Develop Reference

AADAuthenticationFilter called only Once

I downloaded the Azure AD with spring boot from https://github.com/microsoft/azure-spring-boot. Its all nice and works well as long as I run theazure-active-directory-spring-boot-sample using
mvn spring-boot:run
as shown in the README file.
I am trying just a basic real-life scenario where the angular/react app is running separately on a separate port using npm. The moment I separated them out the main Filter AADAuthenticationFilter is only invoked once on the first request where it does token verification and never again for subsequent requests.
I went around and configured an nginx proxy so that the domains of these two are now same
localhost:9999 and I redirect based on the next path like web for the npm and app for the Spring boot. This enabled the cookies to be available at every request.
This helps because what I learned is that Spring uses cookies to maintain a session. But ideally, the AAD filter should revalidate the token every request.
But if I add a property of azure.activedirectory.session-stateless=true to my application.properties, as mentioned in the filter's code to make it stateless and validate on every request. It expects roles as a different attribute in AD instead of it being a group of the user.
I also don't understand get the behaviour, when the js files are embedded within the spring app and run all this works perfectly fine and the filter is invoked at every request. But when I separate them out it just doesn't work.
Any help or pointers would be appreciated.

I realize that a lot more info may be required for someone to debug the above problem. But I was just able to solve this - at least found the problem that was causing it. Like I mentioned earlier the problem started when I separated the client and spring APIs. And since the client was not able to send back the cookies set by server, due to change in domains I had to put a proxy server.
What I found out later was that every GET request was always invoking the AAD filter. Even multiple requests. But other requests like POST, PUT were failing. I tried disabling the csrf config in spring WebSecurityConfig.java -->> http.csrf().disable();
This solved my problem and now I receive a request and all works as expected. Now I am trying to figure out how not to disable csrf completely.
Thanks

Is there a way to modify an HTTP request in Chrome or Firefox?

Is there a way to modify an HTTP request using Chrome dev tools or Firebug? For example when developing locally and testing in Chrome, I have a page that needs an HTTP request to fill some data. Because it's local, that service isn't available.
Currently the only way of getting around the problem is configuring a proxy pass in Apache so it hits a QA environment for that call. I'm looking or a simpler way to achieve this because I use Jetty to test the app and can't configure a proxy pass (or that I know of).
In other words, is there a way to create a temporary proxy pass for the current session when testing an app locally?

This might help in some cases - use fetch command to send another, tampered, request. here's how to do it in Chrome:
open DevTools, tab Network
clear
create your request normally
right click that request and select Copy > Copy as fetch
go to Console tab and paste
tamper the data and hit Enter

You can use tweak chrome extension and you'll be able to do exactly that, intercept and modify HTTP requests.

Inspecting request/response from Java/spring web service client

I have a client written in Java using the Springsource toolkit (that is, the #Service attribute) that is talking to an external webservice (completely seperate, nothing to do with my company) via HTTPS. I'm getting an exception on the marshalSendAndReceive step, which states that the content-type is coming back as text/html instead of the expected text/xml - with the message "could this be an error message?"
The webservice itself is the public test for the next version of the service, and calling the live service from the same code works fine. This particular method I am calling works fine on the live system but not on the test system.
My hunch is that the request is not correctly formatted for the test system - although only the response should have changed in the schema according to the release notes - and this is causing the service to return an error that is incorrectly parsed by my client. I am getting this error with all requests, even those that (according to the release notes) have not changed.
I have tried to use Fiddler and Wireshark to inspect the traffic, but can't get Fiddler to see it at all (I suspect this is a problem using Tomcat in STS with a proxy) and Wireshark can't decode the HTTPS stuff (I don't have the keys). I can't use HTTP, as the external service returns 403 Forbidden if I try.
I'm not the original developer, and I'm not even a Java developer. I am an experienced .NET developer, so any analogies with that will be understood - otherwise, I am a dummy and phrase your instructions/questions/possible help accordingly. As instructed by my predecessor, I have created a JAR file from the WSDL using XmlBeans and added that as a referenced library but I can't be sure that I've done that correctly, or even what it is that that is doing. It doesn't appear to have a discernable effect on things.
How can I debug this problem, and verify whether it is a problem with my client or their service?

My first goal would be getting Fiddler working. It is difficult to debug in the dark. However, where I get confused is when you discuss your client running in Tomcat in STS. Is your client a webapp?
Have you tried other tools like SoapUI to validate that the service is responding to your requests as expected?

Webservices in BlackBerry

I am trying to make an application that will connect to a web service and call functions from it. I have worked on HTTP connections that will hit the server. This one will send me data. But can I hit a web service and call functions from it on Blackberry? I don't have such information yet haven't tried it.
So the question is, how to connect to a web service and call functions from it?

You won't be able to directly call functions on the server from the BB, so you'll have to define calls on the server where your app would provide the information needed for your server side script to perform the necessary operations.
As a simple example, maybe your app sends something to the server to a login URL with a payload that has the username and password. The server would then take over and perform all of the necessary validation and come back with a simple "authenticated" or "denied" response. Your app didn't actually do anything other than provide the information that would be needed for the server to do its magic.

Tomcat and Ajax Issues

Hello, it's really the first time for me to post.
I'am encountering a problem with my Web Apps and cannot find any answers on the web.
My problem is that i have a Java Web
App that works on parallel with
tomcat and apache using mod_jk.
Everything works fine, but after one
day of running in tomcat, the Ajax
request i do with Jquery dosn't come
back with the data. I'm using SQL
Base (phpMyAdmin).
I'm sending a request to the servlet
in charge of the sql using Jquery Ajax but i
never get the response. Wierd thing
is that it works for a day and then
stop the next one (i must than reload
my WebApps to make it work again).
Could you gentle developpers give me a hint or two please ? :)

I think whenever you are opening the connection to take data from database then probably you are not closing those connections.And every time your application is creating new connection with database without closing old one.As sql has limited number of connections so after one day or after some time your application is not able to connect with your database.So you are not getting data from database. And when you are reloading your application that time you are restarting tomcat so that time your all connections with database are being closed.So next time again you are able get data from database.
So check whether you are closing database connections properly after every transaction or not.Might be this is your problem.

Have you looked at any error messages in the log files? Especially, do you know if the corresponding Servlet gets called at all, or is the request blocked by apache / tomcat?