Tag Archives: API

cloud Network Infrastructure SQL Ubuntu Unix VMware Windows Server

Scripting Azure On A Mac

Microsoft Azure is Microsoft’s cloud services. Azure can host virtual machines and act as a location to store files. However, Azure can do much more as well, providing an Active Directory instance, provide SQL database access, work with hosted Visual Studio, host web sites or provide BizTalk services. All of these can be managed at https://manage.windowsazure.com.

windows_azure_logo6

You can also manage Windows Azure from the command line on Linux, Windows or Mac. To download command line tools, visit http://www.windowsazure.com/en-us/downloads/#cmd-line-tools. Once downloaded, run the package installer.

Screen Shot 2013-11-29 at 10.51.01 PMWhen the package is finished installing, visit /usr/local/bin where you’ll find the azure binary. Once installed, you’ll need to configure your account from the windowsazure.com site to work with your computer. To do so, log into the windowsazure.com portal.

Screen Shot 2013-12-01 at 8.25.57 PM

Once logged in, open Terminal and then use the azure command along with the account option and the download verb:

azure account download

This account downloads the .publishsettings file for the account you’re logged in as in your browser. Once downloaded, run azure with the account option and the import verb, dragging the path to your .publishsettings file from https://manage.windowsazure.com/publishsettings/index?client=xplat:

azure account import /Users/krypted/Downloads/WindowsAzure-credentials.publishsettings

The account import then completes and your user is imported into azure. Once imported, run azure with the account option and then storage list:

azure account storage list

You might not have any storage configured yet, but at this point you should see the following to indicate that the account is working:

info: No storage accounts defined
info: account storage list command OK

You can also run the azure command by itself to see some neat ascii-art (although the azure logo doesn’t really come through in this spiffy cut and paste job):

info: _ _____ _ ___ ___________________
info:        /_\  |__ / | | | _ \ __|
info: _ ___ / _ \__/ /| |_| |   / _|___ _ _
info: (___ /_/ \_\/___|\___/|_|_\___| _____)
info: (_______ _ _) _ ______ _)_ _
info: (______________ _ ) (___ _ _)
info:
info: Windows Azure: Microsoft's Cloud Platform
info:
info: Tool version 0.7.4
help:
help: Display help for a given command
help: help [options] [command]
help:
help: Open the portal in a browser
help: portal [options]
help:
help: Commands:
help: account to manage your account information and publish settings
help: config Commands to manage your local settings
help: hdinsight Commands to manage your HDInsight accounts
help: mobile Commands to manage your Mobile Services
help: network Commands to manage your Networks
help: sb Commands to manage your Service Bus configuration
help: service Commands to manage your Cloud Services
help: site Commands to manage your Web Sites
help: sql Commands to manage your SQL Server accounts
help: storage Commands to manage your Storage objects
help: vm Commands to manage your Virtual Machines
help:
help: Options:
help: -h, --help output usage information
help: -v, --version output the application version

Provided the account is working, you can then use the account, config, hdinsight, mobile, network, sb, service, site, sql, storage or vm options. Each of these can be invoked along with a -h option to show a help page. For example, to see a help page for service:

azure service -h

You can spin up resources including sites, storage containers and even virtual machines (although you might need to create templates for VMs first). As an example, let’s create a new site using the git template:

azure site create --git

Overall, there are a lot of options available in the azure command line interface. The web interface is very simple, with options in the command line interface mirroring the options in the web interface. Running and therefore scripting around these commands is straight forward. I wrote up some Amazon stuff previously at http://krypted.com/commands/amazon-s3cmd-commands, but the azure controls are really full featured and I’m really becoming a huge fan of the service itself the more I use it (which likely means I’ll post more articles on it soon).

Mac OS X Mac OS X Server Network Infrastructure

The Cumulus Command Line Interface

Cumulus comes with a number of commands installed in /usr/local/Cumulus_Workgroup_Server. The assets can be in a shared directory location, such as an NFS mount mapped to /cumulus or /Volumes/Cumulus. But in the /usr/local/Cumulus_Workgroup_Server directory there are a number of commands that can be pretty useful. For example, the stop-admin, stop-cumulus, start-cumulus and start-admin commands can be used to restart the Cumulus using a simple ARD template:

/usr/local/Cumulus_Workgroup_Server/stop-admin.sh
/usr/local/Cumulus_Workgroup_Server/stop-cumulus.sh
sleep 30
/usr/local/Cumulus_Workgroup_Server/start-cumulus.sh
/usr/local/Cumulus_Workgroup_Server/start-admin.sh

There are others, such as status.sh, which shows size of repository, PIDs, and the time running. The repair.sh can be used to repair the database and remove-admin.sh and remove-cumulus.sh can uninstall the admin console and cumulus servers respectively (danger, Will Robinson). The install-admin.sh and install-cumulus.sh scripts can also be used to install these items respectively. The bin directory contains daemons such as cumulusd and services information/cumulusrad.

If you want to work with assets, you’ll probably need the Java SE JDK to run and then query the Tomcat server. This web application environment leverages Cumulus Java classes to provide the API that can then be scripted into various workflows, such as providing a site that queries images in the DAM and displays those matching a given pattern on a website.

Overall, the scripting that can be done without the API is service control oriented, but with the API and a little SOAP you can pretty much grab or change almost anything you need to.

cloud FileMaker Mac OS X Mac OS X Server Mac Security Mass Deployment Network Infrastructure Time Machine Xsan

Obtain Information From Watchman Monitoring Using a Script

Watchman Monitoring is a tool used to monitor computers. I’ve noticed recently that there’s a lot of traffic on the Watchman Monitoring email list that shows people want a great little (and by little I mean inexpensive from a compute time standpoint) monitoring tool to become a RMM (Remote Management and Monitoring) tool. The difference here is in “Management.” Many of us actually don’t want a monitoring tool to become a management tool unless we are very deliberate about what we do with it. For example, that script that takes a machine name of ‘rm -Rf /’ that some ironic hipster of a user decided to name their hard drive because, well, they can – well that script that was just supposed to run a fix permissions because that ironic jackass of a user in his v-neck with his funny hat and unkempt beard just accidentally cross-site script attacked himself and he’s now crying out of his otherwise brusque no-lense having glasses and you’re now liable for his data loss because you didn’t sanitize that computer name variable before you sent it to some script.

Since we don’t want the scurrilous attention of hipsters everywhere throwing caustic gazes at us, we’ll all continue using a standard patch management system like Casper, Absolute, Munki, FileWave, etc. Many organizations can still take value out of using Watchman Monitoring (and tools like Watchman) to trigger scripted events in their environment.

Now, before I do this I want to make something clear. I’m just showing a very basic thing here. I am assuming that people would build some middleware around something a little more complicated than curl, but given that this is a quick and dirty article, curl’s all I’m using for examples. I’m also not giving up my API key as that would be silly. Therefore, if I were using a script, I’d have two variables in here. The first would be $MACHINEID, the client/computer ID you would see in Watchman. This would be what you see in red here, when looking at an actual computer.

Screen Shot 2013-07-03 at 9.35.54 AM

The second variable is my API token. This is a special ID that you are provided from our friends at Watchman. Unless you’re very serious about building some scripts or middleware like right now, rather than bug them for it, give it a little while and it will be available in your portal. I’ve given the token $APITOKEN as my variable there.

