DEV Community: Iyvonne Bett

Use OAuth 2.0 and Open ID Connect in a Custom Application

Iyvonne Bett — Fri, 17 Mar 2023 08:38:27 +0000

In this post, we'll explore secure authentication and authorization for custom applications by configuring Federated Single Sign-On (Federated SSO) between Oracle Identity Cloud Service and your app with OAuth 2.0 and OpenID Connect. We'll cover industry-standard protocols, provide step-by-step instructions, and highlight improvements to the original tutorial. Whether you're an experienced developer or just starting, this post is your guide to enhanced app security and a seamless user experience. Let's begin the journey together.

Background
Oracle Identity Cloud Service supports the following frameworks for federated SSO and authorization integration with custom applications:

OAuth 2.0: Framework for authorization, commonly used for third-party authorization requests with consent. See OAuth for more information.
OpenID Connect: Authentication protocol that provides Federated SSO leveraging the OAuth 2.0 authorization framework. See OpenID Connect for more information.

These standards provide the following benefits:

Federated SSO between custom applications and Oracle Identity Cloud Service. Resource owners (users accessing the Customer Quotes application) need a single login to access Oracle Identity Cloud Service plus all applications integrated. Oracle Identity Cloud Service handles the authentication and credentials themselves, insulating custom applications. This capability is provided by OpenID Connect with OAuth 2.0.
Authorization to perform operations on third-party servers with consent. Resource owners can decide at runtime whether the application should have the authorization to access data or perform tasks for them. This capability is provided by OAuth 2.0.

Scope
In this tutorial, you implement Federated SSO between Oracle Identity Cloud Service and Customer Quotes, a sample client application that serves as a hub for sales quotations. The authentication has the following flow:

The Customer Quotes application, after integration:

Requires just one login from the resource owner to access both Oracle Identity Cloud Service and the custom application.
Displays information about the resource owner (name and email), provided by Oracle Identity Cloud Service. (Customer Quotes does not store that information).

What Do You Need?

Experience developing in Java.
Access to Oracle Identity Cloud Service with authorisation to manage applications. (Identity Domain Administrator, Security Administrator, or Application Administrator).
Netbeans IDE 16 (bundle All or Java EE).
An Oracle IDCS account with an OAuth 2.0 client configured for your custom application.
Access to the custom application's codebase and the ability to modify it.



C:\Users\Iyvonne>git clone https://github.com/oracle-samples/idm-samples.git

The IDCS OAuth 2.0 client ID and client secret, are used to authenticate the custom application with IDCS.
The IDCS authorization server URL is used to initiate the OAuth 2.0 authorization flow.
The IDCS token URL is used to exchange an authorization code for an access token.

Import the Oracle Identity Cloud Service Certificate in Glassfish

In this section, you export the SSL certificate from the Oracle Identity Cloud Service UI and import it into NetBeans Glassfish Server trust store. This step is required for the custom application to communicate with Oracle Identity Cloud Service via HTTPS.

Export Certificate from Oracle Identity Cloud Service

Launch your browser. (in this tutorial, we are using Google Chrome on Windows)
Access the Oracle Identity Cloud Service UI.
In the browser address bar, click view website information (locker icon), and then click Details.

Click View Certificate.
Click Details then click Copy to File.

Click Next, select Base-64 encoded X.509 (.CER), and then click Next.
Save the certificate as oracle.cer in a temporary folder such as C:\temp, click Next and then Finish.
Click OK, close the certification pop-up and your browser.

Import Oracle Identity Cloud Service Certificate in Glassfish

Launch NetBeans.

Click Services, expand Servers, right-click Glassfish Server, and then click Properties.
Record the Glassfish domains folder.

Close NetBeans.
Launch a command prompt as administrator.
Enter where keytool to confirm that the key tool utility is available from your OS classpath.

Navigate to NetBeans Glassfish domain folder and run the keytool command.
In the confirmation prompt, enter yes.
To confirm the import was a success, enter the command:
Close the command prompt.

Configuring a Client Application in Oracle Identity Cloud Service

In this task, you configure and activate the Customer Quotes application in Oracle Identity Cloud Service.
During configuration, you define how Oracle Identity Cloud Service integrates with your application.

In the Identity Cloud Service console, expand the Navigation Drawer, click Applications, and then click Add.
Select Confidential Application.
Enter Customer Quotes as the Name, a Web application that works as a hub for all of your quotations. Access quotes and insights from customers from your browser as the Description, and then click Next.
Select Configure this application as a client now.
Click Configure this application as a client now, select Authorization Code as Allowed Grant Types, and enter the information according to the table, and then click Next.

Attribute	Value	Description
Redirect URL	`http://localhost:38187/cquotes/return`	URL where users will be redirected to cquotes after authentication/authorization in Oracle Identity Cloud Service
Logout URL	`http://localhost:38187/cquotes/logout`	URL that should be called by Oracle Identity Cloud Service during the logout process. When this URL is called, the resource owner session is terminated in Customer Quotes.
Post Logout Redirect URL	`http://localhost:38187/cquotes`	URL where the resource owner should be redirected after the Oracle Identity Cloud Service logout.

Click Next in the following panes until you reach the last pane. Then click Finish.
Save the Client ID and the Client Secret, and then click Close.

Click Activate, and then click Activate Application. Oracle Identity Cloud Service displays a confirmation message.

At this point, you have an application entry with a client ID and a client secret for integrating your application with Oracle Identity Cloud Service. In the next steps, you integrate your application with Oracle Identity Cloud Service.

Integrating Customer quotes with IDCS

Return to Netbeans and open the file cquotes > Source Packages > com.example.utils > ClientConfig.java. Tip: The ClientConfig.java file contains settings that the Customer Quotes application uses during runtime to connect to Oracle Identity Cloud Service.

Update the CLIENT_ID, CLIENT_SECRET, and IDCS_URL as follows:

Save the ClientConfig.java file.

Testing the Integration

Return to your browser and make sure that you are not logged in to Oracle Identity Cloud Service.
In NetBeans, right-click cquotes, and then click Run. Your web browser displays the Customer Quotes application.

Access https://localhost:38187/cquotes/.

Click Login with Identity Cloud Service.

Authenticate with your credentials.

After successful authentication, Oracle Identity Cloud Service redirects you back to the Customer Quotes application, which displays a welcome message.

This indicates that the Federated SSO between Oracle Identity Cloud service and your application works.

In the upper-right corner, expand the menu and click My Profile.

Return to the Customer Quotes window, expand the upper-right corner menu and then click Logout. You should be redirected to the Oracle Technology Network website.
Access https://localhost:38187/cquotes/, and then Oracle Identity Cloud Service. You should not be recognized as a logged-in user in both places. This indicates that the logout worked.

