Progress is relative


I was installing Microsoft Encarta today when I noted an interesting note during the installation. I took the liberty of making a screenshot and highlighting the phrase for you…

The good thing about this: It’s honest!

I’m really asking myself why they created those prograss bars in the first place. They never work.

How to get a Lamp

Last sunday, the lamp of my IBM iL2220 video projector (no link as it is neither available nor would I recommend it any more) exploded. This was especially stupid as I just bought Wario World and Metroid Prime (which I had to have after finishing Metroid Fusion on my GBA and getting to know this wonderful series) and I really wanted to play them.

On Monday, I called IBM’s support line and asked for the part number of the replacement lamp to be able to buy it at the IBM distributor our company has an account at. The supporter told me that he would need the serial- and partnumber of my projector which I did not know.

Today I finally wrote down those numbers before I went to the office and gave IBM another call.

This time the supporter told me (without needing the neither partnumber nor serial number this time) to call another number, which I did thereafter.

This time I was in one hell of a callcenter menu requiring me to press buttons, giving my name and finally my phonenumber for an automated callback. When I finally had a human on the other end of the line (of course I had to make the phonecall with my cellphone – our PBX does not support DTFM sequences), he laughed at me and told me he was from software support and whether he should “flash” my defunct lamp. Funny, but not after having to wait 30 minutes for it ;-)

Anyway: I got another number where I called later on.

This time the supporter knew what I was speaking about (after having explain to her for about three times that I knew the warranty has expired and that I just want the part number to place an order for another lamp). She told me that she was not allowed to give out any part numbers but that she would try to help me anyway.

20 minutes stupid music

“hmmh… please hold the line. This is complicated”

another 10 minutes

Finally she told me that she will connect me to someone else that knows what to do.

2 Minutes

Now I had another supporter at the phone. I told my story again and she finally gave me this stupid part number (33L3426) which the previous supporter was not allowed to give me.

In the webshop of our IBM retailer, I learned that the lamp would cost ~CHF 700.- and that I would have to wait at least 20 days for the new lamp to arrive. Not good as I really want to play Metroid Prime.

Using google I learned that the IBM iL2220 is nothing more than an inFocus LP350 with an IBM label on top of it. Something worth to give a try with.

The supporter at inFocus gave me the number of a retailer of theirs, I called them and learned that they have a lamp on stock and that it would cost at most CHF 485.- more than CHF 200 less than the IBM lamp. Needless to say that I’ve placed my order. The lamp will arrive on friday – about 10 times sooner than the IBM lamp would have arrived.

So much to the great IBM support. So much for buying an IBM product to have a good supply in replacements.

SOAP needs soap

For our Web-Portal superspeed, I am working on a webservice to give some clients access to our provider/offer database.

As the whole portal is written in PHP, I deceided to write the Webservice (fully fledged using the SOAP-Protocol) in PHP too. After some searching, found NuSOAP and the SOAP-Package in PEAR.

Both packages have virtually no documentation, but the PEAR-package has some nicely documented samples (disco_server.php, example_server.php just to name the most interesting two).

While nuSOAP is very easy to handle, it doesn’t have a way to autogenerate WSDL-output which would have forced me to learn writing WSDL. Unfortunatly I did not have time for this, so I went with the PEAR-Package which is able to create the WSDL for you.

The first tests using PHP as SOAP client worked very well.

tip: to increase “debugability” to an actually useful level, use something like the code here for debugging your server:

// include the actual server class
require_once 'modules/ss3_Provider/xml_access.php';

if ($_SERVER['argv'][1] != 'direct'){
    // use the SOAP-Interface to our class
    include("SOAP/Client.php");
    $wsdl = new SOAP_WSDL("http://your.server.com/server.php?wsdl");
    $object = $wsdl->getProxy();
}else{
   // Use the class directly
    $object = new CProvServiceInfo_Class();
}
// do something with $object

If the script is called with the “direct” parameter, the class will be used directly thus giving you back all the debug information you need without an XML-parser trying and failing to unserstand them.

As the customer for this service is going to use ASP.NET to access the webservice, the next step was to try accessing the service via Visual Studio.NET. This was not fun (pasting the complete error here in the hope that google will catch this and will help future users having my problem):

Custom tool warning: At least one import Binding for the ServiceDescription is an unsupported type and has been ignored.

The hairy thing: I have no expirience at all with VS.NET, so I first thought this was a minor problem and I was just too stupid to actually use the imported class. But sooner or later (after trying out importing the Google Webservice), I came to the conclusion that this warning actually is a grave error: Nothing got imported. Nothing at all.

Searching google did not yield any results.

The next step for me was to learn WSDL (which I did not want to in the first place ;-). Unfortunatly, the PHP generated WSDL-File seemed quite ok (besides the missing <documentation>-Tags).

I could not get VS to report a mor detailed/useful error message.

Just when I wanted to give up, i thought of this tool, wsdl.exe that gets installed with the .NET Framework SDK. Running wsdl <filename.wsdl> gave me the same error message, but with a note to look into the generated .cs-File.

