Rochak Chauhan::Unpredictably Exciting » Java

PHP vs JSP

rochakchauhan — Thu, 25 Sep 2008 14:17:48 +0000

In my opinion, developing a Web based application in JSP (Java) is more or less like killing a housefly with a bazooka. Of course you will hit your target, no one is denying that, but you will also have collateral damage along with it. This damage ranges from Cost of hardware, hosting, servers and development. Not to mention the time taken to develop, edit or modify the application.

But, that’s just me, I’ll let you to decide and let me know after going through these factors.

SNO	Function / Feature	JSP	PHP
1.	Programming Approach	1. Completely Object Oriented Advantage: · Clean code Disadvantage: · Way too descriptive	1. Mainly a Scripting Language 2. It can also be used in OOPS from PHP 5 and above. Advantage: · Functional and quick coding, you can use OOP practices at your convenience Disadvantage: · May get clumsy
2.	String and data manipulation	Rich library, too much descriptive and object oriented code	Rich functionality. Functional and easy coding. Has inbuilt support to use third party libraries from other programming languages like Java, C and Dot.net
3.	Web Oriented features Includes Mails File Uploads Form Handling Sessions	Advantage: · Almost everything is built in or supported by libraries. Disadvantage: · Complicated and way too much of code.	Advantages: · Inbuilt functionality and easy to use functions, written for the specific tasks · Reduces the lines of code and time taken to write an application.
4.	Database Access features	Standard JDBC structure/ Use EJB/ Struts framework built over JDBC. Descriptive and too much overhead or boiler plate code involved. Uses the same API for all databases using JDBC drivers	Dedicated inbuilt libraries for most of the commonly used databases. Very tight integration with Oracle, MySQL and PostGRE SQL. Very minimal boiler plate code required. The libraries and results are straight forward, robust and easy to use.
5.	XML/XSL/XPATH	Use standard SAX/DOM parsers. Too much boiler plate code involved. Well defined APIs and stable implementations are available for XSL and XPATH	SAX and DOM parsers available are easy to use and to the point. Another library, Simple XML provides very easy OO approach to handling XML data. XSL and XPATH functionality is also built in.
6.	Extensibility	Java Classes and Libraries. Run’s in sandbox and hard JNI approach needed to integrate with server programs.	PHP/C/Any thing executable by the underlying OS platform. Can very easily interact with programs on the server. Very good support for native code.
7.	Dynamic Graphics/PDF and bells and whistles	Almost everything has a readymade library	Supported internally or though libraries.
8.	Web Services/SOAP	Addon Libraries like Axis, JAX-WS, etc.	In Built
9.	Portals	Spec JSR-168 and 286	Many different Portal frameworks
10.	Learning curve	It helps if you have an decent understanding of JAVA and its architecture.	If you know C/C++, then you are halfway through to learn PHP.
11.	Support	It has support and backing of Industry giants like Sun and IBM.	It enjoys the backing of Oracle, Sun, IBM, Microsoft and Zend.
12.	Hardware cost and requirement.	Well this is one factor which makes PHP a favourite. The cost of procuring a server is exponentially higher than that of getting PHP server up and running.	Cost of hosting a small and medium scale PHP application start from as low as $9 per month. For a decent enterprise level application server with an enterprise PHP framework, the cost would come out to be around $50 per month.

Sample Codes for comparison

_1._{Hello World}

_JSP

_PHP

_{JSP — Hello World!}

_{<% out.println(” Hello World”); %> !}

_{PHP — Hello World!}

_2._{Print Date as DD/MM/YYYY}

_JSP

_PHP

_{JSP – Print date}

_<%

_{java.util.Calendar cal =java.util.Calendar.getInstance();}

_out.println(

_{new SimpleDateFormat(“dd/MM/yyyy).format(cal.getTime()?)}

_);

_%>

_{PHP – Print Date}

_3._{Read / Write session variable}

_JSP

_PHP

_{JSP – Session Read/Write}

_<%

_{//Get current session or create a new session}

_{HtppSession session = request.getSession(true);}

_{//Add information to the session}

_{session.setAttribute(“name”, “Pramati”);}

_{//Print the information}

_{out.println(session.getAttribute(“name”);}

_%>

_{PHP – Session Read/Write}

_{//Get current session or create a new session}

_{session_start();}

_{//Add information to the session}

_{$_SESSION['name']= “Pramati”;}

_{//Print the information}

_{echo $_SESSION['name'];}

_?>

_4.

_a._{File Uploading – Form}

_JSP

_PHP

_{JSP – File upload form}

_{action=”ProcessFileUpload.jsp” method=”post” enctype=”multipart/form-data”>}

_{File 1:}

_{Please Note: No in-built support for file uploading in JSP. You have to rely on external libraries. This example uses Apache’s commons-upload lib.}

_{PHP – File upload form}

_{action=”ProcessFileUpload.php” method=”post” enctype=”multipart/form-data”>}

_{File 1:}

_4.

