It’s great validation when industry analysts back up what we’re seeing with customers.  A new Analyst Connection, sponsored by Alfresco from Melissa Webster, IDC Vice President for Content & Digital Media Technologies does just that.

Here’s an excerpt:

Hybrid ECM is a deployment architecture that combines on-premise and cloud computing in a seamless and flexible way. It marries enterprise-class cloud file sync and share with enterprise content management. It provides an end-to-end, managed environment that lets organizations empower users while retaining full control over their enterprise content. It’s the best of both worlds, and it lends itself to numerous scenarios.

And another:

Hybrid ECM gives organizations an elegant way to address diverse use cases and resolve the inherent tension between use cases that are more cloud focused and use cases that need on-premise services. As SaaS adoption continues to grow, hybrid ECM gives organizations the flexibility to move applications — together with related enterprise content — to the cloud. Organizations are still evolving their cloud strategies, so that flexibility is a big advantage.

Read the rest of what Melissa has to say in this insightful IDC Analyst Connection. Let us know how you are using Alfresco’s hybrid ECM and don’t forget to share your interesting use case with us for a chance to present at Alfresco Summit.

The playlist currently includes:

• Reviewing the sample site
• Adding users (one at-a-time and by importing a CSV)
• Creating groups
• Create a new site
• Five ways to create content
• Versioning a document
• Starting a workflow
• Updating your profile
• Exploring social features
• Configuring user and site dashboards
• Adding new features to your site

In the very near future I’d like to add some technical how-to’s for Community Edition, including LDAP configuration, CIFS/WebDAV/FTP/IMAP configuration, installing the SharePoint Protocol, installing the Google Docs Integration, configuring inbound and outbound SMTP, basic content model extensions, and basic dashlet development.

If you have ideas for Alfresco Community Edition videos you’d like to see that would help make your Alfresco Community Edition rollout more successful, let me know.

We’ve updated the web site with a high-level agenda, training course descriptions, hotel and venue information, detailed pricing, and, of course, the registration form (Barcelona, Boston).

Regarding pricing, note that we are doing something a little different this year. Instead of having a single early-bird period we’re having multiple price breaks leading up to the event. The biggest savings happens now through mid-July and then the prices start to go up until we eventually reach the full-price rates.

Networking with others in the community, talking to industry visionaries and Alfresco Engineers, and taking some time to look at your ECM implementation from a new angle are all great reasons to come to Alfresco Summit. But I think the biggest benefit that justifies the cost of the conference, travel, and time away from work is the great content.

If you’ve been to past DevCons you know that this is an information-dense event. That will be the case again this year. To help make that happen, we rely on our passionate community of customers, partners, employees, and other members of the ecosystem to come to the conference and share their story with the rest of us, whether that’s a full-length session or a lightning talk. If you would like to speak, there is still time. You have until June 15 to get your proposal turned in.

Alfresco Summit is the must-attend event for anyone doing anything with our software. Do not wait to register because I want to see you there, have a chance to shake your hand, and thank you for helping make Alfresco the last true innovator in the ECM industry.

MariaDB is a drop-in replacement for MySQL. Literally. You don’t have to change anything, really. Uninstall MySQL, install MariaDB, restart Alfresco, done. Same driver. Same connection string. Same tables. Same mysql command-line client.

If you install from MacPorts, watch out for this gotcha, otherwise, it is no big deal.

You don’t need both installed, but if both MySQL and MariaDB are installed via MacPorts, you can switch between the two with “sudo port select –set mysql mariadb”.

Despite the compatibility, Alfresco does not list MariaDB on the list of supported databases, so Enterprise Edition users should not do this on production machines.

There are two types of submissions: full sessions and lightning talks. You use the same submission form for both types of presentations, but the lightning talks require less detail.

When filling out the proposal survey, there are four types of questions you will need to answer:

1. We need to know who you are and how to contact you.
2. Categorize your submission by intended audience, topics covered and the technical level of the presentation.
3. Briefly describe the topic.
4. Share your previous experience giving presentations and explain why you would be good at presenting this topic.

Should your proposal be accepted, this information will be the basis of the conference guide that people use to determine which sessions to attend.

We use your intended audience, topics and technical rating to determine which audience the presentation will most appeal to—a developer audience or our business management and content professional audiences. Our theme is “Put Your Content to Work,” and regardless of your audience we want to hear how to make content more accessible and useful to your organization. We will use this list of topics to make sure we have broad coverage at the conference. If you still have questions then this blog post should help.

In addition to technical presentations, some of the new topics we want to see covered this year include:

• Non-technical case studies presented by the user of the solution;
• Industry trends, regulations and standards;
• Best practices in project management;
• Library science and information architecture; and,
• Tips for driving user adoption within your organization.

If you have an idea for a proposal, but don’t think it will fill the time of a full session then please consider it for one of our lightening talks. We also encourage you to submit more than one proposal.

Submit today, the deadline is June 15th.

If you have any specific questions about the submission process, leave me a comment here or email hidden; JavaScript is required .

Good luck and I hope to see you in November!

CMIS 1.1 has some exciting new features. Here’s a re-cap of what’s new…

Browser Binding

A binding is the protocol a client uses to talk to a CMIS server. CMIS 1.0 supported two bindings, Web Services (SOAP) and AtomPub (RESTful XML), the latter being the most performant and the most popular. But if you’ve ever looked at the XML that comes back from a CMIS AtomPub call you know how verbose it can be. The Browser Binding is based on JSON, so the payloads that go between client and server are smaller, making it the fastest of the three bindings. The original purpose of the Browser Binding was to make it easy for those building “single page” web apps or doing other work with CMIS via client-side JavaScript, but I think apps of all types will move to the Browser Binding as quickly as possible simply because it is easier to work with.

Type Mutability

This allows CMIS developers to create and update the repository’s content model with code. Imagine you’re building an Accounts Payable solution. You’re using CMIS because you want your solution to run on top of any CMIS-compliant ECM repository. It is highly likely you will need content types to store objects with metadata specific to your solution. Before CMIS 1.1, you have to ship repository-specific content models and installation and configuration instructions with your app. With CMIS 1.1, developers can simply write install and config logic as part of the solution that will interrogate the repository to determine if any changes need to be made to the content model to support the solution, and if changes are required, implement them.

Secondary Types

Some repositories (like Alfresco) have the concept of free-floating or cross-cutting content types that group together related properties that can be added to object instances in the repository. For example, perhaps you want to define a “client-related” set of properties that can be added to any document in the repository that is related to one of your clients. Not all documents are related to a client, but the ones that are need to be able to refer to a client name or number or something. In Alfresco, these are called “aspects”. CMIS 1.0 didn’t support aspects natively so developers using CMIS to query for or set properties defined in an aspect had to use a workaround. In CMIS 1.1, aspects are supported natively.

New “Item” Type

In CMIS 1.0, Document objects are assumed to have a content stream. Some repositories even require it. In Alfresco, this means if you want to work with a type that inherits from something other than cm:content (or cm:folder), you are out-of-luck. CMIS 1.1 adds a new base object type called “Item” that represents objects that don’t have a file associated with it.

Bulk Updates

CMIS 1.1 adds a new feature that makes mass changes more performant. Instead of iterating over a list of objects, changing and saving each one, you can define a set of property changes and make those against an entire collection, which is much more efficient.

Append to Content Stream

A challenge with any ECM project is how to move large files into the repository. The new append to content stream feature in CMIS 1.1 allows you to send files to the repository in chunks which could be a key to addressing that challenge.

Retentions and Holds

This new feature allows you to set retention periods for a piece of content or place a legal hold on content through the CMIS 1.1 API. This is useful in compliance solutions like Records Management (RM). Honestly, I am not a big fan of this feature. It seems too specific to a particular domain (RM) and I think CMIS should be more general. If you are going to start adding RM features into the spec, why not add Web Content Management (WCM) features as well? And Digital Asset Management (DAM) and so on? I’m sure it is useful, I just don’t think it belongs in the spec.

So that’s what’s new in CMIS 1.1. You can read the authoritative spec for details.

When Will My Favorite Repository Support CMIS 1.1?

That’s up to each vendor. If these features are important to your installation or the solution you are building, you should be making it very clear to your vendor contacts that you want to see these features get priority over other things the engineering team might be working on. As for Alfresco, I can’t make any promises on dates. We’ve had experimental support for the browser binding in place for some time. I think we all want to see the other CMIS 1.1 features in both Alfresco on-premise and in the cloud sooner rather than later, but I don’t know when that will be.

Try It!

You can play with CMIS 1.1 by downloading the OpenCMIS InMemory Server from Apache Chemistry and a client library for your favorite language, or just launch the OpenCMIS Workbench and you’ll see the Browser Binding as an option when you connect. If you need to know more about CMIS and the client libraries, server frameworks, and CMIS development tools available at Apache Chemistry, you should buy the book Jay Brown, Florian Mueller, and I have been working on. It should be in print later this summer but you can get the eBook now. It covers both CMIS 1.0 and CMIS 1.1.

Alfresco recently announced changes to our pricing with Alfresco One available to all existing Enterprise subscribers. That means all of our customers can try hybrid enterprise content management (ECM) for free with a limited number of users and see how this new solution can help deliver new use cases for your organization.

At Alfresco, we believe hybrid is the only way the enterprise today can address all their ECM needs. We’ve called cloud-only vendors bluff that everything can be managed in the cloud. We’ve also addressed the gaps of legacy on-premise only vendors who can’t meet the increasing needs for enterprises to securely share content outside their firewall with third parties or mobile devices.

A few weeks ago I did a webinar on how enterprise architects can use hybrid ECM to deliver new solutions that aren’t possible in either a on-premise only or cloud-only environment. Below is a summary of the four main solutions we’re seeing customers build for their enterprises on top of Alfresco One. All of these solutions can be set-up in minutes if you’re using Alfresco 4.1 or above.

1. Secure B2B Collaboration

By far the biggest driver we see from customers adopting hybrid ECM is the need to share cotent and collaborate with people outside their organization. Before hybrid ECM, enterprises would have to open up their internal systems to external users. This could take weeks to approve and provision in some organizations and potentially open up security holes.

With hybrid ECM, users can now sync content to our cloud service and use Alfresco in the cloud as a secure, compliant, Extranet, to share content and collaborate with external organizations. Because the content is synchronised automatically between both sides of the firewall, customers can now bring external parties into the collaboration process where needed, while keeping internal, confidential systems and data secure behind the firewall.

This results in faster turn-around times when collaborating on content, reducing the need to fall back to email or use unsanctioned file sharing services that the organization has no control over and may be breaking regulatory laws.

2. Enable Mobile Devices

The second driver we’re seeing is using hybrid ECM to enable mobile devices. While mobile devices can use VPN to connect securely to on-premise systems, VPN doesn’t always work and can be technically challenging for users to set-up. However, one concern we’re seeing is protection of data if a mobile device is lost or compromised. With hybrid ECM, enterprises can put the content they need to share on mobile devices on our cloud service, while keeping highly confidential and regulated content behind the firewall. That way the mobile devices can only ever access the content you want to share via cloud.

One of our manufacturing customers uses this for pushing sales presentations to their sales reps and partners in the field. Their marketing team use Alfresco behind the firewall as an Intranet with access to all the internal company research and content to help create new sales presentations for their sales teams and partners. They then push the final presentations to sales reps and partners in the field’s mobile devices via cloud using sync. Not only does this keep confidential content off mobile devices, our cloud service which is optimised for users around the world, provides faster distribution of that content to their devices all over the world.

The other great use case is using mobile devices submit new content to Alfresco in the field. A large retail customer is using Alfresco in this way to take photos of problems in their stores around the country, which are posted to a site on cloud and automatically synchronised back on-premise to the facilities management team who can then create new cases to go and fix those problems.

Both of these use cases provide a reliable infrastructure to push and pull content from mobile devices securely anywhere in the world and ensure than highly confidential, regulated content, stays secure behind the firewall where it belongs.

3. Connect Cloud Services to On-Premise

With the upcoming release of our Salesforce connector, this is a great use case that solves a real problem IT teams have with cloud solutions today. A lot of ECM repositories on-premise are used to store all the content from other solutions such as CRM, ERP, etc. the enterprise is using. Cloud has created an issue where enterprises moving to new cloud-only solutions like Salesforce cannot easily store the content from the service in their ECM repository on-premise. The reasons to do this is to make it easier to integrate with existing business processes and search behind the firewall. For example, uploading a contract on Salesforce should probably be available to SAP on-premise too.

While there are some very expensive and complex solutions available to solve this problem securely, Alfresco One provides a low cost and extremely simple architecture for integrating cloud solutions with your on-premise repositories. Our cloud service acts as a repository for all your cloud services to easily connect to via our public APIs and hybrid sync. can synchronise content from cloud to on-premise automatically and vice versa. This allows your cloud services to access content previously locked behind your firewall and your cloud services to store content in your on-premise repository where it can be accessed by your internal systems.

Once our Salesforce connector is available, you’ll be able to configure this solution in minutes and finally connect your cloud services to your on-premise systems and business processes.

4. Orchestrating your Content in the Cloud

This is my favorite use case as I believe this is where many of our customers will find the most value from hybrid ECM as they become more advanced with using the solution. The great thing about hybrid sync is that changes on both sides of the firewall are automatically synchronized and folder rules can be used on both cloud and on-premise to automate really interesting business processes.

For example, I mentioned in the mobile solution above how a large retail customer was using cloud to push photos of store issues from mobile devices to their facilities management team on-premise. With hybrid ECM, they could automatically kick off a new workflow (case) whenever new photos are submitted via cloud using folder rules. The facilities team could be using Alfresco Workdesk on-premise to manage cases and send cases to external contractors (via cloud) to quote and fix issues around their stores. Once the contract has added their quote or completed the work, the case would return on-premise to the facilities team who would then close the case,and archive it as a record.

With hybrid ECM you can start building new business processes that bring external parties and devices into your workflows without having to open up your firewall or put highly confidential or regulated content at risk.

Hybrid ECM provides a unique and powerful architecture for delivering new solutions for your enterprise. Are there some other examples of how you are using hybrid in a unique way to get stuff done? To get started watch my webinar and downloading Alfresco One today!

Is ECM a mature market?  We often hear that it is, when speaking to analysts, press and others in the industry.  Sure, Enterprise Content Management as a description for document management, capture, workflow and related technologies has been around awhile (AIIM started using it in 2000).  But does saying that ECM is mature mean organizations have all their content issues sorted?

Some new survey data from AIIM shows that is hardly the case.

The new study, ECM at a Crossroads, which Alfresco co-sponsored, surveyed 538 AIIM members about their current and planned use of ECM technologies. Key findings include:

• Only 3% of surveyed organizations have actually turned off their file-shares, although 12% have “largely replaced it” with ECM. 34% are keen to turn it off, but for 61%, file-shares still play a significant role in their content structure.
• Only 26% have the classic ECM implementation that includes capture and image workflow. 34% have separate systems, although 16% plan to bring them together.
• More enterprise content sits outside of ECM than inside: for 61% of organizations, half or more of their content is held in non-ECM/DM systems such as ERP, HR, Finance, etc. This makes it difficult to search and it is not under records management retention rules.
• Only 11% have a mobile optimized browser interface to their ECM and only 10% have specific apps. Yet 30% need their employees to interact with workflows on mobile devices.
• More than 1 in 4 organizations face a dilemma with their cloud strategy. 25% are seeing unofficial use of cloud file-sharing sites – most of which are “consumer-grade”.
• Spend on ECM software licenses is set to increase in the next 12 months.

Doesn’t really sound like a mature market, does it?   Though it does sound like one that is ‘at a crossroads,’ as the title of the new AIIM study suggests.

At Alfresco, we see customers dealing with several trends at the moment and in some cases, with really challenging enterprise content environments.

• Many deployed ECM systems are old and – as the AIIM data shows – aren’t meeting the needs of users who still rely on file shares, struggle to find content across too many repositories, and can’t participate in content-related processes when they’re mobile.
• Users are adopting “consumer-grade” services because of the limitations in their ECM systems and models.  This only creates more silos – and in some cases, data privacy or security concerns.
• Organizations don’t need more content silos, particularly ones that are disconnected from all existing on-prem systems and data.  There is real appetite in the market for rationalization, openness and integration – in the cloud, on-prem and with hybrid models.
• Business processes are more collaborative and more mobile – yet many organizations haven’t even addressed basic workflow and capture requirements.
• Yes, there is a lot of SharePoint out there, but it doesn’t seem to solve content chaos problems or lead to much rationalization – the AIIM data shows 50% of organizations surveyed use SharePoint as a content repository and those organizations are nearly twice as likely to have 4 or more ECM systems (34%) than those who don’t use SharePoint in this way (18%).
• And SharePoint likely leads to more content living outside of the sanctioned “ECM” system, since it isn’t meeting user demands for mobile access. In a recent Forrester survey about SharePoint, 91% of respondents reported not providing mobile access to SharePoint.  Hmmm…wonder what mobile workers in those organizations do when they need to access files from their phones and tablets?  Enter “consumer grade.”

The AIIM survey data backs up what Alfresco is experiencing – there is significant demand in the market for modern, open, mobile and cloud-ready ECM capabilities to ongoing and emerging content chaos and content process challenges.

Yes, spend on ECM software is going to increase in the next 12 months – the market isn’t mature.  Enterprise content problems are not solved.  It’s just that a lot of products and approaches currently on the market are old and not meeting the needs of modern organizations.  There is a difference.

Read the full AIIM study here. And then check out what customers and analysts are saying about Alfresco.

SharePoint users are at a crossroads. They have put a massive amount of content into SharePoint that isn’t always easily retrieved. They have invested time, resources and money trying to configure SharePoint to solve their content management problems.  Users are found questioning if SharePoint is efficiently managing their business-critical content processes.

AIIM has realized the challenges that SharePoint users are facing and recently addressed them at the seminar in Toronto, “SharePoint at a Crossroads.”

