Author Archives: TimL

•

Overview

SAML allows for SSO using the Web Browser users credentials.

Noodle Prerequisites

If AD is being used, LDAP users should have already been populated within Noodle.

Quick reference

  1. Save your IdP URL and fingerprint in your SP (Noodle)
  2. Use https://yourNoodle.tld/SAML.po in your IdP settings and Web Browser.

Supported IdPs

Onelogin, Okta, and Azure
Note: Contact us for assistance integrating Other IdPs.

Noodle Configuration

In Noodle navigate to “System Tools > Settings > Single Sign-On”

Both URL & fingerprint will be supplied by your IdP vendor. Your IdP may provide an XML file which contains the URL and certificate, to convert the certificate into a SHA-1 fingerprint there are some online SAML tools:

Format Certificate

Calculate Fingerprint

IdP Configuration

Your IdP will require a location to direct SAML responses, use https://yourNoodle.tld/SAML.po.  Noodle will be compatible with the default settings of most IdPs.

OneLogin

  1. Navigate to "Administration > Applications > Add App"
  2. Search for "SAML Test Connector (IdP)"
  3. setting tabs
    • Info (all optional)
    • Configuration
      • ACS (Consumer) URL Validator = .*
      • ACS (Consumer) URL = https://yourNoodle.tld/SAML.po
      • the rest can be left blank
    • Parameters
      • Configured by admin
        • NameID (fka Email) = Email
    • Rules (all optional)
    • SSO
      • X.509 Certificate = 2048-bit
        • View details will show the fingerprint
      • SAML Signature Algorithm = SHA-1
      • SAML 2.0 Endpoint (HTTP)
        • This is the URL to save in Noodle
    • Access (all optional)
    • Users (make sure you add some)
    • Privileges (all optional)

Azure

  1. Azure Active Directory > Enterprise applications > New Application
  2. Non-gallery Application > Name can be anything > 2 Single sign on > SAML
    • set "Identifier (Entity ID)" to the domain name for the Noodle instance
    • set the "Reply URL" to https://yourNoodle.tld/SAML.po
    • copy the "Thumbprint" and "Login URL" to put in the Noodle settings

•

Noodle supports the following integrations:

  • Authentication
  • Media
    • Unsplash
    • Youtube
    • Vimeo
  • Files
  • Calendars (iCal)
    • Google
    • Microsoft
  • Scripting (bash)
  • email (SMTP)
    • Postfix
    • MS Exchange
    • etc
  • RDBMS (SQL)
    • PostgreSQL
    • MS SQL
    • MareaDB
    • MySQL
    • CockroachDB + Ceph
    • Oracle
  • Web Browsers
    • Firefox
    • Chromium
  • Indexing (CLI)
    •  TensorFlow
    • MS Office
    • Adobe
    • LibreOffice
    • OpenAI Whisper
    • Tesseract
    • etc
  • UI Customization (JS/CSS)
    • Twitter
    • Weather
    • RSS
    • etc

•

GDPR checklist;

Local

  • We hold payment information optionally provided by clients, and share it with no one. we use it to charge for our software service.
  • We hold at least one pice of contact information to update payment information.
  • Data is stored on our accounting computer
  • This is our publicly accessible policy
  • We have a DPO
  • Our staff and management is aware of this document
  • We use modern and up to date security.
  • We appoint clients as their own representatives in the EU
  • If ever we become aware of a personal data breach our customers and local authorities will be made aware.
  • customers can verify and update information by simply asking.
  • We review this policy annually or as required.
  • We understand when DPIA is required

Hosted

  • Data is stored-in / removed-from a location of the clients request.

•
  1. Create a drive key and secret
  2. Put them in "System Tools > Settings > General > Google Drive OAuth"
    1. Note that OAuth requires your Noodle server to be accessed via a public domain
  3. Enable in the "Administration > Properties" of the folder you want to connect.
  4. View the folder and follow the prompts.

