mORMot Open Source

The Elevate Web Builder (EWB) book is available at Amazon: UK, EU and USA.  250 pages are advanced stuff, and 50 pages are introductory to EWB,
but it all assumes you have a good Delphi/FPC background.  There is no introduction to Pascal or OOP or Forms.

I live in Canada, so I actually have to order it from the US store because it's not yet carried in my own country...yet.  My other books are listed everywhere, I think they just have to have enough time/volume to be listed everywhere.  This one was just released on the weekend.
- - -
My current project is a Mormot book, which I've been working on for over a year now.   I'll share it with AB
to fact check as it nears completion. 

Mormot is such a rich environment, I found no shortage of material, but the real challenge was finding a coherent way
to present it accurately.

The Mormot online FAQ is obviously the definitive source for information and will always be that, but I hope to shave
off a lot of the learning curve for new users, and present interesting solutions for existing users.

The book will likely be called Delphi Enterprise Databases Using mORMot and Elevate Web Builder.  I
think they are a perfect fit (with a little help from me).  For advanced users, using only SOA, I
show how to do Active Directory/RADIUS/LDAP based logins from the EWB web client.  I am currently
working on OAuth2 logins too, but that isn't quite done. 

I freqently mention FPC/NewPascal but don't get into the intricacies of FPC/NewPascal because I
consider them a point-in-time challenge best addressed in the FAQ.

mORMot brings compatibility, performance, reliability, scalability, etc. to the table.  And it's a long term
solution because it's not tied to one vendor.  EWB brings a universal client - both through
the web, and as my current EWB book (sorry I'm jumping around here) shows, you can generate
EXEs, OS/X bins, Android APKs, IOS binaries, Win Phone bins, etc.  It's more portable than
FMX, but you can do most things FMX apps can (read bar scanner on your phone, use geolocation, etc.) when
compiled as a native EWB app.

The two give an end-to-end solution in Object Pascal and standards based technologies.

Oddly, I think my books also legitimize the topics for bosses who might be afraid of these technologies.  They are
worried about long term investments in software which is only documented online, or where there is a
steep learning curve and silos of knowledge.  With my books, a new employee can be brought up to
speed quickly, and best practices are shared coherently.

There are about 50 pages of overlap in these two books.  The remaining 250 pages in each are unique.

Erick

I took a look at newpascal.org.  Interesting. 

Questions:
1. How stable would a mormot/NewPascal server be under Linux?  Would you say you are comfortable running it in production?

2.My shop is primarily FreeBSD-based.  How stable is that newpascal version?

3. The RTTI-from-Delphi solution doesn't work for me because my staff are not licensed for Delphi, just me.

Definitely keep up the good work.

According to the mormot docs, FPC can't do server-side SOA due to RTTI limitations.  Has that been fixed yet?

Just adding moral support at this point.   

Coming from the Elevate Web Builder community (Object Pascal for Web, compiles to native JavaScript/HTML)
we are presently talking about options for server code, and many people are post-Delphi in that they don't
carry Embarcadero licenses anymore. 

We are just mashing up mormot with Elevate's product, so I'm pleased to see a glowing future for the free/affordable Pascal server code compatible with mormot.

Erick

Sorry, I forgot to mention that the book is still being proofed, so it should be available for september.

Erick

Ahhh, that was my problem.  Solved!

Question:  I see the protocol creates a problem the client has a 1/4billion odds of solving for a Man-in-the-middle attack.  What is to prevent the bad client from trying all 4 billion possibilities?  Do you close the session or do an exponential back off, or blacklist, or what? 

Thanks

For mormot.pas I see:

Call.url := Call.url+fSessionIDHexa8+nonce+CardinalToHex(
      crc32(crc32(fSessionPrivateKey,Pointer(nonce),length(nonce)),
      Pointer(blankURI),length(blankURI))

which I interpret as:

     Tix := integer(now) div 256;  // time in 256 ms incremeents

     Nonce := IntToHex( Tix, 8 );
                                                             
     s := IntTOHex( crc32( authsessionprivatekey + nonce ),8);
     s := IntToHex( crc32( s + url),8);
    sign := IntToHex( authsessionID, 8) + nonce + s;

    prf := '?';
    if Pos('?',url) > 0 then  prf := '&';
    result :=  prf + 'session_signature=' + sign;

but I'm obviously wrong.

Okay, my current problem is the session_signature value

>The URI signature, using the session private key, the user hashed password, and the supplied Client Time Stamp as source for its crc32 hashing algorithm.
...
>In this case, 0000004C is the Session ID, 000F6BE3 is the client time stamp (aka nonce), and 65D8D454 is the signature, computed by the following Delphi >expression:

(crc32(crc32(fPrivateSaltHash,PTimeStamp,8),pointer(aURL),aURLlength)=aSignature);

and PrivateSaltHash = sha1('salt'+password )

Where is the server-returned private key used in this formula, I don't see it.  That's probably why my code isn't working

Also, is aURLLength in decimal or hex or 8 character hex?

