If we're going to track tickets, we should probably keep our apologies in triplicate. Pictures in TinyMCE work, also.

The .NET Toolkit for Single Sign On version 1.0 Beta is now available. This will provide .NET Web Applications with the ability to be authenticated against the User Service.

Overview

Currently it supports the following two forms of Authentication:

1. Active: If this is chosen then the user will be presented with a Login page.
2. Passive: If this is chosen then the user is authenticated without presenting a login page. For this to work the user must already have a cookie with a valid authentication id.

Pre-Requisites

Requires the .NET Framework verion 2.0 or later.

Installation

The required .NET assemblies are available at:

svn://<repository>/SecuritySolution/SharedLibs/

Retrieve these assemblies and reference them in your ASP.NET Web Application project.

Retrieve the configuration file from svn at /SecuritySolution/ClientWebApp/web.config This is a sample config file that can be used to add configuration settings to your web application's web.config file. Make a copy of the file and modify it as listed below to setup your application.

For the <provisionClient> element set the following.

• Set the endpointUri to the URL where the provision service is located. Contact the Apps Team to get a valid URL for the provision service.
• Set the serviceName attribute to the name of your web application.
• Set the instanceValue attribute to the instance of your application.

For the <userClient> element set the authenticationType attribute to "Active" or "Passive" depending upon the type of authentication required.

IIS Setup

If IIS is being used for hosting your web application then the following steps need to be performed to set it up correctly.

• IIS 5.1
  • Use the IIS MMC to select the Web Site or Virtual Directory for your web application. Right  Click on it and select Properties.
  • In the Virtual Directory tab, click on the Configuration button. From the Mappings tab click on Add. In the Add/Edit Application Extension Mapping Dialog perform the following.
  • For the Executable select the aspnet_isapi.dll whose default location is C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727
  • For the Extension keyin .acs
  • Uncheck the "check that file exists" check box.
  • The OK button on the dialog button should now be enabled but it is usually not. This is a known bug in IIS and to overcome this just click in the Executable text box. This will enable the OK button. Click on  OK.
  • Click OK on all the previous dialog boxes to save your settings.
• IIS 6.0 and later versions
  • Should work with the same configuration as that for IIS 5.1 but needs to be tested. (May also be able to apply Wildcard URL mapping to get the same effect)

Usage

Once the above has been performed and Active authentication has been set in the web.config file then the user will be presented with a login page. After keying in the credentials at this login page the user will be authenticated and logged on/off appropriately.

Source Code

The source code for the project is available at:

svn://<respository>/SecuritySolution/Security

This project can be retrieved and compiled using Microsoft Visual Studio 2008. This will generate the nGenera.Security.dll assembly. The log4net.dll assembly and the ICSharpCode.SharpZipLib.dll assembly are also provided.

Background

The Single Sign On capability has been implemented as a .NET HttpModule implementing the IHttpModule interface.

A detailed explanation of Http Modules can be found here.

Basically whenever an Http request is made it passes through the Http Pipeline. The pipeline consists of various stages where each stage intercepts the request and processes it accordingly. A number of these stages are Http Modules which are provided with ASP.NET and they perform different tasks on the incoming requests. At the final end of all these stages is what is called an Http Handler and each request can pass through only one Http Handler. The Http Handler is determined by the extension of the file being requested (i.e. if its a .aspx file then the aspx Http Handler will be used to process this request)

Future Updates

• Single Log Out (SLO)
• Clients for other Platform Services
• Provide Base Classes for creating RESTful Services and Clients that are WCF compliant.

Here's the code that went with our metaprogramming discussion. Feel free to ping (or walk 10 feet and ask me) if you've got questions. There's a 3/10 chance I can answer it.

meta.rb

We've been looking into using Selenium as our web testing framework.  However, there is another popular open source tool to do this as well, Canoo WebTest.

This blog post shows an excellent comparison between the two tools. It favors WebTest due to some of its greater feature set. This post however favors Selenium due to the ease of use.

