yousendit.com - send large files by email

Because a lot of the work that we do is visual, we often need to shift large files around and Futurate's experience is that email becomes impractical once an attachment size of a megabyte has been exceeded. This isn't a problem for us internally, but if clients or partners want to rapidly get media files to us then it's more of a headache.

yousendit.com get's around this by providing a simple 'email client' style web interface that allows anyone to upload a file to their site, and then send an email with a download link (the whole process is very quick - it basically takes the pain out of trying to get an alternative such as FTP organised).

If you are a regular user of the service then you'll need to pay for yousendit, but they also offer a free, 'lite' version which allows a maximum file size of 100mb and 1gb of data download a month.

Shibboleth in 60 Seconds

Warning: This article contains more than your recommended daily allowance of vitamin Geek. Non-geeks should look away now and check out some of our other articles.

About Shibboleth

Shibboleth (http://shibboleth.internet2.edu), according to it's website:

is standards-based, open source middleware software which provides Web Single SignOn (SSO) across or within organizational boundaries. It allows sites to make informed authorization decisions for individual access of protected online resources in a privacy-preserving manner.

That, from the point of view of a developer needing to integrate with Shibboleth isn't much help. Having read through a great deal of documentation on the website I was still non-the-wiser. Enlightenment came after I spoke to the very helpful Fiona Culloch who explained it all.

In a Nutshell

So here, for any developers trying to get their head around how to integrate Shibboleth into an existing app, is the lowdown in 60 seconds:

• Your application does not communicate with Shibboleth directly. The 'magic' happens before any of your code is run.
• When a request for a page is made, Shibboleth checks to see if the page requires authentication. If it does, Shibboleth redirects the user to an authentication page where they enter their credentials (usually their username / password).
• Once authenticated or if the page doesn't require authentication, normal (web)service resumes. Shibboleth inserts some data into the web server environment variables and then passes control back to your page. You can read this data in your application and use to identify the user.
• Shibboleth remembers the user has authenticated on each subsequent page request and continues to update the environment variables until the user ends the session.
• If they failed to authenticate, protected pages are never reached and the environment variables are never set.

Simple eh? And secure too. At no point in the process is anything that could be used to identify your user made visible to any potential snoopers.

Who Are you?

So, how do you know WHO your user is and and WHAT they are allowed to do in your application?

One of the environment variables Shibboleth sets is the 'targeted id'. This ID is unique to the user but doesn't contain any identifying information.

You can arrange with Shibboleth to insert additional information (such as their group, their email address etc.) but for the majority of developers, your application will already be storing this kind of information.

Integrating With Your System

I'm assuming you already have some sort of Access Control system in place in your application. In this case, you would store the targeted id in your user table along side all the usual stuff you store about your uses and use the one supplied in the environment variable to lookup their details in your system.

Practical Examples

Here's a few examples of the most common authentication requirements. These examples assumes you are using your own user / groups / roles / permissions code. We are using Shibboleth purely to handle the authentication.

Page 1:

Synopsis:

• Viewable by anyone.
• For anyone not signed in, display a link to the login page (4).
• For authenticated users, add a link to page 2
• For authenticated users in the admin group, add a link to page 3

Pseudocode:

display the page

if shibboleth environment variable is empty {

 display a link to the sign in page (4)

}
else {

 display the link to page 2

 using the environment variable, lookup the user's details

 if the user's group is "admin" {

   display the link to page 3

 }

}

Page 2:

Synopsis:

• Only visible to authenticated users, irrespective of which group they are in

Pseudocode:

if the shibboleth environment variable is empty {

 access denied

}
else {

 display the page

}

Page 3:

Synopsis:

• Only visible to authenticated users in the admin group

Pseudocode:

if the shibboleth environment variable is empty {

 access denied

}
else {

 using the environment variable, lookup the user's details

 if the user's group isn't "admin" {

   access denied

 }
 else {

   display the page

 }

}

Page 4:

Synopsis:

• Sign in page

Pseudocode:

redirect the user to page 1

Hang on a minute, what's happing on page 4?

Firstly, you must instruct the Shibboleth module in advance that page 4 requires authentication. This is the only page in this example that Shibboleth is 'protecting'. This is usually a job for the Shibboleth System Administrator and out of scope for this article.

When the user follows the sign in link, shibboleth sees that the sign in page requires authentication and redirects the user to the shibboleth authentication page.

Once the user has authenticated, Shibboleth sets its environment variables and redirects them back to our sign in page. The sign in page redirects them back to page 1 as Shibboleth continues to update the environment variables for each subsequent page request.

If they fail to authenticate, the code never runs and the environment variables are never set

Questions and Comments?

Do you have any tips or tricks for working with Shibboleth? I'd love to hear them!

Is poor usability Google's achilles heal?

In the day's when Google just offered search, the elegance of the user interface stood in stark contrast to the offerings of Yahoo and others (which were busy relegating search to the same status as stock reports and horoscopes).

Google was a breath of fresh air and the company deserved to get ahead, but is it only me that's getting increasingly frustrated with the usability of their products?

iGoogle (Google personalised version of Google search) is a particular source of frustration. For example we use Google Analytics to track activity on Futurate's website but I can find no way to add a link to our Analytics account from the iGoogle home page. 'Add a tab' allows me to create a category for content that is then preselected by Google, 'Add stuff' allows me to add a 'gadget' (a feed or web app) while 'more' is a list of links to other Google offerings and Analytics is missing for some reason.

