Delphi HTTPRIO Certificates - web-services

I uptaded Delphi to the 10.3.2 version. My app worked well using a webservice with HTTPRIO and certificates in the previous version I was working with (10.1). I changed a few things to make it compile&run. But I'm facing a problem now.
I have a combobox with all the certificates in the machine so the user can select the one he needs.
The first time I only do this:
HTTPRIO1.HTTPWebNode.ClientCertificate.SerialNum:= CertificatSerialNumber;
and in the HTTPRIO1HTTPWebNode1NeedClientCertificate event I set the AnInteger value properly.
This way it works fine.
The thing is if the user selects another certificate, even I set the SerialNum property with the new value the OnNeedClient event is not triggered again so it still uses the first certificate. Is there a way to reset the certificate so I can set it every time I make the request depending on the combobox selection? Am I doing anything wrong?

Related

Item updated via CSOM will not fire remote event receiver

We have a remote event receiver associated to a list and hooked on all events there. When you update any list item using OOB SharePoint page, the event receiver is executed; a web service which is taking care of the afterward actions works nicely. However when you update item use CSOM code e.g. in simple console application, nothing happens. The event receiver is not called at all. I found this issue on both SP 2013 and 2016.
I will not post any code while it is irrelevant: item is updated using standard approach and values are actually changed in the list item, only the event receiver is not fired. To put it simply:
item updated manually from site -> event receiver fired
item updated via CSOM -> event receiver not fired.
I remember similar issue on SharePoint 2010 when using server side code and system account. Could it be that behind the scene web service called by CSOM (e.g. list.asmx) is using system account to make changes as well? It's just hypothesis...
So after deeper investigation and many try/fails we found out it was indeed issue with code in our event receiver. For some strange reason original developers were checking Title field in after properties and cancelling code if not present. I guess it was probably an attempt to prevent looping calls.
One lesson learned: When using CSOM after event properties contains only those fields which were altered by CSOM code. Keep it in a mind in case you need to use other values than those you want to update. You may need to stupidly copy and assign them again just because of this.

System.ServiceModel.FaultException: Server was unable to process request. ---> ... with key 0 was not found

I have a simple service (C# web service) that accepts an integer and returns an integer, i have tested it using Storm it is working properly.
Now i am calling this service in a for loop in a file with around 2000 records approx, this service is failing giving the above error with some records. If i run the error file it goes through as if nothing was wrong, what might be the problem please help.
The error doesn't seem related to it being a web service call: it seems to indicate you either tried to GetEntity and passed in a zero/NullIdentifier() (not a valid Id), or maybe you tried an CreateEntity and that entity has a foreign key that is not filled in (i.e. zero/NullIdentifier() again).
I would start by checking the logic inside the WS method for those action calls and the inputs you are using there.

How to clear cookies in loadrunner 12.50

I am quite new to LoadRunner. I am using the 12.50 community edition and am using the protocol TruClient for web.
What should i do in order to delete the cookies that the LoadRunner has accumulated while doing interaction with browser?
As suggested by tserg42, you could add a separate step inside your "Develop Script" of TruClient for adding the "Utils.clearCookies()" command inside a Javascript action.
Please find the screenshots below for adding the above
Step 1
Drag the marked step on to the script
Step 2
Step 3
Upon clicking the "JS" icon at the right corner, the arguments editor would be available for providing javascript commands. Key in the required commands - "Utils.clearCookies()".
Additionally, you can also check "Simulate new user on each iteration" checkbox from Runtime Settings --> Replay --> Simulate new user on each iteration
I guess you are looking for the function web_cleanup_cookies(). Here is some relevant information I have found about its use:
Return Values
This function returns LR_PASS (0) on success and LR_FAIL (1) on failure.
General Information
The web_cleanup_cookies function removes all the cookies that are currently stored by the for use by the script.
Note: Scripts do not use (access or modify) the cookies that are stored by your browser. Instead, each Vuser uses the cookies that are sent to the Vuser by the server host at runtime. These cookies are maintained only while the script runs. The web-cookie functions (web_add_cookie, web_remove_cookie and web_cleanup_cookies) manipulate these temporary cookies, and do not affect cookies stored by your browser.
This function is supported for all Web scripts, and for WAP scripts running in HTTP or Wireless Session Protocol (WSP) replay mode.
You could try Utils.clearCookies() method. By the way, TruClient API documentation is available online.

Setting Tomcat 7 sessionid and value to be identified via Hardware Load Balancing for session affinity

