Using ColdFusion to Deflate compress a SAML XML authentication message

I am working on a ColdFusion project that uses SAML to authenticate users. I won't get into all the specific application details as they are quite complicated. However, the point of this blog post is to explain the components of the authentication request XML message that gets DEFLATE compressed, Base64 encoded and URL encoded. I hope some of this can help others dealing with SAML and/or Deflate compression in their projects.

To implement "DEFLATE compressed" I knew Java would come into play and I found this resource which explained the Java Deflater class.

This is the example Java code I needed to represent in ColdFusion.

/* Encode a String into bytes */
String inputString = "blahblahblah??";
byte[] input = inputString.getBytes("UTF-8");

/* Compress the bytes */
byte[] output = new byte[100];
Deflater compresser = new Deflater();
compresser.setInput(input);
compresser.finish();
int compressedDataLength = compresser.deflate(output);

I had a hard time finding any help on how I could create the Java byte array "output" variable in ColdFusion. Luckily, I came across this old 2004 blog post from Christian Cantrell. This find was a life saver, thanks Christian! Here is Christian's code:

<cffunction name="getByteArray" access="private" returnType="binary" output="no">
<cfargument name="size" type="numeric" required="true"/>
<cfset var emptyByteArray = createObject("java", "java.io.ByteArrayOutputStream").init().toByteArray()/>
<cfset var byteClass = emptyByteArray.getClass().getComponentType()/>
<cfset var byteArray = createObject("java","java.lang.reflect.Array").newInstance(byteClass, arguments.size)/>
<cfreturn byteArray/>
</cffunction>

Here is my final ColdFusion code that represents the original Java example above.

<!--- setup ColdFusion/Java bytearray variable --->
<cfset emptyByteArray = createObject("java", "java.io.ByteArrayOutputStream").init().toByteArray()/>
<cfset byteClass = emptyByteArray.getClass().getComponentType()/>
<cfset output = createObject("java","java.lang.reflect.Array").newInstance(byteClass, 500)/>

<!--- perform Deflate, Base64 encode, and URL encode --->
<cfscript>
saml_deflate = createObject("java", "java.util.zip.Deflater");
saml_deflate.init(9,true);
saml_deflate.setInput(saml_xml.getBytes("UTF-8"));
saml_deflate.finish();
compressedDataLength = saml_deflate.deflate(output);
data64 = toBase64(output,"UTF-8");
data64url = urlencodedformat(data64);
</cfscript>

Before the ColdFusion code above, you start with the SAML XML message like this, which is saved in the CF variable "saml_xml", and the final result is in the CF variable "data64url".

<cfsavecontent variable="saml_xml"><?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<samlp:AuthnRequest xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
ID="a966242f393474b7d95f4581ff7db131d" Version="2.0"
IssueInstant="2010-05-10T16:24:33.525Z">

<saml:Issuer>http://theissuer.domain.org/app/</saml:Issuer>
</samlp:AuthnRequest></cfsavecontent>

Using ColdFusion with a stubborn MS Access Date/Time field

I have a small application using a MS Access database. Yes, I know all the reasons why it shouldn't be used, let's not go there. Fact is, many developers still use Access for small apps, prototyping, etc, and may come across the same roadblock in which I figured out a solution. For reference, today's date is 3/19/2010 which was used in the query examples shown.

Requirement: Query a table of Jobs (JobTitle, Dept, Salary, etc) that contains a Date/Time field named PostingEndDate. This field is configured as Required = No. That means the admin user who populates records in the table will either supply a date, or may leave the date blank. Think of it as a field that allows NULL in MS SQL. On the end-user side, the query needs to list only current jobs by filtering the records where:
1) PostingEndDate has not passed today's date
OR
2) PostingEndDate is empty (blank value means the Job can be displayed to the user indefinitely)

Here is a cfdump (jobList_raw) of all records:

SELECT JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM tblJob
WHERE     ActiveJob = 1
ORDER BY JobTitle


Problem: no easy way to write the WHERE clause. Here are some attempts:
1) Len(PostingEndDate) = 0
No error, but does not pick up those with blank dates:

SELECT JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM tblJob
WHERE     ActiveJob = 1
AND (Now() <= PostingEndDate OR Len(PostingEndDate) = 0)
ORDER BY JobTitle

2) PostingEndDate = ''
Generates error: [Macromedia][SequeLink JDBC Driver][ODBC Socket][Microsoft][ODBC Microsoft Access Driver] Data type mismatch in criteria expression.
We can't compare the date field to an empty string.

