feed.xml

<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>Okta Developer</title>
    <description>Secure, scalable, and highly available authentication and user management for any app.</description>
    <link>http://developer.okta.com</link>
    <atom:link href="http://developer.okta.com/feed.xml" rel="self" type="application/rss+xml" />
    
      <item>
        <title>How to use KentorIT AuthServices with Okta</title>
        <description>&lt;p&gt;If you’re wondering how to configure an ASP.NET application with &lt;a href=&quot;https://github.com/KentorIT/authservices&quot;&gt;KentorIT’s AuthServices&lt;/a&gt; and Okta, you’ve come to the right place. But before delving into the specifics of how to make Okta work with an SAML-enabled ASP.NET application powered by KentorIT AuthServices, is is worth spending some time going over a critical, but easily fixable issue:&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Important note&lt;/strong&gt; : As of March 22nd, 2016, you have 2 choices:&lt;/p&gt;

&lt;ol&gt;
  &lt;li&gt;
    &lt;p&gt;Either get the source code of the AuthServices assemblies and compile them on your own machine. In this case, no specific adjustment is necessary.&lt;/p&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Or use the v0.17 KentorIT NuGet assemblies. In this case, if you plan to use the SampleApplication project (not the SampleMvcApplication) for testing purposes, make sure you remove the following line from the web.config file:&lt;/p&gt;

    &lt;p&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;requestedAuthnContextclassRef=&quot;Password&quot; comparison=&quot;Minimum&quot; /&amp;gt;&lt;/code&gt;&lt;/p&gt;

    &lt;p&gt;If you don’t, the SP-initiated login flow will fail because Okta won’t manage to deserialize the SAMLRequest parameter (due to a case issue).&lt;/p&gt;
  &lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;Here’s how you should configure an app powered by Kentor AuthServices to make it work with Okta:&lt;/p&gt;

&lt;ol&gt;
  &lt;li&gt;Download the latest version of KentorIT’s AuthServices from &lt;a href=&quot;https://github.com/KentorIT/authservices&quot;&gt;https://github.com/KentorIT/authservices&lt;/a&gt; and open the Kentor.AuthServices.sln solution in Visual Studio.&lt;/li&gt;
  &lt;li&gt;Identify the SampleApplication project and make a note of its URL property:
  &lt;img src=&quot;/assets/img/KentorOkta/VSProjectProperties.png&quot; alt=&quot;Visual Studio Project properties&quot; /&gt;&lt;/li&gt;
  &lt;li&gt;Go to you Okta organization and navigate to Admin =&amp;gt; Applications.&lt;/li&gt;
  &lt;li&gt;Press the &lt;strong&gt;Add Application&lt;/strong&gt; button and the green &lt;strong&gt;Create New App&lt;/strong&gt; button
  &lt;img src=&quot;/assets/img/KentorOkta/CreateNewAppButton.png&quot; alt=&quot;Press the Create a new Okta app&quot; /&gt;&lt;/li&gt;
  &lt;li&gt;Select the &lt;strong&gt;SAML 2.0&lt;/strong&gt; option and press the &lt;strong&gt;Create&lt;/strong&gt; button.
  &lt;img src=&quot;/assets/img/KentorOkta/SAML2Option.png&quot; alt=&quot;Choose the SAML 2.0 template&quot; /&gt;&lt;/li&gt;
  &lt;li&gt;Give your application a name and optionally upload a custom logo. We’ll call it “&lt;strong&gt;Kentor AuthServices App 1&lt;/strong&gt;”
  &lt;img src=&quot;/assets/img/KentorOkta/OktaAppName.png&quot; alt=&quot;Give your Okta app a name&quot; /&gt;&lt;/li&gt;
  &lt;li&gt;Press &lt;strong&gt;Next&lt;/strong&gt;.&lt;/li&gt;
  &lt;li&gt;In the &lt;strong&gt;Single sign on URL&lt;/strong&gt; field, enter the url you retrieved above in step #2 and append “ &lt;strong&gt;/AuthServices/Acs&lt;/strong&gt;”, for instance &lt;strong&gt;http://localhost:18714/SamplePath/AuthServices/Acs&lt;/strong&gt;&lt;/li&gt;
  &lt;li&gt;For the Audience URI field, enter the Url you retrieved above in step #2 and append “ &lt;strong&gt;/AuthServices&lt;/strong&gt;”, for instance &lt;strong&gt;http://localhost:18714/SamplePath/AuthServices&lt;/strong&gt;&lt;/li&gt;
  &lt;li&gt;In the &lt;strong&gt;Name ID format&lt;/strong&gt; field, select the default &lt;strong&gt;Unspecified&lt;/strong&gt; (or select any other value of your choice).&lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Select the &lt;strong&gt;Show Advanced Settings&lt;/strong&gt; link. For the &lt;strong&gt;Signature Algorithm&lt;/strong&gt; field, we suggest that you leave the default value, SHA-256. However, if you do, you will need to add the following line of code to the Application_Start() method of your Global.asax.cs file:&lt;/p&gt;

    &lt;p&gt;&lt;code class=&quot;highlighter-rouge&quot;&gt;Kentor.AuthServices.Configuration.Options.GlobalEnableSha256XmlSignatures();&lt;/code&gt;&lt;/p&gt;

    &lt;p&gt;Otherwise, you may switch to RSA-SHA1 though we do not recommend it (as it less secure than SHA-256).&lt;/p&gt;
  &lt;/li&gt;
  &lt;li&gt;In the Attribute Statements section, optionally enter additional attributes, such as in the following screenshot:
  &lt;img src=&quot;/assets/img/KentorOkta/OptionalAttributeStatements.png&quot; alt=&quot;Optional Attribute Statements&quot; /&gt;&lt;/li&gt;
  &lt;li&gt;Press the &lt;strong&gt;Next&lt;/strong&gt; button. Select the &lt;strong&gt;I’m a software vendor&lt;/strong&gt; option (if you’re indeed a vendor - if you are developing an internal app, select the first option) and press the Finish button.
  &lt;img src=&quot;/assets/img/KentorOkta/VendorOrCustomerOption.png&quot; alt=&quot;Select the customer or vendor option&quot; /&gt;&lt;/li&gt;
  &lt;li&gt;Now edit the web.config file of the SampleApplication project.&lt;/li&gt;
  &lt;li&gt;In the &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;kentor.authServices&amp;gt;&lt;/code&gt; section, enter the following values:
    &lt;ul&gt;
      &lt;li&gt;&lt;strong&gt;entityId&lt;/strong&gt; = same value as the Audience URI for the Okta app, e.g. &lt;a href=&quot;http://localhost:18714/SamplePath/AuthServices&quot;&gt;http://localhost:18714/SamplePath/AuthServices&lt;/a&gt;&lt;/li&gt;
      &lt;li&gt;&lt;strong&gt;returnUrl&lt;/strong&gt; = value of the web application’s url, i.e. &lt;a href=&quot;http://localhost:18714/SamplePath&quot;&gt;http://localhost:18714/SamplePath&lt;/a&gt;&lt;/li&gt;
    &lt;/ul&gt;
  &lt;/li&gt;
  &lt;li&gt;In the &lt;identityProviders&gt; section, enter the following values:
&lt;/identityProviders&gt;    &lt;ul&gt;
      &lt;li&gt;&lt;strong&gt;entityId&lt;/strong&gt; = &lt;strong&gt;Identity Provider Issuer&lt;/strong&gt; from &lt;strong&gt;Sign On&lt;/strong&gt; =&amp;gt; &lt;strong&gt;View Setup Instructions&lt;/strong&gt;
&lt;img src=&quot;/assets/img/KentorOkta/ViewSetupInstructions.png&quot; alt=&quot;View setup instructions&quot; /&gt;
&lt;img src=&quot;/assets/img/KentorOkta/IdentityProviderIssuer.png&quot; alt=&quot;Identity Provider Issuer&quot; /&gt;&lt;/li&gt;
      &lt;li&gt;&lt;strong&gt;signOnUrl&lt;/strong&gt; = value of the &lt;strong&gt;Identity Provider Single Sign-On URL&lt;/strong&gt; below
&lt;img src=&quot;/assets/img/KentorOkta/IdPSSOUrl.png&quot; alt=&quot;Identity Provider Single Sign-On URL&quot; /&gt;&lt;/li&gt;
      &lt;li&gt;In the &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;signingCertificate&amp;gt;&lt;/code&gt; section, download the &lt;strong&gt;okta.cert&lt;/strong&gt; X.509 certificate from the instructions page in the Okta app and put it in the &lt;strong&gt;App_Data&lt;/strong&gt; folder of your web application. Then reference it accordingly (such as with &lt;strong&gt;fileName=”~/App_Data/okta.cert&lt;/strong&gt;”) in the web.config file.&lt;/li&gt;
    &lt;/ul&gt;
  &lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;You should be good to go now! Don’t forget to assign users to your Okta application and test that you can sign in into your SAML application both from the Okta portal (IdP-initiated sign-in flow) and from your SAML application itself (SP-initiated sign-in flow).&lt;/p&gt;

&lt;p&gt;If you run into any issue while using the SP-initiated login flow (when a user clicks on the “Sign In” link of the /SamplePath page), then try to recompile the KentorIT.AuthServices project and make sure it is used by your project. If your project uses v0.17 of the NuGet corresponding library, make sure to comment out any &lt;code class=&quot;highlighter-rouge&quot;&gt;&amp;lt;requestedAuthnContext &amp;gt;&lt;/code&gt; section in your web.config file.&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Happy Okta’ing!&lt;/strong&gt;&lt;/p&gt;
</description>
        <pubDate>Tue, 22 Mar 2016 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2016/03/22/use-kentor-authservices-with-okta</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2016/03/22/use-kentor-authservices-with-okta</guid>
      </item>
    
      <item>
        <title>REST Service Authorization with JWTs</title>
        <description>&lt;p&gt;Many companies are adopting micro-services based architectures to promote
decoupling and separation of concerns in their applications. One inherent
challenge with breaking applications up into small services is that now each
service needs to deal with authenticating and authorizing requests made to it.
&lt;a href=&quot;https://tools.ietf.org/html/rfc7519&quot;&gt;Json Web Tokens (JWTs)&lt;/a&gt; offer a clean
solution to this problem along with
&lt;a href=&quot;/blog/2015/12/02/tls-client-authentication-for-services&quot;&gt;TLS client authentication&lt;/a&gt;
lower down in the stack.&lt;/p&gt;

&lt;p&gt;Wils Dawson and I presented these topics to the &lt;a href=&quot;http://www.meetup.com/sfjava/&quot;&gt;Java User Group&lt;/a&gt;
at Okta’s HQ in December and are thrilled to offer the
&lt;a href=&quot;http://www.slideshare.net/JonTodd1/rest-service-authetication-with-tls-jwts&quot;&gt;slides&lt;/a&gt;,
&lt;a href=&quot;https://github.com/wdawson/dropwizard-auth-example&quot;&gt;code&lt;/a&gt;, and the following
recording of the presentation. In the talk, we cover authentication and
authorization both at a server level with TLS and a user level with OAuth 2.0.
In addition, we explain claims based auth and federation while walking through
demos for these concepts using Java and Dropwizard. We purposely skipped over
client (e.g. browser) side authentication as it’s enough material for a future
talk and focused on solutions for authentication and authorization between
services within an application.&lt;/p&gt;

&lt;iframe src=&quot;https://player.vimeo.com/video/150714428&quot; width=&quot;500&quot; height=&quot;281&quot; frameborder=&quot;0&quot; webkitallowfullscreen=&quot;&quot; mozallowfullscreen=&quot;&quot; allowfullscreen=&quot;&quot;&gt;&lt;/iframe&gt;
</description>
        <pubDate>Tue, 05 Jan 2016 00:00:00 -0800</pubDate>
        <link>http://developer.okta.com/blog/2016/01/05/rest-service-auth-jwt</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2016/01/05/rest-service-auth-jwt</guid>
      </item>
    
      <item>
        <title>Demystifying OAuth</title>
        <description>&lt;p&gt;It seems that OAuth 2.0 is everywhere these days. Whether you are building a hot new single page web application (SPA), a native mobile experience, or just trying to integrate with the API economy, you can’t go far without running into the popular authorization framework for REST/APIs and social authentication.&lt;/p&gt;

&lt;p&gt;During &lt;a href=&quot;https://www.okta.com/oktane15/&quot;&gt;Oktane15&lt;/a&gt;, &lt;a href=&quot;https://www.linkedin.com/in/karlmcguinness&quot;&gt;Karl McGuinness&lt;/a&gt;, our Senior Director of Identity, demystified the powerful, yet often misunderstood, world of OAuth 2.0 and shared details on Okta’s growing support for &lt;a href=&quot;http://openid.net/connect/&quot;&gt;OpenID Connect&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;&lt;a href=&quot;http://www.slideshare.net/karl_mcguinness/demystifying-oauth-20&quot;&gt;Slides&lt;/a&gt;&lt;/p&gt;

