Xomino

Domino with the new improved X

Who? Me? SocialBizUg Clippings guru Guidance

Posted by MarkyRoden on May 17, 2015

So the great and phenomenal Sir. Julian Robicheaux has decided to pass the torch and retire from the SocialBizUg Clippings Guru Guidance articles. We are all grateful to him for sharing his vast knowledge with us.

So you can imagine my horror and surprise when I was asked to take over the Guru articles. How could I possibly follow the great one ?!? I was of course very flattered and I really hope that I am able to carry on the legacy :)

Starting next month I will be contributing bi-monthly to the Clippings magazine and I will be talking about Bluemix and XPages. I really see Bluemix and XPages as an amazing opportunity for all of us to learn something new, while being grounded in what we already know.

You can sign up to get Clippings in your SocialBizUg profile. 

The newsletters are also posted to this wiki every month: https://www.socialbizug.org/wikis/home?lang=en-us#!/wiki/Newsletters/page/Clippings
As always – this is going to be fun :)


Posted in Just Marky | 3 Comments »

Bluemix docker documentation update

Posted by MarkyRoden on May 11, 2015

Sunday night I commented on the Bluemix document site that the instructions did not work for the windows installed version of boot2docker.

Only yesterday I posted the following image taken from the site last Friday night

w3

and commented how it didn’t work and I had to use curl.

I found this, this evening….

w8

How cool is that – I have no idea if my comments/blog post was the reason for the change, but it certainly can’t have hurt.

If you see something wrong, do the right thing and report it and get it fixed for other people :)

It also goes to show that a program in BETA is going to undergo some refining – that is kinda the point of being in BETA. I am very impressed at the response time for the changes and I can only hope that the final version is better than what I had to go through.

PS

The other thing of course is that yesterday’s blog is now total rubbish (facepalm)

Posted in Bluemix, Docker | Leave a Comment »

Bluemix and docker BETA installation (part 1)

Posted by MarkyRoden on May 10, 2015

*** UPDATE***

I guess I should have seen this coming, but it is a good thing – the Bluemix docker documentation has been updated since this post was published. It is still worth reading to learn a few things about docker – but the referenced documentation site does not look like it is detailed in this post (less than 24 hours later!!)

***************

Currently access to containers within Bluemix is at BETA (May 2015) and you have to request access to get to it. I am writing this for my own sanity and documentation…….

The instructions for installation are here

http://www.ng.bluemix.net/docs/#starters/index-gentopic3.html

Having had to figure out how to give my boot2docker access to the internet to download files for Step 1, Step 2 was no easier…

Step 2

 

 

 

w3

Well when I tried that I got this……

w1

So having a quick Google and some Toby I found this link about using curl instead of wget

 wget vs curl: How to Download Files Using wget and curl

Using curl -O instead of wget it works

w2

Step 3

  1. Install Python Setuptools, see Installing and Using Setuptools.

Install says do this – curl https://bootstrap.pypa.io/ez_setup.py -o – | python

and that bombed

w4

Do this instead

curl -O https://bootstrap.pypa.io/ez_setup.py

sudo python ez_setup.py

w5

Step 4

Abandon all faith ye who enter…..ok what next

docker@boot2docker:~$ wget cf.tgz -L -O https://cli.run.pivotal.io/stable?release=linux32-binary
docker@boot2docker:~$ sudo tar -zxvf cf.tgz -C /usr/bin/

well that didn’t work as we have already seen – try I tried this instead and this failed as well

curl cf.tgz -O https://cli.run.pivotal.io/stable?release=linux32-binary

I tried to download the file (https://cli.run.pivotal.io/stable?release=linux32-binary ) with chrome dev tools open and I saw this URL – http://go-cli.s3-website-us-east-1.amazonaws.com/releases/v6.11.2/cf-linux-386.tgz

so I tried this – and it worked

then this failed – sudo tar -zxvf cf.tgz -C /usr/bin/ because the name of the file is really cf-linux-386.tgz

so do this

  • sudo tar -zxvf cf-linux-386.tgz -C /usr/bin/

Step 5

Set the following variable: DOCKER_TLS_VERIFY=1

Note: If you are using Boot2docker, set the variable in your Boot2docker VM.”

