There are a lot of Enterprise Content Management systems (ECM) on the market nowadays. My company has working experience with Alfresco, EMC Documentum, IBM FileNet, Microsoft SharePoint. In this article I’d like to figure out, how exactly ECM can be useful, what problems can be expected while implementing ECM and how to cope with them.
Our experience has shown, that while choosing an ECM you have to decide first, what options in particular you need at the moment, what options you don’t need at all, and which of them you may need in the future.
We can make a conclusion that ECM should bring following:
Improve the efficiency of business process management thanks to analytical reporting system and performing tasks monitoring system.
Improve employees’ efficiency thanks to the interface adapted to the central tasks, ability to the quick information search, notifications and reminders system, task deadlines control systems, simple interaction of the employees within the work on a single document or a single business process and many other modules of modern ECM.
Improve performance discipline thanks to effective tasks performing control system.
Accounting and long-term storage of documents with the precise control of access to information.
Some reduction of employees’ working time and consumables’ costs.
All these benefits of ECM implementation can be really achieved. However you can face a couple of unexpected difficulties caused by human factor when implementing the system.
Employees reject new way of work. ECM implementation causes changes in usual working environment. Employees can feel suspicious about innovations. To neutralize the negative effect you can try to switch to the new ECM step by step. At the adjustment and testing phase it’s better to show the system to the future users and collect their opinions about the functions’ convenience or inconvenience, involving them to the system creation process. Create trust to the final product. User starts recognizing the system. The feeling of helplessness is getting replaced by the pleasant feeling of control over the system. In our experience people like to see realization of their ideas in the final product. It is though very important not to overdo it. Sometimes it is worth it to spend your time and explain how to make this or that functionality right based on the functioning experience of ECM. This approach though can misfire too. We developed ECM for a political institution, for example. During the ECM development and implementation there appeared a change in the institution management. As a result the team got completely different. New people bring new points of view. And new requirements for the system of course.
Fear of control and job rating. When ECM is implemented you get a precise control over the employees’ activities. The system estimates ratings of job quality uncompromisingly and precisely. We know an employee can be scared by the fact that if he will not be able to affect all his/her urgent tasks at the end of the day, it can have negative influence from management on his/her work. Any employee can have such fears. It is important to explain to people: this situation can display that the work flow is too high and an employee needs an assistant e.g. It is also a great opportunity for the management to notice “chokepoints” in the business process flow.
According to our experience the ECM implementation discloses problems in the document management rules of the company. Instead of the human factor presented by manager you have to deal with a cold task performance system that always operates according to its internal regulations.
In conclusion I’d like to emphasize: despite all known both evident and hidden difficulties of ECM implementation the implementation effect leads to the direct resource saving as well as to improvement in work efficiency and quality. After difficult training or retraining of employees is done ECM implementation brings higher work comfort, satisfaction with work conditions, and higher work quality. In our practice we had situations, when clients who needed only small ECM adaptation began to enjoy this way of work. They started to trust it and now they order more and more improvements.
Delegating non-core functions to professionals remains the most efficient way of managing a company. Chief Executive Officer speaks to Alexej Spas, CEO of *instinctools, about finding the right partner in the outsourcing market.
CEO and Owner at *instinctools
The media likes to talk about successful IT projects, start-ups and new technology IPOs, but are the majority of projects actually successful?
Alexej Spas: According to polls in the IT industry, only 10% of companies are getting return on investment with most of their products and actually reaching financial goals. Every day, a huge number of innovations are happening in this area, but the economic success of these is questionable. This reminds me of Titanic: it looks promising, but in the depths we discover some deadly holes
Why do you think this is?
Alexej Spas: The key here is specialization. Product launch, development and promotion are a set of complex tasks. Successful execution requires expertise in many areas – from marketing through to the product development and customer support. Not many companies have all these competencies at a sufficient level. As a result of trying to do everything on their own, companies end up drowning in the details and missing the targets. The non-core functions can, and should, be delegated to professionals who perform this function more efficiently.
Do you think it’s enough just to give non-core functions to external contractors and believe everything will be fine?
Alexej Spas: Delegating does not mean excluding yourself. My experience with companies of all sizes shows that the product or project becomes successful only with the active participation of specialists from the subject matter domain on the customer side, as well as the presence of open partnerships between the customer and supplier.
Are there any other reasons that contribute towards these failures?
