BoothBilt Blog

2010/03/05

PowerShell to create a SID file for FIM 2010

Filed under: FIM2010, PowerShell — James @ 11:27 am

The situation:

I want to add an account to the FIM portal manually, and make that account a FIM Administrator.

Of course, for this to work, the FIM portal needs to have the account name, domain, and objectSID of my new FIM administrator. Account name and domain are not a problem, but how to get SID in there? Yes, the account exists in AD, but it is stuck off in an OU that will never be discovered, so I can’t just flow it through an AD MA. If you look at the existing administrator object in Advanced view, you see the objectSID and can even export it to a file. There’s a browse button too, so to import a SID, you just need to point to a 28 byte binary file that holds the SID. But how to create this file?

Turns out to be dead simple in Server 2008 R2. The following few lines will do it (assuming you’ve already imported the ActiveDirectory module).

$b = New-Object byte[] 28
$u = Get-ADUser squeebo
$u.SID.GetBinaryForm($b,0)
$b | Set-Content ($u.SamAccountName + '.dat') -Encoding byte

I’ve been discovering lots of little things like this as I’ve been using FIM more, and I’ll blog about them as soon as I can organize my thoughts a bit. Most of them are a little more complicated than this, and were the result of a lot of iterations and head-scratching, so I need to distill them down before I post.

2010/02/15

Handy PowerShell script for tweaking $env:PATH

Filed under: PowerShell — James @ 2:47 pm

Anyone who has worked with me knows I’m a bit of a command-line junkie. Lately, I’ve been setting up a test environment with lots of servers. I want to be able to use my favourite command line utils from the prompt, and since this is a Microsoft Windows environment, that means PowerShell. Today I found myself installing some utils then adding the newly installed locations to the PATH environment variable. After the first machine, and facing the prospect of several more, I decided to cruft up something that would work from within PowerShell and keep me away from that nasty GUI stuff. (Computer-Properties-Advanced System Settings-Environment Variables-Path-Edit-DearLordThereMustBeABetterWay…)

And so here’s what I came up with: Add-Path.ps1. You feed it a path name, it checks to make sure it is a valid path, and if so, adds it to the PATH environment variable. You can either add it just for the current session, or use the -Peristent switch to make the change stick.

Add-Path.ps1

param([string]$pathName,[switch]$Persistent=$false)

if ($pathName)
{
    if (Test-Path $pathName)
    {
        if ($env:PATH.IndexOf($pathName) -gt -1)
        {
            Write-Host "$pathName is already on the path"
        }
        else
        {
            Write-Host "Going to add $pathName to the path"
            $newPath = "$env:Path;$pathName"
            if ($Persistent)
            {
                # update the registry and add the path
                # NB, you'll need admin creds for the reg change
                [System.Environment]::SetEnvironmentVariable("PATH", $newPath, "Machine")
                $env:Path = $newPath
            }
            else
            {
                # just add the path for this session
                $env:Path = $newPath
            }

            Write-Host "Path is now: [$newPath]"
        }
    }
    else
    {
        Write-Host "Path does not exist"
    }
}
else
{
    Write-Host "Need a path name to add"
}

2010/02/11

Speech by Canada’s Privacy Commissioner

Filed under: Privacy — Tags: — James @ 9:33 am

Jennifer Stoddart, the Privacy Commissioner of Canada (for a little while yet) has posted a speech she gave at the 11th Annual Privacy and Security Conference in Victoria, entitled The Future of Privacy Regulation. I found it an interesting read; definitely worth checking out.

2009/09/13

An Open Letter on Canadian Copyright

Filed under: Copyright — James @ 6:00 pm

Below is the letter I wrote to Industry Minister Tony Clemente and others about my views on Canadian copyright reform.

Dear Ministers,

I am writing to offer my input to the public consultation process on Canadian copyright reform. For the past twenty-five years I have made my living in the information technology industry both here in Canada and abroad. I was one of the very early users of internet technology, and so I have experienced at first hand the massive changes that it has brought to all aspects of society around the world. The virtual landscape has been in a perpetual state of flux, and things grow ever more complicated. Today I find myself the father of three young men in their teens and early twenties who have never known life without the internet. All three are very creative; one is a writer, one a musician, and one a software developer interested in virtual reality. As I try to peer into the future which they will inhabit, I am struck by the impact that copyright legislation will potentially have on their lives, and it is that more than anything else that has prompted me to write.

I remember when bill C-61 was being discussed, and I remember railing against what I considered to be its many flaws and shortcomings with my IT colleagues, virtually all of whom agreed with me. Even so, I never bothered to take the step of making my views known to my member of parliament, or anyone in the government for that matter. I had the sense that my views were not valued, and that the government would pursue its own agenda regardless of what I or my colleagues felt about it. This time around the mood is definitely different, and I applaud the government’s efforts to seek feedback from Canadians about the issues they feel are important as concerns copyright legislation. I believe we need a fresh perspective on copyright, not merely another rehash of bills C-60 and C-61.

