Overview

 IWA can allow for “silent authentication” using the current users credentials.

Prerequisites

LDAP users have been successfully populated from AD; if not please refer to the AD Configuration Guide.

Quick reference

  1. setspn -U -S HTTP/%noodle.domain.tld@DOMAIN.TLD %service_account
  2. Add Noodle to "Microsoft Internet Explorer > Tools > Internet Options > Security > Local intranet > Sites > Advanced"

Supported configurations

Browsers

Microsoft Internet Explorer, Mozilla Firefox, Google Chrome
Note: Microsoft Edge does not support this feature.

Protocols

Kerberos in SPNEGO in GSS-API (RFC 2478)
Note: NTLM, and NegoExts are not supported.

Endpoints

AD, Azure, and F5
Note: Others may work but have not been tested

Server configuration

Define the appropriate SPN for the account which Noodle is using to bind to LDAP.

  • Within the AD Users and Groups snap-in Navigate to Noodle’s service (admin) account and set the follow attribute:
    1. servicePrincipalName = HTTP/%noodle_url
    2. Apply the change
  • This may also be set via command line:
    1. setspn -U -S HTTP/%noodle.domain.tld@DOMAIN.TLD %service_account
  • For Windows server 2008R2 or older command line instead use
    1. setspn -A HTTP/%noodle.domain.tld %service_account

Note:

  • Logins from the AD Kerberos Server itself are not supported because Windows will attempt NTLM.
  • For local installs, non-primary domains can be used with IWA by placing “IgnoreIWADomain = true” into intranet.conf 

Browser configuration

The next step in enabling IWA requires browser configurations to attempt authentication with the Noodle intranet website.

Once the configuration is in place users will need to access Noodle via the SPNEGO.po URL (ie. https://yourNoodle.tld/SPNEGO.po).

The following section of this guide explains this process.

Microsoft Internet Explorer & Google Chrome

Both of these browsers are configured with Microsoft Internet Explorer in "Tools > Internet Options > Security > Local intranet". 

Note:  If a non-default level is in use be sure “Automatic logon only in Intranet zone” is selected in "the Custom Level".

Next we will need to add the URL of your Noodle instance in "Sites > Advanced".

Mozilla Firefox

Enter “about:config” in the address bar, press “Enter”, and click “I Accept the Risk” when prompted.

Next, search for “auth.trusted”, enter your Noodle URL in the attribute entitled “network.negotiate-auth.trusted-uris” and select OK.

At this point IWA should be fully operational for your Noodle Intranet site!

Overview

SAML authentication can allow for Single Sign-On (SSO).  This guide outlines the steps involved for implementation of Noodle as a SAML Service Provider (SP) and offers general configuration parameters required by your SAML idP.  Noodle users are often being populated via AD; for more information on this setup please refer to the document.

Noodle Prerequisites

If Active Directory (AD) is being used, LDAP users should have already been populated within Noodle.

Supported Identity Providers (idP)

Onelogin, Okta, Azure

Note: Vialect will provide best effort support to integrate with other idP solutions.

Noodle Configuration & Access

Once navigating to the SAML configuration section in Noodle (via “System Tools > Settings > Single Sign-On”), your Noodle instance will require only two pieces of information about your SAML idP:

Note:  Both of these items (post URL & SHA1 fingerprint) will be supplied by your idP vendor.

Essentially, your idP will provide an XML file which contains input for both of the required fields mentioned above.  However, the certificate sometimes is in the incorrect format and may need to be converted into a SHA-1 Fingerprint.

There are some online SAML tools that may prove helpful in order to calculate the SHA-1 fingerprint:

  1. Format a X.509 Certificate - Convert the certificate into a suitable format
  2. Calculate Fingerprint - Use the formatted certificate to calculate a fingerprint
Optional: For non-managed users there is also an option to save the account details within the browser itself, by enabling "Noodle > System Tools > Settings > User Settings > Remember my login information".  The user will be asked to login again if they ever actually click the “Logout” link within Noodle.

Once this information has been saved in Noodle you are ready to move onto configuring the idP with the necessary information about the SP, Noodle.

Defining a Service Provider with your idP

The primary information that your idP will be looking for is how to construct the SAML Response and where to send it once the idP has successfully verified the SAML Request.  

As mentioned earlier in this document the URL for sending a SAML response is http://yourNoodle.tld/SAML.po which will be defined as a Web App if asked.

There are several other parameters that may required when defining how your idP will construct the SAML response being sent to Noodle.

  • urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
  • urn:oasis:names:tc:SAML:2.0:nameid-format:encrypted
  • urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

For further information, please refer to your idP’s documentation or contact techsupport@vialect.com.

