Spring Data Rest - Data Meets Hypermedia + Security

Unless otherwise indicated, these sl ides are © 2013-2015 Pivotal Software, Inc. and l icensed under a Creat ive Commons Attr ibut ion-NonCommercial l icense: ht tp: / /creat ivecommons.org/ l icenses/by-nc/3.0/

SPRINGONE2GXWASHINGTON, DC

Spring Data Rest - Data Meets Hypermedia

Greg Turnquist and Roy Clarkson

Unless otherwise indicated, these sl ides are © 2013-2015 Pivotal Software, Inc. and l icensed under a Creat ive Commons Attr ibut ion-NonCommercial l icense: ht tp: / /creat ivecommons.org/ l icenses/by-nc/3.0/ 2


Recognize This?

3



Is the answer…

5


This?

6


“I am getting frustrated by the number of people calling any HTTP-based interface a REST API. Today’s example is the SocialSite REST API. That is RPC. It screams RPC…”


“…What needs to be done to make the REST architectural style clear on the notion that hypertext is a constraint? In other words, if the engine of application state (and hence the API) is not being driven by hypertext, then it cannot be RESTful and cannot be a REST API. Period. Is there some broken manual somewhere that needs to be fixed?” - Roy Fielding

http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext-driven

http://roy.gbiv.com/untangled/2008/rest-apis-must-be-hypertext-driven


Demo 1 - $1B Idea

9


Spring Projects• Spring Framework• Spring Boot• Spring Data• Spring HATEOAS• Spring Data REST• Spring Security• Spring Cloud• Spring Cloud Services

10


What is Spring Data REST?• Leverages HYPERMEDIA & Internet standards

• HAL (draft)• ALPS (draft)• JSON Schema (draft)• URI Templates (RFC 6570)• text/uri-list mediatype (RFC 2483)• profile link relation (RFC 6906)

11


{ "image" : "http://spring-‐a-‐gram.cfapps.io:80/files/plan.jpg1441898618238", "_links" : { "self" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/items/32" }, "item" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/items/32{?projection}", "templated" : true }, "gallery" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/items/32/gallery" } } }

12

Item Resource


@Data@Entity@ToString(exclude = "gallery") public class Item { @Id @GeneratedValue(strategy = GenerationType.AUTO) private long id; @Lob private String image; @ManyToOne private Gallery gallery; @JsonIgnore @OneToOne private User user; }

13

Item Class


{ "description" : "cats", "_links" : { "self" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/galleries/2" }, "gallery" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/galleries/2" }, "items" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/galleries/2/items" } } }

14

Gallery Resource


@Data@Entity@ToStringpublic class Gallery { @Id @GeneratedValue(strategy = GenerationType.AUTO) private long id; private String description; @OneToMany(mappedBy = "gallery") private List<Item> items; protected Gallery() {} public Gallery(String description) { this.description = description; } }

15

Gallery Class


Demo 2 - HAL Navigation

16


<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-rest</artifactId></dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-data-jpa</artifactId></dependency>

17

How to Get Spring Data REST


<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-hateoas</artifactId></dependency>

18

How to Get Spring HATEAOS


Demo 3 - HAL Browser

19


<dependency> <groupId>org.springframework.data</groupId> <artifactId>spring-data-rest-hal-browser</artifactId></dependency>

20

HAL Browser dependency


Security

21


“It’s not real until it’s secured.”

“Do not implement security on your own.”Rob Winch, Spring Security Lead

Greg Turnquist, Spring Data Dude


Comprehensive and extensible support for both Authentication and Authorization

23

Spring Security


Common Attack Vectors• Session fixation• XSS - Cross-Site Scripting• CSRF - Cross Site Request Forgery• clickjacking - User Interface redress attack

24


@PreAuthorize("hasRole('ROLE_USER')") public interface ItemRepository extends PagingAndSortingRepository<Item, Long> { List<Item> findByGalleryIsNull(); @Override @PreAuthorize("#item?.user == null or #item?.user?.name == authentication?.name") Item save(@Param("item") Item item); @Override @PreAuthorize("#item?.user?.name == authentication?.name or hasRole('ROLE_ADMIN')") void delete(@Param("item") Item item); @Override @PreAuthorize("@itemRepository.findOne(#id)?.user?.name == authentication?.name or hasRole('ROLE_ADMIN')") void delete(@Param("id") Long id); }