Thanks

I found the source code easier to read than the page.
But the example from javascript
http://synopse.info/forum/viewtopic.php?id=490&p=2
shows hexpasswordhash=sha256( 'salt' + password )
where 'salt' is unexplained, so I think they mean the word said
which doesn't seem compatible with the documentation.

My Mormot/EWB interfacing code will probably be hosted on Elevate's public web space
in the coming weeks after I have it more finalized.  I'm still rejigging major parts to
match the specifics of Mormot and the latest EWB Beta 2.05.

It will be a free library.  Documentation for it and EWB in general will be in my updated
book which will be released probably by September.

True, unless it is used with OAuth 2, then it is safe.

Erick

I put up a quick example of EWB with Mormot working together at http://erickengelke.com/ewb/mormot/mormot.zip
and included the sample's 3kB source code for EWB, though not all the libraries

I will have more information available before September.

I have it ALMOST working, but there is a change that needs to be made in mormot to make it work.
For JSON posts you accept:

   ID : 4
   Name : "Peter"

but embedded in EWB it uses
  "ID" : 4
  "Name" : "Peter"

which is technically valid too, but mormot doesn't seem to like it.
Make EWB not use quotes would break compatibility with systems
that allow embedded spaces.  So I think I will patch mormot to skip
the quotes. 

Wish me luck.

Erick

Yes, last night i figured out your protocol on the wire using the browser's network activity pane.
I looked at the javascript example to get started.  Having EWB replace JavaScript is a first goal, then
the more general case will be the next challenge.

Erick

http://erickengelke.com  for samples, including the web page itself.

Erick

Hi,

I bought an SmartMobileStudio license a year ago because i wanted to use it for web page development with Mormot, which I chose because of the open database layer.  My projected needed web to database connectivity.

The SMS learning curve felt steep, and so I bought the 3rd party book they advertise, but it was a few years out of date, incomplete, and abandoned.  I was a little annoyed that the sales hype for the book didn't say that.  Also, SMS version 2.2 was promised but not delivered in a long time and they reverted back to 2.1.  I wrote a few apps, but was not enthralled with it.

Someone in a Delphi group enthusiastically suggested Elevate Web Builder EWB 2.04 instead.  So I bought a copy of it and  found it had an active community, new releases every 1/2 year or so, and it felt like Delphi 7 - fast, solid, clean, well documented.  I though it delivered where SMS was still mostly promising.  Maybe in a few months SMS will change, but like everyone, I needed a solution today and to feel the product is actively being improved.

There is now a 200 page book on EWB on Amazon, I know 'cause I wrote it, it's my fourth book.  But I would recommend holding off buying the book because a 300-ish page 2nd edition will be released in about two weeks, it's being proof read by the EWB software author.  Someone here commented that EWB didn't look as powerful.  There are lots of samples on my web page showing what it can do, including OAuth 2.0 and interface with almost any JavaScript library.  It's very powerful.

I didn't write this to sell my book, as evidenced by the fact I just told you not to buy the current book.  I'm just making the point that it has a lot going for it now and that I'm a person who likes to get involved.

What I want to say is EWB includes SOA and obviously serialization and deserialization code from published properties.  But the exchange is currently different than what Mormot expects or uses.   

I haven't yet interfaced it to Mormot.  However that's what I'd like to do next, hopefully with the help of a few mormot-knowedgeable people.

I'm looking for suggestions as to whether to interface with Mormot's interface layer and data exchange, or to use EWB's database model and write a Momot layer which can talk to EWB's SOA api.  The first is more RPC-like, whereas the second would simplify use of things like Grids already available in EWB.

Obviously there are tradeoffs with each model.  Input would be helpful. 

Erick

Hmmm, I haven't been able to get it to work.

I have nexus\erick2 in my SQLAuthUser database, and when I call client.SetUser( 'nexus\erick2','asdf' )
I see it detects the name as valid because it calls function TSQLRestServerAuthenticationSSPI.Auth

Then it calls function TSQLRestServerAuthenticationSSPI.Auth() twice.  The first time there is no error, but
the second time it raises OS error 87 bad parameters in the function call ServerSSPIAuth()
in the call to AcceptSecurityContext().  I'm sure the userid/password is right, I've tried it a dozen times

I had called  aServer := TSQLRestServerDB.Create(aModel, ':memory:', True);
because I think we are wanting to authenticate users though not passwords from the DB.

FWIW, the socket is on a 127.0.0.1 address.

I see firedac can support mysql, but I only have Delphi professional version, and we want database stored on a separate server, so firedac is out.

A collegue of mine figured it out for me, so I'm documenting for those who follow me.

You enter:

  pseudoname := 'mysql.3';
  MySQL := TOLEDBODBCSQLConnectionProperties.Create( pseudoname, pseudoname, '', 'UseridBlah', 'passwordDooHicky');

Then, as long as you have no mismatch between the driver bitness (32 versus 64), it works.

Thanks

Okay, I think I've figured it out.  Trying the above and dumping the database confirmed that the entries were in separate tables like I wanted.

Yes, I was looking at exactly that.  My first thought had been to accept msqldump-styled text input, but then I saw syndbexplorer already could learn the database on-the-fly.  I will experiment and get back to the forum when I have something.

Erick