Results matching “x11”

dspace shibboleth config and debug

Configuring shibboleth is always somewhat confusing for me, so I decided to write this blog post to document how configuration for dspace is done and debugged.

This information is scattered over documentation and dspace-tech mailing list so hopefully this will be useful to someone, at least me if I ever needed to do this again.

First step is to install mod-shib for apache: apt install libapache2-mod-shib Now there are two files which have to be modified with your information, /etc//shibboleth/shibboleth2.xml which defines configuration and /etc/shibboleth/attribute-map.xml to define which information will be passwd from shibboleth to application.

attribute-map.xml

Here we have to define headers which dspace expects, so it can get information from upstream idenitity provider.

diff --git a/shibboleth/attribute-map.xml b/shibboleth/attribute-map.xml index 1a4a3b0..a8680da 100644 --- a/shibboleth/attribute-map.xml +++ b/shibboleth/attribute-map.xml @@ -163,4 +163,34 @@ </Attribute> --> +  + <Attribute name="urn:oid:0.9.2342.19200300.100.1.1" id="SHIB-NETID"/> + <Attribute name="urn:mace:dir:attribute-def:uid" id="SHIB-NETID"/> + <Attribute name="hrEduPersonPersistentID" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="SHIB-NETID"/> + + <Attribute name="urn:oid:0.9.2342.19200300.100.1.3" id="SHIB-MAIL"/> + <Attribute name="urn:mace:dir:attribute-def:mail" id="SHIB-MAIL"/> + <Attribute name="mail" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="SHIB-MAIL"/> + + <Attribute name="urn:oid:2.5.4.42" id="SHIB-GIVENNAME"/> + <Attribute name="urn:mace:dir:attribute-def:givenName" id="SHIB-GIVENNAME"/> + <Attribute name="givenName" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="SHIB-GIVENNAME"/> + + <Attribute name="urn:oid:2.5.4.4" id="SHIB-SURNAME"/> + <Attribute name="urn:mace:dir:attribute-def:sn" id="SHIB-SURNAME"/> + <Attribute name="sn" nameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic" id="SHIB-SURNAME"/> + </Attributes>

shibboleth2.xml

This is main configuration file for shibd. First we need to add OutOfProcess and InProcess to include useful information in shibd.log which are very useful.

diff --git a/shibboleth/shibboleth2.xml b/shibboleth/shibboleth2.xml index ddfb98a..7b55987 100644 --- a/shibboleth/shibboleth2.xml +++ b/shibboleth/shibboleth2.xml @@ -2,15 +2,46 @@ xmlns:conf="urn:mace:shibboleth:3.0:native:sp:config" clockSkew="180"> - <OutOfProcess tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a" /> +  + <OutOfProcess logger="shibd.logger" tranLogFormat="%u|%s|%IDP|%i|%ac|%t|%attr|%n|%b|%E|%S|%SS|%L|%UA|%a"> +  + </OutOfProcess> + +  + <InProcess logger="native.logger"> + <ISAPI normalizeRequest="true" safeHeaderNames="true"> +  + <Site id="1" name="sp.example.org"/> +  +  + </ISAPI> + </InProcess> +   - <ApplicationDefaults entityID="https://sp.example.org/shibboleth" + <ApplicationDefaults entityID="https://repository.clarin.hr/Shibboleth.sso/Metadata" REMOTE_USER="eppn subject-id pairwise-id persistent-id" cipherSuites="DEFAULT:!EXP:!LOW:!aNULL:!eNULL:!DES:!IDEA:!SEED:!RC4:!3DES:!kRSA:!SSLv2:!SSLv3:!TLSv1:!TLSv1.1"> @@ -31,8 +62,8 @@ entityID property and adjust discoveryURL to point to discovery service. You can also override entityID on /Login query string, or in RequestMap/htaccess. --> - <SSO entityID="https://idp.example.org/idp/shibboleth" - discoveryProtocol="SAMLDS" discoveryURL="https://ds.example.org/DS/WAYF"> + <SSO + discoveryProtocol="SAMLDS" discoveryURL="https://discovery.clarin.eu"> SAML2 </SSO> @@ -68,6 +99,10 @@  + <MetadataProvider type="XML" url="https://login.aaiedu.hr/shib/saml2/idp/metadata.php" backingFilePath="aaieduhr-metadata.xml" maxRefreshDelay="3600" />  <!--

certificates

To make upstream identity provider connect to us, we need valid certificate so we need /etc//shibboleth/sp-encrypt-cert.pem and /etc/shibboleth/sp-encrypt-key.pem.
Since we are using Let's encrypt for certificates, I'm using shell script to move them over and change permissions so shibd will accept them.

