Intuit Partner Platform team blog

The "Security Review": What to Expect

by Philip Leslie; ProOnGo Expense

If you are new to the Intuit Partner Platform, one step in the process that might have caught your eye is the security review that happens once you've finished development and internal testing. It's a checkpoint that helps maintain a high quality bar on apps that are destined for Intuit App Center or live customers, and emphasizes the unique security expectations that come with your request to access sensitive QuickBooks data.

If you've already pencilled in some time on your calendar to navigate the security scan, you are no doubt trying to size the effort involved in preparing for the scan, going through the scan, and following up to solve any vulnerabilities discovered during the scan. The purpose of this post is to give you a practical perspective on some of the time, effort, and resources that go into successfully passing the scan. As the developer of ProOnGo Expense, we've been through the scan several times, and so I'll speak from first-hand experience.

Part 1: Preparing for the Security Scan

Some startups that are launching a web app for the first time start out with the "deploy first, test second" strategy; i.e., going straight from testing on localhost to deploying to a public-facing "live server", with no intermediate "staging server". If that describes your current arrangement, it's time to graduate to a deployment strategy that provides some level of isolation on a staging or test server. Why? The security scan will definitely include attacks where the test is clearly trying to peg the CPU (sometimes on a sustained basis, sometimes momentarily):


Equally certain, is that your site will be exposed to SQL injection, XML injection, XSS attacks, and various SSL and TLS-related validation. All of these are things you'll want to experience first on a staging/test server, to harden your security in an isolated environment. Your server logs will suddenly become much more interesting than usual, with tens of thousands of requests like this trivial example:

https://example.com/yourscript.php?page=1%3Ciframe+src%3Djavascript%3Aalert%2868140%29%3E 

Although my observation is that the tests are designed to be as non-destructive as possible, the dynamic nature of the tests combines with the sheer volume and variety of test cases, makes it impossible to predict what impact they would have on your system.

At ProOnGo, here are some of the steps we take to prepare for a security scan. Our terminology is AWS-centric, but the concepts apply equally to Azure and other cloud-hosting options:

• Web Server Machine Image & Instance: We create a machine image of our staging server, frozen at a last-known-good changelist, and we spawn a new/isolated/separate instance of the staging server to be the target of the security scan.
• Database Image & Instance: We bring up a database instance that is conforms to the normal database schema used by our live server, but containing none of the live customer data that our production database contains. Then, we dump output containing MRU timestamps of the DB tables, so that later on we can easily determine which tables were written to (and which ones weren't) during the test.
• Session-Handling: We isolate our session-handling infrastructure similarly; ensuring that any SESSION-related attacks are sandboxed from having any production impact (I'm looking in your direction, shared instances of memcached)
• Outbound Network Scrub: We scrub-and-disable certain parts of our source tree that lead to calls to external service providers; i.e., just because we're going through a security scan, does not mean that our partners are prepared to. We disable certain code that triggers outbound mails, eCommerce actions, and other services.
• Log-Clearing: We clear our web server logs, so that we don't have to wonder what portion of the logs were caused by the security scan.

While taking these and other actions, you'll also want to preview the security questionnaire. This is one of the easiest things you can do to save yourself time: if you spot anything in the questionnaire where you know or believe you have a vulnerability, save yourself some time by mitigating up front. The alternative -- failing the test, mitigating, potentially re-testing, and all of the coordination that goes along with it -- will undoubtedly delay the launch date of your production app.

Part 2: Going through the Security Scan

One of the terrific things that's happened during all of the security scans we've been party to, is that we've been able to request that the bulk of the testing happen within a particular 2-3 day time period. Further, each time we've agreed on a particular time-of-day for the test to start. That's been helpful because we can literally be viewing the tail of the web server log at the very minute that the testing is scheduled to begin, to be sure that it's off to a successful start. Although we do our best to be sure that our instances are ready for testing, there's nothing like seeing the web traffic start to flow to know that the security scan process is underway.

If you watch your web server logs and your diagnostics related to disk I/O, CPU, and memory use, you'll get the added benefit of watching to see whether your various throttling, fail-over, and/or auto-scaling triggers get tripped and whether they respond the way you designed. It can be difficult to get a full grasp of that in a post-mortem analysis; we prefer to watch this happen interactively. Another benefit of watching your logs interactively is that you start to see patterns of the kinds of attacks that are being tried, and perhaps that knowledge will help you manually scrutinize parts of the system that you know are not getting the full brunt of the testing.

