Marcin Świerczyński's Blog

Strong passwords hashing with Apache Shiro

Fri Jan 25 22:30:12 -0800 2013

What is it all about?

Recently, I wanted to provide a strong password hashing in a plain Java application. I decided to use Apache Shiro.

As Apache Shiro's website says:

Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management.

Shiro is very powerful and provides all-in-one security solution. For instance, it can communicate with a persistence layer directly, so you don't need to take care of a boilerplate code. However, my intention was only to provide a strong password hashing, nothing more or less.

So, how to do that?

Hashing salted passwords

My implementation uses a separate salt for each user. Although, there are different opinions about that, I've decided that salt will be stored in its own column in a database. Let's start coding then.

First of all we should generate a salt:

protected ByteSource getSalt() {
    return new SecureRandomNumberGenerator().nextBytes();
}

Given salt, we can hash plain text password:

 new Sha512Hash(password, salt, hashIterations).toHex();

Of course, we didn't want to store ByteSource directly in a database, so I converted it to a hex-encoded string:

 salt.toHex();

Now we can store both hashed password and salt in a database. How about comparing a result with a plain text password?

Comparing clear text and hashed passwords

Obviously, to compare a user-provided password with its hashed version, we need to hash it again using the same salt and compare the result with what is stored in a database.

ByteSource salt = ???
String hashedPassword = new Sha512Hash(clearTextPassword, salt, hashIterations).toHex();
return hashedPassword.equals(dbStoredHashedPassword);

But how to get ByteSource object from a string we saved? It's easy as well.

 ByteSource salt = ByteSource.Util.bytes(Hex.decode(salt));

Putting it all together

The complete example could look like:

public boolean passwordsMatch(String dbStoredHashedPassword, String salt, String clearTextPassword) {
    ByteSource salt = ByteSource.Util.bytes(Hex.decode(salt));
    String hashedPassword = hashAndSaltPassword(clearTextPassword, salt);
    return hashedPassword.equals(dbStoredHashedPassword);
}

public void hashPassword(String clearTextPassword) {
    ByteSource salt = getSalt();
    String hash = hashAndSaltPassword(clearTextPassword, salt);
    // persist salt and hash or return them to delegate this task to other component
}

private String hashAndSaltPassword(String clearTextPassword, String salt) {
    return new Sha512Hash(clearTextPassword, salt, hashIterations).toHex();
}

private ByteSource getSalt() {
    return new SecureRandomNumberGenerator().nextBytes();
}

What is the hashIterations?

The hash iterations value indicates the number of times the clear password is hashed. The value larger, the hash algorithm applied more times, making the process slower and, as a result, making the password harder to break by a brute-force attack.

What's the perfect value? It depends on you security requirements and your hardware performance. Too many iterations, means slower log-in process from users perspective. Too few, means easier to compromise passwords.

I've decided to 200.000 iterations. More on that issue can be found on Stormpath's blog.

That's all, folks

Passwords hashing appeared to be quite easy with Apache Shiro. The code I provided lacks of some null-checks and exceptions handling. I omitted them for the sake of clarity.

And remember, never store plain text passwords in a database :-)

Schema Design in MongoDB

Sun Nov 11 15:21:23 -0800 2012

Recently, I started MongoDB for Developers course from 10gen Education. The third week brought some very interesting information on schema design.

I decided to write it down here for further reference but I hope it will also be useful for others.

MongoDB limitations

MongoDB do not provide foreign key constraints known from relational databases. How can we deal with it? Well, one option is embedding. If you don't separate documents into a few collections but embed one into other, you basically avoid using foreign key at all! It of course isn't a silver bullet - it depends on your data usage pattern or other MongoDB limitations (like max. 16MB per document), but it's definitely worth considering.

Moreover, Mongo don't provide transactions. It looks quite serious but it actually can be worked around easily, because of a few solutions.