The API, like many these days is json. This doesn’t send entire databases or even queries, but instead an expression of each variable. So, to see all of the available variables for our machine ID, we’re going to use curl (I like to add -i to see my headers) and do the following lookup:

curl -i https://318.monitoringclient.com/clients/$MACHINEID.json?auth_token=$APITOKEN

This is going to spit out a bunch of information, parsed with a comma, whereas each variable and then the contents of that variable are stored in quoted text. To delimit my results, I’m simply going to awk for a given position (using comma as my delimiter instead of the default space). In this case, machine name is what I’m after:

curl -i https://318.monitoringclient.com/clients/$MACHINEID.json?auth_token=$APITOKEN | awk -F"," '{ print $4}'

And there you go. It’s that easy. Great work by the Watchman team in making such an easy to use and standards compliant API. Because of how common json is I think integrating a number of other tools with this (kinda’ like the opposite of the Bomgar implementation they already have) is very straight forward and should allow for serious automation for those out there that are asking for it. For example, it would be very easy to say take this output and weaponize it to clear caches before bugging you:

“plugin_id”:1237,”plugin_name”:”Check Root Capacity”,”service_exit_details”:”[2013-07-01] WARNING:  92% (276GB of 297GB) exceeds the 90% usage threshold set on the root volume by about 8 GB.”

Overall, I love it when I have one more toy to play with. You can automatically inject information into asset management systems, trigger events in other systems and if need be, allow the disillusioned youth the ability to erase their own hard drives!

Mac OS X Server

Server Admin Web Modules, curl & You

Since the early days, OS X Server has supported performing the serveradmin commands through a web interface. This interface was accessible at the address of the server followed by a colon and then 311 in a web browser. This feature was disabled by default in Mountain Lion. But fear causes hesitation, and hesitation will cause your worst fears to come true, so we’re going to turn it back on. To enable, use the following command:

sudo defaults write /Library/Preferences/com.apple.servermgrd requireUserAgent -bool false

Once done, open https://127.0.0.1:311 in a web browser, or replace 127.0.0.1 with the address of the server if accessing from another location. This is stimulating, but we’re out of here. So, authenticate to be greeted with a list of services.

Lawyers don’t surf.

At the Server Admin Modules page, each service output from `serveradmin list` appears. Clicking each produces the ability to run the commands you can supply using `serveradmin command` along with the service name. For example, to get a list of all of the connected AFP users in OS X Mountain Lion Server, run the following command:

sudo serveradmin command afp:command = getConnectedUsers

Now, to get the same list, click on the servermgr_afp.html link and then click on getConnectedUsers.

Life sure has a sick sense of humor, doesn’t it?

Click on Send Command to see the output.

Peace, through superior firepower.

You then see an XML output that shows who’s connected (since I’m on a flight right now, luckily no one is connected to mine). Now you also have a URL in the toolbar, which should look something like this:

https://127.0.0.1:311/commands/servermgr_afp?input=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%0D%0A%3Cplist+version%3D%220.9%22%3E%0D%0A%3Cdict%3E%0D%0A%09%3Ckey%3Ecommand%3C%2Fkey%3E%0D%0A%09%3Cstring%3EgetConnectedUsers%3C%2Fstring%3E%0D%0A%3C%2Fdict%3E%0D%0A%3C%2Fplist%3E%0D%0A&send=Send+Command

Rad, unicode. I guess spaces aren’t really compliant in URLs. Before we look at that, let’s take a look at what we can do with these. If you follow what I write, you have probably noticed that I use curl for tinkering with URLs a lot. In many cases, this is not the right tool. But I usually start there and move on if need be. Six seconds. We’re going to be meat waffles.

Because we’re going to assume the server is using a self-signed cert that we don’t yet trust, we’re gonna’ use a -k along with curl. Then we’re going to follow that with the link. However, since we need to auth, we’re going to also go ahead and embed the username (in this case johhny) followed by a : and then the password (in this example, bodhi), followed by an @ in between the https:// and the server address, as follows:

curl -k https://johhny:bodhi@127.0.0.1:311/commands/servermgr_afp?input=%3C%3Fxml+version%3D%221.0%22+encoding%3D%22UTF-8%22%3F%3E%0D%0A%3Cplist+version%3D%220.9%22%3E%0D%0A%3Cdict%3E%0D%0A%09%3Ckey%3Ecommand%3C%2Fkey%3E%0D%0A%09%3Cstring%3EgetConnectedUsers%3C%2Fstring%3E%0D%0A%3C%2Fdict%3E%0D%0A%3C%2Fplist%3E%0D%0A&send=Send+Command

The output includes the afp:usersArray which shows active connections. The most interesting options, other than those for services you run in your environment, ar those under servermgr_info. Here, you can get PIDs for processes, kill PIDs, view logs, check file sizes, delete data and even reboot servers. Overall, this option has some security concerns, but provides some good insight into how the Server Admin tool worked under the hood in Mac OS X Lion Server and below while also serving as a functional option as an API for the  product, especially given that output is in XML, similar to the output of most other modern APIs.

Vaya con Dios, Brah.

Mac OS X Mass Deployment

Programmatically Running And Looping Keynote Presentations

These days, you can spend a lot of money buying really nice digital signage tools. And if you’re doing so, then you likely have some pretty dynamic content you’d like to load. Something that doesn’t necessarily lend itself to a dynamic content platform, but which is nice for the quick presentation that you whip up and want to use for a form of digital signage is Keynote presentations. These are inexpensive and can be played on monitors through AirPlay or directly through a Mac Mini connected to a television or big monitor. Great for a monitor in the company lobby, the hallway in the school or for subliminal messaging at the DMV to convince you that no, the guy with the forehead tat isn’t really going to shank you (srsly, metal detectors, pls).

There are a few issues there, though. First, for most uses, you need the presentation to either go on forever or need to queue up a bunch of them. Then, you need to set the presentation to automatically start when opened so that you can just open files through a script. Scripts being able to be set as login items for a default user. There are also some logistical issues with the physical hardware if it’s in public, but I’ll assume you’ve got those covered and move on to the technical details of how to do the above tasks.

To prepare a Keynote presentation, first open the Keynote, click on Inspector in the toolbar and then at the inspector click on the document icon (in the far left top corner of the inspector). Then, check the boxes for “Automatically play upon open” and “Loop slideshow”. This will automatically play the presentation and start it again when it’s done.


Then I’d use the second icon from the left on each slide to automate the transition to the next slide.


Then, the entire Keynote is automated. That part is all done within Keynote and the next part is just opening and closing Keynote from the command line. To open via ARD or another management tool, send the following command:

open /Users/admin/Desktop/Presentationname.key

Then to close Keynote and run something else:

killall Keynote

To close one presentation and immediately reopen a different presentation, merge the commands into one line:

killall Keynote; open /Users/admin/Desktop/Presentationname.key

Just make sure everything’s automated or the loop won’t run. Now, to automate events within Keynote will require clicking on things from an AppleScript or Automator workflow or using the AppleScript options for Keynote. To automate just clicking to move to another slide can be done with the following AppleScript (and sent via osascript), although it’s usually best done within Keynote:

tell application “System Events”
click
end tell

The following are all of the Keynote-specific options from Automator:

To close a single presentation, the following workflow would do the trick:

One challenge is that when you loop through different Keynote presentations, you would see the desktop of OS X and the Dock while Keynote is re-opening if you kill it off first. It should take a little less than a second. Once keynote re-opens, you see the menu for keynote for about another half second while the keynote document is opening. If I don’t close Keynote and instead just open a 2nd document then I see the Keynote menu bar for a split second while the second presentation is starting and I don’t end up seeing the actual Desktop. That would be done just by opening a second presentation from the command line. The caveat is that as you toggle between them, if you don’t kill off the Keynote application, you’ll end up starting where the other left off rather than at the beginning (which might be fine in a given workflow).