25

Securing Images


@RepositoryRestResource(exported = false) public interface UserRepository extends CrudRepository<User, Long> { User findByName(String name); }

26

Securing Users


{ "user" : { "name" : "roy", "roles" : [ "ROLE_USER" ] }, "image" : "http://spring-‐a-‐gram.cfapps.io:80/files/plan.jpg1441898618238", "_links" : { "self" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/items/32" }, "item" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/items/32{?projection}", "templated" : true }, "gallery" : { "href" : "http://spring-‐a-‐gram.cfapps.io/api/items/32/gallery" } } }

27

Resource with Projection


@Projection(name = "owner", types = Item.class) public interface Owner { public User getUser(); public String getImage(); }

28

Owner Projection


Demo 4 - Security Configuration

29


<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId></dependency>

30

How to get Spring Security


Use it.No excuses.Seriously.

31

HTTPS


Microservices

32


“the microservice architectural style is an approach to developing a single application as a suite of small services, each running in its own process and communicating with lightweight mechanisms, often an HTTP resource API.”

http://martinfowler.com/articles/microservices.html


Twelve Factor Apps (12factor.net)• Codebase - One codebase tracked in revision control, many deploys• Dependencies - Explicitly declare and isolate dependencies• Config - Store config in the environment• Backing Services - Treat backing services as attached resources• Build, release, run - Strictly separate build and run stages• Processes - Execute the app as one or more stateless processes• Port binding - Export services via port binding• Concurrency - Scale out via the process model• Disposability - Maximize robustness with fast startup and graceful shutdown• Dev/prod parity - Keep development, staging, and production as similar as possible• Logs - Treat logs as event streams• Admin processes - Run admin/management tasks as one-off processes

34


No microservice is an island


Spring Cloud• Intelligent Proxy• Service Discovery• Circuit Breaker• External Configuration

36


Application Diagram

Spring-a-Gram

Spring-a-Gram Backend

MongoDB FileService

SQL Database SQL Database MongoDB


<parent> <groupId>io.pivotal.spring.cloud</groupId> <artifactId>spring-cloud-starter-parent</artifactId> <version>Angel.SR3</version></parent>

38

Spring Cloud Parent POM


org.springframework.cloud Dependencies• spring-‐cloud-‐starter-‐zuul • spring-‐cloud-‐starter-‐eureka • spring-‐cloud-‐starter-‐hystrix • spring-‐cloud-‐starter-‐hystrix-‐amqp • spring-‐cloud-‐starter-‐config-‐client

39


Demo 5 - Microservice Code

40


Spring Cloud Services• Circuit Breaker• Service Registry• Config Client

41


Demo 6 - PWS Showcase

42


<parent> <groupId>io.pivotal.spring.cloud</groupId> <artifactId>spring-cloud-services-starter-parent</artifactId> <version>1.0.0.M1</version></parent>

43

Spring Cloud Services Parent POM


<dependency> <groupId>io.pivotal.spring.cloud</groupId> <artifactId>spring-cloud-services-starter-service-registry</artifactId></dependency> <dependency> <groupId>io.pivotal.spring.cloud</groupId> <artifactId>spring-cloud-services-starter-circuit-breaker</artifactId></dependency><dependency> <groupId>io.pivotal.spring.cloud</groupId> <artifactId>spring-cloud-services-starter-config-client</artifactId></dependency>

44

Spring Cloud Services Dependencies


Additional Sessions• The State of Securing RESTful APIs with Spring

Tue 4:30 Salon I-L - Rob Winch• Hands on Spring Security

Wed 8:30 Salon I-L - Rob Winch• Cloud Native Java with Spring Cloud Services

Wed 2:30 Salon E-H - Craig Walls and Scott Frederick• Securing Microservices with Spring Cloud Security

