Peter Major, OpenAM Sustaining Lead, ForgeRock: In today’s world it is increasingly necessary to quickly react to changing requirements, while at the same time ensuring high availability with small maintenance windows. To satisfy all these needs, the best solution is to leverage scripting. In this presentation, the main concerns around scripting (high availability, security, and performance) will be discussed, followed by a demo session showcasing the enhanced scripting support in OpenAM 13.

1. Taking Flexibility to the Next Level
Is scripting the next best thing since sliced bread?
Peter Major
OpenAM Sustaining Lead
peter.major@forgerock.com
@majorpetya http://github.com/aldaris

2. Copyright © Identity Summit 2015, all rights reserved.
Scripting with Java
• JSR 223
• JavaScript, Groovy, Scala, JRuby, Jython
• Excellent for extension points
• Great for analyzing live systems

3. Copyright © Identity Summit 2015, all rights reserved.
Pros
• Fastens up development
• “Prevents writing Java code”
• Zero downtime deployments
• Improved JVM support

4. Copyright © Identity Summit 2015, all rights reserved.
Cons
• Potentially worse performance
• Easy to write bad scripts
• Business logic implemented in JavaScript
• Difficult to share code

5. Copyright © Identity Summit 2015, all rights reserved.
Security considerations
• Limit max time of script execution
• Threadpool based script executors
• Sandbox
• Restricted classloader
• Limited set of API exposed through bindings

6. Demo
Copyright © Identity Summit 2015, all rights reserved.

7. Copyright © Identity Summit 2015, all rights reserved.
Performance
Testing
• An example policy condition implementation
• Verify that (a + b) * c = a * c + b * c
• One AM server, one user, one policy

8. Copyright © Identity Summit 2015, all rights reserved.
Performance
Groovy (indy)
• 1825 eval/s

9. Copyright © Identity Summit 2015, all rights reserved.
Performance
JavaScript
• 2051 eval/s

10. Copyright © Identity Summit 2015, all rights reserved.
Performance
Java
• 2844 eval/s

11. Copyright © Identity Summit 2015, all rights reserved.
Which language to choose?
JavaScript
• Easy to develop
• JDK 8’s Nashorn can speed things up even further
Groovy
• Syntax similar to Java => easy migration path
• First-class access to Java APIs
• More powerful => easy access to non-Groovy
libraries

12. Copyright © Identity Summit 2015, all rights reserved.
Who/When should use scripting?
• Small-mid deployments
• Proof of concepts
• Companies with limited development resources

13. Demo
Copyright © Identity Summit 2015, all rights reserved.

14. Thank You
Q&A
Peter Major
OpenAM Sustaining Lead
peter.major@forgerock.com
@majorpetya http://github.com/aldaris