Security for stand-alone Java programs that use the Notes API

Since its launch in the early 1990s, Lotus Notes has had a wonderful security architecture which implemented a public/private key architecture which has only recently been widely adopted by other platforms. Unfortunately this meant that many people are not really familiar with how it works.

I recently blogged about how to write stand-alone Java programs which can manipulate Notes/Domino databases. A few people commented upon the fact that when they run their stand-alone programs on a machine on which they have a Notes client installed they are normally prompted to enter a password each time the program launches. Since they don't get a similar password prompt when they run their program on a machine which has a Domino server installed on it, they seem tro think that the Domino server code gives them some form of privelege to bypass Notes security. This is not true, but to explain why I will first need to explain some important facts about Notes/Domino secuirty model.

1. Notes implements what security experts call "two factor authentication". This means that you need to prove your identity by two different mechanisms. Firstly you need to have an ID file containing your private key and secondly you need to know the password used to secure the ID file.
2. Domino servers also have ID files to prove their identity. However, most administrators insist that their real human users choose a complex password to secure their ID file and change it frequently, but most administrators don't use any password at all on their servers' ID files. This is because otherwise they would need a human to be present to type in the password every time the server is restarted and in any case sharing the ID file's password with all of the potential administrators would negate any security benefit from having a password.

When you run a Java stand-alone program that used the Notes API on a machine which has the Notes client installed you will run with the identity of currently installed ID file (which typically requires you to type a password). When you run this same program on a machine which has the Domino server installed you will run with the identity of server's ID file (which probably doesn't require you to type a password). Because of this you will need to ensure that the server is granted the appropriate access rights to the databases your program needs to use.

Domino has the concept of "scheduled agents" which can run on a server in the background and do various maintenance tasks. If these tasks executed with the server's ID it would be necessary to give the server access rights to a lot of databases which would not be very secure. Instead Domino implements a mechanism that these scheduled agents run with the access rights of the user who signed the agent this means that each of the users can run their own version of the agent running with access rights to just their own databases.

[xpost] Running stand-alone java programs that read and write Notes/Domino databases

[This post was originally posted to my IBM internal blog]

Most code which interfaces with Notes/Domino databases will run in the context of a running client or server e.g. a notes agent which runs on a schedule or in response to an event. However, there are times when you might want to run a stand-alone programs that will read and write Notes/Domino databases.

Bob Balaban (who wrote the definitive book on the Notes Java API) recommends that programmers should write agents in such a way that they can be run either as a stand-alone program or as a Notes agent because of the fact that it is so much easier to debug a Java program than to debug a Notes/Domino agent (he calls this the two headed beast). However, it is also often handy to distribute a program which modifies a Notes database in the form of a stand alone program e.g. I recently had to  write a program which tweaked the settings of a Sametime Community server - since many Sametime administrators don't even realize that they have a Domino server underneath I thought it would be easier to distribute the code in the form of a stand-alone program rather than as an agent and asking administrators to go through the complexity of installing and enabling a Notes agent.

One of the things that is complex about running a piece of Notes/Domino code is that you need a lot of context e.g what Notes ID etc. If you are running java agent on a machine which has Notes installed upon it then the environment variables will be already set up for you, but if your machine does not have Notes installed it can be tricky to figure out all of the paths and environmental variables that are needed. In particular I have often wasted a lot of time trying to get Java programs to run on Linux Domino servers.

What many people don't realize is that Domino Linux servers come with a very handy startup script in /opt/ibm/lotus/notes/latest/linux. that can do all of the hard work for you. To use this program you should invoke your program with the script, like:

/opt/ibm/lotus/notes/latest/linux/startup /LOCATION/MYTOOL

where LOCATION is the path to your tool and MYTOOL is the name of your tool. Then your tool will get invoked with all of the necessary environmental variables defined properly.

This startup script  is really handy, I am not sure why it is not more widely documented.

