Configuring TIBCO Web Messaging to Securely Connect to TIBCO EMS

If you want to configure your TIBCO Web Messaging gateway, which normally lives in the DMZ, to connect to TIBCO EMS messaging backbone over a TCP connection, the procedure is straightforward. Just point to the TIBCO EMS server hostname and port number, assuming that's already open in the firewall, in the trusted network and that's it.

Something similar to the following service (stomp.jms) configuration should be enough:

<service>
  <accept>ws://${gateway.hostname}:${gateway.nonsecure.port}/jms</accept>
  <type>stomp.jms</type>
    <properties>
      <connection.factory.name>GenericConnectionFactory</connection.factory.name>
      <context.lookup.topic.format>%s</context.lookup.topic.format>
      <context.lookup.queue.format>%s</context.lookup.queue.format>
      <env.java.naming.factory.initial>
            com.tibco.tibjms.naming.TibjmsInitialContextFactory
      </env.java.naming.factory.initial>
      <env.java.naming.provider.url>
            tcp://${EMS.hostname}:${EMS.portNumber}
      </env.java.naming.provider.url>
      <destination.strategy>session</destination.strategy>
    </properties>
    <realm-name>dev_realm</realm-name>
    <authorization-constraint>
      <require-role>AUTHORIZED</require-role>
    </authorization-constraint>
  </service>

Now, if you want to configure an end-to-end secured enabled environment then some extra parameters are necessary to make everything work correctly. The service configuration below will give you what you need (most of them are self-explanatory) to enable that.

<service>
    <accept>wss://${gateway.hostname}:${gateway.secure.port}/jms</accept>
    <type>stomp.jms</type>  
    <properties>
     <connection.factory.name>SecureConnectionFactory</connection.factory.name>
      <context.lookup.topic.format>%s</context.lookup.topic.format>
      <context.lookup.queue.format>%s</context.lookup.queue.format>
      <connection.security.principal>ems_user</connection.security.principal>
      <connection.security.credentials>ems_password</connection.security.credentials>
      <env.java.naming.factory.initial>
          com.tibco.tibjms.naming.TibjmsInitialContextFactory
      </env.java.naming.factory.initial>
      <env.com.tibco.tibjms.naming.security_protocol>
          ssl
      </env.com.tibco.tibjms.naming.security_protocol> 
      <env.java.naming.provider.url>
         ssl://${EMS.hostname}:${EMS.securePortNumber}
      </env.java.naming.provider.url>
      <env.com.tibco.tibjms.naming.ssl_enable_verify_host>
         true
      </env.com.tibco.tibjms.naming.ssl_enable_verify_host>  
      <env.com.tibco.tibjms.naming.ssl_trusted_certs>
         ems_certificate.pem
      </env.com.tibco.tibjms.naming.ssl_trusted_certs> 
      <env.com.tibco.tibjms.naming.ssl_trace>
         true
      </env.com.tibco.tibjms.naming.ssl_trace>
      <destination.strategy>session</destination.strategy>
     </properties>
     <realm-name>dev_realm</realm-name>
     <authorization-constraint>
      <require-role>AUTHORIZED</require-role>
    </authorization-constraint>  
  </service>

The current version of TIBCO Web Messaging also provides you a really nice feature called Reverse Connectivity where you will be able to close all incoming traffic ports while still allowing external clients to initiate the connection. But, this is a topic to be explored on a next post. Stay tuned!

Accessing Databases with HTML5 WebSockets and Apache Camel

As I have said on my previous post, I've been working with several companies with the most diverse use cases and one that really brought my attention was the requirement to access databases using HTML5 WebSockets which seems to be a clever thing to do with the right tools.

So, basically what I've setup for this is represented on the picture below:

Let's go over the implementation details of all of the components described here:

From right to left, the backend datasource I had to use was MySQL that you can download from http://www.mysql.com/downloads/. Then, I used Apache Camel as the backend framework accessing the database and also exposing a TCP-based component (Mina in this case). Moving to the left, we have the Kaazing WebSocket Gateway connecting to the Apache Camel framework and exposing WebSocket connectivity to the web clients (browser-based, mobile-based and desktop thick client applications).

The web-browser sample client is pretty straightforward and with a few lines of code you can get the functionality. There are sample javascript clients shipped with the Kaazing WebSocket Gateway that you can re-use or modify to your needs. The Kaazing WebSocket Gateway documentation set is also helpful and good starting point. Check it out: http://tech.kaazing.com/documentation/html5/3.3/o_dev_js.html

Then the only change you have to make in the Kaazing WebSocket Gateway is in the gateway-config.xml (under $KWG_HOME/conf) to include the service you want to expose to the web clients and where you want to connect to the backend framework with access to the database.

Here is what I have included on my configuration:

<!-- Demo JDBC Backend System Config -->

  <!-- Proxy service --> 

  <service>

<accept>ws://${gateway.hostname}:${gateway.extras.port}/jdbc</accept> 

<type>proxy</type>

<properties>

<connect>tcp://${gateway.hostname}:8888</connect>

</properties>

   </service>

Check the Kaazing WebSocket Gateway documentation to get more familiar with these settings.

Last but not least, the Apache Camel route hosting the Mina endpoint and the database connectivity:

 <camelContext xmlns="http://camel.apache.org/schema/spring">

    <package>com.kaazing.gateway.demo.db</package>

    <route id="WSMinaJDBCSample">

        <from uri="mina:tcp://localhost:8888?timeout=30000"/>

        <log message="RECEIVED: ${body}"/>

        <setBody>

        <simple>select * from customers where customers.email = '${body}'</simple>

        </setBody>

        <to uri="jdbc:myDataSource"/>

        <log message="GENERATED: ${body}"/>

    </route>

</camelContext>

<!-- MySQL datasource -->

  <bean class="org.springframework.jdbc.datasource.DriverManagerDataSource" id="myDataSource">

    <property name="driverClassName" value="com.mysql.jdbc.Driver"/>

    <property name="url" value="jdbc:mysql://localhost:3306/test"/>

    <property name="username" value="root"/>

    <!-- <property name="password" value="XXXXX"/>  -->

  </bean>

The MySQL database setup is very simple and you can use any sample database tables you want. Just make sure you update the Apache Camel route and your environment settings accordingly.

Code will be available soon...

UDPATE:
Sample code is now available at: https://github.com/mjabali/DBOverWS