GDPR checklist;

Local

  • We hold payment information optionally provided by clients, and share it with no one. we use it to charge for our software service.
  • We hold at least one pice of contact information to update payment information.
  • Data is stored on our accounting computer
  • This is our publicly accessible policy
  • We have a DPO
  • Our staff and management is aware of this document
  • We use modern and up to date security.
  • We appoint clients as there own representatives in the EU
  • If ever we become aware of a personal data breach our customers and local authorities will be made aware.
  • customers can verify and update information by simply asking.
  • We review this policy annually or as required.
  • We understand when DPIA is required

Hosted

  • Data is stored-in / removed-from a location of the clients request.

  1. Create a drive key and secret
  2. Put them in "System Tools > Settings > General > Google Drive OAuth"
    1. Note that OAuth requires your Noodle server to be accessed via a public domain
  3. Enable in the "Administration > Properties" of the folder you want to connect.
  4. View the folder and follow the prompts.

Vialect Bug Bounty;

  1. Contact us and let us know you are interested
  2. We will send you an installer or an IP address
  3. Qualification
    • Confine aggressive/damaging testing to the installer/IP we provide
    • Keep your findings confidential until we fix the bug (same day we hope)
    • We pay whenever we make a change as a result of your bug report.
  4. Send us a report with enough information for us to reproduce the bug
  5. We will reward you (You will not be prosecuted)
    • Public credit and thanks
    • Payment (varies by severity of the bug from $1 to $1000 per bug)

postgresql.conf ships with quite modest defaults so be sure to august it for anything more than light use. We recommend for ~4k users;

  • Available Memory = System Memory - OS (1GB for Windows) - Java (100 to 512)
  • effective_cache_size = Available Memory / 2
  • shared_buffers  = effective_cache_size / 4
  • max_locks_per_transaction = 512
  • max_connections =  60
  • checkpoint_segments 30
  • log_min_duration_statement = 10000
  • log_line_prefix =  ''%m: ''

There is a convenient config creator here.

When something unexpected happens Noodle will ask you what you were doing and email a stack trace to Vialect. Bug reports may also be sent to techsupport@vialect.com. Please use saleshelp@vialect.com for any other inquiries.

Please provide the following to help us reproduce and correct issues faster:

  • Minimal steps to reproduce the issue from scratch. Possibly relevant details:
    • The URL
    • The version of Noodle
    • The version of Web Browser
    • The version of Operating System
    • A username and password
    • An ordered list of buttons/links clicked
    • Sample file/data
  • Expected behavior, possible details:
    • 720p mockup of desired appearance with min and max sample data.
  • Actual behavior, possible details:
    • A full resolution screen shot including address and scroll bars
    • Web Browser console output
    • The source of any warning pages (wrong format, missing parameter)
    • The source of any email
    • A zip of the Noodle/log folder
  • Observe email educate
    • A short descriptive email subject
    • Reply to the email thread only for the the same issue
    • Don't make new threads for the same issue.
    • Avoid requesting thread history review.
    • Do not place legal or print notes in signatures or otherwise bloat them.
    • Use test in favor of images
    • Use attachments not overlays/embeds of images or text
    • Be concise.

Leaving out information leads to Vialect spending less time creating solutions and more time attempting to reproduce issues and linking to this page.

 

The first encrypted request after starting Noodle can be 3 orders of magnitude slower than normal due to random entropy pool depletion. If your server suffers from this issue (most EC2 servers) you can verify by checking the pool size:

cd /proc/sys/kernel/random/ && cat poolsize entropy_avail

There are at least 3 solutions to a depleted pool:


1 Hardware

Some hardware includes random generators (like the rdrand CPU flag):

cat /proc/cpuinfo | grep -i rdrand | wc -l

You can enable its use with:

Debian/Ubuntu

apt install rng-tools
systemctl start rng-tools.service
systemctl enable rng-tools.service

Fedora/RedHat

yum install rng-tools
systemctl start rngd.service
systemctl enable rngd.service

2 urandom

If you don't have a hardware generator or you don't trust it you can edit /opt/Noodle/multiserver to use:

-Djava.security.egd=file:///dev/urandom

Or edit java.security in $JRE8/lib/security or $JRE9/conf/security to use:

securerandom.source=file:/dev/urandom

3 haveged

For higher throughput and lower CPU usage than urandom haveged can be used but it can still block:

Debian/Ubuntu

apt install haveged
systemctl start haveged.service
systemctl enable haveged.service

Fedora/RedHat

yum install haveged
systemctl start haveged.service
systemctl enable haveged.service