Enterprise Component Comparison: An Examination Of J2EE, CORBA, And .NET

Enterprise Component Comparison--1

Enterprise Component Comparison:Enterprise Component Comparison:An Examination Of J2EE, CORBA, And .NETAn Examination Of J2EE, CORBA, And .NET

presented bySeth Freeman, Phil Griffith and Frank Manni

Semester Project- Final PresentationCSE333 – Distributed Component Systems (FALL 2005)

InstructorProf. Steven A. Demurjian

Department of Computer Science and EngineeringUniversity of Connecticut

[email protected]@[email protected]@yahoo.com


Outline Of PresentationOutline Of Presentation

IntroductionIntroduction Project DescriptionProject Description CORBA MaterialCORBA Material J2EE MaterialJ2EE Material .NET Material .NET Material AnalysisAnalysis ConclusionConclusion


Project DescriptionProject Description

Compare and Contrast the 3 Technologies Compare and Contrast the 3 Technologies J2EE, .NET, and CORBA.J2EE, .NET, and CORBA.

Evaluate the Three in These Four Areas: Evaluate the Three in These Four Areas: Database Connectivity Security Web Services Interoperability

GOAL: To Analyze Which Areas in J2EE or .NET GOAL: To Analyze Which Areas in J2EE or .NET is Better Suited to Be Used for Application is Better Suited to Be Used for Application Development. Also to Determine in Which Areas Development. Also to Determine in Which Areas CORBA Can Be Beneficial.CORBA Can Be Beneficial.


Project ScopeProject Scope

Database ConnectivityDatabase Connectivity Determine Components Involved. Examine the Underlying Functionality of

Establishing a Connection to a Database. In the End We Will Also Compare the

Performance of J2EE and .NET in Updating and Querying a Real World Database.

Web ServicesWeb Services Analyze the Techniques to Develop and Deploy

Web Services for the Three Technologies. Observe the Ease of Use Determine the Support of Each for Web Services.


Project ScopeProject Scope

SecuritySecurity The Goal Here is to Determine the Built-in

Capabilities of Authorization, Authentication, and Encryption.

Then Analyze the Functionality of These Primitives Within the Framework.

InteroperabilityInteroperability The Final Part of the Project is to Investigate

the Middleware Interoperability of .NET/J2EE and CORBA Components.

More Specifically the Focus Will Be on Remoting in .NET vs. RMI (J2EE).

And Also Observe How Components Interact With Heterogeneous Components.


CORBA (In Brief)CORBA (In Brief)

Common Object Request Broker ArchitectureCommon Object Request Broker Architecture


CORBA DBCORBA DB

CORBA and DatabasesCORBA and Databases


CORBA WSCORBA WS

Similar FunctionalitySimilar Functionality

AdvantagesAdvantages DisadvantagesDisadvantagesData is in the correct format when it is Data is in the correct format when it is received from the ORB. This saves time received from the ORB. This saves time from having to parse XML.from having to parse XML.

Data cannot be read by humans alone. Data cannot be read by humans alone. Because it is in the correct/digital format.Because it is in the correct/digital format.

Standard specification, which is Defined Standard specification, which is Defined by the OMG.by the OMG.

Protocol(IIOP)does not easily transport over Protocol(IIOP)does not easily transport over the internet. This limits the scope of where the internet. This limits the scope of where CORBA can be used. ORB must be present CORBA can be used. ORB must be present on all machines, or elaborate coding is on all machines, or elaborate coding is required to workaround.required to workaround.

Readable Interface Descriptions. SOAP Readable Interface Descriptions. SOAP wsdl files are difficult to read through.wsdl files are difficult to read through.

Does not directly support .NET.Does not directly support .NET.

Supports various events, i.e. transaction, Supports various events, i.e. transaction, notification, security services.notification, security services.

Cannot transport some types of documents Cannot transport some types of documents easily, such as .pdf or .doc files.easily, such as .pdf or .doc files.

CORBACORBA


CORBA WSCORBA WS

AdvantagesAdvantages DisadvantagesDisadvantagesReady-made to travel over the internet because it Ready-made to travel over the internet because it uses the http protocol.uses the http protocol.

Congestion at Port 80.Congestion at Port 80.

Data is easy to read in XML formatData is easy to read in XML format Many competing SOAP standards.Many competing SOAP standards.

Supports .NETSupports .NET Difficult to encode polymorphism.Difficult to encode polymorphism.

Supported by IBM and Microsoft.Supported by IBM and Microsoft. No standard specification.No standard specification.

Can transport attachments without problems.Can transport attachments without problems. No event services.No event services.

Slower performance—data needs to be parsed Slower performance—data needs to be parsed

WSDL files are not easy to read.WSDL files are not easy to read.

Web ServicesWeb Services


CORBA SecurityCORBA Security

Security Within CORBASecurity Within CORBA CORBA Gives Administrators, Developers, Etc CORBA Gives Administrators, Developers, Etc

the Ability to Add Security to the System.the Ability to Add Security to the System. Developed a Specification of What Makes a Developed a Specification of What Makes a

CORBA Application Secure.CORBA Application Secure. CORBA, Being Distributed, Has More Areas That CORBA, Being Distributed, Has More Areas That

Are Vulnerable to Attacks, and Therefore Has Are Vulnerable to Attacks, and Therefore Has More Areas That Need to Be Made SecureMore Areas That Need to Be Made Secure

Not Going to Go Over All of Them--Already Went Not Going to Go Over All of Them--Already Went Over Them in Class. Over Them in Class.