&lt;iframe src=&quot;https://player.vimeo.com/video/148164438&quot; width=&quot;500&quot; height=&quot;281&quot; frameborder=&quot;0&quot; webkitallowfullscreen=&quot;&quot; mozallowfullscreen=&quot;&quot; allowfullscreen=&quot;&quot;&gt;&lt;/iframe&gt;
</description>
        <pubDate>Mon, 07 Dec 2015 00:00:00 -0800</pubDate>
        <link>http://developer.okta.com/blog/2015/12/07/oauth</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/12/07/oauth</guid>
      </item>
    
      <item>
        <title>TLS Client Authentication for Internal Services</title>
        <description>&lt;p&gt;If you’re like me, the most aggravating thing is finding a Stack Overflow
question that exactly describes the issue you are facing, only to scroll down
and see that it has remained unanswered since 2011. I was recently trying to
configure Transport Layer Security (TLS) &lt;a href=&quot;https://en.wikipedia.org/wiki/Transport_Layer_Security#Client-authenticated_TLS_handshake&quot;&gt;client
authentication&lt;/a&gt;
(also referred to as mutual SSL) between two internal services at Okta and
found the lack of complete examples astonishing. I hope that this blog post
provides a better understanding of how to accomplish client authentication in
your applications and makes all that hard security stuff a bit easier.&lt;/p&gt;

&lt;h2 id=&quot;tls-background&quot;&gt;TLS Background&lt;/h2&gt;

&lt;p&gt;In a normal TLS handshake, the server sends its certificate to the client so
that the client can verify the authenticity of the server. It does this by
following the certificate chain that issued the server’s certificate until it
arrives at a certificate that it trusts. If the client reaches the end of the
chain without finding a certificate that it trusts, it will reject the
connection. For an example of what a server might send, see &lt;a href=&quot;https://gist.github.com/jpf/9282d558bcc105ae8e1a&quot;&gt;this
gist&lt;/a&gt;.&lt;/p&gt;

&lt;p style=&quot;text-align: center&quot;&gt;&lt;img src=&quot;/assets/img/2015-10-29-tls-client-authentication-for-services-tls-handshake.png&quot; alt=&quot;TLS handshake&quot; width=&quot;540px&quot; /&gt;&lt;/p&gt;

&lt;p style=&quot;text-align: center;font-size: x-small;&quot;&gt;Image reprinted with permission from
&lt;a href=&quot;https://blog.cloudflare.com/protecting-the-origin-with-tls-authenticated-origin-pulls/&quot;&gt;CloudFlare&lt;/a&gt;&lt;/p&gt;

&lt;p&gt;In mutual SSL, the client also sends its certificate to the server
for the server to authenticate along with an additional message (called the
CertificateVerify message), which assures the server that the client is the true
owner of the certificate. The server follows the same process of checking the
certificate chain until it finds one it trusts, refusing the connection if it
can’t find such a certificate.&lt;/p&gt;

&lt;p&gt;So why is that useful? You probably interact with typical TLS all the time in
your browser. For example, when you visit &lt;a href=&quot;https://www.okta.com&quot;&gt;https://www.okta.com&lt;/a&gt;, your browser
is verifying that the server serving Okta’s site is authentic (that it’s not
impersonating a legitimate Okta server). But Okta’s server has no idea who your
browser is. In this case it doesn’t care too much, so it lets you connect.&lt;/p&gt;

&lt;p&gt;When we start talking about services talking to each other, authenticating the
client becomes important because it lowers the risk of our servers divulging
information to machines impersonating our services. For example, let’s say we
have a service called the User Service that holds all the information about
users in our application. We have another service called the Home Page Service
that serves up the home page to the browser. The home page has the user’s name,
email, phone number, and other personal information. The Home Page Service needs
to talk to the User Service to get the user’s name to display on the page. In
this case, the Home Page Service is the client and the User Service is the
server. If we only used normal TLS, only the User Service would be
authenticated! We need TLS client authentication to make sure the User Service
doesn’t provide data to a random client.&lt;/p&gt;

&lt;h2 id=&quot;implementing-tls-client-authentication&quot;&gt;Implementing TLS Client Authentication&lt;/h2&gt;

&lt;p&gt;In our case, the client and server are internal services communicating with each
other. I won’t cover configuring a browser client or other clients that may be
not under your control. In this post, I’ll give examples for the technology we
use at Okta. Specifically, we use &lt;a href=&quot;http://www.dropwizard.io/&quot;&gt;Dropwizard&lt;/a&gt; as
the server framework and &lt;a href=&quot;https://jersey.java.net/&quot;&gt;Jersey&lt;/a&gt; for the client
framework. We’ll also use Java’s
&lt;a href=&quot;https://docs.oracle.com/javase/8/docs/technotes/tools/unix/keytool.html&quot;&gt;keytool&lt;/a&gt;
for building the key and trust stores in Java KeyStore (JKS) format. The
examples below use these technologies, but I hope they’ll be fairly transferable
to choices you make in your applications. In addition, these samples are not
meant to be complete, so you may need to modify them to fit in your environment.&lt;/p&gt;

&lt;h3 id=&quot;certificates-and-key-stores&quot;&gt;Certificates and Key Stores&lt;/h3&gt;

&lt;p style=&quot;text-align: center&quot;&gt;&lt;img src=&quot;/assets/img/2015-10-29-tls-client-authentication-for-services-ca-chain.png&quot; alt=&quot;CA heirarchy&quot; width=&quot;540px&quot; /&gt;&lt;/p&gt;

&lt;p&gt;First, let’s setup our trust store, which is just a key store that will only
contain certificates. Let’s assume we have a layered Certificate Authority (CA)
structure, like the image above, with a root CA and a subordinate global CA. The
root CA has its private key stored offline and its certificate is the one we
want our services to trust. The root certificate is the &lt;em&gt;only&lt;/em&gt; certificate we
want our services to trust on that channel. We don’t even want a certificate
issued by a reputable 3rd party CA to be trusted by our service. So our trust
store will contain only the root certificate, which means the server will only
establish connections from clients that have a certificate issued by the root CA
or its child, the global CA, which will be the issuer of our server’s
certificate. This way, it’s quite easy to rotate our server’s certificate,
either when it expires or if it is somehow compromised; we can just change it on
that service and don’t have to worry about the other services it communicates
with losing trust because they trust the root. If all our services trusted each
other explicitly, the rotation would be much more difficult, especially if you
can’t take downtime. We’ll use the trust store for both the client and the
server, so you only need to make one, which you can copy if you need to.&lt;/p&gt;

&lt;div class=&quot;language-shell highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;c&quot;&gt;# Import your root certificate into a new trust store and follow the prompts&lt;/span&gt;
keytool -import -alias root -file root.crt -keystore truststore.jks
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p&gt;Now that we’ve set up trust, we want to issue the certificate for our service
that chains up to the root. We’ll use the global CA to issue our server its
certificate, and since the global CA’s certificate is issued by the root CA,
we have a chain of trust. When we create the server’s certificate, we’ll include
the chain as well for clients to verify. The &lt;a href=&quot;http://tools.ietf.org/html/rfc5246#section-7.4.2&quot;&gt;TLS
standard&lt;/a&gt; specifies that the
certificate chain does not require the actual root of trust since the endpoints
will have it already, so we’ll omit it to save bandwidth. Once we have the
certificate we’ll put it in a JKS for our Dropwizard application to use. If
your client does not have a certificate for service-to-service communication,
you can follow a similar pattern to create its certificate. But if it does have
an existing certificate, you can just reuse that one.&lt;/p&gt;

&lt;div class=&quot;language-shell highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;c&quot;&gt;# Create our server&#39;s key&lt;/span&gt;
openssl genrsa -out server.key 2048

&lt;span class=&quot;c&quot;&gt;# Create the csr and follow the prompts for country code, ou, etc&lt;/span&gt;
openssl req -new -key server.key -sha256 -out server.csr

&lt;span class=&quot;c&quot;&gt;# Sign the csr with your CA&lt;/span&gt;
openssl ca -in server.csr -days 365 -config my-ca-conf.cnf -out server.crt

&lt;span class=&quot;c&quot;&gt;# Cat the cert chain together (except the root)&lt;/span&gt;
cat server.crt global.crt &amp;gt; chain.crt

&lt;span class=&quot;c&quot;&gt;# Create pkcs12 file for key and cert chain&lt;/span&gt;
openssl pkcs12 -export -name server-tls -in chain.crt -inkey server.key -out server.p12

&lt;span class=&quot;c&quot;&gt;# Create JKS for server&lt;/span&gt;
keytool -importkeystore -destkeystore keystore.jks -srckeystore server.p12 -srcstoretype pkcs12 -alias server-tls
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;h3 id=&quot;server-configuration&quot;&gt;Server Configuration&lt;/h3&gt;

&lt;p&gt;Now that we have our key and trust stores, let’s configure the server’s
Dropwizard application connector.&lt;/p&gt;

&lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;server&lt;/span&gt;:
  &lt;span class=&quot;n&quot;&gt;applicationConnectors&lt;/span&gt;:
    - &lt;span class=&quot;n&quot;&gt;type&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;https&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;port&lt;/span&gt;: &lt;span class=&quot;m&quot;&gt;8443&lt;/span&gt;

    &lt;span class=&quot;c&quot;&gt;# Key store settings
&lt;/span&gt;    &lt;span class=&quot;n&quot;&gt;keyStorePath&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;path&lt;/span&gt;/&lt;span class=&quot;n&quot;&gt;to&lt;/span&gt;/&lt;span class=&quot;n&quot;&gt;keystore&lt;/span&gt;.&lt;span class=&quot;n&quot;&gt;jks&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;keyStorePassword&lt;/span&gt;: &lt;span class=&quot;s2&quot;&gt;&quot;notsecret&quot;&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;certAlias&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;server&lt;/span&gt;-&lt;span class=&quot;n&quot;&gt;tls&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;enableCRLDP&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;true&lt;/span&gt;

    &lt;span class=&quot;c&quot;&gt;# Trust store settings
&lt;/span&gt;    &lt;span class=&quot;n&quot;&gt;trustStorePath&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;path&lt;/span&gt;/&lt;span class=&quot;n&quot;&gt;to&lt;/span&gt;/&lt;span class=&quot;n&quot;&gt;truststore&lt;/span&gt;.&lt;span class=&quot;n&quot;&gt;jks&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;trustStorePassword&lt;/span&gt;: &lt;span class=&quot;s2&quot;&gt;&quot;notsecret&quot;&lt;/span&gt;

    &lt;span class=&quot;c&quot;&gt;# Fail fast at startup if the certificates are invalid
&lt;/span&gt;    &lt;span class=&quot;n&quot;&gt;validateCerts&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;true&lt;/span&gt;

    &lt;span class=&quot;c&quot;&gt;# Whether or not to require authentication by peer certificate.
&lt;/span&gt;    &lt;span class=&quot;n&quot;&gt;needClientAuth&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;true&lt;/span&gt;

    &lt;span class=&quot;c&quot;&gt;# Check peer certificates for validity when establishing a connection
&lt;/span&gt;    &lt;span class=&quot;n&quot;&gt;validatePeers&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;true&lt;/span&gt;

    &lt;span class=&quot;c&quot;&gt;# The list of supported SSL/TLS protocols. You may need to modify
&lt;/span&gt;    &lt;span class=&quot;c&quot;&gt;# this section to support clients that you have.
&lt;/span&gt;    &lt;span class=&quot;n&quot;&gt;supportedProtocols&lt;/span&gt;: [&lt;span class=&quot;s2&quot;&gt;&quot;TLSv1.2&quot;&lt;/span&gt;]
    &lt;span class=&quot;n&quot;&gt;supportedCipherSuites&lt;/span&gt;: [&lt;span class=&quot;s2&quot;&gt;&quot;TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384&quot;&lt;/span&gt;]
    &lt;span class=&quot;n&quot;&gt;allowRenegotiation&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;false&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p style=&quot;text-align: center;font-size: x-small;&quot;&gt;Dropwizard code is Copyright © 2010-2013 Coda Hale, Yammer Inc., 2014-2015 Dropwizard Team and/or its affiliates.
&lt;a href=&quot;http://www.apache.org/licenses/LICENSE-2.0.html&quot;&gt;Apache 2.0&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;That was pretty easy, huh? No cryptic OpenSSL commands! Now our server should be
configured to refuse connections from clients not presenting a root issued
certificate chain. We can test to make sure that happens! We can start our
server, telling Java to debug the SSL handshakes, and make sure we see it
refusing the connection for the right reason. In one terminal start the
Dropwizard server debugging SSL.&lt;/p&gt;

&lt;div class=&quot;language-shell highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;gp&quot;&gt;$ &lt;/span&gt;java -Djavax.net.debug&lt;span class=&quot;o&quot;&gt;=&lt;/span&gt;SSL,keymanager,trustmanager -jar your/jar.jar server config.yml
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p&gt;In another terminal run the following curl commands and verify you get the
expected results. First, make sure that the server does not talk HTTP over our
port.&lt;/p&gt;

