I'm anything but tired when I work with Quarkus

Things have been hectic in Quarkus in 2021 for everyone involved - and therefore it is important, when contributing to such an active project, to listen to good music. 

Luckily I have rediscovered the music and songs of Bruce Springsteen and his band. Of course I've heard it before, I bought a CD with his best songs about 10-15 years ago, but somehow listening to it did not inspire me back then, not sure if it happened to you at some point as well.

But something has changed this year. I have bought a new set of CDs and started listening to Bruce Springsteen again, sometimes when I was coding but more often when driving after work when I can make the music very loud 😀.

It is amazing how much power, energy and positive messaging is emanating from so many of Bruce Springsteen's songs.

I honestly don't understand how I managed before without listening to them. I feel energized after it - and I start looking to the next day of exciting coding even if it was busy today in Quarkus. I'm anything but tired when I work with Quarkus 😀.

And I hope all of you who have discovered and started embracing Quarkus have felt the same this year.

Happy Christmas and New Year to All. Enjoy !

Quarkus is all about Developer Joy

No doubt that you, being an open source developer, have already browsed through the QuarkusIO GitHub projects, been impressed by the cool Quarkus web site, and seen a lot of very positive feedback about this truly innovative project which will disrupt the current application runtime ecosystem.

So, I'm not going to go into the details into why Quarkus is such a brilliant project from the technical point of view. I'd only touch on why the Developer Joy is what Quarkus is all about IMHO.

I'm not a member of the Quarkus core team, but I was privileged to witness the launch of the project and observe the team doing the final preparations for the few days. It was obvious that what was really driving this talented team was the desire to make the features and the documentation as simple and accessible as possible from the very start.

Back in the Apache CXF days, I tried very hard with my dear Apache CXF colleagues, to make things as simple as possible for the users. Those of you who followed our progress will hopefully agree.

So, please believe me, and hope you don't mind me saying it, I do see when making the developers happy is what really drives a team. I trust you will confirm it yourself after working with Quarkus.

Get engaged with the project which will fly, become the part of its community now.

Finally, what about a link to some nice music ? Back in May 2018, I blogged about Thorntail v4. As you know by now, Thorntail v4 has not materialized. But, consider Thorntail v4 be an early version of Quarkus, given the core Thorntail v4 contributors helped to shape Quarkus. So that blog post of mine was not a complete flop :-). Besides I had a link there to the most beautiful piece of music, albeit that was a mix one.

So here is a real one. Because it is real now, here comes another new day, here comes Quarkus !

Enjoy !

[OT] Your Software Project is the Best Thing About You

The open source software project you've been contributing to 'encapsulates' your thoughts, ideas, energy, drive to help. It is quite obvious if you start thinking about it.

The API you have contributed to does not have to be perfect, what makes a difference is that you will 'connect' with the developers and users all around the world who have downloaded the released library. The fewer bugs the project has the better you are represented :-).

It is quite possible then that your software project is one of the best things about you :-).
   

Thorntail Goes Total JOSE

JOSE is a set of modern security specifications developed by the best security experts in the industry. It has not always had the best press, with some weaknesses being identified. But it is still evolving, the JOSE libraries become more robust and it is always worth remembering that no ideal security specification exists, a given security mechanism always needs to be applied very carefully, with the support from the experts.

You may or may not be surprised but JOSE is nearly everywhere now. Many of  the current leading SSO providers use OIDC. They use ID and access tokens which are JOSE instances, JWT tokens, typically signed or even encrypted using the JOSE JWS and/or JOSE JWE mechanisms.

Thorntail has been OIDC/JOSE aware for a while. For a start it offers a comprehensive Keycloak integration which not only lets users easily secure their HTTP endpoints with the Keycloak adapters but also offers a pretty unique Keycloak Server integration which will be the topic of one of the next posts.

Next, Thorntail provided an integration with Microprofile JWT, the effort led by Red Hat. It offers an easy access to the individual claims inside a validated JWT token - often it is not enough for the endpoint to validate the token, it may need to make some application specific decisions based on the token content.