HOW????

So I checked the docker git site…https://github.com/boot2docker/boot2docker which states clearly…

w7

I also saw to run boot2docker up and oooooo look at that export !!!

w6

 

So do that (I wonder what the other two do – that might be helpful later)

  • export DOCKER_TLS_VERIFY=1

“You are ready to install the IBM Containers Extension.”

Conclusion

Steps 1 – 5 and none of them worked as per the instructions. I have done my part and commented on the post stating as such, but wow !!!

You can’t make this up…..more as soon as I can figure it out….or not !

I did learn a bunch about curl, boot2docker, oracle VirtualBox so not a total waste

#thinkPositive

 

Posted in Bluemix, Docker | 2 Comments »

Setting Port forwarding for boot2docker to access the internet

Posted by MarkyRoden on May 6, 2015

If you have followed the instructions on how to install boot2docker on windows you will discover that the docker VM may not able to talk to the outside world by default.

boo6

To correct this you have to add port forwarding from the docker VM to the HOST. This is accomplished by the following

Run the newly installed Oracle Virtual box on your window machine

boo1

Select Settings

boo2

Network > Port Forwarding

boo3

Add the docker port (2375) so that it can talk out through the host (windows) machine

With this in place you must close boot2docker and restart the VM.

boo5

After that you can restart boot2docker and you should be able to ping the outside world

boo7

 

 

 

Posted in Docker | Tagged: | 1 Comment »

Passing authentication information through the Bluemix Hybrid Secure Gateway

Posted by MarkyRoden on May 5, 2015

In this article I will demonstrate a couple of the things which can be passed through a Bluemix secure gateway, allowing us to create normal web based applications.

Introduction

In the previous article I demonstrated how to create a TLS secured hybrid Bluemix application. In this article we will look at some of the web properties/headers, cookies etc which we can pass through the gateway.

The Gateway

To demonstrate what can be passed through the gateway I am using a simple notes form to display the incoming information

The Cookie, Header and username fields are all hidden if the field value is blank

b1

 

Here is my application running on node, using the secure gateway and once again accessing the domino server hosted on my laptop.

b2

 

No username, no cookie, no header.

Changing the code back within the calling application we are going to add some additional information. In the following code snippet you can see that we have added some header “Marky” information.

app.get('/secureTunnel', function(req, res) {
    tunnel.create('8888', function(){
        var options = {
            headers: {"Cookie": "", "Marky": "Hi Marky"},
            port: '8888',
            path: '/xomino/ainx.nsf/testform?readform'
        };

        var callback = function(obj){
            res.writeHead(200, {"Content-Type": "text/html"});
            res.end(obj.body);
        }
        var obj = simpleHTTP.run(options, callback);

    });
});

When we refresh the application we can see that the header has been passed through the secure gateway to the application itself:


b3

b4

If we try and log into the application (directly on the domino server) we can generate a session authentication token. These screenshots are taken directly from the domino server.


b5

b6

At this point though just because the domino window is logged in, the node app still records anonymous.
b7

Adding the cookie to the node application code, which is passed through the gateway

app.get('/secureTunnel', function(req, res) {
    tunnel.create('8888', function(){
        var cookie = "DomAuthSessId=D2BF0063D62C9138E9F723BB88C046F5";
        var options = {
            headers: {"Cookie": cookie, "Marky": "Hi Marky"},
            port: '8888',
            path: '/xomino/ainx.nsf/testform?readform'
        };

        var callback = function(obj){
            res.writeHead(200, {"Content-Type": "text/html"});
            //res.write(JSON.stringify(obj.resHeaders)+"<hr/>")
            res.end(obj.body);
        }
        var obj = simpleHTTP.run(options, callback);
    });
});

We can now see that the user is authenticated within the bounds of the hybrid application

b8

Pushing all this code up into Bluemix you can truly appreciate the authenticated hybrid app

b9

Conclusion

In this article we have seen how we can push basic header information through the gateway and pseudo-demonstrate an authenticated application. There are of course multiple hurdles to overcome between this demo and a real world application, but I hope it has given you an idea for what’s possible.

