Some Thoughts on IdM, SSO, SAML and CAS

We are having a hot summer time here, so sharing clever thoughts has become challenging for me. Nevertheless, I would like to write some words here, in short: "Identity Management".

Based on my last experience from diving into the world of unknown, or in other words: "the experience from hardening my knowledge base", I'm starting to redefine my learning principles. Earlier I had an opinion that the best, yet structured, way to learn something big and new is to find a new book (bible) and just to read it from cover to cover. And only after such a hard reading, with hands-on exercises, one could be able to form some conclusions and feel more comfortable in that new area.

I followed this path last time as well and I have read the whole book: "Identity Management: Concepts, Technologies, and Systems".

And ... I don't feel much more clever now :)

The fact is, the book offers an in-depth understanding of how to design, deploy and assess identity management solutions. It provides a comprehensive overview of current trends and future directions in identity management, including best practices, the standardization landscape, and the latest research finding.

But this book is to much theoretical and overly one-concept-oriented. Note that reading this book sooner or later you will punch the head against the wall called: "SAML" :)

I'm not saying that SAML is bad or even that it is not worth reading about, etc, I'm just saying that the book, the concept of IdM, has to narrow description (you could learn even more about SAML from wikipedia and its references).

I'm just asking myself silently, where are more chapters about SSO, IdM solutions, protocols, e.g.: CAS, JOSSO, Athens, OpenAM? ;)

After finishing this book I was still hungry for knowledge about the IdM (especially about the SSO solutions), so I went googling for more. I was more than happy about the results finally. I have found plenty of articles about CAS usage and what is more interesting, I have come across the "CAS and APEX integration" tutorial.

I have done the whole example and I must say that CAS integrates smoothly with APEX. Moreover the author gives more good advices for APEX, open web solutions, hardening, e.g. using ModSecurity.

Resume:
Never stop searching :) and nevertheless the bad experience from the last book, next time I will try to
search for better "bible" ;)

P.S. If you can do something with APEX smoothly (in this case CAS integration) you will be able to do it with Java and so on.

Disclaimer: I did not get paid to review this book, and I do not stand to gain anything if you buy the book. I have no relationship with the publisher or the author.

Oracle Apex Asks: “Where is Tomcat?”

A few days ago I had to check one particular Apex plug-in for simple PDF printing. As you remember from my previous post, my newly installed laptop didn't have any Oracle DB sandbox, so I was 'forced' to make a quick decision: 'to do a full installation or to find some pre-installed Oracle virtual image'. I did some google search and the answer came sooner then I expected. The Oracle has a fully prepared DB environment and what is more interesting this DB image had 'Application Express 4.0.0.00.46' so I was really surprised.

To give more details, the following products are pre-installed and ready to go:

• Oracle Enterprise Linux 5
• Oracle Database 11g Release 2 Enterprise Edition
• Oracle TimesTen In-Memory Database Cache
• Oracle XML DB
• Oracle SQL Developer
• Oracle SQL Developer Data Modeler
• Oracle Application Express 4.0
• Oracle JDeveloper
• Hands-On-Labs (accessed via the Toolbar Menu in Firefox)

Thus, I started a very quick download (in fact it wasn't so quick because all packed files were up to 6 GB). Having completed all standard procedures (i.e. downloading, unpacking, running VB) I made two simple VirtualBox corrections. And only then had I a fully working Oracle DB sandbox.

Uf :). Where are these days when the preparation of Oracle sandbox took me long hours?

Having checked the Apex PDF plug-in, I went through the whole Oracle sandbox and I have found an interesting Apex 'add-on' called Tomcat. OK, this is not the add-on in a common sense but an additional option that Apex could run with, or, in other words, could be used for a web tier.
You may ask why I was so surprised? The answer is 'Oracle does not support this installation option', what is more, it suggests installing: GlassFish, WebLogic, OC4J instead. Moreover, as I remember, there were many discussions on Oracle forums about that unsupported issue. So, the questions stay open: 'Why does Oracle state that it is an unsupported option and meanwhile using it in its demo example?'.

Nevertheless, if you would like to see how 'originally' Apex works with Tomcat, you could run this VirtualBox and check Oracle's sandbox, a well-done package.

Debugging mode and 404-not found

During the Apex development, it is very good to have additional information about the error: "404-not found page".
Read this Troubleshooting the 404-not found error on XE and enable dubug mode.

Checkbox nightmare

Before you code something with Web checkboxes, you should read the post on a simple checkbox explanation by Dimitri Gielis Checkbox in APEX
In addition, you could read Apex documentationas well.
And only after this short (two stories) reading, you will probably spend less time with checkboxes configuration than I did :).

Simple e-mail validation function

Nice and very simple pl/sql e-mail validation function from: http://forums.devshed.com/

if owa_pattern.match('email.address@server.com', '^.+@{1}\w+\.{1}\w{2,3}$') then
   /*matches*/
else
   /*not matches*/
end if;

Just create validation function returning boolean:

declare
begin
return
owa_pattern.match(:P27_EMAIL, '^.+@{1}\w+\.{1}\w{2,3}$');
end;