Sun Directory/IDM Blogs

mcraig: Registering Directory Server Enterprise Edition 7.0 With Windows Services

mcraig — Thu, 19 Nov 2009 17:29:02 -0800

This entry covers registering servers and components as Windows Services, so you no longer need to start them by hand on reboot.

Install as described in Installing Directory Server Enterprise Edition 7.0.
Log on as Administrator or a member of the local group of Administrators.

This same procedure also works with dpadm for Directory Proxy instances.

C:\Program Files\Sun\dsee7\bin>dsadm stop C:\DirectoryServer
Directory Server instance 'C:/DirectoryServer' stopped C:\Program Files\Sun\dsee7\bin>dsadm enable-service --type WIN_SERVICE C:\DirectoryServer
Instance C:/DirectoryServer registered in WIN_SERVICE C:\Program Files\Sun\dsee7\bin>dsadm info C:\DirectoryServer
Instance Path: C:/DirectoryServer
Non-secure port: 1389
Secure port: 1636
Bit format: 32-bit
State: Stopped
DSCC url: -
Windows service registration: Enabled
Instance version: D-A10

Do not forget the DSCC Registry instance.

C:\Program Files\Sun\dsee7\bin>dsadm stop ..\var\dcc\ads
Directory Server instance 'C:/Program Files/Sun/dsee7/var/dcc/ads' stopped C:\Program Files\Sun\dsee7\bin>dsadm enable-service --type WIN_SERVICE ..\var\dcc\ads
Instance C:/Program Files/Sun/dsee7/var/dcc/ads registered in WIN_SERVICE

Register your Application Server as a Windows Service.

How to do this depends on your Application Server. With GlassFish this was so easy I have already forgotten.
Register the Common Agent Container as a Windows Service.
```
C:\Program Files\Sun\dsee7\bin>cacaoadm enable --instance default --file pwd.txt
```
The pwd.txt file contains the password of the current user, such as Administrator.

Important Note: As of this writing, Nov. 20, 2009, Sun is still working on an issue with Common Agent Container in DSEE 7.0 that can crash upon system restart. So until there's a service pack for that, you will need to restart the Common Agent Container by hand after reboot.
For belt-and-suspenders style administration, after this works you can also provide the password through the Log On tab of the Properties window for the Common Agent Container service in the Services management console. (Run... services.msc)

nwooler: Twitter, Facebook Hacks Last Week Good Reminders Of Socialmedia Identity Security--Ugggh not Ugg Boots

nwooler — Wed, 18 Nov 2009 02:01:45 -0800

Ugggh....last week we were reminded of how social media platforms are vulnerable to identity security problems. Two colleagues of mine were hacked in the twitter and an add was posted to my facebook account via cross-posting feature in Facebook (I love uggh boots, I just didn't plan on advertising them on my Facebook account. More about this later). One of the powerful aspects of social media sites is the extended conversation that users can have with their friends, colleagues and communities that participate. However, if social media sites don't work more aggressively to thwart security holes in their platforms they will undermine the credibility and trust they have worked hard to gain with the mobile IT generation. This is not a new problem.

The twitter hack is not a new one and in the short term can be rectified by changing one's password immediately. However, with the simplicity of being able to acquire the password there seems to be a problem that the twitter team needs to plug immediately. I have severely restricted my link clicking activities as a result of these vulnerabilities and tell family members not to click links when possible. However, this takes the fun out of getting access to content quickly or participating in events that are happening immediately (e.g. conferences, concerts, etc.).

As for the cross posting via Facebook, first let's talk about what constitutes cross-posting. Cross-posting is a great feature if used properly. It is a way for you to post to wider groups of people and this is useful as communities sometimes do not always overlap. Simply put, it is where a bot or user puts a comment in a blog that has been posted to Facebook or other social media site. Because a trust relationship has been established between the post and social media site comments are "retweeted" to the social media site it has been published.

I have three options to ensure that this does not happen in the future. One, do not post/share blog entries on Facebook; two, remove the trust relationship from Facebook to my blog; three, review all comments before allowing to be published to my blog. All of them are not good options. I will probably choose the third because it allows me to still share my blogs with my friends on Facebook but yet maintain some level of control over what is "retweeted" to my friends. Each of the blogging platforms allows a different level of control and easy access to the social media platforms so investigate and determine which is best for you.

Lastly, here is a quick overview of the top 8 social media hacks as of August, 2009 by Michael Eggebrecht from CIO Zone (thanks for the great picture top left). He outlines the top 8 social media hacks so far (e.g. Koobface, Twittercut, Best Video, etc.). If you are not reading Mashable already then I suggest taking a peruse as they have great coverage of different events and issues associated with this emerging space.

nwooler: NEW!! DSEE 7 Download, Documentation and Upgrade Guide Available Today

nwooler — Tue, 17 Nov 2009 02:15:14 -0800

DSEE 7.0 is available for download today here with new documentation here. The critical document you want to look at is the upgrade and migration guide here.

Directory Server Enterprise Edition 7.0 Boosts Speed and Performance:

Considered one of the best extranet LDAP Directory Servers in the market today, the latest version of Directory Server Enterprise Edition allows enterprises to accelerate growth in a simplified way, improve performance and lower total cost of ownership. Directory Server Enterprise Edition 7.0 has been optimized to improve performance by more than three times when compared to its predecessor. In addition, this release provides innovations that improve authentication and modification performance by 60 percent, allowing customers to accelerate their applications without changing one line of code.

What's New with Directory Server EE 7.0

• Boosts speed and performance: DSEE 7.0 has been optimized to improve performance of some operations by more than 3x the current version. In addition, this release provides hardware optimization with up to 60% improvement in authentications and modifications.
• Reduces Total Cost of Ownership– Reduce cost by using the only solution in the market that provides customers with a directory server, virtual directory, proxy server, web console and Active Directory synchronization tool-kit under a single license.
• Hassle Free Upgrade – DSEE 7.0 provides a simple upgrade path and provides 5x performance improvement in data import times, thereby reducing migration costs.

You can see a webinar we did recently on DSEE 7 and Role Manager 5 on why this release is important to your business and how this can help your company meet growth goals and reduce your total cost of ownership.

Etienne Remillon: Directory Server 7.0 Released: Download and Upgrade today

Etienne Remillon — Tue, 17 Nov 2009 01:49:22 -0800

Sun Directory Server Enterprise Edition 7.0 just released.

The 7.0 release is a new version for Directory Server Enterprise Edition.

Directory Server Enterprise Edition 7.0 allows companies to grow faster and easier. The significant improvement in performance allows companies to accelerate their applications while reducing their total cost of ownership. Companies can reduce cost by improving serviceability with faster import times, new easy upgrade in place, and with the only solution in the market that gives customers a directory server, virtual directory, proxy server, web console and synchronization with Active Directory available all in one license.

This updated release improves overall quality and robustness of deployments. Among other features, by downloading DSEE 7.0 you will get:

Up to 3 time performance improvement
In place upgrade from previous DSEE 6 versions
Reduced disk space and memory footprint
Optional Data compression
Instant Restore capability
Advanced tuning capability
More use cases and increased performances with views through Directory Proxy Server virtual directory capabilities
Improved control over traffic going through Directory Proxy Server
New distribution algorithm with Directory Proxy Server
Updated list of supported Operating Systems as well as IP v6 supported on all platforms
Directory Service Control Center supported on broader list of application servers

Release Notes are available from here. Full documentation is available from here.

Information on Sun Directory Server Enterprise Edition are also available on: www.sun.com/dsee.

You can download Sun Directory Server Enterprise Edition 7.0 software from the following location:

http://www.sun.com/software/products/directory_srvr_ee/get.jsp

The download page serves as a starting point to direct you to the proper downloads depending on the distribution type you need to download.

Directory Server Enterprise Edition 7.0 is available in the following full distributions.

ZIP Full distribution (Solaris, OpenSolaris, Red Hat, SuSE, HP-UX, Windows) - standalone delivery to install Directory Server Enterprise Edition 7.0. For upgrade from 6.x please refer to Installation Guide.

Native SVR4 packages for Solaris. For upgrade from 6.x please refer to Installation Guide.

Identity Synchronization for Windows is not delivered in the Directory Server Enterprise Edition 7.0 distribution and have to be selected from the download page: http://www.sun.com/software/products/directory_srvr_ee/get.jsp

Directory Server Enterprise Edition
Marketing Team

Ludo: OpenDS 2.2.0 Release Candidate 3 is now available

Ludo — Mon, 16 Nov 2009 17:02:03 -0800

The OpenDS development team is very pleased to announce the immediate availability of OpenDS 2.2.0-RC3.

OpenDS 2.2 offers the following new features from OpenDS 2.0 :

Scalable import and indexing
External changelog compliant with the Internet-Draft "Definition of an Object Class to Hold LDAP Change Records", draft-good-ldap-changelog-04.txt
Fractional replication
Extensible matching rules for time base attributes
Support for custom syntaxes based on substitution, regular expressions or enumeration
Remote server management in control panel
Recurrent tasks in control Panel
Default automatic Backup in the control panel
Separation of LDAP Servers and Replication Servers for replication
Ability to merge disjoint replication topologies
Dsconfig script friendly mode

The purpose of the Release Candidate is to solicit one last round of testing before the final release. So please test the OpenDS release with your client applications, in your environment or on your favorite platform.

If you do find a bug, please report it with Issue Tracker.

We welcome feedback. Please report you experience with OpenDS on our mailing lists, or on #opends IRC channel on Freenode.

OpenDS 2.2.0-RC3 is built from revision 6147 of the b2.2 branch of the source tree.

The direct link to download the core server is: http://www.opends.org/promoted-builds/2.2.0-RC3/OpenDS-2.2.0-RC3.zip

The direct link to download the DSML gateway is: http://www.opends.org/promoted-builds/2.2.0-RC3/OpenDS-2.2.0-RC3-DSML.war

We have also updated the archive that may be used to install OpenDS via Java Web Start. You may launch that using the URL http://www.opends.org/promoted-builds/2.2.0-RC3/install/QuickSetup.jnlp, or visit https://www.opends.org/wiki/page/OverviewOfTheQuickSetupTool for more information.

Detailed information about this build is available at http://www.opends.org/promoted-builds/2.2.0-RC3, including the detailed change log

Major changes incorporated since OpenDS 2.2.0-RC2 include:

Revision 6100 (Issue #4337) - Resolves an issue in which importing large LDIF files would consume a lot of disk space
Revision 6102 (Issue #4298) - Fixes a problem with Replication changelog that could grow out of bound
Revisions 6108, 6123 (Issue #4283) - Resolves an issue in the Control Panel when adding operational attributes to an entry
Revision 6109 (Issue #4292) - Changes the Control Panel to abandon the systematic use of the ManageDSAIT Control
Revision 6111 (Issue #4264) - Fixes an issue in the Control Panel when doing multiple modifications on a single entry
Revision 6113 (Issue #4302) - Fixes unexpected errors in the Control Panel Manage Entries screen with concurrent searches
Revision 6117 (Issue #4322) - Provides a way in the Control Panel to rebuild all indexes
Revision 6118 (Issue #4328) - Resolves an issue where the Control Panel would freeze on Ubuntu
Revision 6119 (Issue #4332) - Resolves an issue on Windows with installation path names containing spaces
Revision 6120 (Issue #4269) - Fixes a problem with the External Changelog changenumber not being reset when the database was re-initialized
Revision 6122 (Issue #4296) - Publishes External Changelog base DN in the root DSE entry
Revision 6126 (Issue #4350) - Changes the way replication domain names are created with the dsreplication utility
Revision 6129, 6147 (Issue #4336) - Changes the Control Panel to provide the ability to refresh the suffix and entries in the Manage Entries window
Revision 6131 (Issue #4335) - Fixes the way scrolling works in the Control Panel
Revision 6134 (Issue 4293) - Resolves issues when verifying newly created indexes
Revision 6138 (Issue 4338) - Changes the default Global Access Controls to provide better secure by default permissions for users to update their own entry

Technorati Tags: directory-server, java, ldap, opends, opensource, performance, quality, replication

mcraig: Installing Directory Server Enterprise Edition 7.0

mcraig — Mon, 16 Nov 2009 07:24:22 -0800

This entry takes you through Directory Server Enterprise Edition installation on Windows Server 2008, showing screen shots taken while installing Directory Service Control Center with Directory Server and Directory Proxy Server on a Windows system. I wrote a similar entry for DSEE 6.0 in March 2007.