The conclusions seem to be that Selenium has a better tool for quickly capturing tests, but WebTest has more features and integrates better into a cruise control system. Also interesting is that you can manually script features for both in xml. However, for Selenium you can also use ruby scripts, and in WebTest you can use groovy instead.  I always like having options, but the strenghts of WebTest probably aren't as important to us as the browser tool for quickly generating tests in Selenium.

now, if you're curious, you can type 'cap kalivo:status' and give it which hub you want, and it will display how memcache, backgroundrb, and mysql are configured for that hub on that machine.

In Java and .NET, when I'd write factory methods, it was somewhat handy because I could conceal all the logic for determining class type in one method. Here's something like a typical factory method in Java (ganked from Wikipedia):

public class ImageReaderFactory
{
    public static ImageReader getImageReader( InputStream is )
    {
        int imageType = figureOutImageType( is );
 
        switch( imageType )
        {
            case ImageReaderFactory.GIF:
                return new GifReader( is );
            case ImageReaderFactory.JPEG:
                return new JpegReader( is );
            // etc.
        }
    }
}

This means that the other classes who care about the reading an image, but not how to read it, don't have to know anything about that. They just say, "hey, here's my input stream. Can you read it for me?"

For the last iteration, doing some Facebook integration, I ran into a similar situation. There's lots of types of Facebook elements - Affiliation XML stanzas, single line birthdays, pictures, etc., and they all have different ways that they need to render to html. It seemed like a prime candidate for a factory method:

def self.create(title, body)
    element = nil
    if title =~ /pic/
        element = ImageFacebookElement.new(title, body)
    elsif title == "affiliation"
        element = AffiliationFacebookElement.new(title, body)
    ...
   
    element
end

Unfortunately, this felt incredibly dirty. Especially in Ruby. It sucks that any time Facebook introduces a new type of object, I have to edit the base code. I know Ruby's got open classes and all, but I don't really want to be screwing with that method unnecessarily. So, instead of doing that, I extracted the FacebookElement identification tests to their respective rendering classes, and introduced a means to register an element with the factory. First, here's what the factory looks like now:

class FacebookElement
    @@title_tests = []
    @@body_tests = []
   
    def self.register(klass, type)
        @@title_tests << klass if type == :title
        @@body_tests << klass if type == :body
    end
   
    def self.create(title, body)
        @@title_tests.each do |t|
            return t.new(title, body) if t.matches(title)
        end
       
        @@body_tests.each do |t|
            return t.new(title, body) if t.matches(body)
        end
       
        FacebookElement.new(title, body)
    end
end

I only allow for two types of categorization for tests: title and body. In my case, title tests seemed to be more exact, so I apply those criteria first. If I needed more precision, I could add some other heuristic or attribute to keep up with what tests to run when. The great thing about this approach is that FacebookElement never has to change.

Now, let's look at one of the more concrete implementations of a FacebookElement:

class ImageFacebookElement < FacebookElement
    FacebookElement.register(self, :body)
    def self.matches(body)
        body =~ /(png|jpg|jpeg|gif)$/
    end
   
    def to_html
        #magic image facebook element rendering code
    end
end

I used ImageFacebookElement because it was actually the last class I had to add, and it was ridiculously easy. Find a new facebook element, find a distinguishing characteristic and how it's displayed, code that display method into to_html, code the distinguishing characteristic into the self.matches section, and register with the FacebookElement class.

If you're curious how the rest of that code works, just look at the kalivo codebase in vendor/plugins/facebook_profile. It's actually pretty simple, thanks to how easy Ruby makes lots of patterns.

