Tag - authentication - Synopse Open Source

2012-03-07

Interface based services - Server side

By AB4327-GANDI, 2012-03-07. Open Source › mORMot Framework

In order to have an operating service, you'll need to implement a Delphi class which matches the expected interface.

Interface based services - defining a data contract

By AB4327-GANDI, 2012-03-07. Open Source › mORMot Framework

In a Service Oriented Architecture, services tend to create a huge list of operations.
In order to facilitate implementation and maintenance, operations shall be grouped within common services.

The data contract is to be defined as a plain Delphi interface type.
In fact, the sample type as stated in a previous blog article can be used directly:

type
  ICalculator = interface(IInvokable)
    ['{9A60C8ED-CEB2-4E09-87D4-4A16F496E5FE}']
    /// add two signed 32 bit integers
    function Add(n1,n2: integer): integer;
  end;

This ICalculator.Add method will define one "Add" operation, under the "ICalculator" service (which will be named internally 'Calculator' by convention).
This operation will expect two numbers as input, and then return the sum of those numbers.

Interface based services

By AB4327-GANDI, 2012-03-07. Open Source › mORMot Framework

The Client-Server services via methods implementation (our DataSnap-like feature) gives full access to the lowest-level of the mORMot's core, so it has some advantages:
- It can be tuned to fit any purpose (such as retrieving or returning some HTML or binary data, or modifying the HTTP headers on the fly);
- It is integrated into the RESTful URI model, so it can be related to any table/class of our ORM framework (like DataAsHex service above), or it can handle any remote query (e.g. any AJAX or SOAP requests);
- It has a very low performance overhead, so can be used to reduce server workload for some common tasks.

But this implementation pattern has some drawbacks:
- Most content marshaling is to be done by hand, so may introduce implementation issues;
- Client and server side code does not have the same implementation pattern, so you will have to code explicitly data marshaling twice, for both client and server;
- The services do not have any hierarchy, and are listed as a plain list, which is not very convenient;
- It is difficult to synchronize several service calls within a single context, e.g. when a workflow is to be handled during the application process (you have to code some kind of state machine on both sides);
- Security is handled globally for the user, or should be checked by hand in the implementation method (using the aParams.Context values).

You can get rid of those limitations with the interface-based service implementation of mORMot. For a detailed introduction and best practice guide to SOA, you can consult this "classic" article.

According to this document, all expected SOA features are now available in the current implementation of the mORMot framework (including service catalog aka "broker").

2012-02-06

Modification of TSQLRestServerCallBack method prototype (bis)

By AB4327-GANDI, 2012-02-06. Open Source › mORMot Framework

In order to implement some RESTful Services, a callback has to be defined on the server side.

The prototype of these methods has been modified one more time, to supply an unique parameter:
This is a CODE BREAK change and you shall refresh ALL your server-side code to match the new signature.

This unique parameter will let the signature remain untouched in your code implementation, even if the framework evolves (like adding a new parameter).

2011-12-30

Hash collision attack

By AB4327-GANDI, 2011-12-30. Open Source › mORMot Framework

A variety of programming languages suffer from a denial-of-service (DoS) condition against storage functions of key/value pairs in hash data structures, the condition can be leveraged by exploiting predictable collisions in the underlying hashing algorithms.

The issue finds particular exposure in web server applications and/or frameworks. In particular, the lack of sufficient limits for the number of parameters in POST requests in conjunction with the predictable collision properties in the hashing functions of the underlying languages can render web applications vulnerable to the DoS condition. The attacker, using specially crafted HTTP requests, can lead to a 100% of CPU usage which can last up to several hours depending on the targeted application and server performance, the amplification effect is considerable and requires little bandwidth and time on the attacker side.

Source: #2011-003 multiple implementations denial-of-service via hash algorithm collision

2011-11-30

AJAX authentication

By AB4327-GANDI, 2011-11-30. Open Source › mORMot Framework

A nice framework user, named esmondb, did write and publish some JavaScript code to handle our RESTful authentication mechanism.