Alexej Spas: Yes. One of them is slow time to market. The market for IT products is usually very competitive. We see how companies are trying hard to be the first to market with their products. But, for this, they often do not have enough of their own resources. Domestic resources are either missing or expensive. And this leads to losing market position. So, companies are looking for resources elsewhere; the latest outsourcing reports show that 50% of companies developing their IT solutions in-house reported plans to start outsourcing their IT/development in 2013–14.
Your company has a remarkably low project failure rate. How is this possible?
Alexej Spas: When working with our customers on outsourcing projects, we follow several important rules, and can recommend those for others:
Focus on what we do best. We have invested more than 14 years in improving our production processes, focusing on optimization, and now we can offer this approach to our customers.
Look for a partner that is two to three time zones away. You’ll save a lot of valuable time.
Pay attention to good reputation and references of your partner.
Search for solutions together with your partner. Explain the context of the problem. Include them as much as possible in decision making process.
Find a partner from your league, as well as one that is similar in size and possibilities.
Why is choosing a partner of similar size important?
Alexej Spas: Part of our strategy is to find clients of a similar size. In this way, we can better understand each other’s problems and easily find a common language. Overall, the results of the UK Development Survey 2012 suggest that ITO is yet to be discovered by more small to mid-sized UK organizations in the near future.
But, your list of clients includes such giants as Daimler, Fujitsu and SAP. How does this fit into your recommendation of selecting a partner of similar size?
Alexej Spas: When dealing with these companies, we work with specific departments within them. They are like a smaller company inside of the larger one. So, we solve tasks within these specific departments where our rule around size applies perfectly.
How else could you advise our readers with regard to finding outsourcing partners and avoiding getting on the Titanic?
Alexej Spas: It sounds trivial, but I want to emphasize getting offers from multiple vendors – many companies neglect this. Compare them in terms of price, depth of requirement analysis, quality and level of communication. Professional ITO companies offer the possibility of a preliminary or detailed estimation of your project, as well as running pilot projects. For example, on our company website, you can order an estimation of your project directly through an online form. By comparing estimates from different vendors, you can identify the risky parts of your project and focus on these from the start of the project.
Companies need to concentrate on their strengths, and find reliable partners that can help them get to where they need to go. In this way, you can easily benchmark your existing ITO partner. And, of course, we will be happy to be your winning ship, if you chose to step on it.
Java applets and warnings: do you want both? I’m sure you don’t.
We have extensive experience in using java applets. They really help to speed up your system significantly, still at the same time they may cause issues for the client and their users such as annoying warning messages. Actually it can be easily solved if you know how to do that.
We would like to share a piece of advice with you about how to avoid security problems with java applets. You are always welcome to leave your comments.
Problem definition:
As a WYSIWYG XML editor in our application we use java applet Oxygen Author Component. Java shouldn’t throw out any scaring warnings about dangerous code while loading this applet on the client. It should calmly and silently load this applet without stressing the user and making him take responsibility. We have a serious application after all.
How the applet works in layman’s terms
When a tag <applet> in HTML page is detected, browser passes the applet load control to the corresponding java-plug-in, that in its turn passes the control to the JRE installed on the client’s computer. There are two ways of applet loading (under applet we understand some java application, that represents a set of jars, where there is a main jar with main class implementing class Applet):
Applet’s jar files, that need to be loaded and from where they need to be loaded, are listed in the tag Applet;
With a jnlp file, where this information and a lot of other options and arguments are indicated.
In our case we use jnlp. The jnlp approach has the advantage, that if you change some applet loading parameters (e.g. codebase), you don’t have to change HTML or JavaScript code responsible for the applet loading. It’s enough to change just jnlp. Codebase change (codebase is a url address, that points, where the applet’s jars are) is quite an unpleasant problem, because you have to give the absolute URL, what means, that depending on what server the applet is launched, so has to be the codebase. On the local computer it is one address, on the QA stand the other one, in production – the third one. That’s why while assembling the application you definitely need to give the Context Path, in other words the absolute address of the web-application, where it’s going to work. Using jnlp file solves this problem in following way: there is a special servlet that on-the-fly changes the codebase to the current one when the jnlp file is loaded by the client’s java.