For the last dozen years or so my primary focus has been on identity and access management. This is a branch of IT that is concerned with technological solutions for making sure that people are who they say they are, and for granting them access to things to which they are entitled and for preventing their access to things to which they are not entitled. This has mostly been in the context of large corporate enterprises, but as technology has evolved the boundaries between intranets, extranets, and the internet have increasingly become blurred and there is inevitably a lot of crosstalk between the corporate and consumer realms. From this you might assume that I am in favour of Digital Rights Management (DRM) in some form. Actually the reverse is true. I believe that any approach to enforcing copyright via DRM is doomed to ignominious failure. I believe this for two reasons, one technological, and one social. The technological reason is simply that it is technically infeasible to produce a robust and unbreakable DRM solution. At base, this is because every DRM system provides the end-user or consumer with three things: encrypted content, the cipher used to encrypt it, and the key to decrypt it. It doesn’t take much thought to determine this can’t work very well.

Of course, one possible countermeasure is make it illegal to circumvent the DRM, but this leads to my second – social – reason for objecting to DRM. By making it illegal to circumvent the DRM it denies the possibility that are legally valid reasons for doing so. At least, impossible without becoming embroiled in countless wranglings over what does or does not constitute a valid reason for circumvention. Too much of this counterproductive “How many angels can dance on the head of a pin” activity can only serve to keep the lawyers happy, not Canadian society as a whole. Also it hands the people who put on the DRM locks excessive and onerous control over the rights of Canadian citizens. I think that the vast majority of Canadian instinctively agree with Cory Doctorow’s assertion that “Anytime someone puts a lock on something you own, against your wishes, and doesn’t give you the key, they’re not doing it for your benefit”.

Personally, I will not buy any digital content protected by DRM. I have a collection of hundreds of music CDs, all purchased legally, and I like to listen to music while I work. I have ripped these disks so that I can keep a copy on my home network and listen to whatever strikes my fancy on my computer, without having to run up and down two flights of stairs to my CD player. Moreover, I have several different computers that I frequently work on, and I want an easy way to access my music from all of them without shuttling pieces of plastic among them all. I consider it perfectly acceptable to treat my property that I have bought and paid for in this fashion. Shifting this content from one format to another for the sake of convenience should be allowed. Similarly, format shifting for purposes of making archival copies or producing assistive formats (e.g. talking books for the blind) should also be allowed.

Of course, unscrupulous individuals can use format shifting to violate legitimate copyright. There is nothing technically stopping someone from ripping their own compilation of music in violation of copyright and selling the discs out of the back of their car. Such transgressions can and should be prosecuted, but I think it is very important that the punishment should be dependent on the intention to violate the copyright. In the unfortunate eventuality that some form of DRM is legislated, I think it is doubly important to recognize that the intention to violate copyright is the crux of the issue as regards circumvention. In any event, as and when these cases arise, I think they should be deliberated upon by real human judges, not adjudicated de facto by mere instances of DRM technology.

In terms of technology, I also think it is very important to keep the relationship between technology and copyright law as open and flexible as possible. This, as I see it, was one of the principal flaws of bill C-61, that it pronounced too prescriptively on particular technologies.

I had the good fortune to work closely for many years with Mr. Kim Cameron. Kim is currently the Chief Identity Architect at Microsoft Corporation, and a Microsoft Distinguished Engineer. During the late 1990’s Kim was a very popular speaker at trade shows and conferences. In any slide show that had a slide referring to a timeline of any kind, Kim always had a box tucked over on the right side labelled SOGI. In a business rife with acronyms, everyone is loath to admit that they don’t know what a particular acronym means; SOGI sat at the right side of Kim’s timeline slides for a couple of years before someone in his audience had the temerity to ask “What the heck is SOGI?”. Kim’s answer was simple and succinct: “SOGI is Some Other Good Idea; it is always 18 months to 2 years in the future.” Amusing perhaps, but it points to the very real nature of technological evolution at this point in our history. Any legislation that is not technologically neutral will almost certainly be outdated before it can be fully enacted.

This, in a very roundabout way, brings me back to something I mentioned earlier: trying to picture the digital world my sons will inhabit, and more specifically trying to picture what kind of copyright legislation would best serve them as Canadians and as citizens of the world. Moreover, I’m trying to picture what would serve them best as both consumers and producers of digital content. As I see it, there are several characteristics that this legislation must possess.

First, it must have generous, flexible, and easily understood provisions for fair dealing. We have no idea how the internet will evolve, what will be the impact of new content storage and delivery mechanisms, or what new business models may develop out of these changes, so it is imperative that we keep the legislative framework as open and adaptable as possible. It is better to err on the side of too much openness, and allow legal due process and its ecosystem of precedents to co-evolve with the technology than it is to produce closed, technologically bound legislation that is onerous, coercive, and draconian. I do not want Canadians to inhabit a digital melieu where they are told how and when they can consume what they’ve bought, or how they can dispense what they have produced, or where they can be barred from participation in this digital world based on unfounded or unproven allegations.