You can, if you need to kill the application, launch the screen saver first:

osascript -e 'tell application id "com.apple.ScreenSaver.Engine" to launch'

Or just in bash:

open -a /System/Library/Frameworks/ScreenSaver.framework//Versions/A/Resources/ScreenSaverEngine.app

This just fires up the screen saver to try and hide what you’re doing in the background. You can layer the three commands we’ve looked at on top of each other as a single command from ARD:

osascript -e 'tell application id "com.apple.ScreenSaver.Engine" to launch' ; killall Keynote ; open /Users/admin/Desktop/Presentationname.key

That would effectively kick off the screen saver, kill keynote while it’s hidden and then open the new presentation. The presentation would need to be transferred to the client system first, but that’s usually the easy part. You could also sleep the commands to bring up different presentations and bolt more logic in, although much of that is best left inside of Keynote itself. If you wanted to get extra crafty, in case the desktop did ever appear, you could have a fail safe of having the screen saver appear as the desktop background, which I wrote up awhile ago here. There are also various kiosk applications that do crazy things like replace the Finder or fire up kioskish (is that a word?!?!) browsers and the such, but all will likely require a little testing and massaging to get just right.

Overall, Apple products can make for pretty good signage options given how well they typically handle various graphics and connectivity, without buying 3rd party tools. You do get what you pay for, so it might be worth looking at some of those tools. Also, it’s worth noting that Rich Trouton wrote up a nice article on using AppleTV for this type of stuff here on his site. I’ve also scripted digital content delivery to Macs using Final Cut Server, CatDV and various scripting tools such as python. We’ve even gone so far as to programatically create the actual Keynote files, but that’s probably best saved for a github gist rather than a krypted.com post…

Home Automation Mac OS X Mac OS X Server Mac Security Mass Deployment Xsan

Lights Out Managing Mac Mini Servers with Vera

There is no Lights Out Management for a Mac mini Server (btw, am I the only one that noticed that these are now called Mac mini with Lion Server, where mini isn’t capitalized). While the Mac mini Server doesn’t have the Lights Out Management (LOM)/IPMI chips in it, there are a few things that we can control anyway. Convention would say that we’d get a NetBotz card for that spiffy APC we’ve got, which can do minor automation and even a little environmental monitoring. And there are a few other systems out there that can do similar tasks.

But I’m a home automation nerd these days. So I decided to look into whether my Vera can manage my mini Server botnet and what I might be getting or sacrificing. First, let’s define what we did with LOM. The first and most important is, when the system crashed, we rebooted the server. The second aspect was to maybe wake the thing up, with the 3rd to monitor the components of the system. Let’s look at the first, most important thing, rebooting.

I’m going to start with a Vera. The setup process for Vera is similar to that of a LinkSys, where you give the device an IP and then go a step further by signing up for the MiOS portal, used to remotely control the Vera through a secure tunnel. Then I’m going to add an appliance module to the system. Notably, I want a ground, so I’m going to add the Wayne-Dalton HA-04WD HomeSettings Outdoor Appliance Module. The device can be added to Vera pretty easily. To do so, open Vera and click on DEVICES and then on Add Devices in the subnav bar. From here, click on Add in the first row.

Then scroll down a little and click on Option 1.

The system will then scan for a device. At this point, you’ll see a screen telling you to manage the device. At this point, I just press the button on the device to pair it to the Z-wave network.

Once the device is seen by the Vera, we can go ahead and click on the Next button (by default they’re seen as light switches).

At the next screen, you’ll see a screen with a field you can type in. Here, provide a name for the device and give it a room that the device is in (if you’re using rooms). Click on Close and then Save (big red button after you click Close).

Click on the Continue button to commit the save and you should see your new device listed in All Devices.

At this point, click on the On and Off switches to turn systems on and off. From System Preferences, go to Energy Saver and then check the box for Restart automatically

We’ve now achieved the first goal, having a way to physically turn on and off a Mac mini with Lion Server. Better than LOM, we can do so using a web interface or an iOS app. While the lack of so many moving parts has reduced the need for environmental monitoring, we want to monitor the environment outside the box, the environment inside the box and whether the box has developed any human emotions. To monitor the environment outside the box, I’m using one of the many Z-wave thermostats available. I plan on replacing it with a Temperature and Humidity Sensor, so I can put a sensor right by the machine instead of just monitoring the temperature of the room. I also like the idea of seeing moisture levels, but that’s aside from the point.

Monitoring the inside of the system is really easy, since Apple has built snmp into Mac OS X and a quick snmpwalk will show me most everything I need to know about a box. For that, let’s just remove the default snmpd.conf file:

rm /etc/snmp/snmpd.conf

And then run snmpconf -i to create a new snmpd.conf file. This is interactive, so use option 1 and then choose the settings that work best for whatever monitoring software you’re using. With the loss of Lithium, I am a big fan of Nagios and Dartware’s Intermapper, but there are a number of other solutions that I would look at as well. Either way, this can be a very cumbersome aspect if you let it. Once you’ve configured snmpd.conf, restart it (assuming it’s running):

launchctl unload /System/Library/LaunchDaemons/org.net-snmp.snmpd.plist
launchctl load -w /System/Library/LaunchDaemons/org.net-snmp.snmpd.plist

Next, to wake up the server, we can use Wake on LAN (note that wake for network access is in the Energy Saver System Preference pane). We can also monitor the server’s IP address (ping/ICMP) and even activate a camera in the event that a motion sensor is tripped. I’ll look at these in a future automation article, where we’ll reboot the server automatically in the event that it goes offline and maybe even control an IR blaster to turn on the TV when status bars are running on the server (we might also hook up a coffee pot so we can stay awake while waiting for Lion to download during some upgrades). But for now, suffice it to say that at this point, we have some of what we had with LOM on an Xserve. It’s not everything and it’s not really pretty. But it works and would cost about the same as a module for that APC you’ve got sitting around, while also laying the groundwork for much more home and small office/small data center automation – and at about $25 per additional device, it’s priced pretty well all things considered.

Finally, if that snmp-based monitoring system happens to need to restart the devices, there’s also an API for Vera, documented at http://wiki.micasaverde.com/index.php/Luup_Requests. Being able to script an snmp-generated event that kicks off some kind of triggered response with a grid of devices is pretty cool, and while I hope to cover it eventually, I’m not sure exactly when I’ll end up with time, so might be awhile…

iPhone Mac OS X Mac OS X Server Mac Security Mass Deployment

Managing iOS Devices with Apple Configurator

My traditional interpretation of Apple’s vision on how iOS devices are used is that everyone has an AppleID. That AppleID enables them to access their apps from any iOS device they own or Mac that they own. That AppleID enables them to access mail, contacts, calendars and even files through iCloud. That AppleID also allows users to remotely wipe their device through Find iPhone and track their friends iOS devices (as in social networking via breadcrumb tracking) through Find Friends. All of this “Just Works” in a consumer sense. And it even allows for a little sharing of content across devices you own. However, larger organizations need more. They need centralized management, content distribution and most other things you find that you rely on traditional desktop computers for.

