What do you mean by analysis and design

What do you mean by analysis and design?

Systems Analysis. It is a process of collecting and interpreting facts, identifying the problems, and decomposition of a system into its components. ... It is a problem solving technique that improves the system and ensures that all the components of the system work efficiently to accomplish their purpose.

Analysis:

1. Basically, it is the process of determining what needs to be done before how it should be done. In order to accomplish this, the developer refers the existing systems and documents. So, simply it is an art of discovery.
Design:
It is the process of adopting/choosing the one among the many, which best accomplishes the users needs. So, simply, it is compromising mechanism.

2. What are the steps involved in designing?
Before getting into the design the designer should go through the SRS prepared by the System Analyst.
The main tasks of design are Architectural Design and Detailed Design.
In Architectural Design we find what are the main modules in the problem domain.
In Detailed Design we find what should be done within each module.

3. What are the main underlying concepts of object orientation?
Objects, messages, class, inheritance and polymorphism are the main concepts of object orientation.

4. What do u meant by "SBI" of an object?
SBI stands for State, Behavior and Identity. Since every object has the above three.

State:
It is just a value to the attribute of an object at a particular time.
Behaviour:
It describes the actions and their reactions of that object.
Identity:
An object has an identity that characterizes its own existence. The identity makes it possible to distinguish any object in an unambiguous way, and independently from its state.

5. Differentiate persistent & non-persistent objects?
Persistent refers to an object's ability to transcend time or space. A persistent object stores/saves its state in a permanent storage system with out losing the information represented by the object.
A non-persistent object is said to be transient or ephemeral. By default objects are considered as non-persistent.

6. What do you meant by active and passive objects?
Active objects are one which instigate an interaction which owns a thread and they are responsible for handling control to other objects. In simple words it can be referred as client.
Passive objects are one, which passively waits for the message to be processed. It waits for another object that requires its services. In simple words it can be referred as server.

Diagram:
client server
(Active) (Passive)

7. What is meant by software development method?
Software development method describes how to model and build software systems in a reliable and reproducible way. To put it simple, methods that are used to represent ones' thinking using graphical notations.

8. What are models and meta models?
Model:
It is a complete description of something (i.e. system).
Meta model:
It describes the model elements, syntax and semantics of the notation that allows their manipulation.

9. What do you meant by static and dynamic modeling?
Static modeling is used to specify structure of the objects that exist in the problem domain. These are expressed using class, object and USECASE diagrams.
But Dynamic modeling refers representing the object interactions during runtime. It is represented by sequence, activity, collaboration and statechart diagrams.

10. How to represent the interaction between the modeling elements?
Model element is just a notation to represent (Graphically) the entities that exist in the problem domain. e.g. for modeling element is class notation, object notation etc.

Relationships are used to represent the interaction between the modeling elements.
The following are the Relationships.

Association: Its' just a semantic connection two classes.

e.g.:

Aggregation: Its' the relationship between two classes which are related in the fashion that master and slave. The master takes full rights than the slave. Since the slave works under the master. It is represented as line with diamond in the master area.
ex:
car contains wheels, etc.

car

Containment(Composition): This relationship is applied when the part contained with in the whole part, dies when the whole part dies.
It is represented as darked diamond at the whole part.
example:
class A{
//some code
};

class B
{
A aa; // an object of class A;
// some code for class B;
};
In the above example we see that an object of class A is instantiated with in the class B. so the object class A dies when the object class B dies.we can represnt it in diagram like this.

Generalization: This relationship used when we want represents a class, which captures the common states of objects of different classes. It is represented as arrow line pointed at the class, which has captured the common states.

Dependency: It is the relationship between dependent and independent classes. Any change in the independent class will affect the states of the dependent class.
DIAGRAM:
class A class B

11. Why generalization is very strong?
Even though Generalization satisfies Structural, Interface, Behaviour properties. It is mathematically very strong, as it is Antisymmetric and Transitive.
Antisymmetric: employee is a person, but not all persons are employees. Mathematically all As’ are B, but all Bs’ not A.
Transitive: A=>B, B=>c then A=>c.
A. Salesman.
B. Employee.
C. Person.
Note: All the other relationships satisfy all the properties like Structural properties, Interface properties, Behaviour properties.