&lt;div class=&quot;language-shell highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;gp&quot;&gt;$ &lt;/span&gt;curl localhost:443
curl: &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;52&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; Empty reply from server

&lt;span class=&quot;c&quot;&gt;# The server should print something like the following because of no TLS:&lt;/span&gt;
&lt;span class=&quot;c&quot;&gt;# javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p&gt;Next, check that the server is sending your certificate back over HTTPS.
curl has a preconfigured list of trusted certs and chances are your
root certificate is not in there.&lt;/p&gt;

&lt;div class=&quot;language-shell highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;gp&quot;&gt;$ &lt;/span&gt;curl https://localhost:443
curl: &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;60&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; SSL certificate problem: Invalid certificate chain

&lt;span class=&quot;c&quot;&gt;# The server will print a bunch of stuff ending with something like:&lt;/span&gt;
&lt;span class=&quot;c&quot;&gt;# javax.net.ssl.SSLException: Received close_notify during handshake&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p&gt;Finally, ensure that the server terminates the connection if no client cert is
provided.&lt;/p&gt;

&lt;div class=&quot;language-shell highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;gp&quot;&gt;$ &lt;/span&gt;curl -k https://localhost:443
curl: &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;35&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; Server aborted the SSL handshake

&lt;span class=&quot;c&quot;&gt;# The server will, again, print a bunch of stuff ending with something like:&lt;/span&gt;
&lt;span class=&quot;c&quot;&gt;# javax.net.ssl.SSLHandshakeException: null cert chain&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;h3 id=&quot;client-configuration&quot;&gt;Client Configuration&lt;/h3&gt;

&lt;p&gt;Now we’ll configure our client to talk to the server. I’ll use the Jersey 2.X
API, but there are equivalents in the 1.X as well as in the Apache HTTP library.&lt;/p&gt;

&lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;c1&quot;&gt;// Assume the following variables are initialized already&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;String&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;password&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;RSAPrivateKey&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientKey&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;X509Certificate&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientCert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;X509Certificate&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;globalCert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;X509Certificate&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;rootCert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;n&quot;&gt;X509Certificate&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[]&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;certChain&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;clientCert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;globalCert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;};&lt;/span&gt;

&lt;span class=&quot;c1&quot;&gt;// setup key store&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;KeyStore&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientKeyStore&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;KeyStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getInstance&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;JKS&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;clientKeyStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;load&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;kc&quot;&gt;null&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;password&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;toCharArray&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;());&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;clientKeyStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;setKeyEntry&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;service-tls&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientKey&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;password&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;toCharArray&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(),&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;certChain&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;

&lt;span class=&quot;c1&quot;&gt;// setup trust store&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;KeyStore&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientTrustStore&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;KeyStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getInstance&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;JKS&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;clientTrustStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;load&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;kc&quot;&gt;null&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;password&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;toCharArray&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;());&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;clientTrustStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;setCertificateEntry&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;root-ca&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;rootCert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;

&lt;span class=&quot;c1&quot;&gt;// setup Jersey client&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;SslConfigurator&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;sslConfig&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;SslConfigurator&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;newInstance&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;keyStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;clientKeyStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;keyStorePassword&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;password&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;keyPassword&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;password&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;

        &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;trustStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;clientTrustStore&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;trustStorePassword&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;password&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;

        &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;securityProtocol&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;TLSv1.2&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;

&lt;span class=&quot;n&quot;&gt;SSLContext&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;sslContext&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;sslConfig&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;createSSLContext&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;Client&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;client&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;ClientBuilder&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;newBuilder&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;().&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;sslContext&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;sslContext&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;).&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;build&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p style=&quot;text-align: center;font-size: x-small;&quot;&gt;Jersey code is Copyright © 2010-2015 Oracle and/or its affiliates.
&lt;a href=&quot;https://jersey.java.net/license.html&quot;&gt;GPL 2.0 Selected&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;Hooray authentication!&lt;/p&gt;

&lt;p style=&quot;text-align: center&quot;&gt;&lt;a href=&quot;https://xkcd.com/1121/&quot;&gt;&lt;img src=&quot;http://imgs.xkcd.com/comics/identity.png&quot; alt=&quot;xkcd-identity&quot; /&gt;&lt;/a&gt;&lt;/p&gt;

&lt;p style=&quot;text-align: center;font-size: x-small;&quot;&gt;Comic is Copyright © &lt;a href=&quot;https://xkcd.com&quot;&gt;xkcd.com&lt;/a&gt;.
&lt;a href=&quot;http://creativecommons.org/licenses/by-nc/2.5/&quot;&gt;CC BY-NC 2.5&lt;/a&gt;.&lt;/p&gt;

&lt;h2 id=&quot;tightening-things-up&quot;&gt;Tightening Things Up&lt;/h2&gt;

&lt;p&gt;Now we are just granting any service with a certificate signed by our root CA to
talk to our server. Chances are we’d like to trim this down to only clients that
should be talking to the server so we can refuse some other service that has
no business with our server even though it has a certificate issued by our root
CA. This is useful for preventing another service we have from accessing our new
service. For example, suppose in addition to a User Service and a Home Page
Service, we have an Event Service. We may want to block the Event Service from
communicating with the User Service while allowing the Home Page Service to do
that communication.&lt;/p&gt;

&lt;p&gt;To accomplish this, we could change our server’s trust store to only contain the
public key of the client, but this presents problems (and more work) when we try
to rotate that key pair. So, instead, let’s try having the server check that the
hostname of the client is one that it expects to hear from. We can also do this
in the other direction (client verifying the server).&lt;/p&gt;

&lt;p&gt;Several options exist for verifying the hostname on the server side. The first
is one that Dropwizard supports this verification with a tricky configuration
change for the underlying Java SSL connection.&lt;/p&gt;

&lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;server&lt;/span&gt;:
  &lt;span class=&quot;n&quot;&gt;applicationConnectors&lt;/span&gt;:
    - &lt;span class=&quot;n&quot;&gt;type&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;https&lt;/span&gt;
      &lt;span class=&quot;c&quot;&gt;#...
&lt;/span&gt;      &lt;span class=&quot;n&quot;&gt;endpointIdentificationAlgorithm&lt;/span&gt;: &lt;span class=&quot;n&quot;&gt;HTTPS&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p&gt;The HTTPS endpoint identification algorithm will cause Java to do hostname
verification against your cert. Specifically, this will check the hostname of
the client that made the request against the DN that is given in the client’s
certificate. If they do not match, the connection will be refused. This is a
great, &lt;a href=&quot;http://tools.ietf.org/html/rfc2818#section-3.1&quot;&gt;standard&lt;/a&gt; way to solve
this problem, however it can be tricky to know what the hostnames will be or to
make a wildcard pattern (or &lt;a href=&quot;https://tools.ietf.org/html/rfc3280#section-4.2.1.7&quot;&gt;subject alternative name
extension&lt;/a&gt;) for your
clients. We can take a higher-level approach than hostname comparison.&lt;/p&gt;

&lt;p&gt;We can, instead, provide our server with a regular expression that matches the
DNs that we expect in our certificates. This means we no longer have to worry
about hostnames. So as services move from host to host, they can keep the same
certificate and everything will Just Work™.
Additionally, a certificate can belong to a service rather than an individual
host now so there’s less management that needs to happen. To do this, we just
need to set up a filter in our server and configure a regex to match the DN in
the certificate(s) that are allowed to communicate with our service or else
return a 403 response.&lt;/p&gt;

&lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.annotation.Priority&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.servlet.http.HttpServletRequest&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.ws.rs.Priorities&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.ws.rs.container.ContainerRequestContext&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.ws.rs.container.ContainerRequestFilter&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.ws.rs.container.PreMatching&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.ws.rs.core.Context&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.ws.rs.core.Response&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;java.io.IOException&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;java.security.cert.X509Certificate&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;java.util.regex.Pattern&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;cm&quot;&gt;/**
* A ContainerRequestFilter to do certificate validation beyond the tls validation.
* For example, the filter matches the subject against a regex and will 403 if it doesn&#39;t match
*
* @author &amp;lt;a href=&quot;mailto:wdawson@okta.com&quot;&amp;gt;wdawson&amp;lt;/a&amp;gt;
*/&lt;/span&gt;
&lt;span class=&quot;nd&quot;&gt;@PreMatching&lt;/span&gt;
&lt;span class=&quot;nd&quot;&gt;@Priority&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Priorities&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;AUTHENTICATION&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;CertificateValidationFilter&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;implements&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;ContainerRequestFilter&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;

    &lt;span class=&quot;kd&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;static&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;final&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;String&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;X509_CERTIFICATE_ATTRIBUTE&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;s&quot;&gt;&quot;javax.servlet.request.X509Certificate&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;kd&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;final&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Pattern&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;dnRegex&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;c1&quot;&gt;// Although this is a class level field, Jersey actually injects a proxy&lt;/span&gt;
    &lt;span class=&quot;c1&quot;&gt;// which is able to simultaneously serve more requests.&lt;/span&gt;
    &lt;span class=&quot;nd&quot;&gt;@Context&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;HttpServletRequest&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;request&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;cm&quot;&gt;/**
     * Constructor for the CertificateValidationFilter.
     *
     * @param dnRegex The regular expression to match subjects of certificates with.
     *                E.g.: &quot;^CN=service1\.example\.com$&quot;
     */&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;CertificateValidationFilter&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;String&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;dnRegex&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;k&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;dnRegex&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Pattern&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;compile&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;dnRegex&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;

    &lt;span class=&quot;nd&quot;&gt;@Override&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;filter&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;ContainerRequestContext&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;requestContext&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;throws&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;IOException&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;X509Certificate&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[]&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;certificateChain&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;X509Certificate&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[])&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;request&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getAttribute&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;X509_CERTIFICATE_ATTRIBUTE&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;

        &lt;span class=&quot;k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;certificateChain&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;==&lt;/span&gt; &lt;span class=&quot;kc&quot;&gt;null&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;certificateChain&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;length&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;==&lt;/span&gt; &lt;span class=&quot;mi&quot;&gt;0&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;||&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;certificateChain&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;mi&quot;&gt;0&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;]&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;==&lt;/span&gt; &lt;span class=&quot;kc&quot;&gt;null&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
            &lt;span class=&quot;n&quot;&gt;requestContext&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;abortWith&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;buildForbiddenResponse&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;No certificate chain found!&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;));&lt;/span&gt;
            &lt;span class=&quot;k&quot;&gt;return&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;

        &lt;span class=&quot;c1&quot;&gt;// The certificate of the client is always the first in the chain.&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;X509Certificate&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientCert&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;certificateChain&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[&lt;/span&gt;&lt;span class=&quot;mi&quot;&gt;0&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;];&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;String&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientCertDN&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;clientCert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getSubjectDN&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;().&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getName&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

        &lt;span class=&quot;k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(!&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;dnRegex&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;matcher&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;clientCertDN&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;).&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;matches&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;())&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
            &lt;span class=&quot;n&quot;&gt;requestContext&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;abortWith&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;buildForbiddenResponse&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;Certificate subject is not recognized!&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;));&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;

    &lt;span class=&quot;kd&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Response&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;buildForbiddenResponse&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;String&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;message&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;reutrn&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Response&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;status&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Response&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;Status&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;FORBIDDEN&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
                &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;entity&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;{\&quot;message\&quot;:\&quot;&quot;&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;+&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;message&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;+&lt;/span&gt; &lt;span class=&quot;s&quot;&gt;&quot;\&quot;}&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
                &lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;build&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
&lt;/div&gt;

&lt;p style=&quot;text-align: center;font-size: x-small;&quot;&gt;Dropwizard code is Copyright © 2010-2013 Coda Hale, Yammer Inc., 2014-2015 Dropwizard Team and/or its affiliates.
&lt;a href=&quot;http://www.apache.org/licenses/LICENSE-2.0.html&quot;&gt;Apache 2.0&lt;/a&gt;.
Jersey code is Copyright © 2010-2015 Oracle and/or its affiliates.
&lt;a href=&quot;https://jersey.java.net/license.html&quot;&gt;GPL 2.0 Selected&lt;/a&gt;.&lt;/p&gt;

&lt;h2 id=&quot;circling-back&quot;&gt;Circling Back&lt;/h2&gt;

