TeamAgenda: watch out for open LDAP connections

If you are running TeamAgenda STS (version 4.x, I don't know about v5) and your server is available on public network or DMZ, make sure your LDAP port is blocked for non authorized users. Why? Because all TeamAgenda STS installations use the same user and password for LDAP!

It's cool for people who needs to connect to it to migrate away from TA (I noticed that "security problem" when I was migrating someone from TA to Kerio Connect) so that you can get the data out, but it's not cool if you have a TA server running on the whole Internet.

Sharing calendars with groups

I need to share calendar collections from iCal Server to groups, but sadly, with CalDAV it doesn't work. Why? Because even if the invitation is not sent by email, the user or contact that is going to get the invitation must have an email address. In Open Directory, groups don't have email addresses by default, so I said: "hey, let's add one with dscl!". So I added an existing email address to the group's OD record, but the problem is that it's the user who receive the invitation and must accept it in iCal.

So I asked the ical-server@lists.apple.com mailing list, and it seems the best ways to share calendars with groups instead of inviting every member of the group directly are:

Are you using icalserver standalone or as part of OS X server? With OS X server the wiki feature does offer a way to manage group calendars via the wiki group membership. Users who are members of a wiki can directly "subscribe" to the wiki calendar via a special sharing mode that involves simply clicking a link in the wiki calendar - that will "bind" the wiki calendar into the user's calendar home where it appears as if it were a calendar shared by an individual. 

If you don't have the wiki available, then you can do something similar with resource calendars: 

1) Create a resource for "Movie Editing". 

2) Create an OD group "movie-editing". 

3) Assign the group as a read-only or read-write proxy of the resource using the command line proxy management tool. (the command line tool is: calendarserver_manage_principals).

4) Users can "subscribe" to the shared calendar by clicking on a URL and authenticating in their browser using their calendar server credentials: 

https://calendar.example.com/calendars/resources/movieediting/calendar/?action=share

This is for servers that implements the caldav-sharing draft. To my knowledge, only iCal Server 10.7 and 10.8, or CalendarServer (the open source version of iCal Server) implements it. Other CalDAV implementations don't allow you to share individual calendar collections by iCal/Calendar.app (but some will allow you to share them by doing it by their Web interface, like Zimbra or Kerio Connect).

Alfresco JMX dump and authentification

I see a couple of Web pages that tell you how to do a JMX dump for Alfresco, but all of those pages, they forget to say that you have to be authentified with a admin account in Alfresco Explorer BEFORE you call the URL for the JMX dump! The JMX dump page is not asking for authentification.

So in short, you need to login at http://your.alfrescoserver.com/alfresco and after, you can do the dump at http://your.alfrescoserver.com/alfresco/faces/jsp/admin/jmx-dumper.jsp