[xpost] Scribefire and Lotus Connections

[This article was originally posted to my IBM internal blog]

A while ago I wrote up a description of how to configure the Scribefire blog publishing tool to work with Lotus Connections. At that time it was necessary to manually specify the service URL and the API type, but in the meantime Lotus Connections has fixed the way that it identifies itself to tools like Scribefire so that now you simply need to provide the URL of your blog (if you are using the IBM internal deployment be sure to use the https:// version of the blog URL) and your username/password - all other parameters will automatically default to the correct values.

However, there is another issue that people will find when using Scribefire with Lotus Connections. It is not really a bug as such, but it is very annoying nevertheless.

When I configure Scribefire to publish to a blog hosted on wordpress.com, the tool automatically configures all of the blogs that I have write access to on this platform. This is actually quite a convenient feature and in any case it only takes me a few moments to delete the small number of blogs that I don't actively contribute to. However, in Lotus Connections, newly created communities get a blog by default and by default all members of the community have write access to the blog. I am a member of a huge number of communities on the IBM internal deployment of Lotus Connections (I am sure this is quite typical for most employees, especially since you can be added to the membership of a community without having to even give your proposal). As a result when I tried to add my personal blog to my scribefire configuration, I ended up with several pages of blogs added to my list of blogs on Scribefire and I had to scroll down 6 times to find the one blog that I was likely to want to publish to.

I have tried removing the blogs that I don't use from my Scribefire configuration, but this is a tedious task since I need to remove them one by one and Scribefire asks me for confirmation each time. I wonder if anyone knows an easy way to remove several blogs from my configuration?

Why I uninstalled Lotus Traveller from my Phone

I recently enrolled in the Beta program for Lotus Traveler  on Android. A number of friends have asked me how I am getting on with  and they are amazed to hear that I have removed it from my phone. Therefore I thought I should write a short note to explain why.

First to explain that Lotus Traveler is a product which allows people to read Lotus Notes email from their mobile phone. The product has existed for some time, but only recently added support for the Android platform.

The product itself works very well and while a mobile phone is not an ideal platform for reading and replying to emails, it can occasionally be convenient to be able to check for urgent emails or have a quick glance at my scheduled meetings for tomorrow without having to open my laptop.

The only problem is with the IBM security policy which insists that any device which has access to our email infrastructure is protected by an automatic screen-lock that is secured by a password which is at least 8 characters long and contains a mix of upper-case lower-case characters and non-alphabetic characters. This policy is entirely reasonable and I have no problem in typing such a complex password to unlock my work laptop. However, the logistics of typing such a complex password on a small touch screen phone make it rather annoying - especially when I am simply trying to make a phone call on my own personally owned phone.

In addition I eventually decided that it was better for work/life balance if I didn't have constant access to my work email at all times and so I removed Lotus Traveler and reset my phone to use a simpler unlock pattern which is more appropriate to this type of device.

Harnessing the fun factor to bring young people into contact with the Lotus Products

I am delighted to see that Lotus are making special efforts to connect young students during the upcoming Lotusphere event. The Lotus community is very vibrant and the people who work with the Lotus products tend love them and be very loyal. However since Lotus products are not really aimed at the consumer market, many young people who are studying computer science are not even aware of their existence.

The Lotusphere conference which is happening next week in Orlando, Florida is the biggest event in the year for the Lotus community. It combines education and fun in a way that really helps build enthusiasm for Lotus products.  Normally this event is only attended by people who are already working with Lotus products, but this year a special initiative is being undertaken to help connect with the next generation of IT professionals - we are expecting over 500 students from local universities to attend Lotusphere on our special college day 31st of January,

In addition a special Xpages contest for students is being run in conjunction with a business partner. Because of all of the great results from the Hackdays inside IBM I am confident that we will get great results from this contest.

