KeePass - Secure password and data storage

For a while I have wanted some form of secure password and data storage and I came across KeePass.

This tool appears to do everything I want.

I can run it standalone from a USB device without installing any software or registry changes on the PC.

I can store passwords as well as custom information.

There is a wealth of plugins for things like backups and browser integration.

And its free.

org.hibernate.DuplicateMappingException and tomcat

There are probably many reasons why you might get a DuplicateMappingException from an application using hibernate. Not least because you have a mapping defined twice.

However I have just found this reason and it is new to me.

In the tomcat logs I found this:

Caused by: org.hibernate.DuplicateMappingException: Duplicate class/entity mapping uk.co.formfill.dfcommon.domain.dfwv.Action
at org.hibernate.cfg.Mappings.addClass(Mappings.java:118)
at org.hibernate.cfg.HbmBinder.bindRoot(HbmBinder.java:154)
at org.hibernate.cfg.Configuration.add(Configuration.java:386)
at org.hibernate.cfg.Configuration.addInputStream(Configuration.java:427)
at org.hibernate.cfg.Configuration.addFile(Configuration.java:267)

Looking further up the tomcat logs to just before the first Exception stack trace there was this:

17-03-2009 10:44:22 [Thread-1] INFO  - Reading mappings from file: D:\apache-tomcat-6.0.14\work\Catalina\localhost\dfweb\loader\uk\co\formfill\dfcommon\hibernate\mappings\dfwv\actions.hbm.xml
17-03-2009 10:44:22 [Thread-1] INFO  - duplicate import: uk.co.formfill.dfcommon.domain.dfwv.Action->uk.co.formfill.dfcommon.domain.dfwv.Action
17-03-2009 10:44:22 [Thread-1] INFO  - duplicate import: uk.co.formfill.dfcommon.domain.dfwv.Action->Action
17-03-2009 10:44:22 [Thread-1] INFO  - Mapping class: uk.co.formfill.dfcommon.domain.dfwv.Action -> ACTIONS

So I looked in D:\apache-tomcat-6.0.14\work\Catalina\localhost\dfweb and that was empty. Strange.

The same war worked fine on a different installation and the cause was in the tomcat configuration.

The offending line was in tomcat's context.xml with the problem being the overriding of the antiJARLocking property which had been done beacuse of some historical apps..

<Context antiJARLocking="true">

Removing this and all is fine. Looking at the tomcat documentation I can not see why this problem might occurr but hey ho, it is fixed.

Pretty printing Java classpaths using Ant's pathconvert task

This is a blatent reproduction from a friend of mines blog Andrew Beacock for two reasons.

1. I can never find it.
2. A kind sole by the name of Remke provided a very nice enhancement using a macro

Here is the echopath macro

<!-- = = = = = = = = = = = = = = = = =
macrodef: echopath
= = = = = = = = = = = = = = = = = -->
<macrodef name="echopath">
    <attribute name="pathid" />
    <sequential>
    <property name="line.pathprefix" value="| |-- " />
    <!-- get given path in a printable form -->
    <pathconvert pathsep="${line.separator}${line.pathprefix}"
        property="echo.@{pathid}" refid="@{pathid}">
    </pathconvert>
    <echo>
Path @{pathid}
${line.pathprefix}${echo.@{pathid}}
    </echo>
    </sequential>
</macrodef>

Call the macro like this:

<path id="quick_test_classpath">
    <path refid="test.classpath" />
    <pathelement location="${instrumented.classes.dir.dev}"/>
    <pathelement location ="${classes.dir.dev}" />
    <pathelement location ="${test.config.dir.dev}" />
    <pathelement location ="${dfcommon.dir.dev}" />
</path>

<target name="display_my_classpath" >
    <echopath pathid="quick_test_classpath"/>
</target>

This will produce some output like:

[echo]
[echo] Path quick_test_classpath
[echo] | |-- C:\projects\foo\bar\test\lib\ant-junit.jar
[echo] | |-- C:\projects\foo\bar\test\lib\dbunit-2.3.0.jar
[echo] | |-- C:\projects\foo\bar\WebRoot\WEB-INF\lib\commons-beanutils.jar
[echo] | |-- C:\projects\foo\bar\WebRoot\WEB-INF\lib\commons-codec-1.3.jar
[echo] | |-- C:\projects\foo\bar\WebRoot\WEB-INF\lib\commons-collections-3.2.1.jar
[echo] | |-- C:\projects\foo\bar\WebRoot\WEB-INF\lib\commons-dbcp-1.2.1.jar
[echo]   

Andrew's original bog post can be found here

NTLM Authentication and the IE Post Problem

We are using NTLM Windows Authentication for a Single Sign On (SSO) project.

We are using the Spring security Filter NtlmProcessingFilter which for most of the time is absolutely fine.

However the are atleast two scenarios where this fails.

1) When the session is timed out and a form.submit() request is made.
Under this situation a windows logon box is presented. This is obviously not desirable in a SSO project.

2) If the page makes heavy use of dwr/javascript.
In this case the page makes repeated NTLM authentication requests and stack traces are observed with the message 'This is not a Type 3 Message'.

There is a solution described in the jcifs documentation. Search for registry key. This solution works but is not suitable for us as our client would not let us change the registry on all the client PCs. Quite understandably I think.

The fix described here applies to Spring-Security 2.0.4 and jcifs 1.2.25 but is also required for jcifs to atleast 1.3.3

Both Spring-Security and jcifs have an NTLMFilter and it is to this that the fix is required.