Add to this the fact that Google don't offer new users of iGoogle much in the way of support or help, or even a clear indication of what iGoogle does and it's easy to get confused (or is it just me?).

In my view the developers of iGoogle seem to have assumed that the role and use of iGoogle is obvious, but I don't think it is (adding a tab called 'Google' is perhaps the most useful approach to getting up to speed if you are a user of gmail, google docs or similar but there is still nothing from Google Analytics).

Whenever I use iGoogle I find myself asking questions like 'I want to move a tab, can I just drag it' (not possible), or what happens if I add a tab and uncheck 'automatically add stuff based on tab name'. I spend most of my time experimenting with iGoogle rather than getting it to work for me, which is an interesting puzzle (and material for this post) but not much more.....

If you've got a view I'd love to hear it!

MS Office Compatibility Pack

Futurate have been using Microsoft Office 2007 for a number of months. I'm not entirely convinced that it has bought us too many benefits beyond improvements to Word bullets and numbering.....but one thing we do tend to trip over is the lack of backwards compatibility between the new 2007 file formats and older versions of Word. There is a solution to this however, in the form of the Microsoft Office Compatibility Pack which will allow users of Office 2000 up to convert Office 2007's Open XML formats.

Whitepaper Available - How to Stay Focused on Your Customers in the Web 2.0 Age

As well as our new whitepaper on web accessibility, don't forget that our December 2007 paper is still available - http://www.futurate.com/resources/whitepapers/

New Whitepaper Available - Web accessibility for web managers: part 1

Futurate's latest whitepaper is now available for download from -

http://www.futurate.com/resources/whitepapers/

You can also download our previous whitepaper called - Five tips to help you stay focused on your customers in the ‘Web 2.0’age - from the same location.

If you have any comments, I'd love to hear them.

Museums and eCommerce

Over the last few months Futurate been working with Shetland Museums on a new web presence for their fantastic new museum at Hay's Dock. Like many museums/archives they're considering how best to use eCommerce to leverage their commercial activities and so this recent report from the East Midlands Museums, Libraries and Archives Council on the potential role of online trading in museum activity is timely.

The paper doesn't really tackle the technicalities and it is inevitably focused on the needs of museums in the East Midlands, however it offers sensible advice regarding strategy that's of value to any museum/archive. Among other points Selina Fellows argues that museums need to concentrate activity on high yield products and services and I found the report's summary of potential business opportunities (section 4) particularly interesting.

Asus Eee PC - One Laptop Per Man, Woman and Child?

We haven't had chance to try one yet, but the Asus Eee PC (be warned Asus's website is clunky and slow) has in our view, the potential to turn the portable computing world on its head.

Over the last few months we've begun to see manufacturers such as Apple directly integrating third-party web-based applications such as Google Maps into their devices and Asus have gone a step further by combining free (or advertising driven) applications such as Google Docs, with a free open source operating system (Linux) and low cost solid-state hardware into a cheap, portable device.

The inclusion of wifi, speakers and microphone also means that it's treading on the toes (a little) of Smartphones and the iPhone. Some bloggers (Seb Schmoller for example) see the emergence of low cost solid state devices that rely on the Web for much of their functionality as heralding a shift from a reliance on MS/Apple based operating systems, and given our experience with Windows Vista, that's no bad thing. 2008 is going to be an interesting year.

More on MOSS 2007 Accessibility

It's pretty clear that the onus is very much with the Sharepoint developer to ensure that a Sharepoint site is accessible and there is a limit to what can be done through tools such as Sharepoint Designer to ensure that a site is accessible. Our efforts to get Sharepoint to effectively render a Master page that doesn't use tables for layout for example have been fruitless to date (we've not given up yet though), which means that the maximum achievable compliance level is going to be Single A, whereas the minimum compliance level for public sector websites in the UK is Double A.....

This area is developing rapidly however and we shall see whether working practices and tools emerge which will resolve this. For the moment however, if it is essential that your website/intranet is Accessible at WCAG 1.0 Double A then Sharepoint may not be the platform for you. Although it's worth noting that when it comes to accessibility Sharepoint isn't the only major CMS/intranet product that disappoints in this area.

Sharepoint 2007: Accessibility

Over the last few months we've been working on a number of website/intranet deployments that are based on Microsoft Sharepoint 2007. The platform definitely has some strengths, and it is likely to be widely adopted but the degree to which it complies with accessibility requirements has been difficult to establish, and the 'out of the box' templates that have been provided by Microsoft have not helped this since they fail even to comply with general W3C coding standards.

However, after considerable debate among Sharepoint users, and some statements from Microsoft it looks as though the question is finally being answered and the answer seems to be that Sharepoint 2007 is nearly accessibile and contains end user functionality that can make it more accessible.

The last quarter of 2007 also saw the release of the feely available Accessibility Kit for Sharepoint 2007, which was developed by Hisoftware in partnership with Microsoft and is currently under evaluation here at Futurate.

In the digging on this subject that I've done over the last few days the following are probably the most valuable resources I've found for those people who are interested in current thinking:

• Understanding and enabling MOSS 'more accessible mode' (towards page bottom)
• The degree to which MOSS 2007 complies with the requirements of the W3C WCAG
• The Microsoft Sharepoint team blog
• The Official MOSS 2007 Accessibility Kit
• The Microsoft Developer Accessibility Centre
• Cross-browser compatibility in MOSS 2007
• Microsoft's statement on accessibility improvements in MOSS 2007.

I'm still looking into this and my intention is to expand the list above if I find anything interesting.