Copyright: I don’t have anything. This is only my resume to OCMJEA 6 study based on Bambara’s book (an excellent one, if you can, buy it here). All the images are from the book and from Google Images. Personal use only. Sorry for english errors. Sergio Figueras (sergio@yourecm.com).

OCMJEA 6 - Study Book
Java EE 6 Enterprise Architect Certified Master 1Z0-807
2. Common Architectures
551e7f29930ffa3e1273e623_Screen%20Shot%202015-04-03%20at%2008.59.14.png

CERTIFICATION OBJECTIVE 3.01 - Strategies to deploy client apps

1. UI

The major objective in UI is to provide a harmful way to users interacts and operates into applications in required environments (mobile, desktop, web). Are considered as UI principles:

551e83942f93909e0786d380_Screen%20Shot%202015-04-03%20at%2009.19.28.png

All this principles can be translated as following statements:
- Visual goal must be clarity. It is visibility. Ex: Color pallete, etc
- All the visual elements must respond user acts with feedbacks. Ex: Buttons
- All the visual elements must be obvious. It is affordance. Ex: User icons
- Keep things simple as possible. It’s simplicity. Ex: cog button on CRUD
- The UI must be structured, so, it must have an easy way to user interacts. Ex: Structured menus
- Consistency is when an application is easy to learn. Ex: help systems
- Tolerance refers to prevent errors. Should reduce errors from user operations. Ex: validators

CERTIFICATION OBJECTIVE 3.02 – Exception Handlings, Logging, Business Tier Patterns 

1. Exceptions in General

There are two types of exceptions that can occur:

BUSINESS EXCEPTION

Process cannot continue with behavior due a business rule.
Ex: user.name.invalid, ERROR 303, Validation Error
Are CHECKED exceptions
Shouldn't stop the process

PROCESS EXCEPTION

Non recoverable exceptions, memory, processing, network errors. Ex: StackOverflowException, OutOfMemoryException
Are UNCHECKED exceptions
Can stop the process

Logging must provide these good characteristics:
- Pertinent logging information
- Passing information to the user
- Try to alternate execution to other path (retry logic if it is possible)
- Route exception to the support team (by email)
- Give all pertinent information to support user

The end user normally expects the following behaviors:
- Description and error code
- An unique error code so the user can contact the support system.

CERTIFICATION OBJECTIVE 3.03 – Identify design patterns that address specific changes in Web Tier

1. Web Tier Security Patterns

The following table details the web tier security patterns.

Authentication Enforcer

This pattern describes how a JEE application should manage authentication process. Authentication means an attempt to generate identity proof (session).

HTTPS, SSL, IPSec, JAAS, JCE

Authorization Enforcer

This pattern describes how a JEE application should manage authorization process. Authorization is verify if a specified identity can access a specified resource.

JAC, JAAS, JCE

Intercepting Validator

Secure mechanism to validate parameters. Invalid parameters can lead to security leaks like SQL injection and errors since the sent data is not verified.

JSP, Servlets

Secure Logger

Specify logging information all across the request / response. Describes how to log in a reliable/efficient way.

JMX, Logging API

Secure Pipe

Estabilishes secure connection between client and server including mutual authentication, nonrepudiation and confidentially. 

HTTPS, SSL, IPSec

Intercepting Web Agent

Provides authentication, authorization, encryption and auditing  from controlling access from outside the application. It is good because it isolates business logic from authorization logic. It’s implemented on the web server.

JMX, Web Server Plugin

2. Business Tier Security Patterns

Audit Interceptor 

Collect all events that are stored by the secure logger. 

Java API for logging, Log4J

Container Managed Security

Describes when and how to use standard security features by application container.  

Secure Pipe

Dynamic Service Management

This pattern provides dynamically adjustable instrumentation of security components for monitoring and active management of business objects.

JMX

Obfuscated Transfer Object

Pattern that describes how protect some attributes between the tiers. Basically you've maps of attributes with different concerns.

HTTPS, SSL, IPSec, JAAS, JCE

Policy Delegate

Determines how EJB objects should be accessed and used.  

JACC, EJB

Secure Service Facade

This pattern provides a session façade that can contain and centralize complex interactions between business components under a secure session. It provides dynamic and declarative security to back-end business objects in the service façade. It shields off foreign entities from performing illegal or unauthorized service invocation directly under a secure session.

EJB

Secure Session Object 

This pattern defines ways to secure session information in EJBs facilitating distributed access and seamless propagation of security context.