Downloading Directory Server Enterprise Edition

You can download Directory Server Enterprise Edition 7.0 from http://www.sun.com/software/products/directory_srvr_ee/get1.jsp.

To install Directory Server Enterprise Edition, get the Windows .zip file, DSEE.7.0.Windows-X86-zip.zip.

Note that DSEE 7.0 processes run as 32-bit applications on Windows systems.

Installing Directory Server Enterprise Edition Software

Unpack the .zip file, which contains the idsktune utility, the Microsoft Visual C++ 2008 Redistributable Package, and the sun-dsee7.zip to unpack.
Double-click and install vcredist_x86 if the Microsoft Visual C++ 2008 Redistributable Package is not already installed on the system.
Run the idsktune utility.

Note that if this were a production install, I would need more RAM.
Unpack sun-dsee7.zip where you want to put the software, such as C:\Program Files\Sun.
The .zip contains a dsee7 folder that houses all the files you need to keep.

Note that the files are now installed under C:\Program Files\Sun\dsee7\.

Setting Up Directory Service Control Center Components

Before you can create Directory Server and Directory Proxy Server instances through the DSCC console, you must set up the DSCC console (a web app housed in an application server such as GlassFish, Tomcat, or WebLogic that I expect you to have installed already), and set up the DSCC agent (a local service residing in the Common Agent Container, aka Cacao, that allows you to access servers, in particular to start them when they are stopped, and so forth).

Note that on Windows 2008 if you are not Administrator, you cannot register the DSCC Agent in the Common Agent Container until you set the following Windows registry keys to 0:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA

The procedure below worked with GlassFish v2.1.

Create the dscc7.war file containing the application to deploy.
C:\Program Files\Sun\dsee7\bin>dsccsetup war-file-create
Initialize the DSCC Registry (the Directory Server instance DSCC uses to keep track of managed servers).
C:\Program Files\Sun\dsee7\bin>dsccsetup ads-create
During this step, set and remember the Directory Service Manager password.
Directory Service Manager is the DSCC user who has credentials to handle all managed servers.
Register the DSCC Agent in the Common Agent Container.
C:\Program Files\Sun\dsee7\bin>dsccsetup ads-create
...
Cacao will listen on port 21162
...
Note the port number used by the Common Agent Container.

Add the following permissions to the end of the C:\Program Files\Sun\SDK\domains\domain1\config\server.policy file.

// Permissions for Directory Service Control Center
grant codeBase "file:${com.sun.aas.instanceRoot}/applications/j2ee-modules/dscc7/-"
{ permission java.security.AllPermission;
};

Deploy DSCC.
Login to Directory Service Control Center using the Directory Service Manager password from the previous procedure.
At this point, you should see the DSCC home page.

Creating a Directory Server Instance

Time to create a directory to hold sample data.

Click Create New Directory Server.
Provide the properties needed to create the server, and click Next.
(See the screen shot below for hints.)
Accept the self-signed certificate, and click Next.
Accept the Default Settings, and click Next.
Note that the DSCC Agent Port is the port number provided when the Agent was registered in the previous procedure.

The host name in this case is localhost, since the server is running in VirtualBox on a laptop. (Now you know why I did not give it 4GB RAM ;-)
Click Finish.

Before going further, add a dc=example,dc=com suffix, and import sample data into the Directory Server instance just created.

In DSCC under Directory Server > Suffixes, click New Suffix.
Use the example suffix DN, dc=example,dc=com, and click Next.
Skip replication for now, and click Next.
Choose the localhost:1389 server you created, then click Next.
Accept the Default Settings, and click Next.
Accept the Default Database Location, and click Next.
Select Initialize by Importing Sample Data (160 entries), and click Next.
Read the summary, and click Finish.

Creating a Directory Proxy Server Instance

Next, create a proxy that could be used instead of allowing direct access to the directory.

On the DSCC home page, click Create New Proxy Server.
Provide the properties needed to create the server, and click Next.
(See the screenshot below for hints.)
Accept the Default Settings, and click Next.
Read the summary, and click Finish.

Finally, you can use DSCC to configure the proxy to send requests to the Directory Server instance.

Under the Proxy Servers tab, click localhost:9389.
Under the Routing > Data Sources tab, click New Data Source.
Provide a name, but otherwise accept defaults throughout the Creating New Data Source wizard.
Under the Routing > Data Source Pools tab, click defaultDataSourcePool.
Click Choose Data Sources, and add the new data source you created to the Data Source list.
In each LDAP operation column for the data source, set the weight to 1.
Under Server Operation > Main, click Restart.

Trying It Out

Directory Server Enterprise Edition is delivered with command line tools for accessing the directory service. For example, the ldapsearch tool installed here in C:\Program Files\Sun\dsee7\dsrk\bin, allows you to see that the search functionality is working as expected.

First, search Directory Server on port 1389 to verify the data is there. Then, search through Directory Proxy Server on port 9389 to make sure the proxy is properly configured.

Note that you can now access Directory Server data through Directory Proxy Server, and that you can manage both servers through Directory Service Control Center.

mcraig: Sun Directory Server Enterprise Edition 7.0

mcraig — Mon, 16 Nov 2009 07:23:29 -0800

Congratulations to the DSEE 7.0 team!

Sun Directory Server Enterprise Edition 7.0 released today. You can download the software for your platform at http://www.sun.com/software/products/directory_srvr_ee/get1.jsp.

The documentation should follow shortly at http://docs.sfbay.sun.com/app/docs/coll/1819.1.

nwooler: Directory Server Performance and Cloud Computing

nwooler — Mon, 16 Nov 2009 01:44:47 -0800

I recently attended Gartner IAM in San Diego and the topic of Cloud Computing permeated the titles of presentations throughout the conference. Eric Sachs, from Google gave a good presentation on applying IAM principles to applications in the cloud. RSA talked about network based security detection for companies leveraging the cloud. You might even argue, depending on your definition of the cloud, that Matthew Modica's talk on using Sun Role Manager at Express Scripts was about using role management to help provide better security to cloud based services. However, despite the good content and dialogue it seems that there is still some room for clarification as this space evolves. The one thing that seemed obvious was that performance requirements for IAM infrastructure is going to continue to grow and be tested by this evolving space.

At Sun, we worry about performance requirements every day as our customers push our existing technologies with demanding performance requirements. Directory Server Enterprise Edition with it's more than 10 years of experience in the market has had to deal with cloud based architectures in a number of ways. However, before we talk about how they intersect it is prudent for us to define the different types of clouds (prudent because there is still controversy over the definition of clouds). According to Wikipedia there are three different types of clouds: Public, Hybrid and Private.

Directory Server Enterprise Edition (DSEE) provides infrastructure for companies that primarily use private and hybrid clouds. In both the private and hybrid environments, these cloud based architectures reside in large enterprises using Directory Server to provide an authentication service for a portal and collaboration platforms for customer, employees and partner's. Additionally, Telco's and service providers have used DSEE to provide the identity backbone for private and hybrid clouds. In these deployments DSEE is used as the access and authentication layer and OpenSSO as the single-sign-on, federation or web services security layer. However, the most common use case that we see today is enterprises using DSEE as the identity backbone for the hybrid cloud environment. This is where companies are using federation or web services security on top of Directory Services to leverage Public Cloud services to extend the services they offer customers, employees and partners.

At the very least these architectures in cloud computing are pushing performance beyond traditional levels. This is also why we have seen a resurgence in interest in Directory Services. The Directory Server and specifically Sun's Directory Server Enterprise Edition provides proven performance that enterprises can rely on as they build, experiment and deploy these new services. We continue to push our existing products and new versions of the product to get the best performance out of the platform. Terry Gardner, building off the great work Brad Diggs has done, recently published an example of this in his blog post to report performance results on a 13,800,000 user Directory using DSEE 5.2, Solaris 10 Update 7 using ZFS and Sun Netra x4250. The deployment provided some impressive performance results below (taken from Terry's Blog here):

8,000 searches per second with simultaneous updates
maximum 800 milliseconds for any single search
minimum 70% CPU utilization (usr+sys)

As DSEE 7 is available for download today (here) with 3x performance improvements it is worth remembering the strong foundation and history DSEE 7 follows. I look forward to sharing with you over the next several months the performance figures of proven deployments as customers use DSEE 7. These future architectures that drive performance whether they be to serve private or hybrid clouds or critical enterprise collaboration platforms will continue to drive us at Sun to produce the best proven performance directory server on the planet.

nwooler: Identity in Healthcare Webinar Nov. 18

nwooler — Fri, 13 Nov 2009 02:24:16 -0800

The Sun Identity Management team will be giving a webinar next Wednesday to discuss the very important topic of Identity Management and healthcare. As the healthcare legislation moves through congress the increase of 36M patients on healthcare providers, insurance companies, and patients will be profound. The cost savings projected by the bills will rely on IT systems to provide increased access to information to drive productivity gains. As we have seen with recent high profile identity security breeches at hospitals identity security is critical in making sure the right people have access to the appropriate information, that information must be shared with all members of the value chain securely.

Sun's Identity Management Suite provides a powerful package of solutions to help with storing identity information with Directory Server Enterprise Edition; managing authorization, federation and web services security with OpenSSO; providing provisioning solutions with Identity Manager; and, defining and managing role based access control with Role Manager.

Join this free Webinar to learn how Sun's identity management solutions can help your organization to:

Automate management of digital identities for other providers, patients, physicians, clinicians, and payors Provide single sign-on (SSO) and secure federated access to privacy-regulated healthcare information while adhering to strict mandates
Enable delegated, self-service password management
Comply with the Health Insurance Portability and Accountability Act (HIPAA), internal security policies, and corporate governance policies with complete auditing and reporting capabilities

Sun identity management solutions make it easier for healthcare organizations to manage and share digital information.

Topic:	Topic: Sun Webinar Series - Identity Management for Healthcare
Date:	Wednesday, November 18, 2009
Time:	10:00 am PDT / 1:00 pm EDT / 19.00 CET (check my timezone)
Duration:	1 hour
Speaker:	Sun Product Manager Suresh Sridharan

nwooler: Webinar: Identity Management and Healthcare

nwooler — Fri, 13 Nov 2009 02:22:32 -0800

Join this free Webinar to learn how Sun's identity management solutions can help your organization to:

Automate management of digital identities for other providers, patients, physicians, clinicians, and payors Provide single sign-on (SSO) and secure federated access to privacy-regulated healthcare information while adhering to strict mandates
Enable delegated, self-service password management
Comply with the Health Insurance Portability and Accountability Act (HIPAA), internal security policies, and corporate governance policies with complete auditing and reporting capabilities

Sun identity management solutions make it easier for healthcare organizations to manage and share digital information.