First of all, MongoDB supports atomic operations. It means you have a guarantee that a single document will be persisted atomically, ie. saved all or nothing. How does it help the situation? Well, if you embed a document into another, you don't need to worry about transactions at all. You save one document (atomically!), instead of a few, which would need transactional approach.

If you can't or don't want to embed documents, you still have some options. First of all, you can implement some sort of locking on the application level. For example, it can be critical sections, semaphores, etc.

The last option is to tolarate a little bit of inconsistency. Sometimes, actually more often nowadays, it isn't crucial to provide the same data to all users at the same time. If you consider social networks, it makes sense to show the fact that you made a new friendship a bit later to some of your friends, than to others. In this case the goal is to achieve eventual consistency, not the immediate consistency.

Relations

In MongoDB, you can achieve relations between documents on one of four ways:

put a foreign key in one of these documents
put foreign keys in both documents
embed one document into another

Which one to choose depends on a few factors, including relation type.

One to One

In one to one relation you can ask yourself three questions.

How often will I use the data? If the data won't be used often as a single piece, you probably should separate it into two documents.

How big is the data? If the data size exceeds 16 MB then it's a no brainer - you need to separate it. Also, when the data is big, however under 16 MB, but you constantly update only a part of it, it probably makes sense to separate it as well to avoid update overhead. Of course, it's also important here to think about how the data will grow up in the future.

Do I need to update the data atomically? If the answer is yes and there are no other contraindications, then it makes sense to keep it together as mentioned above.

One to Many

The question here is: is it real one to many or maybe it's rather one to few? So, if you have a people-city relation, it makes sense to use true linking and two collections. However, if you have a blog post - comments relation, then you probably should decide to embedding.

Many to Many

As a rule of thumb, it makes the most sense to create two collections and link them using array fields. If you'd like to make this connection bidirectional, then the array should be in both collections. It becomes more powerful together with multikey indexes.

Conclusion

To sum up, we can say that a rule of thumb is to embed. Beside the advantages mentioned above, there is one more - performance. Embedded documents lays near each other on the HDD, probably in the same sector, so reading them is much faster because of hard drives nature.

However, it all depends on the data access patterns of your application. You need to consider potential duplication anomalies as well as performance. I hope the above recommendations will help with the decission.

Functional Programming Principles in Scala Course

Thu Nov 08 20:10:23 -0800 2012

A few days ago I finished Functional Programming Principles in Scala course by Martin Odersky and Coursera. I just wanted to share my thoughts on it, since it took quite a bit of my time during last seven weeks.

Goal

My goal was to get a taste of functional programming which I had a very little contact with before. Also, I wanted to polish my Scala skills, because I'm still learning it. Was the plan accomplished? Well, definitely! But it wasn't a piece of cake!

Challenges

It's quite challenging to change your mindset and start thinking in a functional way. But when you get the point, it's unbelievably rewarding!

Also, the resulting code is very elegant and consistent. However, I got to the point where I think it needs more understanding (or maybe just experience) not to make it inefficient, mainly because of have usage of recursion. Scala helps the situation by introducing tail recursion, but again, it takes time for a beginner's mind to wrap around it. Paradoxically, that's probably the biggest gain from the course - to change the way you think.

Assignments

The most important part of the course were weekly assignments. I spent a lot of time on them and I really enjoyed every minute! They were challenging, but not in "turning you off" way.

Each assignment was rated in 10 points scale - 8 points for code validity and 2 for style. The score was calculated using automated tests, which is actually fully understandable, considering participants number (~50k last time I checked it). However, it looks like the grading introduces a lot of misunderstanding. I've read many comments about how it's misleading and how a high (or low) rate doesn't proof anything. I agree, but I can't really imagine how it could work without grades. I, personally, was really excited when I got 10/10 after a few hours of exercising my mind. And while it doesn't proof anything, I was at least ensured that I was on a good path.