SELECT JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM tblJob
WHERE     ActiveJob = 1
AND (Now() <= PostingEndDate OR PostingEndDate = '')
ORDER BY JobTitle

3) Cstr(PostingEndDate) = ''
Generates error: [Macromedia][SequeLink JDBC Driver][ODBC Socket][Microsoft][ODBC Microsoft Access Driver] Invalid use of Null
This was my attempt to Cast the date to a string using an Access function. Guess not.

SELECT JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM tblJob
WHERE     ActiveJob = 1
AND (Now() <= PostingEndDate OR Cstr(PostingEndDate) = '')
ORDER BY JobTitle

Solution: write a ColdFusion Query of Query (QoQ) to UNION the two conditions into one resultset. Here are the steps that lead to the final solution.
1) I still need a way to get a string representation (varchar) of the date field. So I added another column (PostingEndDate_str) to the Query object.

<cfset QueryAddColumn(jobList_raw,"PostingEndDate_str","varchar",Arraynew(1))>

2) Loop query and populate the new varchar field. This was intended to produce a blank string for what cfdump showed as [empty string]. Then I should be able to use: PostingEndDate = ''

<cfloop query="jobList_raw">
   <cfset QuerySetCell(jobList_raw, "PostingEndDate_str", "#PostingEndDate#",currentrow)>
</cfloop>
NOPE! Still see [empty string] in the new field, THIS BECAME THE HAIR PULLING MOMENT OF THE SOLUTION AT THIS POINT, SO I STARTED GOOGLE SEARCHING.

I decided to try using '-' before and after the value, a trick I noticed in Ben Nadel's blog:

<cfloop query="jobList_raw">
   <cfset QuerySetCell(jobList_raw, "PostingEndDate_str", "-#PostingEndDate#-",currentrow)>
</cfloop>
Now I see "--" for all those [empty string] values, much better. I can work with that in the QoQ.

3) Last is the Query of Query UNION.

SELECT   JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM jobList_raw
WHERE #ParseDateTime(DateFormat(Now(),'mm/dd/yyyy'))# <= PostingEndDate <!--- Lefthand expression will format Now() as: 2010-03-19 00:00:00.0 --->
UNION
SELECT   JobID, DeptID, JobTitle, Salary, PostingEndDate
FROM jobList_raw
WHERE     PostingEndDate_str = '--' <!--- [empty string] dates will contain this value from the QuerySetCell loop executed above --->
ORDER BY JobTitle

Here is the final recordset. It correctly leaves the Architect job filtered out because its PostingEndDate of Mar 9, 2010 has passed. The Mortgage Processor and Supervisor jobs with blank dates are kept in the results!

Excited for special ColdFusion Builder event in St. Paul on March 23

Josh Adams, Adobe Senior Solutions Engineer for ColdFusion, will be presenting live as part of a special CFUG tour. Josh will bring us the latest details and demonstration of the new Eclipse based IDE, ColdFusion Builder. We are planning for a fun event hosted at our usual user group location, Easel Solutions. Adobe is shipping us some special event swag as well, so be there for chance to take home a unique prize. Hope to see a packed house, register now!

www.colderfusion.com/CFBuilder10.cfm

Date: Tuesday, March 23, 2010

Agenda:
5:45 Food and Social
6:30 Presentation begins
8:15 Q & A - Prizes
8:30 After party at local bar TBD

Location: Easel Solutions, St. Paul, MN

Updated 3/24/2010
We had a great event, here are some pics!

ColdFusion Builder - Josh Adams - March 2010

ColdFusion UG Tour coming to St. Paul June 11

I'm thrilled to report that Ben Forta is visiting the Twin Cities again as part of the Adobe worldwide user group tour for the upcoming versions of ColdFusion and Flex. I got the official word a few weeks ago and have been head down in planning mode ever since. Figuring attendance will bust down the doors at Easel Solutions, we needed a bigger venue, so I made a bunch of calls, sent emails, and even visited one potential location. In the end we choose the University of St. Thomas, St. Paul Campus and I think it is going to work out great.

I want to thank the TCCFUG's co-manager, Ben Ellefson, for major work on the event registration website. It's now live and I urge you to get this on your calendar and register now. This is one user group meeting you will not want to miss, plus you'll be fed and could win an IPod touch to boot.