_b._{File Uploading – Backend Code}

_JSP

_PHP

_{Code for ProcessFileUpload.jsp}

_<%

_{if(ServletFileUpload.isMultipartContent(request))}_?

_{FileItemFactory f = new DiskFileItemFactory();}

_{ServletFileUpload upload = new ServletFileUpload(f);}

_{List items = upload.parseRequest(request);}

_{Iterator itemsIter = items.getIterator();}

_{if(iter.hasNext())}_?

_{File uploadedFile = new File(item.getName());}

_{item.write(uploadedFile);}

_%>

_{Please Note: No in-built support for file uploading in JSP. You have to rely on external libraries. This example uses Apache’s commons-upload lib.}

_{Code for ProcessFileUpload.php}

_{if ($_FILES["file"]["error"] > 0)}_?

_{echo “Error: ” . $_FILES["file"]["error"];}

_else

_{move_uploaded_file(}

_{$_FILES["file"]["tmp_name"],}

_{“upload/” . $_FILES["file"]["name"]);}

_?>

_5._{Connect to the Database (MySql)}

_JSP

_PHP

_{<%@ page import=”java.sql.*” %>}

_<%

_{Connetion conn = null;}

_{java.sql.Connection conn= null;}

_{Statement st = null;}

_{ResultSet rs = null;}

_{try {}

_{Class.forName(“com.mysql.jdbc.Driver”).newInstance();}

_{Class.forName(“org.gjt.mm.mysql.Driver”).newInstance();}

_{conn = DriverManager.getConnection( “jdbc:mysql://localhost/jsp?user=xxx&password=xxx”);}

_{st = conn.createStatement();}

_{// connection made….

}}

_{$dbserver=”locations”;}

_{$username=”username”;

$password=”password”;

$database=”your_database”;}

_{mysql_connect($dbserver,$username,$password);

@mysql_select_db($database) or die( “Unable to select database”);}

_//connection_made…

_?>

Sun’s Web Stack Offers Choice of Operating Systems

rochakchauhan — Thu, 24 Jul 2008 04:09:40 +0000

Sun showed off its Web Stack on Tuesday, as its name indicates, the stack includes technology used to run Web sites and Web applications. It is based on the AMP portion of the LAMP stack (Linux, Apache, MySQL, Perl/Python/PHP), but users will have a choice of operating systems: Sun’s Solaris, Linux, Windows or other operating systems. The story says Sun will provide support for Solaris starting this quarter, for Linux starting next quarter, and for Windows and others starting later in the year.Let’s be honest — we knew this was coming as soon as Sun acquired MySQL, right? Except at that point, I thought it would be strictly a MAPS stack (MySQL, Apache, Perl/Python/PHP, Solaris). Maybe the Linux Foundation’s reaction to that idea wasn’t the only one that was adverse.

Whatever the motivation to offer multiple operating systems, it looks like Sun is focusing on working with rather than excluding other platforms, just like Canonical’s Mark Shuttleworth encouraged Linux developers to do when working on Linux desktop.

Sun plans JavaFX for the desktop

rochakchauhan — Fri, 09 May 2008 03:29:21 +0000

Sun Microsystems (NSDQ: JAVA) has a long ways to go before it steps up to compete with Adobe Systems (NSDQ: ADBE) Flash or AJAX or even Microsoft (NSDQ: MSFT) Silverlight in building Web 2.0 applications. But it clearly has that goal in mind as it works on producing a version of JavaFX for the desktop, which it seeks to launch this fall.Sun’s Param Singh, senior director of Java marketing and veteran executive of Apple’s Multimedia Group, filled in some of the gaps in the information available on JavaFX in an interview Wednesday, the second day of Sun’s 13th annual user group, JavaOne, in San Francisco.

JavaFX first and foremost will be a scripting language like Adobe’s ActionScript, which allows programming to be run in the Flash Player. Likewise, JavaFX will serve the same function as JavaScript, used to power the interactive user applications in the browser window built with Ajax.

JavaFX also will have a timeline sequence engine, something like the one pioneered by Adobe’s Flash, that will allow animations and coordination of a multimedia sound and video roll out.

But even more important, perhaps, JavaFX is a bid by Sun to coordinate powerful back-end programming on a multiprocessor server with an engaging and rich presentation for the end user. All three — Sun, Adobe, and Microsoft — still have issues in pulling together the power of the Internet server and the presentation to the user. Think of the difference between bumping your way through Web pages versus the enveloping action of a computer game. Sun thinks it’s going to win the arms race to coordinate the two.

Sun expects to give developers the option of producing user interfaces for Web applications that run inside the browser window, or outside on the user’s normal computer desktop work space. It can do this because it will have a plug-in for the browser that updates the Java Virtual Machine, resident on many PCs. That JavaFX runtime exists in Java Standard Edition 6, update 10, and will gradually be added to existing Java Virtual Machines through an automated update process, Singh said.