Second, the legislation must recognize that no creative endeavour can arise in a cultural vacuum. Every artistic and creative work emerges as a reaction to and subsumation of other creative works, and for these other works to be effective as a catalyst for new works, a significant portion of them must be freely available in the public domain. I could argue that the current term of copyright (life of the artist plus 50 years) is excessive, that a shorter term plus opt-in extensions would serve Canadians better, but at a minimum any new legislation should commit to extending the term no longer than it is currently. Canada should not follow the lead of other countries, most notably the United States, in extending copyright term to such extremes that it harms the public domain and negatively impacts the cultural life of the nation. When all is said and done, it is the interests of large media conglomerates that drive these extensions, and it must be recognized that what is good for large media conglomerates is not what is best for Canadian citizens.

Third, while it is clear that Canada has a role to play in international affairs, and must participate in and adopt international treaties, it should not follow that in so doing the interests of Canada and Canadian citizens should be made subordinate to international interests. Indeed, we currently have the opportunity to pick and choose the best ideas from the efforts of others in the international community and avoid the more egregious mistakes that some have made, and can implement a new and better legislative framework of copyright protection that will serve Canadians well for a long time to come.

Yours sincerely,

James Booth

2009/07/29

Italian Identity

Filed under: Identity — James @ 10:36 am

Currently sitting by the water in San Diego just before the Burton Group’s Catalyst conference kicks off but I got to thinking how it’s been awhile since I posted, and I’ve been meaning to post about a couple of things that struck me while I was in Italy a few weeks back. (Great weather, great food, great wine, and ah the gelato…the gelato…)

The first happened immediately after we’d arrived. We had a friend picking us up at the airport and as luck would have it, his daughters were also returning from visiting their grandmother in France at pretty much the same time, so he was collecting them as well. After they’d arrived and had a nice reunion with their father, our friend realized he had left his id in the car. So he could not pick up his daughters (travelling as unaccompanied minors) until he was able to prove who he was. Now, I know why they do this, but it makes me kind of sad that things have got to a point where a couple of girls (11 & 13) cannot say “This is our father and we want to go home with him now.”

Later the same week the same friend was faced with buying a new washing machine, so off he goes to the store, picks out his model, then wants to pay for it by cheque. A cheque from an Italian bank in Rome. BUT, did he have Italian ID? No, he’s a French national working for the UN in Rome, so his ID was French. Well, they didn’t know if they could do that. The salesman had to check with his manager, who had to check with the floor manager, who had to check with the store manager… Finally, and a little reluctantly, they agreed to accept his cheque. So did he huff the machine in the back of his van and drive off? No, the model he wanted would have to be ordered and would take a few days to a week to arrive. It seems to me that would be plenty of time for the cheque to clear the bank, so the whole rigmarole of deciding whether to accept the cheque strikes me as really odd. It seemed to have more to do with whether he had the right Italian id as opposed to whether his money was any good.

Then again, maybe there’s just something about my friend…

2009/06/24

Canadian Copyright Info

Filed under: Copyright — James @ 6:42 pm

EXCELLENT POST on Michael Geist’s blog about the cabal of alarmists who would have all Canadians up in arms about the dire state of our internet legislation. If you want to really understand the issues, I don’t see how you could do better than to start here

2009/06/22

The Fine Print…

Filed under: Identity — Tags: , , — James @ 5:00 pm

I usually read those pages that say “this is what we are going to do with your personal information.” And usually they’re pretty dull and boring. I ordered something online recently for an upcoming trip (to Italy, thanks for asking) and here’s what I was told:

A] 	the personal data you freely furnished will be:
	1) used for giving succession to Your application
	2) recorded on electronic supports for a possible
	   following reference
	3) treated as stated by our privacy regulations;

B] 	the personal data you freely furnished won't be communicated
	or diffused to third without your written consent;

C] 	to the senses of the art. 7 of the Unique Text on the Privacy,
	Legislative Decree 30-06-03 ns. 196, you will be able in any
	moment to consult, to integrate, to modify or to ask to cancel
	your personal data, or to oppose in everything or partly to
	their use to the anticipated goals from the precedent point A],
	forwarding formal application to the address zzz@zzz.zzz

I’m not trying to make fun of this at all. I find these painstaking renderings of foreign legalese into English quite delightful actually, and as long as I can “oppose in everything or partly”, I figure I’m reasonably safe from having my information abused.

2009/06/21

Well, it’s taken a while…

Filed under: Miscellaneous — James @ 9:20 pm

But I’ve finally gotten around to getting a blog set up. Of course, I could have used one of those free services, but that would be too easy. So I decided to go with my own WordPress blog that I have complete control over and will get too busy to update or customize to any significant extent, but at least I’ve got options. And setting the whole thing up was, well, too easy.

Powered by WordPress