For the past 16 months I’ve been working as a Technical Consultant within the Security, Identity & Access Management (SIAM) team at Salford Software. Salford Software are known as “The Identity Specialist” and focus on identity and access management, they are a leading technology solutions provider. A Novell Platinum partner, Microsoft Gold partner and partnered with Sun and Oracle. Their clients include colleges, universities, local government, NHS and commercial clients.

My work involved designing and implementing Identity Management solutions, principally using Novell Identity Manager. Designing and creating Novell Identity Manager drivers for large projects, including Active Directory, eDirectory, JDBC database and Text drivers. I was also regularly called upon to utilize my skills with eDirectory, LDAP, Netware, Border Manager, Storage Manager and SUSE Linux, including Open Enterprise Server. Working on-site and remotely, including collaborating with colleagues on complex projects, and embracing constant technical challenges.

The company has been forced to downsize due to tough trading conditions and I am amongst a number of consultants that have been cut loose. During my time with Salford I’ve met and worked with some great people, who I intend to keep in touch with. It’s a very small world after all and with our particular skill sets we are likely to bump into one another again and again.

So I’m now seeking new challenges and will consider permanent or contract work. I am happy to provide a full CV to prospective clients/employers on request, which includes details of my role in numerous large and challenging technical projects. Visit my website at www.jamesgosling.com to learn more about me and skills I have to offer and details of how to get in touch.

I’m now working as a Technical Consultant at Salford Software, a leading IT solutions provider here in the UK. Salford Software are a Novell Platinum partner, Microsoft Gold Partner and and are also partnered with Sun and Oracle. Their clients include colleges, universities, local government, NHS and commercial clients such as Virgin Media. Salford Software itself was formed by the University of Salford back in 1988. Since then they have built a very good reputation, with highly skilled in-house expertise. One of the biggest areas of specialism for the company is identity and access management, in fact they brand themselves as ‘The Identity Specialist’. I am working as part of the Professional Services team, and my primary focus is this specialist area. The team uses products from Novell, Sun and Microsoft. Currently my principle tool is Novell Identity Manager. My linux skills are coming on leaps and bounds and I work with SUSE Linux on a daily basis, primarily with Novell services such as eDirectory.

I keep in touch with former colleagues from the University of Nottingham, which is just down the road, and we meet up regularly for cold beer and pork scratchings! Funnily enough I am now working on the same project I was when I was at UoN except now I am sitting on the opposite side of the table as an IDM consultant with Salford Software.

I wasn’t able to attend Brainshare, but I had the opportunity to study the slides of a presentation by Jason Williams, Senior Product Manager at Novell, about forthcoming developments in Open Enterprise Server which are due out, as part of an update, in the final quarter of 2008.

I scanned through it identifying things relevant to the work I am involved in and this is what caught my attention. First of all the update promises 64 bit eDirectory, which also mean 64 bit versions of Novell Core Protocol (NCP), Public Key Infrastructure Services (PKI) and Novell Modular Authentication Services (NMAS). All OES Services will hereafter be full 64 bit.

There are a number of developments affecting CIFS and Samba. Common Internet File System (CIFS) is a standard protocol to allow clients to access files via the internet. CIFS is a public or open variation of the Server Message Block protocol developed and used by Microsoft. Implementing CIFS enables clientless access to Novell file storage.

Samba on the other hand takes things further and in addition to implementing the SMB/CIFS network protocols actually emulates features which are proprietary to Microsoft. It can provide file and print services for Microsoft Windows clients and can integrate with a Windows Server domain, either as a Primary Domain Controller (PDC) or as a domain member. It can also be part of an Active Directory domain.

As effectively the implementation of hacked proprietary technology there is the on-going risk that the owner of the proprietary software will change their code and break compatibility – this has happened in previous releases. Now that Samba is implemented as part of so many major Linux distributions with all those development teams committed to maintaining it this is less of a concern than it used to be.

Currently on OES 2 Linux CIFS is implemented as part of Novell Samba. The open source Samba software is included as part of SUSE Linux Enterprise Server. OES 2 Linux uses this base Samba software, but configures it differently and installs additional software to take advantage of enhanced services. Features specific to Samba on OES 2 Linux include:

• eDirectory LDAP authentication
• Support for NSS and NCP
• iPrint Support

Novell considers CIFS support with SAMBA is lacking in the areas of performance, integration and configuration and has indicated that in the forthcoming update to OES 2 Linux they include a Novell engineered SMB/CIFS stack that is “better” than SAMBA, key features will be:

• Support for migration of CIFS from NetWare
• Installation will be via Yast
• Simplified management via iManager
• No longer a requirement for a local eDirectory replica
• Ability to configure multiple user contexts for CIFS access
• Linux User Management (LUM) not required, instead any eDirectory user with universal password enabled will be able to be given access

Currently users have to be LUM enabled to use CIFS, this is one of the steps that complicates the current implementation of CIFS on OES2 Linux. However we may find it puts us in an advantageous position in the future to have already implemented LUM support as this potentially makes it easier to use other Linux based services in the future.