At the same time, JavaFX applications will have the ability to migrate out of the browser window. The icon for a JavaFX application, once it’s been downloaded, can be moved onto the user’s desktop and run there through the usual drag-and-drop method. The application, unlike most that are streamed down to the browser, can be either run while connected to the Internet or stored and saved as a permanent addition, available to run when the user is disconnected. Online application suppliers have been struggling with that issue — what to do when the user is no long plugged into the Net.

But there’s still the issue of simplicity of application building. “Designers for end-user interfaces want to assemble content, not program it. We start from a strength among programmers, but we will produce incremental tools that allow designers to make the front end more enticing. We need to bring both of these communities together,” Singh said.

Exactly how that “bringing together” will proceed will await the first software development kit Sun can produce for FX this fall. Will it also be able to produce “assembly oriented” content tools, the way Adobe has?

In a demonstration Tuesday that needed to be restarted twice, Sun illustrated a mashup JavaFX application. A user’s collection of Facebook and Flickr pictures were loaded into the application, then a sophisticated flocking algorithm applied. If the user entered a person’s name, all the pictures with that person in them began to flock together out of a slowly moving mass on the screen. Pictures with similar colors could be enticed to flock together, etc. It was a combination of programming and presentation that many in the audience hadn’t seen before.

Whether they will see it on their own computers will depend on how fast Sun can deliver the goods and whether they will be able to perform as expected.

“We are focused on strengthening the designer/developer integration,” claimed Singh. The flocking demo illustrated Sun’s programming skills. The scripting code behind it had been compiled and could run fast enough in the Java Virtual Machine to keep everything in motion. Most scripting or “dynamic” languages wouldn’t have been equal to the feat; they must go through an interpreter, and interpreted code is slower than compiled code.

As Sun produces JavaFX for the desktop, it hopes to capitalize on its capabilities by following up with JavaFX for mobile devices in the spring of 2009. Java already has a strong presence in the cell phone and mobile device market.Nokia (NYSE: NOK) representatives say more than half of all their phones — not just their smartphones but all their mobile device inventory — run Java now. If JavaFX gets a toehold on the desktop, Sun may outsprint the competition in offering capabilities for rich Internet applications on mobile devices.

If advertising, for example, could be inserted into an Internet server’s response to a user, based on what that user wanted to do with a running application, such coordination might yield competitive advantage. It already can be done in various clunky Internet applications, but that’s not the point. The point, said Singh, is “how seamlessly all the pieces can be overlaid with each other.”

Zend PHP Framework is now powered by Google and Microsoft

rochakchauhan — Mon, 17 Mar 2008 04:23:55 +0000

It’s no longer just a .NET or Java world when it comes to production-quality development frameworks — PHP is edging its way into developers’ affections. Now, the technology’s backers are planning further efforts to expand on its successes.

Zend, PHP’s lead commercial sponsor, plans Monday to release its eponymous Framework 1.5, the first major release since 1.0 debuted last year.

The launch will build on the framework’s significant momentum to date. According to Zend, the framework has had over four million downloads.

Additionally, the Zend Framework has received votes of confidence in the form of contributions from and joint development with major vendors like Microsoft, IBM, Fox Interactive Media and Google.

Building on those relationships, a marquee feature in the 1.5 release will be full support for Google’s newly announced YouTube APIs.

“Google has people that are actively contributing to Zend Framework,” Andi Gutmans, Zend’s CTO, told InternetNews.com. “As part of their rollout plans for the YouTube APIs, Zend Framework was a very important part because of the broad reach of the PHP community.”

“There was work going on behind the scenes before their announcement to make sure it all worked together,” Gutmans added.

The new release will also give a boost to Ajax support (define), with infrastructure improvements to handle Ajax requests as well as coding autocomplete, shortcut and form support features.

Gutmans said he expects the next version of Zend Framework will provide even better Ajax support with tighter integration for Ajax toolkits like Dojo.

The launch will build on burgeoning interest and support for the Zend Framework, which began in earnest in October 2005. The framework’s first public development release appeared in March 2006.

Since then, the effort has been attracting attention from many of the big names in software development.

Google, for instance, has been contributing to the project since at least December 2006, when it first included the GData module. The module is used in most of Google’s APIs, including those for Google Calendar, Blogger Data, Google Base, Spreadsheets and Google Code Search.

Google archrival Microsoft has also lent a hand to the PHP effort so that the company’s InfoCard identity technology will work with the framework.

Most recently, Zend’s active partnership with Microsoft led to PHP being certified for use on Windows Server 2008.

While Zend has teamed with the software giant for core PHP support in Windows, other potential areas of collaboration remain untapped, however. For example, the two are not currently working integrating Microsoft .NET into the framework.

Gutmans said that some customers have asked about such integration, but the two companies remain in a “discovery phase” for the moment.

With support from large players like Google and Microsoft, it’s not surprising that PHP’s backers have high hopes for the near future — including potentially taking share from Java and .NET.

“Obviously, PHP is growing and over time, we are displacing other languages,” Gutmans said.

