在CXF服务端配置WEB SERVICE时，通常会包含一些来此cxf.jar里面的XML文件，用于自动配置需要使用到的BEAN

例如：

1<import resource="classpath:META-INF/cxf/cxf.xml" />   
2<import resource="classpath:META-INF/cxf/cxf-extension-soap.xml" />   
3<import resource="classpath:META-INF/cxf/cxf-servlet.xml" />   

但是在客户端配置的时候这些文件是不需要的，甚至配置会引发错误，详细的经过见下文。

经过：

今天在配置客户端的时候，步骤和内容都是和往常一样的，但是

出现一个NullPointerException 的错误，只知道这个错误是在创建客户端service的时候出的错，但是原因找不到。

错误堆栈：

Caused by: java.lang.NullPointerException    
    at org.apache.cxf.frontend.AbstractWSDLBasedEndpointFactory.createEndpointInfo(AbstractWSDLBasedEndpointFactory.java:160)    
    at org.apache.cxf.frontend.AbstractWSDLBasedEndpointFactory.createEndpoint(AbstractWSDLBasedEndpointFactory.java:102)    
    at org.apache.cxf.frontend.ClientFactoryBean.create(ClientFactoryBean.java:51)    
    at org.apache.cxf.frontend.ClientProxyFactoryBean.create(ClientProxyFactoryBean.java:97)    
    at org.apache.cxf.jaxws.JaxWsProxyFactoryBean.create(JaxWsProxyFactoryBean.java:89)    
    at com.itravel.cxf.client.JaxWsProxyFactoryBean.create(JaxWsProxyFactoryBean.java:25)    
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)    
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)    
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)    
    at java.lang.reflect.Method.invoke(Method.java:585)    
    at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:115)   

直到后来我单独加载了创建客户端service的applicationContext时，初始化是正常的，所以就怀疑配置文件出了问题；

当上面提到的几个被包含进来的文件的配置被删除后，一切就正常了。

现象：

在Web harvest中使用http请求去获取某个远程的XML，此XML的特征是无文件头(即没有编码描述等关键信息)，采用了多种办法去获取，出现乱码，无法解析成我们需要的数据。

办法：

(1)最原始办法：使用Java中的URLConnection，InputStream等类读取字节流，构造字符串：

 (2)最好的办法：直接使用dom4j中的SAXReader

非常简单，连编码都不用管！

 其中：link为需要获取XML的地址

最近这几天都在使用CXF作为webservice的组件，试图将公开的webservice加入到保护的范围内。

添加到保护的方法有三种：

(1)指定地址访问，即指定一些IP地址，只有这些地址的请求我们的接口才处理。

这种方法我在开发中有使用到，可以通过WEB容器中的Filter类来实现，

只需要检查请求的地址是否在我们指定的地址列表中就可以了。

优点:处于请求响应链的前端，响应非常迅速，所以消耗的资源很少。

缺端：使用这种方法只能检查指定地址的请求，通常只能应用的小范围内，如局域网。

另外使用这种验证方法，无法进行权限的检查，一旦通过验证将可以执行所有公开的接口。

(2)用户名/密码对验证，使用指定的用户名密码进行验证

这种方法适合于具体用户的检查，进而可以检查其是否有权限执行其请求的操作.

优点：可以只准确地检查用户，甚至验证权限。

缺点：这种方式不能和WEB应用的登录一样，只需要验证一次就可以了；必须

每个请求都检查，如果需要使用这种方法去做，还需要处理好类似登录/退出机制。

(3)使用HTTPS进行验证，这种方法应该也可以具体的验证证书来自哪个用户，进而检查其权限。

优点：安全更有保证

缺点：配置复杂，对客户端程序员要求很比较高。

注意事项：

使用CXF进行WEBService交互时，特别是进行客户端工作时，最好将服务端和客户端的环境剥离开来。

这几天的工作教会了我这个事情(今天上午在测试客户端代码时出现莫名其妙的错，最后发现是JAR包冲突，

在服务器的环境中运行客户端程序时，程序加载了过时的JAR)。

其影响主要表现在两方面：

(1)对流程确定过程的影响

在通过分析网站地图的方式去确定流程，对专业化程度不是那么高的网站而言，其网站分类、列表方式基本基本都采用链接的方式，这样在流程实现是很容易就可获取需要的链接；而对专业化程度较高的网站而言，在分类下往往通过搜索、javascript(包括AJAX)翻页的方式来陈列同类记录，这在流程实现的时候，就需要程序员去分析一些javascript函数所做的操作，去猜度相关列表方式的URL(如搜索的表单如何提交、翻页函数如何处理翻页等)。

