May 31 2010

Announcing: Spring Security 3: The Book

I write this announcement with a lot of excitement and a great sigh of relief. It was about a year ago when I was approached by Packt Publishing, who was interested in my introduction to Spring Security, and somehow got the idea that I could write. :) They recognized that there was no published book focusing on Spring Security (as I have often noted myself), and wondered if I would be interested in writing a book on the subject. For me, the idea really clicked, and I jumped on the opportunity to write a book about a subject that I had already had some significant exposure to, and a desire to explore further.

Fast-forward one year, and the final 400+ page book is now available on Amazon or from other online sources, as both a printed book and eBook (eBook available from Packt). I’ve put together a web site with more information about the book at – there, you’ll find a rough idea of what the book covers, what it is (and isn’t), and where you can buy it or get more information.

This has been an enormously interesting research project for me, and the culmination of hundreds (probably thousands) of hours of night and weekend work, completed in addition to a demanding full-time job and family.

In a quick list of bullet points, we cover:

  • Overall Spring Security architecture, at both a high and low level
  • Implementation of all major Spring Security features, including:
    • JDBC-backed authentication
    • Method security with annotations and pointcuts
    • Session fixation protection
    • Concurrent session control
    • Password hashing
    • Access control lists (ACLs)
  • Integration of Spring Security with external authentication providers, including:
    • OpenID
    • LDAP
    • CAS
    • Client certificates (X.509)
    • Kerberos
    • Microsoft Active Directory
  • Full configuration of Spring Security using explicit Spring Bean declarations
  • Many custom coding samples, including custom servlet filters, custom AuthenticationProviders, exception handlers, and much more.

All of these topics are covered both at a high level (how and why do they work), and a low level (how to configure, how to code, how to implement). It’s a great mix of theory and practice that I hope will be very effective for readers looking to implement Spring Security, or those who are already using it, but might not understand how it works.

I’m very excited to see the book in print, and believe it will have a big impact on the ability of users new to Spring Security to approach the framework with a better understanding of how it works. Additionally, for those users who will be doing sophisticated integrations or customizations based on the framework, there’s enough undocumented material and nuts-and-bolts discussions in the book to make it interesting for you as well.

Since most of my readers are techies, I hope to post interesting quantiative bits that I’ve been tracking along the way as I’ve coded, researched, diagrammed, revised, and all out slogged my way through gobs of code. More to come on this topic!

Please contact me if you have questions, comments, suggestions, or just congratulations :)

Book Info

Title: Spring Security 3

Publisher: Packt Publishing

Publication Date: May 29, 2010

Web Sites:

Pages: 420

ISBN: 978-1847199744

Dec 01 2009

[Tutorial] URL Shortening in Java using

Tag: bitly,java,tinyurl,tutorial,twitterpmularien @ 12:19 am

A while ago, I had written up a tutorial on accessing the TinyURL API from Java. I was recently playing with the API and decided to write up a quick tutorial on generating URLs from Java.


Since Twitter switched from TinyURL to, I decided I’d take a look at it. Personally, I love the stats tracking features of, and the ability to store history, and parse the results of the API call in XML or JSON (I use XML in this tutorial).

What you Need

First, you’ll need a account in order to be assigned an API key. Your API key will show up under the “API Key” heading in your account page.

You’ll also need the Apache Commons HTTP (3.x) library and a recent version of Java.

Calling’s REST API’s API is slightly more complex than TinyURL’s, but only very slightly so. Here’s an example of calling the API:

		HttpClient httpclient = new HttpClient();
		HttpMethod method = new GetMethod("");
				new NameValuePair[]{
						new NameValuePair("longUrl",",
						new NameValuePair("version","2.0.1"),
						new NameValuePair("login","mybitlylogin"),
						new NameValuePair("apiKey","R_abcdefmyguid"),
						new NameValuePair("format","xml"),
						new NameValuePair("history","1")
		String responseXml = method.getResponseBodyAsString();

Obviously, you would substitute “login” with your login name, and “apiKey” with your API key. This will result in the “longUrl” you pass being returned in an XML structure that looks like the following:


Processing the Returned XML

To do a “dumb” processing of the returned XML, we can simply do something like the following (depending on what XML APIs you have available, you can get much more sophisticated :) ):

		String retVal = null;
		if(responseXml != null) {
			// parse the XML
			DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
			DocumentBuilder db = dbf.newDocumentBuilder();
			StringReader st = new StringReader(responseXml);
			Document d = db.parse(new InputSource(st));
			NodeList nl = d.getElementsByTagName("shortUrl");
			if(nl != null) {
				Node n = nl.item(0);
				retVal = n.getTextContent();
		return retVal;

It appears there is also a very early stage project at Google Code called “bitlyj”, which seems to offer a very straightforward API. I’ll try to post a tutorial for this soon, in the meantime, feel free to check it out here: bitlyj at Google Code. As always, feedback is appreciated!