It seems to work well, and implements all secure hashing and challenging.
Our authentication mechanism is much more advanced than the one used by DataSnap - which is a basic HTTP authentication with the password transmitted in clear (this is the reason why it shall better be used over HTTPS, whereas mORMot can be used over plain HTTP).
Resulting JavaScript code seems not difficult to follow, even for a no JS expert like me.

2011-09-01

DataSnap-like Client-Server JSON RESTful Services in Delphi 6-XE5

By AB4327-GANDI, 2011-09-01. Open Source › mORMot Framework

Article update:
The server side call back signature changed since this article was first published in 2010.
Please refer to the documentation or this forum article and associated commit.
The article was totally rewritten to reflect the enhancements.
And do not forget to see mORMot's interface-based services!

Note that the main difference with previous implementation is the signature of the service implementation event, which should be now exactly:
procedure MyService(Ctxt: TSQLRestServerURIContext);
(note that there is one unique class parameter, with no var specifier)
Please update your code if you are using method-based services!

You certainly knows about the new DataSnap Client-Server features, based on JSON, introduced in Delphi 2010.
http://docwiki.embarcadero.com/RADStudi … plications

We added such communication in our mORmot Framework, in a KISS (i.e. simple) way: no expert, no new unit or new class. Just add a published method Server-side, then use easy functions about JSON or URL-parameters to get the request encoded and decoded as expected, on Client-side.

no trackbacks

2011-07-25

Close future of the framework: database agnosticism

By AB4327-GANDI, 2011-07-25. Open Source › mORMot Framework

Our ORM RESTful Framework is about to access any available database engine.

It will probably change its name (since it won't use only SQlite3 as database), to become mORMot - could be an acronym for "Manage Object Relational Mapping Over Tables", or whatever you may think of...

We'll still rely on SQLite3 on the server, but a dedicated mechanism will allow to access via OleDB any remote database, and mix those tables content with the native ORM tables of the framework. A flexible Virtual Tables and column mapping will allow any possible architecture: either a new project in pure ORM, either a project relying on an existing database with its own table layout.

2011-06-05

Synopse SQLite3 Framework 1.13

By AB4327-GANDI, 2011-06-05. Open Source › mORMot Framework

This is a major step for the framework.

Among a lot of new features and bug fixes:

Dynamic arrays and Record handling, including low-level access and high-level handling for the ORM part of the framework (using TDynArray wrapper);
Business rules now handled via filtering and validating classes for both our ORM and the Synopse Big Table;
New full-featured logging classes, with exception handling, stack trace and JSON serialization;
Custom SQL functions and TSQLRecordRTree to implement R-Tree virtual tables;
Batch sequences for adding/updating/deleting multiple records;
Secure RESTful authentication via per-user light sessions, and per-query signature;
Define custom Virtual Tables (i.e. access any kind of data from SQL) in Delphi code;
New HTTP server using fast http.sys kernel-mode server and zip / SynLZ compression;
SynTaskDialog unit native under Vista,Seven with emulation code under XP/2000 ;
User Interface automated Generation using standard VCL or proprietary TMS components;
Documentation completed - more than 600 pages by now, including general User Guide and exhaustive Technical Reference;
Updated SQLite3 database engine to version 3.7.6.3;
Numerous bug fixes, speed and feature enhancements (including in the PDF and other UI-related units).

Open Source project, for Delphi 6 up to XE, licensed under a MPL/LGPL/GPL tri-license.

2011-05-24

How to implement RESTful authentication

By AB4327-GANDI, 2011-05-24. Open Source › mORMot Framework

How to handle authentication in a RESTful Client-Server architecture is a matter of debate.

Commonly, it can be achieved, in the SOA over HTTP world via:
- HTTP basic auth over HTTPS;
- Cookies and session management;
- Query Authentication with additional signature parameters.

We'll have to adapt, or even better mix those techniques, to match our framework architecture at best.

Each authentication scheme has its own PROs and CONs, depending on the purpose of your security policy and software architecture.

no trackbacks