C# set to take Java’s crown as Java drops 50 percent

rochakchauhan — Tue, 11 Mar 2008 07:04:37 +0000

Using book sales as surrogate tea leaves, Mike Hendrickson of the O’Reilly Radar finds life bleak for pretty much every major programming language except C#, Javascript, and Ruby. Java? It has plunged by 50 percent since 2003.

Sun Microsystems is hedging its bets on web scripting languages, recently adding Python experts to its fold. So perhaps Sun will weather the storm. Regardless, even despite its five-year slide, Java still holds the biggest share of the book-buying market, as this chart shows:

(Credit: O’Reilly Media)

Are Java’s days numbered? O’Reilly’s data seems to suggest this:

Ruby was a small box last year and is now 8 largest language passing Perl and Python and is now knocking on the door for Visual Basic’s spot. Ruby has the second largest unit growth after C# and went from 4% overall market share to 5% and is 4k units off of displacing VB for #7 overall. C# was equally impressive with a 36,811 unit growth or 18.85% growth and went from 11% market share in 2006 to 13% market share in 2007. At the rate it is going, it should surpass Java as the number one language this year as it is only (9,526) units short and is on a positive 18.85% growth rate while Java continues its slide at a (14.16%) clip.

What is the cause of Java’s decline? I certainly see plenty of it within enterprises. Still, it’s undeniable that the Web and its dynamic programming languages is upstaging Java. Arguably, too, Java has all the benefits and downsides to being a community product (though not enough of one for some people’s tastes).

Is there a future for standalone Java applications? Of course. But is it a future that will drown in irrelevance in the wake of dynamic web languages?

What do you think?

Java increasingly threatened by new app dev frameworks

rochakchauhan — Sat, 01 Mar 2008 06:05:00 +0000

Is Java slipping into second-tier status in the application development space? All the attention being given to its rivals these days might give off that impression.

Nearly 13 years old, the Java language and platform created at Sun Microsystems now shares the software development limelight with scripting languages such as PHP (Hypertext Preprocessor) and Ruby, as well as with Microsoft’s .Net technologies.

Much touted for its ability to run on multiple platforms via the JVM (Java Virtual Machine), Java grabbed headlines for years before being seriously challenged by .Net and open source scripting variants. Today, these alternatives to Java have gained plenty of adherents. Open source CRM vendor SugarCRM, for example, chose to write its application in PHP instead of Java. “When we set out, we thought we were going to build a Java application on top of Oracle,” said Clint Oram, SugarCRM co-founder. The company, however, saw PHP maturing and found it “just more accessible than Java, for the average person,” Oram said.

Microsoft, meanwhile, has made its .Net platform a serious player in the enterprise space. A November 2007 report by Info-Tech Research Group stated the case for .Net becoming more popular than the Java platform in enterprises.

But don’t count Java out just yet.

“Everywhere you turn, Java touches something. It’s used in databases, it’s used to drive the Web [systems] of big companies like eBay,” said Rick Ross, president of the DZone developer community and founder of Javalobby, a Web community for Java developers. He also is a Java developer.

The Java industry remains very, very large, Ross said. “All of it put together is literally billions and billions of dollars,” said Ross, noting the use of Java by everyone from IBM to Oracle and its latest major acquisition, BEA Systems.

Microsoft .Net is attracting a lot of smaller developers
The Tiobe Programming Community Index, which ranks the popularity of programming languages, has Java at No. 1 for February, the same place it held a year ago. Following it are C, Visual Basic, PHP, C++, Perl, Python, and C#. Further down the list are Delphi, JavaScript, and Ruby. (Tiobe ratings are based on the worldwide availability of skilled engineers, courses, and vendors, with popular search engines used to calculate the ratings.)

Info-Tech, however, found Microsoft has a strength in its ability to offer a single soup-to-nuts stack featuring .Net, the Exchange e-mail system, and SQL Server database. “[Companies] want one throat to choke,” said George Goodall, an Info-Tech senior research analyst and author of the firm’s November report.

“We’re not particularly bullish on .Net technology over Java technology, but the difference here is that .Net for most applications is good enough,” he said.

Info-Tech sampled 1,900 companies, most of which are midmarket companies with less than $1 billion in annual revenues. The study found that 12 percent of enterprises focus exclusively on .Net as compared to 3 percent focused just on Java. Also, 49 percent center primarily on .Net, compared to 20 percent for Java.

Despite the survey’s midmarket focus, Goodall noted that even respondent companies with annual revenues exceeding $1 billion had a similar .Net preference as the midmarket respondents. Still, the survey did find that the popularity of .Net decreases very gradually as the size of enterprises increases. But Goodall cautioned that in such companies, .Net’s popularity decline did not come from an increase in Java usage, but instead from a preference for other development platforms in heterogeneous environments.

