Random thoughts from an unusual company

Turtle Partnership Blog

Problem Solving The 1-2-3 Punch. LDAP, WAS and SSO

Gabriella Davis  May 8 2012 10:46:35 PM
Last weekend I was working on a Sametime install and ran across 3 separate problems that took more time than I'd like to resolve.  I thought I'd post here in case it's of use to anyone else.

Problem No.1: Domino LDAP
The customer gave me details of a Domino-based LDAP server to use for the install of Sametime.  Initially I only had Anonymous access as no credentials had been set up and it was a weekend so I didn't want to bother anyone else.  I installed the SSC and then went to configure LDAP but after clicking the "next" screen on LDAP base entry I got an error telling me I needed a base entry.  This was a surprise since WAS usually recognises Domino LDAP and lets me proceed without a base entry so I knew something was wrong.  Time to start troubleshooting...
Image:Problem Solving The 1-2-3 Punch. LDAP, WAS and SSO
Firstly I know the SSC server can see the LDAP server or I wouldn't have made it as far as this screen, so I need to find out what's wrong with the LDAP server itself.  I install Softerra's LDAP Browser on the SSC and try to connect to the LDAP Domino server using the same details I tried to give the SSC.  The connection works but shows an error loading the rootDSE, basically a schema error.  In addition, Softerra can't query the server well enough to tell it's a Domino server which is suspicious.  I go and look at the Global Configuration document in Domino and see that the list of attributes available to Anonymous LDAP queries has been severely cut down from the default list so I reset that to "default' and relaunch LDAP.  This time I don't get the rootDSE problem but I do still get an error.  So I take another look and see that the LDAP server has a secondary directory specified in Directory Assistance pointing to a Notes database on a remote server and that database doesn't allow Anonymous access.  I move a replica of the database to the LDAP server and open up access for Anonymous and LDAP works fine.  I remove Anonymous and remove "available to LDAP clients" from the Directory Assistance document just in case and all is still fine.  Problem No.1 Solved.

Problem No.2: SSO Not Working
Everything is now installed but when I launch the Sametime Proxy client I get the error "server temporarily unavailable".  Usually this is down to the trusted servers field in Sametime but I confirmed that was OK so after more testing I decided to see if the Meeting Server had the same issue.  The Meeting Server via a browser can authenticate me fine but when I go from there to the Sametime Community Server homepage in Domino, I arrive not logged in.  So no SSO. Then I shut and restart the browser and try logging in first to the Domino Community Server and from there moving to the Meeting server homepage.  I arrive at the Meeting Server home page logged in.  Good. So we've narrowed the problem down, it is SSO from WAS to Domino not from Domino to WAS.  Since that's the case it's almost certainly my problem with the Sametime Proxy Server.  So I focus on fixing the SSO from the Meeting Server to Domino.  I enable LDAP debugging on the Domino server running Sametime (NOT the LDAP server) by adding:

DEBUG_SSO_TRACE_LEVEL=2
WEBSESS_VERBOSE_TRACE=1

which logs LDAP activity to the console (and to console.log if you have it running).  From the logs I can see that the token isn't able to be decrypted.  That's strange.  The usual fix for that is to re-export and import the WAS keys but after doing that carefully twice more, I go looking elsewhere.

On checking (on my 11inch screen) I realised the Domino LTPA token document had scrolled off the bottom and that the default value when I imported the Websphere keys was set to 'token compatible with Domino v7 or earlier' which requires LtpaToken.  I changed it to "compatible with all releases of Domino) which generates both LtpaToken and LtpaToken2 then went to check WAS.

Image:Problem Solving The 1-2-3 Punch. LDAP, WAS and SSO
Logging into the SSC I go to my Global Security and Single Sign On section and check that interoperabiilty mode is checked.  It wasn't, which meant it was only generating a Ltpatoken2 .  So the default install gave me a WAS LtpaToken2 and a Domino LtpaToken that would never be able to talk.  I enabled Interoperability mode (I didn't have to, having changed Domino to recognise LtpaToken2, but I wanted to) restarted EVERYTHING and my Meeting Server could pass its credentials successfully to the Sametime Community Server.   Problem No.2 solved.

Image:Problem Solving The 1-2-3 Punch. LDAP, WAS and SSO

One thing that sidetracked me was this IBM document http://ibm.co/IGGQnz which ,although full of really useful details, does make the statement that the reason for getting the "unable to decrypt token" message can only be down to the keys being wrong.  In my case that wasn't true, it was simply incompatible token settings between WAS and Domino.