Novell intend to separate out CIFS and Samba creating two product sets:

• Novell CIFS – for customers that just want windows protocol access to their files.
• Domain Services for Windows – for customers who want full Active Directory integration (such as domain membership or domain controller emulation).

Novell has this to say about DSfW:

“Domain Services for Windows (DSfW) is a suite of technologies in Open Enterprise Server (OES) 2 that provides login, authentication and Directory authorization for Windows workstations in eDirectory trees and integrates with existing eDirectory deployments”

It will be built on existing open source technology such as Kerberos and Samba and the aim is to “provide seamless integration between Windows and OES environments while leveraging existing Novell eDirectory deployments.”

It will only work with eDirectory 8.8 sp4 on OES 2 sp1 and installation will create a new DSfW domain controller in a new or existing domain, extending the eDirectory schema with AD schema. It integrates Samba with eDirectory using NT 4 protocols a new Samba back end.

Clearly there are design considerations and a level of complexity involved in implementing DSfW. The aim is better integration with Active Directory and better support for ‘clientless’ Windows workstations.

Some nice new improved migration tools are also in the pipeline. A sneak preview was provided of a new consolidated GUI interface supporting various migration scenarios, e.g. upgrade, migration or consolidation. Supported service migrations are to include file system, eDirectory, DNS, DHCP, iPrint, iFolder, Novell CIFS, FTP, NTP amongst others. The ability to migrate CIFS and iFolder is certainly new.

The new consolidated GUI interface provides a dashboard view of migration process and integrates tasks into a single overall view. It supports advanced migrations not just basic scenarios.

The most exciting capability is “Server ID Swap” which in essence is the ability to migrate the configuration of a running NetWare server to an OES2 Linux server, including eDirectory configuration, eDirectory objects and the file system.

The future for Print Accounting on OES Linux was mentioned. Novell is developing a new API enabling third-party modules to interact with iPrint. Partners such as Papercut Software and Salford Software are ready to port their accounting modules, they are still discussing things with A.N.D. Technogies (PCounter). The Windows Vista iPrint client is still being enhanced and isn’t yet at parity with other platforms.

Other coming developments include LDAP Auditing, Enhanced Directory Monitoring in the LDAP layer and a new version of iFolder with lots of new features (both 32 bit and 64 versions).

Under investigation for the future are Novell Cluster Services support for Virtual Machine clustering (clustering of VM infrastructure) and Dynamic Storage Technology for Windows/NTFS without a dependency on eDirectory, iManager, NCP or NSS.

So all in all there are some great developments coming!

I’m looking for a new challenge to move onto now that my work here in Systems & Security at the University of Nottingham is coming to a close. I’ve enjoyed working with the team here, but I’m also looking forward to the next challenge. I’m ready to re-locate anywhere for the right opportunity. For more about me, my skills and experience please visit my main website www.jamesgosling.com and if my skills are of interest please feel free to ring me on 07863-318939 to discuss how I may be able to help.

James

I am currently working on contract in Nottingham. I am involved in a number of projects, the most interesting of which recently was implementing Novell Storage Manager. It’s one of those Niche products that you may not have heard of, but it’s absolutely excellent at what it does. Novell Storage Manager is a policy based, event driven, storage management system primarily focused on the automatic provision of user home directories. According to the policies defined NSM can create directories, set trustee rights, set quotas, apply templates and queue directory deletion all according to the settings within the associated policy. A central NSM Action Engine receives details of relevant events from NSM Event Monitors and where an associated NSM policy applies the NSM Engine issues the work to be done to NSM Sentinels. Novell Storage Manager is actually developed by the Condrey Corporation who are also the authors of AuditLogin, a utility that as the name suggests monitors and logs login activity. A new version of Storage Manager is due out anytime now which promises to have much greater support for Linux. Two things that we learned the hard way – DO NOT do partition merges involving partitions with user/group objects linked to your NSM policies without first unloading the NSM event monitors and remember to allow time for these changes to finish synchronsing – my advice is to either switch off the processing of events so they are queues in the engine where you can vet them or start the engine up with the -noprocess command line switch. Another useful switch, this time for the sentinels is -maxcopydir <1-99> which allows you to increase the throughput if you are doing a lot of home directory migrations. I had to create over 300 individual NSM policies in this project! Yes, I’ve learned a thing or two about Storage Manager!

