Hibernate Search FTW

In praise of Hibernate Search:

-Search is both easy to learn and easy to use
-A great book "Hibernate Search in Action" is available to tame the learning curve
-It is very well designed, exposing just the right amount of the underlying Lucene extendability. I am using Filters, programmatic construction of complex queries, FieldBridges to search custom types, and a custom Scorer for result ranking

Just wanted to put this out there: If you're thinking of using Hibernate Search, jump in. To the Hibernate Search team: thank you!

JBossCache 3 vs Oracle Coherence

I'm looking at both products right now. If anyone has real world comparative experience, please chime in.

My initial impression is that Coherence has a more sophisticated replication scheme that eliminates the need for all data to be replicated to all nodes; this probably helps them to get closer to true linear scalability.

My other impression is that Coherence is insanely expensive. Their cheapest edition is $4600 per processor; whoa!

Hibernate and JBossCache

While attempting to move from EHCache to JBossCache I was having a hard time finding information or documentation. Then I found this: http://galder.zamarreno.com/wp-content/uploads/2008/09/hibernate-jbosscache-guide.pdf

It took me almost two hours to stumble across this, hopefully this saves someone some time.

Maven Plugins for Eclipse

I've tried both q4e and m2eclipse pretty thoroughly at this point and I hereby declare m2eclipse the winner. My application is a multi-module project and q4e got terribly confused, m2eclipse handles this better. It's not perfect but way better than switching out to the shell to build, and a real time saver if you frequently work across multiple modules. Go get it now: http://m2eclipse.sonatype.org/

Hibernate Redux

Hey big suprise, another long ignored hibernate bug (ok ok this one is only six months old), this time it is creating duplicate Foreign Keys (increasing the size of my DB, certainly not *helping* performance). At least there is a workaround. http://opensource.atlassian.com/projects/hibernate/browse/HHH-3532

Has Hibernate Been Abandoned?

When I run into a serious defect like this one, and it hasn't been worked in almost a year, I have to wonder if anyone over at JBoss/RedHat works on Hibernate any more. Maybe they just decided to abandon it? Are there other similar big bugs that they seem to be studiously ignoring?
http://opensource.atlassian.com/projects/hibernate/browse/HHH-3332

Posting Source Code in Blogger

This should be so easy - BBEdit code tags anyone? Here's a nice and easy solution for posting cleanly formatted code samples in blogger: FormatMySourceCode

Spring Security, HTTP Basic plus Form Authentication

This is probably pretty common - we have a restful API that can be used for third-party systems integration but which is also used to support our AJAX user interface.

To support both cases, I want HTTP-Basic and Form authentication to protect the service URLs - ideally spring security would be configured to transparently support either one.

I finally got this working but not as cleanly as I might have hoped for - if anyone out there has an improved solution I would love to hear it!

1. expose the API on two URLs, I created one service mapping for /api and one for /services both mapped to the same servlet, one will be http-basic and one will use form-login

2. Change the default filter-name that Spring uses:

<filter-mapping>
   <filter-name>customSecurityFilterChain</filter-name>
   <url-pattern>/*</url-pattern>
</filter-mapping> 

3. Configure spring security using the custom filter chain. Use a new instance of HttpSessionContextIntegrationFilter with allow session creation set to false to prevent the wasted overhead of session creation for http basic clients, who will likely not present JSESSIONID cookies. (thanks to magomarcelo here http://raibledesigns.com/rd/entry/upgrading_to_spring_security_2 for that one)

    <http auto-config="false">
 
        <intercept-url pattern="/api/**"  access="ROLE_USER,ROLE_GROUPADMIN,ROLE_SYSADMIN" /> 
              
        <http-basic/>  
        <form-login  login-page="/login.jsp" authentication-failure-url="/login.jsp?msg=fail" default-target-url="/" always-use-default-target="true" />              
        <logout logout-url="/logout" logout-success-url="/login.jsp" />           

    </http>


    <beans:bean id="basicExceptionTranslationFilter"
        class="org.springframework.security.ui.ExceptionTranslationFilter">
        <beans:property name="authenticationEntryPoint" ref="_basicAuthenticationEntryPoint"/>
        <beans:property name="accessDeniedHandler">
            <beans:bean class="org.springframework.security.ui.AccessDeniedHandlerImpl"/>
        </beans:property>
    </beans:bean>


    <beans:bean id="httpSessionContextIntegrationFilterWithASCFalse"
        class="org.springframework.security.context.HttpSessionContextIntegrationFilter">
        <beans:property name="allowSessionCreation" value="true"/>
    </beans:bean>



    <beans:bean id="customSecurityFilterChain" class="org.springframework.security.util.FilterChainProxy">
        <filter-chain-map path-type="ant">
            <filter-chain pattern="/api/**"
                filters="httpSessionContextIntegrationFilterWithASCFalse,_basicAuthenticationFilter,
                    basicExceptionTranslationFilter,
                       _filterSecurityInterceptor"/>
            <filter-chain pattern="/**"
                filters="_httpSessionContextIntegrationFilter,_logoutFilter,_formLoginFilter,
                     _securityContextHolderAwareRequestFilter,
                     _exceptionTranslationFilter,
                     _filterSecurityInterceptor"/>
            
        </filter-chain-map>
    </beans:bean>

Don't Change Maven Artifact Names

Well lets get this started out with a rant shall we? Now I'm a bit of a Maven noob so it's possible I have it all wrong...

I've got a project that builds with mvn, all is well. Lets upgrade to Hibernate 3.3.1 and add the Jersey REST library - this is the kind of thing that Maven should make easy! Right? Not so much - I got this sorted out eventually but it was a pain. I used (and recommend) the Q4E maven plugin for eclipse http://code.google.com/p/q4e/ to get this sorted out.

OK here goes. In pom.xml, add the Jersey dependency and change the hibernate version to 3.3.1, no dice. The JAR file is not found. Look out on the JBoss maven repo and there's a directory with no JARs. A little research shows that they changed the artifact name from 'hibernate' to 'hibernate-core'. That should be it right?

Wrong - attempt to run unit tests and lots fail on an error about asm. I don't have a dependency on this. Here comes Q4E and the 'Analyze Dependencies' feature. It turns out that Jersey uses a new version of ASM (a bytecode lib) and Hibernate uses an old one. But wait, Hibernate 3.3.1 doesn't have a dependency on ASM. Hibernate 3.2.6 did however, and that's included as a dependency of Hibernate-Common-Annotations.

The problem here is that Maven will automatically prevent including two different versions of a library, but not if you go and change the &(*^ name. So the Hibernate guys changed from 'hibernate' to 'hibernate-entitymanager' (with separate 'hibernate-core' for reasons that I can understand) and now I inadvertently have two complete copies of Hibernate (and lots of extraneous jars) polluting my project.

Hard to figure out, simple to fix:

<dependency>
<groupid>org.hibernate</groupid>
<artifactid>hibernate-commons-annotations</artifactid>
<version>3.3.0.ga</version>
<exclusions>
<exclusion>
<artifactid>hibernate</artifactid>
<groupid>org.hibernate</groupid>
</exclusion>
</exclusions>
</dependency>

So all you library developers out there - don't change your artifactIds! Now with that said, this isn't really the Hibernate guys fault. Reorganization like this is healthy for a project like Hibernate. Unfortunately Maven doesn't handle it well, there's probably something they could do better to help with artifactId / groupId changes. How about a pointer to the previous version so that Maven can 'follow the version chain' over a name change?