Focus on Security Service Protocol (SECP)—Focus on Security Service Protocol (SECP)—Communication Between Objects/Clients and the Communication Between Objects/Clients and the ORBORB



CORBA ORBs Communicate by Using the GIOP (General CORBA ORBs Communicate by Using the GIOP (General Inter-Orb Protocol). This Protocol Defines the Format of Inter-Orb Protocol). This Protocol Defines the Format of the Messages That Are Passed Over the ORB to and From the Messages That Are Passed Over the ORB to and From the Client and Object. When GIOP Runs Over TCP/IP it the Client and Object. When GIOP Runs Over TCP/IP it is a Part of IIOP. SECP Will Be Another Layer Below the is a Part of IIOP. SECP Will Be Another Layer Below the GIOP That Adds Security to Message Transportation. GIOP That Adds Security to Message Transportation.

SECP Will Transport GIOP Messages SecuritySECP Will Transport GIOP Messages Security SECP is Still in Progress. Its Status is “Approved.”SECP is Still in Progress. Its Status is “Approved.”



Three Parts to SECP:1) Circuit Establishment--Creating a Secure, Bidirectional Connection Between a Client and Target.2) Context Establishment -- Allowing Both a Client and Target to Set up Security Contexts, and Based off the Specified Security Context of the Client and the Target, Certain Behaviors May Take Place.3) Message Transport-- Final Phase of the SECP, and This Phase Securely Transports the Messages and Then Destroys the Contexts.


CORBA InteroperabilityCORBA Interoperability

CORBA’s Whole Focus Is Interoperability!CORBA’s Whole Focus Is Interoperability! We All Know What Corba is Now, So We See We All Know What Corba is Now, So We See

How Using an IDL, We Can Create a Client in How Using an IDL, We Can Create a Client in One Software Platform That Can Access a Target One Software Platform That Can Access a Target Object Through the ORB.Object Through the ORB.

So, That’s it, Right? This Part is Done.So, That’s it, Right? This Part is Done.



Wrong! There Are Other Types of Wrong! There Are Other Types of Interoperability.Interoperability.

What About From One ORB to Another ORB?What About From One ORB to Another ORB? What About From One System That is CORBA What About From One System That is CORBA

Compliant to a Legacy System That isn’t CORBA Compliant to a Legacy System That isn’t CORBA Compliant?Compliant?

What About Security Policies on a System? What About Security Policies on a System? Sometime This System Can Be Accessed, Sometime This System Can Be Accessed, Sometimes it Can’t Be.Sometimes it Can’t Be.

So, There Are Also Implementational and So, There Are Also Implementational and Administrative Types of Interoperability.Administrative Types of Interoperability.

How Can We Handle This?How Can We Handle This?



With a Specification, of Course!With a Specification, of Course! CORBA Interoperability ArchitectureCORBA Interoperability Architecture CORBA Defines a Domain—Group of Objects That Do CORBA Defines a Domain—Group of Objects That Do

Not Communicate With Other Objects.Not Communicate With Other Objects. To Communicate Between Domains, There Must Be a To Communicate Between Domains, There Must Be a

Bridge.Bridge.

Some Terms:Some Terms: In-Line Bridging—All the Domains Are Within One ORB.In-Line Bridging—All the Domains Are Within One ORB. Request Level Bridging—Domains Are Not Within One Request Level Bridging—Domains Are Not Within One

ORB. (More Interesting Than In-Line Bridging)ORB. (More Interesting Than In-Line Bridging) DII—Dynamic Invocation Interface—Can Invoke Methods DII—Dynamic Invocation Interface—Can Invoke Methods

on Objects Without Knowing What the Target Interfaces on Objects Without Knowing What the Target Interfaces Are at Compile Time.Are at Compile Time.

DSI—Dynamic Skeleton Interface—Servers Don’t Know DSI—Dynamic Skeleton Interface—Servers Don’t Know the Types of the Objects They Are Going to Access Ahead the Types of the Objects They Are Going to Access Ahead of Run Time.of Run Time.



Request Level Bridging:Request Level Bridging:

1) The Client ORB Simulates That the Server ORB and the 1) The Client ORB Simulates That the Server ORB and the Bridge Are Actually Part of Its Own Object. The Client Bridge Are Actually Part of Its Own Object. The Client Requests This Object Using the Dynamic Skeletal Interface Requests This Object Using the Dynamic Skeletal Interface (DSI).(DSI).

2) The DSI, Using the Bridge, Translates the Requests.2) The DSI, Using the Bridge, Translates the Requests. 3) The DSI Invokes the Request Through DII of the Server. 3) The DSI Invokes the Request Through DII of the Server.

Any Results Are Passed Back. Any Results Are Passed Back.