Topic:	Topic: Sun Webinar Series - Identity Management for Healthcare
Date:	Wednesday, November 18, 2009
Time:	10:00 am PDT / 1:00 pm EDT / 19.00 CET (check my timezone)
Duration:	1 hour
Speaker:	Sun Product Manager Suresh Sridharan

Ludo: OpenDS in Polish

Ludo — Fri, 13 Nov 2009 00:59:13 -0800

Pavel Heimlich just announced today, on the project users mailing list that the OpenDS project is now (partly) localized in Polish. Translation of the messages for the command line tools has been contributed by 2 members of the Polish OpenDS Community : Bartłomiej Pelc and Marek Roszkowski. Many thanks from the development team to both of you.

This is the 6th localization of OpenDS that is shipping. Other languages are still work in progress : Italian, Serb, Portuguese, Korean... If you want to contribute, it's easy: Join the project as a Contributor, and create your account of the Community Translation Interface. The project is currently named OpenDS 2.3easy (it's a subset of the whole OpenDS messages, leaving out the server error messages).

The Polish translation files are available in the latest daily build. If you want to turn of Polish localization or try some other language, check the tip for enabling / disabling specific language. If you find any problem with the translations, please let us know. You can either file an issue in the Issue Tracker, or send an email on the localization and internationalization mailing list : g11n (at) opends.dev.java.net.

Technorati Tags: directory-server, ldap, localization, opends, opensource

nwooler: SAVE THE DATE: NY User Group Identity Management Dec. 2

nwooler — Thu, 12 Nov 2009 01:56:14 -0800

SAVE THE DATE - Wednesday, December 2, 2009
Sun Identity Management User Group Session
Grammercy Park Room
Sun Microsystems, 101 Park Avenue, New York, NY

The Sun Identity Management User Group will meet for its next session at Sun Microsystems, 101 Park Avenue, New York, NY on Wednesday, December 2, 2009.

We are still finalizing the agenda and we will publish in this blog as soon as it is ready.

Here are a couple of pictures from a user group in London. Etienne is doing the presentation on Directory Server.

nwooler: NY Identity User Group December 2

nwooler — Thu, 12 Nov 2009 01:54:17 -0800

SAVE THE DATE - Wednesday, December 2, 2009
Sun Identity Management User Group Session
Grammercy Park Room
Sun Microsystems, 101 Park Avenue, New York, NY

The Sun Identity Management User Group will meet for its next session at Sun Microsystems, 101 Park Avenue, New York, NY on Wednesday, December 2, 2009.

We are still finalizing the agenda and I will publish in this blog as soon as it is ready.

Here are a couple of pictures from a user group in London. Etienne is doing the presentation on Directory Server.

Ludo: OpenDS Silent install

Ludo — Mon, 09 Nov 2009 16:01:16 -0800

One of the things we're the most proud of in the OpenDS project is the simplicity of installation and initial configuration, thanks to the Java Web Start QuickSetup installer. We say that you can download, install and configure OpenDS to run on your machine in less than 3 minutes and 6 clicks.
But OpenDS can also be downloaded as a Zip and installed with the setup program, which can be either graphical or in command line and even used in silent mode.
The OpenDS community is often full of resources and Lucas Rockwell pointed out to his script for downloading and installing OpenDS automatically. I've taken the liberty to improve his idea and show it here :

#!/bin/sh

# This is the OpenDS version number to install
VER=2.2.0-RC2

# Download with curl or wget, uncomment the preferred download method
curl -O http://www.opends.org/promoted-builds/${VER}/OpenDS-${VER}.zip
# wget -nd http://www.opends.org/promoted-builds/${VER}/OpenDS-${VER}.zip

unzip OpenDS-${VER}.zip

cd OpenDS-${VER}/

# Some possible option change :
# Replace -d 20 (generate sample data with 20 entries) with -a (create
# top entry) or -l <ldifFile> (load data from the LDIF file)
# Change -w "secret12" with -j /tmp/me/passwordfile to avoid hardcoded
# cleartext password
# Add -O to avoid starting the server after install
# Add -Q for a quiet install
# ./setup --help for more information on options
./setup --cli -n -b "dc=example,dc=com" -d 20 -p 1389 \
--adminConnectorPort 4444 -D "cn=Directory Manager" \
-w "secret12" -q -Z 1636 --generateSelfSignedCertificate

As you can see, it's really trivial and it does the work from a few seconds to a few minutes depending on the speed of your internet connection.
The script can be downloaded here.
Have fun !

Technorati Tags: directory-server, java, ldap, opends, opensource

nwooler: Google Dashboard and Identity Security

nwooler — Fri, 06 Nov 2009 00:46:17 -0800

This week Google launched a new service called Google Dashboard which can be found in the account settings in top right hand corner under "personal settings". The service is a great idea for a couple of reasons. One, it served as a reminder (at least to this user) of all the services that I had actually signed-up for from Google over the years. Which given the pace of their innovation and continuous beta approach and my propensity to try new things in the technology space was quite a few. The second reason and arguably the most important was that it offered you the link to go and manage your privacy settings from the dashboard to the services you have subscribed. This is critical and important for those customers and users that are interested in actively managing their identity at Google. Here are the reasons why!

In the world of Web 2.0, Mashups and Federation business's are constantly stitching together different applications to provide value to customer's and consumer's. Organization's need to give user's control of their privacy setting's to allow them to control what information they share when and where on the internet. Most user's don't mind providing the information or more likely are unaware of what they are sharing. This is why the Google Dashboard feature is a powerful tool for user's to improve their security. The ability to access these privacy setting's existed in each of the services that Google offered. However, as I mentioned above, I had forgotten about all the different services I had signed up for within Google Land. This consolidation in one spot, gave me information, power and most importantly choice in one spot making my ability to make better decisions about how my identity is managed on the internet.

Facebook has learned this lesson and has done a lot to put the power in user's hands of controlling how applications user their information. I applaud what they have done to provide not only the tools but the education to users about what that privacy information actually means. You can join the Facebook Security Fan Page to get updates on different steps they are taking to improve the choices users have to manage their identity data. Another great step they have taken is also in the user experience they provide users in the pages that manage services and privacy by providing contextual help for users. Big improvements that contribute to better user decision making.

Click here and go check out your dashboard.

nwooler: Identity Learning Labs at Gartner IAM, Nov. 9-11

nwooler — Wed, 04 Nov 2009 01:21:54 -0800

Next week, Nov. 9-11, the Identity Management Team travels down to Gartner Identity Access Management conference to showcase two of our latest releases DSEE 7 and Role Manager 5. Gartner IAM is a great event because it not only gather's together experienced practitioners in the identity management space but has a number of events that are small enough that you can have quality conversations about real problems. Last year, Verizon presented at this conference on the Directory and OpenSSO implementation that serves 50M users. The presentation is a great example of the proven expertise that Sun brings to Identity Management and the proven extranet scale our products can support---not a marketing benchmark.

publisherID=1460825906">

Our team has taken a different approach to this even this year and we are participating in Gartner's Learning Lab's. Vendors, customer's and identity specialists are encouraged to come-by in a classroom style and learn about specific problem's Sun's product, partner's and customer's are doing to solve their identity business problems. This is crucial today as the cost of failure or doing nothing rises exponentially. The best way to ensure success is to learn from real-world implementations not marketing based slideware presentations. This is why we have assembled not just the product teams but partners and real customer's to share their experience in these "learning labs".

The other great thing about Gartner IAM is that there are usually a few different ways to combine great industry expertise and a little fun. On Tuesday, Nov. 10 at 9:00pm you can meet the Sun Identity team at the Hard Rock Rooftop bar for drinks and conversation. The first 50 people get a wristband for free drinks. Identity management isn't hard so come to the Hard Rock to find out how to make it easy!

Gartner IAM Sun Schedule

Monday, Nov 9th

Learning Lab:

12:40 - 1:05pm “Increase Speed & Performance while reducing TCO with Sun Directory Server Enterprise Edition” Speaker: Nick Wooler, Sr Product Manager – Sun Microsystems

1:05 - 1:30pm “Changing the Rules of the game; Raising the bar with Rule Life-cycle Management and closed-loop remediation” Speaker: Neil Gandhi, Sr Product Manager – Sun Microsystems

1:35 - 2:00pm "IAM Governance, Risk and Compliance -- the future of IAM", Speaker: Sachin Nayyar, President - BrinQa

2:05 - 2:30pm "Enterprise Single Sign On for Sun Identity Management", Speaker: Stephane Fymat, VP of Strategy and Product Management - Passlogix

Sun Booth:

12:30 - 2:30pm Daniel Raskin showcasing OpenSSO

12:30 - 2:30pm Mat Hamlin showcasing Identity Manager

Tuesday, Nov 10^th

Learning Lab:

12:10 - 12:35pm “Role based user provisioning; using business roles for identity life-cycle management and identity auditing”, Speaker: Mat Hamlin, Sr Product Manager, Sun Microsystems

12:35 - 1:00pm “Three tough challenges, one powerful solution: OpenSSO for web access management, federation and Web services security”, Speaker: Daniel Raskin, Chief Identity Strategist – Sun Microsystems

1:05 - 1:30pm "Privileged Identity Risk Management: Mitigating the Insider Threat", Speaker: Richard Weeks, VP of Channels and Business Development, Cyber-Ark

1:35 - 2:00pm "The WHO behind the WHAT: Arcot Authentication and Sun OpenSSO Enterprise " Speaker: R 'Doc' Vaidhyanathan, Chief Product Officer - Arcot

Sun Booth:

12:00 - 2:00pm Nick Wooler, showcasing DSEE

12:00 - 2:00pm Neil Ghandi, showcasing Role Manager

nwooler: Gartner IAM, Nov. 9-11: Identity Management Isn't Hard

nwooler — Wed, 04 Nov 2009 01:19:14 -0800

publisherID=1460825906">

Our team has taken a different approach to this even this year and we are participating in Gartner's Learning Lab's. Vendors, customer's and identity specialists are encouraged to come-by in a classroom style and learn about specific problem's Sun's product, partner's and customer's are using to solve their identity business problems. This is crucial today as the cost of failure or doing nothing rises exponentially. The best way to ensure success is to learn from real-world implementations not marketing based slideware presentations. This is why we have assembled not just the product teams but partners and real customer's to share their experience in these "learning labs".