Finally, to complete the picture, Thorntail master now offers a support for the generic JOSE, for the users be able to experiment with protecting their data using all that JOSE offers today: signing and/or encrypting the arbitrary data, complete payloads or only their specific parts, using the Java JKS or JOSE JWK key stores.

The application code will be able to inject Jose and configure its properties in YAML files like this one. Currently both Apache CXF JOSE and Jose4J are being tested as Jose implementations. The CXF implementation is currently offered by default - it has proven itself in the production and it also supports JWS and JWE JSON formats , but please do not be concerned if you prefer a quality Jose4J library - we hope the users will show the interest in this feature over time and then we can easily offer a Jose4J option out of the box as well. 

Have a look at the demo please. It shows how JOSE can be used to sign the data in the detached mode. It is actually a very cool feature which is not well known due to JOSE being primarily used in the OIDC/OAuth2 space for now, as opposed to in the regular HTTP service communications. It allows to create a custom envelope where the data to be protected go alongside the signature. Yes, no need to come up with yet another specification to standardize on the envelope format, just choose whatever bean format you prefer, choose the data to be signed, and where the signature in this bean has to be collocated, it is so good.

So, here you go. Are you interested in the modern security ? If yes - see what Thorntail can do.

Enjoy!

Thorntail Bird Brings New Day in Container Development

WildFly Swarm team started thinking about renaming the project awhile back, with the first message to the community coming in February.

Ken and Bob have put a lot of effort into finalizing the process, with the announcements starting coming this week, the week of Red Hat Summit.

The most exciting part is the fact that a new Thorntail Project GitHub organization has been created with the main concepts of this new 4.x line being captured here.

It is going to be a very cool project. For a start, many tests run in Docker Machine. The new project already ships and will add the best and proven components, ready to run in the micro services and Cloud centric environments. It is expected to be light-weight and easy to work with. I hope you are already forking the repository while you are reading this post :-).

Here Comes Another New Day. New Day in the application container development. Start enjoying it now !

Adieu Talend, Hello Red Hat !

Seems it was nearly yesterday when I joined Talend seven years ago. Time has flown so fast... Next week I will be returning to Red Hat but first I will talk a bit about my years with Talend.

I'd like to believe that working for Talend has helped me become a better engineer, grow in confidence.  And what about those unforgettable Talend R&D events :-) ? No doubt, it has been an interesting and exciting journey.

It has not been easy to find a link to a piece of music which would associate well with the company, but I think I've got it in the end. The text there is a bit sombre, but the music reflects well what I'd like to remember about Talend, the energy and the style: enjoy Ave Cesaria By Stromae. Thank you Talend, Goodbye.

And now I'll be heading back to Red Hat :-). I will be joining a WildFly Swarm team and I look forward to and optimistic about it and the new challenge. I'll have to learn new things. I will enjoy it too. And in time, after I settle well, I will return to this blog and talk about WildFly Swarm and other related projects.

Stay Tuned !

Apache CXF Story Will Continue

When I started working on Apache CXF full time it was already a well established project, shipping a production quality JAX-WS and an early JAX-RS implementations.

During the next N years, with some short breaks, all of us did put a lot of effort into supporting the CXF community,  keeping enhancing the JAX-RS, various security features, fixing lots and lots of bugs, and trying to support the idea that "CXF was more than just a library" :-).

I'm curious, how many SOAP or pure HTTP calls have been made over the years with the help of CXF ? Sometimes one can read: "This product supports thousands of transactions per minute". Would be fun to read somewhere that "CXF has supported several millions of service calls over 10 years" :-). Or how many downloads have been made ? Who knows...

It is satisfying to see that today the users keep coming to CXF and ask questions and open new issues. No doubt it has helped many users, helped to completely mainstream JAX-WS and then JAX-RS, alongside its Jersey and RestEasy 'colleague' frameworks.

No doubt the Apache CXF story will continue and I've been happy to be part of this story. Thank You !