Attendees at the event were from a broad range of organizations with varying successes, difficulties and questions about SharePoint. Some are looking for more value from their ECM, including mobile and secure cloud solutions. Some have just deployed SharePoint and are experiencing success in their first stages of implementation. Many attendees were looking for SharePoint partners to solve their problems related to scalability, accessibility to content and flexibility of the platform to create unique business solutions.

Alfresco participated in the event as the only ECM alternative to SharePoint. Many participants were partners with add-on solutions to SharePoint or imaging solutions that integrate with many different ECMs. Alfresco uniquely represented one of the options that SharePoint users face—replacing it with another ECM.

A recent survey of over 500 professionals was conducted that found 80 percent of those using SharePoint thought it fell short of their expectations. Alfresco offers many valuable features in comparison to SharePoint:

• Lower cost and higher ROI
• Faster implementations
• More advanced workflow capabilities
• Scalability and stronger search features
• An open platform that more easily integrates with business-critical tools

While not everyone is looking to migrate to a new ECM, there are tools available to better manage content already in SharePoint. To learn more about managing your SharePoint data in Alfresco, watch our webinar recording.

There are many different options to choose from when considering your current ECM investment and where to invest your resources in the future. Alfresco offers a scalable, flexible and cost efficient solution for managing your content. Is SharePoint providing the same for you?

“Web content management is evolving from website publishing to digital experience support,”

What does Forrester mean?  You don’t need an explanation if…

• You’re reading this on a smartphone or tablet
• You’ve updated a website on your own, without sending files to an IT person
• You rely on user generated or suggestions from trusted communities

Websites were once about flat content with little interaction.  Today, that sort of nostalgia doesn’t play.  What we expect is…

• A digital experience that flows from browser to tablet to mobile flawlessly
• A site to be responsive to our requests with targeted information
• Communities to suggest and bubble up the best ideas, relevant to our needs

Building these abilities into a website isn’t easy. It takes more than pretty pictures and snappy text.  It takes extensive use of digital assets integrated into the web experience.  It assumes responsive design for viewing on any screen. It requires content targeting for presentation of the right content at the right time. It takes a dedicated tool purpose built for accomplishing the goal of delivering an awesome web experience. Yet many web and content experience management solutions are heavy, hard to learn and expensive.

Alfresco has a solution for WCM that it is built around the open strategy of content services. As a strategy, we decided to be committed to what we do best, manage digital content.  And although the core of WCM is managing digital content, today’s modern web requires a comprehensive solution. Welcome Crafter, you do it very well.

Who says?

• YouSendIt:  “Crafter enabled our marketing and web development teams to easily deliver dynamic and engaging content, while knowing we have preeminent Crafter experts on hand for support,” said Steve Ceplenski, Senior Director, Web Services at YouSendIt. “Using Crafter’s next generation technology, we are able to quickly develop targeted content for our brand, and easily integrate with a SaaS translation system to manage sites in multiple languages.”
• Full Sail University:  “We wanted to make use of rich web media, including flash and video in our new website and Alfresco did not limit us in any way.  Combining Crafter with Alfresco allowed us increased flexibility and to scale with relative ease” Mark Gilbert, VP Information and Media Technologies.  Read more here.
• MasterCard, National Academy of Sciences and Harvard Business Publishing to name a few – check out more references here.

Today we welcome Crafter Software to the Alfresco Partner Program as their own organization with their own team to sell and support the solution. Check out their website to learn more and read more about the great work they are doing!

Alfresco has been talking about cloud connected content management for awhile now, since we first launched a stand-alone SaaS offering last year. Cloud connected content management is all about using the cloud for applications, user groups and processes where it makes sense, but doing so in a way that doesn’t create additional, disconnected content silos or compromise content security or corporate policies.

This week at the Gartner Portals, Content & Collaboration Summit held in San Diego, analysts presented a vision for content management that reinforces what we’ve been seeing and speaking about at Alfresco.

In a session called The New Enterprise Content Management Scenario, Gartner ECM analyst Mark Gilbert presented his view on what he called ‘multi-verse cloud content.’  This was a spot-on analysis of the different ways in which enterprise content is moving to the cloud.  Mark distinguished between consumer-oriented file-sharing services, departmental line-of-business apps and traditional enterprise content management systems.

The reality is that most organizations have all three of these types of content systems, but the degree to which they are going to the cloud depends a lot on the type of organization.

Some organizations are way out in front of this opportunity, moving their content and apps to the cloud aggressively and encouraging users to innovate.  Others, particularly in highly regulated industries, are sticking to more traditional, IT-led approaches to content management and using the cloud only in very limited scenarios, if at all.

But most companies are somewhere in the middle of these two extremes, adopting cloud services for extranet-type apps or to enable easy access to content from mobile devices, but mostly still experimenting.  Most also know that the traditional ECM systems – which are fifteen years old or more in some cases – are in need of a refresh.  But will that refresh happen in the cloud?

Alfresco’s vision of cloud connected content is a forward looking one, but also one that can work for customers today despite being at different stages in this multi-verse world of cloud content.

To this end, we’ve created some scalable options depending on your content needs now and in the future as those needs change and evolve depending on your cloud comfort level -

Ready to put significant portions of content-centric apps in the cloud?  Check out Alfresco in the cloud, our own SaaS offering or how we’re working with AWS for private-cloud deployments.

Want to use the cloud for some apps or specific audiences without creating more content silos or worrying about loss of control?  Check out Alfresco’s hybrid model that enables content in the cloud, content on-prem and synchronization between the two environments.

Not interested in the cloud right now, but still need to think about an ECM refresh and how you’re going to meet demands for mobile access?  Alfresco Enterprise is a modern and open ECM platform for on-prem deployments with great support for mobile, business processes and collaboration.

We had some great conversations this week at PCC with customers and analysts that confirmed Alfresco’s approach truly resonates with solve real business needs.  There is no one-size-fits all solution in content management – there never really has been and the cloud, for all the benefits it offers, doesn’t change that.

Check out Gartner’s analysis of Alfresco and the ECM market in the Magic Quadrant. How are you enabling cloud connected content to do great work?

Imagine the future… I have been imagining the not too distant future a lot recently. It all started when I attended AWS re:Invent in Las Vegas last November. Werner Vogels, Andy Jassy and Jeff Bezos painted a picture of their services: reducing costs, leading to more users, leading to economies of scale to further reducing costs. Reduced costs, to the point where you don’t think about the cost (like you don’t think about turning on a light switch), leading to massive innovation. Democratizing infrastructure, why spend time and money on things that don’t differentiate you in the marketplace?

My vision? In the future all of our computing will be done in the cloud. There will be no more desktop or laptop computers instead we will use devices like tablets and terminals (remember the days when terminals were commonplace)? A day at work for the average knowledge worker might start off by selecting one of many EC2 instances or even entire application stacks. When infrastructure is a service and can be started and stopped with an API call, an entire new paradigm opens up. You don’t have to “fix” failing servers, you can just replace them with new healthy ones. You can version your entire server stack by keeping your provisioning code in version control. You can duplicate a production stack of hundreds of servers in minutes instead of months.

The work day could involve many of these throughout the day – developing new code on the latest product, a customer demo for the latest production release and one for crunching data about customer usage, just to name a few examples. There is a corporate policy in place, automatically enforced, to shut down servers at the end of the day so any instances left running are shut down to save money. All access to the corporate AWS account is controlled by IAM roles so each individual can only access the AWS resources that are relevant to them. For example the test group only has access to the test servers.

Leaving work doesn’t mean leaving the cloud behind. At home, the kids are watching a movie on Netflix and listening to Spotify, both streamed from AWS. Dad wants to relax with the latest shooter style computer game. He goes to the AWS Marketplace, finds the game he is looking for, starts up an instance and starts playing from his tablet. He doesn’t have to buy the game, the cost is built into the usage charges for AWS. His buddy wants to join in the game so connects his tablet to Dad’s server and both play on the cloud. Mom is uploading the photos and videos that she took of the kids’ school play earlier in the day. The photos will all be available, safe and forever secure because behind the scenes they are stored in S3.

Do you think this is a distant reality?

I don’t think so. We are already seeing corporate IT fall by the wayside. Departments are asking for AWS now as a means to circumvent the slow and tedious process of asking IT for a server for their new software installation. We see this all the time with our Alfresco clients. Like AWS management says, why spend the effort on hardware and networking when it doesn’t bring you a competitive advantage? Hardware and networking are commodities.

Spend 5 minutes provisioning an AWS EC2 instance, one with Alfresco already installed on it from the AWS Marketplace perhaps, instead of 5 weeks ordering hardware and setting it up. I personally already do this for development and customer demos. This past weekend, I needed a Drupal server. Rather than installing Apache, Drupal, and PHP, I just found an AMI and started up an instance, saving me valuable time.

The fact is that almost everything described here is already possible. The only thing that needs to change for this to be a reality is how we think about and use our computing resources. I am excited for that change to occur!

I will be attending the AWS Summit today in San Francisco. Every time I attend an AWS event, my vision becomes closer to reality. AWS is increasing their product and service offerings rapidly and usually have a few new announcements at each event.

Please stop by to say hi and if you would like to learn more about AWS and Alfresco you can check out our webinar or Alfresco’s new CloudFormation template!

If you are already signed up for the WebEx this Wednesday, don’t join it. Instead, just head over to the Event page. We’ll embed the live broadcast there. We’ll also include an embedded IRC chat window tuned in to #alfresco on Freenode IRC to facilitate real-time questions and discussion.

What’s on the agenda this month?

So glad you asked. This month we’ll be talking about Alfresco and reporting. We’ll have Alfresco community member, Tjarda Peelen, showing us what he does to solve the problem by integrating Alfresco and Pentaho. He’s made that available as an open source project so we’ll be looking at that code, seeing a demo, and talking about other ways people do reporting against Alfresco. If you want to throw in your ideas, join us in the chat.

We’ve tried Google Hangouts before, but this is the first time using it for Tech Talk Live. We hope it works well and that you’ll like the new format. Of course it could be a complete disaster. Who knows. Tune in to find out!

Organizations can now integrate their existing user directories to our cloud service, allowing your users to login with their existing company credentials. This feature is available to all Standard and Enterprise Network subscribers and we welcome any organizations to upgrade for a free 30 day trial if they wish to test the functionality today.

For Users

If you already have a central login/password for your organization, you probably don’t want to remember a new username and password for all the different cloud services you use. With this feature enabled by your administrators, you will now be able to use a single login with your existing credientials seamlessly. In order to get started, here are some user best practices:

1. Your administrators will give you a specific URL for your organization to bookmark when you want to login to Alfresco in the cloud.
2. When you access that URL, you will automatically be redirected to your organization’s login page to login using your existing credentials.
3. On successful login, you will automatically be redirected back to Alfresco and logged into the application

For Administrators

For the more technical, this new feature uses the SAML Single Sign-On (SSO) 2.0 protocol to integrate your existing Active Directory/LDAP server with our cloud service. Using some simple configuration on your Account Settings page, any of your Network Members will be able to go to a unique URL for your Network, which will redirect them to your own login page where they can sign in. On a successful login, they will be automatically redirected back to Alfresco and logged into use the service.

This means a couple of things:

• Your users only need to manage one password for your organization and no longer need to create a separate login to use the Alfresco in the cloud service.
• Since you control the login process and policies, you have complete authority over how users are provisioned and managed using your existing security infrastructure.
• You can onboard users easily by just letting them login to the cloud service, automatically creating a new account for them if its their first time accessing the service

You can find our full documentation on how to get setup using SAML SSO with Alfresco in the cloud here.

Supported Identity Providers (IDPs)

We have built this to conform with the SAML standard so this feature should work out of the box with any SAML SSO enabled IDPs. However; in practice many IDPs have their own quirks, which means we have to certify each provider to ensure they work and are fully supported by our service on every release. At this time our official support is limited to PingFederate, but we will be looking to expand this list to other IDPs such as Centrify over time based on customer demand.

Get started today and let me know if you have any feedback or questions by leaving a comment here!

Last year was my first time to Alfresco DevCon. I was six months in to working here and had heard of DevCon before having been one of Alfresco’s partners in a previous life.

But for some reason I was always under the assumption it was this strange geek thing lead by the mysterious Jeff Potts. I was only half right. With no expectations, I showed up in Berlin for Day 0 with Trainings and the Hackaton.

The one thing that immediately stood out was passion. I mean, what else explains 17 grown men sitting around a table working in teams to build the best applications that will actually help make every day work easier and more productive?

The trainings were packed with a smart audience asking great questions around how they can get the most out of our powerful platform. Having eight hours to focus on understanding how to put content to work and get the most from employees really sets you on a good path to a more calm content existence. If I would have gotten one of these crash courses when I first started in PR, it would have saved me literally years of version control press release nightmares.

The next couple of days were a complete whirlwind, each one building on the other and opening my eyes to the heart of Alfresco. I have never had the chance to be in a room with a smarter, more passionate and innovative group of people looking to solve real work problems and enhance the flow of global content.

At the same time, I also sort of felt that DevCon was the best secret conference I had ever been to, which is saying a lot considering I’ve worked SXSW Interactive for the past eight years in some capacity. More people would come if they were aware and we opened it up to industry heavy weights and customers who can share unique perspectives that others can learn from to empower great teamwork.

This year we are doing just that with Alfresco Summit!

I’m so excited that Jeff along with an internal team of event ninjas is taking the best of what makes Alfresco’s entrepreneurial community unique and letting more businesses take advantage of learning how to put our critical content to work.

We also put out the Call for Presenters due June 15,2013 so get submissions in early! We will stop accepting ideas once all the speaking slots are filled. We couldn’t be more excited for what 2013 will bring and can’t wait for our November reunion in two really vibrant cities – Boston and Barcelona…won’t you join us?

Be sure to follow us on Twitter and use #SummitNow to let us know you are coming!

I am pleased to announce that Alfresco Summit will take place this November in Barcelona from the 4th through the 7th and in Boston from the 12th through the 15th.

As we’ve done with previous DevCon events, the first day will be a pre-conference day consisting of training workshops (additional cost), a hack-a-thon, and a Partner Summit. The main conference starts on the next day. The full schedule will be on the Alfresco Summit site some time this Summer.

We expect registration to go live in June.

You Should Speak

We always have a great mix of content from Alfrescans, customers, partners, and other community members and I want to make sure that continues this year. Whether you are a developer who wants to give a down-and-dirty technical talk or you are an IT decision-maker, project manager, or ECM practitioner who wants to share thoughts on how to make ECM implementations successful, we want you to be front-and-center because no matter which edition or solution you are using–Enterprise Edition, Community Edition, Cloud, or Workdesk–you have tips, tricks, best practices, and solutions that the rest of us want to know about.

The call-for-presenters closes June 15. If you need some help thinking about what to present, check this out. Don’t feel like you have to stick to that, of course, but it might improve your chances.

I look forward to seeing what you submit and to catching up with you in-person this November!

15:00 to 15:15 Welcome (Jeff Potts, Alfresco)
15:15 to 15:45 Introducing the Alfresco API (Jeff Potts)
15:45 to 16:15 Group Discussion: How Are You Using Alfresco? (All)
16:15 to 16:45 SmartWCM (Florian Maul, fme)
16:45 to 17:00 BREAK
17:00 to 17:30 Enhanced Script Import Tooling (Axel Faust, Prodyna)
17:30 to 18:00 Alfresco Workdesk (Bernhard Werner, Alfresco)
18:00 to 18:15 Invitation to Join the Community (Jeff Potts)
18:15 to 19:00 Bratwurst, Beer, & Networking

If you would like to present a 30-minute customer case study on how your organization implemented Alfresco, please let me know.

Earlier in the day I’ll be giving a talk at Codemotion Berlin on CMIS and Apache Chemistry in Action. So, if you are at Codemotion and you want to learn how to use an industry standard API to manage content in ECM repositories like SharePoint, FileNet, and Alfresco, come to my talk.

I hope to see you there!

13:00 to 13:15 Welcome (Jeff Potts, Alfresco)
13:15 to 13:45 Introducing the Alfresco API (Jeff Potts)
13:45 to 14:15 Customer Case Study (TBD)
14:15 to 14:45 Alfresco Administration Best Practices (Redpill-Linpro)
14:45 to 15:00 BREAK
15:00 to 15:30 Media Viewers Add-On (Peter Lofgren, Loftux)
15:30 to 16:00 Alfresco Workdesk (Barbara Lemke, Alfresco)
16:00 to 16:45 Lightning Talks
16:45 to 17:00 Invitation to Join the Community (Jeff Potts)

If you want to do a lightning talk (probably 5 minutes, max) or are interested in presenting a case study on how you implemented Alfresco in your organization, please let me know.

I hope to see you there!

First, some background on software vendor partnerships

Every software vendor or project has a community regardless of their business model or their license or whether or not they choose to invest in that community. And most software vendors have partners. These are firms who install, configure, customize, and extend the vendor’s software. The partnership formalizes the business relationship between the partner and the vendor.

To understand whether or not it is realistic to expect partners to participate in a community, it helps to understand the makeup of the partner ecosystem. I’d be shunning my consulting heritage if I didn’t use a two-by-two matrix to illustrate this:

The first axis in the matrix is the size of the partner. You might measure size by revenue, the number of billable consultants, or the number of vendors the firm partners with. It doesn’t really matter for this discussion. The second axis describes the nature of the partnership–is the partnership strategic or tactical for that partner?

A strategic partnership is just that–it is strategic to the partner’s business. A strategic partner actively works to improve their relationship with the vendor. They jointly close deals. They get their consultants trained up or certified on the technology. They might spend marketing dollars on events or campaigns that help promote their work with the software. If the software vendor goes away, or the partnership deteriorates, it adversely impacts a significant chunk of the partner’s revenue.