Lectures

Lectures were integral part of the course. I was watching them before each assignment and they were helping a lot. They were mainly focused on theoretical aspect. I could learn how the code is evaluated and how data structures work internally. That's good because most of tutorials and articles on the Internet focuses on a practical part, so a source of knowledge about what's going on under the hood is much appreciated. That wouldn't be so easy, however, without Martin Odersky. He is a great teacher and it's quite obvious he's excited about what he is doing.

What's next?

Well, I think I'll get back to reading Programming in Scala (which I highly recommend, by the way) and learning Play! Framework.

To sum up, I need to say again that I really enjoyed the course. I feel I gained a lot from it. I'd like to thank you to both Martin Odersky and Coursera team!

Configuring IntelliJ IDEA for Play! Framework

Thu Jun 07 12:45:01 -0700 2012

Some time ago I recorded a short screencast describing how to configure Play! Framework 1.2.4 with IntelliJ IDEA 11. The point was to promote the framework and to get some experience in screencasts recording :)

I'm aware it's a bit outdated now, since Play! 2 has been released. However, I decided to publish it. I hope somebody make a use of it!

Code Simplicity by Max Kanat-Alexander

Sun Apr 15 12:04:23 -0700 2012

Thanks to O'Reilly Blogger Review Program I was recently able to read Code Simplicity by Max Kanat-Alexander. First of all, I have to admit I was confused by the title. I thought that the book will be about, well, coding. But it isn't - in the whole text there is almost no code at all! Instead, on a first few pages, you can read that the book is about a design. But again, if you, like me, think about UML charts or design patterns, you will be fooled again. There is nothing about that either. Then, what the book is about?

It's about good practices in software development. The author tries to create the science of software development. Has he succeeded? In my opinion - unfortunately, not.

He wrote that the ultimate goal of software is to help people. He wrote that the cost of software maintenance is much more important than the cost of its implementation. He wrote about YAGNI and the fact that a code should be as simple as possible.

That's all true. But these issues were mentioned in so many books that you probably already know them! At least, if you read any book by Robert Martin or Martin Fowler.

But let's assume for a moment, that you haven't read any. Is Code Simplicity worth buying then? I think it still isn't. Why? Because the biggest drawback of this book is that it tells what but doesn't tell how. You will read that simplicity is the most important factor of software design, but you won't get a practical example of how to achieve it. Nothing about refactoring, single responsibility principle and so on. The book says that each change introduces a possible bug, but it only gives two advices on how to build easy to change systems: DRY and don't fix it if it isn't broken. That's fine, but does mentioning it really help you to build better software? You probably already know that you shouldn't copy-paste your code...

Reading the above you could think that the book is a complete disaster. But it isn't the case. It just isn't a good book for a programmer. Well, at least for a programmer who is interested in his craftsmanship. However, I'd say this is a good book for a non-technical manager who would like to understand his engineering team better. After reading, he'll get a big picture of how software developers think and what is important for them. No details, but do they really need them?

To sum up, I, as a software engineer, am disappointed by Code Simplicity, so I wouldn't recommend it to my teammates. But I'd recommend it to my product manager to make our communication in the future easier.

O’Reilly Product Page: Code Simplicity

Mastering Advanced Git by Matthew McCullough and Tim Berglund

Sun Feb 12 16:01:23 -0800 2012

It was almost a year ago when I had a pleasure to review Mastering Git by Matthew McCullough and Tim Berglund. Today, thanks to O’Reilly, I can take a look at its successor - Mastering Advanced Git.

Just as a reminder: I really liked the first part. But I simply loved the new one! It covers Git details in very thorough way. And, what is perhaps even more important, it leads you through them in extremely straightforward manner.

In all advanced topic discussions, there is always one important issue to solve. Considering a large number of possible topics, which should we choose? Matthew and Tim decided to talk about pull and push options, rerere, methods of moving a code outside the repo, orphan branches and refspecs. Some of them are just switches to configure and (almost) forget. Although, I personally found patches, bundles and refspecs the most valuable, because these have a lot of possible use cases during the whole development and code management cycle. Nevertheless, all of the topics are well prepared. It obvious that both teachers are professionals in Git.