dpavlin@repository:/etc/shibboleth$ cat update-certs.sh
#!/bin/sh -xe

cp -v /etc/letsencrypt/live/repository.clarin.hr/privkey.pem sp-encrypt-key.pem
cp -v /etc/letsencrypt/live/repository.clarin.hr/cert.pem sp-encrypt-cert.pem
chown -v _shibd:_shibd sp-*.pem
/etc/init.d/shibd restart

dspace configuration

We are using upstream dspace docker which includes local.cfg from outside using docker bind, but also re-defines shibboleth headers so we need to restore them to default names defined before in /etc/shibboleth/attribute-map.xml.

diff --git a/docker/local.cfg b/docker/local.cfg index 168ab0dd42..6f71be32cf 100644 --- a/docker/local.cfg +++ b/docker/local.cfg @@ -14,3 +14,22 @@ # test with: /dspace/bin/dspace dsprop -p rest.cors.allowed-origins handle.prefix = 20.500.14615 + +shibboleth.discofeed.url = https://repository.clarin.hr/Shibboleth.sso/DiscoFeed + +plugin.sequence.org.dspace.authenticate.AuthenticationMethod = org.dspace.authenticate.PasswordAuthentication +plugin.sequence.org.dspace.authenticate.AuthenticationMethod = org.dspace.authenticate.ShibAuthentication + +# in sync with definitions from /etc/shibboleth/attribute-map.xml +authentication-shibboleth.netid-header = SHIB-NETID +authentication-shibboleth.email-header = SHIB-MAIL +authentication-shibboleth.firstname-header = SHIB-GIVENNAME +authentication-shibboleth.lastname-header = SHIB-SURNAME +# Should we allow new users to be registered automatically? +authentication-shibboleth.autoregister = true

example of working login

==> /var/log/shibboleth/shibd.log <== 2024-11-18 17:18:40 INFO XMLTooling.StorageService : purged 2 expired record(s) from storage ==> /var/log/shibboleth/transaction.log <== 2024-11-18 17:27:42|Shibboleth-TRANSACTION.AuthnRequest|||https://login.aaiedu.hr/shib/saml2/idp/metadata.php||||||urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|||||| ==> /var/log/shibboleth/shibd.log <== 2024-11-18 17:27:42 INFO Shibboleth.SessionCache [1] [default]: new session created: ID (_e37d7f0b8ea3ff4d718b3e2c68d81e45) IdP (https://login.aaiedu.hr/shib/saml2/idp/metadata.php) Protocol(urn:oasis:names:tc:SAML:2.0:protocol) Address (141.138.31.16) ==> /var/log/shibboleth/transaction.log <== 2024-11-18 17:27:42|Shibboleth-TRANSACTION.Login|https://login.aaiedu.hr/shib/saml2/idp/metadata.php!https://repository.clarin.hr/Shibboleth.sso/Metadata!303a3b0f72c5e29bcbdf35cab3826e62|_e37d7f0b8ea3ff4d718b3e2c68d81e45|https://login.aaiedu.hr/shib/saml2/idp/metadata.php|_3b8a8dc87db05b5e6abf8aaf9d5c67e6ebc62a2eed|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|2024-11-18T17:01:57|SHIB-GIVENNAME(1),SHIB-MAIL(2),SHIB-NETID(1),SHIB-SURNAME(1),persistent-id(1)|303a3b0f72c5e29bcbdf35cab3826e62|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST||urn:oasis:names:tc:SAML:2.0:status:Success|||Mozilla/5.0 (X11; Linux x86_64; rv:134.0) Gecko/20100101 Firefox/134.0|141.138.31.16

boken urf-8 in shibboleth user first name or surname

You might think that now everything works, but dspace will try to re-encode utf-8 characters received from upstream shibboleth using iso-8859-1 breaking accented characters in process. It has configuration for it, but by default it's false.