Thurs 10:30 Salon E-H - Will Tran

45


More Information• github.com/gregturn/spring-a-gram• github.com/royclarkson/spring-rest-service-oauth• twitter.com/springcentral• spring.io

• spring.io/guides• spring.io/video• spring.io/questions

46


Safe Harbor StatementThe following is intended to outline the general direction of Pivotal's offerings. It is intended for information purposes only and may not be incorporated into any contract. Any information regarding pre-release of Pivotal offerings, future updates or other planned modifications is subject to ongoing evaluation by Pivotal and is subject to change. This information is provided without warranty or any kind, express or implied, and is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions regarding Pivotal's offerings. These purchasing decisions should only be based on features currently available. The development, release, and timing of any features or functionality described for Pivotal's offerings in this presentation remain at the sole discretion of Pivotal. Pivotal has no obligation to update forward looking information in this presentation.

47


Learn More. Stay Connected.

@springcentral Spring.io/video



THIS PAGE INTENTIONALLY LEFT BLANK

50


SPRINGONE2GXWASHINGTON, DC

Presentation Title Goes HereBy Presenter Name

Twitter


STOP! Download Fonts Now.PLEASE DOWNLOAD AND INSTALL THESE FONTS BEFORE CREATING YOUR PRESENTATION. You can download the fonts here…https://www.dropbox.com/s/na8jewnsp8dp659/SpringOne-2015-Fonts.zip?dl=0

Fonts included in the ZIP file:• Proxima Nova (body text)• Domine (included but no longer needed)

http://www.fontspring.com/support/installing/how-do-i-install-fonts-on-my-machttp://www.fontspring.com/support/installing/how-do-i-install-fonts-on-my-windows-pc

52

https://www.dropbox.com/s/na8jewnsp8dp659/SpringOne-2015-Fonts.zip?dl=0

https://www.dropbox.com/s/na8jewnsp8dp659/SpringOne-2015-Fonts.zip?dl=0

http://www.fontspring.com/support/installing/how-do-i-install-fonts-on-my-mac

http://www.fontspring.com/support/installing/how-do-i-install-fonts-on-my-mac

http://www.fontspring.com/support/installing/how-do-i-install-fonts-on-my-windows-pc

http://www.fontspring.com/support/installing/how-do-i-install-fonts-on-my-windows-pc


Contents• Title slide• Contents• Using this template

• Intro• Inserting slide & applying layout• Layouts• Fonts• Colors

• Code Slide• Call to Action Slide• Safe Harbor Statement

53

• Logos and clip art• Logos• Event logos and icons• Project icons• Tool suite icons• General icons

• Table and Charts• Pie chart• Bar chart• Line chart• Table


USING THIS TEMPLATE

54


IntroThis template has been carefully prepared with specific layouts, colors, fonts and more. This short intro will outline the basic components of this template.

Note: This template includes slides with approved color palette, fonts, logos and clip art. It’s a good idea to keep these slides in order to quickly access these assets then delete the slides when you have finished creating your presentation.

55


Inserting New Slides and Applying Layouts• To create different types of slides, select New Slide and apply desired Layout• If you make formatting changes to a slide and want to reapply the default

settings, click Reset

56


LayoutsThere are 13 layouts• Title Only – Standard slide with no text content box, do not use for section title• Title and Content (1 Col) – Standard slide with title and text content box• Title and Content (2 Col) – Standard slide with title and two text content boxes• Comparison – Standard slide with title and two text content boxes with subtitles• Section Title – Use between sections• No text• Table – Quick and easy way to get a table with brand colors• Bar Chart – Quick and easy way to get a bar chart with brand colors• Line Chart – Quick and easy way to get a line chart with brand colors• Pie Chart – Quick and easy way to get a pie chart with brand colors• Code Formatting – Quick and easy way to get preferred code formatting• Title Slide – Presentation title with author name and contact info. Use only once in presentation.• Completely blank – A totally blank, white slide. Use sparingly.