(2)对获取详细信息过程的影响

在获取详细信息的时候，基本都是通过分心详细信息页面的结构出发的。

对专业化程度高的网站而言，详细信息页面的的制作也是投入了一些精力的，通常都规定和页面特定的位置显示特定的信息，这样就便于在分析过程中获取指定的数据。

而对专业化程度稍低的网站而言，详细页面的内容很多都是用HTML编辑器直接编辑出来的内容，在同一频道的不同分类的详细信息页面中存在着很大的差异，这使得获取详细信息部分的分析程序复杂度倍增。

个人的美好愿望：宁愿分析的是专业化程度高一点的站点，因为流程的确定及具体实现总是可以想到办法解决的；详细信息的分析存在太多页面结构的话，将在获取详细信息付出太大代价！

 1<?xml version="1.0" encoding="UTF-8"?>
 2<beans xmlns="http://www.springframework.org/schema/beans"
 3    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4    xmlns:jee="http://www.springframework.org/schema/jee"
 5    xmlns:jaxws="http://cxf.apache.org/jaxws"
 6    xmlns:http-conf="http://cxf.apache.org/transports/http/configuration" 
 7    xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.0.xsd
 8           http://www.springframework.org/schema/jee http://www.springframework.org/schema/jee/spring-jee-2.0.xsd
 9           http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd
10           http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd ">
11        <http-conf:conduit name="{http://impl.service.product.super.com/}ProjectService.http-conduit"> 
12        <http-conf:client ConnectionTimeout="10000" ReceiveTimeout="20000"/>
13    </http-conf:conduit> 
14</beans>
15

这里需要注意的有几个地方:
1:需要指定http-conf名称空间 xmlns:http-conf=http://cxf.apache.org/transports/http/configuration
2:指定模式位置: http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd
3:http-conf:conduit中的name属性,指定设置生效的服务,如例子中,只对服务名为{http://impl.service.product.sww.com/}ProjectService的服务生效.
使用下面的设置则会对所有服务生效

<http-conf:conduit name="*.http-conduit">
      
</http-conf:conduit>

更详细的配置请参考CXF官方文档:

http://cwiki.apache.org/CXF20DOC/client-http-transport-including-ssl-support.html

Whether you program regularly in Java, and know it like the back of your hand, or whether you're new to the language or a casual programmer, you'll make mistakes. It's natural, it's human, and guess what? You'll more than likely make the same mistakes that others do, over and over again. Here's my top ten list of errors that we all seem to make at one time or another,  how to spot them, and how to fix them.

10. Accessing non-static member variables from static methods (such as main)

Many programmers, particularly when first introduced to Java, have problems with accessing member variables from their main method. The method signature for main is marked static - meaning that we don't need to create an instance of the class to invoke the main method. For example, a Java Virtual Machine (JVM) could call the class MyApplication like this :-

MyApplication.main ( command_line_args );

This means, however, that there isn't an instance of MyApplication - it doesn't have any member variables to access! Take for example the following application, which will generate a compiler error message.

public class StaticDemo
{
public String my_member_variable = "somedata";

        public static void main (String args[])
{
// Access a non-static member from static method
System.out.println ("This generates a compiler error" +
my_member_variable );
}
}

If you want to access its member variables from a non-static method (like main), you must create an instance of the object. Here's a simple example of how to correctly write code to access non-static member variables, by first creating an instance of the object.

public class NonStaticDemo
{
public String my_member_variable = "somedata";
public static void main (String args[])
{
NonStaticDemo demo = new NonStaticDemo();
// Access member variable of demo
System.out.println ("This WON'T generate an error" +
demo.my_member_variable );
}
}

9. Mistyping the name of a method when overriding

Overriding allows programmers to replace a method's implementation with new code. Overriding is a handy feature, and most OO programmers make heavy use of it. If you use the AWT 1.1 event handling model, you'll often override listener implementations to provide custom functionality. One easy trap to fall into with overriding, is to mistype the method name. If you mistype the name, you're no longer overriding a method - you're creating an entirely new method, but with the same parameter and return type.

public class MyWindowListener extends WindowAdapter {
// This should be WindowClosed
public void WindowClose(WindowEvent e) {
// Exit when user closes window
System.exit(0);
}
});

Compilers won't pick up on this one, and the problem can be quite frustrating to detect. In the past, I've looked at a method, believed that it was being called, and taken ages to spot the problem. The symptom of this error will be that your code isn't being called, or you think the method has skipped over its code. The only way to ever be certain is to add a println statement, to record a message in a log file, or to use good trace debugger (like Visual J++ or Borland JBuilder) and step through line by line. If your method still isn't being called, then it's likely you've mistyped the name.