Over the years, Apple has added tools for centralized control of devices. This started with ActiveSync compatibility and early forms of Mobile Device Management and has grown into a pretty robust, albeit disconnected, set of tools. Of these, Apple Configurator is the latest. Apple Configurator was released about a week ago and since, I’ve been trying to figure where it fits into the solutions architecture that surrounds iOS integrations. There are a number of other tools already available that can aid in the deployment and management of iOS devices, and Configurator is a great addition.

To me, there are 3 classes of management tools for iOS. These were roughly broken up into Over the Air (OTA), cradled (USB) and content management. Apple Configurator ends up fitting into all of these scenarios in some way. Let’s start by looking at the traditional uses of these three and then look at how they are impacted by Apple Configurator.

Mobile Device Management

Over the Air tools, such as Profile Manager, allow for Mobile Device Management (MDM) without cradling, or syncing a devices. These tools allow you to configure policies via profiles. There is also a bit of App pushing built into most MDM solutions. Apple’s Profile Manager can push applications written in-house, but no content from the App Store. 3rd party solutions, such as JAMF’s Casper Suite, Absolute Manage MDM, AirWatch and about 15 others are able to push apps from the App Store as well, leveraging the Volume Purchasing Program (VPP) to issue apps to devices. However, when an app is pushed through one of these tools, the app becomes associated with the AppleID for the user who owns the device.

Note: While we use the term push, the user has to accept all App installations on the device.

For large environments, MDM is a must as it allows for centralized command and control. Pushing apps is one aspect of such control. Policies enforceable through MDM include disabling cameras, configuring passcode policies on devices (not pushing passcodes), disabling YouTube, silencing Siri, unstreaming photos, disabling iCloud Backup, forcing encrypted backups, disabling location services, controlling certificates, blocking pop-ups, controlling cookies, disabling access to the iTunes and App Stores,  and controlling what kind of media can be accessed on devices.

Additionally, MDM can be used to push SSIDs for wireless networks (and their passwords/802.1x configuration information), setup mail, setup Exchange ActiveSync, configure VPN connections, configure access shared calendars (iCal shared files, CalDAV and Exchange), configure access to shared contacts (LDAP, CardDAV, Exchange and Exchange Global Address Lists), deploy Web Clips and manage certificates (either with cert files or via SCEP). In short, whether you’re using the practically free Profile Manager from Apple, Mobile Iron, Casper, AirWatch, FileWave or one of the many other tools, there are a lot of things that MDM can configure on devices.

Reporting can also play a major role in how MDM tools are used. iOS Apps are owned by AppleIDs, not devices. MDM does not manage AppleIDs, but you can trigger fields in MDM databases to report back unauthorized AppleIDs being used. Reporting can also identify when devices join non-approved wireless networks (which cannot be blocked through MDM), identify devices that have been jailbroken (a major security concern for many organizations) and report on device use.

Because devices can fall outside of our control, MDM also plays an important role in being able to wipe and lock devices. While some of these types of features are available via Exchange, not all people use ActiveSync. Users and administrators alike can wipe, lock and de-enroll devices at will, potentially crippling what any device with an Enrollment Profile can do.

There are really 3 kinds of MDM tools: those that can push apps, those that can’t and Apple’s Profile Manager. The reason I put Profile Manager into its own class, is that it can push some kinds of apps, it’s cheap ($49.99 one time as opposed to per device per month or per device per year billing) and it’s great for some things. But Profile Manager should be used in very specific environments unless the price is the only decision making factor behind a tool. In larger environments, choosing a MDM solution is one of the most important aspects of managing mobile devices and the iOS platform is no different in that manner than other mobile platforms.

MDM has some limitations, though. A good MDM solution can manage the infrastructure side of device configuration. However, content requires a completely separate tool. Additonally, MDM is a completely opt-in experience. If a user wants, they can remove their device from the MDM solution at any time. Rather than a limitation, think about the opt-in experience this way: if a user removes themselves from MDM then all content that was given to them via MDM is then taken away, except that which they have moved to the local device. Therefore, if an administrator pushes an Exchange configuration then all content from that Exchange profile is forbidden fruit, removed alongside the de-enrollment.

MDM also works with Lion. Policies, centralized management, etc can be integrated with Lion. You can’t do app distribution per se, but you can push out a policy to change where the dock is on the screen, add a printer to a Mac and configure a login hook through a Profile Manager-based policy. Many of the MDM providers have begun adding functionality to their tools to allow for Mac management as well as iOS and I would expect that to become the standard in years to come. iOS is a single-user device and OS X is a multi-user device, which completes that paradigm, but Apple has made it no secret that policy-based management for Mac OS X is moving to the realm MDM (even if that is enforced through a traditional lens of directory services based policy-based management).

Content Management

One of the unique aspects of the iOS platform is that it doesn’t have a file system that is exposed to users. There’s no /Volumes, no C: drive and no home folders. The devices don’t log into a server, because there’s no way to interpret a server connection. The file system that is exposed to iOS devices is through the lens of each application. Sandbox is a technology that limits each application’s access in terms of memory, hard drive, etc. Each application can only communicate with resources outside of itself if there is an API to do so, APIs mostly reserved for Apple (e.g. photos, contacts, etc). Therefore, when you discuss content management from the perspective of building a large iOS solution, you’re talking about apps.

The apps used for content management come in a few flavors. There are those that allow you to edit content and then there are those that allow you to read content. One way to look at this is through Safari. Sharepoint, WebDAV and various document management portals allow users to access data through the Safari browser on an iOS device. Safari will let you view various file types. But to edit the data, you would need to send it to an app, or copy it to the clipboard and access it in an app. Pages is an example of an app that can browse a file tree via WebDAV and edit content. However, planning how each type of file is accessed and what type of editing can be done on each file type or what type of resources need to be accessible can be difficult (e.g. there are a number of transitions in Keynote presentations that do not work in iOS).

Cradling Devices

Then there’s iTunes. iTunes allows you to backup and restore devices, update devices, etc. iTunes allows you to drop content into each application. If you look into the ~/Library/Mobile Documents, you can drop content, edit default documents and other tasks that can be done through a command line, then perform a cradled sync to an app. If networking is built into an app then you don’t have to plug a device into a computer. If an app can leverage iCloud, SMB or AFP then you can access data over the air. If you are trying to replace computers with iOS devices (a la post-PC) then you would need to plan each business task that needs to be performed and make sure not only that there is an app for that (or an app you build for that) but also make sure that you can round trip data from a shared repository and back to the network storage that the data resides on.

You can also access many of the benefits of MDM without having an OTA element. This can be done with iPhone Configuration Utility. iPhone Configuration Utility can configure the same policies available through Profile Manager but relies on either a cradled or email/web server/manual way of getting policies onto devices and updating. MDM automates this, but iPhone Configuration Utility is free and can be used as well. Additionally, profiles can be exported from Profile Manager and installed in the email/web server/manual way that iPhone Configuration Utility profiles are installed.