EJB

2. Services Tier Security Patterns

Message Inspector

Verifies if the shared XML is secure and authentique

XMLEncryption;XMLSignature;SAAJ;JAX-RPC;WS-Security;SAML;XKMS;

Message Interceptor

????

JAX-RPC; SAAJ; WS-Security XMLSignature; XMLEncryption; SAMLXA CML WS-*

Secure Message Router

This pattern provides a session façade that can contain and centralize complex interactions between business components under a secure session. It provides dynamic and declarative security to back-end business objects in the service façade. It shields off foreign entities from performing illegal or unauthorized service invocation directly under a secure session.

WSS-SMS, XMLSignature

3. IDM Patterns

Assertion Builder

How security assertions must be build

SAML

Password Synchronizer

How synchronize principals across multiple applications.

SAML

Credential Tokenizer

How a principle security should be encapsulated and sent in SOA messages

SAML

Single Sign-on Delegator

How build a single sign-on delegator to legacy systems.

SPML

4. Scaling and clustering Patterns

Scalability

Scalability means to increase computer resources to improve or maintain system performance. It can be of two types:
 - Vertical Scaling: when you add more CPU and memory to a single machine. It’s not a failover solution, because if that machine dies the system accessibility is damaged.
 - Horizontal scaling: when you add computers that works as a single node. It’s a failover solution and if some CPU dies, another will answer the same request without problems.

High Availability

If a server dies, another must be available to answer for the same request.

Load Balancing

Load balancing is a central concept in clustering technologies. Their function is to route incoming requests to the most available server (according with well defined algorithms), and should also check for the heartbeat of each server and session stickiness (transfer sessions correctly trough servers).

Fault Tolerance

Fault tolerance systems always guarantee request results despite any problems in the servers (redirects incoming requests to available servers)

Failover

When a new server is selected the code will continue ever if the original server fails.

HTTPSession Failover

Every web application normally gives states to their session objects. But to use the failover concept, it must work to HTTPSession too. So, to build a correct httpsession Failover system you need:

 - Unique HTTPSession ID between all the servers.
- HTTPSession Backup to prevent sessions to be lost. You can save these sessions into a Database but it's a heavyweight technique. So your HTTPSession object must be minimum as necessary. The main advantages of this approach is: it's easy to implement, the session can be alive even if all the cluster fails, and a session can be migrated to any server. You can load this HTTPSession objects into memories and they’ll automatically be shared across all the nodes. It's a lightweight technique.

CERTIFICATION OBJECTIVE 3.04 – Identify JavaEE Patterns (JMS, JCA, WS, etc)

1. Design patterns in JavaEE integrations

JMS (Java Messaging Service) is a generic way to integrate Enterprise Applications (EA) exchanging messages. A message is a serialized object exchanged between two or more components in the same server or different servers. Using MOM (Message Oriented Middleware) an application can create, send and receive messages. Messages can be sent to a FIFO queue to be consumed later or directly sent to the consumer component. Each message must be delivered to only one component. The messages stay in queue before they’re consumed or their expiration time comes. There’re two kinds of messages:

Synchronous

- Are delivered in the same order as sent
- Tightly coupled
- The sender and receiver must know each other
- The sender is responsible to retry to send message if any transmission error occurs.
- The sender will continue only when the message is transmitted correctly.
- Typically used for transaction processing. 

Assynchronous

- Can be delivered in different order as sent
- Loosely coupled
- MOM is responsible to retry to send message if any transmission error occurs.
- The sender will continue even if the message is not delivered.
- Used for broadcast messages to multiple receivers and with high data volume. (ex: Charts data) 

There's also a special message kind known as “durable subscription”. They stay alive in the queue until their consumers receive then. So, if they're not active the messages stay in the queue until they come active and consume this message.

2. JCA and design patterns in Enterprise Integrations

The base pattern to Enterprise Application Integrations is Adapter Pattern. The logical definition of that pattern is a software component that enables the two or more adapted components being interacted by an external component without modifying the adapted components. They’re most commonly used to Process Automation, Online Services and Data Synchronization. In JavaEE, an adapter must complain with JCA (Java Connector Architecture). Java Connector Architecture (JCA) is a generic architecture to integrate legacy systems. The JCA is based in the following characteristics.