Hope to see you there!

Updated 6/12/2009
We had a great event, here are some pics!

Adobe CF9/Flex4 UG Tour St. Paul 2009

Completed my first Flash project

Over the past two months, I've been working with a new client on a Flash project. She happens to be a former co-worker in my Creative Internet Solutions days back in 1999-2000. We reconnected on Facebook and I learned about a new women's handbag system she was developing and needed a Flash demo for her website. We met for lunch so I could see the prototype handbags firsthand and she had a basic script on paper of how she wanted it to look and flow. From there I dove into some Lynda.com training and also picked up some best practices from a couple Flash gurus I know. After a few revisions, she had exactly what she wanted and was very happy with the end result.

Heddy Freddy handbag system Flash demo

Client quote: "Thanks so much for the great animation, it's just what I imagined!"

How to send a fax using Ooma

We just got an Ooma VOIP phone system ($220 deal right now at Costco) and I've been testing exactly how I'll position the Hub and Scout in our house. I also wanted to make sure our fax machine will work. We don't fax very often, but it's sure nice to have when when needed (usually about once a month.) Ooma says to position a fax machine with direct phone line connection to the Hub. I tried this, but it wasn't working. I could hear the high pitch "faxing sound", but after that, the connection would fail. I found a web forum with an easy solution, simply prefix the number you are dialing with *99 and it works! Here is the Ooma forum link. Ok, now I just need to get our home phone number ported and it will be time to drop Comcast phone service and save $40 per month!

ColdFusion page added to SalesForce wiki

Today I added a section for Adobe ColdFusion to the SalesForce Developer Wiki under the Web Services API section.

I then added the first code sample article, showing how to do a Basic Web2Lead Implementation. I looked at a similar PHP sample done by Wayne Abbott as the basis for my article.

Hopefully this will spur others in the CF Community to start adding more content to this wiki and spread the knowledge of CF as a viable web development platform.

Tips for testing web-to-lead on SalesForce sandbox server

The SalesForce Web-to-Lead URL is well known to be: https://www.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8

If you have access to a Sandbox server to do your development, you may want to test Web-to-Lead against it. You first should go into the setup area to find your OID (Organization ID) which will differ from your production OID. Find this from SalesForce's top "Setup" link. Then drill down into the left navigation menu:
App Setup / Customize / Leads / Web-to-Lead
Make sure the checkbox for Web-to-Lead Enabled is checked. Then click the "Create Web-to-Lead Form" button. On the next page, keep all selected fields as defaults and click the "Generate" button. Look in the generated HTML output for your unique OID which is given in the first hidden form field. You should see lines of code like this:

<!-- ---------------------------------------------------------------------- -->
<!-- NOTE: Please add the following <META> element to your page <HEAD>. -->
<!-- If necessary, please modify the charset parameter to specify the -->
<!-- character set of your HTML page. -->
<!-- ---------------------------------------------------------------------- -->

<META HTTP-EQUIV="Content-type" CONTENT="text/html; charset=UTF-8">

<!-- ---------------------------------------------------------------------- -->
<!-- NOTE: Please add the following <FORM> element to your page. -->
<!-- ---------------------------------------------------------------------- -->

<form action="https://www.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8" method="POST">

<input type=hidden name="oid" value="youroidhere">

Remember, you are developing for tests against the Sandbox server, so you will need to modify the Form action to match the URL of your Sandbox homepage. Look at your Sandbox url and replace "www" with the proper subdomain, such as "cs2" in this example.
Example Sandbox homepage: https://cs2.salesforce.com/home/home.jsp
New Web-to-Lead Form action: https://cs2.salesforce.com/servlet/servlet.WebToLead?encoding=UTF-8

Update your Twitter status from ColdFusion using a JSP tag library

Today I wanted to find an easy way to put a status update into my Twitter account using ColdFusion. I went searching the API docs, and found this page.

http://apiwiki.twitter.com/Libraries

Unfortunately, there are no CF examples listed, boo! However, there are some for Java, so I continued my search in that direction. Eventually I found this JSP taglib, and decided to give it a "Twirl" :)

http://www.servletsuite.com/servlets/twittertag.htm

To use any JSP taglib, you simply drop the .jar file into your /webroot/WEB-INF/lib/ directory. I believe it also requires the Enterprise edition of ColdFusion. A good article that fully explains their usage was done by Charlie Arehart back in May 2002.