&lt;p&gt;We defined TLS client authentication and went over how it can help secure your
backend services. We walked through configuring a Dropwizard server with
mandatory TLS client authentication and creating a Jersey client to provide the
appropriate credentials when talking to that server. We also talked about
options to further restrict clients’ ability to talk to the server based on
their certificates. I hope you have a better understanding of how to implement
mutual SSL in your applications. Below are a few things to also keep in mind as
you implement these authentication concepts in your applications.&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Transport_Layer_Security#Security&quot;&gt;TLS Protocol Security&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Transport_Layer_Security#Cipher&quot;&gt;Cipher Suites&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Authentication#Authorization&quot;&gt;Authorization&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;https://www.java.com/en/download/faq/release_dates.xml&quot;&gt;JVM Security Updates&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;h4 id=&quot;references&quot;&gt;References&lt;/h4&gt;
&lt;ol&gt;
  &lt;li&gt;&lt;a href=&quot;https://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html&quot;&gt;Common keytool commands&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;https://www.sslshopper.com/article-most-common-openssl-commands.html&quot;&gt;Common openssl commands&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;http://www.dropwizard.io/0.7.0/docs/manual/configuration.html#man-configuration-https&quot;&gt;Dropwizard https configuration manual&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;https://jersey.java.net/documentation/latest/client.html#d0e5128&quot;&gt;Jersey client documentation&lt;/a&gt;&lt;/li&gt;
&lt;/ol&gt;

&lt;p style=&quot;text-align: center;font-size: x-small;&quot;&gt;Copyright © 2015 Okta, Inc. article licensed under
&lt;a href=&quot;http://creativecommons.org/licenses/by-sa/3.0/&quot;&gt;CC BY-SA 3.0&lt;/a&gt; and code samples
licensed under &lt;a href=&quot;http://www.apache.org/licenses/LICENSE-2.0&quot;&gt;Apache 2.0&lt;/a&gt;. All
rights reserved.&lt;/p&gt;
</description>
        <pubDate>Wed, 02 Dec 2015 00:00:00 -0800</pubDate>
        <link>http://developer.okta.com/blog/2015/12/02/tls-client-authentication-for-services</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/12/02/tls-client-authentication-for-services</guid>
      </item>
    
      <item>
        <title>The New Age of Trust</title>
        <description>&lt;p&gt;I recently read an excellent &lt;a href=&quot;http://www.viabilify.com/blog/trust&quot;&gt;article&lt;/a&gt; about how amazing products shape the &lt;strong&gt;trust relationship&lt;/strong&gt; with customers. I think great products are the &lt;em&gt;first step&lt;/em&gt; in building a trust relationship. And like other aspects of the product that are derived from the product but are not physically part of it, the trust relationship is now more important than ever before.&lt;/p&gt;

&lt;hr /&gt;

&lt;blockquote&gt;
  &lt;p&gt;When you use a product, every engagement with that product has a direct correlation with your perception of the value of that product. — From &lt;a href=&quot;http://www.viabilify.com/blog/trust&quot;&gt;Product Loyalty Follows Trust Like Form Follows Function&lt;/a&gt;&lt;/p&gt;
&lt;/blockquote&gt;

&lt;hr /&gt;

&lt;p&gt;These days, making sure your product solves problems that customers face everyday is not just a &lt;em&gt;good idea&lt;/em&gt;, it’s &lt;strong&gt;table stakes&lt;/strong&gt;. And the bar is rising constantly. The more products improve, the less customers are willing to tolerate bad experiences. With the consumerization of the enterprise, the importance of product design and favorable user experiences is indispensable to every kind of product distribution model.&lt;/p&gt;

&lt;p&gt;Two of the most important aspects of the product are Product Status/Trust and Customer Support. Having dissected both of these from many angles in my recent work, I know that businesses neglect them at their peril.&lt;/p&gt;

&lt;p&gt;###Communicate transparently&lt;/p&gt;

&lt;p&gt;The Product Status/Trust page is the first place customers visit on your site when they have a problem. Consider yourself lucky if the customer only had an problem with a browser (like cache), or an issue with their laptop. For more serious issues, customers expect transparency and effective communication from the Product Status/Trust page. They want information that communicates exactly what the problem is. &lt;/p&gt;

&lt;p&gt;###Serve multiple audiences
A Product Status/Trust page is also one of the first places that prospects are likely to visit. In fact, when the product is gaining momentum, prospect traffic may exceed customer traffic. &lt;/p&gt;

&lt;p&gt;I’ve rarely seen a Status/Trust page actually serve both customers and prospects effectively. The key is to find the correct balance. As the product becomes popular, customers and prospects visit the page with very different mindsets.&lt;/p&gt;

&lt;p&gt;For customers, the Status/Trust page must be the source of truth for issues, downtime, and root cause analysis. This requires radical transparency and effective communication.&lt;/p&gt;

&lt;p&gt;For prospects, the Status/Trust page must do at least the following:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Display all the information they need to make an informed decision&lt;/li&gt;
  &lt;li&gt;Make them love the product even more&lt;/li&gt;
  &lt;li&gt;Serve as an effective talking point for your sales reps&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Once users get their hands on a product, they often find new ways to use it that the founders never imagined. This experimentation can shape the future of products and platforms. This is especially true of products that also provide APIs. The growth of B2B2C, B2C2B and other hybrid distribution models means that you are putting your product in front of many different types of audiences, including direct customers, partners, resellers, channel partners, and early and late stage prospects. Understanding how all of these audiences report on the service, interpret the SLA, and react to downtime is crucial if you want to create products that users value.&lt;/p&gt;

&lt;p&gt;###Be highly available but prepare for risk &lt;/p&gt;

&lt;p&gt;It is a truism that one cannot solve for all technical constraints. Choosing the right platform on which to build your Product and Status/Trust pages is very important, but hosting both pages on the same platform risks both being down at the same time if your site crashes. &lt;/p&gt;

&lt;p&gt;Obviously, you cannot afford to let your Trust/Status page go down, so &lt;strong&gt;high availability&lt;/strong&gt; is key. But just in case the page ever &lt;em&gt;does&lt;/em&gt; go down, you need a &lt;strong&gt;risk mitigation plan&lt;/strong&gt;. Central to this is making sure that you are contsantly monitoring your Trust/Status page with enterprise-class monitoring tools.&lt;/p&gt;

&lt;p&gt;###Send rapid, robust, and consistent notifications
In the event of trust page problems, make sure that you have ways to easily and automatically notify customers and site ops as soon as issues are detected. Employ RSS, Twitter, and other channels to notify customers; invest in monitoring tools to notify site ops.&lt;/p&gt;

&lt;p&gt;If you send notifications manually, take care not to introduce human error when the site is having issues, as these are usually chaotic periods for your ops team.&lt;/p&gt;

&lt;p&gt;Realize that many of your customers will probably check your trust page &lt;em&gt;and&lt;/em&gt; call support, so it’s important that the trust page and the support team provide the same information. This also argues for ensuring that your support team is a key stakeholder in the development of your trust page. &lt;/p&gt;

&lt;p&gt;###Conclusion&lt;/p&gt;

&lt;p&gt;Designing and developing the Trust Page has taught me much in the last few months. I’d be happy to hear from you on this topic, so please feel free to send comments or questions to &lt;a href=&quot;&amp;#109;&amp;#097;&amp;#105;&amp;#108;&amp;#116;&amp;#111;:&amp;#118;&amp;#105;&amp;#109;&amp;#097;&amp;#114;&amp;#115;&amp;#104;&amp;#046;&amp;#107;&amp;#097;&amp;#114;&amp;#098;&amp;#104;&amp;#097;&amp;#114;&amp;#105;&amp;#064;&amp;#111;&amp;#107;&amp;#116;&amp;#097;&amp;#046;&amp;#099;&amp;#111;&amp;#109;&quot;&gt;&amp;#118;&amp;#105;&amp;#109;&amp;#097;&amp;#114;&amp;#115;&amp;#104;&amp;#046;&amp;#107;&amp;#097;&amp;#114;&amp;#098;&amp;#104;&amp;#097;&amp;#114;&amp;#105;&amp;#064;&amp;#111;&amp;#107;&amp;#116;&amp;#097;&amp;#046;&amp;#099;&amp;#111;&amp;#109;&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;&lt;em&gt;The Trust Page is the work of an amazing team that includes Tim Gu, Shawn Gupta, Nathan Tate, Wendy Liao, and myself.&lt;/em&gt;&lt;/p&gt;
</description>
        <pubDate>Thu, 11 Jun 2015 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2015/06/11/trustpage</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/06/11/trustpage</guid>
      </item>
    
      <item>
        <title>How Okta Chased Down Severe System CPU Contention in MySQL</title>
        <description>&lt;p&gt;Sometimes fixing a problem causes or reveals a new one. And sometimes this sets off a chain reaction of problems and fixes, where each solution exposes a deeper issue. In technology, cascades like these are common, often painful, and occasionally welcome.&lt;/p&gt;

&lt;p&gt;Our battle against CPU contention last fall is a good example of such a cascade. What began as a buffer pool adjustment triggered a series of issues and fixes that generated plenty of stress, but ultimately strengthened our platform.&lt;/p&gt;

&lt;p&gt;Underlying each of the challenges we faced in that period was the huge amount of business our Sales organization had closed in late summer and early Fall of 2014. Growth brought a dramatic increase in the number of new customers running large import jobs and new orgs running agents.&lt;/p&gt;

&lt;p&gt;As problems go, growing pains are good problems to have. But they usually come at a cost: the increased traffic caused significant CPU contention, as shown in the following image.&lt;/p&gt;

&lt;p&gt;&lt;img style=&quot;width:55%&quot; src=&quot;/assets/img/Pre-buffer_adjustment.png&quot; alt=&quot;Before tuning the database&quot; /&gt;&lt;/p&gt;

&lt;p&gt;Those red and yellow spikes in late October, 2014 seized our attention and spurred an aggressive response from Okta’s site operations team. The team took immediate action to prevent this situation from getting worse and potentially causing a issue with our site.&lt;/p&gt;

&lt;p&gt;##Tuning the database&lt;/p&gt;

&lt;p&gt;As a first step, we tuned our MySQL database to fully utilize the amount of RAM in our server instances. We had been running with a relatively small buffer pool
compared to the amount of available RAM, which meant that we were sacrificing both performance and money.  Increasing the size of the buffer pool decreased page response times and nearly eliminated disk reads.&lt;/p&gt;

&lt;p&gt;&lt;img style=&quot;width:50%&quot; src=&quot;/assets/img/EliminateDiskReads.png&quot; alt=&quot;Almost eliminated disk reads&quot; /&gt;&lt;/p&gt;

&lt;p&gt;##Doubling hardware resources&lt;/p&gt;

&lt;p&gt;Despite the buffer pool adjustment, we continued to see significant CPU contention. In response, we doubled the size of our servers (244 GB of RAM, 32 CPU cores, and 2 x 320 GB HDDs). CPU contention decreased (see the trough in the following image), but probably because of the Thanksgiving holiday, not the additional hardware.&lt;/p&gt;

&lt;p&gt;After the holiday, CPU spikes returned, now worse than ever. Page render time slowed down, queries against the database took longer, and jobs backed up.&lt;/p&gt;

&lt;p&gt;&lt;img style=&quot;width:50%&quot; src=&quot;/assets/img/Thanksgiving.png&quot; alt=&quot;Thanksgiving holiday&quot; /&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Flat areas in the graph showing no CPU usage indicate periods when we were running on a secondary server.&lt;/p&gt;

&lt;p&gt;Why did CPU contention increase after we’d doubled the CPUs? Shouldn’t it have decreased?&lt;/p&gt;

&lt;p&gt;##Kernel mutex bottleneck&lt;/p&gt;

&lt;p&gt;The alarming amount of yellow in our graphs showed extremely high &lt;strong&gt;system CPU usage&lt;/strong&gt; (and &lt;strong&gt;user CPU usage&lt;/strong&gt; was also too high). Clearly, the operating system was working very hard at &lt;em&gt;something&lt;/em&gt;. The metrics we pulled revealed that all the InnoDB threads were busy waiting on the kernel mutex. We had known that kernel mutex was a bottleneck even before we’d doubled hardware resources, but we hadn’t understood why.&lt;/p&gt;

&lt;p&gt;A closer look at the MySQL source code showed that kernel mutex was trying to allocate memory to all of our transactions. This is perfectly normal behavior, but it proved to be very limiting in our case because we perform approximately 85,000 transactions per minute. The kernel has to create a transaction ID for each transaction and allocate a tiny block of memory in RAM before giving it to the thread handling the transaction.&lt;/p&gt;

&lt;p&gt;Now we knew why doubling the number of CPUs caused greater contention: instead of  providing transaction IDs and associated memory to approximately 24 InnoDB threads, kernel mutex was now working like mad to provide IDs and memory to approximately 48 InnoDB threads. Imagine having a single toll booth on a 16 lane highway and then &lt;em&gt;doubling the number of lanes&lt;/em&gt;.&lt;/p&gt;

&lt;p&gt;In the discussions that followed, some called for rolling back to the smaller machines, reasoning that fewer threads would mean less CPU contention. Others believed that rolling backward would be a mistake, arguing that our business growth required the more powerful servers in any case, and that doubling the number of CPUs was not itself a problem, but rather part of the ultimate solution because it exposed the root cause of the extreme system CPU usage.&lt;/p&gt;