8. Comparison assignment (  = rather than == )

This is an easy error to make. If you're used other languages before, such as Pascal, you'll realize just how poor a choice this was by the language's designers. In Pascal, for example, we use the := operator for assignment, and leave = for comparison. This looks like a throwback to C/C++, from which Java draws its roots.

Fortunately, even if you don't spot this one by looking at code on the screen, your compiler will. Most commonly, it will report an error message like this : "Can't convert xxx to boolean", where xxx is a Java type that you're assigning instead of comparing.

7. Comparing two objects ( == instead of .equals)

When we use the == operator, we are actually comparing two object references, to see if they point to the same object. We cannot compare, for example, two strings for equality, using the == operator. We must instead use the .equals method, which is a method inherited by all classes from java.lang.Object.

Here's the correct way to compare two strings.

String abc = "abc"; String def = "def";
// Bad way
if ( (abc + def) == "abcdef" )
{
    ......
}

// Good way
if ( (abc + def).equals("abcdef") )
{
   .....
}

6. Confusion over passing by value, and passing by reference

This can be a frustrating problem to diagnose, because when you look at the code, you might be sure that its passing by reference, but find that its actually being passed by value. Java uses both, so you need to understand when you're passing by value, and when you're passing by reference.

When you pass a primitive data type, such as a char, int, float, or double, to a function then you are passing by value. That means that a copy of the data type is duplicated, and passed to the function. If the function chooses to modify that value, it will be modifying the copy only. Once the function finishes, and control is returned to the returning function, the "real" variable will be untouched, and no changes will have been saved. If you need to modify a primitive data type, make it a return value for a function, or wrap it inside an object.

When you pass a Java object, such as an array, a vector, or a string, to a function then you are passing by reference. Yes - a String is actually an object, not a primitive data type.  So that means that if you pass an object to a function, you are passing a reference to it, not a duplicate. Any changes you make to the object's member variables will be permanent - which can be either good or bad, depending on whether this was what you intended.

On a side note, since String contains no methods to modify its contents, you might as well be passing by value.

5. Writing blank exception handlers

I know it's very tempting to write blank exception handlers, and to just ignore errors. But if you run into problems, and haven't written any error messages, it becomes almost impossible to find out the cause of the error. Even the simplest exception handler can be of benefit. For example, put a try { .. } catch Exception around your code, to catch ANY type of exception, and print out the message. You don't need to write a custom handler for every exception (though this is still good programming practice). Don't ever leave it blank, or you won't know what's happening.

For example

public static void main(String args[])
{
    try {
// Your code goes here..
    }
    catch (Exception e)
    {
System.out.println ("Err - " + e );
    }
}

4. Forgetting that Java is zero-indexed

If you've come from a C/C++ background, you may not find this quite as much a problem as those who have used other languages. In Java, arrays are zero-indexed, meaning that the first element's index is actually 0. Confused? Let's look at a quick example.

// Create an array of three strings
String[] strArray = new String[3];
// First element's index is actually 0
strArray[0] = "First string";
// Second element's index is actually 1
strArray[1] = "Second string";
// Final element's index is actually 2
strArray[2] = "Third and final string";

In this example, we have an array of three strings, but to access elements of the array we actually subtract one. Now, if we were to try and access strArray[3], we'd be accessing the fourth element. This will case an ArrayOutOfBoundsException to be thrown - the most obvious sign of forgetting the zero-indexing rule.

Other areas where zero-indexing can get you into trouble is with strings. Suppose you wanted to get a character at a particular offset within a string. Using the String.charAt(int) function you can look this information up - but under Java, the String class is also zero-indexed. That means than the first character is at offset 0, and second at offset 1. You can run into some very frustrating problems unless you are aware of this - particularly if you write applications with heavy string processing. You can be working on the wrong character, and also throw exceptions at run-time. Just like the ArrayOutOfBoundsException, there is a string equivalent. Accessing beyond the bounds of a String will cause a StringIndexOutOfBoundsException to be thrown, as demonstrated by this example.