After copying the file, you must then restart ColdFusion. This is a must or you will get an error when attempting to import the library.

That's it, I was now ready to test a Twitter post. Here is the sample code I used that will put a new status message in my Twitter account. I saved this in a file twitter.cfm, then browsed to the page on my local machine as http://localhost/twitter.cfm

<cfimport taglib="/WEB-INF/lib/twittertag.jar" prefix="twitter">
<twitter:update user="your_username_here" password="your_password_here" id="result">
My posting to Twitter from CF <cfoutput>#now()#</cfoutput>
</twitter:update>

Upon success, an XML dataset is returned in the "result" variable. If you cfdump it, looks like this.

<?xml version="1.0" encoding="UTF-8"?> <status> <created_at>Wed Feb 04 21:29:26 +0000 2009</created_at> <id>1177644114</id> <text>My posting to Twitter from CF {ts '2009-02-04 15:29:28'}</text> <source>web</source> <truncated>false</truncated> <in_reply_to_status_id></in_reply_to_status_id> <in_reply_to_user_id></in_reply_to_user_id> <favorited>false</favorited> <in_reply_to_screen_name></in_reply_to_screen_name> <user> <id>20062919</id> <name>Twin Cities CFUG</name> <screen_name>TCCFUG</screen_name> <location>St. Paul, MN USA</location> <description>Adobe ColdFusion User Group -of Minneapolis / St. Paul, Minnesota</description> <profile_image_url>http://s3.amazonaws.com/twitter_production/profile_images/75391930/colderfusion_twitter_normal.jpg</profile_image_url> <url>http://groups.adobe.com/groups/bd9082a926/</url> <protected>false</protected> <followers_count>0</followers_count> </user> </status>

If you fail to restart CF, you will see this TagExtraInfo error message:

The TagExtraInfo class com.cj.twitter.strVariable for the update tag could not be found.

The CFML compiler was processing:
* A cfimport tag beginning on line 1, column 2.

This is not the best solution if you are in a shared hosting environment, as they may not install the twittertag.jar file for you. I'm curious what other methods developers have found to accomplish status posts to Twitter.

ColdFusion UDFs long2ip() and ip2long()

Yesterday I was working on porting some PHP code into ColdFusion. The PHP code was using a function called long2ip(), and I researched this PHP Manual website to learn more about it. I needed this function in CF, but couldn't find it at cflib or anywhere else doing a few Google searches. The closest I came was this blog post by Brandon Purcell, which got me started in the right direction. I learned from what Brandon wrote, along with the comments input by Gabriel Malca (if the function doesn't exist) at the PHP Manual site and came up with the logic for my CF version of the function. After I had this working, I figured I better implement the opposite conversion function as well, so I also created ip2long(). Again I found a user comment for when the function doesn't exist to base my function's logic. I submitted these to cflib.org today, so look for them soon.

Examples:
long2ip(3401190660) = 202.186.13.4
ip2long(202.186.13.4) = 3401190660

Here is the code for UDFs below:

<cfscript>
/**
* Generates an (IPv4) Internet Protocol dotted address (aaa.bbb.ccc.ddd) from the proper address representation. Returns 0 if error occurs.
*
* @param longip Numeric value of the address you want to convert. (Required)
* @return Returns a String.
* @author Troy Pullis (tpullis@yahoo.com)
* @version 1, Jan 5, 2009
*/
function long2ip(longip)
{
   var ip = "";
   var i = "";
if (longip < 0 || longip > 4294967295)
      return 0;
for (i=3;i>=0;i--) {
ip = ip & int(longip / 256^i);
longip = longip - int(longip / 256^i) * 256^i;
if (i>0)
         ip = ip & ".";
}
return ip;
}

/**
* Converts a string containing an (IPv4) Internet Protocol dotted address (aaa.bbb.ccc.ddd) into a proper address representation. Returns 0 if error occurs.
*
* @param ip Dotted address value you want to convert. (Required)
* @return Returns a String.
* @author Troy Pullis (tpullis@yahoo.com)
* @version 1, Jan 5, 2009
*/
function ip2long(ip) {
   var iparr = ListToArray(ip,".");
   if (ArrayLen(iparr) != 4)
      return 0;
   else
       return iparr[1]*256^3 + iparr[2]*256^2 + iparr[3]*256 + iparr[4];
}
</cfscript>

More Entries

BlogCFC was created by Raymond Camden. This blog is running version 5.9.002. Contact Blog Owner