This finally gave an usable error-message:

// CODEGEN: The binding 'SuperspeedProvidersBinding' from namespace 'urn:SuperspeedProviders' was ignored. There is no SoapTransportImporter that understands the transport 'http://schemas.xmlsoap.org/soap/http/'.

A quick comparison of the <soap:binding&gt-Tags showed:

Googles Version: http://schemas.xmlsoap.org/soap/http
PHP’s Version: http://schemas.xmlsoap.org/soap/http/

Note the slash at the end.

I hate problems with simple solutions that are so awfully difficult to find because of un-usable error messages!

Just for reference: The following patch fixes the wrong Transport-URL in PEAR::SOAP (0.7.3 – I will report this to the author, so maybe it’s fixed in later versions):

--- Base.php    Thu Jun  5 13:16:03 2003
+++ -   Fri Jun  6 22:51:08 2003
@@ -91,7 +91,7 @@
 define('SCHEMA_DISCO_SCL',          'http://schemas.xmlsoap.org/disco/scl/');

 define('SCHEMA_SOAP',               'http://schemas.xmlsoap.org/wsdl/soap/');
-define('SCHEMA_SOAP_HTTP',          'http://schemas.xmlsoap.org/soap/http/');
+define('SCHEMA_SOAP_HTTP',          'http://schemas.xmlsoap.org/soap/http');
 define('SCHEMA_WSDL_HTTP',          'http://schemas.xmlsoap.org/wsdl/http/');
 define('SCHEMA_MIME',               'http://schemas.xmlsoap.org/wsdl/mime/');
 define('SCHEMA_WSDL',               'http://schemas.xmlsoap.org/wsdl/');

As you can see, there are more URLs having a slash at the end – possibly more candidates? We’ll see. At least I know now, how to debug such problems…

iSync 1.1 but I will not need it

Apple finally has released iSync 1.1 with P800 support, although it remains to be seen whether this support is just for iSync or also for the adressbook which, in my oppinion, is the killer-feature of apples bluetooth initiative.

I will definitely try that out sometime in the future, but not now: I was weak and could not resist from buying myself a SonyEricsson T610 which is – besides the known problem with heavy noise while making calls – the best cellphone I’ve seen so far:

  • It’s very small. It’s very comfortable to finally not have to remove the phone from my pocket when I sit down
  • The UI looks great. OK. That should not be important, but it’s a point anyway.
  • It has a *real* AT-Interface which even resembles the one of the T68 very much. This makes tools like MobileAgent (an excellent freeware for Windows) possible.
  • It has a T9-dictionary: Although I thought that the handwriting would be fast, T9 is much faster for text-entry.
  • It has a really good keypad: Like the T68, the T610 has a really great keypad – the best I’ve seen so far.
  • It has no blinking LEDs – uncommon for Ericsson phones, maybe a tribute to Nokia?

    The only drawback are the limited PIM functionality and much lesser (and less sophisticated) software, but I can more then live with those problems.

    I just hope, they will fix the problem with the noise – and I hope they will do the repair for free.

OSX and OpenLDAP

Finally. It works. I got Richard’s OSX-Box to authenticate against my OpenLDAP server, I set up yesterday (acutually, it authenticates against the replica but this does not make any difference). Here’s what I did:<ol>

  • As I have the homeDirectory attribute in the form /home/username, and Mac OS X has the users in /Users/username, I actually have two ways to fix this: a) add another attribute to the LDAP-Server called osxHomeDirecotry or something like that. This was no alternative as I don’t have an enterprise number yet so I could not legally create an OID for such an attribute. b) symlink /home to /Users. That’s what I did.
  • Now I started the “Directory Access” Utility in the Application/Utilities folder.
  • I’ve removed the checkmark on LDAPv2, selected LDAPv3 and clicked on “configure”
  • The next step was to remove the checkmark “Use DHCP supplied LDAP-Server” as my DHCP-Server does not supply an LDAP server (and I don’t even know which option-code that would be on the DHCP-Server).
  • Now I’ve clicked on the “more”-Arrow to display the advanced settings where I’ve entered the hostname of the internal (replica) LDAP-Server. In LDAP Mappings, I’ve selected “Custom”, the SSL-Checkbox stayed un-checked after my un-successful tries to get OpenLDAP to use my self-signed certificate yesterday. I’ll get back to this as before I get productive with my setup.
  • In the new dialog that popped up, I had to make some adjustments:

    (In my explanations, I assume, your accounts have objectClasses of inetOrgPerson, posixAccount and shadowAccount).

    1. Under “Users”, set the RecordName to “uid”
    2. I had to add a Record called “Group” to Users and assign “primaryUID” to it or the group of the user was not recognized (see the prior entry to this blog)
    3. Under “Group” add the RecordName-Attribute and assign cn to it or the Group was not recognized later on.
    4. Now close the dialog by hitting “OK” and then close the Next dialog too with “OK”
    5. Now select the “Authentication”-Tab and chose a “Custom” search path. Add your newly added LDAP-Server.
    6. Do the same with the Contacts-Tab – although I have not yet figured out how to get this to work.
    7. Hit “Apply”
    8. Reboot
      The last step is very annoying: I had to experiment quite a bit with the mapping settings to finally get my LDAP-Groups recognized and get the right primary group assigned to LDAP-Users (it was always 0/wheel which is not what I wanted – not at all). There is no way to get the OS to recognize changes you make in the Direcotry Access Utility but to reboot the machine. I’m happy, OSX boots that fast. If it had been windows I’d stell be wating for the reboots to complete ;-)

      What have I accomplished?