A tactical partnership is not strategic at all, it’s transactional, often opportunistic. A common way for these partnerships to happen is when a firm sees a potential project on Technology XYZ. Maybe they’ve done something with XYZ and maybe they haven’t, but they need to tick a box, so they do the bare minimum necessary to say they are a partner and then try to win the project. A partnership that starts out as tactical could grow into a strategic relationship over time. Or the firm may move on after one project, never getting any real traction with that vendor.

Every partner ecosystem has partners in these four quadrants. (Notice I do not make any mention of partner tiers. Software vendors often use tiers (Diamond, Platinum, Double-Dutch Chocolate) to help differentiate partners. It’s one way of helping customers figure out where a partner might be on the matrix. But I think the matrix does a better job for this discussion.)

What should a vendor’s community expect from each partner type?

I think it is safe to expect nothing from the partners in the tactical categories, regardless of their size. For this group, the community serves a purpose, but it is almost entirely one-way. These partners will read blog posts, tutorials, sample code, and wiki pages. They might even ask a few questions in the forums as they get up to speed on the platform, but it is unrealistic to expect much more.

Where I think the opportunity lies is in the strategic partners, but what the community offers the partner and what the partner is willing to invest is much different between small and large strategic partners.

Small, Strategic Partners

Let’s look at small, strategic partners first. The number one concern of a small partner is utilization and cash flow. A small, strategic partner needs lots of “at bats” and a reputation for getting on base and scoring runs. Small partners need visibility and credibility. Spending time in the community can help with that. The challenge for a small partner is that resources are super constrained. Often, the same individual is doing billable work and closing the next deal. It leaves little time to give to the community.

For partners in this group I think it is fair to expect contributions to the community that can be done it smaller chunks of off-peak time. Blogging, wiki cleanup, hosting or organizing meetups, and participating in the forums in a fairly ad hoc manner are some things that will help the community tremendously and in turn helps the partner with name recognition and credibility.

Large, Strategic Partners

Of course large partners still care about utilization and cash flow. But there are a few things about large firms that allow them to invest more in their vendor communities: they have a deeper bench (more consultants), they have access to more capital, and often, they have more negotiating power with their clients.

Let’s look at this bench advantage. When a firm has many consultants they can smooth out the inevitable ups-and-downs of utlization (assuming they also have lots of projects).  It also means that compared to smaller firms, they have more bench time to invest in the community. Let’s say there are 2000 potentially billable hours in a year. If you’ve got 30 consultants, there are 60,000 hours you could bill. Assuming a generous utilization rate of 90%, that leaves 6,000 hours of down time, spread across all of the consultants, throughout the year.

It’s not fair to expect all of those hours to go to the community. Consultants need bench time to train, work on internal projects, and help sell new business. But I do think a significant chunk of that time can be invested in the community. Imagine what a huge difference it would make if just 20% of the down time mentioned above was invested in the community. Now multiply that times the number of large, strategic partners in a vendor’s ecosystem and it is huge.

What is the incentive for a large, strategic partner to invest that time in the community? They will benefit from name recognition and credibility benefits that a smaller partner seeks, but larger firms have marketing dollars so that may be less important to them.

I mentioned that larger partners often have more negotiating power with their clients. This can allow them to turn some of their client work into open source projects (like add-ons or extensions) or even into full business solutions. These will have their own communities. Investing in the vendor’s community can help bootstrap these solutions and the communities around those.

There is a bigger picture reason large, strategic partners should invest in the community. It is the “rising tide raises all boats” argument. When the software vendor succeeds, the strategic partners succeed. So anything the partner can do to make the vendor successful will return dividends. I saw this at Optaros, Alfresco’s first platinum partner. Optaros gave me time to blog and to write tutorials and even a book. These helped thousands of people get ramped up on the platform, including customers and competing partners. We were helping the tide rise. Optaros didn’t stay in the Alfresco business long enough to see the full return on those investments, but I know from the success of similarly-sized partners around at that time that they were there to be had.

Free Riders

Clearly, there are partners, small and large, who believe it is important to participate in the community. There are those, however, who will reap the benefits of a healthy community without participating at all. They lock up their best practices, tips & tricks, code snippets, and know-how behind walled gardens, or, worse, they simply don’t share them at all. There is not much a community can do about this other than to try to educate these firms on the benefits of participating and encourage customers to buy services from those who are willing to demonstrate and share their expertise in public, for the benefit of the entire community.

Summary

A strategic partnership is just that–it is strategic to both the partner and the vendor. The community is a huge part of the success of the software vendor (open source or proprietary), so strategic partners ought to invest and participate in the community. Their ability to do that and the types of investments they make differ, primarily due to resource constraints. It is unreasonable to expect more than what the partner can give, but for a strategic partnership to be truly successful, they must be a visible and frequent presence in the community.

Each year we try to do something new to make the event better. Last year we added things like the DevCon web site, Lightning Talks, the Hack-a-Thon, and recordings of each session. These were all hugely popular, but they were all relatively minor in the grand scheme of things. This year, we’re going to shake things up a bit and I wanted to share our plans with you first.

There’s something that’s been bothering us about DevCon: The event isn’t inclusive of our entire community. We want an annual conference to be the go-to event for everyone in the ecosystem, not just developers. Shouldn’t it be possible to have one event with content that is laser focused on each audience?

We think so.

So this year, we are expanding DevCon into what we hope will be a must-attend event for anyone working on an Alfresco project, regardless of their job title. The first change you’ll notice is the name. We’re going to call it Alfresco Summit.

New name, same great technical content, and then some

So the name changes. What else? First, content. Alfresco Summit will include the same great DevCon tracks that you are used to plus a whole new set of non-technical content aimed at the business end of Enterprise Content Management. What might you find in such a business track? Things like non-technical customer case studies, panel discussions with industry analysts, best practices around compliance, going paperless, or case management. Basically, talks that help you be successful in your implementation that focus on everything but code and configuration.

The next change you’ll notice is that we’re adding a half-day to the event. We’ll still have the optional training day, but we want to have some room in the agenda for some high profile speakers, product demos, and other types of general sessions. In addition, the extra time gives us more opportunity to have repeats of popular sessions to help alleviate inevitable schedule conflicts.

Finally, you may notice a bit more production value or “sizzle” to the event. It’s hard to quantify what that really means. Really this is about putting on an event that appears to you, the attendee, as if it were that of a company 100 times our size in terms of organization, branding, quality, and execution.

Help me spread the DevCon magic to our non-technical brothers and sisters

I continue to chair the event. If you’ve enjoyed DevCon the last two years, this should be good news to you. (If you haven’t enjoyed it, make sure I’ve heard your feedback so I can try to make it better). I will also own the DevCon tracks so we’ll have the same high bar for technical content we’ve had in the past. I will work to keep the things that you love about DevCon (the content, the access to engineers, the fun) in place as we expand to an event the entire community can enjoy.

The general format of the conference stays the same:

• Day 0: An optional day for training, hack-a-thon, and partner meetings.
• Day 1: The first day of the main conference starts out with some general sessions and then moves to breakouts with a fun party that night.
• Day 2: Another full day, again starting with some general sessions and product demos before moving to breakouts. Another party that night (this is new).
• Day 3: New for 2013, this is a half-day of breakouts with a closing panel of Engineering leads and senior management.

Of course, we’ll have the exhibition hall, engineering office hours, lightning talks, purposeful lunches, etc.

Where and When?

The save-the-date will be coming soon. The timing will be similar to last year (November) for both EMEA and Americas. EMEA should be thinking southern Europe and we’ll be on the East Coast of the US for the Americas.

Here’s what I need from you:

• In last year’s DevCon survey, we asked if there were people who would attend if we had a business track. Roughly half of you said yes. I need you to show up this year with those people at your side.
• Consider speaking. Especially if you are a current customer. Business or technical track, it doesn’t matter. The key is that the community wants to hear what you’re doing with Alfresco. This is the best place to share your story. The call for papers will be open by the end of April. Watch this blog, twitter, etc. for more info on that.
• Tell me what kind of content you’d like to see at Alfresco Summit. A good way to do that is to propose session titles. You can do that here in the comments for now. If enough people have enough feedback we can look at doing something fancier.
• If you haven’t attended in the past, make this the year you find a way to get to the conference. This is the quintessential gathering of the Alfresco community. You won’t want to miss it.

You can trust me to not screw up a good thing, but I need your help to make it awesome. If you have thoughts or comments as we continue to evolve our annual conference, share those here or by emailing me directly at jeff dot potts at alfresco dot com.

To read more about clickjacking please visit OWASP’s page on the subject:
https://www.owasp.org/index.php/Clickjacking

Now let’s take a look at the default config for Alfresco Enterprise 4.1.4 (and on Community on HEAD), as you can see 3 headers are added by default:

<config evaluator="string-compare" condition="SecurityHeadersPolicy">
  <headers>
    <header>
      <name>X-Frame-Options</name>
      <value>SAMEORIGIN</value>
    </header>
    <header>
      <name>X-Content-Type-Options</name>
      <value>nosniff</value>
    </header>
    <header>
      <name>X-XSS-Protection</name>
      <value>1; mode=block</value>
    </header>
  </headers>
</config>

Lets take a look at what implications these headers will have on browsers…

X-Frame-Options

Adding this header to an http response will tell the browser if Share pages are allowed to be put inside iframes or not. In our default config we have set this to SAMEORIGIN which means that Share pages are only allowed to be “(i)framed” inside Share or other webapps that happen to live under the same domain. In other words it will i.e. be possible to include http://www.acme.com/share inside an iframe on http://www.acme.com/portal.

If you do not want this to be allowed you can override the config and set the header to return DENY instead, you can do that by placing the following config in your share-config-custom.xml file:

<config evaluator="string-compare" condition="SecurityHeadersPolicy">
  <headers>
    <header>
      <name>X-Frame-Options</name>
      <value>DENY</value>
    </header>
  </headers>
</config>

If you instead want to open up the possibility to include Share inside iframes on any domain you can do this by using the following config instead. Note! This is not recommended since it will open up the possibility of Alfresco Share being a target of a clickjacking attack.

<config evaluator="string-compare" condition="SecurityHeadersPolicy">
  <headers>
    <header>
      <name>X-Frame-Options</name>
      <enabled>false</enabled>
    </header>
  </headers>
</config>

Note! Since we are on the subject of iframes, feel free to read this blog post about improved mitigation of phishing attacks in Alfresco Share by the introduction of the new IFramePolicy. It will decide which urls that Alfresco Share will allow to be put inside an iframe in the Alfresco Share client.

X-Content-Type-Options

This is only valid for Internet Explorer. Older version of Internet Explorer (8 and below) will *help* developers by sniffing the content of a returned resource and then execute the content as the content type that IE thinks the resource has, instead of the content type the server returned. To stop IE from doing this we are returning nosniff in the header.

X-XSS-Protection

Yep IE trying to *help* again. Instead of trusting the developer to do a good job of mitigating XSS attacks IE just can’t keep its fingers away from your code. If it finds some code that looks suspicious (XSS code) it will manipulate (a.k.a. “sanitize” it) to become safe and then execute the sanitized code. So what’s bad about that? Well IE’s “sanitization” logic can be used by an attacker to actually introduce an XSS flaw on your site. As a “solution” to this IE introduced the X-XSS-Protection header.

By default Alfresco Share will return “1; mode=block” for this header, which means that if IE *thinks* it has found an XSS attack it will not execute the code (instead of sanitizing it and running it which is the default).

It is also possible to set it to “0” which means that IE shall not even try and inspect the code for XSS attacks.

Adding additional headers

Adding additional headers to the config is also supported. Lets take the Strict-Transport-Security header as an example, it is used to force your browser to only allow https and not http communication. It is not provided by default in Alfresco Share but can be added by placing the following code inside your share-config-custom.xml file:

<config evaluator="string-compare" condition="SecurityHeadersPolicy">
  <headers>
    <header>
      <name>Strict-Transport-Security</name>
      <value>max-age=31536000</value>
    </header>
  </headers>
</config>

I hope you have enjoyed this blog post, if you have any questions please add a comment below!

The reason we added this config is to improve mitigation of phishing attacks. To read more about phishing attacks please visit OWASP’s page on the subject.
https://www.owasp.org/index.php/Phishing

So how does this concern you? Well if you are a developer and you have code that creates iframe’s you should honour the config before creating the iframe. If you are a system administrator you are probably interested in overriding the default config because it allows *any* pages to be iframed.

Let’s start by taking a look at the default configuration defined in share-security-config.xml.

<config evaluator="string-compare" condition="IFramePolicy">
  <!-- 
    Local Share pages/resources are governed by the same-domain element which 
    can be set to "allow" or "deny" 
  -->
  <same-domain>allow</same-domain> 
  <!--
    Add a list of <url> elements inside this element to form a whitelist of 
    allowed domains. The check will assert that the url used for the <iframe> 
    starts with the value of one of the <url> elements.
  -->
  <cross-domain>
    <!--
      Allow all domains by default, it is recommended to override this 
      setting and instead keep a whitelist of the domains that you trust to be 
      included on Share pages.
    -->
    <url>*</url>
  </cross-domain>
</config> 

Honouring the IFramePolicy in your code

Every developer creating custom code for Alfresco Share should honour the IFramePolicy config. It is very simple and all you need to do is to add the following code snipped to your code:

if (Alfresco.util.IFramePolicy && 
    !Alfresco.util.IFramePolicy.isUrlAllowed(iFrameSrcUrl))
{
   // TODO: Display error message saying the IFramePolicy doesn't allow this url
}
else
{
  // TODO: Display the iframe just like you did before
}

First we check if the IFramePolicy is there, we do this to make sure our code will continue to work in older Alfresco Share versions that don’t have an IFramePolicy. Then we check if the url that we are about to display is trusted by the IFramePolicy config. If it isn’t we display a friendly error message telling the user how to proceed.

Creating a whitelist of trusted domains

As an administrator you probably want to override the default configuration to keep your Alfresco Share installation as safe as possible. This is very simple to do, simply:

Copy the following code and add it to your share-config-custom.xml file:

<config evaluator="string-compare" condition="IFramePolicy" replace="true">
  <cross-domain>
    <url>http://www.trusted-domain-1.com/</url>
    <url>http://www.trusted-domain-2.com/</url>
  </cross-domain>
</config>

As you can see we have overriden/replaced the IFramePolicy‘s <cross-domain> element to not include the default <url>*</url> but instead multiple <url> element each specifying the urls to trust.

The url check will be done using a “startswith” comparison (not a regexp) meaning you can, if you like, only allow certain pages on a domain to be trusted, i.e. you could add a <url> element like below:

<url>http://www.partly-trusted-domain.com/but/only/urls/from/here</url>

Note! Avoid adding a url with only the protocol and domain that doesn’t end with a front slash (“/”), since http://www.my-proxy-server.com.evil-server.se/phishing-attack.html obviously starts with http://www.my-proxy-server.com but not http://www.my-proxy-server.com/ .

That’s it, I hope you enjoyed the blog post, if you have any questions please add a comment.

This blog post will be about how the new filter affects your current Alfresco Share installation or your custom Share extension module. In most cases the new filter will actually not affect your installation or custom code at all, however there might be a few edge cases where you need to change your code slightly. The post will also describe how you can configure the CSRF filter to work behind one or more proxies, how to run it with 3rd party plugins behaving badly, how it can be used to stop specific repository services from being accessible directly from the browser through Share’s proxy and also how to turn off the filter.

To learn more about CSRF feel free to read OWASP’s introduction article about CSRF: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)

Note! This post misspells the word “referer” during the entire post to honour the spec that introduced the Referer header with the incorrect spelling :-)

How does the filter work?

The filter is implemented in a class named org.alfresco.web.site.servlet.CSRFFilter that reads a config section in share-security-config.xml named CSRFPolicy which will describe how and when the filter shall mitigate CSRF, summarized as:

• Each logged in user will receive a secret CSRF token.
• The token will be communicated to the browser using a cookie named Alfresco-CSRF-Token.
• When a logged in user performs a POST, PUT or DELETE http request against Alfresco Share the token MUST be passed in the request using one of the following methods:
  • As a custom http request header named Alfresco-CSRF-Token
  • As a url parameter named Alfresco-CSRF-Token.
    Note! Most often the header will be required, but in certain circumstances a header cannot be used and only then the token may be passed using a url parameter. The default config only accepts the url parameter when the Content-Type header starts with multipart/.
• Every time the logged in user goes to a new Share page the token will be renewed.
• The filter will also check the Referer and Original http request headers matches the current domain (if present in the request).

To dig into the config, take a look at the latests revision http://svn.alfresco.com/repos/alfresco-open-mirror/alfresco/HEAD/root/projects/slingshot/config/alfresco/share-security-config.xml. A detailed description of all available options can be found at the bottom of this post.

Do you need to tweak your code?

If your custom code only is reading data using GET requests you will not have to do anything.

If your custom code only is using the standard Alfresco.util.Ajax, alfresco/core/CoreXhr or Alfresco.forms.Form javascript classes when creating/updating/deleting data you will also not have to do anything. Everything will be handled for you by:

• Alfresco.util.Ajax & alfresco/core/CoreXhr – will automatically take the token from the cookie and add it as a request header for every request.
• Alfresco.forms.Form – will automatically take the token from the cookie and add it as a url parameter to when submitting an multipart/form-data request.
  (When submitting a form as JSON the Alfresco.util.Ajax will be used internally)

Note! In the unlikely event that you do need to change your code make sure to:

• Always read the token from the cookie just before the request is sent.
  Reason being that if you have multiple tabs opened in your browser one tab could, if accessing a new page, refresh the token in the session. If another tab then had saved its token in a variable it would suddenly be stale. But if all tabs always read the cookie just before submission they will always get the latest token even if the user changed pages in another tab. To read the token from the cookie simply use Alfresco.util.CSRFPolicy.getToken().
• Always check if the Alfresco.util.CSRFPolicy object exists before using it
  That way your code will work in all versions of Alfresco Share.