Although easily done from my perspective with IIS, I'm a total noob to Tomcat and have no idea how to set static values for cookie contents. Yes I've read the security implications and eventually will access via SSL so I'm not concerned. Plus I've read the Servlet 3.0 spec about not changing the value and I accept that.
In IIS I would simply set a HTTP Header named Set-Cookie with an arbitrary setting of WebServerSID and a value of 1001.
Then in the load balancer VIP containing this group of real servers, set the value WebServerSID at the VIP level, and for the first web server a cookie value of 1001 and so one for the remaining machines 1002 for server 2, 1003 for server 3.
This achieves session affinity via cookies until the client closes the browser.
How can this be done with Tomcat 7.0.22?
I see a great deal of configuration changes have occurred between Tomcat 6.x and 7.x with regard to cookies and how they're set up. I've tried the following after extensive research
over the last week.
In web.xml: (this will disable URL rewriting under Tomcat 7.x)
<tracking-mode>COOKIE</tracking-mode> under the default session element
In context.xml: (cookies is true by default but I was explicit as I can't get it working)
cookies=true
sessionCookiePath=/
sessionCookieName=WebServerSID
sessionCookieName=1001
I have 2 entries in context.xml for sessionCookieName because the equivalent commands from Tomcat 6.x look like they've been merged into 1.
See http://tomcat.apache.org/migration-7.html#Tomcat_7.0.x_configuration_file_differences
Extract:
org.apache.catalina.SESSION_COOKIE_NAME system property: This has been removed. An equivalent effect can be obtained by configuring the sessionCookieName attribute for the global context.xml (in CATALINA_BASE/conf/context.xml).
org.apache.catalina.SESSION_PARAMETER_NAME system property: This has been removed. An equivalent effect can be obtained by configuring the sessionCookieName attribute for the global context.xml (in CATALINA_BASE/conf/context.xml).
If this is not right then I simply do not understand the syntax that is required and I cannot find anywhere that will simply spell it out in plain black and white.
Under Tomcat 6.x, I would have used Java Options in the config like:
-Dorg.apache.catalina.SESSION_COOKIE_NAME=WebServerSID
-Dorg.apache.catalina.SESSION_PARAMETER_NAME=1001
The application I'm using does not have any of these values set elsewhere so it's not the application.
All these settings are in context/web/server.xml files at the Catalina base
At the end of the day what I need to see in the response headers under Set-Cookies: (as seen using Fiddler) is:
WebServerSID=1001
NOT
JSESSIONID=as8sd9787ksjds9d8sdjks89s898
thanks in advance
regards
The best you can do purely with configuration is to set the jvmRoute attribute of the Engine which will add the constant value to the end of the session ID. Most load-balancers can handle that. It would look like:
JSESSIONID=as8sd9787ksjds9d8sdjks89s898.route1
If that isn't good enough and you need WebServerSID=1001 you'll have to write a ServletFilter and configure that to add the header on every response.

How to add software update subscription

We want to add auto-update or update notification to our products (C++).
Update should be subscription-based:
user buys subscription for 1 year of updates
when subscription expires, no more updates are available.
Can someone suggest software or provider for implementing such a service?
I found a few examples of auto-update but they all are unlimited in time.
This service must be limited on per-user basis and allow extensions.
What you would need, in terms of ingredients, would be:
a method to download the updates - I would suggest HTTP(S) for that
a method to encode the license, including what kind of updates you're entitled to and how long you're entitled to it. Ideally, this would be opaque to the user but easily verifiable on both ends (so an erroneous entry can be notified to the user without having to contact the server)
an easy way to know whether updates are available, and perhaps when to check again
What I would suggest would be to define a simple XML over HTTP service using an embeddable HTTP client, such as (shameless plug) Arachnida, with a simple API - something like:
class UpdateAgent
{
/* boilerplate */
public :
/* set the key to use. Throws an InvalidKey exception if not valid
* validity is checked locally - no HTTP queries are used.
* Key may have been invalidated on the server without notification
* at this point */
void setKey(const std::string &key);
// Get the key currently set
std::string getKey() const;
/* using a synchronous HTTPS query, check with the server if updates are
* available for the current key. Throws on error: one of the QueryError
* subclasses if there has been a query error, or InvalidKey is the
* key is either not set or is not valid (i.e. invalidated server-side) */
bool isUpdateAvailable() const;
/* etc. */
};
They key itself would, as seen above, be a string that, through its encoding, would contain some kind of information as to its validity - e.g. some kind of CRC to know whether the entered string is valid. The rest of the key - including its expiration date - could be managed server-side, although expiration information could also be encoded in the key itself (but that would mean changing the key if the user extends the license).
As for the server-side, when presented with a key and a request for an update, the server would
check the validity of the key
check whether any updates are available for the software the key is for (information that may or may not be part of the key itself, depending on whether you want to manage it in a database or want it to be part of the license key)
copy or hardlink the file into a place it can be downloaded, with a unique and hard-to-guess name
provide the URL for download to the client - e.g. in an XML stream returned for the HTTP request
start a time-out to remove the file after it hasn't been downloaded for N seconds/minutes/hours
remove the file once it has been downloaded by the client
If a download fails, it can be restarted or asked for again. If you want to charge for individual downloads, you'd need the client to confirm a successful download - or report an error on failure - so you don't count individual downloads twice.
Of course, all this is off the top of my head - there might be some details I haven't thought of here. Each of the ingredients are pretty easy to come by. An open source version of Arachnida is available on SourceForge and I have some code to encode license keys if you need it (used it for another of my products), but I'm sure that you can write that if you don't want to use mine.
A few things you might want to think of are secure authentication of your clients - so they don't share license keys - securing your HTTP connection so you don't end up publishing your updates to the world, etc. Neither the server nor the client need be very complicated to implement, as most of the building blocks already exist.
HTH
rlc