[OT] Work Next Year the way Arsenal and Liverpool played their football

I've been lacking the ideas on how to write the regular and last off-topic post of the year, thinking which piece of music I should link to.

And then the inspiration came from the completely unexpected source.

Those of you who follow Arsenal FC in the English Premier League know that Arsenal can either draw against Liverpool but in such a way that fans will remember it for years (yes, that Liverpool 4 to Arsenal 4 draw), or, most likely, lose badly to this Merseyside team, something like 1:4 or similar.

So less than a week earlier, Arsenal was playing with Liverpool in London, losing 0:2. Oh well, most Arsenal fans thought, one of those days which can only be described in Fever Pitch. Then, in the 2nd half, after the few minutes, while the fans were having mince pies and tea,  Arsenal were 3:2 up, with Liverpool managing to equalize. The game saw many mistakes and brilliant moves and fans just had the day of the year watching the game. I liked this summary.

How would I translate that to a New Year wish for you, the software engineers ? Here it is:

Enjoy your work next year, try to do something extraordinary, something new, and don't be afraid to make mistakes :-)

Happy New Year !

Get OpenAPI v3 JSON with CXF Now !

The Apache CXF has done some initial work to have OpenAPI v3 JSON reported from the JAX-RS endpoints.

Andriy Redko has started with the OpenApiFeature implementation which depends on the latest OpenApi v3 aware swagger-core and swagger-jaxrs libraries and demoed it here.

In meantime I did a Swagger2 to OpenApi v3 JSON conversion filter which reacts to openapi.json queries by converting Swagger2 swagger.json produced by Swagger2Feature to openapi.json with the idea of making it easier for the existing upstream code (which has already integrated Swagger2Feature) to start experimenting with OpenAPI v3, before doing the switch to the new feature (and dependencies).  

This effort is still a work in progress but the results in both cases are promising. The new feature and the conversion filter will require some more improvements but you can start experimenting with them right now. And if you are someone like me then you will be positively surprised that SwaggerUI  3.6.1 and newer can handle both Swagger2 and OpenAPI v3 JSON :-).

Enjoy !

Simple Reuse of org.reactivestreams in CXF

I mentioned earlier that one could link RxJava2 Flowable with JAX-RS AsyncResponse with Subscriber which will do the best effort at streaming the data pieces converted to JSON array elements, see this example.

That works but requires the application code refer to both JAX-RS AsyncResponse and CXF specific JsonStreamingAsyncSubscriber (RxJava2 specific at the earlier stage), as opposed to simply returning Flowable from the resource method.

In meantime, John Ament added the initial Reactor integration code, and as part of this work John also provided the org.reactivestreams compatible JsonStreamingAsyncSubscriber to be optionally used with the CXF Reactor invoker.

As a result we've found the opportunity to do some refactoring and introduce the simple org.reactivestreams utility module which is now reused between CXF RxJava2 invoker and Reactor invoker: the common invoker code both invokers delegate to will check if JSON is expected and if yes then will register JsonStreamingAsyncSubscriber as org.reactivestreams.Subscriber with org.reactivestreams.Publisher which can be either RxJava2 Flowable or Reactor Flux.

The end result is that users can now write simpler code by returning Flowable or Flux from the service methods.

It is an interesting but simple example of reusing the org.reactivestreams aware code between different org.reactivestreams implementations.

The Real Data Processing with Apache Beam and Tika

If we talk about the data injestion in the big data streaming pipelines it is fair to say that in the vast majority of cases it is the files in the CSV and other text, easy to parse formats which provide the source data.

Things will become more complex when the task is to read and parse the files in the format such as PDF. One would need to create a reader/receiver capable of parsing the PDF files and feeding the content fragments (the regular text, the text found in the embedded attachments and the file metadata) into the processing pipelines. That was tricky to do right but you did it just fine.

The next morning you get a call from your team lead letting you know the customer actually needs the content injested not only from the PDF files but also from the files in a format you've never heard of before. You spend the rest of the week looking for a library which can parse such files and when you finish writing the code involving that library's not well documented API all you think of is that the weekends have arrived just in time.