Now let’s take a look however at the scenarios when you might need to tweak your code or change the default configuration.

1. You are making an XMLHttpRequest with method POST, PUT or DELETE without using the Alfresco.util.Ajax or alfresco/core/CoreXhr classes

Perhaps you are using the native XmlHttpRequest object or a 3rd party library such as jQuery. If that is the case you will need to add code looking something like this to pass the token:

if (Alfresco.util.CSRFPolicy && Alfresco.util.CSRFPolicy.isFilterEnabled())
{
   xhrHeadersObject[Alfresco.util.CSRFPolicy.getHeader()] = Alfresco.util.CSRFPolicy.getToken();
} 

Or if your using YAHOO.util.DataSource to load data with POST requests your code shall look like this:

if (Alfresco.util.CSRFPolicy && Alfresco.util.CSRFPolicy.isFilterEnabled())
{
   yuiDataSource.connMgr.initHeader(Alfresco.util.CSRFPolicy.getHeader(), Alfresco.util.CSRFPolicy.getToken(), false);
}

2. You are making a form upload with enctype multipart/form-data without using Alfresco.forms.Form

When uploading a file by submitting a form with enctype multipart/form-data it is not possible to set a header on the request, the reason is not because of the enctype specifically but due to the fact that its not possible to set a header on any form submission in the browser. Therefor you need to pass the token as a url parameter instead. If you are using the Alfresco.forms.Form class  this will be handled for you automatically but otherwise you have to add the token as a url parameter using code looking something like this:

if (Alfresco.util.CSRFPolicy && Alfresco.util.CSRFPolicy.isFilterEnabled())
{
   url += "?" + Alfresco.util.CSRFPolicy.getParameter() + "=" + encodeURIComponent(Alfresco.util.CSRFPolicy.getToken());
}

3. You are using a flash movie inside Share to send http requests with method POST

If you are using a flash movie to upload files (it uses the flash.net.FileReference ActionScript class which will perform a multipart/form-data request) make sure to add the token as a url parameter in your Javascript before passing in the url to the flash movie. If your Flash movie is performing application/json or other text based POST requests (it uses the flash.net.URLRequest and/or flash.net.navigateToURL ActionScript classes and methods) then make sure to pass in the token and the name of the header so it can be set from the flash movie.

Note! Flash cannot use ActionScript to directly get hold of the token since it may not read the browser cookies or read http response headers. It is possible however to use the flash.external.ExternalInterface ActionScript class to call a custom javascript method you have included on the page.

4. You are writing a non-browser client, i.e. a mobile app

Such app should be targeted against the repo in which there is no CSRF filter, meaning you don’t have to do anything.

That’s it! If your don’t have code matching any of the described patterns you should not have to modify your code in any way. Please continue reading to be aware of other scenarios when you might be required to alter the default configuration.

Another system is sending POST requests to your Alfresco Share server

If there is a scenario in your system environment where servers from other domains actually shall be allowed to POST requests you will need to reconfigure the CSRFPolicy config in your share-config-custom.xml file to not check for a token or a Referer or Origin header. To do so simply:

1. Copy the entire CSRFPolicy config in share-security-config.xml 
2. Paste it into your share-config-custom.xml file and make sure it is replacing the old config section:
   <config evaluator="string-compare" condition="CSRFPolicy" replace=true">
3. Place the following snippet as the first child to the <filter> element:

<rule>
   <request>
      <method>POST</method>
      <path>/page/trusted/call/1|/page/trusted/call/2</path>
   </request>
   <action name="assertReferer">
      <param name="always">false</param>
      <param name="referer">https://www.trustedserver.com/.*</param>
   </action>
   <action name="assertOrigin">
      <param name="always">false</param>
      <param name="origin">https://www.trustedserver.com</param>
   </action>
</rule>

The CSRF filter will compare the incoming request with all the rules’ request elements to find one that match, when it does it will invoke all the defined actions for that rule and then let the normal Share processing begin. In this case it means that if the external page was POST:ing to /page/trusted/call/1 or /page/trusted/call/2 this (and no other) rule will be used and its actions will run. The first action will assert that full page url in the Referer header (if present) equals https://www.trustedserver.com/.* and that the protocol and domain in the Origin header (if present) equals https://www.trustedserver.com .

I am running Alfresco Share behind one or more proxy server(s) and I get errors…

If you have placed Alfresco Share behind one or more proxy servers that rewrites all the urls before Alfresco Share is reached you might see errors in your log about the Referer or Origin headers not matching the current server. If that is the case see if its possible to also rewrite the Origin and Referer headers if they a) are present and b) match your proxy servers domain.
Note! When doing so make sure to not use a start-with-like-comparison without ending the proxy server’s domain with a front slash (“/”), since http://www.my-proxy-server.com.evil-server.se/csrf.html obviously starts with http://www.my-proxy-server.com but not http://www.my-proxy-server.com/ .

If that is not possible you will have reconfigure the filter to accept requests from specific domains by simply:

1. Copy the entire CSRFPolicy config in share-security-config.xml
2. Paste it into your share-config-custom.xml file and make sure it is replacing the old config section:<config evaluator="string-compare" condition="CSRFPolicy" replace=true">
3. Modify every referer action to accept additional urls by changing:

   <action name="assertReferer">
      <param name="always">false</param>
   </action>

   …to…

   <action name="assertReferer">
      <param name="always">false</param>
      <param name="referer">https://www.proxyserver1.com/.*|https://www.proxyserver2.com/.*</param>
   </action>

4. Modify every origin action to accept additional urls by changing:

   <action name="assertOrigin">
      <param name="always">false</param>
   </action>

   …to…

   <action name="assertOrigin">
      <param name="always">false</param>
      <param name="origin">https://www.proxyserver1.com|https://www.proxyserver2.com</param>
   </action>

The Referer will contain the entire url from which the request was submitted but the Origin will only include the protocol and domain (hence the .* wildcard at the end of the referer parameter).

In case you wondered, the current domain will continue to be accepted, meaning that you can login and use Share using its own “internal” domain.

I just want to disable the filter!

There is no real reason why you should need to turn off the filter if it is configured correctly and you are running a standard Share installation. However if you have installed a 3rd party plugin that is not using the Alfresco provided classes for sending XMLHttpRequests or submitting forms you should contact the plugin developer and ask him to read this blog post so he/she can update the plugin. You will then have to make a decision to either uninstall your plugin OR lower the security level in the filter and not check for tokens anymore (at least until a new version of the plugin has been released). To stop checking for tokens, but continuing to check the Origin and Referer headers when available for logged in users, just add the following code snippet in your share-config-custom.xml file:

<config evaluator="string-compare" condition="CSRFPolicy" replace="true">
   <filter>
      <rule>
         <request>
            <method>POST|PUT|DELETE</method>
            <session>
               <attribute name="_alf_USER_ID">.*</attribute>
            </session>
         </request>
         <action name="assertReferer">
            <param name="always">false</param>
         </action>
         <action name="assertOrigin">
            <param name="always">false</param>
         </action>
      </rule>
   </filter>
</config>

If you have custom code that fails for the reason mentioned in the previous section make sure to fix them instead of disabling the filter. It shouldn’t take long.

If you still, for what ever reason, want to disable the filter just add the following code snippet in your share-config-custom.xml file:

<config evaluator="string-compare" condition="CSRFPolicy" replace="true">
   <filter/>
</config>

I have a repository webscript or service that I don’t want to be accessible through Share’s proxy…

This is a bonus feature of having a configurable CSRF filter, that it can be used to completely block certain services in the repository. Perhaps you have an API that only shall be accessible from a) other clients than Share OR b) from server side Java or Javascript code running on the Share server (rather than in the browser as a Java Applet or client side Javascript).

If that is the case you can add the urls to those services to the CSRF filter  and make sure it throws an error when they are accessed. To do this simply:

1. Copy the entire CSRFPolicy config in share-security-config.xml
2. Paste it into your share-config-custom.xml file and make sure it is replacing the old config section:
   <config evaluator="string-compare" condition="CSRFPolicy" replace=true">
3. Add the following code snippet as the first child to the <filter> element:

   <rule>
      <request>
         <path>/proxy/alfresco/acme/special/services/.*</path>
      </request>
      <action name="throwError">
         <param name="message">It is not allowed to access this url from your browser</param>
      </action>
   </rule>

A detailed description of the CSRFPolicy configuration

The next code snippet is will give you a detailed description of all available options in the CSRFPolicy configuration. It is probably only worth reading in case you’re really interested or have run into trouble.

Cheers and thanks for reading this far!

<config evaluator="string-compare" condition="CSRFPolicy">

  <!--
    (Mandatory) Only 1 client element is allowed. 
    Describes what names are used to communicate the token back and forth 
    between the server and the client.
  -->
  <client>

    <!--
      (Mandatory) A client element must have exactly 1 cookie element.
      Name of the cookie that will hold the token, used by the client side to 
      grab the value.
    -->
    <cookie>

    <!--
      (Mandatory) A client element must have exactly 1 header element.
      Name of the custom Http header to place the token in when sending a request
    -->
    <header/>

    <!--
      (Mandatory) A client element must have exactly 1 parameter element.
      Name of the parameter to place the token in when sending a request
    -->
    <parameter/>
  </client>

  <!--
    (Mandatory) Only 1 filter element is allowed.
    The filter will look for 1 rule with a matching request and execute its 
    actions (if any). An empty filter element means the CSRF filter is disabled, 
    in other words will allow all requests to pass.
  -->
  <filter>

    <!--
      (Optional) Zero or more rule elements are allowed.
      A rule contains a description of a request and a set of actions to execute.
    -->
    <rule>

      <!-- (Mandatory) A rule element must have exactly 1 request element -->
      <request>

        <!--
          (Optional) A request element may have exactly 1 method element.
          Holds a regular expression that will be matched against the request's 
          method.
        -->
        <method/>

        <!--
          (Optional) A request element may have exactly 1 path element.
          Holds a regular expression that will be matched against the request's 
          "share path", i.e. /page/start-workflow or /proxy/alfresco/api/people
        -->
        <path/>

        <!--
          (Optional) A request element may have any number of header elements.
          Holds a regular expression that will be matched by the header specified 
          by the name attribute.
        -->
        <header name=""/>

        <!-- (Optional) A request element may have exactly 1 session element -->
        <session>
          <!--
            (Optional) A session may have multipe attribute elements.
            Holds a regular expression that will be matched by the session 
            attribute specified by the name attribute. A closed attribute element 
            indicates that the session attribute does not exist. 
            I.e. <attribute name="Alfresco-CSRFToken"/> means that the token has 
            not yet been created.
          -->
          <attribute name=""/>
        </session>

      </request>

      <!--
        (Optional) A rule element may have multiple action elements.
        Below is a list of all available actions:
      -->

      <!-- Generate the token -->
      <action name="generateToken">
        <!--
          (Mandatory) An "generateToken" action may have exactly 1 "session" 
          param.
          Holds the name of the session attribute in which to place the token, 
          shall match the client element's session element above.
        -->
        <param name="session"/>

        <!--
          (Mandatory) A "generateToken" action may have exactly 1 "cookie" param.
          Holds the name of the cookie in which to place the token, shall match 
          the client element's cookie element above.
        -->
        <param name="cookie"/>
      </action>

      <!-- Clear the token value -->
      <action name="clearToken">
        <!--
          (Mandatory) A "clearToken" action may have exactly 1 "session" param.
          Holds the name of the session attribute which value shall be cleared,
          shall match the client element's session element above.
        -->
        <param name="session"/>

        <!--
          (Mandatory) A "clearToken" action may have exactly 1 "session" param.
          Holds the name of the cookie which value shall be cleared, shall match
          the client element's cookie element above.
        -->
        <param name="cookie"/>
      </action>

      <!-- 
        Assert the request's Referer header matches the current domain. 
        If not an error will be thrown. 
      -->
      <action name="assertReferer">
        <!--
          (Mandatory) An "assertReferer" action may have exactly 1 "always" param.
          Decides when to compare the incoming requests Referer header to the 
          current domain, if set to:
          - true: Always compare, even when no Referer header was provided in the 
                  request.
          - false: Only compare if a Referer header was provided in the request
        -->
        <param name="always"/>

        <!--
          (Optional) An "assertReferer" action may have 0 or 1 "referer" param.
          Holds a regular expression that will be matched against the incoming 
          Referer header if the incoming Referer header does not match Share's domain.
        -->
        <param name="referer"/>
      </action>

      <!-- 
        Assert the requets's Origin header matches the current domain. 
        If not an error will be thrown. 
      -->
      <action name="assertOrigin"> 
        <!--
          (Mandatory) An "assertOrigin" action may have exactly 1 "always" param.
          Decides when to compare the incoming requests Origin header to the 
          current domain, if set to:
          - true: Always compare, even when no Origin header was provided in the 
                 request.
          - false: only compare if a Origin header was provided in the request
        -->
        <param name="always"/>

        <!--
          (Optional) An "assertOrigin" action may have 0 or 1 "origin" param.
          Holds a regular expression that will be matched against the incoming 
          Origin header if the incoming Origin header does not match Share's 
          domain.
        -->
        <param name="origin"/>
      </action>

      <!-- Will throw an error -->
      <action name="throwError">

        <!--
          (Optional) A "throwError" action may have exactly 1 "message" param.
          Holds the error message that will be used when throwing the error.
        -->
        <param name="message"/>
      </action>
    </rule>

  </filter>

</config>

If you’re not familiar with the underlying pdf.js project then you should know that it provides a means of direct rendering of PDF content items using HTML5 and JavaScript in the web browser, with no requirement from additional client-side plugins such as Flash.

Combined with the ability of the Alfresco repository to transform just about any standard document into PDF format, we think this provides a compelling reason to try the Media Viewer add-on if you have not done so before.

An initial version of the PdfJs viewer shipped in the Media Viewers 2.0 release for Alfresco 4, and version 2.5 which we’re releasing today builds on that with support for Alfresco 4.2 while also maintaining backwards compatible with the 4.0 and 4.1 Alfresco product lines.

There’s so much in this release that it felt like much more than a v2.1 release and 2.5 seemed much more appropriate. You can read on for more details of these exciting new capabilities, or go straight to the download, installation and configuration instructions to try it out today.

Easy Configuration

The first thing you’ll notice when enabling the add-on using Share’s Module Deployment console is that additional modules have been added, which provide the configuration needed to bind the viewer into the document details page.

Unless you want a specific custom configuration, you can just enable the new PdfJs Configuration module (in addition to the existing PdfJs Viewer module), click Apply Changes and you should see PDF documents will now use the new viewer. You no longer need to edit your web-preview.get.config.xml file although if you’ve made changes there they will continue to be respected.

Persistent View Settings

Can’t see the text clearly? You can use the zoom controls in the viewer to zoom in, our out if you want to see more. Or pick a preset from the drop-down and the zoom will be auto-calculated.

The next time you come back to the document, these settings – plus the page number you were on – will be remembered.

Powerful Search

Use the Search button in the toolbar or Ctrl+F (Cmd+F on MacOS) to search through the document contents for a particular item of text. You can easily step through the matches one by one, or highlight all matches found.

When you’ve found what you’re after, you can copy the relevant text to the clipboard in order to include it somewhere else, for example in an e-mail.

The feature I like the most will make you wonder how you lived without it before, if you’ve ever searched for a document in Alfresco and then struggled to find the reference to that term in the document itself.

Now, the viewer detects that you have clicked through from the search page, and automatically searches for and highlights the first match of that term. Just hit Enter to continue through any further matches, or Escape to close the search dialog.

Link to Document

The Link button in the toolbar generates a link to the document, or even to a specific page in the document, that you can send to co-workers. If you want them to review Slide 24 in your presentation then simply send them straight there.

Improved Sidebar

You can click the button on the left of the toolbar to toggle the side bar on and off. The side bar shows a thumbnail view of all pages in the document by default and can also show an outline of the document structure if available in the file.

Presentation Mode

At DevCon last November Jared neatly showed how you can use the the new Google Docs integration to deliver a presentation directly from your web browser using Google Drive’s presentation mode, but with the PdfJs viewer you can now do the same thing directly from the Document Details page.

Just click Ctrl+Enter (or Cmd+Enter on MacOS) to go full-screen, then use the left and right arrow keys to move between your slides (the arrow keys will also work in the normal Document Details view).

Document Viewer Dashlet

Just like Site Admins can use the Wiki dashlet to add a selected page to a site dashboard, the Document View dashlet supplied with the add-on allows you to display any chosen document on the dashboard.

The dashlet works well with the PdfJs viewer, but will also work with the others supplied by the add-on or the base viewers supplied with Share (yes, that includes the Flash document viewer, if you really want).

Password-protected PDFs

Viewing password-protected PDFs is no longer a problem with the PdfJs viewer. You will be promoted for the password required to open the file and once supplied the viewer will work as normal.

Lots More

Of course there are many other improvements that you can’t see directly, but that you will benefit from. Peter has been working tirelessly to keep the version of the pdf.js library up-to-date, ensuring that we stay up to date with the improvements in performance and compatibility that the latest versions now provide. We have also improved the performance of page rendering within the dashlet code itself, with improved lazy rendering of all page and thumbnail content.

And of course PdfJs is not the only viewer in the add-on. The Flash-based audio and video players are still supplied, the Embed viewer offers a compelling Flash-free alternative for IE users not on IE 10 who have the Adobe Reader or another PDF plugin installed and the Prettify viewer is great at syntax highlighting any code stored in Alfresco.

Feedback

Like all Share Extras add-ons, we welcome constructive feedback to help us to deliver the next version of Media Viewers. Please use the Issues section on the project to report specific technical issues or ideas for enhancements, or general feedback can be left as comments below.

However ILT classes have some drawbacks. Since they are scheduled at a particular location, at a particular time, if this date and time does not match your availability you will have to wait until the next class, which may be weeks later. When you register for a class it is possible the class may be cancelled because of insufficient numbers. Somehow we need to address these drawbacks.