Modifications Required

One important change you need to make is in the Servlet files.
For instance, in the ReturnServlet.java file replace Javax.
With Jakarta.
Do the same with all the Servlet files, for example, the AccessResourceServlet.java file.

In the Pom.xml file under dependencies add the below snippet.

In the same file under plugins, add the following snippet.

It is important to note that you must have Java JDK 8 installed and available via your Operating System. Under properties make sure the Java platform used to compile the project is JDK 8.

Using the Oracle Identity Cloud Service REST APIs with Postman

Iyvonne Bett — Thu, 16 Mar 2023 10:46:16 +0000

This tutorial incorporates the latest improvements to Postman and builds upon the fundamental principles detailed in the blog Using the Oracle Identity Cloud Service REST APIs with Postman.

Background
The Oracle Identity Cloud Service REST APIs provide a way to integrate Oracle Identity Cloud Service with REST clients so that they can;

Manage users and groups,
Manage application and resource access,
Perform federated single sign-on (SSO) and authorization in the cloud,
Managing multi-factor authentication (MFA),
Managing identity federation and integration with other identity systems.

The APIs support OAuth 2.0, OpenID Connect, and System for Cross-Domain Identity Management.

Postman is a tool used to test and develop APIs. It provides a graphical user interface (GUI) that makes it easy to construct and send HTTP requests, as well as view the responses returned by the API.

What Do You Need?
To use Oracle Identity Cloud Service REST APIs with Postman, you will need the following:

An Oracle Identity Cloud Service tenancy: You will need access to IDCS in order to use the REST APIs. You can sign up for a free trial at ```

https://cloud.oracle.com/tryit

- **A Postman account:** You can create a Postman account for free at

https://www.postman.com/

- Access to Oracle Identity Cloud Service with the Identity Domain Administrator or Application Administrator roles.
- Familiarity with the REST architecture style.
- **API keys:** You will need to obtain API keys in order to authenticate your API requests.
- **Oracle Identity Cloud Service API documentation:** You will need to refer to this in order to learn about the available APIs and how to use them. The documentation is available at

https://docs.oracle.com/en/cloud/paas/identity-cloud/index.html

- **Postman client:** You will need to install the Postman client on your computer in order to make API requests. You can download the Postman client for free at

https://www.postman.com/


---

## Step 1: Register a Client Application

In this section, you register an application in Oracle Identity Cloud Service. This task is required to obtain the credentials (Client ID and Client Secret) used for authentication in REST API calls. The credentials are equivalent to service credentials (ID and password) that your client uses to communicate with Oracle Identity Cloud Service. This task also helps you determine which requests are authorized through the REST API.

1. In the Oracle Identity Cloud Service administration console, expand the Navigation Drawer, click Applications, and then click Add application.
![Navigation Drawer](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/85dhfu2e9b71bt3poq3f.png)
![Add application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/57suqr704tpb20oqcuz1.png)
2. In the Add Application dialogue box, select Trusted Application or Confidential Application. Click launch workflow.
![Dialogue Box](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o2y3rv769ykyoyv3s2kb.png)
3. In the App Details section on the Add Trusted Application page, enter an application name and description, and then click Next.
![Enter App details](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lqtg8uxy931goaasq9b7.png)
4. Select Configure this application as a client now, and then, in the Authorization section that appears, select only Client Credentials as the Allowed Grant Type.
![Configure Application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bt1eff2ndqy2r2lttrmp.png)
5. Scroll down, and click the Add button below Grant the client access to Identity Cloud Service Admin APIs.
![Configure Application](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/st247lhamof2rdq8qkgd.png)
6. In the Add App Role dialogue window, select Identity Domain administrator in the list and click Add.
![dialogue window](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mu3x5ycwbloddykzw882.png)
7. Click Next in the Client pane and in the following panes until you reach the last pane. Then click Finish.
8. In the Application Added dialogue box, copy the Client ID and the Client Secret to a text file, and then click Close.
![Copy Client ID and Secret](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sktl56e8z7jmswi78psr.png)
9. Click Activate, and then click Activate Application.
![Activate](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sf8070yc5z8zbkdkiggk.png)

---

## Step 2: Set the Environment Parameters in Postman

1. Open Postman, and click Import.
![Open File](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/kjr3egxvw1jbca9uzfp7.png)
2. In the Import dialogue box, select Import From Link, paste the following GitHub environment variables URL into the box and then click Import: `https://github.com/oracle/idm-samples/raw/master/idcs-rest-clients/example_environment.json`
![Import](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sg7b7y3n4rn9racltzzx.png)
3. Click the Environment option, and then select Manage Environments.
4. In the Manage Environments dialogue box, to the right of the example.identity.oraclecorp.com environment, click Duplicate Environment.
![Duplicate Environment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/acb5g9ccyzx17pcsdesc.png)
5. Click the example.identity.oraclecorp.com copy, which appears below the original environment.
6. To update the environment variables, enter the following values, and then click Update.

- _**NAME:**_ Environment A for REST API Testing
- _**HOST:**_ Oracle Identity Cloud Service UI address; for example, `https://example.identity.oraclecorp.com`
- _**CLIENT_ID**_ and _**CLIENT_SECRET**_: The Client ID and the Client Secret that you copied into a text file from your Oracle Identity Cloud Service trusted application
- _**USER_LOGIN**_ and _**USER_PW**_: Your user login and password
![Enter variables](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wz5y99hmawu4txkzxwxz.png)
7. Click the Environment drop-down list, and then select the updated environment from the list.
![select the updated environment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8uxt26cd6h1ipodp3e5u.png)

---

## Step 3: Import the Postman Collection and Global Variables

1. To import the Oracle Identity Cloud Service REST API Postman collection, on the Postman main page, click Import.
2. In the Import dialogue box, select Import From Link, paste the following GitHub Postman collection URL into the box, and then click Import:`https://github.com/oracle/idm-samples/raw/master/idcs-rest-clients/REST_API_for_Oracle_Identity_Cloud_Service.postman_collection.json`
![click Import](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8td2h1rpy40aepqttkqk.png)
3. To import the global variables file, click Import.
4. In the Import dialogue box, select Import From Link, paste the following GitHub Postman Globals URL into the box, and then click Import:`https://github.com/oracle/idm-samples/raw/master/idcs-rest-clients/oracle_identity_cloud_service_postman_globals.json`
![click Import from link](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/slofpk9sbapbvnayaflp.png)
5. To view the imported variables, click the Environment options, and then select Manage Environments from the drop-down list.
6. In the Manage Environments dialogue box, click Globals.

