Having started working at my Uni, I’m starting to work on projects related to the university. As a smaller research and learning exercise I built an SSO plugin to integrate with the university SSO system, something I actually started last week but couldn’t test because I didn’t have the appropriate access. In testing today I managed to get it to work and authenticate me appropriately with only a slight change to the original code.

Another fun task is learning how Moodle works. At the moment I’m trying to get my head around how to get the context of a course. I haven’t spent much time looking and all I’ve done is look at the context table and the get_context_instance functions or similar. It will be good to spend some time looking at something not Joomla! and getting some new ideas.

You know lately I’ve been dealing with Windows, and whilst today I’m not directly impacted I think the case is funny enough on its own.

Today’s problem is corrupt Windows roaming profiles. At Council we get a lot of them. Compared to Defence where two of the help desk guys have worked, its excessive. And today they found the answer: long file names. To explain the problem simply, our document management system creates filenames out of document names and the documents’ unique identifier with underscores and other useful URL friendly replacements being made along the way. So the end result is DOC-12345-Document_Name.doc which is usually fine. However we have instances where the document name is incredibly long. In one particular case this resulted in a filename that was 170 characters long. As these files are typically temporary it doesn’t cause a major issue as the document management system deletes the file when it ferries it off to its own data store, however due to an unfortunate series of events Office’s most recently used list was turned on again (our DM system says it should be off, now for good reason). This meant that Office was creating links (that incidentally go nowhere) to these files – since all that usually means is chopping off whatever extension it has and putting ‘lnk’ on instead, this is a 170 character file that remains in the users profile. So this is dumped into C:\Documents and Settings\username\Application Data\Microsoft\Office\Recent (another 76 characters in this instance, making the complete file name 247 when you include the extra path separator) which then gets synchronised with the users profile.

Now within Windows, the rule of thumb is to keep the entire path under 255 characters otherwise you’ll have issues with the file (see http://support.microsoft.com/kb/q177665/; MAX_PATH was defined as 256 characters, that gives you 255 characters plus a null character), I believe this includes the drive specification as well. It appears that Microsoft expanded MAX_PATH to be 260 at some point (http://msdn.microsoft.com/en-us/library/aa365247.aspx) which is the directory specification, 256 characters of path and a null character. Now it isn’t often that you see a file that long however in this case the document management system can make it occur with reasonable frequency. As the filename is synthesised it doesn’t cause an issue for the document management system (it has its own internal file naming structure that is much shorter), but it causes issues on the client. So we’ve got roaming profiles, which means that file then gets copied to our file servers, in this case they’re Novell boxes. This means to get to where you need to be you start with \\servername\volumeN\ and then you start getting to the actual filesystem. So in our case “\\servername\volumeN\home\username\Windows NT 5.1 Workstation Profile\” is the users roaming profile store. So far so good, thats only another 71 characters…oh wait we’re already hitting the boundaries, if we put the file in that folder it’ll be 241 characters already. The final destination for our file is “\\servername\volumeN\home\username\Windows NT 5.1 Workstation\Application Data\Microsoft\Office\Recent\” – thats 170 character filename plus another 104 characters giving a grand total of 274 character file name. At this point Windows fails to copy the file, errors and corrupts the profile. Interestingly it would appear that some Unicode functions will handle this length path easily, which would suggest that internally Microsoft might not be using those functions for its profile copying. Always good fun.

In more productive news, I reorganised the JCMU repository and uploaded the 1.5 version. I’ve got to do some more work and update myGovernance. Its having issues at the present moment with large files and the connection timing out for some reason. I’m going to shift stuff to my server in the states and then see if I can commit it from there, hopefully this will make a difference. I also did some more training of the helpdesk staff and ended up fielding a rather backwards support request which I’ll quickly share.

Joomla! provides the ability to autocreate users if their user account is valid within an authentication plugin. In our case we use the LDAP plugin so it can autocreate users. Great! But then the web master decided that he didn’t want that because random people were having accounts created because they were valid, but they never should update that website. So autocreate gets disabled. Fast forward a few months and he wonders why a user on the site isn’t being autocreated by Joomla! after its been disabled and files a support incident which I get and wonder what he’s going on about – he was the one in the first place that wanted it disabled. Interestingly there was another strange issue where the system had itself gotten out of sync which some how became my problem. Five minutes editing the user fixed the problem, a job that could have been easily done by helpdesk – I know because I used their account to do it since I don’t have the power to do it myself. This is at least in my area, I got for some reason an incident involving authentication with a proxy server because in the past I’ve done stuff with authentication. Strangely enough the helpdesk person who assigned it to me has more power over the proxy server than I do. Much ado about nothing!