This is all probably starting to seem terribly complicated. Let’s simplify it:

  • OTA policies and custom app deployment: MDM
  • OTA content distribution: Apps
  • Cradled policies and custom app deployment: iPhone Configuration Utility (free)
  • Cradled content and app distribution: iTunes (free)
  • OTA App distribution: AppleID/iCloud
  • Backup and restore: iCloud or iTunes

Basically, there’s a few holes here. First, AppleIDs cannot be centrally managed. Second, you need to use gift cards or the Volume Purchasing Program (VPP) to distribute apps, and Third, even when you push an app to an AppleID, the app follows the AppleID to their next organization (which causes many organizations to treat apps like consumables). Fourth, synchronizing content is done primarily through iTunes, which only syncs a device at a time, making preparation of large numbers of systems terribly complicated.

Apple Configurator

Enter Apple Configurator, a free tool on the Mac App Store. This tool basically fixes all of the problems that we reference, but does so over USB. This means that Apple Configurator is not necessarily a replacement for MDM. In fact, you can deploy Trust and Entrollment profiles for MDM and automate the MDM enrollment for a device through Configurator. Instead, Apple Configurator is a tool that can either Prepare or Supervise an iOS deployment and do so in a manner that is easy enough that you don’t need a firm background in IT to manage devices on a day-to-day basis.

Here is what Apple Configurator can do:

  • Update iOS devices to the latest version of iOS.
  • Rename devices using a numbered scheme (e.g. iPad 1, iPad 2, etc).
  • Erase (wipe) iOS devices.
  • Backup and Restore iOS devices.
  • Deploy profiles/policies (e.g. no Siri for you, disable cameras, setup wireless, etc) to iOS devices.
  • Export profiles.
  • Activate devices (after all a restore of a freshly activated device is an activation).
  • Push any kind of app to devices.
  • Track Volume Purchase Program (VPP) codes used on devices.
  • Revoke VPP codes used on “Supervised” devices (more on supervision later).
  • Assign users from directory services to devices.
  • Load non-DRM’d content to apps on devices.
  • Can work with up to 30 devices simultaneously (think big USB hubs or carts on wheels here).

Apple Configurator has some caveats:

  • Paid apps need to use VPP codes to DRM apps. These VPP codes are purchased through a centralized program for an entire organization. To enter the VPP, you need to be a business with a DUNS number or an educational institution. You also basically need to be in the United States.
  • Free apps can be deployed but the AppleID is in the IPA, meaning that to do an OTA update through App Store requires entering the password for the Apple ID the app was purchased with.
  • In order to push apps through Apple Configurator, the system running Configurator needs access to Apple’s servers and Apple Configurator needs an AppleID associated with it that is not the VPP facilitator if you are leveraging any paid apps.
  • You can use Apple Configurator “off-line” or without an AppleID to Prepare devices with Profiles, just not to
  • If you push Trust and Enrollment profiles to automatically join Profile Manager (or another MDM vendor) the device isn’t associated with a user unless the MDM has been prepped to designate each UDID or Serial Number to a given user.
  • Apple Configurator doesn’t work with Video or Music due to different DRM limitations.
  • If you accidentally plug in your iPhone to a machine you’re using Apple Configurator on it and you’ve chosen to Erase in the application, then it will wipe your phone along with the 30 iPads you’re wiping. It’s awesome and scary like that (yes, I’ve accidentally wiped my phone).

I see a number of uses for Apple Configurator. Some of these use cases include:

  • Company and education labs: manage devices end-to-end (no MDM, iTunes iPhone Configuration Utility or other tools needed), managed by the lab manager.
  • One-to-One environments (schools): Manage the distribution of infrastructure settings (mail, wireless networks, etc) for devices as well as Trust Profiles to make it faster to enroll in MDM environments and Web Clips to manage the links for enrollment.
  • Device distribution: Pre-load applications (that can’t be updated unless they’re cradled again), renaming, profiles, activation, iOS software updates, etc.
  • Backup and Restore only stations where you don’t interfere with later iTunes use.

These can enhance practically every environment I’ve worked with. But unless it’s a small environment (e.g. the labs), Apple Configurator isn’t a replacement for the tools already in use in most cases. Instead, it just makes things better. Overall, Apple Configurator is a welcome addition to the bat belt that we all have for iOS management and deployment. Now that we’ve looked at the when/where of using it, let’s look at the how.

There are two ways to use Apple Configurator. The first is to Prepare Devices. You would use this mode when you’re going to perform the initial setup and configuration of devices but not when the devices won’t be checking back into the computer running Apple Configurator routinely. Preparation settings do not persist. And while applications can be pushed through Preparation, updates for those applications will be tied to the AppleID that purchased the app.

The second is Supervise.  Supervising devices is an option when preparing and allows you to have persistent changes to devices, to layer new settings the next time devices are plugged in, to add applications and the most intriguing aspect of iOS management here is reallocating VPP codes to new devices when a user or device is retired. Supervising devices also allows for assigning a given user to a device and thus pushing data into an application.

Setting Up Apple Configurator

Apple Configurator is installed through the Mac App Store. When installed, you are presented with three options. The first (going from left to right) is to Prepare Devices.

Apple Configurator

Apple Configurator

Before we get started, we’re going to add our AppleID. The computer running Apple Configurator needs to be able to connect to the App Store and it needs to have an AppleID associated with it if you’re going to use VPP codes. So let’s set that up before moving on. To do so, from Apple Configurator, click on the Apple Configurator menu and click on Preferences… From the Preferences menu, click on Set for the Apple ID and provide an AppleID (not the VPP Program Facilitator).

Configuring AppleIDs with Apple Configurator

Configuring AppleIDs with Apple Configurator

Then, when prompted, provide the credentials for your AppleID. If you have any problems with this, try Authorizing the computer in iTunes, if you can’t do one it stands to reason you can’t do the other and it’s either an invalid AppleID or that the computer cannot communicate with Apple’s servers (ports, DNS, Internet connectivity, etc might be the issue).

Configuring AppleIDs with Apple Configurator

Configuring AppleIDs with Apple Configurator

Also, let’s configure the Lock Screen settings, which is what’s displayed to users when you’re supervising devices. If you have user pictures in Open Directory, this will show each user’s photo at the lock screen (we will discuss device supervision later).

Configuring Lock Screen Settings In Apple Configurator

Configuring Lock Screen Settings In Apple Configurator

Using Apple Configurator to Prepare Devices

In this example, we’re going to prepare some devices for deployment. Before we do anything, we’re going to do a backup of the iOS device to use for testing. To do so, simply click Prepare Devices to bring up the main Apple Configurator screen and then click in the Restore field.

Apple Configurator's Prepare Devices Screen

At the Restore menu, click Back Up…

Then choose the device to backup and click on Create Backup… to bring up the screen to select where to save your backup to (by default it should be your Documents but you can save them anywhere, like /iOSBackups). Click Save to make the first backup.

Saving Backups in Apple Configurator

Saving Backups in Apple Configurator

Notice how fast that went (assuming you didn’t load it up with 10 Gigs of crap)? The reason is that we’re not backing up iOS, just the data. This will become a little more obvious the first time we go to restore a device. In the meantime, if you look at your target directory, you’ll see a file with the name you provided followed by .iosdevicebackup. If you aren’t supervising you would need to delete these from the filesystem to remove them from the menu of available backups. If you are supervising then you’ll have a menu to manage the backups. You can also use the Other option in the selection menu to browse to another location and select another backup (e.g. you’re pulling them from other machines, etc.

