RE: Controlling access to resources

[Areeb]

Thanks Jerome, I'll check it out

Best Regards

Areeb

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2262980

Tunneling Flex

[William Pietri]

Hi! We're building a new app, with an in-browser Flex (which runs on 
Flash) client and a Java Restlet-based server. I wanted to share some 
info and ask a question.

For those who are considering trying something similar, a few lessons 
we've learned:

* Although the APIs might suggest otherwise, the Flex HTTP library
  is not very REST-friendly.
* There are several alternative libraries, all built on raw sockets.
  We tried three; they are all rough, and implement different bits
  of the HTTP spec. Expect surprises.
* Even if you get one of those socket-based libraries to work, when
  it comes time to deploy you will discover that every server needs
  to run a special Flex security policy daemon on a privileged port.


We've thus given up on trying to make the client behave properly, and 
are going to use the TunnelService as well. That looks great, but 
there's one thing I don't see how to handle: the response: Response 
codes and special headers apparently can't be read from Flex reliably.

Are there known patterns for tunneling a full REST response back to a 
brain-damaged client?

Thanks,

William

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2262995

Spring-loaded Restlets with Context dependencies

[Dustin N. Jenkins]

All,

I'm using the 1.2 (2.0) snapshot with JDK 1.6.

All of my beans are loaded by Spring.  This is working really lovely for 
the most part, except for any bean that relies on the Context to be 
passed in.  How do we create ChallengeGuards, for example, in Spring, 
when we don't have a Context to pass to it?

I used to override the default Constructor to use a Restlet instead of a 
Context, which would act as a Parent and I could call getContext() from 
that bean.  That Parent bean used to be the Application, which is 
initialized by the SpringServerServlet.  The problem is that Spring is 
loading in all the beans first, which means the Parent's Context is 
null, which used to be alright prior to 2.0.

What is the solution for this problem?  Do I need to create a Spring 
Component around my Application?  I don't use a Component now, only an 
Application.

Thanks!
Dustin
-- 


Dustin N. Jenkins | Tel/Tél: 250.363.3101 | dustin.jenk...@nrc-cnrc.gc.ca

facsimile/télécopieur: (250) 363-0045

National Research Council Canada | 5071 West Saanich Rd, Victoria BC. 
V9E 2E7

Conseil national de recherches Canada | 5071, ch. West Saanich, Victoria 
(C.-B) V9E 2E7

Government of Canada | Gouvernement du Canada

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2262451

Re: Dependency injection in Restlet 2.0 with Guice

[Tim Peierls]

On Thu, May 14, 2009 at 3:10 PM, Jerome Louvel wrote:

>  By the way, do you think it would be technically possible to develop a
> similar integration that would leverage the recently announced
> “javax.inject”?
>
> http://crazybob.org/2009/05/announcing-javaxinjectinject.html
>
> If so, it could be an opportunity for a new Restlet extension.
>
I'm sure it will be possible. I haven't worked out the details, but such an
extension would provide an additional public interface,
org.restlet.ext.inject.FinderFactory (better name needed?) and hooks for
obtaining a FinderFactory implementation that would have to be specific to
the injector implementation.

In the mean time, the nice thing about javax.inject is that you should be
able to use com.google.inject for now and later switch your imports to
javax.inject when the support becomes available.

--tim

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2262105

Re: How to get post/get variables out of a request

[Dustin N. Jenkins]

This is accomplished from the getRequest().getResourceRef().getQuery() 
method.  There are variations of that as well if you wanted to get them 
as a Form, for example.

Dustin


webp...@tigris.org wrote:
> I am attempting to get the 'get variable' out of a reqeust.  The url is 
> something like www.example.com/?var=asdf
>
> I try String var = (String) request.getAttributes().get("var);
>
>
> This does not work.  How do I go about doing this?
>
> --
> http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2258641
>   

-- 


Dustin N. Jenkins | Tel/Tél: 250.363.3101 | dustin.jenk...@nrc-cnrc.gc.ca

facsimile/télécopieur: (250) 363-0045

National Research Council Canada | 5071 West Saanich Rd, Victoria BC. 
V9E 2E7

Conseil national de recherches Canada | 5071, ch. West Saanich, Victoria 
(C.-B) V9E 2E7

Government of Canada | Gouvernement du Canada

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2261942

Re: Tomcat not shutting down with Restlet

[Matt Stromske]

I found the problem: a pilot error on my part.  Not sure what I was
sniffing the day I implemented it, but I had put in a server component
that started up upon Tomcat initialization.  I think it "found" its way
in when I  was testing the Restlet standalone java app and ported it to
a servlet.  Anyway, the server wasn't getting shut down when Tomcat was
shutting down.  So I simply removed it.  