Here is the Spring solution to org.springframework.security.ui.ntlm.NtlmProcessingFilter:

protected void doFilterHttp(final HttpServletRequest request,
 final HttpServletResponse response, final FilterChain chain)
 throws IOException, ServletException {
final HttpSession session = request.getSession();
Integer ntlmState = (Integer) session.getAttribute(STATE_ATTR);

final String authMessage = request.getHeader("Authorization");

// Check the special IE POST request with Authorization header containing
// type-1 message (see method javadoc)
if (this.reAuthOnIEPost(request)) {
 if ((authMessage != null) && (authMessage.startsWith("NTLM "))) {
   logger.debug("POST Request with NTLM Authorization detected.");
   // decode the NTLM response from the client
   byte[] src = Base64.decode(authMessage.substring(5));
   // see if a type 1 message was sent by the client
   if (src[8] == 1) {
     logger
         .debug("NTLM Authorization header contains type-1 message. Sending fake response just to pass this stage...");
     Type1Message type1 = new Type1Message(src);
     // respond with a type 2 message, where the challenge is null since we
     // don't
     // care about the server response (type-3 message) since we're already
     // authenticated
     // (This is just a by-pass - see method javadoc)
     Type2Message type2 = new Type2Message(type1, new byte[8], null);
     String msg = Base64.encode(type2.toByteArray());
     response.setHeader("WWW-Authenticate", "NTLM " + msg);
     response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
     response.setContentLength(0);
     response.flushBuffer();
   }
 }
} else {
..... existing filter code
}
chain.doFilter(request, response);
}

The fix for jcifs appears to be very similar and thanks to Asaf Mesika off the jcifs forum for his help. NB: I have not tried this jcifs solution. For jcifs the fix is to jcifs.http.NtlmHttpFilter:

protected NtlmPasswordAuthentication negotiate( HttpServletRequest req,
             HttpServletResponse resp,
             boolean skipAuthentication ) throws IOException, ServletException {
     UniAddress dc;
     String msg;
     NtlmPasswordAuthentication ntlm = null;
     msg = req.getHeader( "Authorization" );
     boolean offerBasic = enableBasic && (insecureBasic || req.isSecure());

// Check the special POST request with Authorization header containing type-1 message (see method javadoc)
     if (request.getMethod().equalsIgnoreCase("POST")) {
         String authorization = request.getHeader( "Authorization" );
         if ( (authorization != null) && (authorization.startsWith("NTLM ")) ) {
             logger.debug("POST Request with NTLM Authorization detected.");
             // decode the NTLM response from the client
             byte[] src = Base64.decode(authorization.substring(5));
             // see if a type 1 message was sent by the client
             if (src[8] == 1) {
                 logger.debug("NTLM Authorization header contains type-1 message. Sending fake response just to pass this stage...");
                 Type1Message type1 = new Type1Message(src);
                 // respond with a type 2 message, where the challenge is null since we don't
                 // care about the server response (type-3 message) since we're already authenticated
                 // (This is just a by-pass - see method javadoc)
                 Type2Message type2 = new Type2Message(type1, new byte[8], null);
                 String msg = Base64.encode(type2.toByteArray());
                 response.setHeader("WWW-Authenticate", "NTLM " + msg);
                 response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                 response.setContentLength(0);
                 response.flushBuffer();
                 return false;
             }
         }
     }

... existing filter code ....
 }

I have raised a spring-security bug if you want to see if it is fixed in the version you have.

Garmin Forerunner - Pairing extra devices

With my new Garmin Forerunner 50 I also got the GSC 10 cycle speed & cadence sensor.

I really struggled to pair this extra device. I followed the instructions, changed batteries etc with no luck. It flatly refused to see the sensor.

After much hunting I discoverred the Garmin FAQ. This said to try riding the bike at the same time. IE wake up the sensor while pairing is happening.

A simpler solution was to wave the magnet near the sensor. Bingo. it is now all paired up.

Garmin Forerunner ANT Agent and running XP exe's on Vista

Lucky me, I received a Garmin Forerunner 50 heart rate monitor for christmas.

Incidently it was bought off amazon which is selling it an an amazing price.

The Forerunner series have the excellent capability of uploading your heart and distance data to garmin.com.

This is done by a wireless dongle and some software called ANT Agent. However this is an Windows XP executable and would not run. Many people appear to have struggled with this but the solution is quite easy and I found how here. This is presumably true for many other XP executables.

In case the link does not work this is what you have to do:
1. right click the ANT Agent executable you have just downloaded.
2. choose Properties
3. Navigate to the Compatibility tab
4. Set the Compatibility mode to Windows XP (Service Pack 2)
5. Click OK to save the settings
6. Run the exe and all should be OK

Spring source for minor spring projects and many others !

A while ago I struggled to find a Spring security test class TestingAuthenticationToken following an upgrade to spring-security from acegi.

Turned out it had been moved out of the standard release causing my tests to fail with a ClassNotFoundException. You will find it in spring-security-core-x.y.z-tests.jar for the relevant version.

Similarly, I wanted to see the source for a test class
org.springframework.test.AbstractTransactionalDataSourceSpringContextTests. This again can found on the same site as can the source for all spring modules. The root for spring modules is here.

Being more nosey you will find the source for may other projects (such as apache, eclipse, dbunit) by navigating further up the tree. Happy hunting.