Aug 13 2009

[Tutorial] Amazon SOAP Product Advertising API from Java – Including Signing of Requests with WS-Security

Tag: amazon,axis,development,java,opensource,tutorial,webservicespmularien @ 11:10 pm

Amazon has made a lot of affiliates unhappy with their updates to the Product Advertising API (ex-Affiliate API). I first covered invoking this API a couple years ago – my, have things changed since then.

On August 15, 2009, Amazon will be requiring all affiliates using the Product Advertising API to digitally sign their API requests. Previously, calls to the web service required only the AWS Access Key ID. Now, affiliates are required to sign the requests with a private key (and supply the AWS Access Key ID!) in order for the request to be accepted.

Unfortunately, many affiliates feel that Amazon has really botched this transition. Very little documentation is available on how to sign requests, and the majority of the responses in the affiliate community forum are unanswered by Amazon staff. Additional bad news for Java users is that Amazon has apparently dropped their Java library (Amazon A2S), which used to nicely abstract the ugliness of making requests to the web service.

In this tutorial, we’ll implement an Amazon Product Advertising API client using Apache Axis2 1.5, invoking the API’s SOAP methods. We’ll sign the requests using a PKCS 12 (.p12) file. Get some popcorn – this is a very long and involved process :( Continue reading “[Tutorial] Amazon SOAP Product Advertising API from Java – Including Signing of Requests with WS-Security”

Dec 04 2008

[Tutorial] Accessing the TinyURL “API” from Java

Tag: apache,httpclient,java,tinyurl,tutorial,web,webservicespmularien @ 10:13 pm

TinyURL is a service that has been around for a while, but recently regained popularity due to its widespread use on Twitter.

Recently, I poked around and wrote up a simple Java method to, given a URL (TinyURL supports only GET requests), generate a TinyURL from it in Java. This is really the only “API” supported by the TinyURL service, but it’s a handy one!

You’ll need Apache HttpClient 3.1 for this.

Without further ado, here’s the code:

import org.apache.commons.httpclient.HttpClient;
import org.apache.commons.httpclient.HttpException;
import org.apache.commons.httpclient.HttpMethod;
import org.apache.commons.httpclient.NameValuePair;
import org.apache.commons.httpclient.methods.GetMethod;
public abstract class TinyURLUtils {
	public static String getTinyUrl(String fullUrl) throws HttpException, IOException {
		HttpClient httpclient = new HttpClient();
		// Prepare a request object
		HttpMethod method = new GetMethod(""); 
		method.setQueryString(new NameValuePair[]{new NameValuePair("url",fullUrl)});
		String tinyUrl = method.getResponseBodyAsString();
		return tinyUrl;

Then you’d call the method as follows:

String tinyUrl = TinyURLUtils.getTinyUrl("");
System.out.println(tinyUrl); // -->

You’re welcome to use / improve this code in any way (obviously, I didn’t consider or care about proper exception handling), ideally linking to my blog as the source.


Note that this makes an HTTP request directly, so this will require some modification if you’re making the call from behind a proxy server. If there’s a need, I can post a follow-up entry on how to set up a proxy server with Apache HTTP Client.

Nov 19 2008

[Tutorial] Twittering from Java with Twitter4J

Tag: java,tutorial,twitterpmularien @ 7:18 am

Really, this is so easy it’s almost not worthy of a blog post. Twitter4J is a tiny library wrapping interaction with Twitter APIs.

Creating a new tweet is as simple as:

	    Twitter twitter = new Twitter("username","password");
	    Status status = twitter.update(title);

The Twitter4J page has a series of simple examples covering timelines and direct messages. Great job and thanks to Yusuke Yamamoto, the author.

Apr 10 2008

5 Minute Guide to the Java Amazon Associates Web Service API

Tag: amazon,java,tutorial,webservicespmularien @ 6:17 am

August 15, 2009: Important update to this article: Amazon now requires signed SOAP requests, which are not supported by the (now defunct) AmazonA2SClient library. Please see my updated article on using the Amazon AWS API (now Product Advertising API) with Java and Apache Axis2. Thanks!

On a side project recently, I decided to try out the Amazon Associates Web Service API, a Java library provided by Amazon which wraps the Amazon Associates Web Service calls with a friendly Java API.

For those who are considering integration with Amazon Associates Web Services (used for things as item search, item detail retrieval, and cart manipulation), this API provides a very deep and rich integration with Amazon, with a relatively shallow learning curve. I’ll provide a simple example here of doing an item lookup by ASIN (Amazon’s unique product IDs), and point you around some of the data structures you’ll encounter when dealing with ASINs.

Continue reading “5 Minute Guide to the Java Amazon Associates Web Service API”