« November 2004 | Main | January 2005 »

December 31, 2004

Federated Identity and Single sign-on

For quite some time we have been setting up a federated identity system for single sign on web apps at work.

The way it works is that whenever you access a web app and you are not authenticated, you get redirected to a login server. There you can choose which intranet you belong to. You click on you intranet name, you authenticate there, and then you are redirected back to the original web app you where trying to access. From then on, you can access to all the other web apps that use the same system without further authentication steps. Authorization is also managed by the system based on profile information provided by each intranet about the user.

This works very well and allows for distributed management of permissions of each user, but with centralized enforcement.

Some weeks ago I found out about Shibboleth. It does exactly the same thing, so I'm looking into using their code and replace all our half-baked solution. If you are interested in this kind of stuff, check out OpenSAML and Ping Identity for commercial solutions with open source code.

Anyway, when I was reading through the shibboleth docs, I started to think that since I use my powerbook, I've been doing single sign on almost in every app I use and website I visit without all this fuss about setting up a federated identity system.

The system Keychain of Mac OS X is a great solution. It stores all my login/passwords for apps, sites, ssh keychains, and x.509 certificates I use for mail. It really works well, and I feel a lot more secure knowing that all my "stuff" is in my personal computer, where I'm the only one responsible for backups (which I do almost every week... :) ).

Kudos, Apple.

December 30, 2004

darcs2rss now at 0.5

Real life has kept me from posting what's going on at simplicidade.

I just sent a mail to darcs mailing list announcing version 0.5. I switched to a proper XML::Parser and added command line options to change RSS metadata.

In my personal copy I have two big changes: - generating RSS 2.0; - filtering comments: current filters are 'simple' and 'markdown'.

Both these features are optional, of course.

I really like markdown and I'm using it more and more everywhere, so this is mostly a feature that I use a lot and I needed fast. But to use HTML formating in your item descriptions, you need to move to RSS 2.0.

In order to do that I'll have to deal with meta-information. Using command line parameters is not such a good idea. My current script to generate a feed for darcs2rss itself is 4 lines long! I'll have to code support for a config file.

Will see.

About darcs, it's been really great. Much more simple to use than arch, my previous favorite CVS replacement, and fast enough. I've been lurking the mailing list and there seem to be some situations where darcs can be very slow, but my projects are very small, so it's not an issue for me. The darcs developers are working on this, but I admit that I don't even try to follow those discussions, that usually evolve into mathematical discussions :).

December 08, 2004

darcs2rss

I've been using darcs for some weeks now, and I like it a lot. I'll write more about darcs and why I like it in a future post, but I'm switching from CVS to darcs for my current and future pet projects.

Last friday, Bennett Todd was asking in the darcs-users mailing list for a script to generate a RSS feed of darcs changelog. I send him a quick perl script to do just that. I also got some sugestions and improvements.

So I created a darcs repo for this project. You can find it at http://darcs.simplicidade.org/repos/darcs2rss/. You can browse all my repos at http://darcs.simplicidade.org/.

Next, I have to make a small page about it. Not today, though. Real life is waiting. Meanwhile, you can use the readme to know more, specially the roadmap.

December 03, 2004

Examples of notifications via XMPP

Yesterday, I wrote an unusually long article about IM systems as a transport mechanism to notifications.

I got a comment from Bob Wyman, of PubSub.com fame, getting my attention to PubSub usage of JEP-0060 as a prospective search mechanism.

Well, I didn't forget. I use it everyday. I have a pubsub subscription on "JEP-0060" and less than 30 minutes after I posted my article, my pubsub feed was telling me that I had a new article, my article. So it works extremely well.

PubSub is without a doubt the largest implementation of JEP-0060 I know about. The other big implementation is also a service I use a lot: Mimír. It sends me messages whenever certain feeds have new items. It also does aggregation of items while I'm offline, and send's me a summary whenever I get back online. It's an excellent service, and it's also supported with JEP-0060 (ralph, the Mimír creator, is also the creator of Idavoll). Since I subscribed to mimir, I dropped a lot of subscriptions from NetNewsWire, and my RSS reading in the morning is now much more managable.

Both of these systems work very well, and with a decent IM client, I also get Growl notifications of the items. Is pretty cool.