 

 

Posted in Bluemix, Hybrid Application, node.js | Tagged: , , | 5 Comments »

Creating a secure Bluemix hybrid app using TLS encryption

Posted by MarkyRoden on May 3, 2015

In this article I will demonstrate how to secure a hybrid IBM Bluemix application using the Secure Gateway and the Mutual TLS encryption option.

Introduction

In the previous article I demonstrated how to create a sample hybrid app which was unsecure because you could just call the gateway URL and access the application behind the firewall. While this worked well as a concept demo, it is not a production feasible set up. In this article we will look at how to set up a secure tunnel to the gateway URL and then on to our application.

The basis for this article comes from this developerworks article.

https://developer.ibm.com/bluemix/2015/04/17/securing-destinations-tls-bluemix-secure-gateway/

It took me a long time (relatively) to figure out how to make this work in my environment as I did not understand what was being accomplished by the example. I hope to provide a greater level of detail and explanation in this article.

Creating a secure gateway

Following the steps described previously we can set up a Secure Gateway within our Bluemix app. This time we are going to create a gateway which is secured with TLS encryption. As you can see from the image below, when you select the “TLS Mutual Auth” option a grey section appears underneath the form fields.

  • Select Auto Generate cert and Private key

s1

 

Click on the + Icon at the end of the fields and you will see the new gateway created

s2

Click on the gear icon at the end of the line and you will see an option to “Download Keys”. On selecting that a zip file will be downloaded. You will notice that I have not blurred out the port or Destination ID this time. This is because the point of this is that without those TLS Keys, knowing this information will be of no use to you. (You’re welcome).

Once the Keys are downloaded you need to add them to your node application (in my case in the root)

s3

 

As you can see from the image below, the .pem files are just text files which are the key files used as part of the encryption handshake when we connect to the gateway.

s4

Once the keys have been added to the project we are then able to create our basic app.

Basic node app 101

The following code creates a basic node website

var express = require('express');
var app = express();
var http = require('http');

app.get('/', function(req, res) {
    res.write("Hi I am the root")
    res.end();
});

var host = (process.env.VCAP_APP_HOST || 'localhost');
var port = (process.env.VCAP_APP_PORT || 4000);
app.listen(port, host);

 

s5

 

Secure tunnel

We are going to create a secure tunnel to the Bluemix Secure gateway. We do this using the following code which should be saved as tunnel.js.

//tunnel.js
var tls = require('tls');
var fs = require('fs');
var net = require('net');

var options = {
    host: 'cap-sg-prd-5.integration.ibmcloud.com',
    port: '15101',
    key: fs.readFileSync('Hqb17PFJ9Oe_5lm_key.pem'),
    cert: fs.readFileSync('Hqb17PFJ9Oe_5lm_cert.pem'),
    ca: fs.readFileSync('DigiCertCA2.pem')
};

var creations = 0;
var server;

//In this case the port value is the port of the tunnel created on the local server
//to the secure gateway - this is NOT the 15xxx port of the gateway
exports.create = function(port, callback) {
    if(creations == 0){
        creations++;
        //server not currently running, create one
        server = net.createServer(function (conn) {
            connectFarside(conn, function(err, socket) {
                if (err){
                    console.log(err);
                }
                socket.pipe(conn);
                conn.pipe(socket);
            });
        });
        server.listen(port, function(){
            console.log('tunnel on port: '+port);
            callback();
        });
    } else{
        //server already running
        creations++;
        callback()
    }
};

function connectFarside(conn, callback) {
    try {
        var socket = tls.connect(options, function() {
            console.log('tunnel connected');
            callback(null, socket);
        });
        socket.on('error', function(err){
            console.log('Socket error: ' + JSON.stringify(err));
        });
    } catch(err) {
        console.log(err)
        callback(err);
    }
};

exports.close = function(){
    creations--;
    if(creations == 0){
        //close the server if this was the only connections running on it
        server.close();
    }
}

 

This file needs some explanation. What it is doing is the following:

  • When we call tunnel.create we are going to create a secure tunnel from the current node server to whatever is passed in through the options object
  • The port on which the tunnel is created has NOTHING to do with the port of the secure gateway. This tunnel will connect a specific port on the current server to the port on the gateway server.
  • The tunnel itself connects to the secureGateway on port 15101 (in this case)
  • The port is created as part of the connection to the gateway. When the connection is complete the port is closed. This prevents someone from guessing the new port on the server and using it!
  • This is not the best way of doing it, it is not very flexible for a reusable, in production, service with multiple connections. The port and server should not be hard coded. They are for this example so it is easier to understand. We will look at making it generic it later.