We've also had situations where our throttling precautions caused us to dramatically slow or stop the acceptance of web traffic from the test, and it was helpful to catch that early on and work out a plan with the security test team to get them "the access they needed" while still taking credit for the fact that our throttling did what it was supposed to do.

We've never seen a scan take fewer than several hours, and we've never had it take more than three days, but as always "your mileage may vary".

Part 3: Following-Up on the Security Scan

Sometime after the scan (likely within a week), you'll find yourself on the phone with the penetration testers that administered the scan, walking through a report of their findings. The first time (and every time since) we've appreciated the level of detail in the report. In many cases, the findings will come with an example of an HTTP request that demonstrates the defect. You may or may not have access to the same tools that the penetration testers used, but if you sharpen your cURL command-line skills, you'll have a good chance at repro'ing many of the HTTP POST, HTTP GET, TRACE, or TRACK attacks.

As for XSS attacks, you'll likely find yourself at a browser window pasting in a URL with a frightening string of characters in the params. You might need to have your web server send a "X-XSS-Protection" header, to cause your webkit browser act naive about XSS (therefore acting a little bit like an older less cautious web browser). If you are a Chrome or Firebug fan, or a fan of IE's F12 developer tools, you'll want your console, call stack, and network activity at-the-ready so that you can see the exploit in action.

For SQL injection attacks, you'll probably find yourself diffing the MRU timestamps on your SQL tables, before and after running a cURL command line or browser-based copy-and-pasted URL.

For SSL-related vulnerabilities (like weak cipher availability, CRIME, BEAST, certificate chain problems, and others), you might find yourself using one of the web-based scanners like this excellent one from Qualys, as you work to mitigate the vulnerability and test your fix.

Once you've mitigated the vulnerabilities uncovered by the penetration testers, you'll touch base again to explain your fixes, and to work together to plan any next-steps -- the eventual outcome being that you will fill out the security questionnaire to apply for production access.

See You Next Time: And, there will be a next time...

Once you are granted production access, know that the security scans will become part of the rhythm of your business -- they happen on a recurring basis. The good news is, you'll get better and more efficient and handling them over time (nine runs in, we're getting pretty good at it).

Good luck navigating the security scan process, I wish you smooth sailing and a rapid arrival on Intuit App Center -- see you there!

ODE to OAuth and Rest API’s and how I love thee – NOT

We always get questions about the Rest API’s and what they return versus what is returned through the SDK requests.

Well, my goal was to find an easy way to test the API’s without much trouble. To test QuickBooks desktop this was fairly easy. Just log in to workplace or your app with the appropriate company file open and in a new browser you could send the request and get a response. You could also do this with Poster and Post the body to the requested URL and you would get an answer.

Of course QuickBooks online wasn’t going to play as nice, so I had to figure out the best way to send the request. In doing so, I came across some great websites that can help make the process go smoother and help with creating OAuth signatures.

Where to begin….   Let’s get the RESTClient installed first. This is a Firefox addon that can be found at https://addons.mozilla.org/En-us/firefox/addon/restclient/. This client works well because it has the ability to add OAuth headers as well as calculating the OAuth signature when sending the request.

Once you get the RESTClient installed and running, it should look something like this:

 

Great, so now that it is installed and working, let’s move on to configuring it. This process can be used to access both QuickBooks Online (QBO) and QuickBooks Desktop (QBD) data from IDS.

1. Login to https://workplace.intuit.com and select your Intuit Anywhere (IA) application
2. Select the Development tab and make sure you have configured the QBO and/or QBD Data Source section.
3. Scroll down to the bottom section of this page and select the “Test connect to app (OAuth)” link under the Testing Your App section.

 

4. This will bring up the Intuit Anywhere Developer Playground.  Select the Connect to QuickBooks button to go through the OAuth flow for authorizing your app to have access to the QuickBooks company data. (Your Consumer Secret key will be filled in.)



5. Select QBO or QBD depending on how you configured your App above, select company and authorize.







6. Select App Menu API test from the Post-Connection Interactions section of the screen. (Your Consumer Secret key will be filled in.)



7. Now for the best part, here are your Consumer and Access Token keys and secret keys needed for signing the OAuth connections. You can also test some of the requests from this screen, but it won’t handle all the data requests, so that is the reason I am using the RESTClient addon. (Your Consumer Secret and Access Token Secret keys will be filled in.)