Project Espresso?

Our project, code named Espresso, will deliver a brand new and revolutionary way of taking training from Alfresco, that will address these issues and provide additional benefits to participants.

We pay close attention to industry trends and to our customers and both have caused us to re-think the challenge of delivering affordable, effective training.  This is why we’ve come up with a new way to deliver training to delegates. The changes happening in the way people learn, and are trained, are both profound and permanent. For the very first time, learners have the ability to take control of their own learning experience. This is being driven for the most part by the advent of new technologies, social platforms, search engines and near ubiquitous instant communications.

That’s why we’re embracing this new era of Personal Learning. Tertiary educators are adopting these changes quickly and even schools are getting in on the act through the flipped-classroom model.  This trend to Personal Learning is becoming widespread throughout the education field and is being led by two organizations in the United States edX and Coursera. They have invested many millions in spearheading this approach and are reporting impressive early success.

The future of training

In future we are looking for a different type of training delivery channel which more closely matches the Personal Learning approach and which will deliver benefits to Alfresco as well as our students. We’re stuck for a name at the moment, but this new approach will:

• be intensive self-paced, but flexible;
• have electronic content delivery;
• be group based;
• supported by an instructor;
• have a support forum per class;
• have no minimum delegate requirement (i.e. guaranteed to run);
• have a virtual machine environment provisioned.

If you would like to see a demo of our vision about how this would work? You can watch it now, but please bear in mind that this video demonstration is a future concept! We are working hard to bring this new way of training to you, and it’s not too late to let us know what you think by completing our survey, it will take 5 minutes of your time and as a thank you, we will enter you into our prize draw on 25 February, when one lucky respondent will win an Amazon Kindle Fire.

With the release of the Alfresco Public API back in October, the Alfresco Cloud is now a CMIS-compliant repository, and can hence be accessed using the CMIS Workbench.  The CMIS Workbench does not yet directly support the OAuth2 authentication mechanism used in the Alfresco Cloud however; this post describes the steps necessary to get it working.

For starters, you’ll need accounts on both the Alfresco Cloud and the Alfresco Developer Portal (signup to both of these services is free).  You’ll then need to download v0.8.0 or newer of the CMIS Workbench and unzip it somewhere convenient on your hard drive.  It also helps to have some understanding of the OAuth2 authentication mechanism, how the various OAuth2 codes and tokens are obtained and used, and how OAuth2 has been implemented in the Alfresco Cloud – if you’re not familiar with these concepts you may find this DevCon 2012 session helpful.

Next you need to obtain an OAuth2 access token from the Alfresco Cloud.  This is best achieved using a pre-built application, such as my Grails sample app (which conveniently dumps the access token to the log).

After that we’re ready to run the CMIS Workbench.  After the “Login” dialog appears, switch to the “Expert” tab and paste in the following text (note: on Mac OSX you need to use the Ctrl key rather than the Command key for select and paste operations):

# Alfresco Cloud (CMIS 1.0 AtomPub)
org.apache.chemistry.opencmis.binding.spi.type=atompub
org.apache.chemistry.opencmis.binding.atompub.url=https://api.alfresco.com/cmis/versions/1.0/atom
org.apache.chemistry.opencmis.binding.auth.http.basic=false

# Please provide a valid OAuth access token in the following property
# Note that Alfresco Cloud access tokens have a limited lifetime (currently 1 hour) and the OpenCMIS Workbench does not auto-refresh the access token when it expires
org.apache.chemistry.opencmis.binding.header.0=Authorization:Bearer ####ACCESS_TOKEN####

# Other optional options - compression etc. - may be provided here

Replace the text “####ACCESS_TOKEN####” with the access token you obtained previously, ensuring there is a single space character between “Bearer” and the access token value.  This should end up looking similar to the following (click to embiggen):

Click “Load Repositories” and if the settings are correct the Alfresco Networks you are a member of will be displayed in the repositories dropdown.  Pick one (don’t be surprised if you have only one – that’s the normal case), click the Login button and you should be viewing your Alfresco Cloud content using the CMIS Workbench!

On 30th November we updated the certification exams with changes to both the syllabus and content:

• All items have been updated for Alfresco version 4, and new ones introduced to cover new functionality in version 4 such as Solr indexing and Activiti Workflow.

• The number of questions in each exam has been reduced from 80 to 60, reflecting feedback from non-native English speakers who requested extra time to understand what each question was asking. Reducing the number of questions should also allow for additional review time at the end of the paper. This change will not compromise the exams’ integrity, since a 70% pass mark is still required, and the level of questions will remain the same.

• All items have been cross referenced with the documentation available at docs.alfresco.com and/or the training curriculum on the University site, to ensure they are covered. (There will still, however, be a small number (no more than 20%) of questions related to knowledge gained in the field.)
• The new exams come with new blueprints which you can download from our certification page.
• To improve the revision experience we’ve created online sample papers for both exams, and you can try the sample ACA and ACE papers now to test your readiness for the exams. These have 30 questions each (representing 50% of the exam), and provide a much better experience than the previous sample tests.

If you’re already certified, please rest assured that your certification is still valid, and will be until the next iteration of the exams, which will be issued after the next major release of Alfresco (version 5). We’ll notify you in plenty of time to encourage you to upgrade your certification prior to this release.

As certification gains more and more traction in the marketplace, you will see more positions advertised requiring Alfresco certified professionals. There has never been a better time to prepare for your Alfresco certification – make it your new year’s resolution.

LightTheme

The latest Share user interface theme to be added to Alfresco and a preview of the newer more modern look we are working towards in the Share UI. This theme is a step towards a lighter looking, more modern UI experience. It is not the final version as we intend to refactor the header bar and top-level menus to add some much needed contrast but it already makes Share look more modern and more pleasing to use in modern browser environments. This theme is now the default for new installations. It also shows just how far you can take a Share theme with just CSS!

Gallery View

Improved performance (large thumbnails are now JPEG format by default) and improved user experience, including a fix to the issue of “squashed” image aspect ratio for thumbnails.

Forms Validation Improvements

A feature that has been present on the Alfresco Cloud product for a while and now part of Community also – improved user feedback for form validation.

Wiki CSS Improvements

The CSS used to render wiki pages has been improved.

Google Docs Integration

The very latest Google Docs integration (2.0.1-13) is present in 4.2.c and has a number of important fixes.

Translations

We have full Chinese, Japanese, Russian, Dutch and Norwegian translations available in 4.2.c as well as the usual English, French, German, Spanish, Italian lang packs.

CSS Data Images

A SpringSurf web-framework feature now on by default. Improves the performance of pages that use a lot of small icon images by including them already encoded into a single style sheet file rather than lots of little image files.

Bugs!

Lots of bugs have been fixed, including the issues with Document Library filters that was present in 4.2.b. You should also find again the performance of 4.2 is so much better out the box than Community 4.0. See the full list of fixed bugs since the 4.2.b release.

In Summary

We hope you enjoy this Alfresco Community release, it’s the last one we will be putting into your stocking before xmas!

He also pointed out something that may be obvious to some of you, but it had not occurred to me! When you add a new plugin to Alfresco’s web preview component – as this add-on does – then that is also available on the Quick Share page.

If you’re not familiar with Quick Share it is a great new feature originally in Cloud and now in Community 4.2, providing public sharing of documents via a short URL, which can be easily used by clicking the Share action directly above the document preview.

The result is pretty powerful, since using an iFrame you can easily add those embedded documents to an intranet page or public web page – or just link to the items direct as Peter has done in his post. In fact Sergio Buitrago and I worked on this implementing this very thing as a WordPress plugin at the Berlin DevCon Hackathon last month!

Latest Changes in PdfJs Viewer

It’s worth mentioning that you can try out the features Peter mentions by grabbing the project’s latest source from trunk. In particular, here are two new features that are hot off the press in the PdfJs viewer:

• Perform a search in Share and click through to a PDF file or office document. You should see that the search function is automatically invoked for the term you searched for in the previous page, and highlights the first match.
• If you are using the latest available Firefox or Chrome browsers, you can enter full-screen mode by pressing Ctrl+F on the keyboard. Now you can deliver PowerPoint presentations directly from Share itself!

We are still in the process of finalising the 2.1 release of the Media Viewers add-on, so if you have feedback please file an issue on the Share Extras project site.

Thanks to everyone who participated in the hack-a-thon. It worked so well, I can definitely see us doing it again next year.

Thanks again to Blue Fish Group for their sponsorship of the session recordings.

We’ll get the Berlin recordings up soon, but be aware that we had many problems with the recordings in Berlin and only a small handful of the sessions were recorded at that event. Many of the sessions were repeated in San Jose, however, so there is a chance we have some version of your favorite Berlin talk available.

Last week kicked off with a full-day hackathon building on top of Alfresco, facilitated by Nathan McMinn, which I would recommend to anyone who has worked with Alfresco before and is interested in expanding  their horizons. This was about people coming together to work collectively on building something in a day, and the format worked fantastically well. I believe Nathan will be posting soon on what was produced in the session.

As always John and John kicked off the main sessions with the high-level view of Alfresco, seamlessly mixing open source content management with tales from the wider IT industry and a satirical take on current global politics. If you’re interested in any of those things, it’s a must see.

I didn’t get to see as many technical sessions as I have done in previous years, but the quality of those I did see really stood out. In particular:

• The public API live coding (part 1, part 2) session by Peter, Gethin and Steve was a great opportunity to get to grips with Alfresco Cloud’s new public API, and like the hackathon it felt great to have some working code at the end, much aided by the sample project provided on the USB sticks.
• Expanding on the idea of developing your own projects, Gab Columbro’s talk on the long-awaited and brand-new Maven SDK was a highlight as much for the content as for Gab’s style, although you’ll want to do some background reading on Maven and how it differs from more traditional build tools before you use it for real.
• On the second day I attended Dave and Erik’s Share Customizations Live session where they demonstrated, through the use of site presets and extensibility modules, some concrete examples which showed them taking a vanilla Share and hacking away until it was barely recognisable. What was interesting was how the mechanisms for doing this have improved over the last year, and the point that often it is just as useful to remove non-required OOTB functions as it is to add new ones, which the framework makes easy.
• Jared’s talk on our own Integrations team and what we’ve been up to over the last year (or six months in my case), and Nathan’s overview of PDF Toolkit and the latest new features, based on the work he’s done recently building on Jared’s earlier work. If you’re interested in integrating Share with external systems and working with PDF content you’ll find both sessions really useful.

Overall what stood out this year for me was the diversity of sessions available, not only in terms of topics but in their formats as well. There were less of the traditional-style PowerPoint-only type of sessions and more richer interactive sessions.

I experimented with a local Git repo in my own Developing Great Dashlets talk, switching between eight different branches of my example project to show progressively adding more features to an at-first-basic dashlet. It was great to see others experimenting in even more ways and adding more diversity to the two days.

If you’re attending the event in San Jose you’re I’ll be presenting the same dashlets “Zero to Hero” talk on Day 1 and Day 2, plus a topic on pimping the Document Details screen with your own document viewers and a lightning talk on the fantastic Leaflet. Do join if you can!

Gab’s session on Alfresco & Maven will be repeated at 9:40am on Thursday. Will’s session, Develop Great Dashlets, will be repeated at 3:50pm on Thursday.

Thanks to everyone who turned in a conference survey and for the individual session comments as well. Lots of great feedback in there.

As you noticed during the conference, the speaker’s slides are downloadable from their session page on the DevCon web site. If slides are missing, you might want to politely remind the speaker to upload. The vast majority of presentations are there.

The audio and laptop video were recorded for a handful of sessions. We’ll get those posted and linked from the session page as soon as we can.

Thanks again for attending and I look forward to seeing you all again next year!

If you are still considering attending DevCon San Jose, it isn’t too late to register!

Get links to Andy’s session abstracts on his speaker page.

Catch up with Dave and his team during Engineering Office Hours at the conference!

The integration allows LibreOffice to connect to a remote Alfresco server in order to open and save documents. This is a feature Microsoft Office has had for a long time, although limited to SharePoint-compatible servers (including Alfresco, via our SharePoint protocol support!). Now you can do the same thing with LibreOffice, via the magic of CMIS.

The first thing to do is to enable LibreOffice’s experimental features within the Preferences dialogue.

After you’ve confirmed that change, you can open a file stored in Alfresco using the standard Open menu. When the file browser loads, you should notice a small button next to the location drop-down menu labelled with an ellipsis (…).

Clicking that button allows you to add a server. LibreOffice supports a range of server types, including the CMIS AtomPub service provided by Alfresco.

First you must enter a name for the server – I entered ‘Alfresco’ – and select the server type. If you do not see CMIS (Atom Binding) in the list then check to ensure that you have LibreOffice 3.6+ and that you have enabled Experimental Features.

The binding URL for Alfresco 4.2 will be something like http://localhost:8080/alfresco/cmisatom if you are running a local instance. I found that if I used the legacy CMIS URL below /alfresco/service (or the short form /alfresco/s) then document saves did not work, but the newer URL worked great.

Next is the slightly tricky part, entering the CMIS repository ID. Your Alfresco instance will only expose one repository, but other CMIS providers provide others, and so you need to enter this.

Hitting the repository binding URL directly will give you the ID, but unfortunately the non-standard document MIME type returned means it does not open directly in a web browser. You could save the response to disk and then use a text editor to view its contents, but I found it easier to use curl at the command line, together with less.

curl -u admin:admin http://localhost:8080/alfresco/cmisatom | less

In the response, do a search for the string repositoryId and within that element you should see a GUID value which you can copy and paste into the dialogue in LibreOffice.

The last item you need to enter is the username that will be used to access Alfresco (you will enter the password later).

You should now have the full set of information needed to add the server. Click OK, and it should be added to the side panel on the left of the Open dialogue.

You can navigate through the folders below the repository’s Company Home space, and open any compatible document. I used the Word documents located under Sites > swsdp > documentLibrary > Meeting Notes, which opened perfectly.

You can make any modifications, hit Save and the content will be automatically saved back into Alfresco.

I also tried creating a new document from the New menu, and was able to save the document back to a folder Alfresco via the Save As dialogue. I found I needed to set the correct MIME type for new documents back in Alfresco Share to get previews to work, but this could easily be done using a rule.

All in all not bad for an experimental feature, and it will be interesting to see if this makes it into LibreOffice 3.7 for real.

You can catch up with Mike during Engineering Office Hours. He’ll also be manning one of the pods at the Alfresco Showcase in the Exhibition Hall in both Berlin and San Jose.

Catch Brian and the rest of the Engineering Team during Engineering Office Hours at DevCon Berlin and San Jose!

Notice Dashlet

This dashlet may already be familiar to some of you who have used the add-ons available from Share Extras.

The Notice Dashlet allows site managers to add a custom notice that will be displayed to all site members, and allows this to be done directly from the dashlet itself. Now you no longer need to create a wiki page just to display some basic text on the dashboard!

New Bubbling event for dashlet resize notifications

If you’ve developed any complex dashlets to render maps or other graphics, you’ll appreciate that it’s important to know the vertical height of the dashlet when you render your content. That is easy to get via the Dom or using YUI2′s YAHOO.util.Dom.getRegion() function, but what if the user resizes the dashlet?

Now the resizer module can notify your listeners via the new Bubbling event dashletResizeEnd. This is fired when the resizing has been completed and passes a number of parameters in the event arguments, including the new height of the dashlet, the dashlet element and component IDs and the Dom element representing the dashlet. To subscribe to the event, simply define a new custom function in your dashlet class prototype and bind it to the event in the dashlet class constructor, e.g.

YAHOO.Bubbling.on("dashletResizeEnd", this.onDashletResize, this);

In your custom function you can then take any further action which is necessary, e.g. informing a map instance that the element bounds have changed.

More options for Data List actions

The ability to add custom UI actions to Share’s Document Library is well documented and the add-ons site has a number of extensions which utilize this capability. But did you know the same thing can be done for data list items?

Until now the number of actions that can be displayed in the UI has been effectively capped at three. But now you can easily add new actions of your own there too. Thanks to the work done by Dave Draper these definitions can easily be inserted into the application by using an extensibility module to customize the datagrid.get and actions-common.get components.

As an example, the following code could be used to add the Sample Datalist Action provided by Share Extras to your datalist items, as part of an extensibility module.

if (model.widgets)
{
   for (var i = 0; i < model.widgets.length; i++)
   {
      var widget = model.widgets[i];
      if (widget.id == "DataGrid")
      {
         // These two lines only needed if you want to show the action in the 'actions' cell,
         // otherwise a 'More actions' menu will be created to display it.
         //widget.options.splitActionsAt = 4;
         //widget.options.actionsColumnWidth = 105; // splitActionsAt * 25 + 5
         // Add the action definition - this will be action-specific
         model.actionSet.push({
            id: "onActionSample", // Change to match your handler function name
            type: "action-link",
            permission: "",
            href: "",
            label: "actions.datalist.mycustom" // Change to match your custom label in datagrid.get.properties
         });
      }
   }
}

If you have attempted to customize the existing Edit and Create data list actions with your own custom form configuration, then you may also appreciate the ability to increase the width of the modal dialogs used here, which previously were fixed-width.

Better handling of missing custom previewers

This will mainly be of interest to developers and administrators working with custom viewers in the web preview component, such as the pdf.js viewer in Share Extras’s Media Viewers add-on, and is a topic which I’ll be talking about in San Jose next month.

Previously, if the files implementing the viewer were unavailable for some reason then an error would be thrown in the client-side component. With this change the component now logs that the viewer class could not be found, and this will also be printed on the screen if no other viewers can be found.

Here’s a quick summary of the new and improved features can you expect to see when you install Community 4.2!