On Monday your new task is to ensure that the pipelines have to be initialized from the same network folder where the files in PDF and other format will be dropped. You end up writing a frontend reader code which reads the file, checks the extension, and then chooses a more specific reader.   

Next day, when you are told that Microsoft Excel and Word documents which may or may not be zipped will have to be parsed as well, you report back asking for the holidays...

I'm sure you already know I've been preparing you for a couple of good news.

The first one is a well known fact that Apache Tika allows to write a generic code which can collect the data from the massive number of text, binary, image and video formats. One has to prepare or update the dependencies and configuration and have the same code serving the data from the variety of the data formats.

The other and main news is that Apache Beam 2.2.0-SNAPSHOT now ships a new TikaIO module (thanks to my colleague JB for reviewing and merging the PR). With Apache Beam capable of running the pipelines on top of Spark, Flink and other runners and Apache Tika taking care of various file formats, you get the most flexible data streaming system.

Do give it a try, help to improve TikaIO with new PRs, and if you are really serious about supporting a variety of the data formats in the pipelines, start planning on integrating it into your products :-)

Enjoy!

Mostly On Topic: CXF and Swagger Integration Keeps Getting Better

While thinking about a title of this post I thought the current title line, with the " Keeps Getting Better" finishing touch may work well; I knew I used a similar line before, and after looking through my posts I found it.

Oh dear. I'm transported back to 2008, I can see myself, 9 years younger, walking to the Iona Technologies office, completely wired on trying to stop the Jersey JAX-RS domination :-), spotting an ad of the latest  Christina Aguilera's albom on the exit from the Lansdowne Dart station and thinking, it would be fun, trying to blog about it and link to CXF, welcome to the start of the [OT] series. I'm not sure now if I'm more surprised it was actually me who did write that post or that 9 years later I'm still here, talking about CXF :-).

Let me get back to the actual subject of this post. You know CXF started quite late with embracing Swagger, and I'm still getting nervous whenever I remind myself Swagger does not support 'matrix' parameters :-). But the Swagger team has done a massive effort through the years, my CXF hat is off to them.

I'm happy to say that now Apache CXF offers one of the best Swagger2 integrations around, at the JSON only and UI levels and it just keeps getting better.

We've talked recently with Dennis Kieselhorst and one can now configure Swagger2Feature with the external properties file which can be especially handy when this feature is auto-discovered.

Just at the last minute we resolved an issue reported by a CXF user to do with accessing Swagger UI from the reverse proxies.

Finally, Freeman contributed a java2swagger Maven plugin.

Swagger 3 will be supported as soon as possible too.

Enjoy!

Apache CXF 3.2.0 NIO Extension

In CXF 3.2.0 we have also introduced a server-side NIO extension which is based on the very first JAX-RS API prototype done by Santiago Pericas-Geertsen. The client NIO API prototype was not ready but the server one had some promising start. It was immediately implemented in CXF once a long-awaited 1st 2.1 API jar got published to Maven.

However, once the JAX-RS 2.1 group finally resumed its work and started working on finalizing NIO API, the early NIO API was unfortunately dropped (IMHO it could've stayed as an entry point, 'easy' NIO API), while the new NIO API did not materialize primarily due to the time constraints of the JCP process.

The spec leads did all they could but it was too tight for them to make it right. As sad as it was, they did the right decision, rather then do something in a hurry, better do it right at some later stage...

It was easily the major omission from the final 2.1 API. How long JAX-RS users will wait till the new JAX-RS version will get finalized with the new NIO API becoming available to them given that it takes years for major Java EE umbrella of various specs be done ?

In meantime the engineering minds in SpringBoot and RxJava and other teams will come up with some new brilliant ways of doing it. There will be not 1 but several steps ahead.