Note: To Do This, the Bridge Must Have Access to the Note: To Do This, the Bridge Must Have Access to the Interface Repository, or Have Pre-defined Knowledge of Interface Repository, or Have Pre-defined Knowledge of the Object Specifications. Also, the Standard Method for the Object Specifications. Also, the Standard Method for Transferring This Information is GIOP.Transferring This Information is GIOP.


J2EE EnvironmentJ2EE Environment

N-tier architectureN-tier architecture

Client SideClient Side

Web Application Web Application Servers:Servers:

JSP, Servlets, HTML, JSP, Servlets, HTML, XMLXML

Enterprise InformationEnterprise Information ServerServer

EJB Server, JNDI, EJB Server, JNDI, JMS, JavaMailJMS, JavaMail

Middle TiersMiddle Tiers

RDBMS, ERP, RDBMS, ERP, Legacy AppsLegacy Apps

Source: Enterprise Java SecuritySource: Enterprise Java Security


J2EE Enterprise ArchiveJ2EE Enterprise Archive

J2EE Application code is contained within an J2EE Application code is contained within an Enterprise Archive (EAR) that consists ofEnterprise Archive (EAR) that consists of EJB Module (JAR File) Web Module (WAR File) Application Client Module (JAR File) Utilities Deployment Descriptor File (XML document)

Specifies contents of EAR, deployment instructions, security settings to be enforced by runtime environment

Each WAR, JAR also contain deployment descriptor Each module is run in a container which is the

interface b/w the module and outside world


EJB ModulesEJB Modules

Reside in EJB ContainersReside in EJB Containers Provide interface b/w the EJB and app server which

EJB resides EJB can be accessedEJB can be accessed

via RMI-IIOP via JMS via Web Service over SOAP

Three types of beansThree types of beans Entity, Session and Message-Driven


Web ModulesWeb Modules

An Application that can be accessed over the WebAn Application that can be accessed over the Web Consists of Servlets, JSP Pages, HTMLConsists of Servlets, JSP Pages, HTML Stored in WAR filesStored in WAR files Java ServletsJava Servlets

platform-independent server side software run in a servlet or Web container Web container is responsible for servlet creation,

deletion Java code with HTML

Java Server PagesJava Server Pages Used to generate and display dynamic content on the

Web JSP are translated into Servlets at run-time at first

request HTML with Java code


JDBCJDBC

J2EE Applications Interact With Databases J2EE Applications Interact With Databases Through Java Database Connectivity (JDBC) APIThrough Java Database Connectivity (JDBC) API

JDBC Supports Four Types of DriversJDBC Supports Four Types of Drivers JDBC-ODBC Bridge Native-API Partly Java Bridge JDBC-NET Pure Java Driver Native-protocol Pure Driver Java

Drivers Return a Drivers Return a ConnectionConnection Object Which Object Which Represents a Connection to the DatabaseRepresents a Connection to the Database

StatementStatement Objects Contain Methods to Pass SQL Objects Contain Methods to Pass SQL Statements to Database and Return ResultsStatements to Database and Return Results

ResultSetResultSet Objects Contain the Results of SQL Objects Contain the Results of SQL QueriesQueries Scrollable, Updateable, Holdable


J2EE SecurityJ2EE Security

J2EE Provides J2EE Provides DeclarativeDeclarative and and ProgrammaticProgrammatic Security Security Declarative SecurityDeclarative Security

Security Constraints Are Specified in Deployment Descriptors

At Run-time the Container Uses Security Policy Configured Specified in Deployment Descriptors to Enforce Authorization

Allows Better Application Portability Programmatic SecurityProgrammatic Security

Security Is Hard-coded Into Application Code Harder to Maintain Used to Enforce Constraints That Can’t Be Expressed

Through Declarative Security


Define Security RoleDefine Security Role

Definition of Security Role Defined Within the Definition of Security Role Defined Within the Deployment Descriptor of an EARDeployment Descriptor of an EAR

<assembly-descriptor><assembly-descriptor><security-role><security-role>

<description><description>This role is for tellersThis role is for tellers

</description></description><role-name>Teller</role-name><role-name>Teller</role-name>

</security-role></security-role><assembly-descriptor><assembly-descriptor>


Role Access To EJBRole Access To EJB

EJB methods can be associated with EJB methods can be associated with method-method-permissionpermission elements in EJB module deployment elements in EJB module deployment descriptorsdescriptors

<method-permission><method-permission><role-name>Teller</role-name><role-name>Teller</role-name><method><method>

<ejb-name>AccountBean</ejb-name><ejb-name>AccountBean</ejb-name><method-name>getBalance</method-name><method-name>getBalance</method-name>

</method></method></method-permission></method-permission>

Source:Enterprise Java Security


Role Access To Web ResourcesRole Access To Web Resources

Access to web resource URI’s can be specified by Access to web resource URI’s can be specified by security-constraintsecurity-constraint elements in web module deployment elements in web module deployment descriptorsdescriptors

<security-constraint><security-constraint><web-resource-collection><web-resource-collection>

<web-resource-name><web-resource-name> Account servlet protected areaAccount servlet protected area</web-resource-name></web-resource-name><url-pattern>/finance/account</url-pattern><url-pattern>/finance/account</url-pattern><http-method>GET</http-method><http-method>GET</http-method>

</web-resource-collection></web-resource-collection><auth-constraint><auth-constraint>