Gartner IAM Sun Schedule

Monday, Nov 9th

Learning Lab:

12:40 - 1:05pm “Increase Speed & Performance while reducing TCO with Sun Directory Server Enterprise Edition” Speaker: Nick Wooler, Sr Product Manager – Sun Microsystems

1:05 - 1:30pm “Changing the Rules of the game; Raising the bar with Rule Life-cycle Management and closed-loop remediation” Speaker: Neil Gandhi, Sr Product Manager – Sun Microsystems

1:35 - 2:00pm "IAM Governance, Risk and Compliance -- the future of IAM", Speaker: Sachin Nayyar, President - BrinQa

2:05 - 2:30pm "Enterprise Single Sign On for Sun Identity Management", Speaker: Stephane Fymat, VP of Strategy and Product Management - Passlogix

Sun Booth:

12:30 - 2:30pm Daniel Raskin showcasing OpenSSO

12:30 - 2:30pm Mat Hamlin showcasing Identity Manager

Tuesday, Nov 10^th

Learning Lab:

12:10 - 12:35pm “Role based user provisioning; using business roles for identity life-cycle management and identity auditing”, Speaker: Mat Hamlin, Sr Product Manager, Sun Microsystems

1:05 - 1:30pm "Privileged Identity Risk Management: Mitigating the Insider Threat", Speaker: Richard Weeks, VP of Channels and Business Development, Cyber-Ark

1:35 - 2:00pm "The WHO behind the WHAT: Arcot Authentication and Sun OpenSSO Enterprise " Speaker: R 'Doc' Vaidhyanathan, Chief Product Officer - Arcot

Sun Booth:

12:00 - 2:00pm Nick Wooler, showcasing DSEE

12:00 - 2:00pm Neil Ghandi, showcasing Role Manager

nwooler: Farewell to a Directory Hero

nwooler — Mon, 02 Nov 2009 03:00:31 -0800

This weekend the Directory Community said goodbye to a true hero, Don Bowen. Many on the Directory Team at Sun had the pleasure of working with Don and will miss his energy and enthusiasm for life, technology and his family. Our condolences go out to his family. We will miss you Don!

You can read more or leave a comment for his family here!

mcraig: Sun Identity Manager With OpenDS 2.2

mcraig — Tue, 27 Oct 2009 17:37:00 -0700

As Ludo mentions in his announcement about RC 1 for OpenDS 2.2, this release adds external changelog access. Directory applications access the changelog to follow what updates are happening to directory data, and so find the changelog useful when aiming to stay synchronized.

Rob Byrne, who has been stitching together big identity deployments for the last few years, writes about how Sun Identity Manager seems to work fine with the OpenDS changelog, just as it does with the Sun Directory Server changelog. Rob hasn't tested every case, but it looks promising.

Ludo: What's new in Sun Directory Server Enterprise Edition 7 ?

Ludo — Fri, 23 Oct 2009 00:03:43 -0700

Did you attend the event I talked about last week ? Remember, it was a webinar about Sun DSEE 7 and Role Manager 5.
Well, if you could not attend the webinar, you can watch it now, or download the video. The slides are also available.
Enjoy.

Technorati Tags: directory-server, ldap

nwooler: What's New In Directory Server Enterprise Edition 7?

nwooler — Thu, 22 Oct 2009 02:30:28 -0700

Yesterday, Neil Ghandi, Matt Hamlin, Etienne Remillon and Nick Wooler gave a quick overview of what is new in Directory Server Enterprise Edition 7 and Role Manager 5. Here are just a few of the great highlights that were discussed during the presentation. Of course, you can get the full video embeded below. Lastly, if you are interested in seeing more events like this you can go to the webinar site here.

You can download the slides here. You can download the video here.

nwooler: What's New In Directory Server Enterprise Edition 7?

nwooler — Thu, 22 Oct 2009 02:28:13 -0700

Yesterday, Neil Ghandi, Matt Hamlin, Etienne Remillon and I gave a quick overview of what is new in Directory Server Enterprise Edition 7 and Role Manager 5. Here are just a few of the great highlights that were discussed during the presentation. Of course, you can get the full video embeded below. Lastly, if you are interested in seeing more events like this you can go to the webinar site here.

You can download the slides here. You can download the video here.

Ludo: Enumeration based attributes in LDAP

Ludo — Mon, 19 Oct 2009 16:28:20 -0700

Yesterday I've explained how to restrict LDAP attribute values using Regular Expression based syntaxes, with the OpenDS directory server. There is another use case for restricting attribute values: when there is an enumerated list of possible values. It's possible to define finite list of values as a regular expression, but as we wanted to be able to provide additional values, we added in OpenDS the ability to define Enumeration based syntaxes, and we implemented it as a syntax definition extension as well.

Here's an example of use of an Enumeration syntax for the day of the week. Let's first define and load the syntax in the OpenDS directory server's schema :

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':
dn: cn=schema
changetype: modify
add: ldapsyntaxes
ldapSyntaxes: ( 1.3.6.1.4.1.32473.4 DESC 'Day Of The Week'
X-ENUM ( 'monday' 'tuesday' 'wednesday' 'thursday'
'friday' 'saturday' 'sunday' ) )

Processing MODIFY request for cn=schema
MODIFY operation successful for DN cn=schema
^D

Let's use the syntax in an attribute, itself used in an object classes:

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':

dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.32473.5 NAME 'test-attr-enum'
SYNTAX 1.3.6.1.4.1.32473.4 )
-
add: objectclasses
objectclasses: ( 1.3.6.1.4.1.32473.6 NAME 'testOCenum' SUP top
AUXILIARY MUST test-attr-enum)
-

Processing MODIFY request for cn=schema
MODIFY operation successful for DN cn=schema
^D

Let's create a test entry :

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':
dn: cn=TestEntry,dc=example,dc=com
changetype: add
sn: TestEntry
cn: TestEntry
objectclass: Person

Processing ADD request for cn=TestEntry,dc=example,dc=com
ADD operation successful for DN cn=TestEntry,dc=example,dc=com
^D

And now, let's make use of the newly created schema objects with that test entry :

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':
dn: cn=TestEntry,dc=example,dc=com
changetype: modify
add: objectclass
objectclass: testOCenum
-
add: test-attr-enum
test-attr-enum: monday

Processing MODIFY request for cn=TestEntry,dc=example,dc=com
MODIFY operation successful for DN cn=TestEntry,dc=example,dc=com
^D

But if the value isn't part of the enumeration, it gets rejected :

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':

dn: cn=TestEntry,dc=example,dc=com
changetype: modify
replace: test-attr-enum
test-attr-enum: Lundi

Processing MODIFY request for cn=TestEntry,dc=example,dc=com
MODIFY operation failed
Result Code: 21 (Invalid Attribute Syntax)
Additional Information: When attempting to modify entry cn=TestEntry,dc=example,dc=com to replace the set of values for attribute test-attr-enum, value "Lundi" was found to be invalid according to the associated syntax: The provided value "Lundi" cannot be parsed because it is not allowed by enumeration syntax with OID "1.3.6.1.4.1.32473.4"
$

The enumeration syntaxes, like the regular expression one, matches like a DirectoryString, that is matches using CaseIgnoreMatch equality rule.

$ bin/ldapsearch -p 1389 -D cn=directory\ manager -w secret12 \
-b "dc=example,dc=com" '(test-attr-enum=Monday)'

dn: cn=TestEntry,dc=example,dc=com
objectClass: Person
objectClass: top
objectClass: testOCenum
test-attr-enum: monday
cn: TestEntry
sn: TestEntry

But the biggest advantage of the Enumeration syntax is the ability to use Ordering match, which is not based on strings, but on the order of the enumerated values in the syntax definition. So "Monday" is lower than "Tuesday" which is lower than "Wednesday"...

$ bin/ldapsearch -p 1389 -D cn=directory\ manager -w secret12 \
-b "dc=example,dc=com" '(test-attr-enum<=Thursday)'

dn: cn=TestEntry,dc=example,dc=com
objectClass: Person
objectClass: top
objectClass: testOCenum
test-attr-enum: monday
cn: TestEntry
sn: TestEntry

I hope you will find this useful and make use of these syntaxes. To do so, you need to download and install OpenDS 2.2 Release Candidate 1 (or higher).
And if you have additional requirements with syntaxes, I'd be happy to hear about them.

Technorati Tags: directory-server, java, ldap, opends, opensource

Etienne Remillon: Beta Class for "Directory Server Enterprise Edition 7.0 Maintenance and Operations Class"

Etienne Remillon — Mon, 19 Oct 2009 03:30:22 -0700

Sun Learning Services will be holding a beta class for Sun Directory Server Enterprise Edition (Directory Server EE) 7.0 Administration training in San Francisco, CA, from Tuesday, December 1 through Friday, December 4, 2009. Tuition is waived and there will be no charge for your valued partnership in this review. However, participants are responsible for travel expenses, lodging and incidentals.

This course provides students with the opportunity to learn to perform routine maintenance and troubleshooting techniques, monitor and tune servers, create and manage multiple databases, and perform other tasks encountered in day-to-day operations of Directory Server EE 7.0.

Labs acquaint students with the tools included with Directory Server EE. Students should use them to perform tasks such as searching and modifying directory data, exporting and importing data, starting and stopping servers, and troubleshooting. Students should also migrate server versions, create multiple databases, configure servers for replication, and tune
performance.

This course focuses on maintenance and operations issues related to Directory Server EE rather than planning and design issues. For planning and design topics, refer to DIR-2217: Sun Java(TM) System Directory Server Enterprise Edition: Analysis and Planning. If you are already extremely familiar with Directory Server EE, this course probably covers topics you are already familiar with.

We are looking for attendees who will provide a lot of feedback about the class and how we can improve it. We want students who will ask a lot of difficult and annoying questions that we can't answer, do the labs and make them break, and beat up on the product.

PLEASE READ CAREFULLY: If you have specific in-depth needs, such as heavy-duty performance tuning or analysis, planning, and architecture, please be advised that this class will NOT meet those needs. If you are new or somewhat new to the product, and need to know how to install and administer the product, use the command-line interface and Directory Server Control Center console, use the logs, and know a little about directory proxy server, this class will be will be an ideal introduction.

PLEASE NOTE: We require a passing level of familiarity with LDAP concepts, such as DN, DIT, RDN, search filter, and base DN. We will not have time to cover basic LDAP concepts during this beta course. You also need to know how to use the Solaris OS (or Linux) command line.

Our classroom space in San Francisco is extremely limited and we will very likely be unable to accommodate all who are interested. Apologies in advance if we cannot accept your enrollment.

If you're interested in attending, please contact David Goldsmith (David.Goldsmith@sun.com) for more information.

mcraig: Free Webinar: New Sun Role Manager and Sun Directory Server Enterprise Edition

mcraig — Sun, 18 Oct 2009 19:27:36 -0700

Last Oct. 21, Neil Gandhi and Nick Wooler offered a Webinar for you on improving compliance, access control, and performance with Sun's latest releases of Role Manager and Directory Server Enterprise Edition.

The presentation is available at https://slx.sun.com/limelight/filevault/1179275769/0/RM5_DSEE7_Customer_Webinar_Presentation_v5.pdf.

Some Q&A are covered in an additional file at https://slx.sun.com/limelight/filevault/1179275769/3/DSRM_Q_A.pdf.

Ludo: Regular Expression based attributes in LDAP

Ludo — Sun, 18 Oct 2009 17:26:33 -0700

One of the question that I get frequently asked when discussing with customers or coworkers about defining custom schema and attributes, is how to restrict the values that can be set to an attribute. From a pure LDAP standard point of view, you would need to define a new syntax and describe the valid values. Then you would need to check with the directory server's vendor or discuss with the open source developers to get the syntax implemented in the server, either in the core product, or as a plug-in extension. In the end, the easy choice goes to use a standard syntax (like DirectoryString) and let all client applications validate the values.

In OpenDS, we've choose another option. We have added support for regular expression based syntaxes, and implemented this as a syntax definition extension.