Problem No.3: Sametime Proxy Server STILL Won't Login
So the Meeting server is working, I have SSO in both directions but my Sametime Proxy server is still showing "server temporarily unavailable".  Luckily I still have my LDAP debugging on and I test by first logging into the Meeting server then moving to Domino's homepage then onto the Proxy Server.  Checking the console output I see that although the Meeting Server uses the correct Web SSO document in Domino (called LtpaSTToken), the Proxy server arrives asking for the token LtpaToken which exists but is used by other servers and is secured from the Community Server. So why is the Sametime Proxy server trying to use the wrong Web SSO document in Domino? After all the configuration for which document to use is entirely within Domino itself and not configured in WAS.  Then I remember that Sametime has always had a problem with using a Ltpatoken called anything but Ltpatoken.  There used to be a sametime.ini setting that allowed you to override that and force Sametime to use a named token.  I find the technote and it's still true for Sametime 8.5x so I add the value ST_TOKEN_TYPE="LtpaSTToken" to the [AuthToken] section of sametime.ini and restart EVERYTHING again.  Problem fixed.




Connections101 Blog

Gabriella Davis  March 27 2012 02:55:26 PM
This is a joint post by Paul and Gab.   As posted on here a few weeks ago and due to the feedback from the community and IBM, we have decided to go live with an education site dedicated to IBM connections software.  So (drum roll), www.connections101.net is now up.  To start we are going to take you through our steps and tips on how to install a Pilot connections deployment.  This may take some time, but we will get there.  As we are finding our feet, the site may change a bit over the coming weeks, but as ever, we focus on content

Paul and Gab

Off To Melbourne AUSLUG Jumpstarts and Travelling to China

Gabriella Davis  February 17 2012 10:43:54 AM
Well that was sudden.  I had been hoping to make it to Melbourne for the 2nd AUSLUG this March but things just didn't gel when I was trying to plan.  Then about a week ago Mat contacted me to ask if I'd do a Jumpstart but focussing entirely on Domino admin.  In the past year I've been doing lots of work and training on Sametime and Connections but the chance to do a full day's workshop on advanced Domino administration seemed too good to pass up.  Then I looked into flights and Cathay had a sale on this week.  That's serendipity right?  I sent Mat my outline for the Jumpstart and it turns out Chris Miller was also thinking of doing a Jumpstart on Domino but his topics were completely different to mine so Chris came up with the idea that instead of having 2 concurrent 1 day Jumpstarts with entirely different topics, we combine ours into a single super-Jumpstart over 2 days offering the best in high level Domino Administration.  So that's what we're doing.

Sessions are still being firmed up and I'd love to hear from anyone who is attending if this would be useful or what's missing. For example I have planned
  • Working with Mail Databases, Inbox Maintenance, Design, DAOS
  • Working with IDs, certificates, security, password synchronisation
  • ID Vault Setup and Management
  • Performing a security healthcheck , Security best practices, guarding against the most common security vulnerabilities and attacks  

Chris then has sessions on optimisation of services and resources (but I don't want to speak on his behalf).  

The 2 day Jumpstart takes place just before the conference in Melbourne on the 27th and 28th March.  I have also submitted Sametime and Connections abstracts into the AUSLUG conference so hopefully I'll be speaking on those during the regular conference.

Now I have 6 weeks to organise our first ever trip to Australia.  Which will also be our first ever trip to Hong Kong.  And China.  But that's another story which will be taking place on http://www.travellingturtles.com

Excited !

Spark Ideas Video Online - Plus BLUG!

Gabriella Davis  February 16 2012 11:37:27 AM
For those that didn't make it to Lotusphere this year or those that did and missed out on our Spark Ideas session, or those that came to the session and loved it so much you want to see it again (we know you're there, we saw the feedback); our friends at Spiked Studios have kindly recorded each of the 6 Sparks sessions and we have linked to them online here

PLUS - Sparks was so successful we want to keep it going. Next stop is hopefully the Benelux User Group in Antwerp on the 22nd March.  If you're interested in doing a Sparks session and are coming to Antwerp then we'd love to hear from you.  Just you, a mic and 6 minutes to inspire someone.  Take a look at the videos to see how it's done then email your idea to info@nerdgirlgroup.com.  Thanks again to all our wonderful, brave Spark speakers from Lotusphere and to everyone who attended.