Which brings me to this point: if I were to offer a single piece of advice to Java EE process designers, I'd recommend them to make sure that the new features can be easily added after the EE release date with the minor EE releases embracing these new features to follow soon,  without waiting for N years. If it were an option then we could've seen a JAX-RS 2.2 NIO in say 6 months - just a dream at the moment, I know. The current mechanism where EE users wait for several years for some new features is out of sync with the competitive reality of the software industry and only works because of the great teams around doing EE, the EE users loyalty and the power of the term 'standard'.

Anyway, throwing away our own implementation of that NIO API prototype now gone from 2.1 API just because it immediately became the code supporting a non-standard feature was not a good idea.

It offers an easy link to the Servlet 3.1 NIO extensions from the JAX-RS code and offers the real value. Thus the code stayed and is now available for the CXF users to experiment with.

It's not very shiny but it will deliver. Seriously, if you need to have a massive InputStream copied to/from the HTTP connection with NIO and asynchronous callbacks involved, what else do you need but a simple and easy way to do it from the code ? Well, nothing can be simpler than this option for sure.

Worried a bit it is not a standard feature ? No, it is fine, doing it the CXF way is a standard :-)
  

JAX-RS 2.1 is Released

JAX-RS 2.1 (JSR 370) has been finally released and JAX-RS users can now start looking forward to experimenting with the new features very soon, with a number of final JAX-RS 2.1 implementations being already available (such as Jersey) or nearly ready to be released.

Apache CXF 3.2.0 is about to be released shortly, and all of the new JAX-RS 2.1 features have been implemented:  reactive client API extensions, client/server Server Sent Events support, returning CompletableFuture from the resource methods and other minor improvements.

As part of the 2.1 work (but also based on the CXF JIRA request) we also introduced RxJava Observable and recently - RxJava2 Flowable/Observable client and server extensions. One can use them as an alternative to using CompletableFuture  on the client or/and the server side. Note, the combination of RxJava2 Flowable with JAX-RS AsyncResponse on the server is quite cool.

The other new CXF extension which was introduced as part of the JAX-RS 2.1 work is the NIO extension, this will be a topic of the next post.

Pavel Bucek and Santiago Pericas-Geertsen were the great JAX-RS 2.1 spec leads. Andriy Redko spent a lot of his time with getting CXF 3.2.0 JAX-RS 2.1 ready.

[OT] I Work with CXF and I Want It That Way

The time has come for a regular OT post.

The journey of the software developer is always about finding the home where he or she can enjoy being every day, can look forward to contributing to the bigger effort every day.

In addition to that the journey of the web services developer is always about finding the web services framework which will help with creating the coolest HTTP service on the Web. We all know there are many quality HTTP service frameworks around.

My software developer's journey so far has been mostly about supporting one of such web services frameworks, Apache CXF. It has been a great journey.

Some of you helped by using and contributing to Apache CXF earlier, some of you are long term Apache CXF users and contributors, preparing the ground for the new users and contributors who are yet to discover CXF.

No matter which group you are in, even if you're no longer with CXF, I'm sure you've had that feeling at least once that you'd like your CXF experience last forever :-).

Listen to a message from the best boys band in the world. Enjoy :-)

  

Multiple JWE Encryptions POC With Apache CXF in two hours

The summer has been great so far, and as usual, instead of watching yet another sport event final, you've decided to catch up with your colleagues after work and do a new round of the Apache CXF JOSE coding. Nice idea they said.

The idea of  creating an application processing the content encrypted for the multiple recipients has captured your imagination.

After reviewing the CXF JWE JSON documentation you've decided to start with the following client code. This code creates a client proxy which posts some text.

JWE JSON filter registered with the proxy will encrypt whatever the content the proxy is sending (does not have to be only text) only once, and the content encrypting key (CEK) will be encrypted with the recipient specific encrypting keys. Thus if you have 2 recipients then CEK will be encrypted twice.

Registering the jwejson1.properties  and jwejson2.properties with the proxy instructs the JWE JSON filter that a JWE JSON container for 2 recipients needs to be created, that the content encryption algorithm is A128GCM and key encryption algorithm is A128KW, and each recipient is using its own symmetric key encryption key. Each recipient specific entry will also include a 'kid' key identifier of the key encryption key for the service to figure out which JWE JSON entry is targeted at which recipient.