In terms of technical quality, I haven’t found any differences. Both video and sound are still very high quality.

Listening to Matthew and Tim is simply a pleasure. I strongly recommend it for everyone who wants to polish his or her Git skills.

Just a short disclaimer at the end: Although I referenced to Mastering Git a few times, I need to mention that Mastering Advanced Git is a separate product. You do not need to watch the first part to benefit from the Mastering Advanced Git. If you feel comfortable with Git on intermediate level, do not hesitate and go straight to the most advanced one.

O’Reilly Product Page: McCullough and Berglund on Mastering Advanced Git

Cloud Foundry + Grails = lightning fast deployment

Sat Jan 07 17:45:50 -0800 2012

The purpose of this article is to show how quickly and easily deploy Grails application to Cloud Foundry platform.

What is Cloud Foundry?

From cloudfoundry.com:

Cloud Foundry is an open platform as a service, providing a choice of clouds, developer frameworks and application services. Initiated by VMware, with broad industry support, Cloud Foundry makes it faster and easier to build, test, deploy and scale applications. It is an open source project and is available through a variety of private cloud distributions and public cloud instances, including CloudFoundry.com.

Prerequisites

To make a use of this article you'll need to have Grails framework installed.

To check if Grails is properly installed, use

  grails -version

You should see something like

  Grails version: 2.0.0

If you haven't, just follow the Grails Getting Started Guide.

Let's the fun begin

The whole process is extraordinary simple! Just do the following steps.

1. Create Grails app

  grails create-app cloud_foundry_example

2. Change your working directory to a new application directory

  cd cloud_foundry_example

3. Install Cloud Foundry plug-in

  grails install-plugin cloud-foundry

4. Configure your Cloud Foundry credentials

You can configure it in both grails-app/conf/Config.groovy and in ~/.grails/settings.groovy. Since the file will contain sensitive, it's not recommended to put it in source control. That's why the second option is considered the best practice.

So, configure your credentials using

  grails.plugin.cloudfoundry.username = "<your_username>"
  grails.plugin.cloudfoundry.password = "<pass>"

5. Test your config

  grails cf-info

The output should look like

  VMware's Cloud Application Platform
  For support visit http://support.cloudfoundry.com
  Target:   http://api.cloudfoundry.com (v0.999)
  
  User:     <your_username>
  Usage:    Memory   (0B of 2.0G total)
            Services (0 of 16 total)
            Apps     (0 of 20 total)

6. Deploy your app!

  grails prod cf-push

You'll be asked about the application URL, and also about some persistence services (in the time of writing: MySQL and PostgreSQL). I advise to accept default address and chose one of these services.

If you want to re-deploy after some changes, just do

  grails prod cf-update

That's it!

The app is deployed and ready to work. A proof? PartyPlanner app.

In next part I'll describe how to configure different services in Cloud Foundry.

Mastering Git by Matthew McCullough and Tim Berglund

Sat Mar 05 11:00:58 -0800 2011

On the beginning, I just want to say one thing - McCullough and Berglund on Mastering Git is a perfect way to learn Git! The only requirement is an ability to learn in a classroom-type environment. An impression of class or conference is maximized by the fact that “students” are asking questions. If you're able to learn from a lecture, keep reading!

This video provide you with step-by-step instructions on how to efficiently use Git in a production environment. You'll begin from the very beginning: installing and configuring Git on different platforms.

Then you'll go to basics like managing repositories, three-stage approach, committing, creating local branches and tracking the remote ones and so on.

What I especially like about this training is the fact that it also covers more sophisticated topics. You'll learn what DAG is and how this structure influences a whole Git. You'll become a best friend of tags (both light- and heavyweight) and know how to use rebasing, amend, stashing and others. I've to mention that it's quite easy to get lost during these topics discussion, but you can always rewind the video and repeat a complex part.