So in order to define, for example, an attribute whose values must be in the form of host:port, you simply need to define a new syntax for it with the regular expression pattern and load it in the server's schema:

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':
dn: cn=schema
changetype: modify
add: ldapsyntaxes
ldapSyntaxes: ( 1.3.6.1.4.1.32473.1
DESC 'Host and Port in the format of HOST:PORT'
X-PATTERN '^[a-zA-Z][.a-zA-Z0-9-]+:[0-9]+$' )

Processing MODIFY request for cn=schema
MODIFY operation successful for DN cn=schema
^D

And then you can make use of the newly defined syntax in attributes.

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':
dn: cn=schema
changetype: modify
add: attributetypes
attributetypes: ( 1.3.6.1.4.1.32473.2 NAME 'test-attr-regex' SYNTAX 1.3.6.1.4.1.32473.1 )
-
add: objectclasses
objectclasses: ( 1.3.6.1.4.1.32473.3 NAME 'testOCregex' SUP top AUXILIARY MUST test-attr-regex)
-

Processing MODIFY request for cn=schema
MODIFY operation successful for DN cn=schema
^D

Let's create a test entry

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':
dn: cn=TestEntry,dc=example,dc=com
changetype: add
sn: TestEntry
cn: TestEntry
objectclass: Person

Processing ADD request for cn=TestEntry,dc=example,dc=com
ADD operation successful for DN cn=TestEntry,dc=example,dc=com
^D

And now make use of this new attribute and objectclass:

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':

dn: cn=TestEntry,dc=example,dc=com
changetype: modify
add: objectclass
objectclass: testOCregex
-
add: test-attr-regex
test-attr-regex: localhost:1389
-

Processing MODIFY request for cn=TestEntry,dc=example,dc=com
MODIFY operation successful for DN cn=TestEntry,dc=example,dc=com
^D

$ bin/ldapmodify -D cn=directory\ manager -p 1389
Password for user 'cn=directory manager':
dn: cn=testentry,dc=example,dc=com
changetype: modify
replace: test-attr-regex
test-attr-regex: foobar.com

Processing MODIFY request for cn=testentry,dc=example,dc=com
MODIFY operation failed
Result Code: 21 (Invalid Attribute Syntax)
Additional Information: When attempting to modify entry cn=testentry,dc=example,dc=com to replace the set of values for attribute test-attr-regex, value "foobar.com" was found to be invalid according to the associated syntax: The provided value "foobar.com" cannot be parsed as a valid regex syntax because it does not match the pattern "^[a-zA-Z][.a-zA-Z0-9-]+:[0-9]+$"

It's simple and efficient. But wait there's more to come, tomorrow.

Technorati Tags: directory-server, java, ldap, opends, opensource

nwooler: Register for Webinar: What's New in DSEE 7 and Role Manager 5

nwooler — Fri, 16 Oct 2009 01:59:43 -0700

Sun's Identity Team have been busy over the summer! On Oct. 9, 2009 the Identity Management Team announced the release of Directory Server Enterprise Edition 7 and Role Manager 5. Next Wednesday, Oct. 21 at 8:00am PT, Neil Ghandi (Role Manager Technical Product Manager) and Nick Wooler (Product Line Manager, Directory Services) will be giving an overview of some of the great features that exist in the new releases. Here are a couple of highlights:

What's New with Directory Server EE 7.0

• Boosts speed and performance: DSEE 7.0 has been optimized to improve performance of some operations by more than 3x the current version. In addition, this release provides hardware optimization with up to 60% improvement in authentications and modifications.
• Reduces Total Cost of Ownership– Reduce cost by using the only solution in the market that provides customers with a directory server, virtual directory, proxy server, web console and Active Directory synchronization tool-kit under a single license.
• Hassle Free Upgrade – DSEE 7.0 provides a simple upgrade path and provides 5x performance improvement in data import times, thereby reducing migration costs.

What's New with Role Manager 5.0

• 360 Degree View of Assigned Access – A unified view of data related to user access that empowers reviewers to make more intelligent decisions concerning users access.
• Closed-loop Remediation – A complete end-to-end solution for reviewing user access and removing inappropriately assigned access.
• Rule Life-cycle Management – The first solution for managing the complete life-cycle of role assignment and SoD audit rules.

Interested in hearing more? Interested in hearing more about the release and what business problems it solves for your enterprise? Register here for the Webinar here:

Topic: Improve Compliance, Access Controls, and Performance with Sun's Latest Releases of Role Manager and DSEE

Date: Wednesday, October 21, 2009

Time: 10:00 am PDT / 1:00 pm EDT / 19.00 CET (check my timezone)

Duration: 1 hour

Speaker:
Sun Product Managers: Neil Gandhi and Nick Wooler

Registration::
Register Here

Ludo: A Must Event : "What's new in DSEE 7 and Role Manager 5" webinar !

Ludo — Fri, 16 Oct 2009 01:56:47 -0700

On Wednesday October 21, 2009 at 8:00am PST, Nick Wooler, product manager for Directory Services, and Neil Ghandi, Role Manager Technical Product Manager will be giving an overview of some of the great features that exist in the new releases of Sun Directory Server Enterprise Edition and Sun Role Manager.
Here are a few highlights:

What's New with Directory Server EE 7.0

Boosts speed and performance: DSEE 7.0 has been optimized to improve performance of some operations by more than 3x the current version. In addition, this release provides hardware optimization with up to 60% improvement in authentications and modifications.
Reduces Total Cost of Ownership– Reduce cost by using the only solution in the market that provides customers with a directory server, virtual directory, proxy server, web console and Active Directory synchronization tool-kit under a single license.
Hassle Free Upgrade – DSEE 7.0 provides a simple upgrade path and provides 5x performance improvement in data import times, thereby reducing migration costs.

What's New with Role Manager 5.0

360 Degree View of Assigned Access – A unified view of data related to user access that empowers reviewers to make more intelligent decisions concerning users access.
Closed-loop Remediation – A complete end-to-end solution for reviewing user access and removing inappropriately assigned access.
Rule Life-cycle Management – The first solution for managing the complete life-cycle of role assignment and SoD audit rules.

Register now for the webinar and you will learn more about the releases and what business problems they solve in your enterprise.

Webinar
Improve Compliance, Access Controls, and Performance with Sun's Latest Releases of Role Manager and DSEE
Wedneday October 21, 2009
10:00am PDT / 1:00pm EDT / 19:00 CET
One Hour

Technorati Tags: directory-server, ldap, software, Sun, training

nwooler: Register for Webinar: What's New in DSEE 7 and Role Manager 5

nwooler — Fri, 16 Oct 2009 01:55:52 -0700

Sun's Identity Team have been busy over the summer! On Oct. 9, 2009 the Identity Management Team announced the release of Directory Server Enterprise Edition 7 and Role Manager 5. Next Wednesday, Oct. 21 at 8:00am PT, Neil Ghandi (Role Manager Technical Product Manager) and I will be giving an overview of some of the great features that exist in the new releases. Here are a couple of highlights:

What's New with Directory Server EE 7.0

• Boosts speed and performance: DSEE 7.0 has been optimized to improve performance of some operations by more than 3x the current version. In addition, this release provides hardware optimization with up to 60% improvement in authentications and modifications.
• Reduces Total Cost of Ownership– Reduce cost by using the only solution in the market that provides customers with a directory server, virtual directory, proxy server, web console and Active Directory synchronization tool-kit under a single license.
• Hassle Free Upgrade – DSEE 7.0 provides a simple upgrade path and provides 5x performance improvement in data import times, thereby reducing migration costs.

What's New with Role Manager 5.0

• 360 Degree View of Assigned Access – A unified view of data related to user access that empowers reviewers to make more intelligent decisions concerning users access.
• Closed-loop Remediation – A complete end-to-end solution for reviewing user access and removing inappropriately assigned access.
• Rule Life-cycle Management – The first solution for managing the complete life-cycle of role assignment and SoD audit rules.

Interested in hearing more? Interested in hearing more about the release and what business problems it solves for your enterprise? Register here for the Webinar here:

Ludo: Tip on OpenDS localization and error messages...

Ludo — Thu, 15 Oct 2009 00:37:37 -0700

The OpenDS LDAP directory server is localized by default in many different languages, thanks to our community.
All (well we try) messages from the client tools, command lines or graphical, are translated in Chinese (Simplified and Traditional), German, French, Japanese, Korean and Spanish (and soon Polish). But the server error messages are also localized, and the OpenDS directory server picks up the current locale of the process owner to choose in which language to print them.
Not everyone wants to have the server error messages in their own language, especially in distributed or international teams. There is a way to make sure the server always uses English as the language for the message, regardless of who starts it, and it's very simple (thanks to Josu for reminding me how to do it ;) ):

Edit the java.properties file (from the config/ directory) and append the following to the start-ds.java-args line:

-Duser.language=en -Duser.country=US

Example:

start-ds.java-args=-server -Xms128m -Xmx256m -Duser.language=en -Duser.country=US

Now run the dsjavaproperties command and restart the server.

Et voila ! All in English.

Technorati Tags: directory-server, java, ldap, localization, opends, opensource, tip

Ludo: OpenDS 2.2.0 Release Candidate 1 is now available

Ludo — Tue, 13 Oct 2009 01:32:59 -0700

The OpenDS development team is very pleased to announce the immediate availability of OpenDS 2.2.0-RC1 which is the first release candidate for OpenDS 2.2.

OpenDS 2.2 offers the following new features from OpenDS 2.0 :

Scalable import and indexing
External changelog compliant with the Internet-Draft "Definition of an Object Class to Hold LDAP Change Records", draft-good-ldap-changelog-04.txt
Fractional replication
Extensible matching rules for time base attributes
Support for custom syntaxes based on substitution, regular expressions or enumeration
Remote server management in control panel
Recurrent tasks in control Panel
Default automatic Backup in the control panel
Separation of LDAP Servers and Replication Servers for replication
Ability to merge disjoint replication topologies
Dsconfig script friendly mode

We've also captured a first snapshot of the OpenDS 2.2 documentation and hosted it on it's own wiki: https://docs.opends.org/2.2/. The documentation is not complete yet, but will be almost at the same time we will do the final release of OpenDS 2.2.

If you do find a bug, please report it with Issue Tracker.

We welcome feedback. Please report you experience with OpenDS on our mailing lists, or on #opends IRC channel on Freenode.

OpenDS 2.2.0-RC1 is built from revision 5941 of our source tree.

The direct link to download the core server is: http://www.opends.org/promoted-builds/2.2.0-RC1/OpenDS-2.2.0-RC1.zip

The direct link to download the DSML gateway is: http://www.opends.org/promoted-builds/2.2.0-RC1/OpenDS-2.2.0-RC1-DSML.war

We have also updated the archive that may be used to install OpenDS via Java Web Start. You may launch that using the URL http://www.opends.org/promoted-builds/2.2.0-RC1/install/QuickSetup.jnlp, or visit https://www.opends.org/wiki/page/OverviewOfTheQuickSetupTool for more information.