---


## Step 4: Request an Access Token
To make API calls to Oracle Identity Cloud Service, you must authenticate your client against Oracle Identity Cloud Service, and then obtain an OAuth access token.

The access token provides a session between a client (in this tutorial, Postman) and Oracle Identity Cloud Service. By default, the access token has a timeout interval of 60 minutes, and then you must request a new access token to perform additional REST API calls.

1. On the Collections tab, expand OAuth, and then OAuth Tokens - Get (Authorize).
2. Select Obtain access_token (client credentials), and then click Send. The access token is returned in the response from Oracle Identity Cloud Service.
3. Highlight the access token content between the quotation marks, and then right-click. In the shortcut menu, select Set: example.identity.oraclecloud.com. In the secondary menu, select access token. The highlighted content is assigned as the access token value.
![copy access token then paste under access token variable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8ghdpn3isbh4yrrp9kcm.png)
Subsequent REST API calls to Oracle Identity Cloud Service contain the access token as well as additional information about the request. The additional information is sent through a request Universal Resource Identifier, a header, parameters, or JSON code, and varies according to the REST API call and method that you request.

---

## Step 5: Create a User

1. On the Collections tab, expand Users, and then Create.
2. Select Create a user. The requested information appears.
3. Click Body, and then click Send.
![click Send](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i62y3pve4wuzmemqrzs8.png)
4. In the response, confirm that the status 201 Created appears and that the response body displays details about the user that was successfully created in Oracle Identity Cloud Service.
![Confirm its created](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jk21zjzmzs8c2ac33a1w.png)

---

## Step 6: Test Other User API Calls
To test other user calls, you can set the user as a variable for reference.

1. In the response body, select and right-click the id. In the shortcut menu, select Set: Globals, and then select userid. The unique id is assigned as the userid value.
![Set: Globals](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rqfu7ypmvb0p3qa7gkhz.png)
2. On the Collections tab, expand Users, and then Search.
3. Select Search specific user, and click Send.
![verify it displays status 200 Ok ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mdsr304u4sr1t79ybmbp.png)
4. Scroll down and verify that the response body displays the status 200 Ok and details about the user.

Code Complete 2: Table Driven Methods (Part 4)

Iyvonne Bett — Wed, 23 Sep 2020 20:33:49 +0000

A table-driven method is a scheme that allows you to look up information in a table rather than using logic statements (if and case) to figure it out.
Virtually anything you can select with logic statements, you can select with tables instead. In simple cases, logic statements are easier and more direct. As the logic chain becomes more complex, tables become increasingly attractive.

Chapter 18: Table-Driven Methods

General Considerations in Using Table-Driven Methods

With a table-driven method, you must address how to look up entries, and what data should be stored in the table.

Direct Access Tables
A table-driven approach generates less code and is easier to change without the need to recompile.
Put a lookup key transformation in its own method to guard against different transformations in different places.

Stair-Step Access Tables
This puts the upper end of consecutive ranges into a table and works well with a binary search for larger lists.

Indexed Access Tables
Indexed access schemes offer two main advantages. First, if each of the entries in the main lookup table is large, it takes a lot less space to create an index array with a lot of wasted space than it does to create a main lookup table with a lot of wasted space.
The second advantage, even if you don’t save space by using an index, is that it’s sometimes cheaper to manipulate entries in an index than entries in a main table.

Key Points in this Chapter

Tables provide an alternative to complicated logic and inheritance structures. If you find that you’re confused by a program’s logic or inheritance tree, ask yourself whether you could simplify by using a lookup table.
One key consideration in using a table is deciding how to access the table. You can access tables by using direct access, indexed access, or stair-step access.
Another key consideration in using a table is deciding what exactly to put into the table.

Chapter 19: General Control Issues

Boolean Expressions

Even if a complicated conditional expression is only used once, moving it into its own method is useful for improving readability.
Organize numeric tests so that they follow points on a number line.
Comparing a character against \0 instead of 0 reinforces that the expression works with character data instead of logical data.

Null Statements
Null statements are uncommon, so make them obvious, such as a comment inside the braces explaining why one is used.
Taming Dangerously Deep Nesting
Use a break block, try to flatten, move some of the nested blocks into their own methods, or use polymorphism.
Complicated code is a sign that you don't understand your program well enough to make it simple.

A Programming Foundation: Structured Programming
The core of structured programming is a simple idea that a program should use single-entry, single-exit control constructs.

Key Points in this Chapter

Making boolean expressions simple and readable contributes substantially to the quality of your code.
Deep nesting makes a routine hard to understand. Fortunately, you can avoid it relatively easily.
Structured programming is a simple idea that is still relevant: you can build any program out of a combination of sequences, selections, and iterations.
Minimizing complexity is a key to writing high-quality code.

Code Complete 2: Loops (Part 4)

Iyvonne Bett — Wed, 23 Sep 2020 17:22:26 +0000

Loop is an informal term that refers to any kind of iterative control structure—any structure that causes a program to repeatedly execute a block of code.

Common loop types are for, while, and do-while in C++ and Java, and For-Next, While-Wend, and Do-Loop-While in Microsoft Visual Basic. Go has only one looping construct, the for loop.

Chapter 16: Controlling Loops

Selecting the Kind of Loop

If you don't know ahead of time exactly how many times you’ll want the loop to iterate, use a while loop.
Don't code a "loop and a half"; instead, loop forever and break in the middle.
Keep for loops simple; if you're explicitly changing the index value, consider a while loop. **Controlling the Loop**
- Put initialization code immediately before the loop.
- Use for (;;) or while (true) to write an infinite loop; don't fake it by iterating to a large number.
- Reserve the for loop header for initializing the loop, terminating it, and moving toward termination.
- Keep statements that control the loop, or move it toward termination, near its beginning or end.
- Don't change the index of a for loop to make it terminate. Avoid using the loop index value after the loop; instead, assign a final value to a variable at the appropriate point inside the loop.
- Using a break forces the person reading your code to look inside the loop for an understanding of the loop control.
- Inefficient programmers experiment randomly until they find something that works, perhaps replacing a bug with a more subtle one.
Chapter 17: Unusual Control Structures

Recursion

For most situations, recursion produces very complicated solutions that chew up stack space. Use it selectively, and prefer iteration.
For local variables in recursive functions, use new to create objects on the heap as opposed to on the stack.

Goto
The use of a goto statement defeats some compiler optimizations, which rely on orderly flow control.
The try-finally construct can sometimes be used to perform the error cleanup that a goto sometimes performs.
Measure the performance of any goto statement used to improve efficiency.

