PerformancePoint 2007 Monitoring Server permissions

The Monitoring Server component of PerformancePoint 2007 is responsible for managing the user rights as far as being able to publish dashboards, edit existing dashboards, etc. This article got me most of the way there in understanding how to set up user permissions, but I think it's helpful to point out a few other items.

Dashboard Designer is the interface for Monitoring Server user security.
This was not immediately clear to me. There are two basic aspects to the permissions: global permissions (such as administrator rights, being able to publish new dashboards, etc.) and per-Dashboard permissions.

To configure server (global) role assignments:

In Dashboard Designer, hit the Office button and then the Options button on the resulting menu:



On the resulting Server tab, hit the Connect button:



Once it logs in, hit Permissions:



On the resulting Permissions dialog, you can add users in DOMAIN\name form, specifying their server (global) role:



To configure permissions for individual dashboards:

Open the desired dashboard On its Properties tab, there is a Permissions section at the bottom:



Add your users (DOMAIN\name format again) and specify Reader or Editor roles. After changing these permissions, you must publish the dashboard.

Vista Page File in Netherworld

I had an odd problem with a Windows Vista SP1 installation. I suddenly began getting "your computer is low on memory" warnings when nothing really had changed with the way I use the machine. I looked at Task Manager and saw that it was showing page file use of ~1700M / ~1800M. When I went to Advanced System Settings (System Properties) to examine the page file size (Advanced tab, Performance settings, then the Advanced tab again) it showed the total page file size as.... 0 MB!

I knew I had enabled a page file previously when I set up the machine, so I rebooted--and it still showed 0 MB for the page file size. So, I went to assign a new 4096 MB page file. When I did this, it gave me a message stating that pagefile.sys already existed (!) and asked if I wanted to overwrite it. I half expected the machine to die painfully when I approved this action, but it did not... and knock on particleboard, I haven't gotten any of the warnings since.

WCF in .NET 3.5 SP1 and Enterprise Library - TypeInitializationException

I have been fighting a maddening issue. It seems that if you have a WCF service under the .NET 3.5 SP1 beta that is impersonating the caller--either using the ServiceModel pipeline or ASP.NET Compatibility Mode--calls to Enterprise Library assemblies (at least for logging or data access needs) will fail with the following exception:

"The type initializer for 'Microsoft.Practices.EnterpriseLibrary.Logging.LogEntry' threw an exception."

When you dig for the inner exception, you find:

Could not load file or assembly 'System.Management, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' or one of its dependencies. Access is denied.

I've tried numerous things to get around this, such as:

• Changing the application pool identity to Local System
• Directly referencing System.Management in the service assembly
• Adding System.Management (and the Ent Lib assemblies, for that matter) to the <assemblies> node in the web.config

** Update - 11 Jul 2008: Client configuration changes were required to correct the problem. In the client's app.config, configure a behavior for the endpoint to allow impersonation:

<client>
<endpoint address="http://server/WcfService1/Service1.svc"
binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IService1"
contract="ServiceReference2.IService1" name="BasicHttpBinding_IService1"
behaviorConfiguration="endpointBehavior"/>
</client>
<behaviors>
<endpointBehaviors>
<behavior name="endpointBehavior">
<clientCredentials>
<windows allowedImpersonationLevel="Impersonation"/>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>

Then, for some reason, an IIS reset was needed to make the client start working. This article describes the problem in detail.

Here's the thread over on the Enterprise Library forums where I was corresponding about the issue.

Silverlight and REST for corporate (intranet) applications

Danger Will Robinson, Silverlight 2 beta 2's WebClient implementation does not support passing integrated security credentials. I was hoping to implement a RESTful services tier for my intranet Silverlight application using Windows Integrated Security. While this does work brilliantly when using IE as a client, the Silverlight client cannot call the services. There seems to be no good workaround: I could use ASP.NET authentication services using Forms authentication against AD, but I would have to present the client with a login prompt.