root@4880a3097115:/usr/local/tomcat/bin# /dspace/bin/dspace dsprop -p authentication-shibboleth.reconvert.attributes false

So we need to modify dspace-angular/docker/local.cfg and turn it on:

# incomming utf-8 from shibboleth AAI authentication-shibboleth.reconvert.attributes=true

DORS/CLUC 2019: Mainline kernel on ARM Tegra20 devices that are left behind on 2.6 kernels

Is it possible to take obsolete Android device and port it to mainline kernel with Debian? (make RaspberryPi-like device)

X11 running on Nook Color without Android stack

I have been toying around with idea of having real Linux stack (X11 and friends) on Nook Color. While this seems like a silly thing to do, it does allow me to use x2x and transfer keyboard and mouse from my laptop to tablet which is handy. If also allows me to run X11 applications on tablet screen using DISPLAY=nook.lan:0. I was fortunate enough to find blog post how to run Linux framebuffer X server on Android but I wanted to use touchscreen so I decided to write my own xorg.conf (this brings back memories...).

To get full-blown Debian-based distribution on your Android take a look at BotBrew Basil. It's Emdebian based distribution which will setup mount points and various other stuff so you don't have to do that manually. Since it's Debian based, you are not limited to Emdebian packages -- you can (and will have to) add normal sid:

(BotBrew)root@localhost:/# cat /etc/apt/sources.list.d/sid.list 
deb [arch=armel] http://ftp.debian.org/debian sid main contrib non-free

If you want to know more about Emdebian hop over to DebConf 12: Integrating Emdebian into Debian [video].

With all this prepared, we are ready to shut down Android stack:

adb shell setprop ctl.stop media
adb shell setprop ctl.stop zygote
adb shell setprop ctl.stop surfaceflinger
adb shell setprop ctl.stop drm

Next step is installation of required packages:

dpavlin@t61p:~$ adb shell
root@android:/ # TERM=xterm chroot /data/botbrew-basil/ /bin/bash --login
(BotBrew)root@localhost:/# apt-get install xserver-xorg-video-fbdev xserver-xorg-input-evdev \
   xserver-xorg-input-multitouch x11-xserver-utils xinit \
   matchbox matchbox-keyboard xterm

I decided to use matchbox, mostly becuase it's only window manager which comes with on-screen keyboard which is useful on touch screen device.

After installation you will need to setup X symlink and create .xinitrc:

root@android:/ # ln -s /usr/bin/Xorg /usr/bin/X

root@android:/ # cat ~/.xinitrc                                              
( sleep 1 ; matchbox-keyboard -o portrait ) &
xhost 192.168.1.61
matchbox-session

Finally, you need to create xorg.conf:

Section "ServerLayout"
    Identifier    "Layout0"
    Screen        "Screen0"
    InputDevice   "cyttsp-i2c" "CorePointer"
    InputDevice   "gpio-keys" "CoreKeyboard"
    InputDevice   "twl4030-keypad" "CoreKeyboard"
EndSection

Section "InputDevice"
    Identifier    "gpio-keys"
    Driver        "evdev"
    Option        "Device" "/dev/input/event0"
    # code 102 (KEY_HOME)
    # code 116 (KEY_POWER)
EndSection

Section "InputDevice"
    Identifier     "twl4030-keypad"
    Driver         "evdev"
    Option         "Device" "/dev/input/event1"
    # code 114 (KEY_VOLUMEDOWN)
    # code 115 (KEY_VOLUMEUP)
EndSection

Section "InputDevice"
    Identifier     "cyttsp-i2c"
    Driver         "multitouch"
    Option         "Device" "/dev/input/event2"
    # mouse should move as fast as finger and not faster
    Option         "AccelerationScheme" "none"
    # evdev has it, multitouch doesn't so it behaves like touchpad
#   Option         "IgnoreRelativeAxes" "True"
EndSection