Connecting to our backend service (simpleHTTP.js)

In this case I am demonstrating connecting to a web page, but there is no reason why you cannot connect to mysql, mongo or anything else. I have a simple http connection module which will connect to the specified webpage on the back end and return the page as a buffered string back to the original app.get(‘/secureTunnel’).

//simpleHTTP.js
var http = require('http')
exports.run = function(options, callback){
    var response = {};
    var body = "";

    var req = http.get(options, function(res) {
        // Buffer the body entirely for processing as a whole.
        var bodyChunks = [];
        res.on('data', function(chunk) {
            // You can process streamed parts here...
            bodyChunks.push(chunk);
        }).on('end', function() {
            body = Buffer.concat(bodyChunks);
            //put the response into a format which can be easily passed to the callback
            response = {'body': body, 'resHeaders': res.headers}
            callback(response)
        })
    });
}

Building out our node app

Building out the rest of the app.js it looks like this:

  • Create the route for app.get(“secureTunnel”, function()……..)
  • When called the route does two things
    • Calls tunnel.create
    • Passes the connection request to simpleHTTP
    • Closes the tunnel

 


var express = require('express');
var app = express();
var http = require('http');
var tunnel = require('./tunnel.js');      //code used to create and manage the secure tunnel
var simpleHTTP = require('./simpleHTTP'); //code used to create the request to the http service (web page)

app.get('/secureTunnel', function(req, res) {
    tunnel.create('8888', function(){

        var options = {
            //host is not necessary in this case because it binds directly this server if blank
            port: '8888',          //The tunnel port
            path: '/xomino/jQinX.nsf/Marky?readform' //the path of the test page on my laptop
        };

        var callback = function(obj){
            res.writeHead(200, {"Content-Type": "text/html"});
            res.write(JSON.stringify(obj.resHeaders)+"<hr/>")
            res.end(obj.body);
        }
        //make the http call and display the results out on the page.
        var obj = simpleCopper.run(options, callback);
        tunner.close()
    });
});

var host = (process.env.VCAP_APP_HOST || 'localhost');
// The port on the DEA for communication with the application:
var port = (process.env.VCAP_APP_PORT || 4000);
// Start server
app.listen(port, host);

Putting it all together

Here is the process for the connection laid out in bullet points:

  • Request comes in to /secureTunnel
  • Create a secure tunnel on port 8888
  • The tunnel is created on port 8888 by setting:
    • The secureGateway URL
    • The secureGateway port
    • The secure gateway keys
    • and then opening the new tunnel to the secureGateway
  • At this point the host website (bluemix) on port 8888 is not connected to the secure gateway on port 15101
  • The connection is made and the request to the service is made
    • The request to the connection is not made over port 80 or 4000 (or whatever you are using for the host), it is actually made to the newly created tunnel port 8888
    • The connection to 8888 routes out to secureGateway port 15101 – this is now permitted
    • The secure gateway in turn connects back into the hybrid environment (192.168.0.2:80) and gets the desired information from within the firewall
    • The firewalled service responds back through the secure gateway and back to the host port 8888
    • The response is packaged up and returned to the user’s screen (for this demo the HI Message)
    • The tunnel on port 8888 is then closed and cannot be accessed by anyone any more.

And we have a result locally

s6

Which is my node server locally, connecting to the secure gateway to come BACK to my local domino server

s7

This of course would look WAAAY more impressive it was Bluemix making the call. So I committed the code and pushed it up the the xominoKnox Bluemix repository…….et voilà

s8

Conclusion

What I hoped to achieve in this article is a step by step explanation of how a secure tunnel is created to facilitate the secure hybrid environment. As I mentioned this hard coded version is not ideal for production yet because the keys are hard coded to the connection. With a little effort the code could be genericised to use the connection tunnel multiple secure gateways within BlueMix.