Even faced with increased competition from the likes of .Net, Java is nowhere near the end of its life, Info-Tech’s report concluded. The platform has incredibly strong allies and an immense code base. Just as user sites must tend to legacy Cobol code, so will they have to tend to a lot of Java code in the future. “[Java is] not going to disappear,” Goodall said.

Rails framework founder David Heinemeier Hansson also likened Java to Cobol. “I think Java is still relevant in the sense that languages never die. There will be systems running in Java 20 years from now,” he said, “just like there are still lots of Cobol systems around from way back when.”

New frameworks are gaining traction among developers
“Ruby, PHP, Python, and similar platforms have definitely taken a big chunk out of the Java brain trust,” said Hansson. “We have a large constituency of Rails users who are Java refugees.”

New frameworks such as PHP and Ruby on Rails indeed “have taken a huge bite out of the territory that used to belong to Java and .Net,” said Tim Bray, Sun’s director of Web technologies — emphasizing that .Net has the same issue. “I totally don’t believe, based on what I see, that .Net still has the kind of growth that it had for a few years there starting in the late 1990s.The evidence seems to show that while Java isn’t the hottest growth spot, it’s still the largest single ecosystem out there,” he added.

Hansson agrees that .Net is also threatened by new frameworks, but he noted that .Net nevertheless seems to be taking away mindshare from Java in shops predisposed to use Microsoft technology.

A program manager at a government agency, who wished to remain anonymous, said solutions such as Adobe Flex and Microsoft products are offering alternatives to Java. “On the server side, Java will always have a place in stitching things together and customizing, but to turn out nice applications quickly that are maintainable, I see the other tools starting to take over that space,” the program manager said.

Sun looks ahead to a world where Java may not be king
At Sun, CEO Jonathan Schwartz remains a staunch Java advocate but acknowledges Java is not the only contestant in the show these days. At the SugarCon 2008 conference for SugarCRM users earlier this month, Schwartz noted Sun’s Da Vinci Machine project to extend the JVM to accommodate other languages. “The intent is to say, ‘Look, Java is one language, but it is not a hammer for all nails. It happens to be a really, really good hammer,’” Schwartz said.

Bray admits that the Java language “is starting to look a little boring to the young rabble-rousers in the community,” and says the Java language is “replaceable.” However, Bray argues that the Java platform — the JVM, APIs, and libraries — is here to stay. The JVM is “insanely popular,” and the consensus is the libraries are about the best, he said.

In anticipation of a less Java-centric world, Sun is working to embrace the new technologies. Case in point is the JRuby effort to enable Ruby to run Rails applications on the Java platform, Bray said. Meanwhile, work is being done to spruce up the Java language with closures and other capabilities, he said. (Closures lets pieces of code be passed around and used elsewhere without the need to declare a subroutine.)

Rails founder Hansson agrees with Sun’s direction. “I do think the mentality of ‘Java is the answer, what was the question again?’ is gone. Even Sun realizes that now, which I think is healthy. There are lots of domains where Java is just too heavy and cumbersome an environment to dance with.”

Is PHP ready for enterprise?

rochakchauhan — Sat, 01 Mar 2008 06:02:17 +0000

It’s been an interesting few months for Zend, the commercial company behind the open source programming language PHP.

In the past few weeks, Zend has teamed up with Rackspace, a leading web hosting provider. It’s also signed an agreement with Ibuildings, an Anglo-Dutch software consultancy company, to provide training and support services in the UK. And last year, Zend partnered with Microsoft, despite the software giant offering a competing platform.

A closer look at these partnerships suggests the company – and PHP itself – may be ready for the big time.

Overcoming its roots

Partners such as Rackspace and Microsoft can help overcome one of the largest hurdles in moving into the enterprise arena: the record of PHP development and the strength of Java as the principle software language in enterprise consultancy – both of which stem back to the history of how PHP has evolved culturally within the software community.

With Java as the de facto academic choice, PHP has grown out of the “hobbyist” programmer, generally self-taught and with all of the issues that entails. Until only a few years ago, the concepts of best practice development, coding frameworks and even having a methodology were alien to the hackers of the PHP community, invariably spinning off from the Perl programmers of old.

While these developers were fine for creating the odd microsite, their lack of discipline and structure was akin to an unguided nuke on enterprise projects, while the maturity of the Java community was more like a tomahawk. And IT directors quite rightly didn’t want huge fiery ends to their projects by geniuses who had no interest in collaborating when they could enjoy all the benefits from the cool, precise child of Sun.

But now that Zend Framework, the open source scaffold for PHP development, has passed through a troublesome puberty (version one was released last year to some acclaim), and that more and more companies with web sites in PHP are adopting the procedures and practices of a “grown-up” language, does this mean that PHP is going to be seen as a realistic alternative to Java in the enterprise?

Taking on Java

With Zend’s star rising, is it enough to overcome the bias in large e-commerce firms? Zend have an uphill struggle on a cultural level: many blue-chip companies have a policy of only hiring developers with a 2:1 Computer Science degree, and the majority of UK universities are still teaching Java.

