OraTransplant

My first day at ODTUG 2006

20 June 2006 at 18:09 CEST | In AppServer, JDeveloper, Oracle, Workshops & trainings, XML Publisher |

I won’t bother you all with my sightseeing adventures of Washington D.C. I walked around for about 10 miles (16 kilometers) and my feet are aching I also cannot include any pictures of my sightseeing and the presentations, since I forgot the USB cable to connect my camera to my laptop

I already met up with a lot of people. That’s one of the interesting things of these conferences. You get to meet up with a lot of people that you otherwise wouldn’t meet. This is where you hear all the really interesting stuff!

I attended my first session on Sunday afternoon, but that didn’t really teach me anything new. That’s the risk you run when choosing for a certain presentation based on a very short abstract in the conference schedule.

The end of the Sunday afternoon was the kickoff for the Business Intelligence Summit. It was supposed to shed light on Oracle’s Business Intelligence strategy. But to be honest, it’s still not clear to me. It was well over an hour of marketing bla-bla about Oracle BI Enterprise Edition, the re-branded Siebel Analytics product. The session ended with a 15 minute demo by Mark Rittman, which was very insightful. He has a short demo of two new features of Oracle Warehouse Builder 10gR2. It all looked very promising although we not a user (yet) of Warehouse builder.

Monday morning we had a keynote by Marco Tilli from Oracle presenting about they Fusion Middleware strategy. There were two interesting things I picked up in this session. The first is a (non official) release road map:
version 10.1.2 is production (Q1-2006)
version 10.1.3 is production (Q3-2006)
version 10.1.3.1 is the addition of the SOA Suite available before the end of 2006
version 10.1.3.2 is the addition of the Workspace Suite (not really sure what that is yet). No date was given for that release
and finally we will have version 11, for which Marco didn’t give a release date. But from the Forms version 11 webcast I had I expect this to be summer 2007.

They also did two demos during Marco’s presentation. The first one was on BPEL and Oracle Business Rules. For people following all the Oracle news, this was nothing new. The other presentation featured some of the new JSF components. This has been called RIA (Rich Internet Application) components or ADF Faces.Next. Basically, it’s AJAX enabled ADF Faces components. I already saw some of them at Oracle OpenWorld last year.

Oracle doesn’t have a release date for these new components, but they hope to have some sort of early adopter release out by the end of this year. These components look very very promising and I can’t wait to get my hands on them. Frank Nimphius will also cover these components in a presentation on Wednesday, so I’ll certainly will attend that one. I’ll see if I can get some more information there.

Oracle XML Publisher - What’s it all about? by Mark Rittman

The next session I had on Monday was by Mark Rittman on XML Publisher. This was by far the most useful session I went to so far. Mark explained what XML Publisher is and did a 45 minute demo. It all looked very interesting. He basically demoed the step-by-step he published on OTN. Take a look to get a good feeling of what XML Publisher can do.

For us. XML Publisher could be a great replacement for Oracle Reports. XML Publisher brings a clear separation between data and layout/presentation. The data can come from a SQL query over JDBC, a HTTP request feeding XML data or a call to a web service. You then apply a template to this data to build the presentation. The great thing is that you can build multiple templates for the same data-set and let the user decide which template to use. This enables things like summary reports and detail reports from the same data. The user can also select their own publishing format (HTML, PDF, XLS, etc).

The template design is done in Microsoft Word (or Adobe Acrobat). This is really great, since it is much more user friendly then the Oracle Reports builder. A small macro plug in is installed in Microsoft Word. This gives you a wizard to create a first-cut report based on the previously defined data-set. This basically gives you a simple table in Word. In each table cell a Field that represents a data item from your data set. You can then use all the layout features in MS Word you like. Mark even told us you can do some (simple) scripting in the Field items. This can make you do things like conditional formatting or displaying, although it is not as powerful as the PL/SQL triggers in Oracle Reports.

The template is then uploaded to the XML Publisher server and is available for the users. As a XML Publisher admin you can set things like security making certain reports available to only specific user(groups).

You also have two ways to deliver the data in a MS Excel (XLS) file. The most advanced one installs a .Net based plug-in to MS Excel and this allows for some fancy stuff. You can do all sorts of analysis in Excel, which goes back to the XML Publisher server to retrieve the data if necessary. You can also export to a “dumb” XLS file without any active components which might be more suitable for some users.