New Share dashboard dashlets:

• Site Search

search results dashlet that allows a user to enter fts-alfresco search and see results across all their sites (when added to user dashboard) or just within a specific site (site dashboard)

Site Search dashlet

• Saved Search

Similar to Site Search – but the query is set via the dashlet settings panel – since this panel is only accessible to Site Managers, it means that “pre-canned” site searches can be set up by a Site Manager – great for reporting since it supports the full power of fts-alfresco search syntax. The title of dashlet can also be changed in the settings panel to make it clearer what the dashlet is reporting on.

Saved Search dashlet – settings for Site Managers

• My Discussions

dashlet to show forum posts that a user has created or replied to recently

My Discussions dashlet

Improved Share dashlets:

• Image Summary

improved liquid layout, folder path selection to show sub-set of images within a site, improved lightbox view

Image Preview dashlet

• My Tasks Dashlet

filter “all” has been split into “active” and “completed”, paging added.

• Content I’m Editing

dashlet converted to asynchronous loading to improve initial dashboard display speed

Document Library extendible views (see blog by Ray Gauss II)

the ability for developers to more easily add custom view modes to the Document Library

Rich Media Gallery View for Document Library

The first version of the Gallery View is now available in the Document Library – try it out to explore the shiny! More Multi-Media related views will be coming soon also. The new view supports the standard Document Library features such as multi-file select, drag-and-drop upload and also new features such the ability to dynamically change the number and size of the thumbnail images that are displayed in real-time.

Gallery View 1

Gallery View 2

Quick Share

public sharing of shortened document URLs

Quick Share action

Workflow UI improvements

delete completed workflow, show the completed tasks and workflows

iPad and Android usability fixes and improvements

HTML editing for Create Content, Wiki, Blogs and Forums (TinyMCE integration improved), drag and drop support for customise dashboard/site and rules ordering.

HTML5 multi-file upload

As well as the existing HTML5 drag-and-drop (in supported HTML5 browsers), the Document Library now supports multi-file selection in the standard upload dialog. With this change, there really is no need for the Flash based uploader any more on modern browsers.

SpringSurf 1.2:

• module-deployment features (see blog by David Draper)
• use-checksum-dependencies (see blog by David Draper)

No need to “clear internet cache” for end users when deploying Alfresco 4.2 or any future version. This great feature means the pain of clearing the temporary files cache has gone away when rolling out Alfresco 4.2 to your users!

• optional CSS image encoding (automatic embedding of images resources into CSS files – see blog by David Draper)

a prototype feature that is not enabled by default but potentially a great way of saving resources reducing the number of files that need to be downloaded to the client

• widget refactoring and extensibility hooks (see blogs by David Draper and Erik Winlöf)

more impressive Share extensibility features for developers

• configurable RemoteClient (see blog by Kevin Roast)

timeouts, buffer sizes, http proxy settings, tcp settings, the white/black list of unsecure HTML tags for wiki editing and inline display of HTML content from Alfresco is now fully configurable

Prevent 304 revalidations for unchanged thumbnail images

a feature that means Share will no longer need to execute checks back to Alfresco to see if document or user avatar thumbnail images have changed – reduced network traffic and improved performance

Category Manager and Tag Manager fixes and improvements

Sharepoint VTI module improvements

WebDav

stability and coverage (litmus tests), range header support

Latest Activiti BPM engine

Activiti 5.10 release

Search help information

inline help for the main search page when results are found

Download as ZIP action

combined multi-file download

Forms Runtime Validation improvements

improved user feedback for invalid form data 

I hope this gives you a good overview of the new and improved features in Alfresco Community 4.2, as ever you can also expect better Repository and Share performance since the last release and significantly improved stability with a large number of bug fixes. Enjoy the shiny!

The instructions on the wiki are pretty comprehensive, and together with the text file provided in the Solr integration package provide all the info you need to understand the process of creating your own keys and certificates for local testing.

After I stepped through the complete procedure documented there, with some slight modifications to avoid the interactive prompting, I found I had a set of commands which I could use in order to repeatedly re-generate a set of keys inside each installation directory on my system.

The first section in the following listing could be placed inside your .bash_profile file, and this is recommended to ensure that the password values you choose to use are not captured in your command history or in your terminal. The commands after that should be used repeatedly against each Alfresco installation you wish to generate keys and certificates for.

# The subject name of the key used to sign the certificates
REPO_SUBJECT_NAME="/C=GB/ST=UK/L=Maidenhead/O=Alfresco Software Ltd./OU=Unknown/CN=Alfresco Repository"
# The repository server certificate subject name, as specified in tomcat/conf/tomcat-users.xml with roles="repository"
REPO_CERT_DNAME="CN=Alfresco Repository, OU=Unknown, O=Alfresco Software Ltd., L=Maidenhead, ST=UK, C=GB"
# The SOLR client certificate subject name, as specified in tomcat/conf/tomcat-users.xml with roles="repoclient"
SOLR_CLIENT_CERT_DNAME="CN=Alfresco Repository Client, OU=Unknown, O=Alfresco Software Ltd., L=Maidenhead, ST=UK, C=GB"
# The number of days before the certificate expires
CERTIFICATE_VALIDITY=36525
# Keystore password
KEYSTORE_PASSWORD=custompassword
BROWSER_KEYSTORE_PASSWORD=alfresco

openssl genrsa -des3 -passout pass:$KEYSTORE_PASSWORD -out ca.key 1024
openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -passin pass:$KEYSTORE_PASSWORD -subj "$REPO_SUBJECT_NAME" -passout pass:$KEYSTORE_PASSWORD

# Generate Alfresco Repository SSL keystores
keytool -genkey -alias 'ssl.repo' -keyalg RSA -keystore ssl.keystore -storetype JCEKS -dname "$REPO_CERT_DNAME" -storepass "$KEYSTORE_PASSWORD" -keypass "$KEYSTORE_PASSWORD"
keytool -keystore ssl.keystore -alias 'ssl.repo' -certreq -file repo.csr -storetype JCEKS -storepass "$KEYSTORE_PASSWORD"
openssl x509 -CA ca.crt -CAkey ca.key -CAcreateserial -req -in repo.csr -out repo.crt -days "$CERTIFICATE_VALIDITY" -passin pass:$KEYSTORE_PASSWORD
keytool -import -alias 'alfresco.ca' -file ca.crt -keystore ssl.keystore -storetype JCEKS -storepass $KEYSTORE_PASSWORD -noprompt
keytool -import -alias 'ssl.repo' -file repo.crt -keystore ssl.keystore -storetype JCEKS -storepass $KEYSTORE_PASSWORD -noprompt
keytool -importkeystore -srckeystore ssl.keystore -srcstorepass $KEYSTORE_PASSWORD -srcstoretype JCEKS -srcalias 'ssl.repo' -srckeypass $KEYSTORE_PASSWORD -destkeystore browser.p12 -deststoretype pkcs12 -deststorepass $BROWSER_KEYSTORE_PASSWORD -destalias repo -destkeypass $BROWSER_KEYSTORE_PASSWORD
keytool -import -alias alfresco.ca -file ca.crt -keystore ssl.truststore -storetype JCEKS -storepass $KEYSTORE_PASSWORD -noprompt

# Generate Alfresco Solr SSL keystores
keytool -genkey -alias 'ssl.repo.client' -keyalg RSA -keystore ssl.repo.client.keystore -storetype JCEKS -storepass $KEYSTORE_PASSWORD -keypass "$KEYSTORE_PASSWORD" -dname "$SOLR_CLIENT_CERT_DNAME"
keytool -keystore ssl.repo.client.keystore -alias 'ssl.repo.client' -certreq -file ssl.repo.client.csr -storetype JCEKS -storepass $KEYSTORE_PASSWORD
openssl x509 -CA ca.crt -CAkey ca.key -CAcreateserial -req -in ssl.repo.client.csr -out ssl.repo.client.crt -days "$CERTIFICATE_VALIDITY" -passin pass:$KEYSTORE_PASSWORD
keytool -import -alias 'alfresco.ca' -file ca.crt -keystore ssl.repo.client.keystore -storetype JCEKS -storepass $KEYSTORE_PASSWORD -noprompt
keytool -import -alias 'ssl.repo.client' -file ssl.repo.client.crt -keystore ssl.repo.client.keystore -storetype JCEKS -storepass $KEYSTORE_PASSWORD -noprompt
keytool -import -alias 'alfresco.ca' -file ca.crt -keystore ssl.repo.client.truststore -storetype JCEKS -storepass $KEYSTORE_PASSWORD -noprompt

# Copy files
cp ssl.keystore ssl.truststore browser.p12 data/keystore/
cp ssl.repo.client.keystore ssl.repo.client.truststore solr/workspace-SpacesStore/conf
cp ssl.repo.client.keystore ssl.repo.client.truststore solr/archive-SpacesStore/conf

# Remove temporary files
rm repo.csr ca.key ca.crt repo.crt ssl.keystore browser.p12 ssl.truststore ssl.repo.client.csr ssl.repo.client.crt ssl.repo.client.keystore ssl.repo.client.truststore

Note that this will not update the Alfresco and Solr configuration with the password you choose for the keystores – you must do this separately in your alfresco-global.properties and in the properties file associated with each Solr core, as detailed in the Solr installation guide.

Lastly, this procedure should not be used in any public-facing or production instances, it is intended to be used in development environments only.

However, one problem has plagued me since I started using the Homebrew-installed version of ImageMagick in conjunction with my local Alfresco installs, with errors such as this in the logs

 2012-08-02 10:20:10,547  DEBUG [transform.magick.AbstractImageMagickContentTransformerWorker] [main] org.alfresco.service.cmr.repository.ContentIOException: 07020000 Failed to perform ImageMagick transformation: 
Execution result: 
   os:         Mac OS X
   command:    [/usr/local/bin/convert, /Users/wabson/Development/projects/share-extras-2/software/tomcat/temp/Alfresco/ImageMagickContentTransformerWorker_init_source_4067880520213204197.gif[0], /Users/wabson/Development/projects/share-extras-2/software/tomcat/temp/Alfresco/ImageMagickContentTransformerWorker_init_target_7684811633126657147.png]
   succeeded:  true
   exit code:  133
   out:        
   err:        dyld: Symbol not found: __cg_jpeg_resync_to_restart
  Referenced from: /System/Library/Frameworks/ApplicationServices.framework/Versions/A/Frameworks/ImageIO.framework/Versions/A/ImageIO
  Expected in: /usr/local/lib/libjpeg.8.dylib
 in /System/Libra

This frustrated me for a while. It happened every time Alfresco tried to call convert in order to effect an image transform – for instance generating doclib thumbnails – but running the exact same command at a bash prompt worked fine.

Various internet posts all pointed to the environment in which ImageMagick is run as being the cause for such problems. It seemed the environment variable DYLD_LIBRARY_PATH in particular was known to cause problems on OS X, but checking /etc/profile, /etc/bashrc and the custom alfresco.sh script I use to start up Alfresco (included in my Tomcat packages) did not yield any trace of such a variable.

Finally I found a comment in ALF-13452, which led me to check the Spring config within the thirdparty subsystem, responsible for starting up ImageMagick.

   <bean id="transformer.worker.ImageMagick">
      <property name="mimetypeService">
         <ref bean="mimetypeService" />
      </property>
      <property name="executer">
         <bean name="transformer.ImageMagick.Command">
            <property name="commandsAndArguments">
               <map>
                  <entry key=".*">
                     <list>
                        <value>${img.exe}</value>
                        <value>${source}</value>
                        <value>SPLIT:${options}</value>
                        <value>${target}</value>
                     </list>
                  </entry>
               </map>
            </property>
            <property name="processProperties">
               <map>
                  <entry key="MAGICK_HOME">
                     <value>${img.root}</value>
                  </entry>
                  <entry key="DYLD_LIBRARY_PATH">
                     <value>${img.dyn}</value>
                  </entry>
                  <entry key="LD_LIBRARY_PATH">
                     <value>${img.dyn}</value>
                  </entry>
               </map>
            </property>
            <property name="defaultProperties">
               <props>
                  <prop key="options"></prop>
               </props>
            </property>
         </bean>
      </property>
     ...

There it was. The subsystem itself was setting up a few environment variables before firing up the external process, and these were defined in processProperties. One was the DYLD_LIBRARY_PATH variable.

The solution was trivial. I copied the Spring config in tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/thirdparty/default/imagemagick-transform-context.xml into tomcat/shared/classes/alfresco/extension/subsystems/thirdparty/default/default/imagemagick-transform-context.xml as per the subsystems docs on overriding beans, and commented out the offending <entry> element.

mkdir -p tomcat/shared/classes/alfresco/extension/subsystems/thirdparty/default/default/
cp tomcat/webapps/alfresco/WEB-INF/classes/alfresco/subsystems/thirdparty/default/imagemagick-transform-context.xml tomcat/shared/classes/alfresco/extension/subsystems/thirdparty/default/default/
vim tomcat/shared/classes/alfresco/extension/subsystems/thirdparty/default/default/imagemagick-transform-context.xml

The result – image conversions now work perfectly in my local dev environment using the Homebrew-installed version of ImageMagick.

Share Extras will be moving to a new platform in the next few weeks. The new platform will be GitHub, with the version control obviously provided by Git instead of Subversion, which is used at present.

There are many reasons for moving to Git from Subversion. I’ve spent a while reviewing the project issue list this week and it’s clear to me that there are many enhancement requests which may not be appropriate to make in the main Extras code base, or are simply not achievable within the project due to people’s time constraints.

Git will enable the wider community to fork individual any add-on as they feel the need to. I hope this will lead to more contributions back to the main project and foster greater collaboration (and perhaps a bit of competition?) with others.

Specifically, there is also the need to improve on the localisation of add-ons in a consistent manner, and there are some great tools available for doing that based on Git.

Whilst I had originally intended to simply migrate to a new Git VCS within Google Code, the frequent downtime and increasingly poor feature set and user interface when compared to other providers has led me to conclude that it is not a viable platform for future development.

In contrast, GitHub supports the notion of projects within an overall organisation much better (I have already registered Share Extras as an organisation) and has some great options for improving our documentation using cool standards such as Markdown.

I propose to migrate the current trunk codeline (and perhaps the 1.0 branch should time allow) at the end of August. There are several things that committers need to do before then, in order to help make it a success, such as ensuring that they have a README.md file in all their projects (this will become the main source of documentation, rather than the wiki), and helping to close down any issues that remain open on Google Code (issues will not be migrated over).

As always, if you have any feedback, please let me know. Otherwise I will be in touch with the main committers separately in the coming week or so.

I mentioned at the end of that post that there were some new examples of custom viewers coming in Share Extras and I’m excited that we’re now ready to release them on the site.

Peter Löfgren had the great idea of using the pdf.js project to perform direct rendering of document content in the web browser using HTML5. I’d already started work on some simpler examples of custom viewers, and on refining the Flash audio/video players that Share Extras previously provided for Alfresco 3.3/3.4.

The result is what we’re calling the Media Viewers add-on. This bundles up a total of six viewer implementations designed to show different ways of implementing custom document views, both with and without Flash.

• PdfJs displays documents, presentations and any other file capable of being transformed to PDF in-line in the web browser using the excellent pdf.js viewer, which uses the power of HTML5 to remove Share’s Flash dependency for document viewing.

  The viewer supports a number of features not directly supported by the Flash document previewer, such as a sidebar with thumbnail, outline and search views, bookmarking of individual pages of a document, and will remember the page number and zoom level of previous documents that you have viewed.

  

• FLVPlayer and MP3Player display compatible audio and video files respectively, within the web-browser using the open source FLV Player and MP3 Player media players by neolao. Based on the content’s MIME type, the updated component automatically chooses the appropriate previewer to use.

  While similar to the Flash players provided by Share out-of-the-box, these implementations allow advanced customization of the player via configuration and if FFmpeg is installed, will fire up a transformation to allow viewing of non-H264/FLV video and non-MP3 audio. The user is informed when conversion is in progress and the screen automatically updates when the content can be viewed.

• Embed uses an in-line iFrame to embed the content itself directly inside the web page. It is suitable for use with content types that can be viewed directly within the web browser such as plain text and PDF, with the Chrome or Acrobat plugins installed. Again, this can be used to avoid the use of the Flash previewer for some clients.
• Prettify allows formatted code, mark-up and other supported text formats to be displayed in directly in the document and uses the google-code-prettify project to provide an in-line browser-based view with syntax highlighting.

  

• WebODF is an EXPERIMENTAL viewer which uses the AGPL-licensed WebODF project to display ODF content directly in the web browser.

  WebODF cannot be distributed with the add-in itself, so in order to use it you must also download the latest JAR file from the supporting share-webodf project and install it in the same way as the main media-viewers JAR file.

What’s most exciting is that we’re building on top of some great projects such as google-code-prettify, WebODF and pdf.js, that are evolving at a fast pace and changing the way that documents are viewed in a browser environment.

There is plenty more information including download links on the main Media Viewers project page on Share Extras. Please try it out, let us know what you think and help us to improve this collection.

This is a well tested feature that handles all commonly known XSS attack holes and many less well known ones – including all the attack vectors listed here: http://ha.ckers.org/xss.html

One of the downsides to this, is the stripping of some otherwise useful HTML attributes and elements is mainly to support issues in legacy browsers such as IE6 and IE7. Consider the STYLE attribute – not a problem attribute you would assume, how could setting a STYLE cause an XSS attack?! Well in IE8, FireFox, Safari, Chrome etc. it can’t. But in IE6/7 Microsoft in their wisdom allowed JavaScript to be inserted into a STYLE attribute (called “CSS Expressions” – a better name would have “CSS Hacks”). This is a potential XSS hole that only affects those legacy browsers – but the HTML stripping process cannot rely on your browser agent (which of course could be faked) so must always assume the worst and strip those STYLE attributes.

For the majority Alfresco users who discarded IE6 (or even just IE…) long ago, why should they be punished with this limitation? And it is an annoying limitation, as most of the in-line editing capabilities of TinyMCE and other in-line editors that can potentially be used with Alfresco use STYLE attributes to apply formatting to much of their generated content.

