options for connecting java applets to sybase - · pdf fileoptions for connecting java applets...

1998 International Sybase User Group North American Conference1998 International Sybase User Group North American Conference

Options For Connecting Java Applets ToSybaseOptions For Connecting Java Applets ToSybase

u GuntherBirznieks

u NationalHumanGenomeResearchInstitute


Connecting Java Applets To SybaseConnecting Java Applets To Sybase

u “If I had a dime… ”u JDBC is frequently not the whole solution!u There are many different ways to connect

applets to Sybase.


It’s About ArchitectureIt’s About Architecture

u Architecture evolvesu New technology with existing infrastructureu Seek out strategic new technologiesu Java, CORBA, and moreu But do not blindly throw away old technologyu Try to leverage the old with the newu Recognize the tradeoffs

u “The Problem With Standards Is That There Are So Many!"


Options To Connect Applets To SybaseOptions To Connect Applets To Sybase

u JDBC (Java DataBase Connectivity)u Straight-up/JSQLu JavaBlend

u Proprietary Protocols - Socketsu Object Middlewareu RMI, CORBA, DCOM, ObjectSpace Voyager

u Object Transaction Middleware (OTM)u Jaguar CTS, Microsoft MTS, EnterpriseBeans

u Web Server Middlewareu Perl, Web.SQL, ASP, ColdFusion, Servlets


Applet ConsiderationsApplet Considerations

u Securityu Firewall Compatibilityu Java Applet Sizeu Browser Compatibilityu Network Bandwidth (Internet/Intranet)u Ease of Development/Maintenanceu Matching Current Software Architectureu Software Reuseu Internet vs Intranet (Controlled Deployment)


Considerations - SecurityConsiderations - Security

u Transmitted Passwordsu Beware transmitting user typed password in the

“clear”u Programmer built encryption has points of

weaknessu Distributed applet could be decompiled to

check out algorithmu Distributed applet could become fat, bloated

with encryption codeu Not compatible with native database libraries



u Possible solutions for applet-side encryptionu Obfuscators can protect encryption codeu Passwords could be pre-encrypted (no encryption

code needed)u For example, using PGP (Pretty Good Privacy)



u PGP Exampleu User encrypts her password with private keyu User’s public key is stored centrally in a

middleware serveru Middleware server decrypts PGPed password on-

the-fly to log onto the database.


Considerations - SecurityPGP DiagramConsiderations - SecurityPGP Diagram

DatabaseServer

Raw DataPGP Password

Java Applet

MiddlewareServer



u Passwords Embedded in Source Codeu Just say NO!u If your program can be downloaded anywhere,

then anyone can access it.u Not all obfuscators take care of fixed strings!u BEWARE! Even with obfuscation, the

password still has to be unobfuscatedsomewhere in the memory space to betransmitted.



u Obfuscation URLsu http://www.brouhaha.com/~eric/computers/mocha

.htmlu Mocha decompiler, Crema Obfuscator

u http://www.zelix.com/klassmaster/u http://www.mochasoft.dk/u http://www.e-t.com/jshrink.htmlu http://www.sbktech.org/hashjava.html



u Clear Java Code Example

void transform() { if (transformed || nvert <= 0) return; if (tvert == null || tvert.length < nvert * 3) tvert = new int[nvert * 3]; mat.transform(vert, tvert, nvert); transformed = true; }



u Obfuscated Java Code Exampleu From HashApplet Homepage

void C() { if (I || E <= 0) return; if (C == null || C.length < E * 3) C = new int[E * 3]; J.O(A, C, E); I = true; }



u What about the raw data itself?u Is it OK for data packets to be transmitted in

the clear?u Many solutions do not cover this!u SSL is one possible resolutionu Use Web Server middleware (HTTPS)u jConnect 3.0 supports HTTPS


Considerations - Firewall CompatibilityConsiderations - Firewall Compatibility

u Server sideu Poking holes in your firewall

u Client sideu Proxy Servers


Considerations - Applet SizeConsiderations - Applet Size

u Time to downloadu Time to initializeu Browser Incompatibilityu Less Code = Less To Debug


Considerations - Browser CompatibilityConsiderations - Browser Compatibility

u Supported Protocolsu DCOM = Microsoft IE w/trustu CORBA = Netscape 4u RMI = ?