Thanks for all the advice.

Matt

Jerome Louvel wrote:

  Hi Matt,

One way to check from where the issue comes is to trim your application to
the strict minimum and check if you still observer this issue.

In such case, please open a defect report and attach the same applications
with steps to reproduce the issue and we'll look at it.

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com




-Message d'origine-
De : Michael McCallum [mailto:gho...@xtra.co.nz] 
Envoyé : mardi 12 mai 2009 01:08
À : discuss@restlet.tigris.org
Objet : Re: Tomcat not shutting down with Restlet

On Tue, 12 May 2009 06:47:53 Matt Stromske wrote:
  
  
Still no reply on this yet.  Anyone out there with some advice?

Thanks,
Matt

--


  
  http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=21951
79
  
  
check to see you have not spawned non daemon threads... or thread pool
executors not shut down...

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2234270
  


-- 
Matt Stromske
Software Engineer
Singlewire Software, LLC
www.singlewire.com
--
608.298.1020
matt.strom...@singlewire.com

How to get post/get variables out of a request

[webpost]

I am attempting to get the 'get variable' out of a reqeust.  The url is 
something like www.example.com/?var=asdf

I try String var = (String) request.getAttributes().get("var);


This does not work.  How do I go about doing this?

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2258641

RE: Dependency injection in Restlet 2.0 with Guice

[Jerome Louvel]

Hi Tim,

 

Thanks for updating your integration. I’ve added an entry in the Community
Wiki:

 

“Third-party integrations”

http://wiki.restlet.org/community/123-restlet.html

 

By the way, do you think it would be technically possible to develop a
similar integration that would leverage the recently announced
“javax.inject”?

http://crazybob.org/2009/05/announcing-javaxinjectinject.html

 

If so, it could be an opportunity for a new Restlet extension. 

 

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~  
http://www.restlet.org
Noelios Technologies ~ Co-founder ~  
http://www.noelios.com

 

 

 

 

De : Tim Peierls [mailto:tpeie...@gmail.com] 
Envoyé : mercredi 13 mai 2009 00:32
À : discuss@restlet.tigris.org
Objet : Dependency injection in Restlet 2.0 with Guice

 

I just posted a short article on my blog about using Guice with Restlet 2.0.

 

http://tembrel.blogspot.com/2009/05/dependency-injection-in-restlet-20-with.
html

 

Not much new here, just updated to work with ServerResource. (Still supports
Handler, but not for long if Handler is going away.)

 

I had the impression that Leigh Klotz was working on something to do Guice
dependency injection into Restlets, not just resources. Leigh, if you're
listening, where are you with that? Anyone else working on Restlet-Guice
integration?

 

--tim

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2261819

RE: Controlling access to resources

[Jerome Louvel]

Hi Areeb,

Thanks for sharing your impressions!

You definitely need to look at Restlet 1.2 (being renamed to 2.0) and its new 
security API. For now we only have the specifications and the Javadocs as 
documentation:

"Security API refactoring"
http://wiki.restlet.org/developers/172-restlet/212-restlet.html

Of special interest to you, you might want to check the Role, MethodAuthorizer 
and RoleAuthorizer classes in the "org.restlet.security" package. You might 
need to create your own Authorizer subclass though, which should be trivial.

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com



-Message d'origine-
De : Areeb [mailto:aaa...@ecs.soton.ac.uk] 
Envoyé : mardi 12 mai 2009 15:13
À : discuss@restlet.tigris.org
Objet : Controlling access to resources

Hello,
I am new to Restlet and I like it because it really simplifies things without 
cutting out flexibility. I would like to know if the following feature is 
available and in which version, please:
I want to restrict access to resources; this restriction is different for each 
type of user. For example if I have a resource called Orders and two different 
user types usertype1 and usertype2. I would like to enable usertype1 to do GET, 
PUT on the resource, but usertype2 for usertype2 to only do GET. Is there a way 
in which I can code these kinds of rules for all the resources?  Or do I need 
to do this from scratch I’ve looked quickly into Guard in v1.1 and into v1.2 
but they seem to be solving other problems.
Thanx
Regards,
Areeb

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2213010

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2261734

RE: Reissuing Post after challenge losses entity body

[Jerome Louvel]

Hi there,

The problem is that some representations are streamed and once sent they
can't be sent again because the Restlet connector has no way to recreate it.
Some representations like DomRepresentation and StringRepresentation contain
all the content in memory and can be resent though.

If you really need such a feature, you might have to cache the
representation before sending it, in memory or on disk.