Even though both languages are object-oriented and have more then cursory similarities, does this mean that Java will continue to be the forerunner?

Vic Wyatt, business development manager for Leeds Metropolitan University, doesn’t think so. “We’ve recently signed with Zend to provide our students a worthwhile group of modules in PHP,” said Wyatt, speaking about the university’s PHP academy, which helps students learn the language as well as get commercial accreditation via the Zend Certified Engineer exam.

“Java is perceived, rightly or wrongly, as having had its day. We’re simply responding to the market, and the market is clearly picking up on PHP,” he said.

In addition, the university is working to place its students at companies using PHP. According to Wyatt, several large companies are involved, including network provider Orange. “We need to give our students opportunities that are real and meaningful,” Wyatt said.

Rackspace turns to Zend

With more partnerships, PHP-trained students will have more opportunities to take their skills to the enterprise market.

The Rackspace offering – the hosting firm is keen to stress that it isn’t a product – is a Red Hat environment running Zend Platform. This proprietary server technology provides a whole host of features for increasing performance, testing and debugging PHP applications – all key to making PHP friendlier for a business audience.

David Goulden, enterprise additions product manager for Zend, detailed the improvements the new partnership would offer for businesses. “When we initially worked together, it wasn’t synchronized,” he admitted. “We were working on a case-by-case basis [with Rackspace], with no official agreements in place. That’s all changed, and for the better of our customers.”

Doug Loewe, managing director for Rackspace in Europe, the Middle East and Asia, agreed. “We’ve been looking to expand our loose federation of partners, all of them fast-moving and able to stand shoulder to shoulder with us to provide our customers the support they want. Zend fit that criteria for us,” he said.

Zend are now training key Rackspace tech personnel in Zend Platform, and a clear vendor escalation path has been drawn up between the companies. “It’s a natural progression for us,” said Loewe. “There is a massive overlap between our customer bases.”

While Zend Platform is hardly new to the market, the acceptance of the architecture by Rackspace is an important step for Zend in moving into the enterprise market.

A bit of Microsoft maturity

There’s no stronger mark of a technology’s maturity than when Microsoft takes it seriously. Last year, Microsoft and Zend became partners to provide a better PHP offering on Windows 2003 Server – a much needed move to overcome the Unix bias of PHP’s functionality.

“We want to make it so as many developers can run on Windows as possible,” said Mark Quirk, Microsoft UK’s head of technology for development and platform. “So it made perfect sense.”

But does that mean Microsoft’s .Net and PHP can co-exist within the enterprise market? “I don’t think it changes the position of Zend in the enterprise,” said Quirk. “We’re not trying to make it work well in the enterprise or anything. ASP .Net works well in the enterprise.”

Despite the defence of Microsoft’s own programming framework, Quirk is far from belittling PHP’s inclusion on Windows Server. “Which platform would I recommend: .Net,” he said. “But as a platform provider, we want our platform to work for everyone.”

He said that making the platform better means more applications will be running on windows. “Having people run it on Windows will benefit us,” he said.

The verdict

This bodes well for the future of PHP in the enterprise, said Ivo Jansch, chief technology officer for the other recent Zend partner, Ibuildings. Jansch is currently writing a book for the well known PHP|Architect series, called Enterprise PHP Development – clearly a strong indicator of where he feels PHP will progress in the future.

Speaking before coming to the UK for the PHPLondon’08 conference, he said: “We’re seeing more and more uptake in PHP for business applications. It’s being taken more seriously.”

Referring to a recent survey by Nexen that puts PHP adoption on the Web at 33 per cent, Jansch compared the uptake of PHP in commercial applications to the rise of Linux. “We’re seeing the same pattern. There was a time when Linux was thought of as a hobby for enthusiasts only. Now look at the market. It’s the same for PHP too.”

Microsoft launches student Java and LAMP challenge

rochakchauhan — Sun, 24 Feb 2008 12:43:47 +0000

University computer science departments are rapidly becoming Microsoft-free zones, as Linux, Apache, MySQL and PHP (LAMP) combine with Java to become the de-facto standard environment for students of programming.

Microsoft knows from history that this will be fatal in the long term, hence its decision to extend free availability of core development tools to students. Most of my generation of computer science students quite literally never touched any IBM kit, even though – back then – it had a bigger share of the IT market than today is enjoyed by Microsoft, Dell and Hewlett-Packard put together.

We did C and Unix, and as we spread like plague rats out into employers, infecting them with the new wave, we regarded IBM mainframes with amused contempt – even when IBM was paying me good money.

We changed the trend line through 90 degrees in a decade, to the extent that IBM is now a top Unix vendor that avoids talking about its legacy mainframes in polite company.

We knew that Fortran and Cobol were most of the game, but by changing the rules we outflanked the older generation. In a superb irony, the upgrade of choice for Cobol programmers was to learn Microsoft Visual Basic.

