Java Applets in Sun Identity Manager (Part 1: The Problem)

Sun uses a number of Java applets in the identity manager administrator interface.  The end-user interface also has some applets but they are not nearly as prominent.  I’ll say it now: I hate the Java applets in the Sun Identity Manager web interface.  I’ve grown to have a passion hating them and I’ll try to describe why.

Java Applets in Sun IDM

Report Status Notification

Java applets in the IDM interface tend to fall into two categories: status notifications and user interface elements.  In the status notification category there is the report generation notice applet.  All this little applet does is tell you a report is being generated and how far along it is in the generation.  Once the report is generated the report itself is displayed.

An applet displaying the status of a report being generated

Report Graphs

When a report is generated there’s an applet that can be used to display a graph of events.  From what I can tell, the only purpose of this applet is to display an image and a mouse over pop up indicating data.

An applet displaying a graph

Workflow Status

After a workflow is executed the results are displayed.  Along with those results is a visual representation of the workflow and the stage it’s at.  Each activity in the workflow is represented by a box with a line connecting it to the next activity in the workflow that was executed.  The applet allows you to move the boxes around in case they overlap or if there are many.

An applet displaying the status of a workflow

Multiselect

A multiselect element is one where you can choose between multiple selections on a left side and move one or more of the selections over to the right.  Usually, multiselects are used when assigning collections of data to an object.  The default Sun IDM deployment uses a Java applet to display a multiselect.  The applet checks the respository for the required information, displays and updates the selection.

An applet is used as a multiple selection box

Capabilities UI

The entire interface for managing capabilities in Identity Manager is a Java applet.  New capability collections are added using the applet.  Existing capabilities are displayed using the applet.

The Problem

Additional Support Load

In my organization we support reasonably modern web browsers: IE 6, 7 and now 8, Firefox 3 and Safari 3 and 4. We used to not support any version of a client-side Java installation.

Officially, Sun supports the following web browsers:
Microsoft Internet Explorer 6.x, 7.x
Safari 2.0 and later for Mac OS X 10.3.3 and later, 3.0.x
Firefox 1.04, 1.05, 1.06, 1.5, 2.0.0.4, 3.0
MozillaTM 1.78s

The only mention of the version of Java required is Java 5 and higher. There’s no mention of the client’s version of Java required nor is there a mention of client side operating system support.

Due to Sun’s use of Java applets for both end user and administrators, my organization is now forced to incur an additional support load. We now have to support some minimal Java installations on the client systems across multiple operating systems so that managers and end users can see the Java applets in the IDM product. (Try having an end user make a request to add a resource from a multiselect list without Java.)

Buggy Applets

Even if the client has an version of Java installed there seems to be a large number of bugs that pop up.  The bugs are not usually with the applet itself but more often with the version of Java installed on the client and the interaction with the browser.  Java 6 update 10+ seems to be a problem on the client side as well. The forum post describing the problem is here.  This is an issue because on most operating systems, the local Java installation is updated automatically.

I asked people in my organization to send me screenshots of bugs they had with the applets found in IDM.  Below are some examples that.

A report status applet that refuses to go away

Applet failing to load in Windows

Applet failing to load in OSX

Applet failing to load in Linux

Supporting the applets has become a headache that really should not be necessary. In almost all cases where applets are used, I can’t see why Javascript wasn’t used instead or in the case of the graphs a simple image generated instead.  All the supported web browsers have some form of Javascript that would provide enough of a platform to solve the user interface problems that the applets are trying to solve. Even a basic page post/reload would work around some of the issues the applets present.

When the applets do work, they are slow and have graphical glitches.  (Usually moving the browser around on the screen fixes the glitches but not always.)  Often when there is a problem with an applet the entire browser tends to crash or become unresponsive.  There’s nothing more infuriating than trying to approve a request in IDM only to have the browser itself lock up just because an applet was displayed to select resources.

One could argue that with an enterprise application a high level requirements for the client side is acceptable.  But given the fact that non-technical users are often using the administrative interface to approve an manage their reporting users it doesn’t seem reasonable to require Java applets.  (Not to mention that it’s a royal pain when I have to tell a manager to not update his installed version of Java just to make his approval workflow work.)  Given that end-users are displayed the results of workflows after they update information and you’ve got a situation where every single user who has some interaction with IDM requires Java applets, administrative and non-administrative alike.

Work-Arounds & Solutions

There are work-arounds to avoid using some of the Java applets.  Unfortunately the work-arounds require a lot of custom code.  I’ll cover of solutions for each of the applets in my next post.