Key points to note;
- Loops are complicated. Keeping them simple helps readers of your code.
- Techniques for keeping loops simple include avoiding exotic kinds of loops, minimizing nesting, making entries and exits clear, and keeping housekeeping code in one place.
- Loop indexes are subjected to a great deal of abuse. Name them clearly, and use them for only one purpose.
- Think through the loop carefully to verify that it operates normally under each case and terminates under all possible conditions.
- Multiple returns can enhance a routine’s readability and maintainability, and they help prevent deeply nested logic. They should, nevertheless, be used carefully.
- Recursion provides elegant solutions to a small set of problems. Use it carefully, too.
- In a few cases, gotos are the best way to write code that’s readable and maintainable.
- Such cases are rare. Use gotos only as a last resort.

Code Complete 2: Statements (Part 4)

Iyvonne Bett — Wed, 23 Sep 2020 16:55:14 +0000

A statement is an instruction for the computer program to perform an action. There are many different types of statements that can be given in a computer program in order to direct the actions the program performs or to control the order that the actions are carried out in.

Chapter 14: Organizing Straight-Line Code

Statements That Must Be in a Specific Order
Organize code so that dependencies are obvious; if one method initializes data, create and call an Initialize() method.

Statements Whose Order Doesn't Matter
Statements that operate on the same data, perform similar tasks or have ordering dependencies should appear together.

Chapter 15: Using Conditionals
if statements
For both readability and performance, write the nominal path through the code first, then the unusual cases.
Simplify complicated conditional expressions with calls to methods that return boolean values.

Case statements
Some case statements only work on data of certain types; don't create a "phoney variable" to use a case statement.
Use the default statement to detect legitimate defaults, or to detect errors, and nothing else.

My Key takeaways in these two chapters are;

The strongest principle for organizing straight-line code is ordering dependencies.
Dependencies should be made obvious through the use of good routine names, parameter lists, comments, and—if the code is critical enough—housekeeping variables.
If code doesn’t have order dependencies, keep related statements as close together as possible.
For simple if-else statements, pay attention to the order of the if and else clauses, especially if they process a lot of errors. Make sure the nominal case is clear.
For if-then-else chains and case statements, choose an order that maximizes readability.
To trap errors, use the default clause in a case statement or the last else in a chain of if-then-else statements.
All control constructs are not created equal. Choose the control construct that’s most appropriate for each section of code.

Code Complete 2: Fundamental Data Types (Part 3)

Iyvonne Bett — Wed, 23 Sep 2020 16:30:34 +0000

In this blog post, I'll discuss the fundamental Data types in Steve McConnell's book Code Complete.

Chapter 12: Fundamental Data Types

Numbers in General
By replacing magic numbers with constants, changes are reliable, changes can be made easily, and your code is more readable.

Floating-Point Numbers

To increase accuracy when adding numbers with differing magnitudes, add them starting with the smallest values.
Avoid equality operations and anticipate rounding errors; cope by switching to greater precision, BCD, or integer variables.

Characters and Strings
To avoid endless strings in C, initialize strings to null, and use strncpy() instead of strcpy().

Enumerated Types

Use enumerated types for more type-checking, and as a richer alternative to boolean variables.
Explicitly assign their values to specify first and last values for iteration, and an invalid or "null" type.

Arrays
In C, use or define an ARRAY_LENGTH() macro as #define ARRAY_LENGTH(x) (sizeof(x) / sizeof(x[0])).

Creating Your Own Types
Don't name a type created using typedef after the underlying data type, and don't refer to predefined types.

Chapter 13: Unusual Data Types

Structures
By passing only one or two fields from a structure into a method, you promote information hiding from the method.

Pointers

Symptoms of pointer errors tend to be unrelated to causes of pointer errors.
By isolating pointer operations to methods, you minimize the possibility of propagating careless mistakes through your program.
Allocating dog tags allow you to check for freeing memory twice or overwriting memory beyond the last byte.
Free pointers at the same scoping level as they were allocated, such as in the same method, or a constructor/destructor pair.
Set a pointer to NULL after deallocation; writing to it produces an error, and deallocating twice is more easily caught.
In C++, a reference cannot point to NULL and the object it refers to cannot be changed.
In C, you can use char or void pointers for any type of variable.

Global Data

Passing a global variable to a method, and then referring to both the parameter and global variable is especially tricky.
Initialization order among different "translation units," or files, is not defined in languages like C++.
Try to contain a global variable as a class variable, and provide an accessor for any other code that needs it.
Replace global data with access methods to centralize control over it and protect yourself against changes.
Build access methods at the level of the problem domain rather than at the level of the implementation details.

My Key takeaways in these two chapters are;

Working with specific data types means remembering many individual rules for each type.
Creating your own types makes your programs easier to modify and more self-documenting, if your language supports that capability.
When you create a simple type using typedef or its equivalent, consider whether you should be creating a new class instead.
Structures can help make programs less complicated, easier to understand, and easier to maintain.
Whenever you consider using a structure, consider whether a class would work better.
Pointers are error-prone. Protect yourself by using access routines or classes and defensive-programming practices.
Avoid global variables, not just because they’re dangerous, but because you can replace them with something better.
If you can’t avoid global variables, work with them through access routines.
Access routines give you everything that global variables give you, and more.

Code Complete 2: Variables (Part 3)

Iyvonne Bett — Wed, 23 Sep 2020 13:02:54 +0000

Variables are a foundational piece to any programming languages. Declaring variables is probably one of the first things you learn in any language after Hello world!

Chapter 10: General Issues in Using Variables

Guidelines for Initializing Variables

Ideally, declare and define each variable close to where it's used, following the principle of proximity.
Initialize named constants once; initialize variables with executable code, such as in a Startup() method.
Initialize each variable as it’s declared Initializing variables as they’re declared is an inexpensive form of defensive programming.
Initialize each variable close to where it’s first used Some languages, including Visual Basic, don’t support initializing variables as they’re declared.
Use final or const when possible By declaring a variable to be final in Java or const in C++, you can prevent the variable from being assigned a value after it’s initialized.
The final and const keywords are useful for defining class constants, input-only parameters, and any local variables whose values are intended to remain unchanged after initialization.
Pay special attention to counters and accumulators The variables i, j, k, sum, and total are often counters or accumulators. A common error is forgetting to reset a counter or an accumulator before the next time it’s used.
Initialize a class’s member data in its constructor Just as a routine’s variables should be initialized within each routine, a class’s data should be initialized within its constructor.
Check the need for reinitialization- Ask yourself whether the variable will ever need to be reinitialized, either because a loop in the routine uses the variable many times or because the variable retains its value between calls to the routine and needs to be reset between calls.
Initialize named constants once; initialize variables with executable code If you’re using variables to emulate named constants, it’s OK to write code that initializes them once, at the beginning of the program.
Initialize true variables in executable code close to where they’re used. One of the most common program modifications is to change a routine that was originally called once so that you call it multiple times.
Use the compiler setting that automatically initializes all variables If your compiler supports such an option, having the compiler set to automatically initialize all variables is an easy variation on the theme of relying on your compiler.
Take advantage of your compiler’s warning messages Many compilers warn you that you’re using an uninitialized variable.