<description>Teller can access the URIs</description><description>Teller can access the URIs</description><role-name>Teller</role-name><role-name>Teller</role-name>

</auth-constraint></auth-constraint></security-constraint></security-constraint>

Source:Enterprise Java Security


Mapping Principals To RolesMapping Principals To Roles

Mapping of Principals to Security Roles is done by Mapping of Principals to Security Roles is done by the Deployerthe Deployer

If calling principal is in one of the security roles If calling principal is in one of the security roles authorized to access method, then calling Principal authorized to access method, then calling Principal is allowed accessis allowed access To the URI for Web Resources To the EJB method for EJB


Declarative Security PoliciesDeclarative Security Policies

Security Policies associated with URI’s and EJB Security Policies associated with URI’s and EJB includeinclude Login-configurations associated with URI

Form-based logins Authorization policies associated with URIs and EJB

based on security roles Principal-delegation policies that apply to Web Apps

and EJB Connection policies associated with JCA connectors

that dictate how apps access EIS in a secure manner


Login ConfigurationsLogin Configurations

J2EE security authenticates a principal based on J2EE security authenticates a principal based on the authentication policy of the resource the the authentication policy of the resource the principal has requestedprincipal has requested

J2EE Application Server is responsible for J2EE Application Server is responsible for authenticating usersauthenticating users

The authentication method is specified through the The authentication method is specified through the auth-methodauth-method element in the element in the login-configlogin-config descriptordescriptor

Three types of authenticationThree types of authentication HTTP authentication Form-based authentication Certificate-based authentication


HTTP AuthenticationHTTP Authentication

User must provide userID and password pair, User must provide userID and password pair, typically as part of HTTP headertypically as part of HTTP header

Done as followsDone as follows1. WAS issues HTTP unauthorized client error (401) and

a WWW_Authenticate HTTP header2. Web browser pops up dialog window3. User enters id and password4. Information is sent to Web Server5. WAS extracts info, authenticates user


HTTP Authentication (Cont)HTTP Authentication (Cont)

With HTTP authentication a Realm must be With HTTP authentication a Realm must be specifiedspecified Determines scope of security data Used in HTTP 401 challenge to inform user of the

name of the application domain Two typesTwo types

Basic: userID and password passed as cleartext Digest: userID and hash value of password are sent

<login-config><login-config><auth-method>BASIC</auth-method><auth-method>BASIC</auth-method><realm-name>SampleAppRealm</realm-name><realm-name>SampleAppRealm</realm-name>

</login-config></login-config>


Form-based AuthenticationForm-based Authentication

<login-config><login-config><auth-method>FORM</auth-method><auth-method>FORM</auth-method><form-login-config><form-login-config>

<form-login-page>/login.html</form-login-page><form-login-page>/login.html</form-login-page> <form-error-page>/login_fail.html</form-error-<form-error-page>/login_fail.html</form-error-

page>page></form-login-config></form-login-config>


When client requests protected resource, server When client requests protected resource, server redirects the client to an HTML form to obtain redirects the client to an HTML form to obtain userID and password userID and password

If authentication fails, user is redirected to error If authentication fails, user is redirected to error pagepage


Certificate-based (X.509)Certificate-based (X.509)

<login-config><login-config><auth-method>CLIENT-CERT</auth-method><auth-method>CLIENT-CERT</auth-method>


Web Server must be configured to perform mutual Web Server must be configured to perform mutual authentication over SSLauthentication over SSL

Client must make request over HTTPSClient must make request over HTTPS Otherwise server will redirect the client over HTTPS

Client must present certificate to establish a connectionClient must present certificate to establish a connection If SSL connection is made, server knows the client has If SSL connection is made, server knows the client has

presented it’s own certificate and no one elsepresented it’s own certificate and no one else Client certificate is then mapped to a principal that has Client certificate is then mapped to a principal that has

been assigned 0 or more security rolesbeen assigned 0 or more security roles


Creating Secure ChannelCreating Secure Channel

<user-data-constraint><user-data-constraint><transport-guarantee>CONFIDENTIAL</transport-<transport-guarantee>CONFIDENTIAL</transport-guarantee>guarantee>

</user-data-constraint></user-data-constraint>

Specifies the request to a URI resource should be Specifies the request to a URI resource should be initiated over HTTPSinitiated over HTTPS


User-Data ConstraintsUser-Data Constraints

There are times we want to specify communication must be There are times we want to specify communication must be done over SSLdone over SSL

This can be done by setting the <transport-guarantee> This can be done by setting the <transport-guarantee> element in the <user-data-constraint> descriptorelement in the <user-data-constraint> descriptor

<security-constraints><security-constraints><web-resource-collection><web-resource-collection>

<web-resource-name>ReservationServlet</web-resource-<web-resource-name>ReservationServlet</web-resource-name>name>

<url-pattern>/travel/reserve</url-pattern><url-pattern>/travel/reserve</url-pattern></web-resource-collection></web-resource-collection><user-data-constraint><user-data-constraint>

<transport-guarantee><transport-guarantee> CONFIDENTIALCONFIDENTIAL</transport-guarantee></transport-guarantee>

</user-data-constraint></user-data-constraint><security-constraints><security-constraints>


Programmatic SecurityProgrammatic Security

How to obtain Subject and Principal information How to obtain Subject and Principal information programmatically?programmatically?