public class StrDemo
{
public static void main (String args[])
{
String abc = "abc";
System.out.println ("Char at offset 0 : " + abc.charAt(0) );
System.out.println ("Char at offset 1 : " + abc.charAt(1) );
System.out.println ("Char at offset 2 : " + abc.charAt(2) );
// This line should throw a StringIndexOutOfBoundsException
System.out.println ("Char at offset 3 : " + abc.charAt(3) );
}
}

Note too, that zero-indexing doesn't just apply to arrays, or to Strings. Other parts of Java are also indexed, but not always consistently. The java.util.Date, and java.util.Calendar classes start their months with 0, but days start normally with 1. This problem is demonstrated by the following application.

import java.util.Date;
import java.util.Calendar;
public class ZeroIndexedDate
{
public static void main (String args[])
{
// Get today's date
Date today = new Date();
// Print return value of getMonth
System.out.println ("Date.getMonth() returns : " +
today.getMonth());
// Get today's date using a Calendar
Calendar rightNow = Calendar.getInstance();
// Print return value of get ( Calendar.MONTH )
System.out.println ("Calendar.get (month) returns : " +
rightNow.get ( Calendar.MONTH ));

        }
}

Zero-indexing is only a problem if you don't realize that its occurring. If you think you're running into a problem, always consult your API documentation.

3. Preventing concurrent access to shared variables by threads

When writing multi-threaded applications, many programmers (myself included) often cut corners, and leave their applications and applets vulnerable to thread conflicts. When two or more threads access the same data concurrently, there exists the possibility (and Murphy's law holding, the probability) that two threads will access or modify the same data at the same time. Don't be fooled into thinking that such problems won't occur on single-threaded processors. While accessing some data (performing a read), your thread may be suspended, and another thread scheduled. It writes its data, which is then overwritten when the first thread makes its changes.

Such problems are not just limited to multi-threaded applications or applets. If you write Java APIs, or JavaBeans, then your code may not be thread-safe. Even if you never write a single application that uses threads, people that use your code WILL. For the sanity of others, if not yourself, you should always take precautions to prevent concurrent access to shared data.

How can this problem be solved? The simplest method is to make your variables private (but you do that already,  right?) and to use synchronized accessor methods. Accessor methods allow access to private member variables, but in a controlled manner. Take the following accessor methods, which provide a safe way to change the value of a counter.

public class MyCounter
{
private int count = 0; // count starts at zero
public synchronized void setCount(int amount)
{
count = amount;
}
public synchronized int getCount()
{
return count;
}
}

2. Capitalization errors

This is one of the most frequent errors that we all make. It's so simple to do, and sometimes one can look at an uncapitalized variable or method and still not spot the problem. I myself have often been puzzled by these errors, because I recognize that the method or variable does exist, but don't spot the lack of capitalization.

While there's no silver bullet for detecting this error, you can easily train yourself to make less of them. There's a very simple trick you can learn :-

• all methods and member variables in the Java API begin with lowercase letters
• all methods and member variables use capitalization where a new word begins e.g - getDoubleValue()

If you use this pattern for all of your member variables and classes, and then make a conscious effort to get it right, you can gradually reduce the number of mistakes you'll make. It may take a while, but it can save some serious head scratching in the future.

(drum roll)

And the number one error that Java programmers make !!!!!

1. Null pointers!

Null pointers are one of the most common errors that Java programmers make. Compilers can't check this one for you - it will only surface at runtime, and if you don't discover it, your users certainly will.

When an attempt to access an object is made, and the reference to that object is null, a NullPointerException will be thrown. The cause of null pointers can be varied, but generally it means that either you haven't initialized an object, or you haven't checked the return value of a function.

Many functions return null to indicate an error condition - but unless you check your return values, you'll never know what's happening. Since the cause is an error condition, normal testing may not pick it up - which means that your users will end up discovering the problem for you. If the API function indicates that null may be returned, be sure to check this before using the object reference!

Another cause is where your initialization has been sloppy, or where it is conditional. For example, examine the following code, and see if you can spot the problem.

public static void main(String args[])
{
// Accept up to 3 parameters
String[] list = new String[3];
int index = 0;
while ( (index < args.length) && ( index < 3 ) )
{
list[index++] = args[index];
}
// Check all the parameters
for (int i = 0; i < list.length; i++)
{
if (list[i].equals "-help")
{
// .........
}
else
if (list[i].equals "-cp")
{
// .........
}
// else .....
}
}

This code (while a contrived example), shows a common mistake. Under some circumstances, where the user enters three or more parameters, the code will run fine. If no parameters are entered, you'll get a NullPointerException at runtime. Sometimes your variables (the array of strings) will be initialized, and other times they won't. One easy solution is to check BEFORE you attempt to access a variable in an array that it is not equal to null.

