VuFind UConnect SSO
VuFind is the library catalogue system and UConnect is USQ’s custom SSO system that was developed. I’ve gone through and built an integration between the two which looks like the following:

I talk a bit more about VuFind, SSO and authentication in an earlier blog post.

Book Finder
This is primarily the work of Ken MacAlpine who is working on mobile technologies at USQ. Ken developed an SVG powered map of the top floor of the library to aide in the location of books. He put together a database of roughly where the catalogue numbers stop and start for each shelf on each side. It has been integrated into the catalogue and shows up as a “Show on Map” link for Toowoomba Main Collection items.

At some point in the future we will work to expand it to all campuses and collections. When it is clicked it appears in a new window like this:

It is aimed to be the same size as an iPhone display so that it fits neatly there. It also works in all browsers that support SVG. Fallback support is provided for IE since it doesn’t support SVG yet.

ePrints, RPCS and data conversion!
As an interesting exercise I also spent some time converting data from an internal reporting system, RPCS, into our open access repository – ePrints. This was a fun project which required connecting to RPCS’ MSSQL database and outputting an XML file for ePrints to eat. To do this I figured I’d pull out Web Matrix, Microsoft’s cut down editor for web developers. It feels on par with Geany though it has a built in web server, request tracking and a database explorer. It also integrates with the Web Platform Installer product which means I can easily install other applications. I used Web Matrix to kick start the Joomla! install for the Access All Databases research project as well.

The RPCS data is loaded into our ePrints system along side the Author ID project that existed there. We’re also pulling across the data from their system which is going to result in duplicate authors until we merge them down to uniques however doing so in an automated manner isn’t easily possible. There is a whole heap of work to get things together but all in all we’re doing well.

EQUELLA Moodle module
Last but not least I’ve been playing with the EQUELLA Moodle module. It adds an extra option to the Moodle resource drop down and enables access to select items from the EQUELLA repository software.

I’ve used Web Matrix here to deploy out a quick Moodle site utilising the same Web Platform Installer technology and managed to get up and running quickly with everything. The deployment of the module to our main Moodle environment would enable lecturers to directly select course readings to embed in relevant modules on their Moodle course pages – exciting!

My solution was to use token login to handle the actual request. The process is a tad convoluted, but the diagram should explain how the system works:

So the user logs into a remote service, which proxies a username to the Joomla! which is picked up by SSO HTTP in a custom component which generates a token using the detected username, redirects the user to the token login component (not through the proxy) which then lets the user log in and continue through the site.

So what we need to create is a new component to handle detecting the user, creating the token and them redirecting them. We can use the SSO HTTP plugin to handle detecting the remote user perfectly fine (this has already been tested) and the Token Login component can handle validating tokens and redirecting users.

Step 1: Prerequisites
I’m going to use the JAuthTools packages available from Joomla!Code. To install these, you will need to install the Advanced Tools package first before you get started. The latest version is Advanced Tools 1.5.1 available from JoomlaCode.

Once we’ve got the Advanced Tools installed, we’re going to need the JAuthTools 1.5.4 Core package. This will give us the SSO library that we’re going to use later on. We will also need the SSO plugins package (for the SSO HTTP plugin in our case) and the Token Login package. As we’re not using the user source plugins for this case (both LDAP and Session are provided by default) we don’t need to install them and since we’re going to write our own SSO detection component we don’t need to use the options offered by the SSO package.

Once we’ve got all of the prerequisites installed we can start building the component

Step 2: Building the component
So we’ll start building our component with the basic few lines all components require:

This basic check ensures that we’re within Joomla!’s confines or kills the execution if we’re not. From here, lets set up some basic variables:

These are two variables we’re going to use later. The landing page is used for token login to redirect the user to a page once they’ve been authenticated successfully. The autocreate option is utilised by the SSO system to determine if it should automatically create the user. Keep these in mind as we’ll use them later on.

In this next phase we’re going to take a copy of the current user and then use the SSO system to attempt to do the login. If its successful, the user’s ID will change and we can then create a token for them and redirect so they can login, if not we’ll redirect them with an error message:

So we get a reference to the user object, get a copy of the user ID, import the SSO library, create a new SSO authentication object and handle authentication. We see the $autocreate variable we initialised before used here. We could load the plugins ourselves and handle everything but the doSSOAuth call will handle this for us, create the users session and if requested attempt to create the user if they don’t exist. We can then check if the user ID’s are different and then create a token to direct the user back:

A sizable chunk of code. So we check if the user ID has changed (typically from unauthenticated to authenticated, we could also just check if the user ID != 0 as well). We then import the token login library, grab a copy of the database object and then create a new token.

So with the token, we set the username to be that of the currently authenticated user (which we know is correct), set the expiry to be the present time plus an hour. Since this data is only ‘temporary’ we don’t bother with JDate and just use the server time. If the server transitions to or from daylight savings there could be an issue but since the user should be redirected rather quickly that seems like an unlikely possibility. We set the number of logins that the token is valid for, which for this case is only one and then we set the token’s landing page to be the value of $landingpage that we set before. Once we’ve set all of the data we call the ‘store’ function to save all of this to the database which will also trigger the generation of the login token.