The same game theory is understood by modern computer science students. They want to balance learning commercially valuable tools, whilst avoiding dead-end maintenance jobs looking after 15-year-old Visual Basic applications – yes, Visual Basic really is that old.

Microsoft almost completely owns the paid-for development tools market, but students have always been wary of spending money on software, and so as a headhunter when I review student CVs for high-end banking jobs, I can see the Microsoft toolset is in a declining minority.

Although Visual Studio Express has been free for a while, its status as an intentionally cut-down tool made students reluctant to commit to it. Microsoft even went through a phase of getting legalistic with people who improved Visual Studio Express, for fear it hurt sales of the real product. They’ve wised up, and are giving students full Visual Studio 2008 Professional (with C++, C#, Visual Basic.Net and Visual Tools for Office) , SQL Server, and Expression Studio for those students who kid themselves they can make their work look pretty.

It’s going to be a tough fight. Java seems to have cornered the market in those universities where the students are deemed to be not smart enough to learn C++. C# in academia is pretty rare, and Visual Basic.NET almost unknown, so Microsoft will first get its claws in the smarter end of computer science departments who haven’t dumbed down to teaching operating system internals in Java. Yes, really, it happens, my firm knows who you are, and no, we don’t regard you as having a degree of any kind.

Part of the carrot is the ability to write stuff for the Xbox, and I suspect we will see that getting a serious push now, because this is not a battle Microsoft can afford to lose. It is already fighting up hill as, when I teach C++ to bankers, I regularly get comments like: “Why aren’t we doing GCC?”, because I force the poor dears to use Visual Studio. Why? They at least need to learn how to get C++ to talk to Excel.

That said, the second tier languages like IronPython, IronRuby and F#, may help Microsoft a lot on this front, since they are growing in importance, and interest, in the world of academia. Even though Microsoft seems to be half hearted about C++ these days, its compiler is respectably conformant with standards and fits nicely into a computer science curriculum.

An objective measure of how critical Microsoft sees this – aside from BillG saying it’s great – is that unusually for Microsoft, the initiative is not a US-only thing. The fact the offer will be rolled out globally, tells us more than anything that Microsoft realizes that it needs to fight this properly.

Java and PHP moves towards interoperability!

rochakchauhan — Sat, 16 Feb 2008 12:30:41 +0000

SugarCRM, one of the open source community’s darlings, is taking steps towards improve interoperability between its PHP architecture and Java.

The next version of SugarCRM’s customer relationship management (CRM) suite, version 6.0 due in the fourth quarter of 2008 or first quarter of 2009, will feature a “Java layer” to enable PHP to talk to Java – hopefully without the tricky engineering work.

SugarCRM is not rewriting its PHP application in Java, but it says interoperability will help it add features in version 6.0 that make its CRM better suited to enterprise users running complex and different queries.

Improved text search is one goal for SugarCRM, but getting Java-based software, notably powerful search engines written in Java such as Apache Software Foundations (ASFs) Lucene high-performance text search engine, is difficult. Without this in the case of search, for example, the user is taken outside the security model and potentially gets to access search results they shouldn’t see.

SugarCRM’s Java layer will, the company says, plug into “compatible” software such as Tomcat, helping to ensure that security is maintained as users’ sign-in and permission levels are communicated between PHP and Java.

In other changes, SugarCRM 6.0 is going all Web 2.0. That’ll mean support for Google’s OpenSocial API to integrate its CRM modules with social networks, and a brand-new calendar written using AJAX with plug ins for Google and Yahoo! calendars.

Switch on SAML for PHP With Lightbulb

rochakchauhan — Wed, 06 Feb 2008 16:06:23 +0000

Lightbulb, an Open Web Single Sign-On (OpenSSO) subproject, aims to achieve federated identity for LAMP (Linux, Apache, MySQL, PHP, Python, and Perl) and MARS (MySQL, Apache, Ruby, and the Solaris Operating System). Currently, Lightbulb offers a service provider (SP) written in PHP with Security Assertion Markup Language (SAML) 2.0. This article elaborates on the SP code and describes how to enable Web applications that are also written in PHP with SAML 2.0.

Contents


-	SAML 2.0
-	Lightbulb’s Service Provider
-	Conclusion
-	Acknowledgment
-	References

SAML 2.0

SAML 2.0 consists of a set of specifications for communicating information on user authentication, entitlement, and attributes. With SAML, you can configure SPs to permit access to resources only when an identity provider (IdP) has authenticated a user, thus enabling SSO between the IdP and the SPs. SAML 2.0 was approved by the Organization for the Advancement of Structured Information Standards (OASIS) in March 2005.

Presently, Lightbulb implements the SP role in SAML 2.0′s Web browser SSO profile through the SAML redirect and POST bindings. Figure 1 illustrates an example of the exchange of messages in that configuration.