&lt;p&gt;The right course – the one we ultimately took – was to stick with the more powerful servers and tune them properly.&lt;/p&gt;

&lt;p&gt;##Adopting TCMalloc&lt;/p&gt;

&lt;p&gt;We quickly found several resources online, including a &lt;a href=&quot;http://goog-perftools.sourceforge.net/doc/tcmalloc.html&quot;&gt;key blog post&lt;/a&gt; about &lt;strong&gt;TCMalloc&lt;/strong&gt; (Thread-Caching Memory Allocation) and an article about &lt;a href=&quot;http://www.olivierdoucet.info/blog/2012/05/19/debugging-a-mysql-stall/&quot;&gt;debugging MySQL&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;Traditional memory allocation schemes, like the &lt;strong&gt;glibc&lt;/strong&gt; malloc that we were then using, employ a mutex to prevent concurrent access to the transaction ID counter.  Preventing concurrency is totally wrong for a multi-core, multi-thread architecture like ours.&lt;/p&gt;

&lt;p&gt;In contrast, TCMalloc allocates a small pool of memory to each CPU core. Individual processor threads obtain RAM directly from their core, ideally from the L2 cache nearest the thread’s section of the CPU. This sounded promising, so we switched to TCMalloc.&lt;/p&gt;

&lt;p&gt;Following the switch, things looked pretty good. User CPU decreased dramatically, never to return to the +50% usage we’d seen before.  We had finally solved the memory allocation bottleneck. If we hadn’t doubled the number of CPUs, we wouldn’t have found the problem that lead us to adopt TCMalloc.&lt;/p&gt;

&lt;p&gt;&lt;em&gt;Had we finally solved our scalability problem?&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;##Transparent Huge Pages: Thanks for your help…please don’t help&lt;/p&gt;

&lt;p&gt;By the next morning &lt;strong&gt;CPU contention was worse&lt;/strong&gt;.&lt;/p&gt;

&lt;p&gt;The alarmingly high system CPU usage that we’d seen in the previous 3 months was always due to MySQL using kernel mutex. But since we’d fixed that problem, &lt;em&gt;what the heck was this?&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;We discussed turning off TCMalloc, but that would’ve been a mistake. Implementing TCMalloc was a critical link in the chain of problems and solutions that ultimately strengthened our platform.&lt;/p&gt;

&lt;p&gt;We discovered very quickly that the culprit this time was a &lt;em&gt;khugepaged&lt;/em&gt; enabled by a Linux kernel flag called &lt;strong&gt;Transparent Huge Pages&lt;/strong&gt; (THP; turned on by default in most Linux distributions). Huge pages are designed to improve performance by helping the operating system manage large amounts of memory. They effectively increase the page size from the standard 4kb to 2MB or 1Gb (depending on how it is configured).&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;THP&lt;/strong&gt; makes huge pages easier to use by, among other things, arranging your memory into larger chunks.  It works great for app servers that are not performing memory-intensive operations.&lt;/p&gt;

&lt;p&gt;Which is why THP is so wrong for our platform. By late 2014 we were using 95% of the RAM and 58% of the 32 CPU cores in our servers . In order to store all of those tiny transaction IDs, we were rewriting memory so rapidly that THP’s efforts to move pages around couldn’t keep up. Clearly, standard 4kb blocks were much more efficient for us than the larger page size that THP was “helping” us with. So we turned THP off. The following image tells the story.&lt;/p&gt;

&lt;p&gt;&lt;img style=&quot;width:40%&quot; src=&quot;/assets/img/TCMalloc.png&quot; alt=&quot;TCMalloc&quot; /&gt;&lt;/p&gt;

&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Flat areas in the graph showing no CPU usage indicate periods when we were running on a secondary server.&lt;/p&gt;

&lt;p&gt;In a sense, encountering the dramatic effect of THP, an operating system problem, was clarifying. It validated our previous remedies, and turning it off definitely strengthened our platform.&lt;/p&gt;

&lt;p&gt;##Lessons learned&lt;/p&gt;

&lt;p&gt;Beyond the technical lessons we learned during this period, we were reminded that sometimes the best thing to do is stay the course. At times we were tempted to pull back, but moving forward ultimately paid off as each improvement we made exposed the inadequacy (for our platform) of a downstream component.&lt;/p&gt;

</description>
        <pubDate>Fri, 22 May 2015 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2015/05/22/tcmalloc</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/05/22/tcmalloc</guid>
      </item>
    
      <item>
        <title>Okta Software Engineering Design Principles</title>
        <description>&lt;p&gt;Okta has been an agile development shop since the beginning. One important
aspect of being agile is enabling a mix of bottom-up and top-down decision
making. Specifically where high level vision and strategy is clearly
communicated enabling teams to autonomously deliver value while also feeding back
learnings from the trenches to inform the high level
goals.&lt;sup id=&quot;fnref:the-knowledge-creating-company&quot;&gt;&lt;a href=&quot;#fn:the-knowledge-creating-company&quot; class=&quot;footnote&quot;&gt;1&lt;/a&gt;&lt;/sup&gt; Below are the tacit engineering design
principles we’ve used to guide development at Okta. They continue to evolve
as we experiment and learn.&lt;/p&gt;

&lt;h2 id=&quot;create-user-value&quot;&gt;1. Create User Value&lt;/h2&gt;

&lt;p&gt;First and foremost, writing software is about creating value for users. This
seems straight forward, but as systems evolve and become more complex we
start introducing more abstraction and layering which brings us further away
from the concrete problem we’re trying to solve. It’s important to keep in mind
the reason for writing software in the first place and use the understanding
of the audience to inform priority.&lt;/p&gt;

&lt;p&gt;At Okta, our entire company is aligned on this principle because our #1 core
value is &lt;a href=&quot;https://www.okta.com/customers/focus-on-customer-success.html&quot;&gt;customer
success&lt;/a&gt;.  In
practice this means there’s almost always a number of customers eager to beta a
new feature we’re working on. We collaborate closely with customers while
building features allowing for continuous feedback as we iterate and get
changes out in weekly sprints.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;http://imgs.xkcd.com/comics/the_general_problem.png&quot; alt=&quot;xkcd - pass the salt&quot; /&gt;&lt;/p&gt;

&lt;h2 id=&quot;keep-it-simple&quot;&gt;2. Keep it Simple&lt;/h2&gt;

&lt;blockquote&gt;
  &lt;p&gt;Everything should be made as simple as possible, but no simpler — Albert
  Einstein&lt;/p&gt;
&lt;/blockquote&gt;

&lt;p&gt;This truism has been around for ages, and it goes hand-in-hand with the
first principle.  If it doesn’t add value to users now, &lt;a href=&quot;http://en.wikipedia.org/wiki/You_aren%27t_gonna_need_it&quot;&gt;you ain’t gonna
need it - YAGNI&lt;/a&gt;!&lt;/p&gt;

&lt;p&gt;We all encounter overly complex code where it’s nearly impossible to reason
about what it does. Part of this confusion is because it’s
generally &lt;a href=&quot;http://www.joelonsoftware.com/articles/fog0000000069.html&quot;&gt;harder to read code than to write
it&lt;/a&gt; but beyond 
that, there are clearly fundamental qualities of some code making it
more intuitive than other code. There’s a lot of prior art on this topic and a
great place to start is &lt;a href=&quot;http://books.google.com/books?id=dwSfGQAACAAJ&quot;&gt;Clean
Code&lt;/a&gt; by Robert C. Martin, aka
Uncle Bob. The book breaks down the qualities of code which make it
intuitive, and provides a framework for reasoning about code quality.&lt;/p&gt;

&lt;p&gt;Here are some guiding principles about writing clean code we use in practice
which are also covered in the book.&lt;/p&gt;

&lt;p&gt;Clean code:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Makes intent clear, use comments when code isn’t expressive enough&lt;/li&gt;
  &lt;li&gt;Can be read and enhanced by others (or the author after a few
years)&lt;/li&gt;
  &lt;li&gt;Provides one way, rather than many, to do a particular task&lt;/li&gt;
  &lt;li&gt;Is idomatic&lt;/li&gt;
  &lt;li&gt;Is broken into pieces which each does one thing and does it well&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;At the end of the day there is no substitue for experience, like any craft,
writing clean code takes practice. At Okta every engineer is constantly honing
their skills, we rely heavily on code reviews and pair programming to help hone
each other’s skills.&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/img/2015-05-08-software-engineering-design-principles-code_quality_wtfs_per_minute.jpg&quot; alt=&quot;wtfs per minute&quot; /&gt;&lt;/p&gt;

&lt;h2 id=&quot;know-thy-service-with-data&quot;&gt;3. Know Thy-Service With Data&lt;/h2&gt;

&lt;p&gt;In the world of “big data” this point needs little explanation. Okta collects
massive amounts of operational data about our systems to:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Monitor health&lt;/li&gt;
  &lt;li&gt;Monitor performance&lt;/li&gt;
  &lt;li&gt;Debug issues&lt;/li&gt;
  &lt;li&gt;Audit security&lt;/li&gt;
  &lt;li&gt;Make decisions&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;With every new feature we add, developers are responsible for ensuring that
their designs provide visibility into these dimensions. In order to make this an
efficient process we’ve invested in:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Runtime logging control toggling by level, class, tenant, user&lt;/li&gt;
  &lt;li&gt;Creation of dashboards and alerts is self-service&lt;/li&gt;
  &lt;li&gt;Every developer has access to metrics and anonymous unstructured data&lt;/li&gt;
  &lt;li&gt;Request ID generated at edge is passed along at every layer of stack for
correlation&lt;/li&gt;
  &lt;li&gt;Engineering control panel for common operational tasks like taking threaddumps&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Technologies we use to gain visibility include: PagerDuty, RedShift,
Zabbix, ThousandEyes, Boundary, Pingdom, App Dynamics, Splunk, ELK, S3.&lt;/p&gt;

&lt;h2 id=&quot;make-failure-cheap&quot;&gt;4. Make Failure Cheap&lt;/h2&gt;

&lt;p&gt;Every software system will experience failures and all code has bugs. While we
constantly work at having fewer, it’s unrealistic to assume they won’t occur. So,
in addition to investing in prevention, we invest in making failure cheap.&lt;/p&gt;

&lt;p&gt;The cost of failure becomes significantly more expensive 
further out on the development timeline. Making adjustments 
during requirements gather and design are significantly cheaper than 
finding issues in production.&lt;sup id=&quot;fnref:agile-cost-curve&quot;&gt;&lt;a href=&quot;#fn:agile-cost-curve&quot; class=&quot;footnote&quot;&gt;2&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;

&lt;p&gt;&lt;img src=&quot;/assets/img/2015-05-08-software-engineering-design-principles-agile-cost-curve.png&quot; alt=&quot;cost curve of development&quot; /&gt;&lt;/p&gt;

&lt;p&gt;One fundamental we take from both Agile and XP is to invest in pushing failure
as early in the development timeline as possible. We mitigate failures from
poor requirements gathering by iterating quickly with the customer as described in
Principle 1. Once we get to design and development we make failure cheap through:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Design reviews with stakeholders ahead of writing code&lt;/li&gt;
  &lt;li&gt;TDD - developers write all tests for their code; test isn’t a separate phase
from development&lt;/li&gt;
  &lt;li&gt;Keeping master stable - check-in to master is gated by passing all unit,
functional and UI tests&lt;/li&gt;
  &lt;li&gt;Developers can trigger CI on any topic branch; CI is massively parallelized
over a cloud of fast machines&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Since our testing phase is done during development the next phase is production
deployments. At this phase we reduce the cost of failure by:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Hiding beta features behind flags in the code&lt;/li&gt;
  &lt;li&gt;Incremental rollout first to test accounts and then in batches of customers&lt;/li&gt;
  &lt;li&gt;Automated deployment process&lt;/li&gt;
  &lt;li&gt;Code and infrastructure is forward and backward compatible allowing
rollback&lt;/li&gt;
  &lt;li&gt;Health check and automatically remove down nodes&lt;/li&gt;
  &lt;li&gt;Return a degraded / read-only response over nothing at all&lt;/li&gt;
&lt;/ul&gt;

&lt;blockquote&gt;
  &lt;p&gt;An escalator can never break; it can only become stairs – Mitch Hedberg&lt;/p&gt;
&lt;/blockquote&gt;

&lt;h2 id=&quot;automate-everything&quot;&gt;5. Automate Everything&lt;/h2&gt;