Section "Device"
    Identifier    "Card0"
    Driver        "fbdev"
    Option        "fbdev" "/dev/graphics/fb0"
    # rotate screen to be in sync with touchpad orientation
    Option        "Rotate" "CCW" # CW=90 UD=180 CCW=270
EndSection

Section "Screen"
    Identifier    "Screen0"
    Device        "Card0"
EndSection

This will map all hardware keys and use mutitouch driver for screen. To make it work, I used evtest package which allows you to see events from input devices so you will know which device produce keyboard events and which produce multitouch events. To be honest, this solution isn't prefect, because screen behaves like touchpad, so you can't just point to screen and expect your cursor to just to that position.

Following video shows X server in action.

This is simple unaccelerated frame buffer. This makes performance less then desirable. There are a few implementations of OMAP xorg server:

xf86-video-omapfb uses DSS kernel support which seems to be part of CM kernel, so this might be good next thing to try out
xf86-video-omap is newer implementation, but this requires 3.3 kernel and is not yet stable.

Having accelerated OMAP X server and fixed touchscreen issues would make Nook somewhat nice Linux tablet, if only it isn't so heavy for day-to-day use :-)

DORS/CLUC 2012 conference

As you all know by now, last week we had another DORS/CLUC conference. This time I had two talks and one workshop.

Sysadmin cookbook

I never proparly introduced this project here, but if you want to know more about my convention based documentation examine the presentation of hop over to http://sysadmin-cookbook.rot13.org/ and take a look at generated documentation.

Basic idea is to document changes in easy to write files on file system (preserving symlinks to files on system which allows you to quickly see if cookbook is deployed or not and diff between template and deployed configuration). I know that my cookbook is mix of various things I did in last three years, but I do find it useful, so hopefully it might be useful to you also.

Kindle - so much more than ebook reader

This was longer talk about my one year experience with Kindle. I must say that I'm still very happy user of Kindle, but in this talk, I tried to cover Kindle Developer's Corner at mobileread forum as well as other related projects:

Free Libre command-line tools for Kindle development
A PDF (plus DJVU, ePub, TXT, CHM, FB2, HTML...) viewer made for e-ink framebuffer devices, using muPDF, djvulibre, crengine mobileread forum thread
A VNC viewer for ebook readers which allows you to use Kindle as second screen mobileread forum thread

So if you are still wondering if it's worth the effort to install third-party software on Kindle, answer is yes, it is!.

Web scale monitoring

This was a workshop which doesn't have much with web (it's about monitoring ADSL CPE devices and provider equipment in-between), but it shows (I hope) nice way to integrate several project to provide nice scalable monitoring infrastructure. It's composed of:

Gearman message queue together with Gearman::Driver provide on-demand scaling of workers
redis saves all data from external systems (LDAP, CRM) and all results from statistics collection nicely providing data for web interface
PostgreSQL stores all collected data, using hstore to provide unstructured key value store for different data from different devices while still allowing us to use SQL to query data (and export it to data warehouse)
Mojolicious provides web interface which uses data from redis and provides JSONP REST interface for Angular.js

All in all it's a nice combination of tools which served my need quite well, so I hope it was also useful to people who attended workshop.

x2x: share mouse and keyboard over ssh

For quote some time I have been using x2x to have single keyboard and mouse for multiple machines (EeePC or third monitor at work), but I had problem with selection buffers. x2x was written for scenario where all X servers are listening to network connections, so if you had two machines klin and t42 and you wanted to use keyboard and mouse on klin you would have to do something like this:

dpavlin@t42:~$ xhost klin

dpavlin@klin:~$ x2x -to klin:0 -west

However, recent Debian systems are not listening to TCP connections, so you will have to modify xserverrc for this to work:

dpavlin@t42:~$ cat /etc/X11/xinit/xserverrc 
#!/bin/sh

exec /usr/bin/X11/X #-nolisten tcp

However, it's much nicer to depend on ssh X11 forwarding to provide encryption using:

dpavlin@klin:~$ ssh -X t42 x2x -to :0 -west

To finish this post, I have to include small patch which allows to switch copy/paste direction (which I don't need any more, but it proved useful in at least one case):