The Irish Lotus Users Group (ILUG) 2010 conference starts tomorrow in Belfast

The Irish Lotus User Group is one of the most active Lotus users groups anywhere in the world. In recent years their annual conference has become very popular and it attracts attendees and speakers from all over the world. Last year no conference was held because the organizers wanted to devote their energy towards launching the UK Lotus user group conference. This year they have decided to hold the conference in Belfast rather than Dublin to give the non-Irish visitors a chance to see a different part of the island (technically this makes it both in Ireland and in the UK).

This years event features 3 days crammed full of interesting talks (often 3 different streams at the same time). Most of the big names in the Lotus world are speaking so it is a great chance to catch up with the latest news on what  is happening with Lotus products. You can check out the full schedule of talks at the conference web site. You must register if you plan to attend, but registration is free. If you can't attend in person, you can normally find out a lot about what is going on my following the twitter hashtag ILUG.

Much of the development team for Lotus products is located in Ireland. This year we will be arranging a meet the developers stand in the exhibition hall. We have arranged a rota of staff to attend so that there will be representatives of all of the major development teams on the stand at all times. This means that if you wish to ask a question about any of the Lotus products you can come and ask one of the development team directly. This is called getting your information straight from the horses mouth!!!

Open Source Software (OSS) Barcamp coming this weekend

The Open Source Software (OSS) Barcamps are "un-conference" type events that are held every 6 months or so to promote all things relating to open source software. I have attended a few of these and always found them to be very interesting. IBM hosted the last event in April of this year, but I was not able to attend due to injury. The next event is scheduled to take place in University College Dublin this coming weekend.

Here is a copy of the presentation I intend to deliver:

OSS Bar Camp - The growing usage of Open Source desktop client SW in IBM

View more presentations from Brian O’Donovan.

It is not just me that will be speaking. In fact, there is such an interesting set of speakers wanting to speak that they extended the schedule to two parallel tracks over 2 days (click here for details). I strongly encourage anyone based in Ireland with an interest in open source software to attend - you will hear many interesting talks and you will also meet many like minded enthusiasts. Registration is is free, but you must apply for a ticket in advance (last time they sold out but I believe there are still some tickets available this time due to a larger venue).

I will be involved in providing AV support for the event. We hope to record some of the talks and post them on-line afterwards for people who cannot make it in person. We may even stream some video live on a newly created OSSBarCamp channel on Ustream. However, I am just learning how to use this platform so I am not making any promises.

Using Notes to manage my Tasks in a GTD way

Since the start of the year, I have been trying out a number of different tools for implementing Getting Things Done (GTD). For the last month or so, I have reverted to using Lotus Notes as a task tracking tool. I have been using the standard Notes email database design and did not use any special tools.

In order to ensure I was following GTD best practices, I read a document from David Allen's company which gives very practical advice on how to use Notes for GTD style task tracking. This guide is quite useful - as a long time Lotus Notes user I already knew most of the tips and tricks, but a new user of Lotus Notes would really benefit from reading this guide. Unfortunately it was written for an older version of Lotus Notes and so it does not mention any of the newer features such as follow-up flags or  the ability to drag emails from your inbox onto your ToDo list to convert them into ToDo items.

While I followed most of the instructions in the guide, I deviated from the official advice in a number of ways:

• David Allen is quite adamant that it is important to distinguish between appointments which have a specific date and time and tasks which don't. However, I like to see at a glance what I need to do next. Therefore I ignored David's advice and configured Notes to show a all incomplete ToDos to on my calendar. I used the following guidelines when deciding which date to assign to tasks:
  
  • By default tasks go into today's list. By looking at a combination of my appointments and ToDo items for a particular day, I can quickly see when I am over booked. For example, if I have only two or three appointments on a day I can expect to get quite a few ToDo items completed, but if I have seven or eight meetings on a particular day I know it is pointless to expect to expect many ToDos to get done in the short gaps between them.
  • Whenever I see a day that is overbooked, Notes allows me to easily change its assigned date by using drag-and-drop to place it on a date with fewer appointments. This automatically updates the start date field for this ToDo without needing me to touch the keyboard.
    