Of course this one is my favourite :-)

Tim Davis – Choosing To Be Lucky


Presenting at BLUG on Sametime

Gabriella Davis  February 16 2012 12:56:09 AM
I'm delighted to say that i'll be speaking at the fantastic BLUG conference in Antwerp on March 22nd (sidebar -only 5 weeks away!).  My session is on Sametime and is the only one able to be squeezed into the packed agenda this year so I'm combining a whole lot of different information under the one heading "Sametime Pick and Mix".  For those of you at Lotusphere 2012 you may know that my session there had the same name but only some of the content is the same.  The session still talks about the different Sametime versions and components and how to design a system to deliver what you need but I've added new content on infrastructure and management as well to make sure those of you who want to learn about Sametime get as much info in as short a time as possible.

I hope to see you there

Gab


Why I love XPages

Tim Davis  February 7 2012 04:09:01 PM
I have been thinking a lot recently about why I love developing XPages. I had a few conversations at Lotusphere around this subject, and certainly while most people consider it powerful and the right way to go for developments, few seemed to find it easy or enjoyable. The general feeling was that learning XPages was a huge hurdle to get over before you can become comfortable.

I do keep trying to encourage people to get started, and Ben Langhinrichs and I did a session at Lotusphere where our theme was how easy it can be to get some nice results quickly using XPages. You won't be an expert in a short time, but you needn't be scared of them.

However, I have just thought about where I was before I came to XPages and how that may have made a difference for me.

For the previous three or four years, almost all my Domino development had been in websites or intranet systems. I did virtually no development for the Notes Client.

As part of this development, I found myself using passthru HTML, CSS and JavaScript almost entirely. I had built myself libraries to handle all the effects I wanted to achieve, with AJAX and JSON and all of that stuff. I had tried to create standard 'template' design elements for cookie-cutter layout components (mainly subforms), and tried to standardize field and form behaviours so that newer developments could be fairly quickly put together from existing designs.

Then, when I came to use XPages, I found that they do all this for me with just a few button clicks. The handling of styles across controls is elegant and simple. The whole concept of custom controls is the natural extension of what I had been trying to do previously with my 'template' subforms, except so much better. JavaScript was already my favorite scripting language. The Source view in DDE looks like my earlier passthru HTML forms, except more concise with the lovely way a control is expressed with XML tags.

I think I may have had an unfair advantage in the transfer to XPages, since I was already developing using the same tools, and to a degree some of the same concepts. If I was a 'regular' Domino developer, mainly writing Notes forms, views, agents, @formulas, etc, then I can imagine the move to XPages would be very different. All that Notes stuff is hidden away in the XPages world.

This isn't to say it was all plain sailing, I've had trouble along the way, but I can remember what it used to take to create an effect in my old developments, and I just find it a joy to work in XPages.

So what can this tell us? I think if you are struggling with XPages, then the thing to do is to first make yourself familiar with the web development techniques. Get to know HTML, JavaScript and CSS. Learn the browser object model, especially the way every thing is contained inside another thing.  If you can feel comfortable working with divs, with identifying objects on the page by id, and with accessing them using JavaScript, then these ideas will help you a long way along the path of learning XPages.



Social Media: Back to the 1800’s

Tim Davis  January 26 2012 03:34:45 PM
When I read old ghost stories on my iPad, I keep tapping Define to improve my olde worlde vocab. Most of the time I think I know what a strange word means, but its fun to be able to immediately look it up and see how close I am.

I was reading a ghost story last night, and I came across the word 'epigram'. I know what it means, but was interested in the official definition. Here it is:

"A pithy saying or remark expressing an idea in a clever and amusing way"

Back in the 1800's epigrams were used everywhere for bon-mots, short poems and quips. People used them in letters, in pamphlets, in poetry collections, newpaper quotes, etc. They were the epitome of succinct wit, and were published across all available media of the time. Think of the sayings of Oscar Wilde, or Mark Twain.

Here in the 21st century, we have Twitter's artificial 140 character limit which effectively forces waffley blogs down into neat epigram-sized bites, and provides the medium to broadcast them. For the first time in over a hundred years, we have a means for anyone to publish an epigram.

The internet may be new, but the content is the same as ever. Welcome back to the 1800's.


Lotusphere presentation - Speedgeeking Websphere

Gabriella Davis  January 24 2012 05:24:21 AM
Here is my Speedgeeking presentation, Websphere in 5 Minutes.

Lotusphere Presentation - Leveraging Software Entitlements

Gabriella Davis  January 24 2012 05:13:58 AM
This is the session I did with Paul Mooney on software entitlements.


Lotusphere Presentation - Domino Security

Gabriella Davis  January 24 2012 05:01:49 AM
This is the Jumpstart presentation I did with Andrew Pollack on Domino Security (images intact).