Summary

These errors represent but some of the many that we all make. Though it is impossible to completely eliminate errors from the coding process, with care and practice you can avoid repeating the same ones. Rest assured, however, that all Java programmers encounter the same sorts of problems. It's comforting to know, that while you work late into the night tracking down an error, someone, somewhere, sometime, will make the same mistake!

Properties Editor

http://propedit.sourceforge.jp/eclipse/updates/ 

CAS用来标志用户的token是存在它自己的域名下的,不是存在web应用的域名下的.CAS判断用户登录由agent决定,agent验证用户信息有两种处理.
1.如果这个用户是以前没登录过的,也就是说这个web应用的域名下没有一个agent颁发的sessionid(在cookie里)的话,那么它会跳转到CAS server的登录界面(这里由CAS server决定是否显示登录界面,还是直接就跳转回来,也就是不是每次都要求输入密码登录的).
2.CAS的登录界面会有两种处理.如果以前没登录过,也就是在CAS server自己的域名下,没有用户的token的话,就要求登录.如果有token的话,就返回一个ticket(也就是不显示登录界面直接重定向返回了).
然后接第一步里面,agent收到ticket以后就提交给CAS server验证,并取得返回信息(是个xml,cas的协议规定的,也可以用saml之类的,这个地方可以取得除了用户姓名以外的信息,这样就可以做同步了,权限的问题可以这么解决).然后agent就保存此时的session,把sessionid放到该web应用域名下的cookie里.
以上逻辑说明了,标志用户身份的token在CAS server的域名下,每个web应用不保存用户身份.因此跨域是绝对没问题的.只是single sign off就需要CAS server的配合了,要把那个token删掉.
不过如果标志身份的token不存在,而sessionid存在,那还是被认为是登录的,只不过是在等待那个session timeout而已.

图片中的字体稍微小了点,呵呵,使用visio我还算是个新手! 

ps:这个流程图是根据cas服务端的webflow的配置画出来,如有本人有理解错误的!欢迎指正!

!-----------------------------------------------------------------------------!  
  !                                                     PATTERN   FORMATS   GLOSSARY                                                       !  
  !-----------------------------------------------------------------------------!  
  !   %n   -   newline                                                                                                                                 !  
  !   %m   -   your   log   message                                                                                                               !  
  !   %p   -   message   priority   (FATAL,   ERROR,   WARN,   INFO,   DEBUG   or   custom)                       !  
  !   %r   -   millisecs   since   program   started   running                                                                 !  
  !    %%  -   percent   sign   in   output                                                                                                   !  
  !                                                                                                                                                           !  
  !-----------------------SOME   MORE   CLUTTER   IN   YOUR   LOG-------------------------!  
  !   %c   -   name   of   your   category   (logger),   %c{2}   will   outputs   last   two   components   !  
  !   %t   -   name   of   current   thread                                                                                                   !  
  !   %x   -   Nested   Diagnostic   Context   (NDC)   (you   supply   it!)                                               !  
  !                                                                                                                                                           !  
  !-------------------------SLOW   PERFORMANCE   FORMATS----------------------------!  
  !   %d   -   date   and   time,   also   %d{ISO8601},   %d{DATE},   %d{ABSOLUTE},                               !  
  !                 %d{HH:mm:ss,SSS},   %d{dd   MMM   yyyy   HH:mm:ss,SSS}   and   so   on                           !  
  !   %l   -   Shortcut   for   %F%L%C%M                                                                                                     !  
  !   %F   -   Java   source   file   name                                                                                                     !  
  !   %L   -   Java   source   line   number                                                                                                 !  
  !   %C   -   Java   class   name,   %C{1}   will   output   the   last   one   component                             !  
  !   %M   -   Java   method   name                                                                                                               !  
  !                                                                                                                                                           !  
  !------------------------------FORMAT   MODIFIERS-------------------------------!  
  !   %-any_letter_above   -   Left-justify   in   min.   width   (default   is   right-justify)     !  
  !   %20any_letter_above   -   20   char.   min.   width   (pad   with   spaces   if   reqd.)                 !  
  !   %.30any_letter_above   -   30   char.   max.   width   (truncate   beginning   if   reqd.)         !  
  !   %-10.10r   -   Example.     Left-justify   time   elapsed   within   10-wide   field.                 !  
  !                             Truncate   from   beginning   if   wider   than   10   characters.                       !  
  !-----------------------------------------------------------------------------!