  • By default ToDo items don't have a due date. If something really needs to be done by a particular date I will give a due date of the day before, then Notes will automatically put a red indicator beside it on my calendar after the due date is passed so that I can see it is more urgent.
    
  • I tend to put the less important ToDos on  Friday. This means that they don't clutter up my list of things that I need to do on a particular day, but at the same time I can easily see them if I have some free time and am looking for something to do.
    
  • I put most personal ToDos on Saturday unless they are something which can only be done on a week day (e.g. ring insurance companies to get a quote).
    
  • I put things that fit into the "Someday/Maybe" category onto new years eve. When it comes to the end of the year and I am making new years resolutions I can decide if I want to move these onto the active list or leave them on the "Someday/Maybe" list for next year.
    
  • David Allen recommends creating ToDo entries with an agenda for anyone with whom you will need to meet with regularly e.g. your boss. If I have a scheduled 1-on-1 with somebody I normally place the Agenda entry on the date of our next 1-on-1. If I don't have a scheduled 1-on-1 meeting with this person I move the agenda out some number fo days in the future which reflects my feeling for the urgency of the items on the agenda. If something on the agenda is really urgent I might even place a due date on it to remind me that I need to meet the person in question.
    
• I followed David Allen's instructions on setting up categories for my ToDo items, but I must admit that I did use categories for all of my ToDo items. I find that I tend to have around 30-50 items and so I find it relatively easy to scan through them even if they are not all properly categorised. Therefore the small amount of time required to assign a category to a ToDo item is wasted time for me. I have heard David say that most busy professionals should expect to have about 150-200 outstanding things listed in their task management system. I am not sure if this means that I am not very busy or if it means that I don't capture all of my possible ToDos in a tracking system (I suspect the later).
  
• I delete ToDos as soon as I complete them rather than marking them complete. I do this partly because I want to save space on my limited email quota and partly because I find that completed ToDos tend to clutter up some of the Notes views. However, I do realise that this means I won't be able to properly do reviews of what I was spending my time on - I might  change this policy in the future.
• David Allen's guide gives no mention of the use of Follow-Up flags (probably because they were not contained in the version of Notes that was available when he wrote his guide). This feature allows you to place a flag on an email indicating that you need to take some action on it - then you can safely move it out of your inbox safe in the knowledge that you won't forget it. In general these flags are very simple to use, but I would love to hear some expert advice on how/if these flagged emails should be managed in conjunction with my ToDos
  

In general I find that Notes is very efficient and easy to use. Since I already use Notes for email and managing my calendar, it is very efficient for me not to have to switch to a different tool for managing my tasks. As a result, I think that this will be my task tracking system for the foreseeable future.

I have heard people speak highly of the eProductivity template which makes it even easier to use Notes in a GTD compatible way. It probably is very good, but I find that the standard Notes template works fine for me. In addition I believe that IBM won't pay the cost of the template and I don't think that I want to pay this out of my own pocket.

Why I chose not to use the "GTD for Lotus Notes" tool

If you have been reading this blog, you will know that I have been experimenting with different ways to implement the GTD methodology in a way that best fits my personal preferences and needs. Thanks to some helpful comments from readers I found out that there is a community inside IBM that is focused on helping people implement GTD best practices. Since the members of this community are all working inside IBM, I find that their advice and best practices are very relevant to my situation. One tool that seems to be highly recommended by IBMers is GTD for Lotus Notes which was developed by Brett Philp and is available for use by IBM staff only. I tried out this tool briefly, but after a short assesment I decided not to use it for real task management. This is not because I don't doubt that this is an excellent tool, but because I don't think that using it will give me any advantage.