One thing I wonder is if Mimír receives updates via JEP-0060 from pubsub.com? That would interesting. It doesn't seem so, looking at the architecture of it.

December 02, 2004

XMPP, Jabber and Growl: notification systems

Updated: fixed all the links, sorry, I'm a markdown beginner. Thanks Ralph.

Rui did some work on growl remote notifications, and then he made a question: why don't we make this a standard? In doing that, he also talks about Jabber and the failure of that project. I don't agree with the last part at all, and I'll try to answer his question.

First, let's talk about Growl. I really really like Growl, I think it is the second best thing that has happened to the Mac this year (the first being Quicksilver). I like the fact that with it I can have a single app and a single prefpane that controls all my notifications. I even changed IM clients (from Proteus to Adium) because I could not find Growl support in Proteus, and Adium 0.7 had it.

But Growl has some problems. First, I don't have a history of notifications. Sometimes I'm away from my TiBook, and I lose notifications. I don't have a place where I can see the last 20 minutes of notifications.

Second, when I'm offline, I cannot receive notifications, and while the servers could keep on trying to send them, it wouldn't work very well. The moment you get online, you're bombarded with notifications, so you'll probably just skip most of them. If you want to see what I'm saying, download Rawr-endezvous, connect your Mac to a local network with lots of other Macs, and fire it up. Expect to be looking at several screens worth of notifications.

Third, you can specify a title and a text for each notification, but you cannot follow it through to the tool/site/server where you can fix the problem. Growl really needs support for a URL, a clickable one. The lack of a "tell me more"-action limits the usefulness.

Fourth, I have 200+ systems, in several places, behind several types of firewalls. My own laptop is behind another corporate firewall, and I don't expect the local firewall admins to open up yet another port for notifications. Also, I don't think it is reasonable to have systems on the other side of the planet sending me notifications directly to my laptop.

Growl is the last mile of notification systems. It's a personal notification system, not a network notification system. Does it need to receive events from the network? Sure! Should we create another protocol for that? Maybe not.

A network notification system needs a lot more than displaying the notifications. It needs aggregation of events, it needs to know that the user is online or offline, to route the notifications to the most available person to handle it. And that brings us to IM systems.

If you use an IM system for transport of notifications, you get a lot of those things for free. When I say IM system, I don't limit myself to XMPP/Jabber. You can use SIMPLE if you want. I really don't care. I use XMPP/Jabber because that's what I know. I'll use XMPP in the rest of this article because of that. Fell free to s/XMPP/IM system/g.

With XMPP you get a lot of things out-of-the-box: * You get an extensible protocol; * You get all the authentication stuff (with TLS support); * you get a bi-directional protocol, so you can ask the source of the notification "Tell me more"; * you get a global scalable reliable protocol; * you get powerful publish/subscribe primitives.

Let's look at each of these in turn. XMPP is an extensible protocol and that allows you to define new packets (stanzas in XMPP lingo) to transport all the information and semantic hints you want.

You can ask people who know me, I'm not a big fan of XML. I think it is over-hyped and over-used. It seems that, like IBM mainframes in the 60' and Cisco gear in the 90', you won't be fired if you use them. XML is also lousy for transport of information. Network protocols should be efficient and XML is not. An XML parser is more complex and heavy than a XDR or ASN.1 parser, for sure. Also the amount of useless information in XML is very high. Huffman must be turning in it's grave.

I don't see XML as the reason for XMPP extensibility, I really don't, but XML is a very high-level method of encoding information, and for now it helps to use it as the base of XMPP. Eventually, you could put a XML dictionary-based compression scheme between XMPP clients and servers, and still use the same protocol. Only compressed in transit. Gzip is also an option, and it's even mentioned in XMPP RFC (this is from memory, I need to check the negotiation phase).

Before people start telling me something like "you stupid person, my p4 x ghz machine does not have performance problems with XML", or "you moron, my 2mbit ADSL is mostly empty, so if I need 400 bytes to send a simple hello, that's not a problem", I have two things for you to think about: * always-on mobile networks will charge you for bytes transfered, at least in the mass-market plans; * it's a waste of resources having 20000 clients connected to my server and having 20000 XML parsers: machines don't need human- readable protocols.