&lt;p&gt;All tasks performed routinely should
be automated. These are automation principles we follow:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Automate every aspect of the deployment including long running db migrations&lt;/li&gt;
  &lt;li&gt;All artifacts are immutable and versioned&lt;/li&gt;
  &lt;li&gt;All code modules get dependencies automatically from central artifact server&lt;/li&gt;
  &lt;li&gt;Creation of base images and provisioning of new hardware is automated&lt;/li&gt;
  &lt;li&gt;All forms of testing are automated&lt;/li&gt;
  &lt;li&gt;Development environment setup is automated&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Tools we use:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;AWS - Automated provisioning of hardware&lt;/li&gt;
  &lt;li&gt;Chef - Configuration managment&lt;/li&gt;
  &lt;li&gt;Ansible - Automated deployment orchestration&lt;/li&gt;
  &lt;li&gt;Jenkins - Continuous integration&lt;/li&gt;
  &lt;li&gt;Gearman - To get Jenkins to scale&lt;/li&gt;
  &lt;li&gt;Docker - Containerizing services&lt;/li&gt;
&lt;/ul&gt;

&lt;h2 id=&quot;with-performance-less-is-more&quot;&gt;6. With Performance, Less is More&lt;/h2&gt;

&lt;p&gt;We find especially with performance, there are typically huge wins to be had in
up front design decisions which may come at very little to no cost. Our design
mantras for performance are:&lt;/p&gt;

&lt;ol&gt;
  &lt;li&gt;Don’t do it&lt;/li&gt;
  &lt;li&gt;Do it, but don’t do it again&lt;/li&gt;
  &lt;li&gt;Do it less&lt;/li&gt;
  &lt;li&gt;Do it later&lt;/li&gt;
  &lt;li&gt;Do it when they’re not looking&lt;/li&gt;
  &lt;li&gt;Do it concurrently&lt;/li&gt;
  &lt;li&gt;Do it cheaper&lt;/li&gt;
&lt;/ol&gt;

&lt;p&gt;In practice we implement a number of strategies to limit risk to poorly
performing code:&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;Major new features and performance tunings live behind feature flags allowing
slow rollout and tuning in real life environment&lt;/li&gt;
  &lt;li&gt;Chunk everything that scales on order of N. When N is controlled by customer
enforce limits and design for infinity.&lt;/li&gt;
  &lt;li&gt;Slow query and frequent query monitoring to detect poor access patterns&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;&lt;img style=&quot;max-width:300px&quot; src=&quot;/assets/img/2015-05-08-software-engineering-design-principles-more_is_less.jpg&quot; alt=&quot;if less is more, does that mean more is less?&quot; /&gt;&lt;/p&gt;

&lt;h3 id=&quot;reference&quot;&gt;Reference&lt;/h3&gt;

&lt;div class=&quot;footnotes&quot;&gt;
  &lt;ol&gt;
    &lt;li id=&quot;fn:the-knowledge-creating-company&quot;&gt;
      &lt;p&gt;Ikujiro Nonaka, and Hirotaka Takeuchi. The Knowledge Creating Company. Oxford University Press, 1995. Print. https://books.google.com/books/about/The_Knowledge_creating_Company.html?id=B-qxrPaU1-MC &lt;a href=&quot;#fnref:the-knowledge-creating-company&quot; class=&quot;reversefootnote&quot;&gt;&amp;#8617;&lt;/a&gt;&lt;/p&gt;
    &lt;/li&gt;
    &lt;li id=&quot;fn:agile-cost-curve&quot;&gt;
      &lt;p&gt;Scott Ambler. Examining the Agile Cost of Change Curve. Website. http://www.agilemodeling.com/essays/costOfChange.htm &lt;a href=&quot;#fnref:agile-cost-curve&quot; class=&quot;reversefootnote&quot;&gt;&amp;#8617;&lt;/a&gt;&lt;/p&gt;
    &lt;/li&gt;
  &lt;/ol&gt;
&lt;/div&gt;
</description>
        <pubDate>Fri, 08 May 2015 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2015/05/08/software-engineering-design-principles</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/05/08/software-engineering-design-principles</guid>
      </item>
    
      <item>
        <title>Productionalizing ActiveMQ</title>
        <description>&lt;p&gt;This post describes our odyssey with ActiveMQ, an open-source version of the Java Messaging Service (JMS) API. We use ActiveMQ as the message broker among our app servers.&lt;/p&gt;

&lt;p&gt;First, a word of thanks. To overcome the challenges we faced with ActiveMQ, we are greatly indebted to a very thorough description of an &lt;a href=&quot;https://bugs.openjdk.java.net/browse/JDK-8054446&quot;&gt;OpenJDK bug&lt;/a&gt;, as well as some other &lt;a href=&quot;https://svn.apache.org/repos/asf/harmony/standard/classlib/trunk/modules/concurrent/src/main/java/java/util/concurrent/ConcurrentLinkedQueue.java&quot;&gt;online resources&lt;/a&gt;. If you’re having problems with ActiveMQ, read on. Maybe our story can help you.&lt;/p&gt;

&lt;h2 id=&quot;growing-pains&quot;&gt;Growing Pains&lt;/h2&gt;

&lt;p&gt;Our problems with ActiveMQ date all the way back to 2012. They centered around high memory and CPU usage, message timeout errors, and message queue delays.&lt;/p&gt;

&lt;p&gt;Let’s pick up the action in the spring 2014. At that time we were battling a new wave of timeout storms and message queue delays caused by our mixed ActiveMQ configuration (broker &lt;strong&gt;5.4.1&lt;/strong&gt;, client &lt;strong&gt;5.7&lt;/strong&gt;) and increasing traffic on our site.&lt;/p&gt;

&lt;p&gt;Of course we welcomed the growth in traffic as a byproduct of our growing business. And although we did plan to address our mixed ActiveMQ configuration, we decided to delay doing so at that time, opting instead to tune the configuration. So we increased the maximum session size from 500 to 2000, and the page size from 200 to 2000 messages. Increasing the page size served to minimize “hung queue” scenarios — a side effect of using &lt;a href=&quot;http://docs.oracle.com/cd/E19798-01/821-1841/bncer/index.html&quot;&gt;message selectors&lt;/a&gt;.&lt;/p&gt;

&lt;h2 id=&quot;another-inflection-point&quot;&gt;Another Inflection Point&lt;/h2&gt;

&lt;p&gt;Business and site traffic continued to grow, contributing to another inflection point in the fall of 2014. Timeout storms, CPU spikes, and memory issues returned. It was clear that we could no longer put off upgrading to a newer version of ActiveMQ.&lt;/p&gt;

&lt;p&gt;We decided to skip versions 5.7 and 5.8 in favor of 5.10, mainly because 5.7 was considered unstable, and 5.10 provided improved failover performance.&lt;/p&gt;

&lt;p&gt;Would this upgrade finally deliver the stability that had eluded us for so long?&lt;/p&gt;

&lt;h2 id=&quot;when-upgrades-bite-back&quot;&gt;When Upgrades Bite Back&lt;/h2&gt;

&lt;p&gt;Unfortunately, no. Within 24 hours, memory usage soared, CPUs spiked, and instability returned. Note the dramatic CPU spikes in the following screenshot.&lt;/p&gt;

&lt;p&gt;&lt;img style=&quot;width:50%&quot; src=&quot;/assets/img/2015-05-08-productionalizing-active-mq-cpu-graph-1.png&quot; alt=&quot;Active MQ CPU&quot; /&gt;&lt;/p&gt;

&lt;p&gt;To prevent these issues from impacting customers, we were forced to restart brokers, which is always an option of
last resort. Restarting brokers is a delicate operation, which can entail a less-than-smooth failover,
risking message loss.&lt;/p&gt;

&lt;p&gt;We immediately increased memory, but within a day or two we ran out of memory again.&lt;/p&gt;

&lt;h2 id=&quot;searching-for-the-root-cause&quot;&gt;Searching for the Root Cause&lt;/h2&gt;

&lt;p&gt;An online search turned up an &lt;a href=&quot;https://bugs.openjdk.java.net/browse/JDK-8054446&quot;&gt;OpenJDK bug&lt;/a&gt; that identified an out of memory issue in the
&lt;em&gt;ConcurrentLinkedQueue&lt;/em&gt;, which is a class in the &lt;strong&gt;java.util.concurrent&lt;/strong&gt; package included in &lt;strong&gt;JVM version 1.6&lt;/strong&gt;.
When working properly, &lt;em&gt;ConcurrentLinkedQueue&lt;/em&gt; allows elements to be added and removed from the queue in a
thread-safe manner.&lt;/p&gt;

&lt;p&gt;The bug caused a null object to be created whenever an element at the end of the queue was added and
then deleted. This behavior is particularly unfavorable to the way we use queuing. We call ActiveMQ
to create and destroy objects in the queue very quickly, tens of millions of times a day, as users
and agents connect to Okta. As a result, null objects rapidly fill up the queue, memory usage soars,
and CPUs spike.&lt;/p&gt;

&lt;h2 id=&quot;conference-call&quot;&gt;Conference Call&lt;/h2&gt;

&lt;p&gt;With the site at risk of impacting customer authentication, several key engineers, including Hector
Aguilar, Okta’s CTO and SVP of Engineering, met on a Saturday afternoon conference call. Discussion was intense, and our options were few and unappealing:
(a) revert all the way back to broker version 5.4.1, or (b) upgrade to broker version 5.11, which
was still unreleased and might introduce new problems.&lt;/p&gt;

&lt;p&gt;As team members recall, Hector said very little during the first half of the meeting.&lt;/p&gt;

&lt;p&gt;A bug in the JVM surprised Hector, as critical JVM bugs are relatively rare. Fortunately, the
OpenJDK bug we’d found included a very thorough description of the problem, as well as sample code
to reproduce it.&lt;/p&gt;

&lt;p&gt;Initially motivated by curiosity, Hector analyzed the code and the bug description. He saw where the
problem was, and then checked online to see if it had been fixed in newer JDK versions. He noticed that
several things were changing in the class, and that others had attempted to resolve the bug in
different ways, but none that would solve our particular problem. Hector developed a very simple fix
of his own, trying to remain consistent with the work of others. He then verified his fix using the
provided sample code.&lt;/p&gt;

&lt;p&gt;The JVM has a mechanism called &lt;em&gt;endorsed libraries&lt;/em&gt; that allows developers to override an existing
class with a new class, effectively patching the JVM. Hector used this mechanism, packaged his fix
into a jar file, tried it against ActiveMQ, and found that it worked.&lt;/p&gt;

&lt;p&gt;The mood and direction of the meeting shifted dramatically when Hector said, &lt;em&gt;“Guys, I have a wild
idea. What if we patch the JVM?”&lt;/em&gt; As none of us had ever patched a JVM before, this seemed like a novel approach, even a long
shot.&lt;/p&gt;

&lt;h2 id=&quot;the-fix&quot;&gt;The Fix&lt;/h2&gt;

&lt;p&gt;Hector sent his JVM patch and sample code to the team and walked us through it. First, he explained
why the other attempted fixes wouldn’t solve our particular problem. He then demonstrated how his override effectively patched the original (faulty) removal method. Members of the
team volunteered to test the override at scale with our simulated environments. Within a few hours,
we were fairly sure that Hector’s fix would work.&lt;/p&gt;

&lt;h2 id=&quot;deploying-the-patch&quot;&gt;Deploying the Patch&lt;/h2&gt;

&lt;p&gt;We deployed the patch and restarted brokers. It was a success! ActiveMQ no longer ran out of memory
and the CPU spikes ceased.&lt;/p&gt;

&lt;p&gt;&lt;img style=&quot;width:50%&quot; src=&quot;/assets/img/2015-05-08-productionalizing-active-mq-cpu-graph-2.png&quot; alt=&quot;Active MQ CPU&quot; /&gt;&lt;/p&gt;

&lt;p&gt;Some minor memory leaks remained, but these were eliminated by upgrading to &lt;strong&gt;java-1.7.0&lt;/strong&gt;.&lt;/p&gt;

&lt;h2 id=&quot;stable-and-looking-at-other-solutions&quot;&gt;Stable, and looking at other solutions&lt;/h2&gt;

&lt;p&gt;Patching the &lt;em&gt;ConcurrentLinkedQueue&lt;/em&gt; with ActiveMQ v5.10 and upgrading to java-1.7.0 provided
acceptable stability and faster failover performance. While this is a significant improvement over
where we were last fall, our goal is &lt;strong&gt;zero failover time&lt;/strong&gt;, which ActiveMQ cannot deliver. So, we’re exploring other messaging solutions.&lt;/p&gt;

&lt;p&gt;In telling our story, we couldn’t resist tooting our own horn a bit. How many CTOs actually get
their hands dirty tackling product issues? Our CTO doesn’t code very often, but when
he does, he patches the JVM.&lt;/p&gt;
</description>
        <pubDate>Fri, 08 May 2015 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2015/05/08/productionalizing-active-mq</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/05/08/productionalizing-active-mq</guid>
      </item>
    