Scope

A span is the number of lines between successive variable uses; live time is the number between its first use and its last.
To help minimize scope, begin with most restricted visibility, and expand the variable's scope only if necessary.

A maximizing scope may make programs easy to write, but a program in which any method can use any variable at any time is harder to understand.

Binding Time
The earlier the binding time, the lower the flexibility and the lower the complexity. So add only as much flexibility as needed.

Using Each Variable for Exactly One Purpose
Use variables for only one purpose; avoid having different values for the variable mean different things (like negative values).

Chapter 11: The Power of Variable Names

Considerations in Choosing Good Names
A good name tends to express the "what" more than the "how."
To avoid numSales versus saleNum confusion, consider variable names like salesTotal, salesCount, and salesIndex.

Naming Specific Types of Data
Intermediate variables do not warrant a name like temp. Such a name may indicate that we aren't sure of their real purposes.
Give boolean variables names that imply true or false, like sourceFileFound or isStatusOk instead of sourceFile and status.

Informal Naming Conventions
Variable names can contain; The variable contents, the kind of data, and the scope or visibility of the variable.

Creating Short Names That Are Readable
When shortening variable names, don't remove just one letter, be consistent, create pronounceable names, and avoid mispronunciation.

Kinds of Names to Avoid
Avoid names with similar meanings, like fileNumber and fileIndex.
Avoid names with different meanings but similar names, like clientRecs and clientReps.

My Key takeaways in this chapter are;

Data initialization is prone to errors, so use the initialization techniques described to avoid the problems caused by unexpected initial values.
Minimize the scope of each variable. Keep references to a variable close together.
Keep it local to a routine or class. Avoid global data.
Keep statements that work with the same variables as close together as possible.
Early binding tends to limit flexibility but minimize complexity. Late binding tends to increase flexibility but at the price of increased complexity.
Use each variable for one and only one purpose. Good variable names are a key element of program readability. Specific kinds of variables such as loop indexes and status variables require specific considerations.
Names should be as specific as possible. Names that are vague enough or general enough to be used for more than one purpose are usually bad names.
Naming conventions distinguish among local, class, and global data. They distinguish among type names, named constants, enumerated types, and variables.
Regardless of the kind of project you’re working on, you should adopt a variable naming convention. The kind of convention you adopt depends on the size of your program and the number of people working on it.
Abbreviations are rarely needed with modern programming languages. If you do use abbreviations, keep track of abbreviations in a project dictionary or use the standardized prefixes approach.
Code is read far more times than it is written. Be sure that the names you choose favour read-time convenience over write-time convenience.

Code Complete 2: High-Quality Routines (Part 2)

Iyvonne Bett — Wed, 23 Sep 2020 12:15:31 +0000

Here I will dive deeper into the next three chapters of part two code complete.

Chapter 7: High-Quality Routines

A bad routine has bad names, a bad layout, multiple purposes, too many parameters, poor documentation, uses global variables, and doesn't defend against bad data.

Valid Reasons to Create a Routine

The most important reason to create a routine is to reduce complexity; using a routine doesn't require knowing its inner workings.
Introduce an intermediate, understandable abstraction Putting a section of code into a well-named routine is one of the best ways to document its purpose.

Avoid Duplicate code

Creation of similar code in two routines implies an error in decomposition. Pull the duplicate code from both routines, put a generic version of the common code into a base class, and then move the two specialized routines into subclasses.
Routines can encapsulate or hide the assumption about the order in which operations must be performed or routines are called.
Putting complicated boolean tests in routines hides the details, summarizes its purpose, and emphasizes its significance.
No block of code is too small to put into a routine, especially if it improves readability.

Design at the Routine Level
A cohesive routine contains operations that are related; otherwise, it probably does more than one thing.

Functional cohesion is the strongest and best kind of cohesion, occurring when a routine performs one and only one operation. Examples of highly cohesive routines include sin(), GetCustomerName(), EraseFile(), CalculateLoanPayment(), and AgeFrom-Birthdate().

Good Routine Names
A routine with a long, complicated name may stem from the routine doing too much; break the routine into multiple routines.
Name functions after the returned value; name procedures with a strong verb and an object to provide its context.

Don’t differentiate routine names solely by the number, To name a function, use a description of the return value and use opposites precisely.

How to Use Routine Parameters
Put parameters in input-modify-output order; if several routines use similar parameters, order the parameters consistently.
If you consistently pass too many arguments to a function, the coupling among your routines is too tight.
Pass the variables or objects that a routine needs to maintain its interface abstraction.

Chapter 8: Defensive Programming

Protecting Your Program From Invalid Inputs
To handle "garbage-in," check values from external sources, values of method parameters, and then decide how to handle bad inputs.

Defensive programming is useful as an adjunct to the other quality-improvement techniques described in the book. The best form of defensive coding is not inserting errors in the first place.

Using the iterative design, writing pseudocode before code, writing test cases before writing the code, and having low-level design inspections are all activities that help to prevent inserting defects.

They should thus be given a higher priority than defensive programming. Fortunately, you can use defensive programming in combination with the other techniques.

Assertions
Use error handling code for conditions you expect to occur; use assertions for conditions that should never occur.
Use assertions to document precondition and postconditions. Don't put executable code in one.

Error Handling Techniques
Correctness means never returning an inaccurate result; robustness means always trying to do something that allows the program to keep running.
Beware using a neutral value, substituting the next valid data, returning the last result, or substituting the closest legal value.

Exceptions
Exceptions weaken encapsulation by requiring the caller to know which exceptions might be thrown from the code that's called.

Barricade Your Program to Contain the Damage Caused by Errors
If public methods of a class checking and sanitizing data, then private methods can assume it is safe.
Convert data to the proper type ASAP; otherwise, you increase complexity and increase the chance that someone can crash your program.

Determining How Much Defensive Programming to Leave in Production Code
Remove code that results in hard crashes in production; but during development, this is invaluable for debugging.

Chapter 9: The Pseudocode Programming Process

Pseudocode for Pros
When writing pseudocode, avoid syntactic elements from the target programming language.
Catching errors at the "least-value stage," or when the least effort has been invested, contributes to success.