Since the session we’re currently in is invalid, we destroy it for a bit of extra security and then we redirect the user to the token login component. Since this request will get proxied as a redirect to the real site (hopefully the proxy doesn’t rewrite the redirect header coming back otherwise this will fail), token login can then authenticate the user (again) and create a session for them without the proxies’ interference. There is however one last part of our component, which is the else case for if the user doesn’t get detected:

So if we don’t detect anything, redirect the user to index.php with the message ‘Invalid SSO Request’. Too easy almost!

So for reference below is the final completed component file, don’t forget to update the values of $landingpage and $autocreate:

Work again is fun as always. We’re working on solving various election problems and getting envelopes. Our printers came back stating that they didn’t want to do Code 128 for the barcodes because its too hard preferring Code 39 instead. As the day progressed it turned out that we’re going to use Code 128 more for space issues because we’ve got that much junk going out on the envelopes. This saga has been occurring over a few days, I really want to get a few proofs done before we actually get the batch done from them first to ensure that everything is good but we’ll see. Testing on the system we’re going to be using to track the election on has also begun to ensure that the system can in fact handle items properly, we had a word of warning from one of the newer guys from the regions that it had issues and that was with nowhere near the same workload. So we’re hoping we can test the system out with a few VM’s emulating the system for multiple data entry. There have been issues with the system in question in the past (in fact the system is being replaced)  so hopefully this won’t be a time when it does have issues otherwise we’re going to have large numbers of problems.

The bulk of my day was spent working on the restore framework for Joomla! 1.6, or more accurately the new JDataLoad system and the JLoaderSql adapter. The data load system, as its name suggests, loads data into the Joomla! database from a data source. In this case I’m looking at the SQL files which in my sample data is actually one of the 1.5 sites that I’m an administrator over at work. Its relatively small in the grand scheme of things with only a few meg and around 9000 queries. So far its been sufficient to find a few issues, one being dropping a table before a task yield which caused a missing table error from J! (put in a simple patch for that, if the last query was a drop, go to the next query in the hope that its a create) and another was a minor typo error which caused some multiline strings to be processed incorrectly when they were on a yield boundary again as well. But all in all its working well even importing data faster than MySQL Query Browser was (to its fairness it highlights each query as it goes) in my test runs. Its now committed to trunk and when I get a chance I’ll write up something about it and put it somewhere

Extra fun today came from trying to write up business cases for the projects I want to work on in the next year or so until I have to write it up again (fun, yeah!). Initially my boss (who is great) thought of me and tried to convert the files from Excel into a more Open format so that I can get at it on my Mac and Linux box. Somewhere during the conversion however the fields got trimmed and data lost, so I offered to edit the document in Excel directly using our Windows only document management system logging in via our Citrix services. The system, OpenText’s DM, isn’t too bad for the most part and does the job well and today I found no fault with it. Today was the day when Microsoft’s tools decided they wanted to misbehave.

Earlier in the week my boss had emailed me a doclink to the document stored in DM. A doclink is a small text file with the document number in it which basically triggers the system to load the specified document, something that usually works quite well. However Outlook, due to various configuration changes, decided that it didn’t want to start for some reason even though earlier in the week it was working perfectly fine. After Outlook repeatedly informing me it wanted to recreate my profile and then informing me that it couldn’t contact my Exchange server and offering to allow me to work offline which consequently failed due to a lack of a profile, I ended up using Mac OS X’s built in “Mail” application (yes, the email application is called “Mail”) to get at my email to find the document number and open it. Usefully enough this is done through the IMAP interface on Exchange and worked well and doesn’t suffer from some of the other issues that the Outlook clients have, such as the address book caching which caches the old Lotus Notes addresses instead of their newer Exchange ones resulting in emails going to the wrong place. Yay Outlook! Suffice to say I found the file and made the changes that I needed to before accosting our Exchange administrator who had returned to see if he could fix the issue – which he did mind you after some trial and error.

The last little item I looked into was building a system to version the content from Joomla! back into our document management system. The new document management officer assures me that we can do it and has even proposed a nifty way of importing the data into the system. It looks like one of the products we have, KoFax, will help us by allow us to generate XML files which specify the documents that we’re creating and the different versions. If we can get this to work it will be really awesome as it’ll mean that our website is in part integrating back into our document management system without hacking into the database! I’ve still got to build it and work out where we want to target the extension, but suffice to say its on my project list for next year.

First up for today is a personal thing, I completed a rather largish Uni assignment today which reminded me of all of the pains that come with C++, but to follow that I returned to working on my filesystem in C, which is just more pain. I got a quick response back, and almost full marks (96%) so I’m happy for all of the time I put in to get it done and how its probably far more complicated than anything else that will be submitted (it used Boost Signals and a whole heap of other things that I don’t think will ever be taught in the subject for a long time). But hey, thats just Uni!