diff -r 2ce6789a43da x2x.c
--- a/x2x.c     Tue Mar 18 22:47:34 2008 +0600
+++ b/x2x.c     Tue Nov 24 14:08:16 2009 +0100
@@ -1125,7 +1125,7 @@
       if (doSel) {
         // pDpyInfo->initialClipboardSeen = False;
         pDpyInfo->winSelText = NULL;
-        pDpyInfo->hwndNextViewer = SetClipboardViewer(pDpyInfo->edgewindow);
+        pDpyInfo->hwndNextViewer = SetClipboardViewer(pDpyInfo->bigwindow);
       }
 
       pDpyInfo->onedge = 0;

Change gtk font size without userChrome.css

If you have any objection your X11 setup (especially if you are not running Gnome or KDE) it's probably: Firefox menu font size is too big! However, that's really not right complaint. If you create your own userChrome.css and install it in correct location, you will notice that rest of applications still won't look good. But, Firefox was biggest problem, so you move on...

But, solution is really simple:

dpavlin@t61p:~$ cat .gtkrc-2.0 
gtk-font-name = "Verdana 7"

This will change all GTK application's (including FIrefox, OpenOffice.org and others) to sane font size for huge monitors with high DPI settings. It's a single line fix to all your problems!, take a look:

X11 selection, clipboard and how to use them

One of first differences when you start using X11 is that you can just select any text on screen and press middle mouse button to paste it back. But, after a while you end up in situation where you did ctrl+c in application, and somehow you expect that middle mouse button will paste it back.

X11 implementation of copy/paste is much more complicated, as you might read from excellent X Selections, Cut Buffers, and Kill Rings.

Most of the time, having two different clipboards is very useful. Think about copy/pasting url and title at the same time from one web page to another (like I do often when writing blog posts like this one).

So, how to we manage buffers more efficiently? First, install xclip and try it out:

dpavlin@t61p:~$ xclip -h
Usage: xclip [OPTION] [FILE]...
Access an X server selection for reading or writing.

  -i, -in          read text into X selection from standard input or files
                   (default)
  -o, -out         prints the selection to standard out (generally for
                   piping to a file or program)
  -l, -loops       number of selection requests to wait for before exiting
  -d, -display     X display to connect to (eg localhost:0")
  -h, -help        usage information
      -selection   selection to access ("primary", "secondary", "clipboard" or "buffer-cut")
      -noutf8      don't treat text as utf-8, use old unicode
      -version     version information
      -silent      errors only, run in background (default)
      -quiet       run in foreground, show what's happening
      -verbose     running commentary

Help output is probably a little verbose, but just remember following things:

-in is default
-out displays content
default selection is primary (which is content you marked on screen)
-selection clipboard is only other thing you need to rember

So, armed with that knowledge, here are couple of examples:

# display selected text
xclip -out

# display clipboard (copy/paste in applications)
xclip -out -selection clipbaord

# transfer selection into copy/paste buffer
xclip -out | xclip -selection clipboard

# transfer selection into copy/paste buffer
xclip -out -selection clipboard | xclip

Last example is useful if you want to paste something back in terminal and it somehow ended up in copy/paste buffer, following is Zotero example:

Just let your imagination go wild: what if you have only textarea and you want to do some massive editing for which vi whould be better? You can install excellent It's All Text! Firefox extension but, you could also write something like this:

xclip -out > /tmp/$$.txt && vi /tmp/$$.txt && xclip -in -selection clipboard < /tmp/$$.txt

You could bind that to a key in your window manager or start different editor if you wanted to... or I guess live can be simple again if you just install autocutsel

Few days after I wrote this blog post, I had interesting problem. I was trying to decrease font size in firefox and I found instructions which included filename and content itself. I copied content with Ctrl+C and selected filename and used this little gem:

xclip -sel clipboard -out > `xclip -out`

Presentations with video clips in x11

I wanted to have full-screen presentation with two video files in-between slides. And I didn't really want to depend on network to present it. I even wanted to use properly scaled video depending on projector resolution.