2.1 Contracts

JCA defines the characteristics to connecting a compliant Application Server to an EIS. 
– Connection Management: defines that an Application Server creates a pool of connections to EIS. (Analogy: JDBC Connection pool)
– Transaction Management: defines that an Application Server should provide a transaction manager to interact with EIS (Analogy: Transaction management in Hibernate)
 – Security Management: the Application Server must provide security manager accordingly with security policy to prevent treats. (Analogy: JAAS)
  – Lifecycle Management: Application Server must manage the lifecycle of the adapter and must notify the dependencies about start, upgrade, undeploy or removal of the adapter.
  – Work Management
  – Transaction Inflow Management
  – Message Inflow Management

5521be866ee85cb80c24b30d_JCA.png

2. Java EE Technologies: WebServices and Design Patterns in Integrations

WebServices are a easy way to integrate systems. They must be used in this situations:
- Client and service are from different domains and they can’t be easily imported to client system.
- Client is a complex business process that already call a lot of other services.
- Cross machine calls (Desktop, Computer, Smartphone, etc).
- MOM (Message Oriented Middleware) would be painful to use (plataform, interoperability, etc).

3. REST WebServices

CERTIFICATION OBJECTIVE 3.05 – Identify JavaEE Patterns (JDBC, JPA, RMI, CORBA, etc)

1. Java EE Technologies: WebServices and Design Patterns in Integrations

The benefit of distributed systems must provide these characteristics to an Enterprise Integration Project:

Interoperability

The system must provide interoperability passing by problems like different programming langs, platforms, etc.

Data Integration

Must handle flow data of components.

Robustness

Integration solutions must be robust, reliable, and scalable.

Before modern approaches like EIS, solutions like point to point integrations have been used a lot. But there’s a major problem in that approach that is an extensive manageability, extensibility costs. That kind of solution rises problematic as goes on with other systems integrating on this. This is a typical point-to-point integration information flow. And if point fails, every others will fail too.

5521b413dcc6adcc0384ec5e_p2p.jpg

2. JDBC

Java Database Conectivity is an API to connect and interact with databases with database commands as CREATE, UPDATE, DELETE, etc. Also, it can run stored procedures too. 

5521b4dd6ee85cb80c24b20d_jdbc.jpeg

3. JPA

Java Persistence Architecture API is a Java specification to access, persist, and manage databases using POJOs and Databases. JPA is defined in EJB3.0 specification. JPA implementations supports XML and @Annotations to configure. There's also a EntityManager to use queries objects. There is an implemented version of SQL to JPA, JPQL (Java Persistence Query Language).

5521b62ebb4e03cb0317d7f7_JPA.jpeg

4. CORBA

Common Object Request Broker Architecture enables integration between different components in different computers works as with they were a single software. CORBA defines an Interface Definition Language (IDL) to define how the objects exposes themselves to the outer world. CORBA then  specifies mappings to different languages like C++, Java, C, Python, etc.

5521b86d6ee85cb80c24b24b_corba.gif

5. RMI

Java Remote Method Invocation is the Java Implementation for CORBA. It can call subroutines in objects made in other languages and running on different computers.

5521b936dcc6adcc0384ecca_RMI%20Java.png

6. IIOP

IIOP is the protocol that runs RMI across internet. CORBA and IIOP assumes the client/server model, where client always do a request to the RMI server that responds it. To make that call, the RMI client should have the address of the program. That address is called Interoperable Object Reference.

5521baa3dcc6adcc0384ece5_iiop.gif

7. Enterprise Service Bus (ESB)

Enterprise Service Bus rises as a evolution of broker model. It envolves configuration files pointing to the services that can be consumed by other services. ESB softwares includes those features:
 – Location Transparency: a consumer component doesn't need to know informations of the producer to consume their objects. 
 - Transparency: ESB should convert objects to a format that a consumer requires (JSON, XML, etc).
 - Protocol Conversion: ESB receives producer requests in a lot of formats and can convert to desired format by the consumer.
 – Routing: The ability to recognize correct consumers based on configurations or dynamically created requests.
 – Enhancement: Can retrieve missing data in an income request and append required data before it reaches their final destination.
 - Monitoring and Administration: ESB can monitor the incoming requests and their responses and provide metrics to the administrator.
 – Security: ESB can manage security using their rules or rules from external components (Container, component, etc).

Are considered as advantages of an ESB system:
 - Lightweight
 - Easy to expand
 – Scalable and distributable
 - SOA Friendly
 - Incremental Adoption

5521be36a5aeddb90cda9333_ESB.jpg