8. Select the RESTClient tab from earlier or if you closed it, open a new tab and start the RESTClient.
9. Select the Headers pull down and select the Custom Header. This will open a window where you will need to add the Content-Type with application/x-www-form-urlencoded as the value.



10. Select the Authentication pull down and select OAuth. This will open the OAuth window where you will put the keys from the OAuth API Console (Step 7) so that it can automatically update the OAuth signature when you make the request. When you select Insert, it will ask you if you want to automatically create a new signature each time. You should select yes. (Make sure to copy the Consumer Secret and Access Token Secret keys.)



11. You are all done. Oh, you want to see the request work. Me too. I am going to make a call to QBO services and retrieve a customer listing for my realm. The URL is the same as what you would use from the docs.  https://[baseurl]/[realm]
    1. Go here - http://oauth.googlecode.com/svn/code/javascript/example/signature.html
    2. Enter all the information requested. Yes, a majority of the values are exactly what was used in the RESTClient above except for the timestamp and nonce.  (Screen shot below.)
    3. Press the Sign button and there you go. If you captured a request from about using something like Fiddler or Firebug, you can plug in the timestamp and nonce and you should get the exact same signature as was sent from the RESTClient.

Make sure you select Response Body in the response section to see the results.



QBO Rest API’s: https://ipp.developer.intuit.com/0010_Intuit_Partner_Platform/0050_Data_Services/0400_QuickBooks_Online

QBD Rest API’s: https://ipp.developer.intuit.com/0010_Intuit_Partner_Platform/0050_Data_Services/0500_QuickBooks_Windows

There you have it. Just make sure when are going through and authorizing the company that the URL you send in matches the company otherwise you will get an error.

Here is a way to create or verify your implementation of an OAuth signature for your request.

        



I hope this helps and enjoy.

Other consoles available, but not tested.

REST Console for Chrome: https://chrome.google.com/webstore/detail/cokgbflfommojglbmbpenpphppikmonn

– William Lorfing – IPP Developer Relations

 

Update - October 10, 2012

It looks like the rest Client is not creating the signature correctly.

Here is how I got it to work correctly:
1. Go to http://oauth.googlecode.com/svn/code/javascript/example/signature.html and enter all the information for the signature.
2. Copy the Authorization header after you have created the signature
3. Go back to the rest client and clear the headers
4. Set the Content-type to application/xml (for create, update and delete)
5. Create a new header Authorization and past the Authorization Header from the googlecode page.

Then you can send the contents to QBO.

How to get Flex to produce a PDF file using Flash Player 10

Hi. My name is William Lorfing and I a Development Support Engineer for the Intuit Developer Network.

I have been with Intuit for over a year now and one of the questions that comes up from time to time is to show an example of how to get a Flex app to produce a PDF file.

My thoughts were, "that shouldn't be too hard!". Now where do I find that code on Google? Ok, it was a little harder than I thought. I am new to Flex, so I had to work through getting the environment set up and figuring out how to load the external libraries. Another problem was that if you were using Flash Player 9, you couldn't create the PDF on the client, but had to use the server to do this. With Flash Player 10, they allowed you to write files locally, so this was the way I went.

Well, Google was helpful and took me to Holly Schinsky's Devgirl's Weblog where she created a Flex script for creating a PDF file for Adobe's Tour de Flex. So, this is where I will begin my journey.

I started by creating a new Flex Project and importing the Open Source AlivePDF library from http://code.google.com. (This might not have been the correct way to do it, but it worked for me.) I tried using the RC version, but for some reason it didn't work, so I ended up downloading the latest SVN version and that worked.

I wanted to start simple, so I created a basic UI with a multi-line text box and a save button. The save button then called a couple of functions from the AlivePDF library to create the PDF pages and then a call to the FileReference save method and poof you have a PDF file.

Building a PDF file using the AlivePDF library, is much like designing a graphical interface. You put your text fields and graphics at certain positions on the page and the library takes care of the rest. I am not good at UI's so I stuck with the basic and just put the text from the Flex text box into the PDF.

Here is what the I came up with.