Increasingly I am involved in migrating services off NetWare onto OES Linux. The next big project will involve migrating a NetWare file server cluster to OES Linux by introducing Linux nodes then migrating the NSS volumes across with zero downtime. Although the plan in the long run is to phase out the Novell Client initially NCP services will be used alongside CIFS to facilitate a staged phase out. Implementing CIFS on NetWare is a far simpler process than on OES Linux I have discovered.

I recently implementing NetStorage also, this involves for the un-initiated simplifying the logic and syntax in login scripts and using a reduced command set. NetStorage also cannot handle enormous login scripts so you may find as I did that you need to break it down further. The solution I used was to create a set of profile objects across the various OU’s and break up the large login script into smaller NetStorage versions. Watch out for NetStorage’s strict interpretation of command syntax that you may have got away with in regular login scripts. I then modified the container login scripts so that they used the appropriate script depending upon whether you were logging into NetStorage or not, using the IF =”1″ THEN… condition to detect NetStorage access. I like NetStorage it is now a pretty hardened and robust product. I did hit one major issue though which I am told will be resolved by moving over to running it on OES Linux and that is that is to do with Storage Location Objects. If you create an SLO that points to a CIFS share rather than an NCP location it doesn’t work, I have been assured that this functionality works as designed on OES Linux.

Recent experience running eDirectory and iDentity Manager on SUSE Linux has only served to reinforce what a stable and fast platform SUSE Linux is. Also on the cards is an upgrade from eDirectory 8.7.3.x to 8.8.2. We got our fingers burnt by the eDirectory 8.7.3 sp10 support pack which introduced ghostly intermittant -608 errors, Novell rushed out a fix called 10a but that has now also been withdrawn and we are left in limbo a bit. Just waiting to hear whether the best cause of action will be to roll forward to 8.8.2 or back-rev to 8.7.3.9.

Recently been introduced to the benefits of JRB Utils and NDS Magic which I will add links for to the resources page on my website when I get the chance

I’ve just completed a 3 day course for CompTIA Certified Technical Trainer. It was run by a company called Rezound based in Sheffield who are one of the few to offer such a course that’s endorsed by CompTIA. Although the complete CompTIA model was coveredd, the emphasis was on providing an immersed classroom experience to give me the skills needed to train in the real world. I was one of 3 candidates in what was an very fast paced and intensive 3 days, but an experience that I would very much recommend. We were all taken out of our comfort zones and strangely performed better when under the most pressure. The use of a variety of media and delivery methods and generating the right mix of questions; overhead and directed was drilled into us. It was very much experiential and our trainer was very good. By the end of the course we all had the necessary video recordings made of us delivering 20 minutes of training, a requirement for the video submission element of qualifying for CompTIA’s Certified Technical Trainer. I have previously sat and passed the computer based exam unlike the other candidates, but this was some time ago and I very much welcomed the opportunity to refresh and review my knowledge. Rezound have an impressive 100% success rate for their candidates video submissions which compares very well to an average of 50%… so no pressure then! Once I receive my video files from rezound I will need to complete detailed supporting documentation to relating each of the key CompTIA domain elements to my course delivery. I found the course very useful and would certainly recommend it to others.

In July I attended an intensive 4 day course, it was a Novell advanced technical training course run by Salford Software. A product expert flew in from Dusseldorf in order to deliver the course in Manchester. The other delegates included a team from ITV and a team from the Turkish government, based in Istanbul. We learned how to integrate and automate different systems using a product called Novell iDentity Manager. By integrating systems and automating processes so that entirely different systems work together seamlessly cuts down on duplication and automates processes that might otherwise be done manually. An example might be for example a new employee joining an organisation – the organisation will need to enter and maintain details about that employee on a number of different systems such as payroll and administration and the user may need accounts on various systems – getting all of that setup is time consuming and involves duplication. Using iDentity Manager it is possible to link these systems together and automate the processes so that the information need only be entered once and the necessary accounts are created automatically and perhaps emails generated to the appropriate people. This is just a very simple example but demonstrates the advantages. Entire business processes can be automated in this way and systems which are currently entirely seperate can be linked together. The skills gained on this course should prove very useful in the future in integrating and automating systems/processes. Identity Manager is an incredible product that I hope to work with more heavily in the future. Provided you have a good technical foundation I highly recommend you try a Novell ATT course.