Detailed information about this build is available at http://www.opends.org/promoted-builds/2.2.0-RC1, including the detailed change log

Major changes incorporated since OpenDS 2.1.0-build002 include:

Revisions 5870, 5888 (Issue #4181) - Resolves a Null pointer exception in DSML Gateway with specific substring search filters
Revision 5871 (Issue #4217) - Fixes an issue with ACI containing parenthesis in the description field
Revision 5874 - Improves the rebuild-index processing for performances
Revision 5880 (Issue #4252) - Fixes a replication issue between OpenDS 2.1/2.2 and OpenDS 2.0
Revision 5883 (Issue #4203) - Fixes an issue where restore -l (list the available backups) would exit with return code 1
Revision 5926 (Issue #4257) - Fixes an error raised when deleting recurrent tasks

Technorati Tags: directory-server, java, ldap, opends, opensource, performance, quality, replication

tgardner: Link to 13,800,000 entry DS52p6 benchmark yields 17,000 searches per second on x4250

tgardner — Mon, 05 Oct 2009 20:06:17 -0700

I've posted the results of a Directory Server 5.2 patch 6 benchmark on my wordpress blog. highlights:

Sun Netra x4250
13 millions of entries
Sun Directory Server 5.2 patch 6
ZFS
Solaris 10 update 7
17,000 searches per second

Ludo: Directory "Engineering"

Ludo — Sun, 04 Oct 2009 22:50:25 -0700

Arnaud a co-worker from the Sun directory engineering team, has taken the term "Directory Engineering" to a new level. Arnaud has always been a doer, someone who starts playing with things, investigate, test, benchmark... Recently, he's been deploying OpenDS on Amazon cloud, configuring a Sun workstation running OpenSolaris with 4 displays in Xinerama mode and much more...

But in the past few weeks, Arnaud started to play with hardware devices like USB Bit Whacker, a few lines of codes, his favorite server product and finally built this :

The OpenDS Weather Station, provides a dashboard of the important metrics from an OpenDS server, showing instantaneously how loaded is the server.
Arnaud already has 3 Stations in order (I and other members of our team want one for demo purpose), but I'm not sure he's ready to accept orders from other people and turn this into another business :)
Anyway, this is a nice little engineering project !

Technorati Tags: directory-server, engineering, java, ldap, opends

arnaud: A Dashboard Like No Other: The OpenDS Weather Station

arnaud — Sat, 03 Oct 2009 11:28:02 -0700

Rationale

Doing so many benchmarks, profiling and other various performance related activities, I had to find a way to "keep an eye" on things while fetching emails, chatting on IM and the like. Having some experience in past projects with microcontrollers, although on Windows, I figured I could put together a little gizmo to help me keep tabs on my Directory Server.

Bird's Eye View

This is basically a simple setup with a USB Bit Whacker controlled by a Python script, feeding it data crunched from various sources, mainly the Directory Server access log, the garbage collection log and kstats... the result is a useful dashboard where I can see things happen at a glance.

The Meat

Everything starts with the USB Bit Whacker. It's a long story, but to cut short, a couple a years ago, Kohsuke Kawaguchi put together an orb that could be used to monitor the status of a build / unit tests in Hudson. Such devices are also know as eXtreme Feedback Devices or XFDs. Kohsuke chose to go with the USB Bit Whacker (UBW) for it is a USB 'aware' microcontroller that also draws power from the bus, and is therefore very versatile while remaining affordable ($25 soldered and tested from sparkfun but you can easily assemble your own). A quick search will tell you that this is a widely popular platform for hobbyists.

On the software side, going all java would have been quite easy except for the part where you need platform specific libraries from the serial communication. Sun's javacomm library or rxtx have pros and cons but in my case, the cons were just too much of a hindrance. What's more, I am not one to inflict myself pain unless it is absolutely necessary. For that reason, I chose to go with Python. While apparently not as good on cross-platformedness compared to Java, installing the Python libraries for serial communication with the UBW is trivial and has worked for me right off the bat on every platform I have tried, namely: Mac OS, Linux and Solaris. For example, on OpenSolaris all there is to it is:

$ pfexec easy_install-2.4 pySerial
Searching for pySerial
Reading http://pypi.python.org/simple/pySerial/
Reading http://pyserial.sourceforge.net/
Best match: pyserial 2.4
Downloading http://pypi.python.org/packages/source/p/pyserial/pyserial-2.4.tar.gz#md5=eec19df59fd75ba5a136992897f8e468
Processing pyserial-2.4.tar.gz
Running pyserial-2.4/setup.py -q bdist_egg --dist-dir /tmp/easy_install-Y8iJv9/pyserial-2.4/egg-dist-tmp-WYKpjg
setuptools
zip_safe flag not set; analyzing archive contents...
Adding pyserial 2.4 to easy-install.pth file

Installed /usr/lib/python2.4/site-packages/pyserial-2.4-py2.4.egg
Processing dependencies for pySerial
Finished processing dependencies for pySerial

that's it! Of course, having easy_install is a prerequisite. If you don't, simply install setuptools for your python distro, which is a 400kB thing to install. You'll be glad you have it anyway.

Then, communicating with the UBW is mind boggingly easy. But let's not get ahead of ourselves, first things first:

Pluging The USB Bit Whacker On OpenSolaris For The First Tim

The controller will appear as a modem of the old days and communicating with equates to sending AT commands. For those of you who are used to accessing Load Balancers or other network equipment through the serial port, this is no big deal.

In the screenshot below, the first ls command output shows that nothing in /dev/term is an actual link, however, the second -which I issued after plugging the UBW on the usb port- shows a new '0' link has been created by the operating system.

Remember which link your ubw appeared as for our next step: talking to the board.

Your First Python Script To Talk To The UBW

I will show below how to send the UBW the 'V' command which instructs it to return the firmware version, and we'll see how to grab the return value and display it. Once you have that down, the sky is the limit. Here is how:

from serial import *
ubw = Serial("/dev/term/0")
ubw.open()
print "Requesting UBW Firmware Version"
ubw.write("V\n")
print "Result=["+ubw.readline().strip() + "]\n"
ubw.close()

Below is the output for my board:

Voila!

That really is all there is to it, you are now one step away from your dream device. And it really is only a matter of imagination. Check out the documentation of current firmware to see what commands the board supports and you will realize all the neat things you can use it for: driving LEDs, Servos, LCD displays, acquiring data, ...

Concrete Example: The OpenDS Weather Station

As I said at the beginning of this post, my initial goal was to craft a monitoring device for OpenDS. Now you have a good idea of how I dealt with the hardware part, but an image is worth a thousand words so here is a snap...

On the software front, well, being a software engineer by trade, that was the easy part so that's almost not fun and I won't go inot as much detail but here is a 10,000ft view:

data is collected in a matrix of hash tables.
each hash table represent a population of data points for a sampling period
an individual time thread pushes a fresh list of hash tables in the matrix so as to reset the counters for a new sampling period

So for example, if we want to track CPU utilization, we only need to keep one metric. The hash table will only have one key pair. Easy. Slightly overkill but easy. Now if you want to keep track of transactions response times, the hash table will keep the response time (in ms) as a key and the number of transactions that were processed in that particular response time as the associated value. Therefore, if you have within one sampling period, 10,000 operations processed with 6,000 in 0 ms, 3,999 in 1ms and 1 in 15 ms, your hashtable will only have 3 entries as follows: [ 0 => 6000; 1=>3999; 15=>1 ]

This allows for a dramatic compression of the data compared to having a single line with etime for each operation, which would result in 10,000 lines of about 100 bytes.

What's more is that this representation of the same information allows to easily compute the average, extract the maximum value and calculate the standard deviation.

All that said, the weather station is only sent the last of the samples, so it always shows the current state of the server. And as it turns out, it is very useful, I like it very much just the way it worked out.

Well, I'm glad to close down the shop, it's 7:30pm .... another busy Saturday

arnaud: A Dashboard Like No Other: The OpenDS Weather Station

arnaud — Sat, 03 Oct 2009 11:28:02 -0700

Rationale

Bird's Eye View

The Meat

that's it! Of course, having easy_install is a prerequisite. If you don't, simply install setuptools for your python distro, which is a 400kB thing to install. You'll be glad you have it anyway.

Then, communicating with the UBW is mind boggingly easy. But let's not get ahead of ourselves, first things first:

Pluging The USB Bit Whacker On OpenSolaris For The First Tim

Remember which link your ubw appeared as for our next step: talking to the board.

Your First Python Script To Talk To The UBW

from serial import *
ubw = Serial("/dev/term/0")
ubw.open()
print "Requesting UBW Firmware Version"
ubw.write("V\n")
print "Result=["+ubw.readline().strip() + "]\n"
ubw.close()

Below is the output for my board:

Voila!

Concrete Example: The OpenDS Weather Station

On the software front, well, being a software engineer by trade, that was the easy part so that's almost not fun and I won't go inot as much detail but here is a 10,000ft view:

data is collected in a matrix of hash tables.
each hash table represent a population of data points for a sampling period
an individual time thread pushes a fresh list of hash tables in the matrix so as to reset the counters for a new sampling period

This allows for a dramatic compression of the data compared to having a single line with etime for each operation, which would result in 10,000 lines of about 100 bytes.

What's more is that this representation of the same information allows to easily compute the average, extract the maximum value and calculate the standard deviation.

Well, I'm glad to close down the shop, it's 7:30pm .... another busy Saturday

arnaud: Note To Self: Things To Do On A Vanilla System

arnaud — Fri, 02 Oct 2009 14:59:09 -0700

I just thought I'd make a note of the common things I do and funny enough, I think this blog might be the closest thing I have from a sticky note / persistent backup ... so here goes:

PATH=/usr/bin:/usr/sbin:/usr/gnu/bin:$PATH
# enable power management
pfexec echo "S3-support enable" >> /etc/power.conf
pfexec pmconfig
pfexec svcadm restart hal

# disable access time update on rpool to minimize disk writes
pfexec zfs set atime=off rpool

# get pkgutil to install community software
pfexec pkgadd -d http://blastwave.network.com/csw/pkgutil_`uname -p`.pkg

# download and install the flash plug-in for firefox
wget http://fpdownload.macromedia.com/get/flashplayer/current/flash_player_10_solaris_x86.tar.bz2 -O libfp.tar.bz2 --no-check-certificate
bunzip2 libfp.tar.bz2
tar xf libfp.tar
pfexec mv flash_player*/libflashplayer.so /usr/lib/firefox/plugins
rm libfp.tar
rmdir flash_player*

# get perfbar
wget http://blogs.sun.com/partnertech/resource/tools/perfbar.i386 -O perfbar --no-check-certificate
chmod 755 perfbar
nohup ./perfbar &

# configure coreadm
coreadm -g /var/cores/%t-%f -e global

arnaud: Note To Self: Things To Do On A Vanilla System

arnaud — Fri, 02 Oct 2009 14:59:09 -0700

I just thought I'd make a note of the common things I do and funny enough, I think this blog might be the closest thing I have from a sticky note / persistent backup ... so here goes:

arnaud: Quad Monitor With Rotation: Where There Is A Will, There Is A Way

arnaud — Fri, 02 Oct 2009 06:30:56 -0700

Talking with a friend recently, he told me about his miserable experience trying to get his workstation to work with four monitors.

Now, I was surprised at first because there are lots (ok, maybe not lots, but a sizeable number) of people with quad-head workstations out there, so obviously that seems rather doable. The trick in his case seemed to be heterogeneity: 2 different dual-head cards, and 4 different monitors of different brands and sizes. Additionally, he wanted one of his widescreens tilted in portrait mode for his coding. Nice for browsing as well, but he wanted to be able to have a tall IDE to see more code at once without the need to scroll.

It took me a while just to get the equipment but to find some spare time to this as well. I ended up with the following:

a desktop that would lend itself to the experiment
4 dual head videos cards to test combinations

4 monitors

a free Saturday (that was actually the most difficult component to find)

To cut short, the result is ... rolling drum ... it _can_ work once you know what to do and what not to. Here is the final result:

So how do we make that work? Well, first thing is NOT to desperately cling to TwinView. You have to let go of that, fall back on good ol' XineRama which does a fine job anyway.