<?xml version="1.0" encoding="utf-8"?>
<mx:Application xmlns:mx="http://www.adobe.com/2006/mxml" layout="absolute" >

    <mx:Script>
        <![CDATA[

        import flash.display.*;
        import flash.events.*;
        import flash.net.*;
        import flash.text.*;
       
        import org.alivepdf.pdf.PDF;
        import org.alivepdf.layout.Orientation;
        import org.alivepdf.layout.Size;
        import org.alivepdf.layout.Unit;
        import org.alivepdf.saving.Method;
       
        import flash.utils.ByteArray;

        protected var frPDF:PDF;

        private function onSave(e:Event):void
        {
            frPDF = new PDF(Orientation.PORTRAIT, Unit.MM, Size.LETTER);
            frPDF.addPage();
            frPDF.addMultiCell(200,5,desc.text);
            var bytes:ByteArray = frPDF.save(Method.LOCAL);
            var f:FileReference = new FileReference();
            f.save(bytes,"sample.pdf");
             
        }
        ]]>

    </mx:Script>   

    <mx:Label top="10" left="10" text="Enter text, then press Save to PDF." />   
    <mx:HBox width="100%" height="100%" top="40" left="10" >
   
        <mx:Canvas top="10" left="10" width="300" height="100%">
            <mx:Label text="Description:" y="2"/>
            <mx:TextArea id="desc" y="18" height="133" width="205"/>   
        </mx:Canvas>
    </mx:HBox>
   
    <mx:HBox top="205" left="50">
        <mx:Button horizontalCenter="0" click="onSave(event)" label="Save to PDF" id="savePDFBtn"/>
    </mx:HBox>
   
</mx:Application>

There are a lot of different methods in the AlivePDF library, so have fun and play around with some of them.

Thanks,

William

Welcome Flex 4 (And for IPP Native Developers...Now What?)

Hello!!  My name is Anjali Kucheria and I’ve recently become a Developer Relations Engineer at the Intuit Partner Platform (IPP) team.  I’ve been a Flex Developer for some time now, specifically focused on the user-interface, styling and skinning aspects of development. I’m super enthused about my new role.  I’m also very excited about the launch of Adobe's new Flex SDK. I’m sure Flex developers will rejoice in  the enhancements in this new release!

Recently, Adobe released its much-awaited  version of the Flex Framework (Flex 4). Developed under the code name ''Gumbo", Adobe has enhanced the framework in several ways (Note: The Flex 4 development environment will be known henceforth as Adobe Flash Builder (previously known as Adobe Flex Builder):

•    Bridging the gap between designers and developers.  Adobe has built a new, comprehensive UI framework known as Spark.  Spark lies on top of the existing MX architecture, allowing the MX components to easily integrate with the new Spark components.  Spark also carries with it a new approach to skinning.  At a high-level, the new framework provides a clear delineation between the “look” of a component and the wiring behind a component.  For more information see  brief overview of the Spark architecture and component set".

•    Did you find yourself constantly struggling with the idea of States in Flex 3? Have no fear, With Flex 4, Adobe promises to unravel some of the complexities surrounding this often confusing, but also useful concept.  No longer will you need to use the <mx:SetProperty> for changes to button properties; Flex 4 denotes states simply by a dot notation   within the original component. For a more detailed explanation see: Flex 3 vs Flex 4 State Management.

•    Flex 4 allows you to connect to data services seamlessly.  For those who’ve done this with prior Flex releases, you will be pleasantly surprised with the new simplicity and intuitiveness.  The provided wizard interface eliminates common errors and misunderstandings and allows you to simply enter the required URLs.  To learn more, see Flex 4 & Data Wizards Make Life Easy.

•    Flex 4 allows for far more flexibility with layouts than in previous versions. Flex 4 introduces   layout objects which separates the layout logic from the component itself,  allowing far more design ingenuity. 

•    Flex 4 simplifies 2 way binding greatly.  All that a developer needs to do is add the ‘@’ character to the property that is to be bound.  For example to bind the text property of one Text areato another,  it can be done like this:

<mx:TextArea id=”textArea1”/>

<mx:TextArea id=”textArea2” text=’@{testArea1.text}’ />

What does this mean to IPP "Native" Developers?

We’ve developed a two-phased approach to transition our developers to the Flex 4 SDK and Adobe Flash Builder 4. What you can expect in the coming months:

•    We will be supporting Adobe Flash Builder 4(FB4) with the IPP SDK tools.  Initially, we will support FB4 with the Flex 3 SDK only.  If you choose to upgrade to FB4, you will automatically be upgraded to JVM 1.6.  For those who develop on a Mac and choose to upgrade to FB4, please be sure you run, or upgrade to, Snow Leopard.  Your application will not be backwards compatible.   Our recommended install is during this phase is Eclipse (Ganyanede 3.4/Galileo 3.5) with Flex 3.4 SDK and the Flash Builder 4 plugin.