In my expirience, best way to preserve presentation format is to export it into pdf. And than with a little bit of shell scripting...

xpdf -fullscreen /home/dpavlin/Desktop/sf3-2009_oslobodimo_hardware.pdf
mplayer -fs /home/dpavlin/llin/RFID/ffzg-promo-knjiznica.avi
xpdf -fullscreen /home/dpavlin/Desktop/sf3-2009_oslobodimo_hardware.pdf 3
mplayer -fs /home/dpavlin/llin/RFID/comet-meteor-koha-rfid.ogv
xpdf -fullscreen /home/dpavlin/Desktop/sf3-2009_oslobodimo_hardware.pdf 6

I got exactly what I needed. Both xpdf and mplayer have full screen options and xpdf can jump to specific slide. Even keyboard shortcut to exit programs (q) are the same!

So, I just flip first two slides, press q and play first video in full screen. When it ends, I will be on next slide in xpdf. You will see background for a bit (so switch to empty virtual desktop or something), but other than that it works nicely and predictably.

xlax: controlling multiple xterms at once

I rarely use X11 for system administration. There is one tool, however, which was always invaluable to me: xlax. Sure, there are other solutions but somehow, I got addicted to xlax ever since I was introduced to it by fellow sysadmin.

Until today, that is. I always have source on the disk since it was such a hard thing to find. I run quick xmkmf on it, and... it didn't work! However, since xlax now has a home page which explains everything about XTerm*allowSendEvents I was on right track.

But, now so fast, grasshopper!

dpavlin@llin:/rest/unix/x11/xlax2.4$ make
gcc -m32 -o xlax -g -O2 -fno-strict-aliasing       xlax.o -lXaw -lXmu -lXt -lSM -lICE -lXpm  -lXext -lX11      
xlax.o: In function `SetupInterface':
/rest/unix/x11/xlax2.4/xlax.c:173: undefined reference to `strlcpy'
collect2: ld returned 1 exit status
make: *** [xlax] Error 1

Argh. I started with Digital UNIX (called OSF/1 back then) and part of my brain which deals with minor adjustments hasn't died yet, so I decided to do quick google search for strlcpy which which has handy link to strlcpy implementation in OpenBSD. Licensing terms aside, I decided to give it a try.

After applying following patch:

diff -urw xlax2.4/Imakefile xlax2.4.strlcpy/Imakefile
--- xlax2.4/Imakefile   2008-07-31 22:18:25.000000000 +0200
+++ xlax2.4.strlcpy/Imakefile   2009-04-30 21:32:15.000000000 +0200
@@ -5,8 +5,8 @@
 #            DEFINES = -DDEBUG
             DEPLIBS = XawClientDepLibs
     LOCAL_LIBRARIES = XawClientLibs
-               SRCS = xlax.c
-               OBJS = xlax.o
+               SRCS = xlax.c strlcpy.c
+               OBJS = xlax.o strlcpy.c
 
 ComplexProgramTarget(xlax)

and quick xmkmf && make and I got it compiled.

Another trivial change was to implement automatic ssh to each host in mkxlax by adding -e 'ssh $ARGV[$i]' to system xterm line so I will have remote reminals opened by default.

And now, back to real work :-)

Xorg Intel virtual setup for dual display

It seems that Intel driver for Xorg allocates virtual destop as maximum rectangular size of biggest attached screen. In my example, I have:

1920*1200 LCD monitor connected via VGA (sic! x200 doesn't have DVI)
1280*800 internal LCD display

Xorg seems to think that my virtual desktop should be 1920*1920. This is probably correct if I want to rotate my screen freely (which doesn't really work with Intel driver because screen refresh in any orientation other than normal is just too slow to be useful).

I want to have VGA output above internal LVDS with something like

xrandr --output VGA --auto --above LVDS

It should be 1290*2000 = 1920*(1200+800) so I had to add following in /etc/X11/xorg.conf:

Section "Screen"
        Identifier      "Default Screen"
        Monitor         "Configured Monitor"
        SubSection "Display"
                Virtual 1920 2000
        EndSubSection
EndSection

Nice and simple. I really love new x.org configuration files with much less clutter...