The code for this project can be found here – https://hub.jazz.net/git/mdroden/xominoKnox but I assure you the gateway is not longer open ;)

Very Cool :)

 

Posted in Bluemix, Hybrid Application, node.js | 3 Comments »

How to add a Node.js Express route in a separate file

Posted by MarkyRoden on April 28, 2015

In this article I will show how you can manage your routes in a separate file from app.js. It also demonstrates more generally how adding modules to your applications works in node.js.

Introduction

In this article I will create a simple route in a route.js file and reference it from my app.js. This will demonstrate how to keep the code separated and easier to manage.

The example application

This is a very simple express example with only two routes – the root of the app which says “Hi I am the root” and a second one which says “I am a new route”.

The initial app is a very basic app created using express.

// Startup Express App
var express = require('express');
var app = express();
var http = require('http').Server(app);

http.listen(3000);

// handle HTTP GET request to the "/" URL
app.get('/', function(req, res) {
    res.write("Hi I am the root")
    res.end();

})

Which then produces the following simple page

n1

New routes.js

I created the following file routes.js which will display a message when going to /marky

module.exports = function(app) {

    app.get('/marky', function(req, res) {
        res.write("I am a new route")
        res.end();
    });
}

mobile.exports{} is node.js specific code which allows for code includes in this very manner. For more on this check out this article. Notice that (app) is passed to the function so that it properly scoped to the original code.

Back in the app.js we add a single line to require this new library and that’s it.

// Startup Express App
var express = require('express');
var app = express();
var http = require('http').Server(app);

//include other libraries
var routes = require('./routes')(app); //This is the extra line

http.listen(3000);

// handle HTTP GET request to the "/" URL
app.get('/', function(req, res) {
    res.write("Hi I am the root")
    res.end();

})

n2

Conclusion

More fundamentally than this simple example, this is the core of how node modules (including express) work. When you “require” express or http or any other module within your node application, this is how it is put together. Kinda cool :)

Posted in node.js | Tagged: | 1 Comment »

Creating a sample Hybrid Bluemix environment

Posted by MarkyRoden on April 26, 2015

In this article I will demonstrate how to create a sample Hybrid app running in IBM Bluemix but getting data from behind a company firewall.

Introduction

A couple of years ago the prevailing message from vendors was “move to the cloud !!!”. The thing the vendors found though, was that the companies do not necessarily want to move their “data” to the cloud. It is either too complicated, expensive, unnecessary or they just do not flat out trust their data to the cloud. All that said though they are interested in the ability to securely expose their data to the outside world without exposing any of their internal systems. This has been achieved for years using a DMZ style firewall architecture which exposes only the web server but not the database server to the outside world.

In the Cloud world this concept is called a Hybrid model – cloud app, on premises data. In this article I want to show one way which IBM has approached this in Bluemix.

Reference

I wish I had listened to Ryan Baxter, last year at MWLUG 2014. I heard him talk about this concept and I serious thought to myself – who would want to do that. Being ahead of your time, happens to the best of us. Anyway you can see how Ryan set up his environment at that time using Cast Iron here. This is an excellent video and gives a nice overview of cast iron – that said, it is not the way I am going to do it and not the way IBM wants you to do it any more. So enjoy but come back….

I found most of the information I am going to write about today in this video…https://www.youtube.com/watch?v=pY-FRwGQ_8Y&feature=youtu.be

(For more information on getting started with your first Bluemix application check out this NotesIn9 video)

So Bluemix

Within my Bluemix application I created a simple node application (xominoKnox) and then added the “Secure Gateway” Service.

b1

 

 

b2

 

b3

 

I then created a Jazz Hub Git site and then cloned the repository locally (See this post for more information on that)

Creating the secure gateway

So the way that the gateway works is this:

  1. Create and configure the Bluemix end of the gateway
  2. Install the gateway code on the machine within the firewall
  3. Open the connection from inside the firewall
  4. Configure the connection to access data behind the firewall
  5. Use the connection

So let’s go through those steps one by one and explain what is going on.