57


Title Proxima Nova Bold (30pt)• All body text is Proxima Nova Regular• Subhead (18pt)

• Level Two (18pt)o Level Three (18pt)

o Level Four (18pt)• Line spacing is set in master slides

58


Brand Colors

59

R: 241G: 241B: 241

R: 153G: 153B: 153

R: 109G: 179B: 63

Spring Brand Colors

R: 52G: 48B: 45

SpringOne 2GX 2015 Theme Colors

R: 83G: 83 B: 83

R: 12G: 48B: 100

R: 156G: 209B: 121

R: 204G: 204 B: 204

R: 38G: 97B: 168

R: 114G: 163B: 211


Code Slide

60

// This is Arial: 18 pt or higher please public class TransferServiceImpl implements TransferService { public TransferServiceImpl(AccountRepository ar) { this.accountRepository = ar; } … }


<Your CTA>

<Related Session>

Learn More. Stay Connected.

@springcentral Spring.io/video


Safe Harbor StatementThe following is intended to outline the general direction of Pivotal's offerings. It is intended for information purposes only and may not be incorporated into any contract. Any information regarding pre-release of Pivotal offerings, future updates or other planned modifications is subject to ongoing evaluation by Pivotal and is subject to change. This information is provided without warranty or any kind, express or implied, and is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions regarding Pivotal's offerings. These purchasing decisions should only be based on features currently available. The development, release, and timing of any features or functionality described for Pivotal's offerings in this presentation remain at the sole discretion of Pivotal. Pivotal has no obligation to update forward looking information in this presentation.

62

If you are a pivotal employee and your talk contains forward facing information, please include this slide at the beginning or conclusion of the presentation.

Remove this text box before presenting.


LOGOS & ICONS

63


Logos

64


Event Logos and Icons

65

Logo on dark Logo on light Date logo on dark Date logo on light


Spring Project Icons

66

SpringFramework

SpringSecurity

SpringData

SpringBatch

SpringIntegration

SpringReactor

SpringAMQP

SpringHateoas

SpringMobile

SpringAndroid

SpringSocial

Groovy SpringWeb Services

SpringWeb Flow

SpringXD

SpringBoot

SpringLDAP

Grails

PNG and PSD files for all Spring projects can be found here…https://www.dropbox.com/sh/5rbbt8v6evvm7xm/AAAZmhgf0zglGHZUWYhPvojFa?dl=0


Spring Tool Suite Icons

67

Spring Tool Suite Groovy / Grails Tool Suite


Spring Document Icons

68

Spring Framework ToolsSupport

Guides Reference AppTutorials


Additional Spring Icons

69

ContinuousIntegration

Metrics Forums /Discussion

Blog @Issues

All Author Broadcast Date NewsEvent

Releases Apple LinuxEngineering Windows

ProfessionalSupport

CommunitySupport Location


Icon Guidelines• These icons can be used when

Spring icons are not appropriate.• Max icon size is 2.08 inches –

anything larger and the icon will be blurry

• Icons are transparent and can be placed over images and other objects

• To use an icon, simply choose, copy and paste

• 200x200 PNG files can be found here…https://www.dropbox.com/sh/wy65b4l5t4fv9b4/AAD1LMHcOtwJSTbNu23zqywka?dl=0

70

Max icon size:2.08 inches

https://www.dropbox.com/sh/wy65b4l5t4fv9b4/AAD1LMHcOtwJSTbNu23zqywka?dl=0




CHARTS & TABLES

73


Sample Pie Chart

74

1st Qtr2nd Qtr3rd Qtr4th Qtr


Sample Bar Chart

75

0

23

45

68

90

1st Qtr 2nd Qtr 3rd Qtr 4th Qtr

NorthSouthEastWest


Sample Line Chart

76

0

23

45

68

90

1st Qtr 2nd Qtr 3rd Qtr 4th Qtr

NorthSouthEastWest


Sample Table

77

2007 2008 2009 2010

Category 1 2.4 6.4 4.1 6.6

Category 2 8.2 4.5 3.2 3.8

Category 3 4.6 3.2 1.9 9.6

Category 4 6.7 3.3 3.4 2.2

Category 5 4.3 5.6 7.1 3.4

Technology

Spring Data Rest - Data Meets Hypermedia + Security