Superpatterns

links for 2008-10-14
[ directoryserver gillmor humor infoworld ldap linux nickwooler opends schwartz solaris sun ]

• Steve Gillmor Interviews Jonathan Schwartz
  How Sun is in a unique position to help enterprises during the downturn.
  (tags: sun humor gillmor schwartz)
• User Experience Matters--install OpenDS in 5 easy steps
  Nice to see Nick Wooler making his mark on OpenDS already - no messing! We miss you on OpenSSO, Nick!
  (tags: opends nickwooler ldap directoryserver)
• Why I like Solaris
  Neil Wilson (ex-Sun Directory Server engineer) expands on his recent quote in an Infoworld article. A really well-written, considered, detailed piece from an engineer for whom I have the utmost respect.
  (tags: linux solaris opends infoworld)

links for 2008-05-17
[ ad analysis authentication bbc bigadmin fedora gartner identity infrastructure kerberos ldap linux microsoft opensource opensso solaris solaris10 sun t1000 t2000 ubuntu windows xtech ]

• Linux shop adds Solaris for performance boost
  Wow - "[...] it turned out that Solaris 10 had a throughput that was 50 times better."
  (tags: fedora linux solaris solaris10 sun t1000 t2000 ubuntu)
• Open Source at Sun Microsystems, 2008
  Gartner Analysis. Synopsis: Open source at Sun Microsystems is strong, and Gartner expects an increasing role for open source within its business strategies in coming years.
  (tags: analysis gartner opensource sun)
• BigAdmin Feature Article: Using Kerberos to Authenticate a Solaris 10 OS LDAP Client With Microsoft Active Directory
  This document describes configuration of a Solaris client to use Microsoft Windows Server 2003 R2 Enterprise Edition (Active Directory) for authentication and naming services.
  (tags: ad authentication bigadmin kerberos ldap microsoft solaris solaris10 sun windows)
• XTech 2008 - BBC Tech Refresh and Identity - Brendan Quinn And Ben Smith » SlideShare
  Presentation from XTech 2008 in Dublin, about the BBC's plans to reinvigorate its technical platform and to create new user management services. Slides 38 and 39 are my favourites :-)
  (tags: bbc identity infrastructure opensso xtech)

Yay - VMware Workstation 5.5.2 now includes VMware Tools for Solaris 10!
[ solaris vmware ]

I spend a lot of time in VMware - it goes with the job - one VM running Federation Manager on Windows Server 2003 R2, another running OpenSSO on Solaris 10, with Firefox on my Ubuntu host machine testing SAML 2.0 single sign-on between them.

For some time now (as blogged here), I've been using the excellent, but unofficial, VMware Tools for Solaris 10, by Juergen Winkelmann to synchronise the host and VM clocks and to let me switch between the host desktop and the VM window without needing to hit Ctrl-Alt all the time. This distro leveraged lxrun to run the VMware Tools for Linux on Solaris 10. It worked pretty well, but was somewhat limited - the mouse motion was pretty jumpy at the edge of the VM window and there was no support for shared folders (vmhgfs), the high speed network adapter (vmxnet) or memory management (vmmemctl).

I recently upgraded my VMware Workstation to 5.5.2 and what do I find, but an official VMware Tools for Solaris 10!!! Just select VM/Install VMware Tools (you might need to type 'eject' in a terminal at this point if you already have a cdrom image loaded), and VMware will mount a cdrom image with the tools package. Run vmware-install.pl - I just hit 'enter' for all the prompts, I think. Follow the onscreen instructions to switch from the default pcn0 network adapter to the shiny new vmxnet0 one, reboot and off you go!

The mouse motion is now perfect, networking is, apparently, faster, and you don't have to have the tools dialog up all the time. Nice one, VMware and thanks, Juergen, for filling the gap!

Solaris 10 /etc/hosts gotcha
[ ipnodes ipv6 solaris ]

Often, when I'm setting up a test system or a demo, I'll use bogus fully qualified domain names (FQDNs), adding entries to /etc/hosts (which is nowadays a symbolic link to /etc/inet/hosts). Today, I was setting up federation; my identity provider (IdP) is at amdemo.example.com and my service provider (SP) is at fmdemo.partner.com. I set up the IdP, appending amdemo.example.com to the line in /etc/hosts that said 192.168.1.31 amdemo and all was well - I could browse to amdemo.example.com and see Access Manager.

On to the SP. I do the same thing, appending fmdemo.partner.com to the line in /etc/hosts that contains fmdemo, browsing to fmdemo.partner.com and... I get some site on the internet. Hmmm. Check /etc/nsswitch.conf - it tells me that it will check files (i.e. /etc/hosts) before DNS. Hmmm. If I comment out the nameserver from /etc/resolv.conf, I can browse to fmdemo.partner.com and see Federation Manager. Strange.

After much man page reading, the answer is... /etc/inet/ipnodes. It turns out that, even if you don't choose IPv6 support, Solaris 10 will read /etc/inet/ipnodes before /etc/hosts and, if there is no ipnodes value, then go to DNS. So, the answer is to copy the relevant line from /etc/hosts to /etc/inet/ipnodes. I do that and, hey presto, I can see Federation Manager at fmdemo.partner.com!

The key here is the comment in /etc/nsswitch.conf that says

# Note that IPv4 addresses are searched in all of the ipnodes databases 
# before searching the hosts databases.

So, with these lines in /etc/nsswitch.conf:

hosts:      files dns
ipnodes:    files dns

The search order is: /etc/inet/ipnodes, DNS, /etc/inet/hosts then DNS again.

This has actually bitten me before. I'm blogging it this time to increase my chances of actually remembering it.