EJB methods in interface EJB methods in interface javax.ejb.EJBContextjavax.ejb.EJBContext isCallerInRole( )

Test whether current caller has been assigned security role getCallerPrincipal( )

Obtain Principal object representing the current caller Servlet/JSP methods in interface Servlet/JSP methods in interface

javax.servlet.http.HttpServletRequestjavax.servlet.http.HttpServletRequest isUserInRole( )

Returns true if current caller is assigned security role getUserPrincipal( )

return Principal object representing the current authenticated user

getRemoteUser( ) Return the name of the authenticated user, null otherwise


Programmatic Security with JAASProgrammatic Security with JAAS

Java Authentication and Authorization ServiceJava Authentication and Authorization Service Provided in javax.security.auth package Developed to provide role-based

authentication, to supplement code-based authentication

Uses Pluggable Authentication Modules (PAMs)

Requires authentication and authorization routines to be explicitly called


JAAS AuthenticationJAAS Authentication

Subject

CredentialsX.509

updatePermission…

PrincipalsJoe Smith

000-11-4444123321

Determines the Determines the SubjectSubject of the user (or service) of the user (or service) making the requestmaking the request Each Subject is associated with identities or principals Each Subject can have attributes or credentials


JAAS ArchitectureJAAS Architecture

ApplicationApplication

LoginContextLoginContext

LDAP ServerLDAP Server

JndiLoginModuleJndiLoginModule

RdbmsLoginModuleRdbmsLoginModule

RDBMSRDBMS NT AuthenticationNT Authentication

Kerberos AuthenticationKerberos Authentication Biometric AuthenticationBiometric Authentication

LoginModules


Authentication StepsAuthentication Steps

App Creates App Creates LoginContext LoginContext object and passesobject and passes CallBackHandlerCallBackHandler Reads JAAS configuration file to determine which

LoginModules to load App Calls App Calls LoginContextLoginContext login( )login( ) method method

Calls the login( ) methods of each LoginModule Each login( ) method performs authentication,

possibly using the CallBackHandler to get input from user Each LoginModule is specified as Required or Optional Overall authentication succeeds only if all Required

LoginModules succeed App obtains the Subject by calling App obtains the Subject by calling LoginContext LoginContext

getSubject( )getSubject( ) App obtains the Principals by calling App obtains the Principals by calling Subject Subject

getPrinciples( )getPrinciples( )


JAAS AuthorizationJAAS Authorization

By default, all J2EE resources within a WAS are By default, all J2EE resources within a WAS are accessible unless they are explicitly protectedaccessible unless they are explicitly protected

JAAS Enforces Principal-Based AuthorizationJAAS Enforces Principal-Based Authorization access to resources are based on the current Principal

Steps include:Steps include: Associate a Subject (and Principals) with a Associate a Subject (and Principals) with a

thread of executionthread of execution Use the Subject.doAs( ) or

Subject.doAsPrivileged( ) methods that execute some privileged code

Update Security Policy FilesUpdate Security Policy Files Specify grant entries that describe codeSources

and/or Principals authorized to perform Privileged Actions


Benefits/Limitations Of JAASBenefits/Limitations Of JAAS

JAAS compliments the security features of J2SEJAAS compliments the security features of J2SE Multiple authentication mechanisms can be Multiple authentication mechanisms can be

“stacked” upon each other and easily configured “stacked” upon each other and easily configured through configuration filethrough configuration file

Supports vendor-neutral authentication Supports vendor-neutral authentication mechanismsmechanisms

JAAS is not equally supported by J2EE JAAS is not equally supported by J2EE Application ServersApplication Servers


Web Service ClientsWeb Service Clients

Three ways for a client to invoke a Web Services Three ways for a client to invoke a Web Services methods aremethods are Static stubs Dynamic proxy Dynamic invocation interface (DII)

Static Stubs (Generated Stubs) are created at Static Stubs (Generated Stubs) are created at development timedevelopment time

Dynamic Proxy – stub classes are created at Dynamic Proxy – stub classes are created at runtimeruntime

Dynamic Invocation Interface – Client can call Dynamic Invocation Interface – Client can call web services which it has no Service Definition web services which it has no Service Definition Interface or stubsInterface or stubs


J2EE InteroperabilityJ2EE Interoperability

Interoperability is primarily achieved through RMI Interoperability is primarily achieved through RMI and Java IDLand Java IDL

RMI allows J2EE Applications to communicate RMI allows J2EE Applications to communicate with remote Java Applicationswith remote Java Applications

uses the Java Remote Messaging Protocol (JRMP) Allows for Objects to be call-by-value since objects

can be serialized and sent across network Java IDL Allows J2EE Apps to communicate with Java IDL Allows J2EE Apps to communicate with

objects in other languages objects in other languages uses the CORBA-standard Internet Inter-Orb

Protocol (IIOP) Only supports call-by-reference


Best of Best of BothBoth Worlds: RMI-IIOP Worlds: RMI-IIOP

RMI over IIOP (RMI-IIOP) combines RMI’s ease RMI over IIOP (RMI-IIOP) combines RMI’s ease of use with CORBA’s interoperabilityof use with CORBA’s interoperability

Jointly developed by IBM and SunJointly developed by IBM and Sun

Uses IIOP as the communication protocolUses IIOP as the communication protocol

Allows developers to write remote interfaces in Allows developers to write remote interfaces in Java, that can be implemented in Java, or any other Java, that can be implemented in Java, or any other CORBA compliant languageCORBA compliant language

Supports call-by-reference and call-by-valueSupports call-by-reference and call-by-value


.NET ADO.NET.NET ADO.NET

ADO.NET is the New Database Technology of ADO.NET is the New Database Technology of the .NET Platform. the .NET Platform.