•

Vialect Bug Bounty;

  1. Contact us and let us know you are interested.
  2. Qualification
    • Confine aggressive/damaging testing to a local install
    • Keep your findings confidential until the week after we fix the bug (same day we hope)
    • We pay whenever we make a change as a result of your bug report.
  3. Send us a report with enough information for us to reproduce the bug of whatever class
    • RCE Remote code execution
    • EoP Elevation of privilege
    • ID Information disclosure
    • DoS Denial of service
  4. We will reward you (You will not be prosecuted)
    • Public credit and thanks
    • Payment (varies by severity and location of the bug up to $1,000 USD)

We thank VioPoint and All Covered for Testing Noodle.

•

postgresql.conf ships with quite modest defaults so be sure to august it for anything more than light use. We recommend for ~4k users;

  • Available Memory = System Memory - OS (1GB for Windows) - Java (100 to 512)
  • effective_cache_size = Available Memory / 2
  • shared_buffers  = effective_cache_size / 4
  • max_locks_per_transaction = 512
  • max_connections =  60
  • checkpoint_segments 30
  • log_min_duration_statement = 10000
  • log_line_prefix =  ''%m: ''

There is a convenient config creator here.

•

When something unexpected happens Noodle will ask you what you were doing and email a stack trace to Vialect. Bug reports may also be sent to techsupport@vialect.com. Please use saleshelp@vialect.com for any other inquiries.

Please provide the following to help us reproduce and correct issues faster:

  • Minimal steps to reproduce the issue from scratch. Possibly relevant details:
    • The URL
    • The version of Noodle
    • The version of Web Browser
    • The version of Operating System
    • A username and password
    • An ordered list of buttons/links clicked
    • Sample file/data
  • Expected behavior, possible details:
    • 720p mockup of desired appearance with min and max sample data.
  • Actual behavior, possible details:
    • A full resolution screen shot including address and scroll bars
    • Web Browser console output
    • Web Browser network log (HAR)
    • The source of any warning pages (wrong format, missing parameter)
    • The source of any email
    • A zip of the Noodle/log folder
  • Observe email educate
    • A short descriptive email subject
    • Reply to the email thread only for the same issue
    • Don't make new threads for the same issue.
    • Avoid requesting thread history review.
    • Do not place legal or print notes in signatures or otherwise bloat them.
    • Use text in favor of images
    • Use attachments not overlays/embeds of images or text
    • Be concise.

Leaving out information leads to Vialect spending less time creating solutions and more time attempting to reproduce issues and linking to this page.

•

The first encrypted request after starting Noodle can be 3 orders of magnitude slower than normal due to random entropy pool depletion. If your server suffers from this issue (most EC2 servers) you can verify by checking the pool size:

cd /proc/sys/kernel/random/ && cat poolsize entropy_avail

There are at least 3 solutions to a depleted pool:

1 Hardware

Some hardware includes random generators (like the rdrand CPU flag):

grep -ic rdrand /proc/cpuinfo

You can enable its use with:

Debian/Ubuntu

apt install rng-tools
systemctl start rng-tools.service
systemctl enable rng-tools.service

Fedora/RedHat

yum install rng-tools
systemctl start rngd.service
systemctl enable rngd.service

2 urandom

If you don't have a hardware generator or you don't trust it you can edit /opt/Noodle/multiserver to use:

-Djava.security.egd=file:///dev/urandom

Or edit java.security in $JRE8/lib/security or $JRE9/conf/security to use:

securerandom.source=file:/dev/urandom

3 haveged

For higher throughput and lower CPU usage than urandom haveged can be used but it can still block:

Debian/Ubuntu

apt install haveged
systemctl start haveged.service
systemctl enable haveged.service

Fedora/RedHat

yum install haveged
systemctl start haveged.service
systemctl enable haveged.service

•

Answers to Frequently asked questions:

  • The support included in your Noodle subscription includes phone, email, and remote assistance for system administration, application usage, and troubleshooting.
  • Customization can normally be accomplished through the user interface which we help with by providing example scripts. Feature requests beyond customization cost extra valued on a per requirement basis.

Ask us more.