FYI, the service configuration for WCF REST and integrated security is as follows:

<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior name="webBehavior">
<webHttp/>
<!--<enableWebScript/>-->
</behavior>
</endpointBehaviors>
</behaviors>

<serviceHostingEnvironment aspNetCompatibilityEnabled="true" />

<bindings>
<webHttpBinding>
<binding name="integratedWebHttpBinding">
<security mode="TransportCredentialOnly">
<transport clientCredentialType="Windows"/>
</security>
</binding>
</webHttpBinding>
</bindings>

<services>
<service name="AppNamespace.Service">
<endpoint address=""
behaviorConfiguration="webBehavior"
binding="webHttpBinding"
bindingConfiguration="integratedWebHttpBinding"
contract="AppNamespace.Service" />
</service>
</services>
</system.serviceModel>

MOSS and Kerberos on Windows Server 2008 - a gotcha

I've been through the Kerberos mill repeated times--getting the SPNs lined up, making sure the computer and service accounts are trusted for delegation, making sure the times on the servers are within 15 minutes, etc. But I couldn't make Kerberos authentication work on my MOSS web applications on a Windows Server 2008 server.

I opened a ticket on this with Microsoft and discovered that IIS 7.0 has kernel mode authentication turned on by default. MOSS has a problem with this and it will completely break Kerberos for those web applications. To turn this off:

In Server Manager, select the web application for which you want to fix Kerberos authentication:



Select its Authentication tool:



Now choose Advanced Settings:



Finally, make sure the "Enable Kernel-mode authentication" checkbox is UNCHECKED:



Apply your changes and you should be good to go. It is not necessary to reset IIS or bounce the application pool to make it take effect. Don't forget that you still have to configure the web in MOSS Central Administration to use Kerberos (Negotiate) authentication instead of NTLM in addition to all the other normal domain-based Kerberos setup steps. Cheers.

** UPDATE 24 Mar 2009 **
Apparently the kernel mode authentication setting also breaks NTLM authentication on WS 2008, so this is not specific to making Kerberos work.

Moving Silverlight 2 beta 1 applications to beta 2

With new times come a new Silverlight beta, released last week. I set out to update my beta 1 applications to beta 2. First, I let it run the project through the upgrade wizard. After that, I found there were several more steps, starting with fixing your installation...

Remove and Re-Add System.Windows References

This includes:

• System.Windows
• System.Windows.Browser
• System.Windows.Controls.Data
• System.Windows.Controls.Extended (this one will likely not be needed now as many controls have moved into the base assemblies)
  

Update Namespaces of the Silverlight User Control and Application Objects

Make this change in App.xaml and any other user control (*.xaml) objects.

From:

xmlns="http://schemas.microsoft.com/client/2007"

To:

xmlns="http://schemas.microsoft.com/winfx/2006/xaml/presentation"

This avoids mystery "invalid XAML" errors from the Silverlight control on web pages:

Sys.InvalidOperationException: Invalid XAML for control 'Xaml1'. [] (line 1, col 229): The element is not valid in the given namespace.

Update the Deployment Node Namespace in AppManifest.xaml

From:

<Deployment xmlns="http://schemas.microsoft.com/client/2007/deployment" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" EntryPointAssembly="HCHB.ServiceRequests" EntryPointType="HCHB.ServiceRequests.App" RuntimeVersion="2.0.30226.2">

To:

<Deployment xmlns="http://schemas.microsoft.com/client/2007" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" EntryPointAssembly="HCHB.ServiceRequests" EntryPointType="HCHB.ServiceRequests.App" RuntimeVersion="2.0.30523.6">

Update the Silverlight Control Declaration

Find the Silverlight control on the web page(s) in your site and update the node accordingly, from:

<asp:Silverlight ID="Xaml1" runat="server" Source="~/ClientBin/Silverlight1.xap" Version="2.0" Width="100%" Height="100%" />

To:

<asp:Silverlight ID="Silverlight1" runat="server" Source="~/ClientBin/Silverlight1.xap" MinimumVersion="2.0.30523" Width="100%" Height="100%" />

Change the Cross-Domain Access Policy

This prevents 404 errors when calling my web services.

From:

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from>
...

To:

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
<cross-domain-access>
<policy>
<allow-from http-request-headers="*">
...