1. Create and configure the Bluemix end of the gateway

Click on the Secure Gateway Service from within your Dashboard app view and you will see the configuration screen to create your first Gateway

b4

b5

Click Add Gateway and then you will be prompted to name your Gateway connection

b6

Click Connect it and you will then be presented with the status screen – Not Connected

b7

 

2. Install the gateway code on the machine within the firewall

The computer that you install the gateway on, inside your firewall, does not have to be the destination machine, it does however have to have access to the destination machine. Currently (April 2015) you will need to install a docker container on the machine and then inside of that the bluemix-secure-gateway can be installed. For those people without docker already, go here to get it installed.

NOTE FOR WINDOWS USERS: I had serious issues getting this installed due to the Oracle Virtual Box which has to be installed along with it. If you find that the Virtual box does not install – use this regedit hack to fix it. https://www.virtualbox.org/ticket/11349

This fixed it for me. Follow these step by step:

  1. Uninstall Virtualbox
  2. Uninstall Any Virtual Box Network Adaptors from Device Manager
  3. Go into the registry at: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Network
  4. Change “MaxFilters” from 8 to 20 (decimal)”
  5. Reboot your PC
  6. Install VirtualBox 4.3.X (Run as Administrator)

3. Open the connection from inside the firewall

Once you have docker installed and running (Boot2Docker for windows), copy the commend below into your docker window and run it.

b8

 

You will see the Connected message appear on your Secure Gateway dashboard and the tunnel connected message in the docker window.

b9

The gateway is set up and a secure tunnel from Bluemix to my laptop (behind my office firewall) is set up.

To be clear at this point the outside world cannot access the Copper/xomino server running on my laptop from the outside world. It is just running on my laptop as normal within my development environment.

4. Configure the connection to access data behind the firewall

Next we have to create a destination (behind the firewall). Understand that the docker window is by default bridged and therefore does not know that it is running on my local computer (127.0.0.1).The IP address  I have given Bluemix is the IP address of the laptop on my network.


b10

b12

 

As you can see from the image above a Cloud Host and port has been assigned. If you do this a number of times you will see that the port changes.

You will also note that I chose not to use No TLS in the connection. This means that this is NOT PRODUCTION ready. We really need to secure this so that only my application can call that URL. More on that later – but for the  sake of this article/demo I am leaving it simple.

5. Use the connection

If we connect to the URL shown in the image above we can see a Domino server !!!


b13

 

If we go to a specific page on that server we see this. Not much to look at I grant you, more on that in a later article.

b15

But if we go to the gateway path – and add the “/xomino/ainx.nsf/testForm?readform” to the end of the URL – we get the exact same thing, from the exact same server, just displayed in a cloud app.

b14

And that is very cool! Especially as it only took about 3 hours to figure this out :)

Conclusion

As we have seen in this article, it is relatively simple to set up a secure connection from a computer behind a firewall, and Bluemix. The example show it not yet fully secure though as anyone could call the URL and get web page from my server.

In a future article we will look at securing the connection and what else we are able to do with it.

 

Posted in Bluemix, Docker, Hybrid Application, node.js | 2 Comments »

The two sides of the incremental operator in JavaScript ++

Posted by MarkyRoden on April 19, 2015

I learned this last week, possibly highlighting my non-classical programming training. I have never come across this in all my years of JavaScript and apparently it is pervasive in other languages such as Java as well.

Incremental Operator ++

Many times I have seen or used the following method for incrementing an integer count

var marky = 0;
console.log(++marky);
console.log(marky);

This increments the integer marky by 1. not rocket science. In the image below you can see that the two console.log entries always return the same value

j1

What I learned yesterday was using the ++ after the variable name also increases the variable – but only AFTER the value has been evaluated…

From this image you can see that the marky++ value and the marky value are not the same. The console.log(marky++); returns the existing marky value and then increments it.

j2

var marky = 0;
console.log(marky++);
console.log(marky);

I have to ask myself “why would anyone do that?”. Why would I want to return a variable value and THEN increase it’s value, seems a little odd to me. I guess someone thought it was a good idea…..

Always makes me think “I wonder what else I don’t know? Probably best not think about that too much”….

 

https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Expressions_and_Operators

Posted in JavaScript | Tagged: | 8 Comments »