When you install Brett's tool, it will create a new database for you to use for storing your task information. This database has several excellent views that allow you to manage your tasks in much the same way that you could with RTM or Toodledo. However, moving my task information into a database other than my email database causes me two problems:

• It is no longer possible for me to drag an drop emails onto my ToDo list like I can do with the latest version of the Notes email template (requires Notes 8.5.1 or later). I know that several people have described you to create a SmartIcon which will copy an email into Brett's database with a single click, but I could probably create a similar SmartIcon to copy details from the email to RTM or Toodledo so I lose the benefit of sticking within Lotus Notes.
• My Notes email is hosted on a clustered server so I am confident that I can gain access to it at anytime and I am re-assured that regular backups are being done. This would not be the case with the database created by Brett's tool where I would need to back it up myself and I would not be able to access it from different computers unless I set-up a server to hist it myself.
  

Through the IBM GTD community I also found a pointer to a publication from David Allen Company which advises people on how Lotus Notes users can best  implement GTD practices. I purchased this guide (for US$10) and it seems to provide excellent advice. The only complaint I have about it is that the document is based upon Notes 6.5. with a short addendum on Notes 8. This means that it does not mention some of the newest features of Notes such as the drag-and-drop support or follow-up-flags. It is easy to use drag and drop once you know the feature exists, but follow-up-flags are more complex. I suspect that they can be very useful, but I would appreciate some advice on how to best use them.

Comparing StatusUpdater and WildFire

I am sure there are many people like me who try to stay involved on several different micro-blogging sites. This can be difficult and so it is good to find tools which can help. Both WildFire and Status Updater are Notes/Sametime sideshelf plugins which allow users to read and write to several micro-blogging platforms at the same time. This blog post compares the two tools.

Just in case you think I have a conflict of interest, I should declare that I was involved with an IBM internal project to develop MicroBlogCentral (MBC) that was later released to OpenNTF under the name Status Updater. It seems that there was a totally independent effort carried out by a business partner in Australia to develop a similar tool which they called WildFire which seems at first glance to be very similar. Both tools offer you an option to configure several micro-blogging accounts on different services and then you can enter a status update into a text box and have that status update automatically posted to whichever micro-blogging services you choose.

However, there are a number of aspects where they differ:

• Widlfire supports significantly more services than Status Updater. Status Updater can only support Twitter, Sametime and Lotus Connections services, while Wildfire also supports Bebo, Facebook, GTalk, PingFM. Plurk, Tumblr and WordPress. Even I don't have accounts on all the services that Wildfire supports, so I wasn't able to test them all. It seemed to work fine for me on Lotus Connnections, Facebook, Sametime and Twitter, but I couldn't get it working on PingFM (this is probably a configuration error on my behalf).
• To be fair the IBM internal version of Status Updater does also support BlueTwit, Fringe and Beehive/SocialBlue, but this is hardly of interest to people outside of IBM.
  
• A really significant advantage of Wildfire is that it supports multiple instances of a service. This means that you can use it to post to two different Twitter accounts (e.g. if you have a personal Twitter account and you also post to your company's official Twitter Feed). It also means that you can participate on more than one implementation of Lotus Connections (e.g. you might interact with different communities on the Bleed Yellow and Lotus Live sites).
  
• A big limitation of Wildfire is that although you can use it to send updates to several sites, it only presents to you your friends updates from Twitter. In contrast Status Updater shows you updates from all of the services you have configured. There is a drop down menu which users can choose what exactly is presented in the windows (although I suspect many people don't realize that this menu exists so I show a picture of it below)
  
  
• In general the Status Updater UI is more smooth than that of Widlfire - this is probably due to the fact that the originator of the project works for IBM's UX team. For example
  
  • It provides a system tray icon for rapid access when Notes/Sametime is minimized.
  • When you click on a username, you will be navigated to a list of that person's status updates presented within the plugin UI rather than launching a separate browser window.
    