ADO is a Language Independent Model That is the ADO is a Language Independent Model That is the Major Benefit of Microsoft's Universal Data Access Major Benefit of Microsoft's Universal Data Access Strategy.Strategy.

.NET Includes Data Providers for Several Types of .NET Includes Data Providers for Several Types of Databases Including Oracle, OLE, and SQL Server. Databases Including Oracle, OLE, and SQL Server.

The Underlying Technique of ADO.NET is the The Underlying Technique of ADO.NET is the Dataset Which Promotes a Disconnected Technique Dataset Which Promotes a Disconnected Technique Where Data Will be Represented in Local Memory.Where Data Will be Represented in Local Memory.


ADO.NETADO.NET

The DataAdapter is The DataAdapter is Responsible for Filling in the Responsible for Filling in the Data Set Object With Data and Data Set Object With Data and Schema Information. The Schema Information. The DataAdapter Works in DataAdapter Works in Conjunction With the Conjunction With the DataReader Class to Fill the DataReader Class to Fill the DataSet Object.DataSet Object.

The DataReader Class Can The DataReader Class Can Only Read From a Database. Only Read From a Database. The Object Contains One Row The Object Contains One Row of Data. Must Reconnect to of Data. Must Reconnect to Get the Subsequent Rows. Get the Subsequent Rows.

The DataSet Is Broken Down The DataSet Is Broken Down Into 2 Subcomponents the Into 2 Subcomponents the DataTable Class and a DataTable Class and a Collection of Relationships for Collection of Relationships for the Corresponding Tables.the Corresponding Tables.


.NET Web Services.NET Web Services

Microsoft Makes Use of XML (Over the SOAP and HTTP Microsoft Makes Use of XML (Over the SOAP and HTTP Protocols) in its .NET Framework for Implementing Web Protocols) in its .NET Framework for Implementing Web Services. The Main Reason is That With XML the Client Services. The Main Reason is That With XML the Client Does Not Need to Know the Language the Web Services Does Not Need to Know the Language the Web Services Are Implemented in. Are Implemented in.

.NET has a command line tool to generate source code .NET has a command line tool to generate source code from a WSDL into a specified language (VB.NET or C#). from a WSDL into a specified language (VB.NET or C#). The source code can be added to a project and instantiating The source code can be added to a project and instantiating an object will enable the use of the web service.an object will enable the use of the web service.

There Are 4 Components in the .Net Infrastructure That There Are 4 Components in the .Net Infrastructure That Allow Clients to Find and Use Web Services.Allow Clients to Find and Use Web Services. Directory Discovery Description Wire format


.NET Security.NET Security

There Are 5 Security Facets in .NET Code-Based Access Control - Giving Permission at the

Code Level to Access Resources Role-Based Access Control – Security Enforcing a

User’s Permissions for an Application, Based on the User’s Role.

Secure Code Verification and Execution - Analyzing the MSIL and Insuring the Executing Code Is Behaving.

Secure Communication – Insuring That Data Is Being Passed in a Secure Manner Both Locally or Remotely to Avoid Message Tampering.

Secure Code and Data Protection - Insuring That Code Has Been No Unauthorized Changes by Utilizing Cryptographic Solutions and Signatures.

The Focus Will Be on Authorization, Authentication, and Cryptography in RBAC and Secure Code Execution.



AuthenticationAuthentication- .NET supports several different methods - .NET supports several different methods for authentication to determine credentials.for authentication to determine credentials. Windows based- Use of Principal and Identity Objects

in conjunction with technologies like IIS pr Certificates to verify identity. Identity- similar to a user account contains Name,

IsAuthenticated, and AuthenticatedType. Principal – is associated with an identity and is a list of roles

for the identity. Form based- Using web based HTML form to verify

identity. Then using cookies in ASP.NET the information can be used in the future.

Passport- Microsoft specific technology and supported directly in ASP.NET. Similar to form based authentication. Uses a central server to check a user’s credentials.



AuthorizationAuthorization- There are two ways to use - There are two ways to use authorization in .NET using Security demands or authorization in .NET using Security demands or Principals.Principals. Security demands: Places a restriction on an

entire class or methods within a class. Limits the use of class based on full trust or partial trust users.

Principals: They are very similar to security demands as you can place restrictions on classes or methods. After defining roles for them the principal object can use the IsInRole() method to see the status of the current user.



EncryptionEncryption- .NET does encryption through via - .NET does encryption through via streaming objects (file stream). streaming objects (file stream). .NET uses the Windows CryptoAPI.