12. Differentiate Aggregation and containment(Composition)?
Aggregation is the relationship between the whole and a part. We can add/subtract some properties in the part (slave) side. It won't affect the whole part.
Best example is Car, which contains the wheels and some extra parts. Even though the parts are not there we can call it as car.
But, in the case of containment the whole part is affected when the part within that got affected. The human body is an apt example for this relationship. When the whole body dies the parts (heart etc) are died.

13. Can link and Association applied interchangeably?
No, You cannot apply the link and Association interchangeably. Since link is used represent the relationship between the two objects.
But Association is used represent the relationship between the two classes.
link :: student:Abhilash course:MCA
Association:: student course

14. what is meant by "method-wars"?
Before 1994 there were different methodologies like Rumbaugh, Booch, Jacobson, Meyer etc who followed their own notations to model the systems. The developers were in a dilemma to choose the method which best accomplishes their needs. This particular span was called as "method-wars"


These terms signify the relationships between classes. These are the building blocks of object oriented programming and very basic stuff. But still for some, these terms look like Latin and Greek. Just wanted to refresh these terms and explain in simpler terms.

Association

Association is a relationship between two objects. In other words, association defines the multiplicity between objects. You may be aware of one-to-one, one-to-many, many-to-one, many-to-many all these words define an association between objects. Aggregation is a special form of association. Composition is a special form of aggregation.

Example: A Student and a Faculty are having an association.

Aggregation

Aggregation is a special case of association. A directional association between objects. When an object ‘has-a’ another object, then you have got an aggregation between them. Direction between them specified which object contains the other object. Aggregation is also called a “Has-a” relationship.

Composition

Composition is a special case of aggregation. In a more specific manner, a restricted aggregation is called composition. When an object contains the other object, if the contained object cannot exist without the existence of container object, then it is called composition.

Example: A class contains students. A student cannot exist without a class. There exists composition between class and students.


Difference between aggregation and composition

Composition is more restrictive. When there is a composition between two objects, the composed object cannot exist without the other object. This restriction is not there in aggregation. Though one object can contain the other object, there is no condition that the composed object must exist. The existence of the composed object is entirely optional. In both aggregation and composition, direction is must. The direction specifies, which object contains the other object.

Example: A Library contains students and books. Relationship between library and student is aggregation. Relationship between library and book is composition. A student can exist without a library and therefore it is aggregation. A book cannot exist without a library and therefore its a composition. For easy understanding I am picking this example. Don’t go deeper into example and justify relationships!

Abstraction

Abstraction is specifying the framework and hiding the implementation level information. Concreteness will be built on top of the abstraction. It gives you a blueprint to follow to while implementing the details. Abstraction reduces the complexity by hiding low level details.

Example: A wire frame model of a car.

Generalization

Generalization uses a “is-a” relationship from a specialization to the generalization class. Common structure and behaviour are used from the specializtion to the generalized class. At a very broader level you can understand this as inheritance. Why I take the term inheritance is, you can relate this term very well. Generalization is also called a “Is-a” relationship.

Example: Consider there exists a class named Person. A student is a person. A faculty is a person. Therefore here the relationship between student and person, similarly faculty and person is generalization.

Realization

Realization is a relationship between the blueprint class and the object containing its respective implementation level details. This object is said to realize the blueprint class. In other words, you can understand this as the relationship between the interface and the implementing class.

Example: A particular model of a car ‘GTB Fiorano’ that implements the blueprint of a car realizes the abstraction.

Dependency

Change in structure or behaviour of a class affects the other related class, then there is a dependency between those two classes. It need not be the same vice-versa. When one class contains the other class it this happens.

Example: Relationship between shape and circle is dependency.

java spring boot tutorial

Explanation on how Spring boot will be used:

Spring Boot aims to make it easy to create Spring-powered, production-grade applications and services with minimum fuss. It takes an opinionated view of the Spring platform so that new and existing users can quickly get to the bits they need. You can use it to create stand-alone Java applications that can be started using ‘java -jar’ or more traditional WAR deployments. We also provide a command line tool that runs ‘spring scripts’.