Back to our list, the second point is TLS support. It's mandatory in XMPP. It's a standard, it works and it's well understood.

The third point is bi-directional protocol. Having a bi-directional protocol allows you to use your notification system to query your systems. It allows your notifications to be short and to the point, giving you the possibility to ask for more information, so that you can correctly evaluate the problem.

The fourth point, a scalable network, is very important if you have more than 50 or so servers. You need aggregation points for notifications, and you need server-to-server communications. You also need reliability, you need the assurance that if an application sends a notification to the local notification center, the message wont be lost (insert regular acts of god disclaimer here). You need store-and-forward semantics, or end-to-end acknowledge of notification. Maybe a mix of both.

Finally, you probably work in a team, with a on-duty staff, and with escalation procedures for notifications. If a disk is 100% full, I don't care if you're offline, someone must be notified, right? Here we get into pubsub systems, probably the best way to deal with the problem of one to many communications right now. You can subscribe to applications, servers, clusters, any node or object in your infrastructure. It's your decision, it's under your control.

Pubsub is available in XMPP in two forms: the lazy one, and the standard one. The lazy one is multi-user chat rooms. You can use a multi-user chat room as a basic quick and dirty pubsub. Just create a chat room for each topic. Whoever wants to be notified, just joins the chat room. It's a one-to-many system, and it works. Imagine this: all your mail servers connected to the same chat room, and having one of them say "Hey people, this dude at 127.0.0.1 is spamming me hard. block the sucker", and having all the other machines in the cluster do it. You can even go into the chat room to monitor those events, or even to say "guys, unblock 127.0.0.1, please". Yes, notifications can be sent between applications.

The standard for pubsub is JEP-0060, and you have at least two implementations today: ralph's Idavoll and ejabberd (which also seems a very nice, mostly-XMPP compliant server. If only virtual hosts where supported...)

So with all of this, using an IM protocol for transport of notifications has a lot going for it. XMPP is by no means perfect. I'm still not sure if XMPP can really assure delivery of messages between servers. I don't think you have the same store-and-forward with acknowledges you have in SMTP. And I really think that a low-bandwidth version of the Jabber network protocol is needed. But it's a start.

So answering Rui's question: why not make Growl a standard? Well, by all means, do it. But as a last mile solution for the notification problem, not for the network part of the problem. The network part is complex and we already have protocols that do it very well, we just need to glue them together.

How do we do that? Well, I have an idea, but I'll need to talk about something else first, to clarify something about XMPP/Jabber that Rui also mentions (yes, the "jabber is dead part"...).

Saying that XMPP is an IM protocol, is like saying that SMTP is for sending text messages. Yes, you can do it, and it's probably the most common use. But XMPP is so much more if you look into it. It has a powerful resource discovery protocol (See JEP-0030) and at least one decent client implementation, Psi, very decent publish and subscribe capabilities, and it also does IM :).

Regarding the lack of clients, my answer is "it depends". You can have great clients today if you want the IM part only. Adium works very well, Fire also works OK. If you really need a XMPP client (and that's an entirely different ball game), then no, there aren't any good clients out there. Again, Psi is probably the best one.

The way I see it, XMPP is much more powerful than traditional IM systems, and most client implementations stop after having the IM part done. The rest of the XMPP doesn't seem to have reached critical mass. In XMPP, you can use pubsub to publish the current music you are listening to, and I can subscribe to that topic to know that (and then probably use Growl to tell me whenever that changes). But there is a lot of framework missing that needs to be in place to make it work: how does my XMPP client talk to my music player? In a Apple environment this is a little bit easier, due to the iTunes domination, but these are the problems that face XMPP extensions adoption for now.

Now back to Rui's answer: how do we do it? Well, you could build a XMPP client not for IM, but for notifications only. Your own personal notification avatar. Julian mentioned this recently. You can even built it into Growl itself.

This would allow you to use Growl to subscribe to topics. You still need to solve Growl shortcomings (at least the lack of URL support), but the rest is pretty much already in place.

My own jab at the problem, Ambrosio, does some of it, but I'm still finishing it's infrastructure to be able to do what I've been talking about. We'll see what happens in the next weeks.