u Browser JVM differencesu Networkingu GUIu System classes


Considerations - Network BandwidthConsiderations - Network Bandwidth

u Cache data locallyu Proxy design patternu Straight caching

ProxyAbstract Class

Subset Classw/No Cache

Real Data Classw/Cache


Considerations - Network BandwidthConsiderations - Network Bandwidth

u Applet sizeu Communication infrastructure codeu JDBC, JavaCGIBridge, CORBA overheadu Jconnect = ~400k (max)u CORBA size variesu OrbixWeb = ~450k (max)u Visigenic Orb built into Netscape 4

u JavaCGIBridge framework = ~ 6ku Voyager = 400-700k jar file

u How much code needs to be on the client


Considerations - Ease of DevelopmentConsiderations - Ease of Development

u Time to developu Time to maintainu Different Methodologies Stress Different

Approachesu Perl tends to stress rapid development, weakly

typedu CORBA tends to stress up-front design, object

reuse for later benefits


Considerations - Matching CurrentSoftware ArchitectureConsiderations - Matching CurrentSoftware Architecture

u Languagesu Javau Perlu Visual Basic

u Operating Systemsu NTu UNIX

u Architecturesu CORBAu RMIu CGI


Considerations - Software ReuseConsiderations - Software Reuse

u Current language standardu C++? Perl? COBOL?

u Component architectureu “Legacy” codeu COBOLu Active Server Pagesu Perl scripts


Considerations - Internet/IntranetConsiderations - Internet/Intranet

u Intranetu Controlled Browser deployment/configurationu Also includes limited outside collaborationsu Less control than Intranet, but more control

than just anyone viewing the pagesu Caveatu Today’s Intranet may become tommorow’s

Internet Application


2-Tier Solution - JDBC2-Tier Solution - JDBC

u JDBC - Java DataBase Connectivityu Direct access to Sybase (or through gateway)u CLI (Call Level Interface)

u J/SQL - Java embedded SQL standardu Embedded SQLu Translated to JDBC calls using preparseru http://www.oracle.com/nca/java_nca/jsql/html/jsql-

spec.html


2-Tier Solution - JDBC Diagram2-Tier Solution - JDBC Diagram

DatabaseServer

JDBC Driver

Gateway

Java Applet GUI

DatabaseServer


2-Tier Solution - JDBC Sample CodeFrom Sybase jConnect 3.0 Documentation2-Tier Solution - JDBC Sample CodeFrom Sybase jConnect 3.0 Documentationimport java.io.*;import java.sql.*;

public class SampleCode { public static void main(String args[]) { try { Connection con = DriverManager.getConnection("jdbc:sybase:Tds:myserver:3767", "sa", "");

Statement stmt = con.createStatement();

ResultSet rs = stmt.executeQuery("Select 1");

if (rs != null) && (rs.next()) { int value = rs.getInt(1); System.out.println("Fetched value " + value); } } catch (SQLException sqe) { System.out.println(”Exception : " + sqe.toString() + ", sqlstate = " + sqe.getSQLState()); System.exit(1); } // End of Exception Handler System.exit(0); } // End of main} // End of SampleCode


JDBC ConsiderationsJDBC Considerations

u Securityu Low if password to database embedded in appletu Low if password transmitted without SSL

u Firewall Compatibilityu Good on the client-side since HTTP Tunneling is

automaticu Can be bad on the server sideu Point of vulnerabilityu Open your Sybase server directly to the world?



u Java Applet Sizeu OK for simple appletsu Bad for complicated appletsu Application logic will tend to get located on the

applet side



u Browser Compatibilityu Bad for large JDBC applets (with business logic in

the applet)u More class library inclusion on the browser

side means more compatibility quirks to dealwith

u Good for actual connectivity thoughu Native JDBC Library can be downloadedu Connection to gateway on original Web Serveru Java Security Model (IP address restriction)



u Network Bandwidth (Internet/Intranet)u Good because TDS (tabular data stream) is faster

than HTTPu Internet Exceptionu HTTP Tunneling

u Can be worse as applet size increasesu Increase in client-side application logicu Followed by increase in raw data processed by

client



u Ease of Development/Maintenanceu Easy if familiar with CLI Architecturesu Call Level Interfaces - CT-Lib, DB-Lib

u Ease of maintenance can be highu With loosely coupled architectureu Data access abstracted away from

presentation/application logic



u Matching Current Software Architectureu Advantageu If you are already developing 2-tier Sybase

applicationsu Disadvantageu If you are coding too much application logic

client-sideu Your developers may be used to languages

other than Java



u Software Reuseu Reuse is low if application logic is stored client-

sideu Applet is relatively self-containedu Although stored on central web server, still

compiled as a separate entity



u Internet vs Intranet (Controlled Deployment)u Internetu Good client compatibilityu Firewallu JDBC Library compatible

u Intranet - JDBC is better hereu Greater bandwidth lowers impact of fat appletsu Security (firewall, password) is not as much of

a problemu Caveat - Your business may want to open an

Intranet application up to the Internet!