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com



-Message d'origine-
De : webp...@tigris.org [mailto:webp...@tigris.org] 
Envoyé : jeudi 7 mai 2009 21:18
À : discuss@restlet.tigris.org
Objet : Reissuing Post after challenge losses entity body

Excuse me if this is a duplicate, my first post did no appear to go through.

I'm not sure if I am approaching the problem incorrectly, or I have found a
bug. I am using the 1.2 snapshot from May 5 2009.

I have a restlet client process and an associated restlet based server. The
resources are all guarded using HTTP_DIGEST authentication. I have setup the
client to automatically resend any request that gets challenged after adding
an updated challenge response. This is working great for GET requests.
However, for POST requests, the Request that is sent with the updated
challenge response does not contain the original body text.

My processing is:

build POST request with reference and body
add ChallengeResponse based upon current vars
client.handle(request)
if status is unauthorized
   rpl ChallengeResponse based upon new vars
   client.handle(request)

When the final Request is sent, the Request Entity body is not present.

Am I wrong in assuming that I can reuse the original Request and just update
the ChallengeResponse? Is this approach suppose to work?

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=20993
35

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2261697

RE: Guard to ChallengeGuard upgrade

[Jerome Louvel]

Hi Dustin,

This is all you indeed need to do:

Here is a similar sample:

// Create a simple password verifier
MapVerifier verifier = new MapVerifier();
verifier.getSecrets().put("scott", "tiger".toCharArray());

// Create a Guard
ChallengeGuard guard = new ChallengeGuard(getContext(),
ChallengeScheme.HTTP_BASIC, "Tutorial");
guard.getAuthenticator().setVerifier(verifier);

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com




-Message d'origine-
De : Dustin N. Jenkins [mailto:dustin.jenk...@nrc-cnrc.gc.ca] 
Envoyé : vendredi 8 mai 2009 19:41
À : discuss@restlet.tigris.org
Objet : Guard to ChallengeGuard upgrade

Hi all.  I'm using the Restlet 1.2 (2.0) snapshot and have been looking 
over the Security implementation. 

If I were to simple replace the old checkSecret() method with something 
else, would it be as easy as setting the LocalVerifier in the 
Authenticator and implementing the getSecret() method?  Is there 
something more to it?

Thanks!
Dustin
-- 


Dustin N. Jenkins | Tel/Tél: 250.363.3101 | dustin.jenk...@nrc-cnrc.gc.ca

facsimile/télécopieur: (250) 363-0045

National Research Council Canada | 5071 West Saanich Rd, Victoria BC. 
V9E 2E7

Conseil national de recherches Canada | 5071, ch. West Saanich, Victoria 
(C.-B) V9E 2E7

Government of Canada | Gouvernement du Canada

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2117135

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2261673

RE: Dispatching calls to resources internally

[Jerome Louvel]

Hi Bruno,

In such case, we recommend the usage of the RIAP (Restlet Internal Access
Protocol):

"The RIAP protocol"
http://wiki.restlet.org/docs_1.2/13-restlet/48-restlet/86-restlet/45-restlet
.html

Currently, there are three authority types:
 - Component
 - Virtual Host
 - Application

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com


-Message d'origine-
De : news [mailto:n...@ger.gmane.org] De la part de Bruno Harbulot
Envoyé : vendredi 8 mai 2009 14:40
À : discuss@restlet.tigris.org
Objet : Dispatching calls to resources internally

Hello,

I'm trying to perform operations on a resource in a way that affects 
other resources in the same system (because they depend partly on the 
same domain objects).

For example, in the tutorial 
, UserResource 
and OrderResource both depend on the User domain object.

I'd like, in the messages I sent to the resources to be able to refer to 
other resources, using a URI (usually relative, but perhaps absolute).

For example, if the structure of the URI is flat:
   /user/{USER_ID}-> UserResource   -> User (table where USER_ID is 
the primary key)
   /order/{ORDER_ID}  -> OrderResource  -> User (table where ORDER_ID is 
the primary key, USER_ID being another column)

and if the default representation for an OrderResource looks like this:
   
 /user/123
 ...
   

I'd like to be able to change the user on that order by giving another 
URI, say:
   
 ../user/456
 ...
   

or with the equivalent absolute URI:
   
 http://host.example/user/456
 ...
   

The way the example in the tutorial works around this is by having the 
orders depend on the user in the template 
("/user/{USER_ID}/order/{ORDER_ID}"), so that the OrderResource can know 
both the USER_ID and the ORDER_ID.