The diagram below shows Spring Boot as a point of focus on the larger Spring ecosystem. It presents a small surface area for users to approach and extract value from the rest of Spring

How to run spring boot without a web container?

Simply start your spring boot app in a non-web environment:

new SpringApplicationBuilder()

.sources(SpringBootApp.class)

.web(false)

.run(args);

Also, you obviously should not add the spring-boot-starter-web dependency.

By default, spring boot launches a web container if it finds one in the classpath. Using web(false)ensures that it does not happen. Tomcat could be included by another dependency without your knowledge, so it's better to disable the web environment if that is your goal.

What is Spring?

Simply put, the Spring framework provides comprehensive infrastructure support for developing Java applications.

It’s packed with some nice features like Dependency Injection and out of the box modules like:

• Spring JDBC
• Spring MVC
• Spring Security
• Spring AOP
• Spring ORM
• Spring Test

These modules can drastically reduce the development time of an application.

For example, in the early days of Java web development, we needed to write a lot of boilerplate code to insert a record into a data source. But by using the JDBCTemplate of the Spring JDBC module we can reduce it to a few lines of code with only a few configurations.

What is Spring Boot?

Spring Boot is basically an extension of the Spring framework which eliminated the boilerplate configurations required for setting up a Spring application.

It takes an opinionated view of the Spring platform which paved the way for a faster and more efficient development eco-system.

Here are just a few of the features in Spring Boot:

• Opinionated ‘starter’ dependencies to simplify build and application configuration
• Embedded server to avoid complexity in application deployment
• Metrics, Helth check, and externalized configuration
• Automatic config for Spring functionality – whenever possible

Maven Dependencies

First of all, let’s look at the minimum dependencies required to create a web application using Spring:

<dependency>

    <groupId>org.springframework</groupId>

    <artifactId>spring-web</artifactId>

    <version>5.1.0.RELEASE</version>

</dependency>

<dependency>

    <groupId>org.springframework</groupId>

    <artifactId>spring-webmvc</artifactId>

    <version>5.1.0.RELEASE</version>

</dependency>

Unlike Spring, Spring Boot requires only one dependency to get a web application up and running:

<dependency>

    <groupId>org.springframework.boot</groupId>

    <artifactId>spring-boot-starter-web</artifactId>

    <version>2.0.5.RELEASE</version>

</dependency>

Spring Boot provides a number of starter dependencies for different Spring modules.Some of the most commonly used ones are:

• spring-boot-starter-data-jpa
• spring-boot-starter-security
• spring-boot-starter-test
• spring-boot-starter-web
• spring-boot-starter-thymeleaf

Application Configuration with Spring Boot:

Configuration for applications vary from one environment to another

·        You would want to connect to a different database or queues

·        You would want to connect with different services

·        You would want to configure less logging in production

·        You might want to have different custom configuration

Application Configuration with Spring Boot application.properties

Spring Boot allows you to configure your application configuration using a file named application.properties

application.properties can reside anywhere in the classpath of the application.

In application.properties, we can use the “logging.level” prefix to set logging levels.

logging.level.some.package.path=DEBUG

logging.level.some.other.package.path=ERROR

You can configure a log file by using logging.file property in application.properties. The logging here would be in addition to the logging in console.

logging.file=\path_to\logfile.log

You can also configure the port to run the server on using server.port

server.port = 9080

For complete list of options refer spring documentation - https://docs.spring.io/spring-boot/docs/current/reference/html/common-application-properties.html

How application configuration will point common location:

Spring Boot looks at Frameworks available on the CLASSPATH b) Existing configuration for the application. Based on these, Spring Boot provides basic configuration needed to configure the application with these frameworks. This is called Auto Configuration.

For external configuration follow the below link:

https://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-external-config.html

How to load external property files into Spring Boot application?