2-Tier Solution - JavaBlend2-Tier Solution - JavaBlend

u Transparently maps Java objects todatabasesu Maps ODMG to JDBC

u Compatible with OOAD Case toolsu UI Builders draw directly from standard

JavaBlend objectsu Provides Object-Relational Mappingu Provides Interfaces for RMI/IDL (CORBA)


2-Tier Solution - JavaBlend2-Tier Solution - JavaBlend

u Same basic issues as JDBC/JSQLu Exception: Can be used for 3-tier access

(mapping to 3-tier Java solutions)u Possible performance problems mapping to

Relational Databasesu http://www.javasoft.com/products/java-

blend/index.html


2 or 3-Tier Solution - Sockets2 or 3-Tier Solution - Sockets

u Proprietary solutionsu Build your own protocol over TCP/IPu Clientu Serveru Middleware Application serveru Gateway to Sybase

u Proprietary does not necessarily mean bad!


Sockets ConsiderationsSockets Considerations

u Securityu Generally badu Proprietary protocol incompatible with

firewallsu Higher complexity = possible security holes

u Could be good if it cannot be interpreted byothers

u But beware...u Java decompilersu Home grown protocol security may not be as

clever as you think



u Firewall Compatibilityu Bad -- No commercial firewall support for

proprietary proxy serversu Java Applet Sizeu The complexity of the protocol can increase

applet sizeu 3-Tier solution has better code size

u Browser Compatibilityu Good because all Java browsers support socketsu Bad if code bloat ends up increasing applet size



u Network Bandwidth (Internet/Intranet)u Excellent if protocol tuned for performanceu Made worse if used in a gateway rather than

application server manner



u Ease of Development/Maintenanceu Protocol development is hardu Maintenance tends to be difficultu What if your protocol programmer leaves?u What if your protocol changes?



u Matching Current Software Architectureu Good if protocol is in use in other programs such

as C++u Software Reuseu Proprietary protocols tend to be difficultu Too easy to add “1 more new feature”u Some “new features” could break old ones



u Internet vs Intranet (Controlled Deployment)u Internetu Can be excellent with a tuned protocolu Beware of applet bloating

u Intranetu Generally bad to use for limited deploymentu Reuse/maintenance problem baggage


Object Middleware - RMIObject Middleware - RMI

u Remote Method Invocationu Java only for both client and serveru Except for superior Java support, fairly

sparse standardu Very little securityu Naming services (JNDI, JavaSpaces soon)u Proprietary Protocol (Eventually IIOP)


Object Middleware - RMI DiagramObject Middleware - RMI Diagram

DatabaseServer

RMI Proxy Stub

Server Skeletons

Java Applet GUI

RMIServer


Object Middleware - CORBAObject Middleware - CORBA

u Common Object Request Broker Architectureu Uses IIOP (Internet Inter-Orb Protocol)u Requires Interface Definition Language (IDL)u Visigenic/Netscape “Caffeine” can create IDL files

directly from Java interface files.u http://www.omg.org/


Object Middleware - CORBA DiagramObject Middleware - CORBA Diagram

DatabaseServer

Corba Proxy Stub

Server Skeletons

Java Applet GUI

CORBAServer


Object Middleware - DCOMObject Middleware - DCOM

u Distributed COM (Common Object Model)u Uses JavaTLB (Type Library Builder)u Generates java .class files as a wrapper for COM

objectu msjava.dll (microsoft VM) recognizes this bridge

information in a class fileu applet must be trusted for local COM access


Object Middleware - VoyagerObject Middleware - Voyager

u “Free” Java solutionu Bidirectional access to CORBAu DCOM Access soonu http://www.objectspace.com/u Home of JGL (Java Generic Library)


Object Middleware ConsiderationsObject Middleware Considerations

u Securityu Mixed bagu RMI was not originally built for

security/password mechanismsu CORBA is adding more security services

u Firewallsu Protocols recognized by firewallsu Or use HTTP tunneling



u Java Applet Sizeu Generally bad because of class library overheadu CORBA software (org.omg hierarchy) is local

to Netscape browser for Visigenic ORBu BUT...u Application logic stored on middle tier

u Browser Compatibilityu Relatively badu Netscape = CORBAu IE = DCOMu Voyager 2 needs JDK 1.1



u Network Bandwidthu OK if using IIOPu Worse with HTTP Tunnellingu More overhead with type informationu Smaller applet size can compensate



u Ease of Development/Maintenanceu CORBA, DCOM generally hard to developu CORBA standard alone is several hundred pagesu Usually need to learn an Interface Definition