Since I'm using a "flat" URI structure, I can't really do this. (What 
I'm trying to do is to have some parent/child relationship between 
resources, without constraints on the depth of the tree, in such a way 
that telling a resource X its parent is Y would also set the domain 
object of Y to be a child of X, and vice-versa. I'm also assuming that 
both within the scope the same system to avoid distributed updates.)


One way to do this would be to make another Request to the enclosing 
Application, via 'handle'. However, going through the external interface 
(GET/PUT/POST/DELETE/...) when it's an internal operation (in 
particular, because I'd like to bypass the Guards/Filters and because I 
want to avoid infinite loops). I'd be looking for a way to get the 
instance of the Resource that would be at the given URI (so that I can 
get its domain object) without the call to be actually made.


Is there a way to do this? Has anyone had similar problems and other 
solutions?


Best wishes,

Bruno.

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=21121
97

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2261623

RE: Case-insensitive version of Series.getValuesArray(...)

[Jerome Louvel]

Hi Arjohn,

Good point, I've just added such method in SVN trunk!

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com



-Message d'origine-
De : Arjohn Kampman [mailto:arjohn.kamp...@aduna-software.com] 
Envoyé : lundi 4 mai 2009 15:41
À : discuss@restlet.tigris.org
Objet : Case-insensitive version of Series.getValuesArray(...)

Hi all,

I've just started working with the restlet framework, so please excuse me if
I'm overlooking something. In Restlet 1.1.4 the Series class offers various
utility methods for getting parameter values, often with a variant allowing
you to control the case-sensitivity. This variant is missing for
getValuesArray(), however, which is what I'd like to use. Can this method be
added?

Regards,

Arjohn Kampman

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=20565
27

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2261414

RE: Re: Clean shutdown in Tomcat

[Jerome Louvel]

Hi Matt,

Regarding the 'stop' not being called on Application class, this is a know
limitation. This will be addressed in Restlet 2.0:

"Make start/stop usage consistent "
http://restlet.tigris.org/issues/show_bug.cgi?id=761

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com




-Message d'origine-
De : Matt Stromske [mailto:matt.strom...@singlewire.com] 
Envoyé : jeudi 30 avril 2009 21:53
À : discuss@restlet.tigris.org
Objet : RE: Re: Clean shutdown in Tomcat

I'm using Restlet 1.1.4 and am having the same issue.  Tomcat does not
shutdown cleanly when I issue a 'shutdown'.  Also, I do not see the 'stop'
method being called in my Application class.  Any ideas?

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=20002
58

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2260998

RE: Is this the right approach? -- Custom routers

[Jerome Louvel]

Hi Nels,

Instead of custom routers, I would suggest that you create Filter
subclasses.

Regarding transactions, be careful because you might need to keep your
transactions open until the response entity is fully written, which happens
after your custom router returns control. Instead you should provide a
custom ConnectorService and use Restlet 2.0 (ex-1.2). See related mails in
the list archives.

Instead of ErrorHandler you could customize the StatusService of your
application which has a similar goal.

Hope this helps!

Best regards,
Jerome Louvel
--
Restlet ~ Founder and Lead developer ~ http://www.restlet.org
Noelios Technologies ~ Co-founder ~ http://www.noelios.com


-Message d'origine-
De : Nels Nelson [mailto:nels.nel...@rackspace.com] 
Envoyé : vendredi 1 mai 2009 17:50
À : discuss@restlet.tigris.org
Objet : Is this the right approach? -- Custom routers

I have completed an application on Restlet, and I am analyzing the approach
I took, since it was my first go at the new tech.

In my Application class, I have the following defined:

Router router = new Router(getContext());
router = new ErrorHandler(router);
router = new TransactionalRouter(router);
router = new ResourceStatisticsManager(router);

The functionality of each custom router should be pretty plain.

The ErrorHandler wraps default router and overrides the handle(Request
request, Response response) method.  Here, it delegates to the wrapped
default router inside of a try-catch block.  In the catch block I deal with
any exceptions by displaying them in a custom error page that does all kinds
of cool things with the Exception.

Is this the best way to accomplish this?

The TransactionalRouter overrides handle(...) by delegating to the default
router in between a standard manual transaction pattern.  (tx =
TransactionProvider.begin(); success=true; ... finally { if (success)
tx.commit();})  Eventually I plan on inspecting each resource requested for
a Transactional annotation on the appropriate method.

Is this the best way to do this?

The ResourceStatisticsManager delegates to default in between some time
stamps, which it then logs.

Is this the best way?

Thanks,
Nels Nelson

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=20162
07

--
http://restlet.tigris.org/ds/viewMessage.do?dsForumId=4447&dsMessageId=2260960