•    Subsequently, we will support the Flex 4 SDK.  Once this upgrade occurs, your application can fully utilize the Fx and Spark component architecture (along with the existing Mx components) along with the state, layout and other Flex 4 SDK enhancements.

More details about IPP’s integration and support of the new Flex tools and SDK will be furnished upon the IPP tools 2.7 release.

In the meantime, we invite you to comment, ask questions/concerns you may have with regards to the Flex 4 and we will provide the necessary guidance. Also, please visit the forums IPP developer forums which is a great resource to post your questions as well as see other developers concerns and questions and the solutions. 

thanks!

Anjali.

Federated Applications: Generating your x.509 certificate in Java, OpenSSL or .Net

Are you ready to create a Federated Application on the Intuit Partner Platform? Need help generating your x.509 certificate for testing? Coding in Java or .Net? Here's how...

You need to provide Intuit with your public key if you wish to Federate your application, here are the instructions for generating those x.509 certificates. Keep in mind these tools generate your certificate for testing only!

Microsoft .Net Instructions:

exe: MakeCert.exe

Location: C:\Program Files\Microsoft Visual Studio 9.0\Common7\Tools

Step 1: Create the .cer and .pvk, you will be prompted to create a password.

MakeCert -r -pe -ss IPPSampleStoreName -n "CN=IPPSample" IPPSample.cer -sky exchange -sv IPPSample.pvk

Step 2: Combine both files into the pfx file which is easily used by the .Net framework. Password is intuit for this example.

pvk2pfx -pvk IPPSample.pvk -pi intuit -spc IPPSample.cer -pfx IPPSample.pfx -f

Step 3: Submit a support incident with your inbound SAML gateway and the .cer file you just created.

Java KeyTool Instructions:

exe: KeyTool.exe

location: C:\Program Files\Java\jdk1.6.0_14\jre\bin

C:\>keytool -genkey -alias ippsample-validity 1095 -keyalg RSA -keystore keystore.jks

Enter keystore password:  intuit

C:\Program Files\Java\jdk1.6.0_14\bin>keytool -genkey -alias ippsample -validity

1095 -keyalg RSA -keystore keystore.jks

Enter keystore password:

Re-enter new password:

What is your first and last name?

  [Unknown]:  Intuit Partner Platform

What is the name of your organizational unit?

  [Unknown]:  PaaSG

What is the name of your organization?

  [Unknown]:  Intuit Inc

What is the name of your City or Locality?

  [Unknown]:  Waltham

What is the name of your State or Province?

  [Unknown]:  MA

What is the two-letter country code for this unit?

  [Unknown]:  US

Is CN=Intuit Partner Platform, OU=PaaSG, O=Intuit Inc, L=Waltham, ST=MA, C=US co

rrect?

  [no]:  yes

Enter key password for <ippsample>

        (RETURN if same as keystore password):

Re-enter new password:

C:\>keytool -list -v -keystore keystore.jks

Enter keystore password:  intuit

Alias name: ippsample

Creation date: Jul 20, 2009

Entry type: PrivateKeyEntry

Certificate chain length: 1

Certificate[1]:

Owner: CN=Intuit Partner Platform, OU=PaaSG, O=Intuit Inc, L=Waltham, ST=MA, C=U

S

Issuer: CN=Intuit Partner Platform, OU=PaaSG, O=Intuit Inc, L=Waltham, ST=MA, C=

US

Serial number: 4a64c596

Valid from: Mon Jul 20 15:29:26 EDT 2009 until: Thu Jul 19 15:29:26 EDT 2012

Certificate fingerprints:

         MD5:  AF:90:1D:41:1A:33:9D:70:CF:EE:B3:6F:C3:30:B9:65

         SHA1: 2B:D4:E7:CA:A2:A6:9F:77:AE:A3:5D:55:E3:DA:C3:AE:35:A1:87:BB

         Signature algorithm name: SHA1withRSA

         Version: 3

*******************************************

*******************************************

*******************************************

*******************************************

C:\>keytool -list -rfc -keystore keystore.jks

Enter keystore password:  intuit

Keystore type: JKS

Keystore provider: SUN

Your keystore contains 1 entry

Alias name: ippsample

Creation date: Jul 20, 2009

Entry type: PrivateKeyEntry

Certificate chain length: 1

Certificate[1]:

-----BEGIN CERTIFICATE-----

MIICXTCCAcagAwIBAgIESmTFljANBgkqhkiG9w0BAQUFADBzMQswCQYDVQQGEwJVUzELMAkGA1UE

CBMCTUExEDAOBgNVBAcTB1dhbHRoYW0xEzARBgNVBAoTCkludHVpdCBJbmMxDjAMBgNVBAsTBVBh

YVNHMSAwHgYDVQQDExdJbnR1aXQgUGFydG5lciBQbGF0Zm9ybTAeFw0wOTA3MjAxOTI5MjZaFw0x

MjA3MTkxOTI5MjZaMHMxCzAJBgNVBAYTAlVTMQswCQYDVQQIEwJNQTEQMA4GA1UEBxMHV2FsdGhh

bTETMBEGA1UEChMKSW50dWl0IEluYzEOMAwGA1UECxMFUGFhU0cxIDAeBgNVBAMTF0ludHVpdCBQ

YXJ0bmVyIFBsYXRmb3JtMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCei1lo3plI7r9gQqOe

TiqcZ0sWmlhGovtr4jNIs6Nib9lAdzOAWEzOqPMu2uNjOomo5bgOtHNpGk3FRqCp38KIy1V9osNu

2rV2qT3Fa8W6A1BB5myHKclOwMss/w/gFc5y/lwx2NaqVc6WiChF7hhgCAHxmAHwjASsWhzUxqQd

zwIDAQABMA0GCSqGSIb3DQEBBQUAA4GBAGlsQBfhGS2zliVMybDzT9oLEjnZF/h+ZjLevkUArhT9

DTPztd4uj6RC58/TYHQp9O67zu/JOYewRmsoo902nQJDOkRdGC6SDIUqSw6CNhN0MJufzSQQxfWd

iRgCVeAzt3sNrh+nY49Zcuz001Xpss+6xTN9uuCSpsVIDohprlyR

-----END CERTIFICATE-----

*******************************************

*******************************************

C:\Program Files\Java\jdk1.6.0_14\bin>keytool -export -rfc -alias ippsample -keystore

keystore.jks -file ippsample.crt

Enter keystore password:

Certificate stored in file <ippsample.crt>

keytool -importkeystore -srckeystore keystore.jks -srcstoretype JKS -deststoretype PKCS12 -destkeystore keystore.p12

NOTE: If you are using a cert that is not signed by a recognized CA (like the self signed cert as described above), you need to import the public cert into the cacerts file on the system that is running the gateway:

$ keytool -import -trustcacerts -keystore $JAVA_HOME/jre/security/cacerts -file ./ippsample.crt -alias ippsample

Open SSL Instructions:

C:\OpenSSL\bin>openssl.exe req -x509 -nodes -days 365 -newkey rsa:1024 -keyout sdgidfedapp11.corp.intuit.net.key -out sdgidfedapp11.corp.intuit.net.crt

Loading 'screen' into random state - done

Generating a 1024 bit RSA private key

..................++++++

........++++++

writing new private key to 'sdgidfedapp11.corp.intuit.net.key'

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [AU]:US

State or Province Name (full name) [Some-State]:California

Locality Name (eg, city) []:San Diego

Organization Name (eg, company) [Internet Widgits Pty Ltd]:Intuit

Organizational Unit Name (eg, section) []:IAM

Common Name (eg, YOUR name) []:sdgidfedapp11.corp.intuit.net

Email Address []:

C:\OpenSSL\bin>

Lastly,

Submit your .crt file and your inbound gateway url to Intuit by submitting a support incident.

happy coding

-Jarred

How to manage Relationships between tables in QuickBase for IPP?

How do we handle QuickBase relationships using the Intuit Partner Platform Flex SDK Plugin?

The QuickBase Missing Manual describes the mechanics for creating relationships between tables as well as common use-case relationships. For example, you can think of a one-to-many relation between projects and tasks where each task in the tasks table is linked to a specific project in the projects table. The projects table is referred to as the Master table and the tasks table as the Details table. QuickBase uses the master's key field or the record id# to relate the records between the master and details table.

Note that within QuickBase the only type of relationship you can directly define is 1:many though within your application you can implement a 1:1 relationship by having a back reference many:1 relationship from master to detail and implementing your business logic to enforce the 1:1 nature of the intended relationship. 