Language (IDL)u Netscape/Visigenic Caffeine



u Ease of Developmentu Object Oriented Analysis and Designu Uses well-established “Design Patterns”u Factory for creating new objectsu Proxy objects for managing remote objects

u Referenceu “Design Patterns” by the “gang of four”u Erich Gamma, Richard Helm, Ralph Johnson,

John Vlissidesu 1995, Addison-Wesley



u Maintenanceu Easier if object model is correctu Just unload old object and reload new oneu Object model not always correctu requires retooling many objects

u Rule of Thumb: Use object middleware primarilyfor well defined enterprise interfaces or large-scale distributed systems



u Software Reuseu Excellent for well defined enterprise objectsu eg Address book, departments, purchasing

process, lab processu Generally good since everyone sticks to common

modelu CORBA allows integration with legacy

applicationsu Expose existing COBOL/Mainframe code on

the net!



u Internet vs Intranet (Controlled Deployment)u Better for intranet deploymentu Browser incompatibilitiesu Class library deployment size


Transaction Middleware - JavaEnterpriseBeansTransaction Middleware - JavaEnterpriseBeans

u Java “Standard”u Allows for transaction-aware beansu Transactions within the beanu Bean_managed, Not_supported

u Transactions with many beansu Supports, Requires, Requires_new, mandatory

u More vendors to follow suitu Sybase supports EnterpriseBeans Spec


Transaction Middleware - JavaEnterpriseBeansTransaction Middleware - JavaEnterpriseBeans

DatabaseServer

TS Protocol

Transaction Beans

Java Applet GUI

TransactionServer


Transaction Middleware - Jaguar CTSTransaction Middleware - Jaguar CTS

u Sybase Solutionu Parallels EnterpriseBean architectureu JDBC Interface - a major plusu Same basic codeu Simply execute “stored procedures”


Transaction Middleware - Microsoft MTSTransaction Middleware - Microsoft MTS

u Transaction-aware COMu DCOM Orientedu Little/No support for EnterpriseBeans/IIOP


Transaction Middleware ConsiderationsTransaction Middleware Considerations

u Basically the same as Object Middlewareu Advantagesu Transaction-aware objects are important in

database connectivityu Disadvantagesu Less openu Look for Java EnterpriseBeans Solution


Web Server MiddlewareWeb Server Middleware

u HTTP Compatible protocolu Simply POST data to Web Serveru Web Server processes data and returns it as

a web documentu Java Applet parses the web responseu JavaCGIBridgeu http://www.extropia.com/Scripts/


Web Server Middleware - DiagramWeb Server Middleware - Diagram

DatabaseServer

JavaCGIBridge

Web.SQLServletCGI/Perl

Java Applet GUI

Flat File onWeb Server


Web Server Middleware - Nuts and BoltsWeb Server Middleware - Nuts and Bolts

u JavaCGIBridge exampleu Modify CGI/Perl programs to return parsed datau Add JavaCGIBridge class to Java applet

implementation

u Data to be returned should be identifiedu Top separator ()u Bottom Separator ()u Pipe delimited fieldsu (Optional) Set up form variable to tell script to

send data using separators defined above(javacgibridge=on)



u The code on the next slide shows how aCGI/Perl or WEB.SQL application would bemodified to return sample data for the Javaapplet if the form variable “javacgibridge” isset to “on”.

# If javacgibridge is on, send data specially formatted for# java applet, otherwise send regular HTML data to the user’s browserIf ($form_data{“javacgibridge”} eq “on”) { print “”; # Loop through data here while (@row_of_data = &getRowOfData()) { printf(“%s|%s|\n”,@row_of_data); } print “”;} else { print “<TABLE><TR><TH>Last Name</TH><TH>First Name</TH></TR>”;

# Loop through data here while (@row_of_data = &getRowOfData()) { printf(“<TR><TD>%s</TD><TD>%s</TD></TR>\n”, @row_of_data); } print “</TABLE>”;}



u Instantiate JavaCGIBridge classu Set up form variable, form value pairs inside

Hashtableu Set up URL by instantiating URL classu Get parsed data back using the URL and form

variable Hashtable as a Vector of Vectors



u Sample Java Codeu The code on the next slide calls Address Book

search script setting “firstname” and“javacgibridge” HTML form variables. Therecords will be returned as a Vector containing allthe fields in each record as a Vector of Strings.