There’s even an online Analyzer in your browser. You can do things like cross-tabs, wit summaries and filters right in your browser. Users can take this and analyze their data without even going to Excel. This is all right from your browser, with active AJAX style components.

XML Publisher comes in a number of flavours, targeted at the different Application suites within Oracle. There’s also a standalone version of XML Publisher. This is the one you should have if you’re not running Oracle Applications. You cannot get it (yet) from OTN, so you have to go to Oracle e-delivery to get your hands on it. Mark explained that the previous 5.5 version was still a bit complex to install and get running. It required quite some handwork, whereas the latest 5.6.2 version installs and runs out-of-the-box.

By-the-way: XML Publisher will be re-branded to BI Publisher later this year and will be included in the Oracle Business Intelligence Enterprise Suite priced for a whopping 225,000 dollar per processor. XML Publisher is (and will remain) available as a standalone product. This is still priced at 40,000 per processor or 30,000 as a Application Server add-on. It’s my personal opinion that this is way overpriced. Let’s hope Oracle will one day just include it in the Application Server Enterprise Edition. Perhaps I’ll do some asking around if they have any plans in that direction.

Oracle BI Roadmap by Christina Kolotouros

The next session I visited was advertised as explaining the roadmap for the Oracle Business Intelligence Suite. This one didn’t really give me the information I was hoping for. We’re not a heavy BI user, we just use some of the traditional tools within Oracle to do some reporting. This means mainly Oracle Reports and I’m trying to figure out where Oracle is heading with it and what we should be doing. This session didn’t really help me answer these questions.

It just gave me the impression that Oracle is really focusing on integrating their BI people with the former Siebel BI people and all the attention seems to go to the high end market with their BI Enterprise Edition products. This is way out of our league.

Web Application Security Part 2 by Duncan Mills

The last session for yesterday I visited was by Duncan Mills on locking down your ADF applications. This was another really interesting session. Duncan emphasised that although your using an (advanced) framework like AFD, security is your responsibility. He went on explaining about container managed security and some of the differences between JSP/Struts and JSF regarding this. Struts has some more built-in features for securing certain actions and flows. JSF does not, so you have to group your pages in directories in your web application. These directories can then easily be secured by container managed security specified in your web.xml.

He showed a very nice open source framework he’s working on, named JSF-Security. You can find it on sourceforge and it extends the JSF Expression language with securityScope. This enables you to check if security is enabled, the username of the logged on user, the authentication type or if the logged on user is in a role. This is all done by simple EL expressions that you can use anywhere in JSF. You can typically use this with the rendered property to hide items or you can make items read-only.

But do remember that this is only security by obscurity. You shouldn’t rely on this. It is just making things hidden or read-only in the user web browser as it should. There’s nothing stopping a user (or hacker) still sending this data changed in the next HTML form post. So be sure to really check for security elsewhere also. For example in your ADF Business Components, which is the second demo he showed.

Duncan also showed the use of SYS_CONTEXT to store addition metadata in your database session. Since most web applications use features like session pooling, they all use the same database user to connect to the database. This means you cannot use the USER pseudo-column to determine which user is logged in things like triggers. The same goes for things like role grants. Duncan showed how to override the prepareSession() method in your application module. You can use this method to pass the “real” end user to the database and store it in a SYS_CONTEXT.

We already do something very similar so this wasn’t really new to me. But I sat next to a guy who’s also on the customer advisory board of Development Tools whom I met at OpenWorld last year. He told me they’re also doing the same thing, but they also use role grants in the whole setup. Their big application user has all the necessary roles granted but they’re initially all disabled. During the prepareSession() stage only the roles appropriate for the current user are enabled. We didn’t think of that yet, but that’s adding an extra layer of security. I must make sure to put this in a RFC when I’m back in the office.

This completed my session for Monday. In the evening I went for dinner with the guys from Amis, who’re also here and run a couple of presentations. I’ve also agreed to meet up with Mark Rittman tomorrow for a couple of beers, and I’m looking forward to that. Socializing is one of the perks of attending these conferences and is where you get all the in-depth information. I’ll blog again with a summary of the sessions on Tuesday.