      • I can login with the LDAP-Accounts be selecting “other” in the Login-Screen and then entering username and password
      • I can su to any LDAP-Account
        What still does not work:

        • passwd
        • Although I can set a new password in the system preferences, the changes do not get written back to the LDAP-Server

          About the password-changing-problems, I will have a look at pam. Until then, I’m quite happy, I finally got it to work.

          I really hope, someone will find this useful…

  • LDAP again…

    I know… it’s getting boring…

    I just wanted to say that I’ve sucessfully fixed two problems:

    1. I had a problem where passwd immediatly failed one another server I just LDAPed:
      pilif@sen1 ~ % passwd
      LDAP Password incorrect
      passwd: User not known to the underlying authentication module
      pilif@sen1 ~ %

      The problem was a use_first_pass I had in the pam_ldap-line of /etc/pam.d/passwd. When changing the password, it checked the authentity with an empty password (first_pass was empty – I never ever entered one) which failed. If somebody could please tell me the log level to set in slapd.conf to actually get useful logging information describing the problem: step forward!

    2. You have to set rootbinddn in you (pam|nss)_ldap configuration file. This will enable root to change a users password without having to know it first.

      Oh.. both updatedn and updateref where not correctly set in the replicas slapd.conf. I’ve fixed this too.

    It’s coming along…

    I’ve just authenticated my first test-user on Richard’s Mac OS X (10.2.5) box via LDAP. It worked nicely – besides the fact that the GID was not assigned correctly. I will have a look into this before I’m going to post a little tutorial here.

    Stay tuned…

    Fun with OpenLDAP

    I bought “LDAP System Administration” because I was interested in LDAP for a long time and I never really understood what one could do with it.

    While the reading book is great (it lacks some details here and there, but it’s really nice to read and has very understandable explanations), putting it to work wasn’t:

    What I want to acomplish is to have a central user-database for our 3 people company: Two Windows PC’s, one Linux-Router, a Mac OS X workstation, 3 Linux-Servers, my Home-PC – I want to be able to log into all of them with my one password I have in the LDAP-Server. That’s what LDAP is for anyway.

    Setting up the server was done in no time (although it required some sweat because I first installed the OpenLDAP Server of debian stable but then deceided to upgrade to the current release (debian is lagging like ever) by using the server from the unstable distribution. I got it to install eventually (after purging the former installation that caused the update-script of the new installation to quit beacuse ldap-utils where not installed [side note: if a packages installation script requires tools from another package: why isn’t this dependency marked in the package?]).

    Soon I’ve created my test-account, installed nss_ldap and pam_ldap and it seemd to work.

    Actually it crashed my SSH-daemon as soon as I tried to log on to the machine, I could not change the password of LDAP-accounts, su did not work and login was not possible either – despite the fact I was following the clear instructions in the LDAP-Book.

    The SSH-Problem got solved by updating to the latest version (uncommenting the LDAP-Support for groups in /etc/nsswitch.conf did help with the older version but this was no alternative. suing eventually began to work without me really changing anything, changing the password required me to edit /etc/pam.d/passwd despite the fact that the in-file documentation of that file states that it is not necessary. Just like the su-problem, the one with login went away eventually.

    /bin/passwd requires still requires me to enter the users old password when called as root. Stupid, but can be circumvented by using a LDAP-Admin-Tool. chsh authenticates via PAM and gets the current entries correctly but tries to save back to /etc/passwd. As stupid as the thing with passwd

    So the adventure is not even half completed but a day is used and I had to fight problems which are not even supposed to be existing…

    Is what I am trying to do really that sophisticated that it sinply does not work? Or am I just plain stupid?

    I’ll keep you updated…

    And on to replication

    The show must go on. As our ADSL connection from the office to the internet is not that reliable, I deceided to use OpenLDAPs slurpd to replicate the LDAP tree to an internal LDAP-Server. The setup is quite well described in my LDAP-Book and it did work at the first time I tried it.

    At least it sort of worked…

    Although changed attributes appeared on the replica, a newly created user was not synchronized. There was no reject on the master either – the data just vanished [sidenote: why is there a replication-rejectlog if data can vanish anyway – this is not reliable behaviour at all].

    Reading the syslog finally gave me the idea: The permissions of the replicas data directory where not set correctly: some of the files (and the directory istelf) belonged to root.root while slapd was running as slapd.slapd.

    Now it’s working like a charm and I am looking forward to trying to authenticate richards mac against the internal LDAP-Server.

    When this works, I’m going to finally convert the SAMBA-installation to a PDC and setup something to synchronize the windows-password with the unix one (both in LDAP – of course).

    I’ll keep you updated on my progress…