grep -l "Boolean" {} \;

This will find all java files from the current directory down that contain the string Boolean and then list their paths.

For something a little more basic where I just need to search for file extension types I use something like this:

find . -name "*.properties" -print

But, one thing I never heard about until yesterday was the locate command.

Locate uses indexed search results and was helpful when I was trying to find some JAR files in a local repository.

Basically it takes find and cron together, run at scheduled intervals, to index the local filesystem. Then when you use locate, it will use that index to quickly give back results, that might have taken long with just the find command.

Mystery of the Nile bluray

Watched for a second time the IMAX movie Mystery of the Nile on Bluray.

Out of five IMAX blurays I own this is one of my favorites.

I like the raft journey from Lake Tana in Ethiopia to the mouth of the Nile at Alexandria.

They visit some amazing sites like rock monolith churches in Lalibela, the Meroe pyramids in Sudan where the Kingdom of Kush existed around 1500 B.C., and Luxor, Egypt.

Doing a third to half of what they rafted or maybe puddle jumping with a plane from some of the highlights would be quite cool.

digital certificates, keys, and message validation

I've been exploring digital certificates a little more in depth this week. They're basically analogous to a "drivers license" in the digital domain.

A drivers license basically allows you to validate who you are (e.g, a face to a name, your age, etc...) to an authority who would like to authentiate and authorize you (maybe a policeman or door man) based on their trust in the authority that issued your license; usually the DMV. Because the license is hard to duplicate and has a certain format (being laminated, has your photo, and a magnetic strip and/or watermarks) the authority has provided strong backing validation when you present your license to third parties like a policeman or other authority figures. Therefore trust and authentication are - hopefully - maintained when you use a license.

An equivalent type of license that validates who you are and is used over the Internet is called a Digital Certificate. Although it might not validate your age, it will help validate a message or document that you might send along with it to the person you are sending it to.

Obviously, drivers licenses offer a lot of private information when you view them: photo, age, address, etc... You keep your license information private by keeping it in your wallet. Digital certificates don't have the same information. They do provide some identity information of who the individual or server is just like a drivers license, but unlike a drivers license a digital certificate provides a mechanism to encypt an exchange (aka transaction) between a client and a server; and itself can be encrypted too.

And since sensitive transactions happen over the Internet, where a sophisticated individual can intercept your credit card information, encryption needs to happen for almost all stages of a transaction (or depending on your level of need).

In this case, a digital certificate is used by a server to authenticate who they are to a client browser. Amazon, for example, sends you a digital certificate to authenticate itself to your browser and then encrypts your shopping cart transaction, etc...

New to Cobertura

Finally got to use Cobertura. I initially started working with the 1.9 build but then decided to use 1.9.4.1, which worked quite well. If I can, I'll always use the latest version.

Took me about a week of experimenting with it - in addition to other duties - to get a handle on the process for creating accurate Cobertura coverage reports.

Some of the things that got me during the initial week were: 1) 100% coverage reports (when I knew there wasn't 100% coverage), 2) using the ant tasks effectively, 3) having an incomplete cobertura.ser be generated by JBoss (in addition to a cobertura.ser.lock file), and 4) having cobertura work with my Eclipse instance where I'd run my junit/htmlunit tests.

For #1 I had to merge the originally created cobertura.ser files (when I instrumented the JAR files I needed) with the one created when running JBoss and the htmlunit tests through the Eclipse IDE. I ultimately used the cobertura ANT task cobertura-instrument to explicitly create a ser datafile while instrumenting, and then used cobertura-merge to merge the ser files together after running my tests.

For #2, I got to know the Ant Task Reference page from the cobertura sourceforge page, which was helpful.

For #3, I'd get an incomplete ser file created after running my htmlunit test cases against a running JBoss server with my deployed application. I'd always have a cobertura.ser.lock file too. One thing I noted was if I had been running multiple test suites after each other and data.zip files would be created. I would try to delete old ones and that seemed to solve most of my lock file issues.

For #4, I had to have Eclipse Helios with the development packages, along with the test packages I was using to test the application's admin interface. I was able to run suite test classes that would have up to 700 tests by running as Junit, and of course, I made sure JBoss was up and running with my deployed application; either created from my dev folder using a maven command or getting a build from Hudson. Either way worked.

Creating keystore for Tomcat 6

I've been training on Ping Identity's Ping Federate server the last two weeks. This week I'm setting up separate Tomcat servers to interact with the Ping Federate servers; on both the identity and service provider servers. Before, I hosted the quickstart apps on the same server instance as Ping Federate.

To setup SSL with Tomcat I needed to edit the server.xml file under the conf directory and then create a keystore file that Tomcat will use to verify trusted certificates sent from the federated servers.

The initial command I ran was:

>>>> : keytool -genkey -alias amf -keyalg RSA -keystore tomcat.keystore [-file 111C353A88F.crt]

The last part of the command with the -file command line argument wasn't needed. I basically created a keystore file named tomcat.keystore and a new self-signed certificate where the Java keytool prompted me with some questions listed below:

Enter keystore password:
Re-enter new password:
What is your first and last name?
[Unknown]: Andrew Fernandez
What is the name of your organizational unit?
[Unknown]: Engineering
What is the name of your organization?
[Unknown]: Ping Identity
What is the name of your City or Locality?
[Unknown]: Denver
What is the name of your State or Province?
[Unknown]: CO
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=Andrew Fernandez, OU=Engineering, O=Ping Identity, L=Denver, ST=CO, C=US correct?
[no]: yes

Enter key password for
(RETURN if same as keystore password):


After this I verified what was in my keystore using this command:

>>>> : keytool -list -v -keystore tomcat.keystore

Since I didn't yet have the certificate from the federate side I then ran this command, making sure I had the *.crt file I needed to place in the keystore in the same directory:

>>>>> : keytool -import -trustcacerts -alias amf2 -file 111C353A88F.crt -keystore tomcat.keystore

Finally I use export the base certificate from Tomcat and import into my Federated server

>>>>> : keytool -exportcert -alias amf -file amfIDP -keystore tomcat.keystore

Where -alias is what the certificate goes by in the keystore file, -file is what I want to call the exported certifacate, and -keystore the actually keystore where I'll be getting the certifcate to export from.

Deletion is pretty straighforward:

>>>>> : keytool -delete -alias amf -keystore tomcat.keystore

Just specify -delete, -alias the certificate you want to delete, and the keystore you want to delete from

Mac OS X differences from Windows

Having started the new job at Ping Identity I now have a MacBook Pro with OS X.

I've had to get used to two notable differences:

1) Window resizing on the OS X is only on the lower right-hand corner versus Windows XP which can be on the bottom and sides too.

2) Copying and pasting in the Finder (which is the equivalent of Windows Explorer) is not like Windows. If I chose a file and copy it I cannot just highlight a new directory and choose paste. I actually have to enter into the directory and paste making sure the dialog title for the Finder lists the correct directory where I want to paste.

At least that's what works for me without any special changes to the OS.