Figure 1: Overview of Message Exchanges in SSO Configuration With Lightbulb

The solid lines with arrows represent SAML 2.0 protocol messages. The dotted lines with arrows are messages that are outside the scope of the protocol. Following is the process:

The user, with an account at the IdP, attempts to access a resource at the SP from a browser.
The SP, which trusts the IdP to authenticate the user, redirects the browser to the IdP with a 302 HTTP response.
The browser follows the redirect and sends an HTTP GET request to the IdP with a SAML authentication request encoded in an HTTP parameter.
The IdP authenticates the user.The user might be required to supply credentials in the form of a user name and password, a smart card, a biometric, or other mechanism.
The IdP returns to the browser an HTML page to be posted to the SP. The page contains a form with a SAML authentication response as a hidden element. A JavaScript onLoad() event handler automatically sends the form to the SP.
The browser posts the form to the SP, which then evaluates the SAML authentication response and allows or denies access to the resource.
The user then can or cannot access the resource, depending on the SP’s decision.

To protect user privacy, SAML 2.0 can specify a pseudonym in the SAML Assertion’s NameID element rather than the user’s actual identifier (for example, the user name) at the IdP. That pseudonym, a string of characters typically randomly generated by the IdP, is known as a persistent (opaque) identifier—the user’s identifier in the context of the IdP-SP relationship. That way, neither provider knows the user’s identifier at the other end. Furthermore, because the user has a different persistent identifier for each IdP-SP pair, SPs cannot correlate user accounts among themselves.

Note: Even though other NameID formats are available with different privacy properties, persistent identifiers are most commonly used and are the only format currently supported by Lightbulb.

The preceding is a high-level view of SAML SSO. For more details on federated SSO, see the following:

Federated Identity: Single Sign-On Among Enterprises, an October 2004 article that predates SAML 2.0
SAML 2.0 Technical Overview (PDF), currently at draft 10

Lightbulb’s Service Provider

The current, initial Lightbulb SP is structured as a simple sample PHP application, integrated with SAML’s SP library code. This section follows the SAML SSO protocol described in the previous section through the Lightbulb code and highlights the two SSO integration points between Lightbulb and the application. You can download the Lightbulb source code from the Web interface or CVS (see the instructions after logging in to java.net).

Initiating SAML SSO

The following excerpt from the prompt.php file contains a link to the spSSOInit.php script:

This is the first integration point between the Lightbulb SAML 2.0 code and the PHP application. Table 1 describes the script’s parameters, which, closely modeled on OpenSSO’s SAML 2.0, direct spSSOInit.php to initiate SAML 2.0 SSO.

Table 1: Parameters of spSSOInit.php Script

Parameter	Description

`metaAlias`	The SP identifier. Multiple SPs are each denoted by `metaAlias`.
`binding`	The SAML binding in the protocol.

Currently, all four parameters are mandatory. Future versions of the script will likely streamline simple deployments by making metaAlias, idpEntityID, and binding optional.

The spSSOInit.php script performs the following tasks:

Uses metaAlias and idpEntityID as indexes into tables of metadata: configuration information such as the endpoint URLs in the protocol.
Assembles and prepares a SAML AuthnRequest element for transmission as an HTTP parameter according to the SAML 2.0 specification.
Compresses (deflates) the prepared AuthnRequest element, encodes it for Base64, and encodes the URL.
Constructs a URL with the encoded AuthnRequest and RelayState elements as parameters to the IdP’s SSO service endpoint.
Redirects the browser to that URL.

Take a look at this typical AuthnRequest element.

Processing the SAML Response

On receiving the authentication request, the IdP authenticates the user and directs the browser to post a SAML response to the sp.php script.

Next, the following process takes place:

The sp.php script decodes the Base64 SAML response and parses the response and its component SAML Assertion with the processResponse() function from saml-lib.php.
processResponse() verifies that the Assertion’s signature is correct and that the signing certificate’s thumbprint (SHA-1 hash) matches the one on record in the metadata for the IdP.
The script maps the Assertion’s NameID to a local user name and sets the latter with the setUserID() function from the localUserManagement.php script.This is the second point of integration. You would replace setUserID() with the function that sets the user name in your application.If NameID does not correspond to a user account, the script redirects the browser to the login page (prompt.php) and then to mapName.php to authenticate the user locally and to map NameID to the resulting local user name.

Conclusion

You’ve now examined a profile of the SAML SSO protocol, followed its execution through the Lightbulb PHP code, and noted the integration points between Lightbulb and a typical PHP application. A future article on Lightbulb will explain SAML’s circle-of-trust concept and will describe how Lightbulb’s single logout process terminates user sessions with all the members of a circle of trust.

Acknowledgment

Special thanks to Rob Richards, author of the PHP library for XML security, for his gracious permission to adapt the library code into OpenSSO for use in Lightbulb.

References

Sun Java System Access Manager
- Main page
- Developer home
- Software Forum
SAML 2.0 Specification
Project Lightbulb
Project OpenSSO
Related articles
- Federated Identity: Single Sign-On Among Enterprises (October 14, 2004)
- What’s Happening in Identity at Sun (September 1, 2006)
Sun developer services
- Support
- Training and certification