FreeMind manual installation in Ubuntu Hardy 8.04

So you like the mind mapping software FreeMind, but the distribution package for Ubuntu 8.04 is hideously out of date. Your solution awaits... simply by installing FreeMind from source. While this is fairly easy to follow, there is some complexity with getting full desktop integration. I am including the steps I followed, but if you scroll all the way to the bottom, you can find a compiled archive with 0.9.0 beta 17 included with a script to do all the work referenced in the article.

First, you need a few packages (if you are going to use the version of FreeMind I compiled below, you do not need sun-java6-jdk):

sudo aptitude install sun-java6-jre sun-java6-fonts sun-java6-jdk

Now download FreeMind. I recommend the latest beta version, found here. You will also need to download Apache Ant. There is an Ant package in the Hardy repositories, but it is broken, so you will need the binaries directly from Apache. I used 1.7.0, the latest version available at the time of this article.

Unpack Ant and copy it to its destination (execute the following in a terminal wherever you placed the downloaded Ant archive):

tar xf apache-ant-1.7.0-bin.tar.bz2
sudo mkdir /usr/local/ant
sudo mv apache-ant-1.7.0/* /usr/local/ant

Set up Ant's environment variables:

gksu gedit /etc/rc.local

# In gedit, append the following to this file before "exit 0":

export ANT_HOME=/usr/local/ant
export PATH=${PATH}:${ANT_HOME}/bin

Reboot for the above to take effect, or just execute the two export commands within your current terminal. Now you are ready to compile FreeMind. Unpack it and build it with Ant:

tar xf freemind-src-0.9.0_Beta_17.tar.gz
cd freemind
ant

Now copy the built contents of the dist folder into /opt/freemind, and set up the executable:

sudo mkdir /opt/freemind
sudo cp -R ../bin/dist/* /opt/freemind
sudo chmod +x /opt/freemind/freemind.sh
sudo ln -s /opt/freemind/freemind.sh /usr/local/bin/freemind

Congratulations, you can now run FreeMind by simply typing the command: freemind

The harder part was registering the x-freemind MIME type and getting Gnome to open .mm files with a double-click (and having an icon assigned to those files!). For the MIME type, there are two existing conflicting MIME types you will have to get rid of: x-troff-mm and x-matlab. As I have no use for these applications, this is not a problem for me. These are defined in /usr/share/mime/packages/freedesktop.org.xml, and you have to comment out the nodes as follows:

<!--
<mime-type type="text/x-matlab">
 <sub-class-of type="text/plain"/>
 <comment>MATLAB script/function</comment>
 <comment xml:lang="bg">Скрипт/функци� — MATLAB</comment>
 <comment xml:lang="ca">script/funció MATLAB</comment>
 <comment xml:lang="cs">Skript/funkce MATLAB</comment>
 <comment xml:lang="de">MATLAB-Skript/-Funktion</comment>
 <comment xml:lang="en_GB">MATLAB script/function</comment>
 <comment xml:lang="es">script/función de MATLAB</comment>
 <comment xml:lang="eu">MATLAB script/funtzioa</comment>
 <comment xml:lang="fi">MATLAB-skripti/funktio</comment>
 <comment xml:lang="fr">script/fonction MATLAB</comment>
 <comment xml:lang="hu">MATLAB parancsfájl/funkció</comment>
 <comment xml:lang="it">Script/Funzione MATLAB</comment>
 <comment xml:lang="ja">MATLAB スクリプト/関数</comment>
 <comment xml:lang="ko">MATLAB 스�립트/함수</comment>
 <comment xml:lang="nb">Skript/funksjon for MATLAB</comment>
 <comment xml:lang="nl">MATLAB-script/functie</comment>
 <comment xml:lang="nn">MATLAB-skript/funksjon</comment>
 <comment xml:lang="pl">Skrypt/funkcja MATLABa</comment>
 <comment xml:lang="pt_BR">Script/função do MATLAB</comment>
 <comment xml:lang="sv">MATLAB-skript/funktion</comment>
 <comment xml:lang="uk">Сценарій/функці� MATLAB</comment>
 <comment xml:lang="vi">Văn lệnh/chức năng MATLAB</comment>
 <magic priority="10">
   <match value="%" type="string" offset="0"/>
 </magic>
 <magic priority="50">
   <match value="function" type="string" offset="0"/>
 </magic>
 <glob pattern="*.m"/>
 <alias type="text/x-octave"/>
</mime-type>
-->


...and....