In Alfresco 3.4.9/4.0.2 and onwards, it is now possible to fully configure the black/white list of HTML tags and attributes that the HTML stripping process will use.

This is the default configuration this is applied OFTB:

      <!-- the set of HTML tags considered safe for rendering when mixing with existing client-side output -->
      <!-- NOTE: define all tags in UPPER CASE only -->
      <property name="tagWhiteList">
         <set>
            <value>!DOCTYPE</value>
            <value>HTML</value>
            <value>HEAD</value>
            <value>BODY</value>
            <value>META</value>
            <value>BASE</value>
            <value>TITLE</value>
            <value>LINK</value>
            <value>CENTER</value>
            <value>EM</value>
            <value>STRONG</value>
            <value>SUP</value>
            <value>SUB</value>
            <value>P</value>
            <value>B</value>
            <value>I</value>
            <value>U</value>
            <value>BR</value>
            <value>UL</value>
            <value>OL</value>
            <value>LI</value>
            <value>H1</value>
            <value>H2</value>
            <value>H3</value>
            <value>H4</value>
            <value>H5</value>
            <value>H6</value>
            <value>SPAN</value>
            <value>DIV</value>
            <value>A</value>
            <value>IMG</value>
            <value>FONT</value>
            <value>TABLE</value>
            <value>THEAD</value>
            <value>TBODY</value>
            <value>TR</value>
            <value>TH</value>
            <value>TD</value>
            <value>HR</value>
            <value>DT</value>
            <value>DL</value>
            <value>DT</value>
            <value>PRE</value>
            <value>BLOCKQUOTE</value>
            <value>BUTTON</value>
            <value>CODE</value>
            <value>FORM</value>
            <value>OPTION</value>
            <value>SELECT</value>
            <value>TEXTAREA</value>
         </set>
      </property>
      <!-- The set of HTML tag attributes that are to be removed before rendering -->
      <!-- NOTE: define all attributes in UPPER CASE only -->
      <!-- IMPORTANT: JavaScript event handler attributes starting with "on" are always removed -->
      <property name="attributeBlackList">
         <set>
            <value>STYLE</value>
         </set>
      </property>
      <!-- The set of HTML tag attributes that are considered for sanitisation i.e. script content removed -->
      <!-- NOTE: define all attributes in UPPER CASE only -->
      <property name="attributeGreyList">
         <set>
            <value>SRC</value>
            <value>DYNSRC</value>
            <value>LOWSRC</value>
            <value>HREF</value>
            <value>BACKGROUND</value>
         </set>
      </property>

As you can see it’s quite a list. The import config for STYLE attribute processing is here:

      <property name="attributeBlackList">
         <set>
            <value>STYLE</value>
         </set>
      </property>

So simply override the black list in the stringutils bean in your custom-slingshot-application-context.xml file – generally found in \tomcat\shared\classes\alfresco\web-extension – as detailed in previous blog posts:

<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE beans PUBLIC '-//SPRING//DTD BEAN//EN' 'http://www.springframework.org/dtd/spring-beans-2.0.dtd'>

<beans>

   <!-- Override HTML processing black list -->
   <bean id="webframework.webscripts.stringutils" parent="webframework.webscripts.stringutils.abstract"
         class="org.springframework.extensions.webscripts.ui.common.StringUtils">
      <property name="attributeBlackList">
         <set></set>
      </property>
   </bean>

</beans>

Restart the Share web-application and STYLE attributes will no longer be removed by Share.

tl;dr

Many open source contributor agreements (including the Alfresco Contributor Agreement) do not involve any reassignment of copyright - instead they grant the project maintainer a license to use, modify and distribute the contribution.

The Full Picture

I was recently chatting with Jennifer Venables (Alfresco’s awesome general counsel) and she mentioned something in passing that I hadn’t realised before, and that I’m guessing many of you may not know either.  I had always been under the impression that most, if not all, contributor agreements (whether for open source projects or not) involved the individual contributor handing over copyright on their contribution to the project maintainer (for example Alfresco Software Inc., in the case of contributions to the open source Alfresco content management system).  If you’re like me, the thought of handing over “your babies” to someone else is not particularly appealing, and in general I’ve made a point of not becoming involved in projects that require me to give up rights to my own creations.

So Jennifer’s off-hand comment took me a little by surprise, and after she patiently explained how contributor agreements typically work, I’m looking at them in a more positive light.  Specifically, the Alfresco Contributor Agreement (and those of some other open source projects) do not involve any reassignment of copyright - you as the creator of a particular contribution retain full ownership of the copyright of that contribution.  Instead, the project maintainer is simply requesting that you license your intellectual property to them, so that they can also use, modify and distribute it – rights you’ve probably granted to the public anyway (at least if you’ve chosen one of the more popular open source licenses).

It’s also worth noting that the Harmony project is an attempt by the wider open source community to try to standardise and clarify contributor agreements, as there seems to be a lot of confusion around them.  Jennifer has been keeping an eye on their progress on behalf of Alfresco, as their initiative would help to clarify what is often (and definitely was for me) a confusing legal mechanism.

<disclaimer aka IANAL>Now I’m about as far from a lawyer as it’s possible to get, so everything I’ve said here you’d be strongly advised to double check with someone who has legal expertise in this area.</disclaimer>

What I can say with certainty is that I had completely misunderstood the intent of Alfresco’s Contributor Agreement and (more importantly) the legal basis upon which it operates, and that misunderstanding has prevented me in the past from contributing to other open source projects.  I guess I’ll chalk this up to “sometimes, you just don’t know what you don’t know”!

These preview capabilities are one of the core strengths of Share, and now these changes allow developers and administrators to tweak the capability as they need.

Web preview component in Alfresco 4 for a PowerPoint Presentation

The Basics

Let’s start with a quick overview.

The web-preview component is similar to most other Share components. The page component itself is rendered by a web script, which is responsible for loading some basic information about the document being requested, and outputting this into the markup that then forms part of the overall page.

The output does not render HTML directly, but rather instantiates a client-side component Alfresco.WebPreview, passing over the document metadata as an object literal.

Previously, that was it. The logic to set up the Flash previewer was contained within Alfresco.WebPreview, and that was what you got for all documents and images. Anything else that couldn’t be transformed by the repository to a SWF file would not be previewed.

What’s Changed?

Alfresco 4 changes that. Now, the rendering of content items is separated from Alfresco.WebPreview and instead performs the work via a series of plug-ins. The component still takes care of loading the document metadata, setting up the basic screen layout and working out which plug-ins can be used to render the content on-screen. This has several benefits -

• System administrators can decide which plug-ins should be used under which circumstances, via configuration.
• Plug-ins are chained together in the configuration. If one fails, then the other available ones are tried in turn, until one succeeds.
• The implementation of the plug-ins by developers does not need to touch any core files. They are tied into the component via configuration alone.

What’s more, Share comes with a number of different plug-ins already present. It’s likely that you will still see the Flash document previewer for most of the content you look at, but you should notice that by default images are now rendered as real images within the page, and will be automatically resized if they are too big. That’s because images are now handled by a different plug-in, but you can still use the Flash previewer if you reconfigure the component.

Web preview component in Alfresco 4 for a JPEG image

Other previewers are provided for displaying audio and video content using Strobe Media Player or FlashFox, plus direct playback of supported formats using the HTML5 <video> and <audio> tags. Take a look in the directory components/preview within the Share webapp and you will see them there. It’s worth looking at the source code if you’re thinking of implementing your own custom previewers, as many of them are surprisingly simple.

Configuring Plug-ins

The configuration that dictates which plug-ins are used under what circumstances is contained in the web script configuration file web-preview.get.config.xml. You can find this in the Share webapp in the directory WEB-INF/classes/alfresco/site-webscripts/org/alfresco/components/preview and view it there, but if you’re planning on making any changes you should first copy it into tomcat/shared/classes/alfresco/web-extension/site-webscripts/org/alfresco/components/preview (you may need to create the directories below web-extension).

You should see that the config is expressed as a series of conditions, each of which contains a list of plug-ins to attempt to use. For each condition that matches, each of the plug-ins within it is then added to the list to try to use.

Here’s an example for MPEG-4 video files

<condition mimeType="video/mp4" thumbnail="imgpreview">
    <plugin poster="imgpreview" posterFileSuffix=".png">StrobeMediaPlayback</plugin>
    <plugin poster="imgpreview" posterFileSuffix=".png">FlashFox</plugin>
    <plugin poster="imgpreview" posterFileSuffix=".png">Video</plugin>
 </condition>

The <condition> element’s attributes form sub-conditions, which are AND-ed together to give the overall result. In this case, the condition will match when the content being viewed has the MIME type video/mp4 and the thumbnail with the name imgpreview can be generated (note, it may not yet have been generated) via the thumbnail service. Other conditions will only test one of these sub-conditions, but here we test both.

Each of the <plugin> elements then provides the name of the plug-in in the element body and any configuration attributes required as element attributes. In this case, each of the plug-ins is being configured to use the imgpreview thumbnail as the static ‘poster’ image to display in the player before the play button is pressed, and to assume this image is in PNG format. Note, these attributes will be different for each plug-in since they are mapped to the options object on the plug-in implementation.

As an administrator, within this file you can add, remove and re-order plug-ins or conditions as you need, change the conditions or change the configuration that is passed to the plug-ins at instantiation time.

Implementing Your Own

It’s easy to create your own plug-ins to render content in interesting and different ways. A plug-in is implemented as a single JavaScript class, which must meet the following simple criteria

• The name of  its constructor must be the same as the value used in the <plugin> configuration element to tie it into the component, and must be defined as a child property of Alfresco.WebPreview.prototype.Plugin. By convention CamelCase is used for the name, e.g. WebPreviewer, FlashFox, Image.
• The object prototype must define an object literal named options and two functions report() and display(). See the in-line JSDoc of the out-of-the-box plug-ins for full details of the method signatures and return types required.

You will also need to ensure that the client-side file where you define the plug-in object is included in the <head> section of the Document Details page, you can do this as an administrator by overriding the web-preview.get.head.ftl template, or (better) as a developer by extending the .head.ftl template using a customization module applied to the web-preview.get web script.

New Viewers on Share Extras

Keep an eye out for the upcoming release of the (to-be-renamed) Media Previews add-on in Share Extras. Peter has been instrumental in helping to build up some new plug-ins for viewing different types of content that we hope can be used to remove the Flash dependency that still remains in Share for viewing document-based content. They should also provide some further examples of how you can define your own, custom, plug-ins.

It is possible to merge maps of a child bean to a parent bean. Here is how it is done: Create a new bean, where the parent is the applicationScriptUtils bean. Add a single property of decoratedProperties and define a map in the property. When you define the map add the attribute merge="true". Finally, add your custom property to decorator bean mappings. Done!

Here is an example:

  <bean id="customApplicationScriptUtils" parent="applicationScriptUtils">
   <property name="decoratedProperties">
      <map merge="true">
         <entry key="alf:propertyHolder">
            <ref bean="customDecoratorBean"/>
         </entry>
      </map>
   </property>
  </bean>

The first web script will add a simple workflow to a node. The second will allow us to signal the transition of accept or reject on that node.

Add a Workflow

As discussed in the previous post, a simple workflow is made up of two paths: accept or reject with a copy or move to another folder. You are also able to set the name presented to the user for the accept or reject step. This is very useful as what we may be presenting to the user is to not accept or reject documents, but rather sending the document to two different group owned folders based on context/content of those documents. At least one step is required. Alfresco defaults “accept” for the required step and makes “reject” the optional step. These need to be passed to our web script. The payload is passed as json. A full example of this looks as follows:

{
    "simpleworkflow": {
        "accept": {
            "name": "acceptstep",
            "move": true,
            "folder": "workspace://SpacesStore/ebd7ff99-b423-4e45-ad4f-71929ce4c089"
        },
        "reject": {
            "name": "rejectstep",
            "move": true,
            "folder": "workspace://SpacesStore/0239b2ed-ebfa-4b9d-a7fa-f0404448cffc"
        }
    }
}

In the above example, the reject object is optional.

Both the accept and reject objects are made up of the three required values of the simple workflow aspect: name, move and folder.

The name field maps to either approveStep or rejectStep. It is the name presented in the Alfresco UIs. But it could also be used in a custom interface as they are returned as part of the list of properties for the node.

The move field maps to either approveMove or rejectMove. This boolean field indicates with a true value to move the node or, if false, to copy the node.

The final field, folder, maps to approveFolder or rejectFolder. This is the folder node where the document should be moved or copied to when the appropriate action is taken.

The web script can be call by passing the simpleworkflow json object to simpleworkflow/add/{store_type}/{store_id}/{id}. Upon completion a json object of { "success": true|false] }. True upon successful completion, false if there was an error adding the simpleworkflow aspect to the node.

Using a Simple Workflow from a Web Script

This web script was originally developed for a customer to return XML, but I’ve now updated it to return json by default. The XML is maintained here for backwards compatibility.

When a simple workflow aspect is added to a node, it just adds the properties of what should occur when an accept or reject action is taken. The actual actions of what happens is built into UIs. So the web scripts need to do the same: perform the copy or move to the targeted folder. The call is pretty simple: simpleworkflow/{accept|reject}/{store_type}/{store_id}/{id}. The json or XML that is returned let us know of either the success or the failure of this action. Failures can provide some information on why the failure occurred. A success messages, provides more detail: what action occured — copy or move, which step was taken — returning the name as set in the approveStep or rejectStep properties, the folder that document was moved or copied to. The destination that is returned is the human readable path. (If there is any interest we can update this to return the nodeRef as well as the path.)

The json returned looks like:

{
    "success": true,
    "action": "move",
    "step": "acceptStep",
    "destination": "/Company Home/Sites/workflow/docmentLibrary/workflow/accept"
}

These web scripts can be downloaded from its Google Code Project.

What I really like about simple workflows is how they are implemented and how you can model your own customizations or applications using this pattern. As a follow up to this post I’m going to share a web script to add a simple workflow to a node and then another to progress the workflow by accepting or rejecting it.

Let’s dig in!

Simple workflows present, as stated above, the ability to accept and reject the document and then copy or move that document to another space. The key to a simple workflow is the model.

      <aspect name="app:simpleworkflow">
         <parent>app:workflow</parent>
         <properties>
            <property name="app:approveStep">
               <type>d:text</type>
               <protected>true</protected>
            </property>
            <property name="app:approveFolder">
               <type>d:noderef</type>
               <protected>true</protected>
            </property>
            <property name="app:approveMove">
               <type>d:boolean</type>
            </property>
            <property name="app:rejectStep">
               <type>d:text</type>
               <protected>true</protected>
            </property>
            <property name="app:rejectFolder">
               <type>d:noderef</type>
               <protected>true</protected>
            </property>
            <property name="app:rejectMove">
               <type>d:boolean</type>
            </property>
         </properties>
      </aspect>

Each node that has a simple workflow attached to it has this aspect applied to it, which specifies through properties what steps are available, what that step should be called (acceptStep and rejectStep) and then what should occur when that step is taken: should it be moved or copied (acceptMove and rejectMove)? and where it should go (acceptFolder and rejectFolder).

Knowing this opens many doors for us. Because the steps are properties on the node, we can modify them, if needs be, using either javascript or Java. We can also build on top of this. When I worked on the Consulting team at Alfresco a customer wanted to have a three step workflow: accept, reject and other. Modeling this was simple. All we really needed to do was add three simple properties: the step name (text), the destination node (noderef) and if it is a move or copy (boolean). A bit more complex was adding the logic for exposing this through the Explorer UI. (This customer had not yet moved to Share). Because we did not want to affect all of the simple workflows already in place, we opted to add an additional 3 step simple workflow, giving them the ability to have up to 5 different paths that could be taken for a single node.

We can also tie simple workflows into more complex actions: dynamically adding simple workflows or scripting more complex actions that allow users to manually take the workflow steps but also allowing programatic lifecycle or state to take simple workflow actions. By jumping out of Explorer or Share and into a custom application you can expose simple workflows from the repository through a web script (an easier task than modifying JSF) and one that I’ve used for several different Alfresco implementations. We will cover that in my next post.

I have chosen questions which demonstrate this range and rather than simply giving you the question and answers I’ve also delved a little bit more behind each question, to explain the correct answers and the distractors, or incorrect answers.

In order to set the pass marks we have used a modified Angoff method which uses subject matter experts to determine the difficulty of each question.  It defines the cutoff score as the lowest score a minimally competent candidate (MCC) is likely to achieve.

Essentially, it works this way:

I have described this process because I also want to give you an idea of how these ratings work so that you can gauge how difficult our subject matter experts have determined it to be.

Let’s jump right in. Our first question relates to Share and is from the ACE exam.

In order to configure Alfresco Share, best practice dictates that you edit which file?

1. share-config.xml
2. share-config-custom.xml.sample
3. share-config-custom.xml
4. web-client-config-custom.xml

The correct answer is 3. This is a relatively easy question and shows that there are some knowledge based questions which require you to memorize file names, locations or other items. These are used only in situations where the piece of information is so key that we would expect a competent Alfresco developer to know this without looking it up. Configuring Alfresco Share is covered on the Share Configuration course. Let’s walk through each of the answers in turn…

1. share-config.xml: This is the systems configuration file for Share, you can edit this and make configuration changes in this file and the changes will work. However if you perform an upgrade at a later stage your changes will be over-written, so best practice dictates that you should not modify this file. Hence this answer is wrong.
2. share-config-custom.xml.sample: This is the sample file that is supplied with Alfresco and which you would copy to share-config-custom.xml before making your changes. Simply editing this file will have no effect because the system will ignore files with the extension .sample.
3. share-config-custom.xml: The correct answer! Your changes should be made in this file which can be created by copying the share-config-custom.xml.sample provided.
4. web-client-config-custom.xml: This file is the file that you should use to make configuration changes to the Alfresco Explorer client, not to Share.