Constructing Routines by Using the PPP

Design the Routine - Once you’ve identified a class’s routines, the first step in constructing any of the class’s more complicated routines is to design it.
Check the prerequisites Before doing any work on the routine itself, check to see that the job of the routine is well defined and fits cleanly into the overall design.
Define the problem the routine will solve State the problem the routine will solve in enough detail to allow the creation of the routine.
Research the algorithms and data types If functionality isn’t available in the available libraries, it might still be described in an algorithms book. Before you launch into writing complicated code from scratch, check an algorithms book to see what’s already available.
Write the pseudocode You might not have much in writing after you finish the preceding steps. The main purpose of the steps is to establish a mental orientation that’s useful when you actually write the routine.

Alternatives to the PPP

Test-first development- Test-first is a popular development style in which test cases are written prior to writing any code.
Refactoring is a development approach in which you improve code through a series of semantic preserving transformations.

Design by contract is a development approach in which each
routine is considered to have preconditions and postconditions.

Code Complete 2: Creating High-Quality Code (Part 2)

Iyvonne Bett — Wed, 23 Sep 2020 11:18:02 +0000

Welcome to the second part of my review of Steve McConnell’s influential text Code Complete (2nd Edition). If you haven’t already, please first read my Laying the Foundation Part 1 post. In this post, we will dig into the second part and continue with the fifth chapter. I hope you enjoy it!

Chapter 5:Design in Construction

The phrase “software design” means the conception, invention, or contrivance of a scheme for turning a specification for computer software into operational software.

Design is also marked by numerous challenges, which I will outline here:

Design is a wicked problem: You must solve the problem once in order to define it, and then solve it again to create a solution that works.
Design is a Heuristic process: Design relies on heuristics, and relies on trial-and-error.

Key Design Concepts

My takeaways in this subtopic were;

Managing complexity is the most important technical topic in software development.
Complexity is reduced by dividing a system into subsystems that are ideally independent.
Desirable characteristics of design include;
- Minimal complexity - make simple and easy-to-understand designs.
- Loosely-coupled -this means designing so that you hold connections among different parts of a program to a minimum. Minimal connectedness minimizes work during integration, testing, and maintenance.
- Extensibility- this means that you can enhance a system without causing violence to the underlying structure.
- Reusability- means designing the system so that you can reuse pieces of it in other systems.
- Ease of maintenance - means designing for the maintenance programmer.
- Portability means designing the system so that you can easily move it to another environment.
- Standard techniques The more a system relies on exotic pieces, the more intimidating. It will be for someone trying to understand it the first time
Make subsystems meaningful by restricting communications and preventing cycles.

Design Building Blocks: Heuristics

Real-World Objects: Identify objects' public/protected/private attributes, then public/protected interfaces.
Form abstractions at the right level, allowing you can ignore irrelevant details.
Encapsulate- abstraction provides a high level of detail, while encapsulation says you can't change levels.
Hide secrets: Information hiding is part of the foundation of both structured design and object-oriented design. In structured design, the notion of black boxes comes from information hiding. In object-oriented design, it gives rise to the concepts of encapsulation and modularity and it is associated with the concept of abstraction.
Information hiding is one of the seminal ideas in software development, and so this subsection explores it in depth. Hiding complexity for easier understanding, or hiding sources of change so its effects are localized.
Asking what a class should hide cuts to the heart of interface design.
Identify and isolate areas likely to change, like nonstandard language features, bad design or construction, or data-size constraints.
Keep coupling loose; one module using some semantic knowledge of a module's inner workings is especially bad.
Coupling Criteria includes;

Size - Size refers to the number of connections between modules. With coupling, small is beautiful because it’s less work to connect other modules to a module that has a smaller interface.
Visibility- Visibility refers to the prominence of the connection between two modules.
Flexibility -Flexibility refers to how easily you can change the connections between modules.

Design patterns provide a vocabulary for efficient communication and embody accumulated wisdom over years.
Other heuristics: aim for strong cohesion, use preconditions and postconditions, design for test, and keep design modular.
Don't get stuck on a single approach; if you are stuck on all approaches, step away for a bit.

Design Practices

Iterate; when you come up with something that seems good enough, don't stop, but instead apply what you learned on a second design.
Top-down design is a decomposition strategy, while the bottom-up design is a composition strategy.
Top-down design is easy and you can defer construction details.
Bottom-up design typically results in early identification of needed utility functionality.

Prototyping fails when developers don't write the absolute minimum code, and so don't treat the code as throwaway.

Big design problems found not to come from bad designs, but from areas deemed too easy for any design at all.

Capture design work in code comments, on a Wiki, with photos of whiteboards, or UML diagrams.

Chapter 6: Working Classes

A class is a collection of data and routines that share a cohesive, well-defined responsibility.
A class might also be a collection of routines that provides a cohesive set of services even if no common data is involved. A key to being an effective programmer is maximizing the portion of a program that you can safely ignore while working on any one section of code. Classes are the primary tool for accomplishing that objective.

Class Foundations: Abstract Data Types (ADTs)
An abstract data type is a collection of data and operations that work on that data.

ADTs hide implementation details, isolate changes, promote informative interfaces, highlight correctness, provide a private namespace, and build on lower-level data.
A class is an ADT with inheritance and polymorphism added in.

Good Class Interfaces
Each class should implement only one ADT; mixed abstractions move implementation details to the public interface and complicate understanding.
If a subset of a class' methods operate on a subset of its data, move the data and methods into a new class.

Minimize assumptions by the programmer to use an interface; have the compiler or its own form enforce the requirements.
Only add public members to a class that are consistent with its abstraction, even if a convenient utility method.
Abstraction provides models allowing you to ignore implementation details, while encapsulation enforces this principle.

Looking at a class' implementation to determine its use breaks encapsulation, and breaking abstraction isn't far behind.

Design and Implementation Issues

Don't re-use names of non-overrideable methods from the base class in a derived class.
Move common interfaces, data, and behaviour as high as possible in the inheritance tree.
Be wary of classes with only one instance (excluding singletons), and base classes with only one subclass.
A subclass overriding a method to do nothing violates the interface contract and should be addressed in the base class. Inheritance works against managing complexity and so you should bias against it.

Keep class interfaces small, the implementations insulated, and minimize its collaboration with other classes.

Reasons to Create a Class
The best reason to create a class is to hide information, thereby reducing complexity.
Classes also isolate complexity, hide implementation details, streamline parameter passing, promote code reuse, and package related operations.
Avoid god classes; if a class retrieves its data from and stores its data in a god class, move that data.