URL u = new URL("http://www.yourdomain.com/cgi-bin/address_query.cgi");

JavaCGIBridge jcBridge = new JavaCGIBridge();

// firstNameTextField is a text field on a Java applet that the user fills // in to query.jcBridge.addFormValue(formVars,"firstname",firstNameTextField.getText());jcBridge.addFormValue(formVars,"javacgibridge", "on"); Vector addressBookResults = jcBridge.getParsedData(u,formVars);



u All searchdata ANDmodificationcode on ONEapplet

u But alsoincludesnormal HTMLinterface


Web Server Middleware ConsiderationsWeb Server Middleware Considerations

u Securityu Excellentu SSL may be used to encrypt both passwords

AND datau Database passwords can be kept on the web

server sideu Firewall proxys are compatible with HTTP and

SSL protocolsu Firewall Compatibilityu Excellent Proxy Support for HTTP protocol



u Java Applet sizeu Goodu Application logic is stored on the server sideu JavaCGIBridge < 7k

u Browser Compatibilityu Goodu Applets kept smaller with logic on the web

serveru CGI Bridge takes advantage of built in class

librariesu URL, URLConnection classes



u Network Bandwidth (Internet/Intranet)u Goodu Applets kept smallu Application logic layer can preprocess

database result set



u Ease of Development/Maintenanceu Development is easieru Leverage existing web server CGI codeu Leverage existing programmer knowledge

about CGIu Maintenanceu Easier since application logic is on a middle

tieru Not as easy as Object/Transaction middlewareu But weakly typed CGI protocol makes

changes easier to implement



u Matching Current Software Architectureu Great if your company is already developing CGIu Solves Java client-side compatibility problemsu Provide clients with forms interface for core

functionsu Use Java for enhancements as optional

functions



u Software Reuseu Great if already developing CGIu Generally worse than existing object

infrastructures such as CORBA if CGI is not anexisting or intended architecture



u Internet vs Intranet (Controlled Deployment)u Intranetu Utilize web server access control features

inside Java appletsu Internetu Good use because HTTP is a standard Internet

protocolu Very few browser incompatibilities


Solutions SummarySolutions Summary

u JDBCu Socketsu Object Middlewareu Object Transaction Middlewareu Web Server Middleware



u JDBCu Prosu Directly integrated to Sybaseu Performance with TDS is goodu CT-Lib developers will find transition easy

u Consu Security for both password and data (use SSL)u 2-Tier bloated applet problem

u Bottomlineu Useful for Intranetu Security/Fat code make it less ideal for Internet



u Socketsu Prosu High performance for tuned protocol

u Consu Protocol not usually seen by firewall proxysu Hard to develop/maintain

u Bottomlineu Useful for very specific performance oriented

applicationsu Only limited use on the open Internetu Large development shop that can afford to

develop its own infrastructure



u Object Middlewareu Prosu Common architecture for software reuseu CORBA is an open standard

u Consu Not much browser support yetu Difficult to work in some modelsu Some are Java onlyu CORBA and DCOM are difficult to learn



u Object Middleware Bottomlineu For companies with no central architecture

development, object middleware can speed youon the road to reuse

u Need to invest in trainingu Not necessarily for use in projects that are

constantly changingu as opposed to evolving



u Transaction Middlewareu Prosu Very database orientedu Transactions managed for youu Security is good in most cases

u Consu Generally proprietaryu May change with EnterpriseBeans spec



u Transaction Middleware Bottomlineu Jaguar CTS is great for shops already used to

Sybase developmentu Microsoft MTS is relatively closed to all except

DCOMu Useful 1-vendor solution for Microsoft shops

u Java Enterprise Beansu Jaguar CTS may comply with the standard as

an added plusu Start managing enterprise objects for reuse



u Web Server Middlewareu Prosu Security of both data and password handled

through HTTPSu Middleware handles database access in

familiar languageu Consu Weakly typedu HTTP can be slow protocolu CGI Invocations are typically slowu Can be sped up with the use of Web.SQL,

servlets, ASP, mod_perl techniques



u Web Server Middleware Bottomlineu Great if you have a lot ofu Perl or Web.SQLu Active Server Pages (Microsoft)u Cold Fusionu Servletsu Other CGI-Like interfaces

u Excellent way to leverage your code andprogrammer expertise

u Also, useful for applets on the Internetu HTTP is a totally open standard


More Information…

u Visit http://www.extropia.com/Scripts/uFurther information on this talkuJavaCGIBridge class examples and

source codeu AcknowledgementsuPeter Chines, Joseph Ryan, Erik Ferlanti,

Selena Sol, Digicon

options for connecting java applets to sybase - · pdf fileoptions for connecting java applets...

Documents