You can see from the answer choices that some options are distractors (or wrong answers), in many cases making them look viable in other circumstances, so it pays to read the questions carefully. This question has a rating of 90%, and so means that we would expect 90% of MCCs to get the answer correct.

Let’s look at another question – again from the ACE exam.

Fill in the blank on the architecture picture.

1. alf_data
2. content services
3. database
4. file system
5. repository
6. Solr

This is a simple question relating to the architecture and is covered in the introductory classes. The right answer of course is #3 – database. Let’s look at the distractors in more detail:

1. alf_data: This is typically the location where Alfresco will store the content files on the file system.
2. content services: this is the range of services provided by the server for managing content for instance versioning.
3. database: the correct answer, Alfresco stores metadata in a relational database.
4. file system: Alfresco store the metadata in the database (some is also stored in the full-text index, but that is already shown in the diagram)
5. repository: this is the name given to the collection of database, file system and indexes as a complete and consistent unit.
6. Solr: This is a simple distractor. Solr is an enterprise indexing server which Alfresco introduces with 4.0.

Now we look at a question from the ACE exam which requires you to have an understanding of Alfresco development best practices. This subject is covered in all the training courses which deal with development. This question has a rating of 88%, hence it is considered slightly more difficult than the first question.

A repository web script is defined in the directory
<TOMCAT_HOME>/webapps/alfresco/WEB-INF/alfresco/templates/webscripts/org/alfresco/test
inside the Alfresco installation. Which of the following procedures should you use to change the default output template, while adhering to best practice?

1. Copy the output template file into <TOMCAT_HOME>/webapps/alfresco/WEB-INF/alfresco/extension/templates/webscripts/org/alfresco/test, make your changes there, then update the web script descriptor to reference the new file.
2. Copy the output template file into <TOMCAT_HOME>/shared/classes/alfresco/extension/templates/webscripts/org/alfresco/test and make your changes there.
3. Copy the output template file into <TOMCAT_HOME>/webapps/alfresco/WEB-INF/alfresco/extension/templates/webscripts/org/alfresco/test and make your changes there.
4. Create a copy of the output template file in the same directory, then update the web script descriptor to reference the new file.

In this case, #2 is the correct answer. This question is rated at 75% and so is more difficult than the preceding two examples. Let’s review the answer choices:

1. This copies the file to a different directory but it is still in the Alfresco webapp, which is not best practice.
2. This is the correct answer! The file should be copied to this directory, often referred to as {extensionRoot}, and edited there to ensure that upgrades do not over-write your changes. In fact, this is the only one of these answers which copies the file outside of the webapp and so is the only answer which is correct according to best practices.
3. This options behaves in the same way as #1 and is also incorrect.
4. This also keeps the file in the webapp and is therefore incorrect.

This is our final sample question from the ACE exam, and demonstrates the application of knowledge gained through development or by researching the subject.

A RESTful API is called via a POST request to the URL /example/mycontent/item1, relative to the RESTful API base URL. Based on your knowledge of Alfresco’s RESTful API and the REST architecture, what will be the logical result of this?

1. A new resource ‘item1′ is added.
2. The content of the resource ‘item1′ is returned to the user.
3. The existing resource ‘item1′ is deleted.
4. The existing resource ‘item1′ is updated.

The correct answer is #1. Resource representations have been modeled on Atom & Atom Publishing Protocol. Resources support methods with the primary ones being GET, PUT, POST & DELETE. You will have realised through development and use of technologies such as web scripts, that Alfresco uses GET for information retrieval from the repository, PUT for updates, POST for adding or creating new items and DELETE to destroy or remove items. Therefore in this case using a POST, the correct answer is that item1 will be added. This is the most difficult question we have looked at and is rated at 65%.

I hope that this blog has given you some idea of the types of questions you will face in the Alfresco certification exams and has given you confidence to undertake the tests for yourself.

Good luck and hope to see you in class.

Carlos Miguens
Global Training Director

One of the things that is easy to forget when adding/writing a new scheduled jobs is to wrap your code in a RetryingTransactionHelper _and_ a RunAs. When executing the scheduled job we need to make sure that we provide a transaction in which to perform your custom code and a user to perform the code under.

Example:

 public void execute()
    {
        AuthenticationUtil.runAs(new AuthenticationUtil.RunAsWork<Object>()
        {
            @Override
            public Object doWork()
                throws Exception
            {
                RetryingTransactionCallback<;Object>; txnWork = new RetryingTransactionCallback<Object>()
                {
                    public Object execute()
                        throws Exception
                    {
                        //Add logic here
                        return null;
                    }
                };

                transactionService.getRetryingTransactionHelper().doInTransaction(txnWork, false);
                return null;
            }
        }, user_authority);

    }

Hopefully this template will prove usefully to anyone writing a custom scheduled actions.

One of the exciting, at least in my opinion, new features of Alfresco 4 is the Share Document Library Extension’s (hat tip to Mike Hatfield).  In the above post Mike goes in to detail on how to use this new feature and I’m going to share an example on how I’m using it as part of integration with Dropbox I’m working on.

The Problem Set

As part of the integration we need to add a status indicator (see the above article for in depth details on status indicators) to, as the name states, indicate that the file/folder is in a specific state, ie synced to Dropbox.  Early on this was a simple tasks: does it have a specific aspect or not.  As the project has moved forward, we’ve raised the complexity: does it have a specific association and does that association have a child association of a specific value…a direct correlation between this child association and a specific user.  Now that we have moved beyond what the out of the box evaluators can do directly, what are our options?

Options?

The Share Document Library Extension Framework provides two options for retrieving additional metadata/values from the repository tier: Custom Responses and Property Decorators.

Custom Responses allow you to return information that is not specific to any node.  Alfresco 4 uses this to return information about our Sharepoint Protocol integration.

Property Decorators allow you to return node specific information in a more usable format to the web tier (ie Share).  For example rewriting a nodeRef to a filename, or a username as first and last name. Or as in our case, a new set of properties or key/value pairs.

Since we are looking for specific information about a node, a property decorator is what we will need.

Implemention

A property decorator needs to have the following:

A content model property to hold a map of properties. In our model we added a property similar to:

<property name="alf:propertyHolder">
    <type>d:boolean</type>
    <default>false</default>
    <index enabled="false"/>
</property>

This property will never be needed in the index since it will always be the same value until it is requested in Share.

Next we need to implement our logic.  This requires a new Java class that implements PropertyDecorator.

public class CustomProperty
    implements PropertyDecorator
{

  //Add any needed services

    @Override
    public Serializable decorate(NodeRef nodeRef, String propertyName, Serializable value)
    {
        Map<String, Serializable> map = new LinkedHashMap<String, Serializable>(4);

        //Add logic here

        //One to many
        map.put("key", value);

        return (Serializable)map;
    }

}

This also requires a new Spring bean definition.

  <bean id="customProperty" class="org.alfresco.extension.repo.jscript.app.CustomProperty">
   <!-- Any needed service -->
  </bean>

Lastly we need to add it to the list of propertyDecorators.  Update: I’ve add a new post that covers how the mapping should occur and added a new bean here. Currently this requires overwriting the out of the box definition for applicationScriptUtils.  This could cause issues if you have several different AMPs that need to overwrite this bean. (I’ve opened ALF-13038 for this issue).

<bean id="customApplicationScriptUtils" parent="applicationScriptUtils">
 <property name="decoratedProperties">
    <map merge="true">
       <entry key="alf:propertyHolder">
          <ref bean="customDecoratorBean"/>
       </entry>
    </map>
 </property>
</bean>

Now this completes the repo side of our extension.  Now we need to work with the values returned on the Share side.  We needr a status indicator so we’ll focus there.

First we’ll define the evaluator.  We need to add the evaluator to web-extension/custom-slingshot-something-context.xml

<bean id="evaluator.doclib.indicator.custom" parent="evaluator.doclib.metadata.value">
      <property name="accessor" value="properties.customProperty"/>
	  <property name="comparator">
         <bean class="org.alfresco.web.evaluator.StringEqualsComparator">
            <property name="value" value="true" />
         </bean>
      </property>
   </bean>

It is important to note that the value of the accessor is not the content model property name, but the key value used in our map from the CustomProperty class.

And finally, we use the evaluator in our indicator config. This is added to our share-config-custom.xml under the META-INF in our custom jar file.

<config evaluator="string-compare" condition="DocumentLibrary">
		<indicators>
			<indicator id="customDecorator" index="250" icon="custom-16.png">
				<evaluator>evaluator.doclib.indicator.custom</evaluator>
			</indicator>
		</indicators>
</config>

In conclusion, the Share Document Library Extension Framework is a powerful new tool in the developer toolbox.

Over the years at Alfresco training, we have taught over 2,500 people, yet more people have trained themselves by reading the documentation, using the product and exploring the vast amount of material available in books, blogs and wikis.

As the pool of Alfresco expertise grows, it becomes more difficult for the experts to differentiate their competency from those developers and administrators, who may have a good industry track record but who are new to the Alfresco platform. Because of this, in 2010 we began looking at developing an accreditation program that would allow individuals to prove their competency on the Alfresco platform through a series of tests. Our objective was clear, we wanted to allow bona fide experts in Alfresco to showcase their competency to their peers and their employers, whilst paving the way for a professional accreditation in the product.

These objectives meant that we did not simply want to create a certification exam that would merely test how well someone listened in a training class. We wanted the tests to be more wide-ranging and really gauge comprehension, application and competency. We started out with a self-test which we called the Alfresco Recognized Developer exam, to trial various scenarios, gather data about profiles and scoring, and gain feedback. In October 2011, in conjunction with our partner PearsonVue, we launched our certification program, with two exams: the Alfresco Certified Engineer and the Alfresco Certified Administrator.

Since launching the exams, a number of questions about the tests have repeatedly come up and so I wanted to take the opportunity in my blog to answer these questions and explain a little bit more about the exams.

Since my last blog on this subject, there has been quite a bit of interest in load balancing Alfresco Share. This is good news but also means that customers and the community have found some issues that needed looking at – good, because more use of Alfresco testing means more stability for everyone when we fix the issues – that’s part of the fun of having a very active user community!

Three main points were raised:

1. A bug relating to a problem with dashboard template layouts not updating between web-tier nodes – which was quickly resolved for 3.4.8 and 4.0 see ALF-12318
2. A request for example load balancing config for Share itself as I only posted info on the forward proxy config for Share.
3. An issue raised in regards to a noticeable drop in performance when the cache config detailed in the previous post was added to each Share instance (which was required for load balancing multiple instances) - see this related blog post http://blog.alfrescian.com/?p=146 and ALF-12336

I’ll address all issues here and share some exciting performance related to item 3 also!

1. A bug that manifested when a user changed the template layout selection for a dashboard – for example from 2 to 3 column layout. The problem was that SpringSurf PageView objects were internally caching the Page object rather than just the PageId – easily and quickly fixed.

2. Config for load balancing Share is very similar to that for load balancing Alfresco.

Set up two tomcat instances containing “share.war” webapp with the “share-config-custom.xml” and “custom-slingshot-application-context.xml” config as detailed in the previously post. Remember the ports exposed by Tomcat need tweaking if you have those instances on the same physical machine – increment the HTTP and AJP and redirect ports in the tomcat/conf/server.xml config. Also ensure you have set the “jvmRoute” attributes to different values ready for the load balancing config, I used “tomcat3″ and “tomcat4″ as I now have a lot of servers running on a single box!

Create another Apache instance, I just did a copy and paste from the one I used to load balance the Alfresco cluster. Again bump the Apache listener port value if it exists on the same physical machine. Finally configure Apache “httpd.conf” to load balance against your Share web-tier instances:

# Reverse Proxy Settings (Share multi-instance load balancing)
ProxyRequests Off
ProxyPassReverse /share balancer://app
ProxyPass /share balancer://app stickysession=JSESSIONID|jsessionid nofailover=On
<Proxy balancer://app>
BalancerMember ajp://localhost:8019/share route=tomcat3
BalancerMember ajp://localhost:8024/share route=tomcat4
</Proxy>

Simply point your client browsers at your new Apache instance. If you have set up your Share instances to themselves use an Apache which is load balancing against an Alfresco cluster then you now have a full 2x Alfresco Cluster + Apache + 2x Alfresco Share + Apache set up!

This is great – BUT it leads onto point 3…

3. Scalability and fail-over capability has improved by having multiple Share instances – but individual performance per Share node is reduced. Now you may consider (as I did first) that this is expected, there is after all some additional work here going on – in the case of the Alfresco cluster it’s inter-node communication overhead, and in the case of the Share nodes it is reduced performance due to the caches that have been disabled. What’s apparent here is that if you just cluster Alfresco and keep to a single Share instance, we find that a single instance of Share can easily service a 4 node Alfresco cluster so in practice there is little need to load balance Share for performance reasons – but you certainly might want to for high availability reasons. Perhaps a price worth paying for the ability to remove and drop in additional nodes without your users knowing or having to update their URLs… But it would be nice if there wasn’t such a noticeable performance drop in Share.

The good news is that this has all changed in Alfresco 3.4.8/4.0.1 – in response to the community blog post and our drive to continually improve the performance of Alfresco, a new clustering technique has now been implemented for the web-tier.

For a load balanced environment, Alfresco Share now uses Hazelcast to provide multicast messaging between web-tier nodes. The end result of this is that all caches are now enabled again for each node, and we send very simple cache invalidation message when appropriate to all nodes. So the performance degradation is gone – each node is as fast a single Share instance.

The only changes required for each node are in “custom-slingshot-application-context.xml” – generally located in \tomcat \shared\classes\alfresco\web-extension and used to override the Spring application context beans for Share. There is an example “custom-slingshot-application-context.xml.sample” provided in the Alfresco distribution which now includes this config.
Enable this section on each Share tomcat instance to enable the Hazelcast cluster messaging:

   <!--
        Hazelcast distributed messaging configuration - Share web-tier cluster config (3.4.8 and 4.0.1)
        - see http://www.hazelcast.com/docs.jsp
        - and specifically http://www.hazelcast.com/docs/1.9.4/manual/single_html/#SpringIntegration
   -->
   <!-- Configure cluster to use either Multicast or direct TCP-IP messaging - multicast is default -->
   <!-- Optionally specify network interfaces - server machines likely to have more than one interface -->
   <!-- The messaging topic - the "name" is also used by the persister config below -->
   <hz:topic id="topic" instance-ref="webframework.cluster.slingshot" name="slingshot-topic"/>
   <hz:hazelcast id="webframework.cluster.slingshot">
      <hz:config>
         <hz:group name="slingshot" password="alfresco"/>
         <hz:network port="5801" port-auto-increment="true">
            <hz:join>
               <hz:multicast enabled="true"
                     multicast-group="224.2.2.5"
                     multicast-port="54327"/>
               <hz:tcp-ip enabled="false">
                  <hz:members></hz:members>
               </hz:tcp-ip>
            </hz:join>
            <hz:interfaces enabled="false">
               <hz:interface>192.168.1.*</hz:interface>
            </hz:interfaces>
         </hz:network>
      </hz:config>
   </hz:hazelcast>

   <bean id="webframework.slingshot.persister.remote" class="org.alfresco.web.site.ClusterAwarePathStoreObjectPersister" parent="webframework.sitedata.persister.abstract">
      <property name="store" ref="webframework.webapp.store.remote" />
      <property name="pathPrefix"><value>alfresco/site-data/${objectTypeIds}</value></property>
      <property name="hazelcastInstance" ref="webframework.cluster.slingshot" />
      <property name="hazelcastTopicName"><value>slingshot-topic</value></property>
   </bean>

   <bean id="webframework.factory.requestcontext.servlet" class="org.alfresco.web.site.ClusterAwareRequestContextFactory" parent="webframework.factory.base">
      <property name="linkBuilderFactory" ref="webframework.factory.linkbuilder.servlet" />
      <property name="extensibilityModuleHandler" ref="webscripts.extensibility.handler" />
      <property name="clusterObjectPersister" ref="webframework.slingshot.persister.remote" />
   </bean>

The config enables the Hazelcast Spring integration which starts the Hazelcast server, it is easily configurable and can use either multicast (the default and minimal effort) or TCP-IP direct if preferred. See http://www.hazelcast.com/docs.jsp for more info. For the default set up, identical config can be applied to each Share node and it will “just work”.

When you start Share you’ll see something like this:

INFO: /192.168.2.8:5801 [slingshot] Hazelcast 1.9.4.6 (20120105) starting at Address[192.168.2.8:5801]
19-Jan-2012 13:58:57 com.hazelcast.system
INFO: /192.168.2.8:5801 [slingshot] Copyright (C) 2008-2011 Hazelcast.com
19-Jan-2012 13:58:57 com.hazelcast.impl.LifecycleServiceImpl
INFO: /192.168.2.8:5801 [slingshot] Address[192.168.2.8:5801] is STARTING
19-Jan-2012 13:58:59 com.hazelcast.impl.MulticastJoiner
INFO: /192.168.2.8:5801 [slingshot]
Members [1] {
        Member [192.168.2.8:5801] this
}
19-Jan-2012 13:58:59 com.hazelcast.impl.management.ManagementCenterService
INFO: /192.168.2.8:5801 [slingshot] Hazelcast Management Center started at port 5901.
19-Jan-2012 13:58:59 com.hazelcast.impl.LifecycleServiceImpl
INFO: /192.168.2.8:5801 [slingshot] Address[192.168.2.8:5801] is STARTED

This means the config has driven the initialisation of Hazelcast successfully. That’s all there is to creating a Share instance in the cluster, if the config is present it will become a cluster node, if the config is not present (such as for a default install) then Hazelcast never starts . Once each node is started they will find each other automatically. Then once you users interact with Share, only when the following operations occur will cache invalidation messages will be sent from the affected node to the others in the cluster:

• an existing site/user dashboard layout is modified
• new site or user dashboard is created
• runtime app properties are changed (the Share theme currently)

This keeps chatter to a minimum and performance up!