Following yesterday’s theme I started fixing the Windows instance so that it worked better. First I had to get local admin but once I had that I was free. I put a decent unzip tool on the system (7zip; perhaps arguable about decent but it handles more than Windows does), I replaced alt-tab with the Windows power toy version (allows me to click on icons and gives me a preview of the window most times), I’d already put Firefox and Eclipse on as well as getting a more up to date version of Java to handle the applications I need to run. I’ve also put Chrome on the machine and I’m presently liking it at the moment. Its not quite home yet and I may yet end up setting up Linux somewhere, potentially in a vm, for the simplest of features: symbolic links. It appears that junction points in Windows are evil, deleting one inappropriate will result in the target folder having its contents deleted, moving it to another volume results in the target being emptied however copying does work properly. A lot of commands don’t treat them properly and there is a limited set of commands that you can use to fix things up. Needless to say, I’m going to avoid them. Ahh the joys of Windows!

I spent the majority of today sitting on a Windows desktop missing simple things that I would normally take for granted from other platforms, this includes:

• The ability to install apps without needing root/administrator to do this
• In Mac OS X when you Alt-Tab (or GNOME with SuperSwitcher) you can click on the icon to select the application
• A provided web server, database server and mail server that doesn’t suck
• A menu navigation system that doesn’t lock itself up trying to find icons (yes, I’m referring to the Windows start bar here)
• Decent memory allocation management
• Show desktop functionality that works properly

As a plus, I spent time playing with Chrome and using it. It feels pretty schmick as a browser and its working nicely for me. I’m a bit of a browser whore, so now I’ve got IE6 (default build for the machine), Firefox 3 and Chrome installed – thats not quite as much as my Mac which has Firefox, Safari, Opera and two versions of Shiira (I don’t mind Shiira, the two versions are for the old feature that I thought was cool but they removed – page dock is its name I think, enables you to put a page in the side bar, useful for navigating sites with a big long list of links on one page but no easy way to progress on the next). I have had browsers like Camino on my Mac in the past but I don’t any more.

But even more I miss my Mac or Linux box for sheer usability and it isn’t until you get back on Windows and try to work that you realise how painful it is. Plus side was that getting my email up and running on the box meant that I had to delete the profile that was there because somehow it pointed to the wrong server, fighting it each time because it tried to connect to a server and then digging through LDAP to find the correct Exchange server to connect to once I’d convinced Outlook to let me configure an account with it instead of having it uselessly tell me that it can’t connect to my server.

In other news I’m playing with Google App Engine again. I first made a mistake setting up my application which meant that it was limited to the App based authentication (bummer!), the next app I made I got the auth right but made a slight typo in the name and now I’m up to my third application and it appears to be doing what I want. Due to testing things my local DNS is presently borked so I can’t do proper testing on items yet but when I get around I’ll flush DNS caches along the chain and things should resolve fine again. The tool I’m building is a simple authentication bridge for Google Accounts that doesn’t require me to work around their other requirements. Now that they have stuff like OAuth I’ll have a look at how to integrate those and use them in future as well as looking at ClientLogin – though I must admit thats not as nifty. I built something simple to handle what I wanted and its come in handy, its present use is for one my of university assignments. Should be fun!

After starting a redesign on the SSO manager I feel that the present design will serve me for at least this release. Already I have quickly expanded it’s scope to mtach what I had always intended my auth manager tool to be. So when I get some more time to work on finalizing it I should be able to make my last JAuthTools release for 1.5 before I start 1.6 only. The only other items left are a few identity providers (e.g. OpenID, SimpleSSO and SOAP SSO) and maybe a Type B OpenID plugin as an example of how that works. Fun for the whole family!

I’ve been working on my SSO manager and today I got to the point that I was writing too much code so I decided to redesign my application in a different way. I’ve started with the redesign, so now I’ll see how the second attempt goes. As Brooks says it may take more than one design and few dead ends before you get to the right place. Yay.