A few words about technical details. The whole training is recorded in high-resolution, so it was a pleasure to watch it. The sound was also very high-quality. The only things missing are subtitles. It'd be a great help for foreigners and the disabled.

The verdict is simple. I would recommend this video to a friend.

O'Reilly Product Page: Mastering Git by Matthew McCullough and Tim Berglund

2010 summary and 2011 resolutions

Fri Dec 31 15:38:18 -0800 2010

I've never done summary of the past year before. As well as I've never make huge resolutions for the upcoming year. But, come on, this year was so great it deserve this! We often forget about our past successes so I think that just thinking about them is a great way to start the New Year with good attitude. On the other hand, the next year resolutions list can be a guide for what to do in every single day to get closer to our aims. And, after all, I've never got a blog to post the summary ;)

So, first things first. This year was good, very good. What I've done?

I've graduated from Polish-Japanese Institue of Information Technology with honours degree in Computer Science.
I've found a new, great job that I really enjoy. It helps in my skills development and, what is the most important, I do what I love to do!
I've learned quite many new technologies and programming languages:
- Android SDK. The result is visible in Android Market and it's called AutoResponder ;)
- Python / Django
- Objective C / iOS SDK
- Groovy / Grails
I've been on my first Java conference, GeeCON in Poznan.

What do I plan to do in 2011?

First of all, as usual I want to improve my development/programming skills, especially in iOS, Android and Python. I also want to polish my "soft" development abilities. How to do that? More books, conferences, and, first of all, practice - both in work and in open-source projects.
I want to learn Scala and Lift framework.
There are other languages than programming ones, aren't there? ;) I want to polish my English skills. This blog is one of the steps toward it. Moreover, I plan to start the new course on the beginning of the year.
There is also one huge project I plan to start in 2011, but for now I can't say much more.

That's all for now. One year is quite a lot of time so I will probably add more items to the above list, if I only have enough time.

Happy New Year, Everone! :)

How to create UIPickerView with toolbar above it in iOS

Mon Dec 06 20:07:24 -0800 2010

A few days ago, I had to implement a UIPickerView based select list with toolbar above it. The toolbar had to have a button to close the picker. The whole solution had to be very similar to the one used in a mobile version of Safari browser. How to do that?

The clue of the problem is contained in just two properties of UIResponder class: inputView and inputAccessoryView. The first one contains a view which will be displayed if its owner will become a first responder. For example, for UITextFields it's a keyboard by default. The second one in turn, represents a view which will be displayed before (ie. above) the view pointed by inputView property.

So now it should be quite easy:

    UIResponder *firstResponder; // use your future first responder
    
    UIPickerView *pickerView = [[UIPickerView alloc] init];
    pickerView.showsSelectionIndicator = YES;
    
    firstResponder.inputView = pickerView;
    [pickerView release];
    
    UIToolbar *toolbar = [[UIToolbar alloc] initWithFrame:CGRectMake(0, 0, 320, 40)];
    toolbar.barStyle = UIBarStyleBlackTranslucent;
    
    firstResponder.inputAccessoryView = toolbar;
    [toolbar release];

Unfortunately, it isn't. Both inputView and inputAccessoryView are readonly properties, so we've to redeclare them in a subclass:

    @property (readwrite, retain) UIView *inputView;
    @property (readwrite, retain) UIView *inputAccessoryView;

What is the best, we aren't limited to use this feature on UITextFields only. Because of fact that UIView inherits from UIResponder, we can attach this behaviour to all views, for example to a button or a table cell. To do that we have to override canBecomeFirstResponder method in our subclass. For example, the UIButton subclass implementation can look like this:

    implementation CustomButton { } //it is UIButton subclass
    
    @synthesize inputView, inputAccessoryView;
    
    - (BOOL) canBecomeFirstResponder {
        return YES;
    }
    
    - (void)dealloc {
        [inputView release];
        [inputAccessoryView release];
        [super dealloc];
    }
    
    @end