Now that we have a backup, let’s do some stuff to the device. Let’s join the wireless network, change the wallpaper, create some contacts, make some notes and in general do some of those things that you might do on a base image of a computer, aside from of course configuring local admin (it’s not a multi-user device), installing anti-virus (to date, AV companies for iOS are snake oil salesmen) and other things you might not do. But as with imaging, if you can do something in Profile Manager or Apple Configurator, let’s reserve doing it there. In fact, I would probably try to set everything in Profile Manager or your MDM provider that you can (if you have one) and use Apple Configurator for as little as possible. That goes with imaging as well, do as much in directory services/managed preferences/profiles as you can and keep the image as simple as possible…

Anyway, once you have the device as you want it, make another backup. This is akin to baking an image with DeployStudio or System Image Utility. We can’t asr them out yet, but we’re in a much better place than we were.

Once you have a good backup, let’s leverage Apple Configurator to tell the device erase, update to the latest version of iOS, restore our image, join the SSID of our enrollment network (let’s consider this similar to a supplicant network in 802.1x). Then, let’s add a profile that will throw a Web Clip to our MDM solution and even add a Trust Profile to cut down on the number of taps to enroll (and the confusion of tap here, tap there, etc). From the Prepare screen in Apple Configurator, click on Settings and type the naming convention for your devices (in this case we’re going to call them krypted 1 and up) in the Name field. Then check the box for Number sequentially starting at 1 so it’s going to name them from 1 to 1,000,000 (which is how many iPads my krypted company is going to end up writing off at the testing rate I’m on now). Leave Supervision set to OFF (we’ll look at that later) and set the iOS field to Latest. Then, check the box for Erase all contents and settings and choose your image from the Restore menu.

Preparing Devices in Apple Configurator

Preparing Devices in Apple Configurator

Now for something that users of iPhone Configuration Utility, Profile Manager and Casper MDM will find familiar, click on the plus sign in the Profiles field and select Create New Profile. Here, we see what is the standard policy sheet (apologies to HIG if that’s not what those are officially called but I’ve not been able to find the right term) and give it a name in the Name field. This is how it will appear in the Profiles section of Apple Configurator. Because you can deploy multiple profiles, I’m just going to configure the SSID and Web Clip and call it MDM Enrollment. Optionally, give it some notes, organization name, etc.

Naming Your Profile in Apple Configurator

Naming Your Profile in Apple Configurator

Click on Wi-Fi and then click on the Configure button. Here, enter the SSID of the deployment network (MDMEnroll in this example). We’ll use the Hidden Network field to indicate the SSID is suppressed and we’ll use the network type of WEP and throw the password into the Password field as well. Now, before we move on, notice that there’s a plus and minus sign in the top right of the screen? You can deploy multiple of each, so if you have 10 wireless networks, 4 Email accounts, 9 VPN connections, 29 SSL Certs etc, you could deploy them all easily with multiple entries of each.

Adding Wireless Networks with Apple Configurator

Adding Wireless Networks with Apple Configurator

Scroll down in the sidebar a little and then click on Web Clips. Click on the Configure button. The Label is how the web clip’s name will appear on the device. We’re going to enter Enroll Here. In the URL field, provide the URL for your MDM server (e.g. When using a Profile Manager server called mdm.krypted.com the URL would be https://mdm.krypted.com/MyDevices). Not to get off topic, but did anyone else notice that Profile Manager in 10.7.3 now requires SSL certs? Anyway, you’ll also choose whether the web clip should be Removable (I think it should if it’s to enroll) and optionally choose an Icon. We’ll skip that (if we were using a 3rd party tool, I’d throw their logo in here; otherwise I usually like to use the company logo. I also like enrollment links to be Full Screen.

Go ahead and click Save and you’ll see MDM Enrollment listed in the Settings. If you notice, you can also click on the profile and then click on the export menu to export the profile or under the plus sign (“+”) you can Import Profile…, which is how we’ll bring in our Trust Profile from Profile Manager. From Profile Manager we already downloaded the Trust Profile. Now we’re going to click on Import Profile… and browse to it on the desktop, clicking on Trust profile.mobileconfig (or whatever name yours may have). Click Open.

Importing a Trust Profile Into Apple Configurator

Importing a Trust Profile Into Apple Configurator

We could go a step further and actually enroll the device by exporting the enrollment profile as well, but again, I want each user to provide their username and password so I as an administrator don’t have to go through and attach each device to a user in this scenario. I’ve been looking at importing devices and associating them with users via postgres, but that’s going to be another 3am article, on another night…

Next, check the box for each profile and click on Apps. This is where things start getting kinda’ cool. For this you’re going to need some app ipas. Each app in iTunes is stored as an .ipa file. We’re going to look at two different kinds of apps. The first is a free one and the second is a paid for app, both we’ll pull from iTunes. To do so, open iTunes and click on an app (iBooks in our example) and click on Show in Finder.

Show Apps in iTunes

Show Apps in iTunes

Note: Not all app .ipas are called the same thing as the filename. If you Show in Finder from the contextual menu of an app in iTunes it will automatically highlight the correct app in the Finder when it opens a Finder screen.

From the Finder you can either copy the app to the machine running Apple Configurator or if you’re using iTunes on that machine, you can go ahead and drag it to the Apple Configurator apps list. We’re also going to add an App that we used a purchase code from the VPP store to buy. You’ll get an error when you drag the paid app in (or browse to it if you so choose) that indicates the app is paid and in order to deploy it you’ll need to use VPP codes. Once added, you’ll notice it has an error indicator and the number 0 beside it.

Install Apps in Apple Configurator

Install Apps in Apple Configurator

Click on the numerical indicator beside the app name and you’ll be able to import redemption codes. These are emailed to you when you buy apps through the Volume Purchasing Program. BTW, no drag and drop in this screen, use the Important Redemption Codes button to browse to the XLS files.

Adding VPP Codes in Apple Configurator

Adding VPP Codes in Apple Configurator

Once the codes are imported, you’re ready to configure a device.
App Indicator Counts

App Indicator Counts In Apple Configurator

When you import an application, you are creating a file with a GUID in /Users/admin/Library/Application Support/com.apple.configurator/Resources. These files represent applications that have been prepared for distribution. When importing, it will take as long as it takes to copy from the source to that directory. The entry in that directory is roughly the same size as the app. Therefore, you likely don’t want to copy every app you have in there, just the ones you plan to distribute.
Now for the dangerous part. Make sure you don’t have any devices plugged into the computer. I love to start with a device at the activation screen. That thing requires so many taps I jump at any 0 touch deploy type of options I can get my hands on to skip it (not that you’re going to get 0 touch if you have profiles). The reason we want to make sure there aren’t any devices plugged in is that they’ll be wiped if they are… Provided there aren’t any, click on the Prepare button and any devices plugged in wills tart configuring immediately. The application count will go down for VPP apps as each device is configured. It can do 30 in parallel.
Imaging Devices in Apple Configurator

Imaging Devices in Apple Configurator

You’ll see a green checkmark when each device is done. When you’re ready to stop configuring devices, click on Stop. The only other way to do any in parallel is through Xcode Organizer’s restore feature, but that was never very stable for this type of purpose and this is a much more object oriented approach to device imaging. The caveat for these apps is that the password for the AppleID is needed to update them, so this is not a means to deploy paid apps to BYOD or self-managed types of devices (IMHO). Also, the iOS version for devices is downloaded at this point from Apple. If you notice that the first time each type of device is imaged that it takes awhile, this is why. The second time this step is skipped (another reason we need Internet access on our Apple Configurator computer). These are located in /Users/admin/Library/Application Support/com.apple.configurator/IPSWs and if you need to run a beta version of iOS you can do so by dropping their ipsw versions in here manually, but I haven’t gotten device supervision to work when doing so.