As I said in my previous post, rotating the monitor is only a matter of adding Option "Rotate" "left" in the relevant screen section.

For all the X options explained, I found this quite useful. Dig in there.

What you want to be careful about:

if at first both cards are not recognized, worry not. Go to a terminal and issue the following command:

pfexec nvidia-xconfig -a

This will force the nvidia config utility to look across all cards.

Note that if this still doesn't work, issue:

pfexec scanpci

and write down the PCI id for each card. It is the first number right after the pci bus 0x002. In this example, this would translate into

BusID "PCI:2:0:0"

in the device section in xorg.conf

look at your /var/log/Xorg.0.log for errors

you will see something like

(II) LoadModule: "xtsol"
(WW) Warning, couldn't open module xtsol
(II) UnloadModule: "xtsol"
(II) Failed to load module "xtsol" (module does not exist, 0)

Don't worry, that's a trusted solaris extension that is hardcoded to be loaded by X even when it's not a trusted solaris OS running, this has yet to be fixed.

make sure to enable Composite

make sure to enable GLX with composite

make sure to enable RandRRotation

Check /var/adm/messages for IRQ collisions which could result in some funky discrepancies. If you find any, tweak your BIOS to force each PCI slot to a distinct IRQ. The message would look similar to:

unix: [ID 954099 kern.info] NOTICE: IRQ16 is being shared by drivers with different interrupt levels

All that said, here is an example of xorg.conf with a single monitor tilted, and everything working pretty well considering that nothing is matched. It does work but doesn't come for free as you can see. There is one drawback however, I have not been able to make Compiz work because apparently the cards would have to have an SLI link between them, but I haven't confirmed that for sure. That's it for today folks!

arnaud: Quad Monitor With Rotation: Where There Is A Will, There Is A Way

arnaud — Fri, 02 Oct 2009 06:30:56 -0700

Talking with a friend recently, he told me about his miserable experience trying to get his workstation to work with four monitors.

It took me a while just to get the equipment but to find some spare time to this as well. I ended up with the following:

a desktop that would lend itself to the experiment
4 dual head videos cards to test combinations

4 monitors

a free Saturday (that was actually the most difficult component to find)

To cut short, the result is ... rolling drum ... it _can_ work once you know what to do and what not to. Here is the final result:

So how do we make that work? Well, first thing is NOT to desperately cling to TwinView. You have to let go of that, fall back on good ol' XineRama which does a fine job anyway.

As I said in my previous post, rotating the monitor is only a matter of adding Option "Rotate" "left" in the relevant screen section.

For all the X options explained, I found this quite useful. Dig in there.

What you want to be careful about:

if at first both cards are not recognized, worry not. Go to a terminal and issue the following command:

pfexec nvidia-xconfig -a

This will force the nvidia config utility to look across all cards.

Note that if this still doesn't work, issue:

pfexec scanpci

and write down the PCI id for each card. It is the first number right after the pci bus 0x002. In this example, this would translate into

BusID "PCI:2:0:0"

in the device section in xorg.conf

look at your /var/log/Xorg.0.log for errors

you will see something like

(II) LoadModule: "xtsol"
(WW) Warning, couldn't open module xtsol
(II) UnloadModule: "xtsol"
(II) Failed to load module "xtsol" (module does not exist, 0)

Don't worry, that's a trusted solaris extension that is hardcoded to be loaded by X even when it's not a trusted solaris OS running, this has yet to be fixed.

make sure to enable Composite

make sure to enable GLX with composite

make sure to enable RandRRotation

Check /var/adm/messages for IRQ collisions which could result in some funky discrepancies. If you find any, tweak your BIOS to force each PCI slot to a distinct IRQ. The message would look similar to:

unix: [ID 954099 kern.info] NOTICE: IRQ16 is being shared by drivers with different interrupt levels

arnaud: OpenSolaris 2010.02 on EeePC 1000: Out-Of-The-Box!!!

arnaud — Fri, 02 Oct 2009 04:11:50 -0700

As usual, I try to give as much away in my titles as I can. This one is no different: it just works....

With 2009.06, you needed to build your own drivers for ethernet and wifi. Pretty much a non starter for 99% of users, understandably so: when it just works for Linux and Windows, why sweat it on OpenSolaris ?

Now that dilemma is behind us: I installed an early access of 2010.02 (OpenSolaris b124) and when the installation was done, everything worked: a whole new experience for me on OpenSolaris. I almost EXPECT to have to fiddle with a driver, a config file, an SMF service that doesn't start, ..., something.

In this case: nothing! Simultaneously gratifying and almost disappointing. I mean, even on my desktop OpenSolaris required some elbow grease to work the way I wanted, but in this case, the coveted prize of a functional system would be handed to me without even the hint of a fight ? ... unusual, to say the least.

And that's good. I used to say that Solaris is the certainly best server OS and just as certainly the worst desktop OS, but this one shot has me wondering... maybe the Sun engineers have covered some of the ground that separates OpenSolaris from Linux. Granted, there's still ways to go! Yes the embedded 1.3 Mega Pixels webcam works but the quality of the picture is perfectible and I don't think it is the hardware... to be fair, Sun has to write their own drivers for everything so I'm even surprised it worked at all, so that pretty good!

Now there is on rather big bummer though...it does suspend but doesn't resume. Pretty big issue for a laptop which is -because of its form factor- bound to be used on the go. If I can make it work, I will post here. If you have had success make resume work, drop me a line!

arnaud: OpenSolaris 2010.02 on EeePC 1000: Out-Of-The-Box!!!

arnaud — Fri, 02 Oct 2009 04:11:50 -0700

As usual, I try to give as much away in my titles as I can. This one is no different: it just works....

arnaud: Lenovo W700ds dual monitor laptop: works! Another 2010.02 success

arnaud — Fri, 02 Oct 2009 04:05:41 -0700

OpenSolaris 2010.02 early access build 124 is really faring pretty well so far. It isn't free of issues, granted, but at the same time, it has improved leaps and bounds on laptop support, especially for netbooks, thanks to a passionate and dedicated team writing up a bunch of device drivers for wifi and network cards found in these little laptops.

Today, I installed build 124 on a Lenovo W700ds.

You probably have never heard of that beast because they probably only sold half a dozen of them, one of which landed on my desk yesterday. The main reason for this success is probably that it weighs a ton (11 lbs or 5 Kgs!!!) due in part to its main 17" monitor, doubled by a netbook-like 10" monitor that slides out from behind the main one.... here are the specs. Notice they call it "portable power". Trasnportable would be more accurate. After using this laptop for about an hour now (I'm writing this post on it), I do have to say that it is quite fantastically comfortable, just about as much a desktop would be...not really surprising if you consider it has a full size keyboard + numeric keypad.

So, OpenSolaris installs without a glitch, once again the installer just does its job without whining. If you run the device driver utility it will notify you that two devices do not have a driver for solaris, one being the integrated bluetooth card and the other being the fingerprint reader. Not a big deal. Once OpenSolaris is installed, it will boot in Gnome just as on any other machine, but what you really want is the second monitor to work... and there's a trick to that.

First, the second monitor won't be recognized if you don't pull it all the way out at boot time. Took me a while to figure this one out. To save some mW, the Lenovo folks don't power it unless it's out and that makes it undetectable at first.

Second, once recognized by X, it will actually display sideways. This "companion" display is actually is 16:9 10" netbook display tilted right so that it's width resolution (1280x768) almost matches the height resolution of the main display (1920x1200). So all we have to do is to tilt it "left" to compensate for the hardware arrangement. To do so, simply enable the Rotate and Resize option on the graphics card and then tell X to rotate the appropriate screen left. Here's how:

Section "Monitor"

    # HorizSync source: edid, VertRefresh source: edid
    Identifier     "SlideOut"
    VendorName     "Lenovo"
    ModelName      "LEN 2nd Display"
    HorizSync       30.0 - 75.0
    VertRefresh     60.0
    Option         "DPMS"
    Option         "Rotate" "left"
EndSection

Section "Device"
    Identifier     "Device1"
    Driver         "nvidia"
    VendorName     "NVIDIA Corporation"
    BoardName      "Quadro FX 2700M"
    BusID          "PCI:1:0:0"
    Screen          1
    Option       "RandRRotation"   "on"
EndSection

Note that TwinView must be disabled because twinview aggregates both display into a single block. Rotation with twinview on will result in rotate both displays. So you need to make them two X displays and enable xinerama.

here is the final xorg.conf in case you're interested...

Additional notes:

Suspend/Resume works great with this laptop -most of the time- however, it seems that sometimes, you will lose the second display upon resume, I'm not sure why.

arnaud: Lenovo W700ds dual monitor laptop: works! Another 2010.02 success

arnaud — Fri, 02 Oct 2009 04:05:41 -0700

Today, I installed build 124 on a Lenovo W700ds.

here is the final xorg.conf in case you're interested...

Additional notes:

Suspend/Resume works great with this laptop -most of the time- however, it seems that sometimes, you will lose the second display upon resume, I'm not sure why.

Ludo: OpenSSO Community changes

Ludo — Wed, 30 Sep 2009 17:05:55 -0700

I just saw that my colleague Hubert Le Van Gong has been elected to replace Pat Patterson as the OpenSSO Community Lead.
It is sad to see Pat leaving Sun. Pat has been a source of inspiration in my role as OpenDS Community Manager and we've been collaborating in numerous occasions.
Hubert definitely has the skills and the experience to lead the OpenSSO community and oversee all Sun Identity related open source projects. Another good thing is that Hubert and I are both working out of the Grenoble Engineering Center, in France. So I'm expecting some tighter collaborations between the projects and the communities.
Welcome on the community leadership side, Hubert !

Technorati Tags: java, opensource, opensso

Ludo: OpenDS 2.1.0-build002 is now available

Ludo — Wed, 30 Sep 2009 01:16:12 -0700

We have just uploaded OpenDS 2.1.0-build002, built from revision 5868 of our source tree, to our promoted builds folder.

The direct link to download the core server is: http://www.opends.org/promoted-builds/2.1.0-build002/OpenDS-2.1.0-build002.zip

The direct link to download the DSML gateway is: http://www.opends.org/promoted-builds/2.1.0-build002/OpenDS-2.1.0-build002-DSML.war

We have also updated the archive that may be used to install OpenDS via Java Web Start. You may launch that using the URL http://www.opends.org/promoted-builds/2.1.0-build002/install/QuickSetup.jnlp, or visit https://www.opends.org/wiki/page/OverviewOfTheQuickSetupTool for more information.

Detailed information about this build is available at http://www.opends.org/promoted-builds/2.1.0-build002, including the detailed change log

Major changes incorporated since OpenDS 2.1.0-build001 include:

Multiple fixes to the new Import code and new Public ChangeLog feature.
Revision 5783 (Issue #4171) - Fixes a hang in replica initialization when the replication servers are unreachable.
Revision 5804 - Performance and scalability improvements with monitoring.
Revision 5842 (Issue #4194) - Resolves an issue where objectclasses would disappear when modified.
Revision 5843 - Upgrade the underlying Berkeley DB JE to version 3.3.87.
Revision 5847 (Issue #4164) - Fixes a decoding problem .
Revision 5848 (Issue #4229) - Resolves an issue where the connection handler thread hangs and cause potential DoS attack.
Revision 5849 (Issue #4226) - Improves the PartialDateOrTime matching rule to match on time as well as date.
Revision 5854 (Issue #4240) - Resolves an issue in the Control-Panel when displaying attributes with a syntax that has no name.
Revision 5863 & 5867 (Issue #4117) - Resolves an issue with MODDN operation that could impact ability to export and reimport from LDIF.
Revision 5865 (Issue #4060) - Prevents a new server process to start while OpenDS server is shutting down. Also preserves the server.pid when in-core restart is performed.