Algorithms Hashing Signatures

Streaming objects can simply be sent to encryption objects to be encrypted.

The encrypted object can be streamed elsewhere to a network socket for example.


.NET Interoperability.NET Interoperability

Interoperability can be achieved through remote Interoperability can be achieved through remote communication in .NET.communication in .NET.

CORBA protocols are not innately supported in CORBA protocols are not innately supported in the .NET Framework.the .NET Framework.

However third party products and open source However third party products and open source projects are available / are in development:projects are available / are in development: Janeva (Borland product) IIOP.NET (open source -available) Remoting.NET (open source - never finished) Microsoft .NET and J2EE interoperability tool

kit (Microsoft product)


.NET Remote Communication.NET Remote Communication

.NET can achieve interoperability between objects in .NET can achieve interoperability between objects in different application domains through remote different application domains through remote communication. The goal of remoting is to allow the communication. The goal of remoting is to allow the ability to enable communication between objects regardless ability to enable communication between objects regardless of the protocols or formats being used on both side. of the protocols or formats being used on both side.

To accomplish inter process communication there needs to To accomplish inter process communication there needs to be:be: A remote object on the server side that will listen for

requests. There are 2 proxies created on the client side the

TransparentProxy and the RealProxy that make requests. The RealProxy is the object that transmits the method call to

the server machine. The TransparentProxy is an object that contains a list of all

classes and methods.



There are two ways to access a remote object: There are two ways to access a remote object: Copy the remote object onto the client machine

Able to access private Data Waste of bandwidth and memory for large classes

when not all of the methods are needed. Use object references on the client side

Limits the class exposure Only the method call, arguments, return values, and

exceptions are sent making efficient use of bandwidth.

Both ways are supported in .NET but the second Both ways are supported in .NET but the second one is preferred.one is preferred.



Remote Communication is done through Channels.Remote Communication is done through Channels. HTTP Channel – More interoperable better for Internet TCP Channel – Better performance better for LAN Custom Channel - mix and match properties.

Two Serialization formats supported by .NETTwo Serialization formats supported by .NET Binary- converts data to binary (faster, default in TCP) SOAP- converts data into XML string (more

interoperable, default in HTTP) Each channel had a default formatter but .NET allows

for either formatter to be used in either channel. Remote ObjectRemote Object

Needs to inherit MarshalByRefObject class. Designer Selects Lifetime of Object Single Call

(stateless), Singleton (maintains state), and Client Activated (client invokes and destroys object).


AnalysisAnalysis

Database ConnectivityDatabase Connectivity

SecuritySecurity

InteroperabilityInteroperability

Web ServicesWeb Services


Database- Small Result SetDatabase- Small Result Set

Query: SELECT Lic_License_Number, Query: SELECT Lic_License_Number, Org_Name,Lic_Class,Lic_Status,Lic_Cancel_DateOrg_Name,Lic_Class,Lic_Status,Lic_Cancel_Date,Lic_License_Date,Org_TIN,Org_Status FROM ,Lic_License_Date,Org_TIN,Org_Status FROM csg.Organization, csg.License WHERE csg.Organization, csg.License WHERE Org_Tin=Lic_Tin and Lic_Tin_Type = 'O' and Org_Tin=Lic_Tin and Lic_Tin_Type = 'O' and lower(Org_Name) like '%aetna%' lower(Org_Name) like '%aetna%'

Java time averaged over 10 trials: 453 msJava time averaged over 10 trials: 453 ms .NET time averaged over 10 trials: 843ms.NET time averaged over 10 trials: 843ms Result Set Size is 4Result Set Size is 4 After testing a similar query in an Access database After testing a similar query in an Access database

the query time averaged 63ms for .NET. The the query time averaged 63ms for .NET. The average time for the Java program was 16ms. average time for the Java program was 16ms.


Database- Large Result SetDatabase- Large Result Set

Query: SELECT Lic_License_Number, Query: SELECT Lic_License_Number, Org_Name,Lic_Class,Lic_Status,Lic_Cancel_DateOrg_Name,Lic_Class,Lic_Status,Lic_Cancel_Date,Lic_License_Date,Org_TIN,Org_Status FROM ,Lic_License_Date,Org_TIN,Org_Status FROM csg.Organization, csg.License WHERE csg.Organization, csg.License WHERE Org_Tin=Lic_Tin and Lic_Tin_Type = 'O' and Org_Tin=Lic_Tin and Lic_Tin_Type = 'O' and lower(Org_Name) like '%a%' lower(Org_Name) like '%a%'

Java time averaged over 10 trials: 5834 msJava time averaged over 10 trials: 5834 ms .NET time averaged over 10 trials: 6653ms.NET time averaged over 10 trials: 6653ms Result Size is 17113Result Size is 17113 The time discrepancy is less severe. Wasn’t able The time discrepancy is less severe. Wasn’t able

to duplicate the query in access due to replicating to duplicate the query in access due to replicating 17,000 entries.17,000 entries.