Setting up the client took you all one hour.

Next task was to prototype a service code. That was even easier. Loading the recipient specific properties, locating a recipient specific entry and getting the decrypted content was all what was needed.

Two hours in total. Note I did not promise it would take you 30 mins to do all the POC, it would've been really a child's play which is not realistic. With the two hours long project it is more complex, it felt like it was a walk in the park :-)



 

How to do JOSE in Apache CXF service code

This blog entry continues the series started with the introduction to Apache CXF JOSE implementation followed recently with the post talking about the signing of HTTP attachments.

So CXF helps with shipping JOSE filters which can protect the application data by wrapping them into JOSE JWS or JWE envelopes or verify that the data has been properly encrypted and/or signed. In these cases the application code is not even aware that the JOSE processors are involved.

How would one approach the task of signing/verifying and/or encrypting/decrypting the data directly in the application code ? For example, what if an individual property of the bigger payload needs to be JOSE protected ?

The most obvious approach is to use either CXF JOSE or the preferred 3rd party library to deal with the JOSE primitives in the application code. This is Option 1. It is a must option if one needs to have a closer control over the JOSE envelope creation process.

Or you can basically do nearly nothing at all and let CXF handle it for you, this is Option 2. This is a CXF Way Option - make it as easy as possible for the users to embrace the advanced technologies fast. It is not though only about making it easy - but is also about having a more flexible and even portable JOSE-aware code.

In this case such requirements as "sign only" or "encrypt only" or "sign and encrypt" and similarly for the "verify/decrypt" are not encoded in the code - it is managed at the time of configuring the JOSE helpers from the application contexts (by default they only sign/verify).

Likewise, the signature and encryption algorithm and key properties are controlled externally.

I know, it is hard to believe that it can be so easy. Try it to believe it. Enjoy !

Signing HTTP Attachments with Apache CXF JOSE

JOSE, the primary mechanism for securing various OAuth2/OIDC tokens, slowly but surely is becoming the main technology for securing the data in the wider contexts. JOSE, alongside COSE, will become more and more visible going forward.

I talked about Apache CXF JOSE implementation in this post. One of the practical aspects of this implementation is that one can apply JOSE to securing the regular HTTP payloads, with the best attempt at keeping the streaming going made by the sender side filters, with the JOSE protection of these payloads (JWS signature or JWE encryption) being able to 'stay' with the data even beyond the HTTP request-response time if needed.

In CXF 3.1.12 I have enhanced this feature to support the signing of HTTP attachments. It depends on JWS Detached Content and Unencoded Content features which allow to integrity-protect the payload which can continue flowing to its destination in a clear form.

Combining it with the super-flexible mechanism of processing the attachments in Apache CXF, and particularly with the newly introduced Multipart filters which let pre-process individual multipart attachment streams, helped produce the final solution.  

Besides, as part of this effort, the optional binding of the outer HTTP headers to the secure JWS or JWE payloads has also been realized.

Be the first in experimenting with this IMHO very cool feature, try it and provide the feedback, enjoy !

Distributed Tracing with CXF: New Features

As you may already know Apache CXF has been offering a simple but effective support for tracing CXF client and server calls with HTrace since 2015.

What is interesting about this feature is that it was done after the DevMind attended to Apache Con NA 2015 and got inspired about integrating CXF with HTrace.

You'll be glad to know this feature has now been enhanced to get the trace details propagated to the logs which is the least intrusive way of working with HTrace though should you need more advanced control, CXF will help, see this section for example.

CXF has also been integrated with Brave. That should do better for CXF OSGI users. The integration work with Brave 4 is under way now.

[OT] You worked with CXF, Have a Great Time Out

Apache CXF has had a good year, with thanks to you using it, reporting the issues, asking the questions, with some of you spending a lot of your own time on helping improving it and keeping it flying and alive.

Time has come for a well deserved break. Have a Great Time Out, enjoy it !