• To Stop backgroundrb listener thrashing:
  
  • feeds table - set run_when = 'frw_manual'
    
  • listeners table - set next_run_at to some far future date
     
• To point your dev environment to the storage test service (coming soon):
  
  • select * from ngenera.preferences where name = 'bsgra_guid';
    
  • select * from service_provision.provisions where bsgra_guid = '6b0c73c0-bsga-kali-ngen-00112ngenera';
    
  • update service_provision.provisions set endpoint_uri = 'http://storagetest.ngenplatform.com/items' where bsgra_guid = '6b0c73c0-bsga-kali-ngen-00112ngenera' and name = 'service_storage_items';
    
  • update service_provision.provisions set endpoint_uri = 'http://storagetest.ngenplatform.com/directories' where bsgra_guid = '6b0c73c0-bsga-kali-ngen-00112ngenera' and name = 'service_storage_directories';
    

I've updated the storage service to remove the referral validation of incoming requests.  Instead it now follows the standard pattern of checking for a BSGRA_GUID header, HTTP_BSGRA_GUID header, or a bsgra_guid parameter on the incoming request like the service_user.  In addition it will validate the incoming bsgra_guid is valid and has access to the storage service in the provisions server, and that the incoming request is coming to an expected request url.

However, it is concerning that this make break clients of the storage server that are not currently passing the bsgra_guid in the request.  Should we be handling backwards compatibility in regards to the referer mechanism?  What sort of systems integration testing do we have for service interface updates?

I recently replaced the majority of our (ganked) wiki_column plugin. The guy who wrote it relied heavily on eval and consequently it was difficult to understand what code was code and what code was just a string.

Anyways, wiki_column allows you to put "wiki_column :column_name" in any class that extends ActiveRecord::Base, and will add helper methods to the class to access that column in a more wiki-ish way. For example, [Links] are converted to HTML links.

The hard part of this comes from adding a method with a dynamic name to a class, and having the method respond in a particular way based on that name.

I ended up puting in the WikiColumn module an instance method, and then in the wiki_column class method, used Module#define_method to essentially alias the method on top of my internal instance method.

The code for the Wiki covers lots of things that aren't relevant to this discussion, so I've written a simpler case:

This example demonstrates a few cool things about how define_method, lambdas, *args, and inheritance works.

When a class includes a module, the module's instance methods are added to the class. This is handy, because it means just by including IncludeMe, the Base class gets a special_method. Inner module methods, like in ClassMethods, aren't automagically added.

When a module is included, Ruby calls the module's included method and passes the entity that included it. This allows the module to react to its inclusion. Here, instead of asking the class to include the ClassMethods module, I tell the class to extend it. The difference is that included modules add instance methods by default, and extended modules add class methods.

In class A, I call special_feature with :hello. This in turn calls the class method (since that's the context of the method call) that comes from IncludeMe::ClassMethods. In there, for every argument I pass (it takes a *args, which means you can pass 0-N parameters), it will call class_eval on A and add a method with that name.

That method, in our case, is "hello". Using Module#define_method to add a method, it gets passed a name (whatever was passed in), and then a closure.

An important thing to note here is that I needed the parameters for the special_method to be optional. In Ruby 1.8.6, parameters passed to closures can't be optional (they can in 2.0), so instead I used the *args convention again, and only pay attention to the first arg ([].first returns nil). Inside special_method is where defaults are created.

It's worth noting that if the lambda has more than one parameter for the closure, it won't complain if the number of arguments passed in matches the arity. It's a crazy case in Ruby, where you get an interpreter warning if the arity of the lambda is 1. Using the *args for the lambda avoids the warning.

The self inside the class_eval call seems ambiguous, and could worry people that it would affect the Base, because that's where the module is included. If that happened, it could be bad news bears. Luckily, Ruby is cooler than that, and self resolves to the correct context, instead of the includer.

Here's the output:

So, there's examples showing that the method can take a hash, can take nothing, can take names, and is only implemented on A.

There's further advantages to using modules for containing groups of methods for multiple classes. It's nice to check to see if a class implements a module instead of if it responds to several methods, but I thought this was a pretty crazy use that could have some effects on the way we code.

http://www.slash7.com/articles/2005/8/13/ajaxariffic-autocomplete-with-scriptaculous