Why implement a relationship in the first place?  Quite simply, because once you have a relationship, QuickBase can do a lot of work for you:  fields from the master can be automatically reflected into the details rows (effectively an Inner Left Join for you SQL-nuts) so you don’t need to go look up the master record when you have a detail record in-hand and just need a couple of fields from the master record on a regular basis; and fields from the details table can be summarized in the master record using a variety of summary operators such as Average, Count, Maximum, etc.; they can even be summarized with the equivalent of a “where” clause to summarize only a subset of the details records (i.e. total task hours assigned to the current user).

How does this work with the IPP Flex SDK Plugin? Using DTOs and some of the APIs in the Kingussie framework we can simplify the task of adding records, maintaining relationships and refreshing summary fields.

I have a Developers table as the master table and a Ratings table as the details table. There can be many Ratings records for a single developer and the summary field which is the average rating in the Developers table keeps track of this.

The challenges are

How do we add a record to the ratings table and relate it to a developer record?

How do we refresh the summary field of the developer record in the view when a ratings record related to the developer is added? Normal refresh mechanisms such as those implemented by the QuickBaseDTOArrayCollection will not detect changes to the developer record if all that changed were details records summarized by the developer record, so our app needs to “know” that it has changed something that influences other records and force a refresh.

To add a Ratings record, we first relate it to the Developer record and add it.

                  rating.populateDTO();

                  // Relate the Ratings record to the Developers record

                  model.ratingsDTO.Relateddeveloper = Number(model.developersDTO.rid);
                  var addRatingEvent: QuickBaseEventStoreRecord = new
                       QuickBaseEventStoreRecord(model.RatingsDTO,
                       new KingussieEventCallBack(doRefreshRating));
           
                  addRatingEvent.dispatch();

Where rating is a simple IDNForm.

               <widgets:IDNForm id="rating" dto="{model.ratingsDTO}">
                   <widgets:IDNField fieldLabel="Enter Rating:" fieldName="Rating"/>     
               </widgets:IDNForm>

To refresh the view using the Kingussie event chaining, we define a method doRefreshRating which essentially refreshes the parent record and thereby updates the summary field.

           public function doRefreshRating(data:Object): void
           {
                  // refresh the parent record now
                  var refreshDeveloperEvent: QuickBaseEventRefreshRecord = new
                       QuickBaseEventRefreshRecord(model.developersDTO);
                  refreshDeveloperEvent.dispatch();

                 // refresh the ratings DTO
                  model.ratingsDTO = new Ratings_DTO();
           }

In conclusion, we looked at how to handle relationships between tables, what is a Master table and a Details table, how to link records between the tables and how to automatically refresh summary fields in the parent record.

How is the QuickBaseDTOArrayCollection different from an ArrayCollection?

Apart from the name, there are some important properties and methods that make it more useful in the context of writing your Flex code.

You can leverage the framework and use QuickBaseDTOArrayCollection to keep your data up to date and avoid having to do the low-level programming to acheive the same otherwise.

I'll try and explain this with some very simple code snippets.

The following is defined in the model.

         public var developersDTO: Developers_DTO = new Developers_DTO();
         public var developersList:  QuickBaseDTOArrayCollection ;

where the Developers_DTO is the Data Transfer Object for an individual record and it handles the marshalling and umarshalling of the fields of the record. It is automatically generated as part of the project when you use the "Generate data transfer objects" as part of the IPP plugin.

I instantiate this list in the view in the initPanel() or as appropriate. This indicates what fields of the record you want to retrieve.

model.developersList = new QuickBaseDTOArrayCollection
                   (Developers_DTO, true, "",
                   "Name.Company.EmailContact...", // fields are dot-separated. Not all shown
                   "",
                   "");

You initialize the list, which essentially populates the list, something along the lines of below.

                   model.developersList.initData();

This populated list can then be used as a dataProvider in a DataGrid just like a regular ArrayCollection, through the magic of Flex databinding and the QuickBaseDTOArraycollection's own magic of updating itself when data on the server changes. So, whenever a record is added, updated or deleted by any user (not necessarily the current user) this is reflected in the view.