Using Apple Configurator to Supervise Devices

Now, supervising devices may seem more complicated, but it isn’t. Back at the Prepare screen, we set Supervision to OFF. Change the iOS field to No Change. Now, let’s turn it ON. When you do so, the iOS field automatically switches to Latest. This means that supervision is going to require updates (which is fine in my book as updates have yet to break a single app for me). Get all the same settings the same as they were previously.

Supervising Devices in Apple Configurator

Supervising Devices in Apple Configurator

Once you enable Supervision, click on Prepare in Apple Configurator and connect a device again. The device will then be imaged as with the same settings that you’ve given it from before. However, once it’s done, you’ll be able to click on the Supervise tab and see devices (Note: You supervise devices rather than users).

Device Supervision in Apple Configurator

Device Supervision in Apple Configurator

The subsequent Starts and Stops will now allow you to enable and disable profiles and apps on the fly, as well as restore backups, update devices and as you can see in this screen, reclaim those valuable VPP codes!

Do a Get Info on a device and you’ll also see a bevy of information about that device.

Get Info on Devices in Apple Configurator

Get Info on Devices in Apple Configurator

You can also click on Assign, once you’ve enabled Supervision. Assigning devices requires directory services. When you click on Assign, click on the plus sign (“+”) to add the first user. Type the first few letters of the users name and they should appear in the list. Click on them and they’ll be added. You can then use the right panel to assign content to the apps that you assign to that user’s devices.

Pushing Content in Apple Configuration Utility

Pushing Content in Apple Configuration Utility

Once added, the user will by default have no device. To assign a device to a user, use the Check Out box at the bottom of the screen and then match the users with the devices you want them to have.

Checking Devices Out To Users

Checking Devices Out To Users

The final piece of this application is to assign content to users. As I mentioned earlier in this article, the file system of an iOS device is through the lens of the applications that the device has installed. Therefore, we’ll be associating files to applications. DRMd content is not distributed through Apple Configurator. So iBooks, etc, aren’t applicable. The various third party applications can open and therefore host file types that they support, as with iTunes. From the Assign pane of Apple Configurator, click on a user and then click on the plus sign (“+”) to add documents. At the Choose A Target Application screen, choose the application you’ll be loading content into.

Choosing An App For Content

Choosing An App For Content

When you click Choose, you’ll then be able to select files to use with that application.

Selecting Content

Selecting Content

Then just dock the iOS device, sync and viola you’ve got content distribution over USB all handled. You can also add groups of devices and groups of users and distribute content to groups of users rather than to one at a time.

Conclusion

Apple Configurator is really a great tool when used in the right scenarios. In learning how it works and interacts I actually learned a lot about both iOS and Mac OS X that I didn’t know before. I hope I did the tool justice with how easy it is to use. This is a fairly long article and it’s probably more complicated than it needs to be in parts, but that’s more my method of trying to figure out what it’s doing than the tool being complicated. It’s not hard to figure out at all. I am sure I could teach any non-technical iOS admin to use it in less than an hour.

My wish list includes logs and OTA. You can’t use iPhone Configuration Utility while you’re using Apple Configurator and therefore, you can’s see up-to-the second logs about things like key bags to figure out why this isn’t working or that. This makes it kinda’ difficult to figure out why a profile doesn’t get installed with an image if you’re not using an AppleID with the tool or other weird little things like that. I’d love to see a little more logging. Obviously, if you could run this thing Over the Air then it would be nerd nirvana. I guess the OTA isn’t as much as wish list for this tool, but features that could be imported into Profile Manager and other tools.

One of the more important aspects is the impact on AppleID use and app ownership. I started this off by saying “My traditional interpretation of Apple’s vision on how iOS devices are used is that everyone has an AppleID.” Well, when using this tool an AppleID is no longer necessary for app deployment.

Overall, we have a new, powerful tool in our arsenal that makes up the iOS administration ecosystem. I hope that I’ve managed to dispel a few rumors with this article and look at some great uses for where this tool should and should not be used. I also hope that no matter what, if you manage iOS devices, that you’ll take a look at it. I expect you’ll find it useful in some part of your management toolkit!

cloud Mac OS X Mac OS X Server Mac Security Mass Deployment Ubuntu Unix

Using the CrashPlan Pro REST API

CrashPlan Pro Server is a pretty cool tool with a lot of great features that can be used to back up client computers. There are a lot of things that CrashPlan Pro is good at out of the box, but there are also a lot of other things that CrashPlan Pro wasn’t intended for that it could be good at, given a little additional flexibility. The REST API that CrashPlan Pro uses provides a little flexibility and as with most APIs I would expect it to provide even more as time goes on.

I often hear people run away screaming when REST comes up, thinking they’re going to have to learn some pretty complex scripting. And while the scripting can be complex, it doesn’t necessarily have to be. You can find a lot of handy information about the options available in the REST API at http://support.crashplanpro.com/doku.php/api. The very first example command that CrashPlan gives is the following:

http://:4280/rest/users?status=Active

Now, to use this in a very simple script, let’s look at it with curl. You are going to need to authenticate, so we’re going to inject that into the URL in much the same was that we would with something like, let’s say, WebDAV, SSH or FTP. If the server name were foundation.lan, the user name was daneel and the password was seldonrulez then the curl command would actually look like so (you could use the -u operator to inject the authentication information, but as you’ll see later I’d like to make those a bit less complex):

curl http://daneel:seldonrulez@foundation.lan:4280/rest/users?status=Active

Note: The default port for the web administration in CrashPlan Pro is 4280.

This is simply going to output a list of Active users on the server. The reason it’s going to output only Active users is that we asked it to (reading from left to right after the rest is shown in the URL) query users, using the status attribute and specifying only to show us users whose status matches as Active. We could just as easily have requested all users by using the following (which just removes ?status=Active):

curl http://daneel:seldonrulez@foundation.lan:4280/rest/users

Each user has a unique attribute in their id. These are assigned in an ascending order, so we could also query for the user with an ID of 3 by simply following the users with their unique ID:

curl http://daneel:seldonrulez@foundation.lan:4280/rest/users/3

We could also query for all users with a given attribute, such as orgId (note that these attributes are case sensitive unlike many other things that start with http). For example, to find users with an orgID of 3:

curl http://daneel:seldonrulez@foundation.lan:4280/rest/users?orgId=3

The API doesn’t just expose looking at users though. You can look at Organizations (aka orgs), targets (aka mountPoints), server statistics (aka serverStats) and Computers (aka computers). These can be discovered by running the following command:

curl -i http://daneel:seldonrulez@foundation.lan:4280/rest/

To then see each Organization:

curl http://daneel:seldonrulez@foundation.lan:4280/rest/orgs

And to see each Computer:

curl http://daneel:seldonrulez@foundation.lan:4280/rest/computers

You can also perform compound searches fairly easily. For example, let’s say that we wanted to see

curl http://daneel:seldonrulez@foundation.lan:4280/rest/computers?userId=3&status=Active