      <item>
        <title>Android Unit Testing Part IV&amp;#58; Mocking</title>
        <description>&lt;p&gt;&lt;em&gt;This is the third of a four part series on Android Unit Testing. In
the last two articles I discussed the &lt;a href=&quot;https://www.okta.com/blog/2015/01/android-unit-testing-part-i-what-makes-strong-test-automation/&quot;&gt;general principles of having
good
tests&lt;/a&gt;
and the way to &lt;a href=&quot;/blog/2015/04/07/android-unit-testing-part-2&quot;&gt;run Android tests on JVM making them
fast&lt;/a&gt; and &lt;a href=&quot;/blog/2015/04/14/android-unit-testing-part-3/&quot;&gt;how to make
your code less coupled&lt;/a&gt;.
This article will explain how to make tests isolated.&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;We need to mock a dependency, inject it, and then modify our test to
indicate that we are not testing an end-to-end scenario anymore, but
are now testing just one class at a time.&lt;/p&gt;

&lt;ul&gt;
  &lt;li&gt;
    &lt;p&gt;Modify application Gradle file&lt;/p&gt;

    &lt;p&gt;Add the following code under the dependency section:&lt;/p&gt;

    &lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;androidTestCompile&lt;/span&gt; &lt;span class=&quot;s1&quot;&gt;&#39;org.easymock:easymock:3.1&#39;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Replace &lt;code class=&quot;highlighter-rouge&quot;&gt;FooTest&lt;/code&gt; with the following code:&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kn&quot;&gt;package&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;com&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;example&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;myapplication&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;junit.framework.Assert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.easymock.EasyMockSupport&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.junit.Before&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.junit.Test&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.junit.runner.RunWith&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.robolectric.RobolectricTestRunner&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;static&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;org&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;easymock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;EasyMock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;expect&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;nd&quot;&gt;@RunWith&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;RobolectricTestRunner&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;class&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;FooTest&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;extends&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;EasyMockSupport&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;Foo&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;sut&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;c1&quot;&gt;// Mocks&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;Bar&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;barMock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;nd&quot;&gt;@Before&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;setUp&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;sut&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Foo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

        &lt;span class=&quot;c1&quot;&gt;// Create mocks&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;barMock&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;createMock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Bar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;class&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;

        &lt;span class=&quot;c1&quot;&gt;// Inject mock&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;InjectHelper&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;injectMock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;sut&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;barMock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;

    &lt;span class=&quot;nd&quot;&gt;@Test&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;testGetFoo_returns4&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;c1&quot;&gt;// Arrange&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;expect&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;barMock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getBar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()).&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;andReturn&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;mi&quot;&gt;4&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;replayAll&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

        &lt;span class=&quot;c1&quot;&gt;// Act&lt;/span&gt;
        &lt;span class=&quot;kt&quot;&gt;int&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;actualResult&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;sut&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getFoo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

        &lt;span class=&quot;c1&quot;&gt;// Assert&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;verifyAll&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;Assert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;assertEquals&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;mi&quot;&gt;4&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;actualResult&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Create a class &lt;code class=&quot;highlighter-rouge&quot;&gt;InjectHelper&lt;/code&gt; under &lt;code class=&quot;highlighter-rouge&quot;&gt;androidTest&lt;/code&gt;&lt;/p&gt;

    &lt;p&gt;(I believe the original code for injecting fields is from &lt;strong&gt;Spring&lt;/strong&gt;; however, it was modified afterwards.)&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kn&quot;&gt;package&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;com&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;example&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;myapplication&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;java.lang.reflect.Field&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;javax.inject.Inject&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;InjectHelper&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;

    &lt;span class=&quot;nd&quot;&gt;@SuppressWarnings&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;s&quot;&gt;&quot;unchecked&quot;&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;static&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;injectMock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Object&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;target&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Object&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;mock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;Class&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;targetClass&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;target&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getClass&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
        &lt;span class=&quot;k&quot;&gt;do&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
            &lt;span class=&quot;n&quot;&gt;Field&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;[]&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;fields&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;targetClass&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getDeclaredFields&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
            &lt;span class=&quot;c1&quot;&gt;// Iterate through all members&lt;/span&gt;
            &lt;span class=&quot;k&quot;&gt;for&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Field&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;field&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;:&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;fields&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
                &lt;span class=&quot;c1&quot;&gt;// Skip all non injectable members&lt;/span&gt;
                &lt;span class=&quot;k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;field&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getAnnotation&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Inject&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;class&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;==&lt;/span&gt; &lt;span class=&quot;kc&quot;&gt;null&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
                    &lt;span class=&quot;k&quot;&gt;continue&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

                &lt;span class=&quot;c1&quot;&gt;// Make private/prptected members accessible&lt;/span&gt;
                &lt;span class=&quot;n&quot;&gt;field&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;setAccessible&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;kc&quot;&gt;true&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;

                &lt;span class=&quot;c1&quot;&gt;// Get a class of the member&lt;/span&gt;
                &lt;span class=&quot;n&quot;&gt;Class&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;injectedClass&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;field&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getType&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
                &lt;span class=&quot;n&quot;&gt;Class&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;mockClass&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;mock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getClass&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

                &lt;span class=&quot;c1&quot;&gt;// Check that mock is essentially the same class&lt;/span&gt;
                &lt;span class=&quot;k&quot;&gt;if&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(!&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;injectedClass&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;isAssignableFrom&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;mockClass&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;))&lt;/span&gt;
                    &lt;span class=&quot;k&quot;&gt;continue&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

                &lt;span class=&quot;k&quot;&gt;try&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
                    &lt;span class=&quot;c1&quot;&gt;// Inject mock&lt;/span&gt;
                    &lt;span class=&quot;n&quot;&gt;field&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;set&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;target&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;mock&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
                &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt; &lt;span class=&quot;k&quot;&gt;catch&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;IllegalAccessException&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;e&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
                &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
                    &lt;span class=&quot;k&quot;&gt;throw&lt;/span&gt; &lt;span class=&quot;k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;RuntimeException&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;e&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
                &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;

                &lt;span class=&quot;c1&quot;&gt;// return accessibility&lt;/span&gt;
                &lt;span class=&quot;n&quot;&gt;field&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;setAccessible&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;kc&quot;&gt;false&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
            &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
            &lt;span class=&quot;n&quot;&gt;targetClass&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;targetClass&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getSuperclass&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
        &lt;span class=&quot;k&quot;&gt;while&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;targetClass&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;!=&lt;/span&gt; &lt;span class=&quot;kc&quot;&gt;null&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;&amp;amp;&amp;amp;&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;targetClass&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;!=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Object&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;class&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;

    &lt;p&gt;&lt;strong&gt;Woo-Hoo! We are finally done!&lt;/strong&gt;&lt;/p&gt;

    &lt;p&gt;Now, your tests are:&lt;/p&gt;

    &lt;ul&gt;
      &lt;li&gt;&lt;strong&gt;fast&lt;/strong&gt; — they are executed on a JVM and don’t require going to the network or a persistent layer.&lt;/li&gt;
      &lt;li&gt;&lt;strong&gt;repeatable&lt;/strong&gt; — they don’t depend on emulator stability or network quality.&lt;/li&gt;
      &lt;li&gt;(potentially!) &lt;strong&gt;simple&lt;/strong&gt; and &lt;strong&gt;consistent&lt;/strong&gt; — there is a lot of good information out there on how to write good unit tests.&lt;/li&gt;
      &lt;li&gt;&lt;strong&gt;independent&lt;/strong&gt; — since the persistent layer isn’t used, one test won’t influence another.&lt;/li&gt;
    &lt;/ul&gt;

    &lt;p&gt;In addition to all of this awesomeness, your code should actually be
better off, too. Hopefully writing unit tests will force you to
simplify classes with too many dependencies and more carefully think
through interfaces.&lt;/p&gt;

    &lt;p&gt;Thanks!&lt;/p&gt;

    &lt;p&gt;Let me mention several people who helped me to put this article
together: &lt;a href=&quot;https://www.linkedin.com/pub/william-dawson/43/140/837&quot;&gt;Wils Dawson&lt;/a&gt; made the initial move to use Robolectric,
&lt;a href=&quot;https://www.linkedin.com/in/nadeemlinkedin&quot;&gt;Nadeem Khan&lt;/a&gt; figured out all those pesky details about usage of
Robolectric, and &lt;a href=&quot;https://www.linkedin.com/pub/hans-reichenbach/20/94b/5b8&quot;&gt;Hans Reichenbach&lt;/a&gt; put a lot of these integration
steps in writing on our wiki. Thanks guys!&lt;/p&gt;

    &lt;p&gt;&lt;a href=&quot;https://github.com/vronin-okta/okta_blog_samples/tree/master/android_unit_testing&quot;&gt;https://github.com/vronin-okta/okta_blog_samples/tree/master/android_unit_testing&lt;/a&gt;&lt;/p&gt;
  &lt;/li&gt;
&lt;/ul&gt;
</description>
        <pubDate>Thu, 23 Apr 2015 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2015/04/23/android-unit-testing-part-4</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/04/23/android-unit-testing-part-4</guid>
      </item>
    
      <item>
        <title>Android Unit Testing Part III&amp;#58; Disintegration</title>
        <description>&lt;p&gt;&lt;em&gt;This is the third of a four part series on Android Unit Testing. In
the last two articles I discussed the &lt;a href=&quot;https://www.okta.com/blog/2015/01/android-unit-testing-part-i-what-makes-strong-test-automation/&quot;&gt;general principles of having
good
tests&lt;/a&gt;
and the way to &lt;a href=&quot;/blog/2015/04/07/android-unit-testing-part-2&quot;&gt;run Android tests on JVM making them
fast&lt;/a&gt;. This
part will show how to make your Android code less heavily
coupled. This is a preparation step to ensure that your tests are
isolated from each other.&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;We want to test each unit of work separately to make sure that each
piece of our machinery is working properly. We need to be able to
inject all dependencies into classes under the test (instead of this
class instantiating a production dependency). I am not a fan of
manual dependency injection (i.e., passing them through a
constructor or setters). Such a manual method requires a lot of code
and drags all dependencies through multiple classes to inject them
into the end class.&lt;/p&gt;

&lt;p&gt;There are a lot of dependency injection frameworks for Android out
there: Dagger, RoboGuice, SpringAndroid, Guice, and Transfuse are a
few. I won’t go into a detailed comparison, but I like Dagger the
most because it provides compile time injection, and doesn’t
influence runtime (specifically startup time) too much.&lt;/p&gt;

&lt;p&gt;Again, here there are detailed tutorials at the end of this post and
my summary is below:&lt;/p&gt;

&lt;h2 id=&quot;my-summary&quot;&gt;My Summary&lt;/h2&gt;

&lt;ul&gt;
  &lt;li&gt;
    &lt;p&gt;Modify the application Gradle file&lt;/p&gt;

    &lt;p&gt;Add the following code under the dependency section:&lt;/p&gt;

    &lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;compile&lt;/span&gt; &lt;span class=&quot;s1&quot;&gt;&#39;com.squareup.dagger:dagger:1.2.1&#39;&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;provided&lt;/span&gt; &lt;span class=&quot;s1&quot;&gt;&#39;com.squareup.dagger:dagger-compiler:1.2.1&#39;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Modify the manifest&lt;/p&gt;

    &lt;p&gt;Add the following code to the Application tags:&lt;/p&gt;

    &lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;android&lt;/span&gt;:&lt;span class=&quot;n&quot;&gt;name&lt;/span&gt;=&lt;span class=&quot;s2&quot;&gt;&quot;.MyApplication&quot;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Create the classes&lt;/p&gt;

    &lt;p&gt;Add the &lt;code class=&quot;highlighter-rouge&quot;&gt;MyApplication&lt;/code&gt; class.&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;MyApplication&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;extends&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Application&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;ObjectGraph&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;applicationGraph&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;nd&quot;&gt;@Override&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;onCreate&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;kd&quot;&gt;super&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;onCreate&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

        &lt;span class=&quot;n&quot;&gt;applicationGraph&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;ObjectGraph&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;create&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;getModules&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;().&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;toArray&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;());&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;

    &lt;span class=&quot;kd&quot;&gt;protected&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;List&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;&amp;lt;&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Object&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;&amp;gt;&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;getModules&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;k&quot;&gt;return&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Arrays&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&amp;lt;&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Object&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;&amp;gt;&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;asList&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;
                &lt;span class=&quot;k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;MyModule&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;k&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;inject&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;Object&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;object&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;applicationGraph&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;inject&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;object&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Add the &lt;code class=&quot;highlighter-rouge&quot;&gt;MyModule&lt;/code&gt; class.&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kn&quot;&gt;package&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;com&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;example&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;myapplication&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;dagger.Module&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;dagger.Provides&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;nd&quot;&gt;@Module&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;injects&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
                &lt;span class=&quot;n&quot;&gt;MainActivity&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;class&lt;/span&gt;
        &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;MyModule&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;final&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;MyApplication&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;application&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;MyModule&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;MyApplication&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;application&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;k&quot;&gt;this&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;application&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;application&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Modify &lt;code class=&quot;highlighter-rouge&quot;&gt;MainActivity&lt;/code&gt; and replace code &lt;code class=&quot;highlighter-rouge&quot;&gt;private Foo
foo = new Foo();&lt;/code&gt; with:&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;nd&quot;&gt;@Inject&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;Foo&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;foo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;