.NET Security Example.NET Security Example

Security Application Tests Authentication and Security Application Tests Authentication and Authorization Using Windows Based Authentication Authorization Using Windows Based Authentication Uses the Identity Object Which Stored My Windows

Account Information. After Authentication I Used the Principal Object to Define After Authentication I Used the Principal Object to Define

the Permissions for a Method. the Permissions for a Method. The Principal Object Contained Only the Role The Principal Object Contained Only the Role

Administrator. Administrator. If the Current User Is Not the Admin the Method Could If the Current User Is Not the Admin the Method Could

Not Be Executed. This Means That the Current User Does Not Be Executed. This Means That the Current User Does Not Have Authorization to Invoke the Secure Method. Not Have Authorization to Invoke the Secure Method.

This Is Tested With the Executing Thread's Current This Is Tested With the Executing Thread's Current Principal Property.Principal Property.


.NET Remoting / J2EE RMI.NET Remoting / J2EE RMI

Steps in .NETSteps in .NET Make a remote object that inherits the

MarshalRefObject class and create a .dll file of the remote object by creating a class library project.

Then create two applications a Client and Server. Used a TCP Channel which by default uses binary

serialization. Steps in RMISteps in RMI

Create interface that extends java.rmi.Remote Create implementation class Run rmic tool to generate stubs and skeletons Create Server app that binds remote object Run Client app


InteroperabilityInteroperability

RMI in J2EE and Remoting in .NET Are Both RMI in J2EE and Remoting in .NET Are Both Simple to ImplementSimple to Implement

Both Allow For Customization of the Transport Both Allow For Customization of the Transport ProtocolProtocol Remoting Can Be Done Over TCP/HTTP, or

Over Custom Channels RMI Can Be Configured Using

SocketFactories and CustomSockets Advantage of RMI in J2EEAdvantage of RMI in J2EE

Multiple Language Support Through CORBA Advantages of Remoting in .NETAdvantages of Remoting in .NET

Highly Customizable- Can Customize the Way Data is Marshalled



After Four Hours in the Computer Lab yesterday After Four Hours in the Computer Lab yesterday with Visibroker…with Visibroker…

Created an IDL (Yes)Created an IDL (Yes) Created Java Classes from IDL (Yes)Created Java Classes from IDL (Yes) Added Functionality to those classes (Yes)Added Functionality to those classes (Yes) Got the Object Running on an ORB (No)Got the Object Running on an ORB (No) Successfully invoked the Object (No)Successfully invoked the Object (No)

Problem: Lack of Example DocumentationProblem: Lack of Example Documentation

Switching to TAO, another CORBA ORB with clear Switching to TAO, another CORBA ORB with clear examples.examples.


CORBA IDLCORBA IDL

//HelloWorld.idl //HelloWorld.idl module com {module com { module wiley { module wiley { module compbooks { module compbooks { module brose {module brose { module chapter4 { module chapter4 { module simple { module simple { module helloWorld { module helloWorld { interface GoodDay { interface GoodDay { string hello(); string hello(); };}; };};};};};};}; };};};};};};};


Create J2EE Web Create J2EE Web ServiceService

Perform the following tasks:Perform the following tasks: Develop web service endpoint InterfaceDevelop web service endpoint Interface

Must extend java.remote.Remote interface Methods must throw

java.rmi.RemoteException (or a subclass) Implement the Web Service Interface Implement the Web Service Interface Write the configuration file “config.xml”Write the configuration file “config.xml” Run Run wscompilewscompile tool to generate . tool to generate .wsdlwsdl file and file and

mapping.xmlmapping.xml file file Package the service in a WAR and deploy it in a Package the service in a WAR and deploy it in a

J2EE Web ServerJ2EE Web Server


Create .NET Web ServiceCreate .NET Web Service

Used the built in WSDL tool (WSDL.exe) provided by Used the built in WSDL tool (WSDL.exe) provided by Microsoft .NET.Microsoft .NET.

Command: WSDL /l:cs /o:StockQuotes.cs /n:Stock c:\Command: WSDL /l:cs /o:StockQuotes.cs /n:Stock c:\CSE333\stockquotes.wsdlCSE333\stockquotes.wsdl

Output : StockQuotes.cs – a C# source code file.Output : StockQuotes.cs – a C# source code file. Options: Options:

\l language CS, VB, JS, or VJS \o output file name \n namespace of output class Others: Protocol (SOAP or HTTP), Server- generate

an abstract class, and other proxy infromation. The next step is to add the source code to the project to The next step is to add the source code to the project to

allow the web service to be consumed.allow the web service to be consumed. Instantiated an object and was able to use methods like Instantiated an object and was able to use methods like

getMarketIndex and getStockQuote(String sq).getMarketIndex and getStockQuote(String sq).


ConclusionConclusion

Database ConnectivityDatabase Connectivity From Our Analysis J2EE Outperformed .NET Applications Heavily Reliant on DB Should Use J2EE

SecuritySecurity J2EE and .NET Offer Similar Functionality CORBA is a Metamodel

InteroperabilityInteroperability RMI and Remoting Both Have Advantages CORBA Is Necessary for Distributed or

Heterogeneous Environments Web ServicesWeb Services

J2EE and .NET Offer the Same Support CORBA Is Better for Large-scale Business Apps Web Services Better for Small Internet Apps


Questions?Questions?

Any Questions?Any Questions?

Documents

Enterprise Component Comparison: An Examination Of J2EE, CORBA, And .NET