As expected I made some progress on my SSO with the basic plugin editor working for type A and C plugins but storing isn’t written yet so I can’t create new type B plugins yet or alter existing plugin entries of any of the plugin types. So the basic views and models are up and running, now I have to finalize the administrator section and then build the front end layer. Once all of that is done I can work on doing the actual plugins themselves, rewriting SOAP SSO, expanding SimpleSSO to handle the new type B requirements and add a new OpenID plugin that integrates into this infrastructure as opposed to integrating badly with the core Joomla! authentication system. It is the only authentication plugin that doesn’t work within the framework instead redirecting the user around the Internet and then back to Joomla! to login. Not the sort of ideal situation which is why I’m trying provide alternatives.

Today was also go live for the next phase of the election process the open source system seems to be working well with a small glitch in one of the extra SQL statements that I had added very close to then end where I had forgotten an extra table. It was a quick fix in my prerelease checking so it thankfully never went online in the production environment. There is no such thing too much testing – it took us three days to find a reproducable bug in one of the other systems that we were planning on using prior to building our own solution. Tomorrow will be putting items up on the website, should be fun!

Beyond more electoral fun and last minute changes (thankfully not impacting on me) I spent some more time on my SSO system working out the database structure for a few tables, extending the installer XML file for my SSO plugins so that they can have some extra information such as their supported states, operations and the key field for a given plugin. I’m using a similar technique that I have used in Joomla! 1.6 by parsing the XML file once, creating the data array and storing it serialized in the table. This way the XML file is only parses once and the much faster PHP unserialize function is used later. This also means that the XML file need not be consulted and the data can be extracted in one query so no excessive increase in over head in the database layer (the query is run anyway, just adding another field) for attempting to open, read and parse the XML file – huge saving. I’ve also managed to get my views down to something logical looking and now that my table structure is finalised I’m getting some work done on the model as well. With any luck I’ll get a mostly working admin component out tomorrow and hopefully finalize the new infrastructure next week. The weekend will be a bit of a wipe out with election being run and potentially me being there to help out.

Today’s major event was fun diagnosing an issue with our directory services (we have three: AD, and two independent eDirectory trees) where users were unable to log in. To cut a long story short, Novell updates the password change in AD and one of the eDir trees directly and the third tree synchronises from the other two and changes between the two via IDM. The directory that we use for web authentication is the ID-Vault which is supposed to be the thing thats got all of the information in the most up to date format. Bzzzzzt assertion failed. Somewhere along the line the password synchronisation for the user got lost between the two directory services and the third one ends up with the wrong password. Fun for the whole family.

This lead me to write up some doco on a service that I rarely use but it is one of the more useful ones that I have out there. JCMU was a project to centralise user authentication and management with a plugin infrastructure to enable disparate ‘sites’ to manage information. In TRC’s incarnation its set up connected to the LDAP directory (the aforementioned ID-Vault), the Staff Intranet and a few other internal applications – each with their own particular method of storing user credentials. So the tool can manage users in the systems, reassigning passwords, groups and even creating accounts in different sites with different connectors. The system even has its own query language to weed down result sets, however the system needs a large hit to make it cache the information as at the moment it finds out all of this information of about 1000 odd users and then outputs it without caching or storing in a database somewhere even temporarily. When I get some time I’ll release out the doco and a tutorial for setting up this extension (its got a 1.0 and 1.5 version) to make it useful in different situations.

Today I spent the majority of the day trying my darndest to convince Subversion to accept my code. Eclipse crashed multiple times and the Subversion command line client wasn’t much help either. I must admit I’ve never seen things crash so often and so fast. I’ve managed to get most of the way there and I’ll persevere for the last bits. I might end up taking it home.

On a lighter front I submitted three extensions to the JED, a really quick Google Search module (you could do it tonnes of other ways that I’m sure have been done before, but just throwing it out there), a content plugin that handles working out anniversary dates (e.g. I’m n years old) and a module that detects if you’re logged in and redirects you to another page (useful more for my SSO stuff where there is no ‘login’ event per se which you want to redirect the user from). Hopefully they’ll all appear sooner or later.