Summary of Reasons to Create a Class
Here’s a summary list of the valid reasons to create a class:
■ Model real-world objects
■ Model abstract objects
■ Reduce complexity
■ Isolate complexity
■ Hide implementation details
■ Limit effects of changes
■ Hide global data
■ Make central points of control
■ Facilitate reusable code
■ Plan for a family of programs
■ Package related operations
■ Accomplish a specific refactoring

What is Graph Databases? A better way to store connected data

Iyvonne Bett — Mon, 21 Sep 2020 09:59:39 +0000

Here in this article, I’ll discuss some ideas and concepts of graph databases, what they are, What you should know in order to pick the correct data store for your application(s) and how they can help us in our daily tasks.

What is a Graph?

A graph is a set of discrete objects, each of which has some set of relationships with other objects.

What is a Database?

From techopedia:
A database, in the most general sense, is an organized collection of data. More specifically, a database is an electronic system that allows data to be easily accessed, manipulated and updated.

In other words, a database is used by an organization as a method of storing, managing and retrieving information. Modern databases are managed using a database management system (DBMS).

What is a Graph Database?

A graph database contains a collection of nodes and edges. A node represents an object, and an edge represents the connection or relationship between two objects. Each node in a graph database is identified by a unique identifier that expresses key-value pairs. Additionally, each edge is defined by a unique identifier that details a starting or ending node, along with a set of properties.

Designed for working with highly interconnected data, Graph databases shine when the goal is to capture complex relationships in vast webs of information.
There are three types of graph database: true graph databases, triple stores and conventional databases that provide some graphical capabilities. Triple stores are often referred to as RDF databases.
Examples:
– Neo4j, OrientDB, InfiniteGraph, AllegroGraph.

Neo4j Databases
Neo4j offers a graph database that helps organizations make sense of their data by revealing how people, processes and systems are related. Neo4j natively stores interconnected data so it’s easier to decipher data. The property graph model also makes it easier for organizations to evolve machine learning and AI models. The platform supports high-performance graph queries on large datasets as well.
Neo4j can import tables into nodes from CSV files, create indexes on the nodes, create uniqueness constraints, and construct relationships using the Cypher query language.

Graph Databases: Pros and Cons

Pros:

Powerful data model, as general as RDBMS.
Connected data locally indexed.
Easy to query.

Cons:

Difficult to scale. Sharding ( lots of people working on this)
No standard language. Every graph database vendor has defined a unique syntax or language for updates and queries.
Requires rewiring your brain

Why You Should Care about Graph Database Technology?

Performance:

Your data volume will definitely increase in the future, but what’s going to increase at an even faster clip is the connections (or relationships) between your data. Big data will definitely get bigger, but connected data will grow exponentially.

With traditional databases, relationship queries come to a grinding halt as the number and depth of relationships increase. In contrast, graph database performance stays constant even as your data grows year over year.

Flexibility:

With graph databases, your data architecture teams move at the speed of business because the structure and schema of a graph data model flex as your solutions and industry change. Your team doesn’t have to exhaustively model your domain ahead of time (and then exhaustively remodel and migrate the DB after some exec asks for a change); instead, you can add to the existing structure without endangering current functionality.

With the graph database model, you are the one dictating changes and taking charge; whereas the RDBMS data model dictates it’s requirements to you, forcing you to adapt to its tabular way of seeing the world.

Agility:

Developing with graph technology aligns perfectly with today’s agile, test-driven development practices, allowing your graph-database-backed application to evolve with your changing business requirements. Your agile team now has a database that keeps up with your daily demands.

Graph database vs. relational database

Relational databases are not well suited to capturing ad hoc relationships that are not consistent across all records: You wind up with sparsely populated rows and way too many indexes, both of which slow down the database performance. Remember, the relational schema is fixed, so every record in a given table contains every field, whether or not the field is populated.
Moreover, In a conventional database, queries about relationships can take a long time to process. This is because relationships are implemented with foreign keys and queried by joining tables. As any SQL DBA can tell you, performing joins is expensive, especially when you must sort through large numbers of objects—or, worse, when you must join multiple tables to perform the sorts of indirect (e.g. “friend of a friend”) queries that graph databases excel at.

Graph databases work by storing the relationships along with the data. Because related nodes are physically linked in the database, accessing those relationships is as immediate as accessing the data itself. In other words, instead of calculating the relationship as relational databases must do, graph databases simply read the relationship from storage.

It also allows you to build a knowledge graph. Because they are graphs, knowledge-graphs are more intuitive. People don’t think in tables, but they do immediately understand graphs. When you draw the structure of a knowledge graph on a whiteboard, it is obvious what it means to most people.

How to choose the Right Data Management Solution

When Is a Graph Database the Right Fit?
Graph databases are hardly a "one size fits all" solution. The type of data, use cases, and available resources should all be considered when deciding to move forward with the graph model or a more traditional data management solution, like the relational database.

Graph databases are suited to handle the volume, variety, and velocity.
Managing data as graphs is a particularly good fit when the use case involves modifying schemas and accommodating new features, data points, or sources.

Graph databases are ideal for instances where elements will need to simultaneously relate to each other, be easily accessible, and query millions of relationships per second. Such data and data management systems are needed to integrate information for chatbots, conversational systems, social applications, recommendation algorithms, optimization applications, routing, and maps — all real-world interactions that need to be stored as densely connected structures and navigated seamlessly.

AI and machine learning applications tremendously increase in value when configured to work against graph databases, because they can now understand and analyze the edges, or relationships, between entities within the dataset or the content set in the graph form.
Graph databases also run more efficiently across highly-connected datasets. Other data management solutions usually cost more to run.

Relational database: deal with more simple data models and connections for less connected static data.Example tabular data such as inventories, financial records.

Graph database: deal with complex data models and processing of large dynamic networks of relationships Example social networks, content management.

In Conclusion
In this article, we have learned about graph databases. In the future, I’ll discuss how graph databases can help us do machine learning and data science in general. If you are interested in building a graph database or reading more I would suggest you start with the Neo4j website as they have excellent documentation in the area. Stay tuned for more.

Code Complete 2 Book Review Series: Laying the Foundation (Part 1)

Iyvonne Bett — Wed, 16 Sep 2020 16:41:34 +0000

The book Code Complete by Steve McConnell is acclaimed as one of the must-reads for all developers and is extremely well known. It is comparable to a practical handbook full of tips and learning examples to develop more robust programs, and also introduces lots of concepts throughout that can be used to improve the development workflow as it evolves for projects.

Hence this is the first part of a seven-part book review series where I will be sharing my key takeaways, I strongly believe that this is a book you read once, learn a stack from and when you revisit it with more experience down the line, you'll learn even more.

Chapter 1: Welcome to Software Construction

Construction refers to the process of building. The construction process might include some aspects of planning, designing, and checking your work, but mostly “construction” refers to the hands-on part of creating something.