Today I finally managed to get Pentaho, some business intelligence (BI) software, to play nicely with Novell eDirectory’s LDAP interface. I must have missed the option, but Pentaho doesn’t seem to accept anonymous binding to the LDAP server, which means I need to bind as a user. By default our users funnily enough have less access than the anonymous account (which is actually a proxy account with full browse permissions). The solution was simple enough: we shunted our dummy Pentaho user into the same group as the anonymous proxy account and everything worked. So I’ve now got Pentaho using LDAP for authentication (yay!) and a MySQL database to get its role/group permissions. Funnily enough when its all said and done the documentation is pretty close to the mark.

But once I had that I don’t have an ability to manage the groups/roles within Pentaho, so I end up having to write some small PHP to manage that. Luckily I worked on a project a while back that I called “Joomla! Central Management for Users” which basically connected directly to MySQL databases of Joomla! installs and altered the users. I had originally built it with a plugin infrastructure in mind so that I could plug other stuff into it later. Starting this morning it only had a ‘connector’ for Joomla! 1.0 via MySQL and LDAP, now it has one for the Pentaho security tables. This means I can easily copy users from LDAP or Joomla! into Pentaho without too much issues and has a debugged user interface already. But wait theres more!

When I was originally developing the tool I wrote a query language for it. See, SQL is a great language for databases, but its a bit hard to apply in situations where you don’t quite need all of that power. So I wrote my own query language. Its quite simple it can validate simple attributes and allows for set operations within “Sites” (a site is a container for users and groups). So for example I want to see all of the users who are on our web site but not in our LDAP directory:
existsin “Web Sites” and not existsin “LDAP”

Primitive sure, but it because writing a large SQL expression for something simple. I hope to expand on it, but it already does what it needs to do for the time being.

So I’ve covered query languages, LDAP and BI! All I need now is the filesystem news. Today there was a whole heap of fan fare on Slashdot about the ZFS news from Apple, whilst thats cool and all (especially since I don’t mind Apple’s UI), I personally have my own filesystem that I’ve gotten back into to do some work on. It also happens to be a Uni assignment due on Friday! So I’ll be back to working on that and hopefully I’ll have it to a nice stage that I can do some lightening talks at linux.conf.au!

1. Put a HTML file on some web space (this didn’t work for me)
2. Set up a new DNS pointer for Google to find (this also didn’t work)
3. Just set up the DNS the way it needs to be (e.g. pointing things to ghs.google.com)

 The last one ended up being the solution for me even though it isn’t obvious when you first start off that things will work this way. Thankfully you can get things up and running without having to verify that you own the domain, just end up setting up your DNS to point to the right place solves things anyway. So what does Google give you?

• Mail – Their Google Mail product available on your domain, the main reason a lot of people will be deploying this solution.
• Calendar – Their calendar solution is integrated into the mail address book. Interestingly enough they don’t have the address book feature as another application which for building corporate address books might be handy, or linking into a website.
• Pages – Google Pages is perhaps one of the lesser known products in Google’s application stable, is a product similar to the old Homesite and Geocities products of old (before they sold out and had lots of ads, then people realised that doing everything manually most of the time was too much effort and they just wanted a template and WordPress did all they needed, or Joomla! did what they wanted better). I’ve used it since the early beta and this, like its brothers is stand alone as well.
• Docs and Spreadsheets – Again, the boon here is the integration with Mail’s address book application which means that you have the ability to share documents (and document control) with different people within your organisation. As an administrator you can also restrict documents to within the domain or allow users to share it externally, so this doesn’t make it less secure than other solutions for document sharing (still doesn’t stop users exporting it to another format and emailing it manually anyway).
• Chat – The final major application is Google’s XMPP powered IM solution, which again integrates into Mail’s address book to provide contact list management integrated with your contact list. This is available via the web browser standalone interfaces, your start page, within the Mail application or using a dedicted IM client such as Adium on the Mac, Google’s Talk application on Windows or the Gajim Jabber client or Pidgin on Linux. These chats can also be logged and are available in the Mail application as well.
• Start – Like the customised Google home page (iGoogle), this is provided as an option for your domain as well. Again it integrates with the rest of the products like Mail, Calendar, Talk and Docs to allow for a very functional first page to go to (more functional than most options I’ve seen around the place). Its heavy integration in a small way puts it at the functionality level of something like Microsoft’s Sharepoint style solution, however the Google solution is not customisable (unlike Sharepoint) however out of the box it enables users to see more information about their data (such as the Docs integration)

This was just a review of the standard edition, the premier edition (at $50/user/year) offers a few more interesting features such as optional ads, policy and message recovery, resource scheduling, single sign on and other user services (including a 10 GB mail box). As an option to a Microsoft powered world, some of the tools are better integrated and easier to use (collaboration and versioning is awesome in Google’s Docs product) however the simple problem is that when the network link goes down, so does your entire office productivity.Something to dwell on.