It is a standard practice that during our production deployments, our application loads property files from external locations. This helps us to change our configurations without changing our code. In this page, we will come to know how to load external property files into Spring Boot application.

By default, Spring Boot look for externalized default property file application.properties into given below predetermined locations:

In the classpath root.

In the package "/config" in classpath.

In the current directory.

In the "/config" directory of current folder.

Now lets say, your application requires externalized properties like application.properties and another property file myapp.properties. The both properties can be in the same folder or they can be in different folder. There are 3 ways of doing it.

Command line arguments

In the first approach, all you need to do is pass folder names and property names as part of command line arguments as shown below:

Terminal:

java -jar myapp.jar --spring.config.name=application,myapp --spring.config.location=classpath:/data/myapp/config,classpath:/data/myapp/external/config

In the above command, we are passing property file name as part of "--spring.config.name" variable and folder location as part of "--spring.config.location" variable.

Environment variables

In the second approach, you can configure your externalized configuration details into environment variables and your Spring Boot application will read it from your environment as shown below:

Terminal:

set SPRING_CONFIG_NAME=application,myapp

set SPRING_CONFIG_LOCATION=classpath:/data/myapp/config,classpath:/data/myapp/external/config

java -jar myapp.jar

Programatically loding configurations:

ort org.slf4j.Logger;

import org.slf4j.LoggerFactory;

import org.springframework.boot.autoconfigure.SpringBootApplication;

import org.springframework.boot.builder.SpringApplicationBuilder;

import org.springframework.context.ConfigurableApplicationContext;

import org.springframework.core.env.ConfigurableEnvironment;

@SpringBootApplication

public class SpringBootWebApplication {

    private static Logger logger = LoggerFactory.getLogger(SpringBootWebApplication.class);

public static void main(String[] args) throws Exception {

ConfigurableApplicationContext applicationContext = new SpringApplicationBuilder(SpringBootWebApplication.class).properties("spring.config.name:application,myapp",          spring.config.location:classpath:/data/myapp/config,classpath:/data/myapp/external/config").build().run(args);

 ConfigurableEnvironment environment = applicationContext.getEnvironment();

     logger.info(environment.getProperty("cmdb.resource-url"));

    }

}

what is micro services authentication strategy in spring

micro services authentication strategy

All about building secure micro-services

Why need security in microservices?

Microservices talk to each-other. So all the communication links between micro services need to have a way to make security decisions whether or not they are allowed to communicate and if at all, what are the authorization levels.

What protocol does your microservice speak?

·        HTTP (REST, SOAP)

·        AMQP (Messaging)

·        Apache Thrift (Remote Procedure Call Framework)

·        gRPC (google’s RPC)

·        custom TCP protocol and likewise…

What we just got to know is, it’s not just a HTTP protocol which is in picture, and therefore decision on making a choice on the security standard must take into account the protocol flexibility.

Solution:

Every request to a microservice must include a security token that the microservice can easily authenticate and use for making authorization decision.

Self-Learn : Look back on what is Authentication and Authorization???

Problems to solve

1. 1   What format should security token use?
2. 2    How are tokens supposed to be obtained?
3. 3    What libraries should be used for authentication and authorization when         implementing micro services?
4. 4 What information should be in the token?

 n  Use a “STANDARD” token format, as simple as that.

Token Standard	Format	Protocol Specific	Year of standardization
Kerberos Ticket	Binary	Yes, Kerberos	1993
SAML Token	XML	Yes, SAML	2002
JWT Token	JSON	No	2015

To get a SAML token you need a SAML Server.

To get a Kerberos ticket you need a Kerberos server.

To get a JWT you need something that can give it to you.

Decision point #1) Evaluation criteria

            Is the token format standardized?

            Can the token be used with any protocol?

            Is the token easy to parse?

            Can the token be included in URL parameter?

            Are there lots of libraries in lots of programming languages for working with the token?

Is the token format considered “easy” to work with?