  • Status updates from each of the services appear with a different background colour so you can see at a glance which service a message was posted upon.
  • For the Lotus connections updates you see an indication of how many people have commented on the status update and with a click you can read these comments and add your own (again without leaving the plugin's UI).
    
• The following screenshots give you a quick idea of what the Status Updater UI looks like. The updates with a light blue background are from the IBM internal BlueTwit system, the updates with a Yellow background are from BeeHive/SocialBlue (another IBM internal system) and the updates with a dark blue background are from Twitter. I obscured some of the text to protect confidentiality, but I left in some text to give you a flavour of how the platform is used:
  
  
  
• The Wildfire UI uses icons which are not intuitive and hence I find very hard to remember what they do without hovering over them and getting the tool-tip to appear. Another problem I have with the Windfire UI is the way it presents whether or not an update has successfully been posted. After you click the submit bin you see a nifty icon beside each service you selected indicating that Wildfire is trying to post your update to the service. When the update is completed the icon changes to a tick if it was successful or a big red X when it fails for any reason - the trouble is that the X or tick goes away after about 2 seconds so if you are not keeping your eyes on the screen you can easily miss the status notification and hence might not realize that a status update failed to register. The sequence of screenshots below illustrate how it looks (which is great except for the fact that the status disappears so quickly).
  
  
• Wildfire was developed with windows support only in mind (a big minus for a Linux fan like me). However, it is actually just the configuration process which is Windows specific. It would not be hard to make the application work across all platforms (I posted a note to their forum telling them how to do this so hopefully they will pick up on this).
  
• Another difference at the code level is that Status Updater has a clean division between the code application and the plugins providing support for each of the services. This means that support for additional servcies can be developed independently of the core application. On the other hand, having the code split into several plugins does make it slightly more complex - not only for the developers, but also for the users who will need to install several plugins to get the same functionality.
  

Either of these tools could definitely be useful for someone who wants to be active on more than one micro-blogging platform. As you can see both tools have significant areas where they are stronger than the other. Therefore I can't reach a definitive conclusion about which tool to recommend and each user would need to decide based upon which requirements are more important to them. I would guess that many IBM internal people would prefer Status Updater because of its slightly smoother UI and its support for the IBM internal platforms. Most others would probably choose Wifdfire because its platform coverage is so much more extensive.

Personally I would love to see the two projects merging to produce a tool which combines the best of both. I have spoken with Jessica who is the main developer behind Status Updater and she is in favor of this idea. I will renew my efforts to contact the people involved in the WildFire project to see if I can insterest them in such a merger.

Delighted that Sametime 8.5 has finally shipped

Almost all of my focus at work for the last few months has been on the Sametime 8.5 project. This is a major upgrade to the IBM/Lotus Sametime product and I am delighted to say that the product has finally shipped. The official announcement says that is will ship on 22nd of December, but the development team have completed all of their work at this stage and the gold master has been passed to the release lab. There was major pressure to have the produce ship before the end of the year, so you can see that we just made it by the skin of our teeth.

Sametime 8.5 includes updates to several parts of the product. Many customers will be excited about the new meeting room client which provides maximum functionality and is ideal for the frequent user of Sametime. However, I suspect that the feature most customers will get excited about is the new Java free web client. Obviously the server is mainly coded in Java, but there is no Java code downloaded onto the browser. We are using the Dojo Toolkit and the latest AJAX techniques which means that the code executed in the browser is all JavaScript. As well as ensuring we are fully buzzword compliant, this means that user can join meetings mush faster because there is no Java Applet to download. It also means that we can now support virtually any browser. Our officially supported browsers are Internet Explorer, Firefox and Safari which should cover a large percentage of users. For other browsers (e.g. Google Chrome) we don't guarantee them, but if you try them you will probably be pleasantly suprised to find they work.

If you want to try it out for free you can visit Lotus Greenhouse. Currently a Beta version is installed on Greenhouse, but I am sure it will be upgraded to the gold coe very soon.