          <mx:DataGrid id="developersViewGrid" change="true" wordWrap="true" dataProvider="{model.developersList}"

You can also force the update when you know things have changed (i.e. because you stored a record in the current client) as below

          model.developersList.forceUpdate();

Most importantly, by using the QuickBaseDTOArrayCollection to keep your data up to date, your application is imposing the smallest possible burden on the server, in particular, if data isn't changing, you aren't touching the database, and therefore are reducing your usage charges.

It's certainly possible to duplicate the functionality of the QuickBaseDTOArrayCollection yourself using a standard ArrayCollection, but why do all that low-level programming yourself?  Focus on your business logic and let the framework take care of the wiring for you.

You can get more details in the Programmer's Guide.

Setting Up a Co-Development IPP Project in Flex Builder

Hello IPP developers, my name is Jarred Keneally and I am a developer support engineer for the Intuit Partner Platform. After receiving quite a few inquiries as to the best way to setup a co-development IPP project, I though I would blog about the way to do that.

You should know we are working on exciting new developer tools to manage your IPP Projects in release 1.4. Until that release arrives, here is what you can do in the meantime. Please keep in mind this process is only temporary.

These are the steps that are typical of a new IPP project in Flex Builder:

1. Someone creates a “build” account on workplace (hereafter referred to as “build engineer”)

2. Build engineer creates a database using the native workplace UI

3. Build engineer creates a new Flex project in Flex Builder

4. Build engineer converts said Flex application to an IPP Application by Adding the IPP framework to the new project

5. Build engineer configures the IPP Project using the wizard

a. Calls the Project 1.0

b. Creates and/or Assigns an AppToken

c. Points to, the dbid from Step #2 to create the Development Master (normally, they’ll always just use Find DBID here)

d. Saves the IPP Project

6. Build engineer runs the DTO generator.

7. Build engineer adds all of the files to CVS/P4, excepting binaries and the DevEnvironment.xml (shouldn’t be one at this point if my memory is correct)

8. Build engineer invites his team, DevA, DevB and DevC to be admins to the Development Master (same dbid as is found in the IPP Project editor wizard)

9. STOP: Combine all logins under Build Engineers Account: All workplace logins that want to deploy this app need to be added to the build engineers account. This process is only temporary.

a. Please submit a support incident with build engineers email and the emails of the other Workplace logins to be added to the account. Click Here to Submit an Incident

10. DevA, DevB, DevC check out source code from CVS/P4

11. DevA, DevB, DevC build code and deploy to their dev environments… This will create their development sandboxes.  It will also create the DevEnvironment.xml file

12. DevA, DevB, DevC make enhancements that they check back into CVS/P4, etc, but they never check in the DevEnvironment.xml file

13. When a Q/A build is desired (or any other deployment or publishing operation) then Build Engineer comes back into the picture

14. Build Engineer checks out all code and deploys to Q/A, Stage, or publish.

*When someone changes the schema, it will be the schema of the dev master. That person must regen the DTOs and check them in.  The other devs must then refresh their project with those new DTO files.  The Dev Instance DBs will get updated automatically.

**The schemaVersion is what triggers the whole thing.  Until there is a difference between the compiled version (SchemaVersion.as) and the sandbox’s schemaVersion dbVar, no schemaUpdate command will be executed.  This is exactly the desired behavior because a developer may be in the middle of a task and not want his sandbox to be updated.  So long as he doesn’t sync code his wishes will be law.

***In Dev the QAR is deployed to the sandbox and never to the master.  In the other environments the exact opposite is true—you deploy the QAR to the master and when running the application the executable is automagically pulled from the master.  It is this difference that allows multiple developers to have different code bases

****Technically any of the developers can deploy to Q/A (etc) but this is probably poor practice.  Future versions of the tools will have role assignments to enforce the concept of an “authorized” deployment manager.  Every developer, however, can deploy to his/her development sandbox as that is limited to their own development area.  If they want, they can also start over this away simply by deleting the DevEnvironment.xml file and doing a Synch operation, or by running the IPP Project wizard and re-cloning the Development Master.

Happy Coding

Jarred

Frustrated by IE6 security warnings in IPP Applications?

Are you seeing the following security warning when running Flex-based IPP applications in IE6? If so, it is probably due to the fact that IE6 does not like iFrame tags without a SRC attribute.

If you're sure that it's not your code that contains the incomplete iFrame tag, chances are pretty good that you inherited the problem from a javascript file included in the Flex 3 HTML template. For a possible solution, read the article on Justin Mose's blog .  In the article he explains what he found and what he did to correct it.