<!--
<mime-type type="text/x-troff-mm">
 <sub-class-of type="text/plain"/>
 <comment>Troff MM input document</comment>
 <comment xml:lang="bg">Изходен документ — Troff MM</comment>
 <comment xml:lang="ca">document d'entrada Troff MM</comment>
 <comment xml:lang="cs">Vstupní dokument Troff MM</comment>
 <comment xml:lang="da">Troff MM inddata-dokument</comment>
 <comment xml:lang="de">Troff-MM-Eingabedokument</comment>
 <comment xml:lang="el">έγγ�αφο/π�όγ�αμμα εντολών troff MM</comment>
 <comment xml:lang="en_GB">Troff MM input document</comment>
 <comment xml:lang="eo">eniga dokumento de Troff MM</comment>
 <comment xml:lang="es">documento de entrada Troff MM</comment>
 <comment xml:lang="eu">Troff MM sarrerako dokumentua</comment>
 <comment xml:lang="fi">Troff MM -syöteasiakirja</comment>
 <comment xml:lang="fr">document d'entrée Troff MM</comment>
 <comment xml:lang="hu">Troff MM bemeneti dokumentum</comment>
 <comment xml:lang="it">Documento di input Troff MM</comment>
 <comment xml:lang="ja">Troff MM 入力ドキュメント</comment>
 <comment xml:lang="ko">Troff MM input 문서</comment>
 <comment xml:lang="lt">Troff MM įvesties dokumentas</comment>
 <comment xml:lang="ms">Dokumen input Troff MM</comment>
 <comment xml:lang="nb">Troff MM-inndatadokument</comment>
 <comment xml:lang="nl">Troff MM-invoerdocument</comment>
 <comment xml:lang="nn">Troff MM inndata-dokument</comment>
 <comment xml:lang="pl">Dokument wejściowy Troff MM</comment>
 <comment xml:lang="pt">documento origem Troff MM</comment>
 <comment xml:lang="pt_BR">Documento de entrada Troff MM</comment>
 <comment xml:lang="sq">Dokument input-i Troff MM</comment>
 <comment xml:lang="sr">Troff MM улазни документ</comment>
 <comment xml:lang="sv">Troff MM-indatadokument</comment>
 <comment xml:lang="uk">Вхідний документ Troff MM</comment>
 <comment xml:lang="vi">Tà i liệu nhập MM Troff</comment>
 <comment xml:lang="zh_CN">Troff MM 输入文档</comment>
 <glob pattern="*.mm"/>
</mime-type>
-->

You then need to add a file at /usr/share/mime/packages/freemind.xml with the following contents:

<?xml version="1.0" encoding="UTF-8"?>
<mime-info xmlns="http://www.freedesktop.org/standards/shared-mime-info">
<mime-type type="application/x-freemind">
 <comment>FreeMind Mind Map</comment>
 <glob pattern="*.mm"/>
</mime-type>
</mime-info>

Once you have edited/created these files, you need to update the MIME database:

sudo update-mime-database /usr/share/mime

To assign icons to the FreeMind .mm files, It turns out you have to create 48x48, 32x32, and 24x24 icons (PNG files) for FreeMind, copy these to /usr/share/icons/gnome under the appropriate size-named folders, and then update the icon cache. I used GIMP to create the icons based on an svg icon that came with the FreeMind source package. Each icon PNG must be named gnome-mime-application-x-freemind.png. To update the icon cache once these are in place:

sudo gtk-update-icon-cache --force gnome

Once you are done, log out and back in, and enjoy your FreeMind goodness.

NOW, if that all seems a bit much... I have created an archive containing a script that does everything except set up the main menu item pointing to FreeMind. It contains a version of FreeMind 0.9.0 beta 17 I compiled (on 64-bit Ubuntu, so this may or may not work on 32-bit versions) along with the modifications to the MIME types and the icons I created.

Download it here: freemind-0.9.0_Beta_17.tar.bz2