Let’s go
So, the applet loading begins with the jnlp file loading, there are there not only the list of necessary jar files and their codebase, but also java arguments (it is very important, I’ll tell you later why), that java has to start on the client’s computer with. Java starts loading jars and checking their safety. Here java security tool takes effect, which starts checking the loading jar, before the classes will be loaded from it. This tool is rather complicated and multisided: general safety level adjustment while loading applets and java security policy on the client (permission grants), safety parameters in the manifests of the jars, jar’s digital signature verification checking etc. I don’t want to go deep into this and I’m going to touch only the aspects, that are really important in the described task.
for information: applet signing means jar files signing. Jar signing is a performance of java-operation signjar, as a result of which in the jar the information about the key appears, that was used for signing in encrypted form. And also each resource, packed by jar, is associated with some code, encrypted by this key, that contains the information about the content of this resource. So, if you’re trying to change the signed jar giving it e.g. some class or changing the old one, such a jar is getting invalid and it’s not going to pass a security test and to be loaded.
So, the applet can be not signed, self-signed and signed by the trusted certificate. Depending on the client’s java version, where the applet loads, the signing level of the applet has an effect on whether the applet will be loaded at all or blocked, loaded with lots of warnings and messages like “If you start this applet, the global disaster comes and everything disappears, so start it on your own risk”.
It could be also loaded with a nice and not scaring message that can be not repeated in the future, if you tick it. And finally we’ve come to the task itself. At the moment of solving this problem our Oxygen applet was self-signed. It means that there was a signature. But it was fake – we made up a private key and generated a public key for it.
Of course during the loading of such an applet java expressed extreme dissatisfaction, but as the final result it loaded the applet. Actually we needed to get rid of these messages, that’s why we needed a certificate from Trusted Certificate Authority.
How do we get it? It’s easy, but not very cheap. A certificate for a year costs about $500. We used the services of www.verisign.com. You have to create a keystore with your alias and other information about the publisher (with a utility keytool) and form a special request (and pay, of course). In reply CA sent the keys. We got three of them: Code Signing certificate, intermediate CA certificate and certificate in pkcs7 format. For JKS type certificate we’re going to need intermediate and Code Signing certificate. First we add intermediate certificate into the earlier created keystore, and then – the main Code Signing certificate. Received keystore is going to be used for jar signing. If your jars were signed earlier (in my case they were self-signed), you have to delete old signatures, before signing them again. If you don’t do this, java will drown during the applet loading on the first jar and stop working. You can delete the signatures manually – delete files .RSA (or .DSA) and .SF from the folder META-INF and delete all the Digest resources’ signatures from the manifest file.
Almost forgot: before jar signing you have to add security attributes into the manifest:
Important: you are going to need antcontrib for using foreach in this script.
So, we clean jars, add necessary attributes to manifests, sign, start and… Warning again!
Again? It turns out that you have to sign not only jars, but also jnlp file. How to sign it? Like this. Jnlp file has to be put into your main jar in the directory. JNLP-INF and the file name has to be exactly APPLICATION.JNLP. so, we add into our ant script, that builds main jar and signs jars, a simple code that copies the initial jnlp into the signed jnlp.
I’ll explain what happens in this ant’s target. Everything is clear in the part one – we create directory classes and compile the code of our applet in it. Please, notice, that during the compilation a folder lib will be added into the classpath. In this folder there are a lot of jars necessary for the applet and all of them have to be signed. Then in the same place a folder JNLP-INF will be created and our initial author-component-dita.jnlp will be copied in it. Then we pack everything into the jar (this is our main jar) and put it into the folder lib to the rest of the jars.
Now we have two jnlp files: initial author-component-dita.jnlp and APPLICATION.JNLP packed into the jar. Something wrong… We start the applet – error!
What now? These jnlp files don’t match, but they have to. The initial jnlp is used for loading the applet, and the packed one is used to check the signature, they should not be different. But why are they different? They are copies! Now remember our servlet (JnlpDownloadServlet), that is used to simplify the deploy of our web application. Using it we can use the variable $$CODEBASE and don’t write into jnlp a certain codebase (e.g. localhost:8888/oxygen-editor/). The servlet changes jnlp during runtime substituting in it necessary values of variables. That’s why the jnlp to be loaded doesn’t match with the signed one. What do we have to do? It’s simple: we have to use APPLICATION-TEMPLATE.JNLP instead of APPLICATION.JNLP. Using APPLICATION-TEMPLATE.JNLP pattern has such an aspect, that it can be different from the initial jnlp, if you give “*” instead of certain parameters, for example, codebase=”*”. Let’s change the ant’s build.xml:
So, is that all? Will I see during the applet loading a long-expected user-friendly message with a blue shield saying that the applet is trusted, safe and doesn’t raise any suspicions? I’m very excited and I finally launch the application, load the applet and…
Yes! I did it! There is the message with the blue shield! Extremely happy I tick “Always trust content from this publisher”, it closes, the applet starts loading and now we get this:
What the hell – what’s insecure there again? It took me two days to find this line in jnlp file:
There are java arguments the applet starts with. Well, debug arguments are insecure. And if your applet is signed by the trusted certificate, these arguments are forbidden. It is interesting, that if your applet is self-signed, you can launch the applet with everything you want, because the client is warned, that the running application is unknown and initially dangerous.