    &lt;p&gt;and add following code to &lt;code class=&quot;highlighter-rouge&quot;&gt;onCreate()&lt;/code&gt;:&lt;/p&gt;

    &lt;div class=&quot;highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;// This will inject all @Inject members
// recursively for everything what is marked as @Inject
((MyApplication)getApplicationContext()).inject(this);
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Modify the &lt;code class=&quot;highlighter-rouge&quot;&gt;Foo&lt;/code&gt; class and replace code &lt;code class=&quot;highlighter-rouge&quot;&gt;Bar bar = new Bar();&lt;/code&gt; with:&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;nd&quot;&gt;@Inject&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;Bar&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;bar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;

    &lt;p&gt;Modify Bar class and add&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;nd&quot;&gt;@Inject&lt;/span&gt;
&lt;span class=&quot;n&quot;&gt;Bar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Now, instances of &lt;code class=&quot;highlighter-rouge&quot;&gt;Foo&lt;/code&gt; and &lt;code class=&quot;highlighter-rouge&quot;&gt;Bar&lt;/code&gt; are
automatically injected in the runtime. However, your test will fail
with NPE, because the Foo class has a Bar dependency which wasn’t
delivered. I.e., we don’t want it injected by Dagger -— we want mocked
dependency, not a real one.&lt;/p&gt;

&lt;h2 id=&quot;resources&quot;&gt;Resources&lt;/h2&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;http://antonioleiva.com/dependency-injection-android-dagger-part-1/&quot;&gt;Dependency injection on Android: Dagger (Part 1)&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;http://antonioleiva.com/dagger-android-part-2/&quot;&gt;Dependency injection on Android: Dagger (Part 2)&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Stay tuned for the final part of our series, where I will show you
how to make tests isolated. You can also check out the full code at
&lt;a href=&quot;https://github.com/vronin-okta/okta_blog_samples/tree/master/android_unit_testing&quot;&gt;GitHub&lt;/a&gt;.&lt;/p&gt;
</description>
        <pubDate>Tue, 14 Apr 2015 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2015/04/14/android-unit-testing-part-3</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/04/14/android-unit-testing-part-3</guid>
      </item>
    
      <item>
        <title>Android Unit Testing Part II&amp;#58; Escaping Dalvik’s Hold</title>
        <description>&lt;p&gt;&lt;em&gt;This is the second of a four part series on Android Unit Testing. In
these posts, we’ll walk through the key steps engineers should take
to make Android test fast by running them on JVM (versus running
them on emulator).&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;&lt;em&gt;For background information on the importance of Android testing, &lt;a href=&quot;https://www.okta.com/blog/2015/01/android-unit-testing-part-i-what-makes-strong-test-automation/&quot;&gt;visit Part I of the series&lt;/a&gt;.&lt;/em&gt;&lt;/p&gt;

&lt;p&gt;It appears that the need to run tests on an Android device or an
emulator has concerned Android engineers for almost as long as Android
has existed – and &lt;a href=&quot;https://www.linkedin.com/pub/christian-williams/8/4/30b&quot;&gt;Christian Williams&lt;/a&gt; created &lt;a href=&quot;http://robolectric.org/&quot;&gt;Robolectric&lt;/a&gt; to solve
this problem. Robolectric allows you to run unmodified test code
(referring to Android specific classes) on your desktop (in a JVM)
instead of running them on an emulator or device in the Android
Virtual Machine, or &lt;a href=&quot;http://en.wikipedia.org/wiki/Dalvik_%28software%29&quot;&gt;Dalvik&lt;/a&gt;.&lt;/p&gt;

&lt;p&gt;I have listed several good tutorials at the end of this post that
illustrate exactly how this can be done, but they also include some
details you may not yet need. So, use the tutorial links for details,
but check out “My Summary” for a short overview of what you need to
do:&lt;/p&gt;

&lt;h2 id=&quot;my-summary&quot;&gt;My Summary&lt;/h2&gt;

&lt;ul&gt;
  &lt;li&gt;
    &lt;p&gt;Create a new project in Android Studio (I used Studio 0.8.14)&lt;/p&gt;

    &lt;p&gt;Choose as example Blank Activity project.&lt;/p&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Modify the TOP Gradle file&lt;/p&gt;

    &lt;p&gt;Add the following code to the dependencies section:&lt;/p&gt;

    &lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;classpath&lt;/span&gt; &lt;span class=&quot;s1&quot;&gt;&#39;org.robolectric:robolectric-gradle-plugin:0.12.+&#39;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Modify the application Gradle file&lt;/p&gt;

    &lt;p&gt;Add the following code under &lt;code class=&quot;highlighter-rouge&quot;&gt;apply plugin: ‘com.android.application&#39;&lt;/code&gt;:&lt;/p&gt;

    &lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;apply&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;plugin&lt;/span&gt;: &lt;span class=&quot;s1&quot;&gt;&#39;robolectric&#39;&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Add the following under the dependencies section:&lt;/p&gt;

    &lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;androidTestCompile&lt;/span&gt;(&lt;span class=&quot;s1&quot;&gt;&#39;junit:junit:4.11&#39;&lt;/span&gt;)
&lt;span class=&quot;n&quot;&gt;androidTestCompile&lt;/span&gt;(&lt;span class=&quot;s1&quot;&gt;&#39;org.robolectric:robolectric:2.3&#39;&lt;/span&gt;)
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Add this section:&lt;/p&gt;

    &lt;div class=&quot;language-conf highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;n&quot;&gt;robolectric&lt;/span&gt; {
        &lt;span class=&quot;n&quot;&gt;include&lt;/span&gt; &lt;span class=&quot;s1&quot;&gt;&#39;**/*Test.class&#39;&lt;/span&gt;
}
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Create the code that you want to test&lt;/p&gt;

    &lt;p&gt;Modify &lt;code class=&quot;highlighter-rouge&quot;&gt;MainActivity&lt;/code&gt;. Add the following code to it:&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kd&quot;&gt;private&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Foo&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;foo&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Foo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;int&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;getSomething&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
    &lt;span class=&quot;k&quot;&gt;return&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;foo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getFoo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;

    &lt;p&gt;Add the &lt;code class=&quot;highlighter-rouge&quot;&gt;Foo&lt;/code&gt; class:&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kn&quot;&gt;package&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;com&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;example&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;myapplication&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;Foo&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;Bar&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;bar&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Bar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;int&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;getFoo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;k&quot;&gt;return&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;bar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getBar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Add the &lt;code class=&quot;highlighter-rouge&quot;&gt;Bar&lt;/code&gt; class:&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kn&quot;&gt;package&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;com&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;example&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;myapplication&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;Bar&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;

    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;int&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;getBar&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;k&quot;&gt;return&lt;/span&gt; &lt;span class=&quot;mi&quot;&gt;4&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Create a test&lt;/p&gt;

    &lt;p&gt;Delete the &lt;code class=&quot;highlighter-rouge&quot;&gt;ApplicationTest&lt;/code&gt; file.&lt;/p&gt;

    &lt;p&gt;Create the following &lt;code class=&quot;highlighter-rouge&quot;&gt;FooTest&lt;/code&gt; class under your &lt;code class=&quot;highlighter-rouge&quot;&gt;androidTest&lt;/code&gt;:&lt;/p&gt;

    &lt;div class=&quot;language-java highlighter-rouge&quot;&gt;&lt;pre class=&quot;highlight&quot;&gt;&lt;code&gt;&lt;span class=&quot;kn&quot;&gt;package&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;com&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;example&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;myapplication&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;junit.framework.Assert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.junit.Before&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.junit.Test&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.junit.runner.RunWith&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;
&lt;span class=&quot;kn&quot;&gt;import&lt;/span&gt; &lt;span class=&quot;nn&quot;&gt;org.robolectric.RobolectricTestRunner&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

&lt;span class=&quot;nd&quot;&gt;@RunWith&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;n&quot;&gt;RobolectricTestRunner&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;class&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;)&lt;/span&gt;
&lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kd&quot;&gt;class&lt;/span&gt; &lt;span class=&quot;nc&quot;&gt;FooTest&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
    &lt;span class=&quot;n&quot;&gt;Foo&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;sut&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;;&lt;/span&gt;

    &lt;span class=&quot;nd&quot;&gt;@Before&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;setUp&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;sut&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;k&quot;&gt;new&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;Foo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;

    &lt;span class=&quot;nd&quot;&gt;@Test&lt;/span&gt;
    &lt;span class=&quot;kd&quot;&gt;public&lt;/span&gt; &lt;span class=&quot;kt&quot;&gt;void&lt;/span&gt; &lt;span class=&quot;nf&quot;&gt;testGetFoo_returns4&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;()&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;{&lt;/span&gt;
        &lt;span class=&quot;c1&quot;&gt;// Arrange&lt;/span&gt;

        &lt;span class=&quot;c1&quot;&gt;// Act&lt;/span&gt;
        &lt;span class=&quot;kt&quot;&gt;int&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;actualResult&lt;/span&gt; &lt;span class=&quot;o&quot;&gt;=&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;sut&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;getFoo&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;();&lt;/span&gt;

        &lt;span class=&quot;c1&quot;&gt;// Assert&lt;/span&gt;
        &lt;span class=&quot;n&quot;&gt;Assert&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;.&lt;/span&gt;&lt;span class=&quot;na&quot;&gt;assertEquals&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;(&lt;/span&gt;&lt;span class=&quot;mi&quot;&gt;4&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;,&lt;/span&gt; &lt;span class=&quot;n&quot;&gt;actualResult&lt;/span&gt;&lt;span class=&quot;o&quot;&gt;);&lt;/span&gt;
    &lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;span class=&quot;o&quot;&gt;}&lt;/span&gt;
&lt;/code&gt;&lt;/pre&gt;
    &lt;/div&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;Create the configuration&lt;/p&gt;

    &lt;ol&gt;
      &lt;li&gt;Create a &lt;strong&gt;gradle&lt;/strong&gt; configuration.&lt;/li&gt;
      &lt;li&gt;Set “&lt;strong&gt;Tests&lt;/strong&gt;” as a name.&lt;/li&gt;
      &lt;li&gt;Choose the top gradle file as a project.&lt;/li&gt;
      &lt;li&gt;Type &lt;em&gt;test&lt;/em&gt; in &lt;strong&gt;Tasks&lt;/strong&gt;.&lt;/li&gt;
    &lt;/ol&gt;

    &lt;p&gt;Now, without launching the emulator, you can run this configuration
and see that your test has passed. It is much faster than before—and
repeatable. You can put this under build automation and it will
totally work.&lt;/p&gt;
  &lt;/li&gt;
  &lt;li&gt;
    &lt;p&gt;JVM&lt;/p&gt;

    &lt;p&gt;There are alternative ways to run the test on a JVM. For example,
you can create a &lt;strong&gt;JUnit&lt;/strong&gt; task and ensure that all your tests and
classes don’t touch any Android specific classes. However, this is
not easy, as you must design all your code with this restriction in
mind.&lt;/p&gt;

    &lt;p&gt;The changes which we did to run on JVM are great, but we are still
facing the limitations of using integration tests. For example, if
the implementation of a &lt;code class=&quot;highlighter-rouge&quot;&gt;Bar&lt;/code&gt; class changes and now uses the network,
you might start seeing flakiness in the &lt;code class=&quot;highlighter-rouge&quot;&gt;testGetFoo_returns4&lt;/code&gt; test
because of a bad network connection.&lt;/p&gt;
  &lt;/li&gt;
&lt;/ul&gt;

&lt;h2 id=&quot;additional-resources&quot;&gt;Additional Resources&lt;/h2&gt;

&lt;ul&gt;
  &lt;li&gt;&lt;a href=&quot;https://github.com/codepath/android_guides/wiki/Robolectric-Installation-for-Unit-Testing&quot;&gt;Robolectric Installation for Unit Testing&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;http://www.peterfriese.de/android-testing-with-robolectric/&quot;&gt;Android Testing With Robolectric&lt;/a&gt;&lt;/li&gt;
  &lt;li&gt;&lt;a href=&quot;https://github.com/robolectric/robolectric-gradle-plugin&quot;&gt;Robolectric Gradle Plugin&lt;/a&gt;&lt;/li&gt;
&lt;/ul&gt;

&lt;p&gt;Stay tuned for part three of our series, where I will show you how
to achieve test isolation using dependency injection. You can also
check out the full code at &lt;a href=&quot;https://github.com/vronin-okta/okta_blog_samples/tree/master/android_unit_testing&quot;&gt;GitHub&lt;/a&gt;.&lt;/p&gt;
</description>
        <pubDate>Tue, 07 Apr 2015 00:00:00 -0700</pubDate>
        <link>http://developer.okta.com/blog/2015/04/07/android-unit-testing-part-2</link>
        <guid isPermaLink="true">http://developer.okta.com/blog/2015/04/07/android-unit-testing-part-2</guid>
      </item>
    
  </channel>
</rss>