A ToolBox of Standards

Name	Title
OAuth1	The Oauth 1.0 Protocol
OAuth2	The Oauth 2.0 Authorization Framework
Bearer Token	The Oauth 2.0 Authorization Framework : Bearer token usage
JWE	JSON Web encryption
JWK	JSON Web key
JWA	JSON Web algorithms
JWT	JSON Web tokens
JOSE	JSON object signing and encryption
JWS	JSON Web signature unencoded payload option

JWT:

JSON Web Tokens are an open, industry standard RFC 7519 method for representing claims securely between two parties.

JWT.IO allows you to decode, verify and generate JWT.

OAuth:

OAuth (Open Authorization) is an open standard for access delegation, commonly used as a way for Internet users to grant websites or applications access to their information on other websites but without giving them the passwords.[1] This mechanism is used by companies such as Google, Facebook, Microsoft and Twitter to permit the users to share information about their accounts with third party applications or websites.

JWT, OAuth, OpenID Connect and CSRF protection : An understanding

JWT (JSON Web Tokens)- It is just a token format. JWT tokens are JSON encoded data structures contains information about issuer, subject (claims), expiration time etc. It is signed for tamper proof and authenticity and it can be encrypted to protect the token information using symmetric or asymmetric approach. JWT is simpler than SAML 1.1/2.0 and supported by all devices and it is more powerful than SWT(Simple Web Token).

OAuth2 - OAuth2 solve a problem that user wants to access the data using client software like browse based web apps, native mobile apps or desktop apps. OAuth2 is just for authorization, client software can be authorized to access the resources on-behalf of end user using access token.

OpenID Connect - OpenID Connect builds on top of OAuth2 and add authentication. OpenID Connect add some constraint to OAuth2 like UserInfo Endpoint, ID Token, discovery and dynamic registration of OpenID Connect providers and session management. JWT is the mandatory format for the token.

CSRF protection - You don't need implement the CSRF protection if you do not store token in the browser's cookie.

You can read more details here http://proficientblog.com/microservices-security/

If we have to differentiate JWT and OAuth. Basically, JWT is a token format. OAuth is an authorization protocol that can use JWT as a token. OAuth uses server-side and client-side storage. If you want to do real logout you must go with OAuth2. Authentication with JWT token cannot logout actually. Because you don't have an Authentication Server that keeps track of tokens. If you want to provide an API to 3rd party clients, you must use OAuth2 also. OAuth2 is very flexible. JWT implementation is very easy and does not take long to implement. If your application needs this sort of flexibility, you should go with OAuth2. But if you don't need this use-case scenario, implementing OAuth2 is a waste of time.

XSRF token is always sent to the client in every response header. It does not matter if a CSRF token is sent in a JWT token or not, because the CSRF token is secured with itself. Therefore sending CSRF token in JWT is unnecessary.

Decision on whether to go for OAuth or Simple JWT based access to applications:

The key point here is access delegation. Why would anyone create OAUTH when there is an id/pwd based authentication, backed by multifactored auth like OTPs and further can be secured by JWTs which are used to secure the access to the paths (like scopes in OAUTH) and set the expiry of the access

There's no point of using OAUTH if consumers access their resources(your end points) only through their trusted websites(or apps) which are your again hosted on your end points

You can go OAUTH authentication only if you are an OAUTH provider in the cases where the resource owners (users) want to access their(your) resources (end-points) via a third-party client(external app). And it is exactly created for the same purpose though you can abuse it in general

Another important note:
You're freely using the word authentication for JWT and OAUTH but neither provide the authentication mechanism. Yes one is a token mechanism and the other is protocol but once authenticated they are only used for authorization (access management). You've to back OAUTH either with OPENID type authentication or your own client credentials

Sample code to generate JWT:

Sample Code to decode tokens:

for reference go through the below links

Please have a detailed look at the below given links to grow hands-on knowledge on Spring REST security:

https://www.toptal.com/java/rest-security-with-jwt-spring-security-and-java

https://www.baeldung.com/securing-a-restful-web-service-with-spring-security

https://medium.com/@nydiarra/secure-a-spring-boot-rest-api-with-json-web-token-reference-to-angular-integration-e57a25806c50

http://www.springboottutorial.com/securing-rest-services-with-spring-boot-starter-security