Here is the full list of forbidden arguments:
// note: this list MUST correspond to native secure.c file
private static String[] secureVmArgs = {
"-d32", /* use 32-bit data model if available */
"-client", /* to select the "client" VM */
"-server", /* to select the "server" VM */
"-verbose", /* enable verbose output */
"-version", /* print product version and exit */
"-showversion", /* print product version and continue */
"-help", /* print this help message */
"-X", /* print help on non-standard options */
"-ea", /* enable assertions */
"-enableassertions", /* enable assertions */
"-da", /* disable assertions */
"-disableassertions", /* disable assertions */
"-esa", /* enable system assertions */
"-enablesystemassertions", /* enable system assertions */
"-dsa", /* disable system assertione */
"-disablesystemassertions", /* disable system assertione */
"-Xmixed", /* mixed mode execution (default) */
"-Xint", /* interpreted mode execution only */
"-Xnoclassgc", /* disable class garbage collection */
"-Xincgc", /* enable incremental gc. */
"-Xbatch", /* disable background compilation */
"-Xprof", /* output cpu profiling data */
"-Xdebug", /* enable remote debugging */
"-Xfuture", /* enable strictest checks */
"-Xrs", /* reduce use of OS signals */
"-XX:+ForceTimeHighResolution", /* use high resolution timer */
"-XX:-ForceTimeHighResolution", /* use low resolution (default) */
"-XX:+PrintGCDetails", /* Gives some details about the GCs */
"-XX:+PrintGCTimeStamps", /* Prints GCs times happen to the start of the application */
"-XX:+PrintHeapAtGC", /* Prints detailed GC info including heap occupancy */
"-XX:PrintCMSStatistics", /* If > 0, Print statistics about the concurrent collections */
"-XX:+PrintTenuringDistribution", /* Gives the aging distribution of the allocated objects */
"-XX:+TraceClassUnloading", /* Display classes as they are unloaded */
"-XX:SurvivorRatio", /* Sets the ratio of the survivor spaces */
"-XX:MaxTenuringThreshol", /* Determines how much the objects may age */
"-XX:CMSMarkStackSize",
"-XX:CMSMarkStackSizeMax",
"-XX:+CMSClassUnloadingEnabled",/* It needs to be combined with -XX:+CMSPermGenSweepingEnabled */
"-XX:+CMSIncrementalMode", /* Enables the incremental mode */
"-XX:CMSIncrementalDutyCycleMin", /* The percentage which is the lower bound on the duty cycle */
"-XX:+CMSIncrementalPacing", /* Automatic adjustment of the incremental mode duty cycle */
"-XX:CMSInitiatingOccupancyFraction", /* Sets the threshold percentage of the used heap */
"-XX:+UseConcMarkSweepGC", /* Turns on concurrent garbage collection */
"-XX:-ParallelRefProcEnabled",
"-XX:ParallelGCThreads", /* Sets the number of parallel GC threads */
"-XX:ParallelCMSThreads",
"-XX:+DisableExplicitGC", /* Disable calls to System.gc() */
"-XX:+UseCompressedOops", /* Enables compressed references in 64-bit JVMs */
"-XX:+UseG1GC",
"-XX:GCPauseIntervalMillis",
"-XX:MaxGCPauseMillis" /* A hint to the virtual machine to pause times */
};
Thank you for attention. I hope, the article will be helpful.
Do you know another ways of realisation of this task?
AI modified real photo
Anna Vasilevskaya
Account Executive
Get in touch
Drop us a line about your project at [email protected] or via the contact form below, and we will contact you soon.
By continuing to use the site, you agree to the use of cookies
