Apache Synapse's HTTP Sender

The factory-default HTTPS sender of Apache Synapse is “org.apache.synapse.transport.nhttp.HttpCoreNIOSSLSender”. The "HostnameVerifier" parameter of this transport sender can be used to control how Apache Synapse perform SSL handshaking. The “HostnameVerifier” parameter indicates how the URL's hostname and the server's SSL certificate's hostname should be matched during the SSL handshake. HostnameVerifier can can take one of the following 3 values values.

• DefaultAndLocalHost
• Strict
• AllowAll

DefaultAndLocalHost

If the "HostnameVerifier" value is set to "DefaultAndLocalHost", then the SSL handshake will be successful only if one of the following is satisfied.

• The hostname must match either the first CN, or any of the subject-alts of the server certificate (same way as Curl and Firefox). A wildcard can occur in the CN, and in any of the subject-alts. The only difference between DEFAULT and STRICT is that a wildcard (such as "*.foo.com") with DEFAULT matches all subdomains, including "a.b.foo.com".

• A host of "localhost", "localhost.localdomain", "127.0.0.1", "::1" will always pass, no matter what is in the server's certificate.

Strict

If the "HostnameVerifier" value is set to "Strict", then the SSL handshake will be successful when the following criteria is met.

The hostname must match either the first CN, or any of the subject-alts of the server certificate. A wildcard can occur in the CN, and in any of the subject-alts. This will only check the first CN of the certificate similar to Sun Java 1.4. A wildcard such as "*.foo.com" matches only subdomains in the same level, for example "a.foo.com". It does not match deeper subdomains such as "a.b.foo.com".

This works the same way as java.net.URL in Sun Java 1.4, Sun Java 5, Sun Java 6. This implementation appears to be compliant with RFC 2818 for dealing with wildcards.

This functionality is also very close to IE6. The one divergence from IE6 is how it only check the first CN. IE6 allows a match against any of the CNs present.

AllowAll

Setting "HostnameVerifier" to "AllowAll" turns hostname verification off. This implementation is a no-op, and never throws the SSLException.

Installing ApacheDS on Unbuntu

Environment

• Ubuntu - Jaunty Jackalope
• 64 bit Architecture

Right now the "Basic User Guide" in the ApacheDS site is not up-to-date. So here is how to install ApacheDS on Ubuntu

1. Download the "Linux Binary Installer - Linux x86_64" of ApacheDS from http://directory.apache.org/apacheds/1.5/download/download-linux-bin.html.
2. Change the permissions of the file as follows.

    chmod u+x apacheds-1.5.5-x86_64.bin

3. Change to root and run the installer as follows. I picked the default proposed installation directories.

   ./apacheds-1.5.5-x86_64.bin

4. Now the task is to locate the "startp script". If you picked the defaults while installing, it can be found in the /etc/init.d directory. Search for a file containing the name *apacheds*. In my case the start-up script was renamed as "apacheds-1.5.5-default". Now give the command as following as root.
   
   

   /etc/init.d/apacheds-1.5.5-default start

Initially when I tried to install, I faced the following problem since the start-up script was renamed to "apacheds-1.5.5-default". This trivial information was lacking in the "Apache DS Basic User Guide".

/etc/init.d/apacheds: No such file or directory

WSO2 ESB : AnonymousEndpoint has been marked for SUSPENSION, but no further retries remain

Are you are running WSO2ESB and receiving this error "AnonymousEndpoint has been marked for SUSPENSION, but no further retries remain" printed on console? This error occurs when trying to send the message again. If this error prints in the console repetitively, then WSO2ESB is trying send messages repetitively. So inspect "<syn:send/>" elements in the synapse config, and it may not be required.

Here is a scenario I ran into.

I am using WSO2ESB-2.1.1(or later) and trying to re-use an old synapse configuration. I am trying to use a proxy service.

In the synapse configuration, I have target endpoint specified in the proxy service, so <syn:send> is not required according to new rules. So when I removed <syn:send/> from the synapse config's inSequence it worked beautifully. BTW .. you have to restart the server.

Neethi Builders - XmlPrimtiveAssertion

When you build neethi Assertions, do you find instances of "org.apache.neethi.builders.xml.XmlPrimtiveAssertion" instead of proper Assertions? The issue is that your runtime has not picked up the "org.apache.neethi.builders.AssertionBuilder" file inside the META-INF/services directory. This problem mostly occur in old versions of Eclipse or in OSGI environment. So check if you have added the META-INF directory that contains the "org.apache.neethi.builders.AssertionBuilder" file to your classpath.

If you want to know the technical details, then please refer how Apache Neethi implemented the http://java.sun.com/j2se/1.3/docs/guide/jar/jar.html#Service at org.apache.neethi.util.Service.java .

WSO2 Carbon Alpha Releases

WSO2 releases alphas of the upcoming product releases. Check them out at,

http://builder.wso2.org/~carbon/alpha/alpha2/
http://builder.wso2.org/~carbon/alpha/alpha1/

You can report bugs at,

https://wso2.org/jira

Key Signing Party

What a geekish party to have!!! That is one of the coolest geeky things I've heard. But I lost my PGP key sometime back when I formatted the hard disk. I forgot to backup.

Read all about the party here.

Decoupling the UI from Backend

The "minimal change prorogation" can be used as a verification test for loose coupling. I've been struggling to handle changes in a core component when it suddenly occurred to me that, "dhhaa tightly coupled". The changes propagated to the UI. The problem is that I have used the information experts to send data to the UI.

So I added a new rule to my experience. Use another set of classes called "Data Transfer Object" to transfer data to the UI. Problem solved!