These basic incantations of curl are simply getting information, which programmatically could also be specified using a -X operator (or –request if you like to type a lot) to indicate the type of REQUEST we’re sending (continuing on with our Code42 Sci-fi inspired example):

curl -X GET -H ‘Content-type: application/json’ http://daneel:seldonrulez@foundation.lan:4280/rest/orgs

The important thing about being able to indicate the type of REQUEST is that we can do more than GET: we can also POST and PUT. We also used the -H operator to indicate the type of data, which we’re specifying as application/json (per the output of a curl -i command against the server’s REST API URL). POST is used to create objects in the database whereas PUT is used update objects in the database. This could result in:

curl -i -H ‘Content-Type: application/json’ -d ‘{“username”: “charlesedge”, “password”: “test”, “firstName”: “Charles”, “lastName”: “Edge”, “orgId”: “3″}’ http://daneel:seldonrulez@foundation.lan:4280/rest/users

Once you are able to write data, you will then be able to script mass events, such as create new users based on a dscl loop using groups, remove users at the end of a school year (PUT {“status”: “Deactivated”}), mass change orgIds based on other variables and basically fully integrate CrashPlan Pro into the middleware that your environment might already employ.

Perl, Python, Ruby and PHP come with a number of options specifically designed for working with REST, which makes more complicated scripting much easier (such as with php’s curl_setopt); however, these are mostly useful if you already know those languages and the point of this article was to stay in shell scripting land. This allows you knock out simple tasks quickly, even if the good people at Code 42 didn’t think to add the specific features to their software that you might have in mind. Once you start to get into scripting more complex events, look to the Python examples at the bottom of the API Architecture page to get ya’ kickstarted!

10 Worst MySpace Apps

One of the contributors to the success that Facebook has had in the social networking world is the ability for savvy developers to build applications. MySpace has been picking up scraps from the Facebook strategy for some time and has followed suit with the ability to integrate custom applications. Now that MySpace has more than 50 pages of applications, I wanted to do a 10 best MySpace applications post. But beyond the RSS feeder I mentioned earlier and a couple of interesting apps that were also on Facebook (and were better in the Facebook iteration) I just couldn’t do it. Therefore, let’s take a look at some of the high quality applications that have been introduced and what I found when I changed my quest from the 10 best to the 10 worst:

10. Football Scrapbook Frame, http://www.myspace.com/520993626
This application allows you to frame a photo of yourself in a football image. Now, I love football myself, but the quality of the frame combined with the model posing and the sad excuse for graphical editing makes me want to actually skip watching the Super Bowl. I am sure that the developer, whose name is TopRated funny enough, is just trying to get people to download the application by putting the word Football in the title. But this application does absolutely nothing, other than waste space on profiles, take a long time to load and best of all, show your friends that you like football but that you aren’t smart enough to find a better picture to show it (or for that matter upload that picture to MySpace, which is really hard to do apparently).

9. Lover or Loner, http://www.myspace.com/520671795
This application is yet another of the quizzes that have become so commonplace on Facebook and now MySpace. My initial reaction was that it would be bad, but who knew? My guess is that best case, if you are taking this quiz and installing this application on your profile that you are currently a Loner. There is a very high probability though, that the longer you leave this application on your profile, the higher the chance that you will always and forever be alone!

8. Flashy Pink Heart, http://www.myspace.com/518871148
This game is awesome in the very same way that <flash>  was awesome back in the 1990′s, when the web was new and you could make things blink on the computer. This game does exactly what it says, it produces a pink heart that is flashy and displays your OMG can’t wait to see it, flashy text!!! But the best part of this application has nothing to do with the application itself, but with the fact that it is so prolific, with well over 1,000 users downloading it and installing it onto their profile!

7. Catch Thife, http://www.myspace.com/520715560
TopRated strikes again in this masterpiece where according to the developer you “try to hit the moving thief in order to send him jail.” I’m not sure what gave it away first: my experiences with this developers applications, the mastery of prepositions in the description or the actual game play. This game single-handedly showed me why Apple reviews all submissions for the iPhone App Store!

6. What Justin bieber, http://www.myspace.com/518694013
Did you ever ask yourself which Justin Bieber song most matches your personality? If so then this application will help prove to all of your friends that you are wearing that chastity belt and if you are over 17, that you are hiding something deeply disturbing with it. Obviously a ploy to get a bunch of email addresses to spam about the latest in viagra pricing, this application is really just another Quiz from the developer called Quizzes.. If it isn’t obvious to you that they are a spammer, then what do you think they are doing by spamming the applications list with so many Quizzes?!?!

5. BFf, http://www.myspace.com/518847077
As if the term BFF wasn’t so 2005, the graphics in this application seek to bring back design elements from clip art CDs that came with Microsoft Office back in the 1990′s. Your friends couldn’t just post something to your profile. No, they needed to actually post to an application. And in order to do so they have to use the application too! Maybe I’m just sad that no one posted to my BFF Comments box? I guess an emoticon is in order to indicate my disappointment here. :(

4. Farm Town, http://www.myspace.com/474755864
This game probably has the best game play and some of the better graphics on MySpace (or Facebook for that matter). So why does it show up on this list? Because 671,665 people are active users. The amount of time spent could end most of the worlds problems? Want a cure for cancer, to revitalize run down neighborhoods or find the meaning of life? How about rewrite Windows so it doesn’t suck any more? Nothing will ever happen until all these people uninstall this game and move on to doing something useful with themselves!

3. The Farmer, http://www.myspace.com/445093191
As if Farm Town wasn’t bad enough, now we have to endure Farm Town copy-cats? Really? I don’t think that anything else need be said about this one. Having said that, many of the other applications from this developer are actually quite good. They just had a little moment where they wanted a few extra addresses to harvest!

2. Twitter Sync, http://www.myspace.com/twittersync
This application just doesn’t work. There’s obviously a lot of code and it’s one of the more mature applications on MySpace. But it doesn’t work. If you absolutely must have your tweets show up on your page then consider iTwitter, available at http://www.myspace.com/463617608

1. The API. Makes me wonder if MySpace was in a rush to put something out or what. The privacy controls are good, but the options are far behind what Facebook offers, making me wonder if MySpace just wanted to be able to say they had applications, but not care about the applications that were made (they’re kinda’ like a Palm Pre that way). But the best part is that almost every application out there is made by spammers. The account I setup to test these things is now getting well over 50 spam messages a day. Thanks MySpace!!!

sites

5 Tools for Extending Google Apps

Google Apps has a nice little API that was developed for interfacing with it programatically. Well, a number of other vendors have been building around it for a little while and there’s starting to be a nice little suite. Here are some to look at:

  • Manymoon: Allows more granular document sharing, mail management and security with your documents, tasks and projects
  • Socialwok: Allows you to build a social network on top of Google Apps
  • Smartsheet: Project, sales pipeline and resource tracking. Allows for collaboration with external users as well.
  • Tripit: allows you to see your travel plans and collaborate with others on their travel plans (wish American Express Travel had an API with them)
  • Zoho: Zoho can do much of what Google Apps can do, but it also has CRM. Now the two can work together!