Software Construction mainly includes; Requirements development, Planning, Software architecture/high-level design, Detailed design, Coding and debugging, Unit testing, Integration testing, System testing and Corrective maintenance.

So why is construction/programming an important focus?

Firstly, construction is a large part of software development – coding typically takes 30 to 80 per cent of the total time spent on a project.
Steve also adds that programming is the central activity in software development where other tasks largely occur before or after the construction phase.
With a focus on construction, the individual programmer’s productivity can improve enormously. Lastly, construction’s product, the source code, is often the only accurate description of the software.

Chapter 2: Metaphors for a Richer Understanding of Software Development

A metaphor serves more as a heuristic than it does as an algorithm. An algorithm is a set of well-defined instructions for carrying out a particular task while a heuristic is a technique that helps you look for an answer.
The main difference is that an algorithm gives you the instructions directly while a heuristic tells you how to discover the instructions for yourself, or at least where to look for them.

1 Penmanship: Writing Code
Developing a program is likened to writing a letter whereas writing is a one-person thing, software projects most likely involve a lot of people. In writing, a high premium is placed on originality whereas in software construction trying to create trull original work is less effective. Nonetheless, none of these associations translates well to the software development process.

2 Construction: Building Software
Here is a list of some similarities between building construction and software development:

Size of the project increases the amount of planning needed.
Foundation and framework come first.
One doesn't need to recreate things that are already built. In software, eg. prebuilt libraries.

Chapter 3:Measure Twice, Cut Once: Upstream Prerequisites

No matter what the project, the preparation is tailored to the project’s specific needs and done conscientiously before construction begins.
This chapter describes the work that must be done to prepare for software construction.
The carpenter’s saying, “Measure twice, cut once” is highly relevant to the construction part of software development, which can account for as much as 65 per cent of the total project costs. Doing the most expensive part of the project twice is as bad an idea in software as it is in any other line of work.
The overarching goal of preparation is risk reduction: a good project planner clears major risks out of the way as early as possible so that the bulk of the project can proceed as smoothly as possible.
By far the most common project risks in software development are poor requirements and poor project planning, thus preparation tends to focus on improving requirements and project plans.

Causes of Incomplete Preparation

A common cause of incomplete preparation is that the developers who are assigned to work on the upstream activities do not have the expertise to carry out their assignments.
Moreover, the skills needed to plan a project, create a compelling business case, develop comprehensive and accurate requirements, and create high-quality architectures are far from trivial, but most developers have not received training in how to perform these activities.
A final reason that programmers don’t prepare is that managers are notoriously unsympathetic to programmers who spend time on construction prerequisites.

Software development is more than coding.
Studies over the last 25 years have proven conclusively that it pays to do things right the first time. Unnecessary changes are expensive.
One of the key ideas in effective programming is that preparation is important. It makes sense that before you start working on a big project, you should plan the project.

Architecture Prerequisite: Typical Architecture Components include;

Program Organization
Without such an overview, you’ll have a hard time building a coherent picture from a thousand details or even a dozen individual classes. The architecture should define the major building blocks in a program. Depending on the size of the program, each building block might be a single class or it might be a subsystem consisting of many classes.

Major Classes
The architecture should specify the major classes to be used. It should identify the responsibilities of each major class and how the class will interact with other classes.

Data Design
The architecture should describe the major files and table designs to be used. It should describe alternatives that were considered and justify the choices that were made.

Resource Management
The architecture should describe a plan for managing scarce resources such as database connections, threads, and handles.

Security
The architecture should describe the approach to design-level and code-level security. If a threat model has not previously been built, it should be built at architecture time.

Scalability
Scalability is the ability of a system to grow to meet future demands.

Interoperability
If the system is expected to share data or resources with other software or hardware, the architecture should describe how that will be accomplished.

Chapter 4: Key Construction Decisions

My key takeaways in this chapter are;

Every programming language has strengths and weaknesses. Be aware of the specific strengths and weaknesses of the language you’re using.
Establish programming conventions before you begin programming. It’s nearly impossible to change code to match them later.
More construction practices exist than you can use on any single project. Consciously choose the practices that are best suited to your project.
Ask yourself whether the programming practices you’re using are a response to the programming language you’re using or controlled by it. Remember to program into the language, rather than programming in it.
Your position on the technology wave determines what approaches will be effective— or even possible. Identify where you are on the technology wave, and adjust your plans and expectations accordingly.

In the second part of this seven-part book series, I will dive in the next chapters of the book fully.

DEV Community: Iyvonne Bett

Use OAuth 2.0 and Open ID Connect in a Custom Application

Import the Oracle Identity Cloud Service Certificate in Glassfish

Configuring a Client Application in Oracle Identity Cloud Service

Integrating Customer quotes with IDCS

Testing the Integration

Using the Oracle Identity Cloud Service REST APIs with Postman

Code Complete 2: Table Driven Methods (Part 4)

Chapter 18: Table-Driven Methods

General Considerations in Using Table-Driven Methods

Key Points in this Chapter

Chapter 19: General Control Issues

Boolean Expressions

Key Points in this Chapter

Code Complete 2: Loops (Part 4)

Chapter 16: Controlling Loops

Selecting the Kind of Loop

Chapter 17: Unusual Control Structures

Recursion

Code Complete 2: Statements (Part 4)

Chapter 14: Organizing Straight-Line Code

Code Complete 2: Fundamental Data Types (Part 3)

Chapter 12: Fundamental Data Types

Chapter 13: Unusual Data Types

Code Complete 2: Variables (Part 3)

Chapter 10: General Issues in Using Variables

Guidelines for Initializing Variables

Scope

Chapter 11: The Power of Variable Names

Code Complete 2: High-Quality Routines (Part 2)

Chapter 7: High-Quality Routines

Valid Reasons to Create a Routine

Chapter 8: Defensive Programming

Chapter 9: The Pseudocode Programming Process

Alternatives to the PPP

Code Complete 2: Creating High-Quality Code (Part 2)

Chapter 5:Design in Construction

Key Design Concepts

Design Building Blocks: Heuristics

Design Practices

Chapter 6: Working Classes

What is Graph Databases? A better way to store connected data

What is a Graph?

What is a Database?

What is a Graph Database?

Graph Databases: Pros and Cons

Why You Should Care about Graph Database Technology?

Graph database vs. relational database

How to choose the Right Data Management Solution

Code Complete 2 Book Review Series: Laying the Foundation (Part 1)

Chapter 1: Welcome to Software Construction

Chapter 2: Metaphors for a Richer Understanding of Software Development

Chapter 3:Measure Twice, Cut Once: Upstream Prerequisites

Chapter 4: Key Construction Decisions