Technorati Tags: directory-server, java, ldap, opends, opensource, performance

arnaud: OpenDS in the cloud on Amazon EC2

arnaud — Tue, 29 Sep 2009 16:39:51 -0700

Rationale

Why not run your Authentication service in the cloud? This is the first step to having a proper cloud IT. There are numerous efforts going to ease deploying your infrastructure in the cloud, from Sun and others, from OpenSSO to glassfish, from SugarCRM to Domino, and on goes the list. Here is my humble contribution for OpenDS.

Bird's Eye View

Tonight I created my EC2 account and got OpenDS going on the Amazon infrastructure in about half an hour, I will retrace my steps here and point out some of the gotchas.

The Meat

Obviously, some steps must be taken prior to installing software.

First, you need an AWS (Amazon Web Services) account with access to EC2 (Elastic Compute Cloud) and S3 (Simple Storage Service). I will say this about EC2, it is so jovially intoxicating that I would not be surprised to be surprised by my first bill when it comes... but that's good, right? At least for amazon it is, yes.

Then you need to create a key pair, trivial as well. Everything is explained in the email you receive upon subscription.

Once that's done, you can cut to the chase and log on to the AWS management console right away to get used to the concepts and terms used in Amazon's infrastructure. The two main things are an instance and a volume. The names are rather self explanatory, the instance is a running image of an operating system of your choice. The caveat is that if shut it down, the next time you start this image, you will be back to the vanilla image. Think of it as a LiveCD. Can't write persistent data to it, if you do, it won't survive a power cycle.

To persist data between cycles, we'll have to rely on volumes for now. Volumes are just what they seem to be, only virtual. You can create and delete volumes at will, of whatever size you wish. Once a volume is created and becomes available, you need to attach it to your running instance in order to be able to mount it in the host operating system. CAUTION: look carefully at the "availability zone" where your instance is running, the volume must be created in the same zone or you won't be able to attach it.

Here's a quick overview of the AWS management console with two instances of OpenSolaris 2009.06 running. The reason I have two instances here is that one runs OpenDS 2.0.0 and the other runs DSEE 6.3 :) -the fun never ends-. I'll use it later on to load OpenDS.

My main point of interest was to see OpenDS perform under this wildly virtualized environment. As I described in my previous article on OpenDS on Acer Aspire One, virtualization brings an interesting trend in the market that is rather orthogonal to the traditional perception of the evolution of performance through mere hardware improvements...

In one corner, the heavy weight telco/financial/pharmaceutical company weighing in at many millions of dollars for a large server farm dedicated to high performance authentication/authorization services. Opposite these folks, the ultra small company curled in the other corner, looking at every way to minimize cost in order to simply run the house while allowing to grow the supporting infrastructure as business ramps up.

Used to be quite the headache, that. I mean it's pretty easy to throw indecent amounts of hardware at meeting crazy SLAs. Architecting a small, nimble deployment yet able to grow later? Not so much. If you've been in this business for some time, you know that every iteration of sizing requires to go back to capacity planning and benchmarking which is too long and too costly most of the time. That's where the elastic approaches can help. The "cloud" (basically, hyped up managed hosting) is one of them.

Our team also has its own, LDAP-specific, approach to elasticity, I will talk about that in another article, let's focus on our "cloud" for now.

Once your instance is running, follow these simple steps to mount your volume and we can start talking about why EC2 is a great idea that needs to be developed further for our performance savvy crowd.

In this first snapshot, I am running a stock OpenDS 2.0.0 server with 5,000 standard MakeLDIF entries. This is to keep it comparable to the database I used on the netbook. Same searchrate, sub scope, return the whole entry, across all 5,000.

If this doesn't ring a bell? Check out the Acer article. Your basic EC2 instance has about as much juice as a netbook. Now the beauty of it all is that all it takes on my part to improve the performance of that same OpenDS server is to stop my "small" EC2 instance and start a medium one.

Voila!

I've got 2.5 times the initial performance. I did not change ONE thing on OpenDS, this took 3 minutes to do, I simply restarted the instance with more CPU. I already hear you cry out that it's a shame we can't do this live -it is virtualization after all- but I'm sure it'll come in due course. It is worth noting that even though I could use 80+% of CPU on the small instance of OpenDS, in this case I was only using about 60% so the benefit would likely be greater but I would need more client instances. This imperfect example still proves the point on the ease of use and the elasticity aspect.

The other thing that you can see coming is an image of OpenDS for EC2. I'm thinking it should be rather easy to script 2 things:

1) self-discovery of an OpenDS topology and automatic hook up in the multi master mesh and

2) snapshot -> copy -> restore the db, almost no catch up to do data wise. If you need more power, just spawn a number of new instances: no setup, no config, no tuning. How about that ?

Although we could do more with additional features from the virtualization infrastructure, there is already a number of unexplored options with what is already there. So let's roll up our sleeves and have a serious look. Below is a snapshot of OpenDS modrate on the same medium instance as before with about 25% CPU utilization. As I said before, this thing has had NO fine tuning whatsoever so these figures are with the default, out-of-the-box settings.

I would like to warmly thank Sam Falkner for his help and advice and most importantly for teasing me into trying EC2 with his FROSUG lightning talk! That stuff is awesome! Try it yourself.

arnaud: OpenDS in the cloud on Amazon EC2

arnaud — Tue, 29 Sep 2009 16:39:51 -0700

Rationale

Bird's Eye View

Tonight I created my EC2 account and got OpenDS going on the Amazon infrastructure in about half an hour, I will retrace my steps here and point out some of the gotchas.

The Meat

Obviously, some steps must be taken prior to installing software.

Then you need to create a key pair, trivial as well. Everything is explained in the email you receive upon subscription.

Our team also has its own, LDAP-specific, approach to elasticity, I will talk about that in another article, let's focus on our "cloud" for now.

Voila!

The other thing that you can see coming is an image of OpenDS for EC2. I'm thinking it should be rather easy to script 2 things:

1) self-discovery of an OpenDS topology and automatic hook up in the multi master mesh and

2) snapshot -> copy -> restore the db, almost no catch up to do data wise. If you need more power, just spawn a number of new instances: no setup, no config, no tuning. How about that ?

I would like to warmly thank Sam Falkner for his help and advice and most importantly for teasing me into trying EC2 with his FROSUG lightning talk! That stuff is awesome! Try it yourself.

arnaud: Tracking Down All Outliers From Your LDAP Servers ...

arnaud — Tue, 29 Sep 2009 05:18:37 -0700

Rationale

I was recently faced with the challenge to track down and eliminate outliers from a customer's traffic and I had to come up with some some of tool to help in diagnosing where these long response time transactions originated from. Not really rocket science -hardly anything IS rocket science, even rocket science isn't all that complicated, but I digress- yet nothing that I had in the tool box would quite serve the purpose. So I sat down and wrote a tool that would allow me to visually correlate events in real time. At least that was the idea.

Bird's Eye View

This little tool is only meant for investigations and we are working on delivering something better and more polished (code name Gualicho, shhhhhhh) for production monitoring. The tool I am describing in this article simply correlates the server throughput, peak etime, I/O, CPU, Network and Garbage Collection activity (for OpenDS). It is all presented in a sliding line metric, stacked on top of each other, making visual identification and correlation easy. Later on I will adapt the tool to work on DPS, since it is the other product I like to fine tune for my customers.

The Meat

When pointed to the access log and the GC log, here is the text output you get. There is one line per second that is displayed with the aggregated information collected from the access log and garbage collection as well as kstats for network, I/O, CPU.

If you looked at it closely, I represented the garbage collection in % which is somewhat unsual but after debating on how to make this metric available, I decided that all I was interested was a relative measure of the time spent in stop-the-world GC operations over the time the application itself is running. As I will show in the snapshot below, this is quite effective to spot correlations with high etimes in most cases. To generate this output in the GC log, all you have to do is add the following to your set of JAVA_ARGS for start-ds.java-args in /path/to/OpenDS/config/java.properties:

-Xloggc:/data/OpenDS/logs/gc.log -XX:+PrintGCApplicationConcurrentTime -XX:+PrintGCApplicationStoppedTime

And then my GUI will show something like:

Don't hesitate to zoom in on this snapshot. The image is barely legible due to blog formatting constraints.

Excuse me if I have not waited 7+ days to take the snapshot for this article but I think this simple snap serves the purpose. You can see that most of the time we spend 2% of the time blocked in GC but sometimes we have spikes up to 8% and when this happens, even though it has little impact on the overall throughput over one second, the peak etime suddenly jumps to 50ms. I will describe in another article what we can do to mitigate this issue, I simply wanted to share this simple tool here since I think it can serve some of our expert community.

arnaud: Tracking Down All Outliers From Your LDAP Servers ...

arnaud — Tue, 29 Sep 2009 05:18:37 -0700

Rationale

Bird's Eye View

The Meat

-Xloggc:/data/OpenDS/logs/gc.log -XX:+PrintGCApplicationConcurrentTime -XX:+PrintGCApplicationStoppedTime

And then my GUI will show something like:

Don't hesitate to zoom in on this snapshot. The image is barely legible due to blog formatting constraints.

arnaud: OpenDS on Acer Aspire One: Smashing!

arnaud — Tue, 29 Sep 2009 03:48:57 -0700

Rationale

As far fetched as it may seem, with the growing use of virtualization and cloud computing, the average image instance that LDAP authentication systems are having to run on look more like your average netbook than a supercomputer. With that in mind, I set out to find a reasonable netbook to test OpenDS on. I ended up with an Acer Aspire ONE with 1GB of RAM. Pretty slim on memory. Let's see what we can get out of that thing!

Bird's Eye View

In this rapid test I have done, I loaded OpenDS (2.1b1) with 5,000 entries (stock MakeLdif template delivered with it), hooked up the netbook to a closed GigE network and loaded it from a corei7 machine with searchrate. Result: 1,300+ searches per second. Not bad for a machine that only draws around 15 Watts!

The Meat

As usual, some more details about the test but first a quick disclaimer: this is not a proper test or benchmark of the Atom as a platform, it is merely a kick in the tires. I have not measured other metrics than the throughput and only for a search workload at that. It is only to get a "feel" of it on such a lightweight sub-notebook.

In short:

Netbook: Acer Aspire One ZG5 - Atom N270 @1.6GHz, 1GB RAM, 100GB HDD
OS: OpenSolaris 2009.05
FS: ZFS
OpenDS: all stock, I did not even touch the JAVA options which I usually do
JAVA: 1.6 Update 13

The little guy in action, perfbar shows the CPU is all the way up there with little headroom...

Topic:	Improve Compliance, Access Controls, and Performance with Sun's Latest Releases of Role Manager and DSEE
Date:	Wednesday, October 21, 2009
Time:	10:00 am PDT / 1:00 pm EDT / 19.00 CET (check my timezone)
Duration:	1 hour
Speaker:	Sun Product Managers: Neil Gandhi and Nick Wooler
Registration::	Register Here