IT Lesson

Editors note: This is a guest post by Thomas Gerber. Thomas is the CTO of Altirnao, the developer of the AODocs document management app on the Google Apps Marketplace. Thomas tells the story of his application and provides some tips for developers considering integrating with Google Apps and launching on the Marketplace. — Arun Nagarajan


Google Drive is increasingly popular in the enterprise, and many organizations would like to leverage it as a replacement for their existing on-premises file servers. Moving physical file servers to Drive provides many benefits, such as reliability, cost-effectiveness and the ability to access the files from anywhere and any device. However, the storage structure of Google Drive, where files are owned by many different users, is significantly different from the centralized organization of a file server, where everything is under the control of a small number of system administrators.

To address this problem, AODocs uses the Google Drive API to automatically transfer the ownership of files to a system account, and thus create a sort of “managed area” within Google Drive. With the Google Drive API, AODocs has complete control over the folder structure and the permissions of files owned by this system account. AODocs can be deployed in one click from the Google Apps Marketplace, which makes our application visible (and easy to try out!) for every Google Apps administrator in the world.



Companies who want to store their files on Google Drive may be concerned about losing control of their data (e.g. access to files being lost when an employee leaves the company) and controlling sharing permissions.

AODocs uses a single system account (i.e. a Google Apps account belonging to the customer’s domain, but not used by any human person) as a “proxy” to control the files. When a Google Drive files is added to an AODocs library, the ownership of the file is transferred to the AODocs system account and the file’s writersCanShare attribute is set to false, so that only AODocs is able to modify the file’s permissions afterwards.

To change the ownership of the file, we check if the system account can already access the file, and then either insert a new “owner” permission on it or use the Permissions.update method with the transferOwnership flag:

public void changeOwner(String user, String fileId, String newOwner) {
   // Find what is the current permission of the new owner on the file
   Permission newOwnerPermission = null;
   PermissionList permissionList = RetriableTask.execute(new DrivePermissionListTask(drive.permissions().list(fileId)));
   newOwnerPermission = findPermission(permissionList, newOwner);

   if (newOwnerPermission == null) {
      // New owner is not in the list, we need to insert it
      newOwnerPermission = new Permission();
      newOwnerPermission.setValue(newOwner);
      newOwnerPermission.setType("user");
      newOwnerPermission.setRole("owner");
      Drive.Permissions.Insert insert = drive.permissions().insert(fileId, newOwnerPermission);
      RetriableTask.execute(new DrivePermissionInsertTask(insert)); 
   } else {
      // New owner is already in the list, update the existing permission
      newOwnerPermission.setRole("owner");
      Drive.Permissions.Update update = drive.permissions().update(fileId, newOwnerPermission.getId(), newOwnerPermission);
      update.setTransferOwnership(true);
      RetriableTask.execute(new DrivePermissionUpdateTask(update));
   }
}

Since all the files are owned by the system account, AODocs completely controls the lifecycle of the file (how they are created, in which folder they are located, who can change their permissions, who can delete them, etc). AODocs can thus provide higher-level document management features on top of Google Drive, such as configuring the retention time of deleted files, limiting external sharing to a whitelist of “trusted external domains”, or recording an audit log of file modifications.

As illustrated in the code snippet above, AODocs relies on the Google Drive API to perform all the operations on the managed files. The main challenge we had when using the Drive API was to properly handle all the error codes returned by the API calls, and make sure we make the difference between fatal errors that should not be tried again (for example, permission denied on a file) and the temporary errors that should be re-tried later (for example, “rate limit exceeded”). To handle that, we have encapsulated all our Google Drive API calls (we are using the Java client library) into a class named RetriableTask, which is responsible for handling the non-fatal errors and automatically retry the API calls with the proper exponential back-off. Here is a simplified version:

public class RetriableTask implements Callable {
[...]
  private final Callable task;

[...]
  @Override public T call() {
     T result = null;
     try {
        startTime = System.currentTimeMillis();
        result = task.call();
     } catch (NonFatalErrorException e) {
        if (numberOfTriesLeft > 0) {
          // Wait some time, using exponential back-off in case of multiple attempts
          Thread.sleep(getWaitTime());

          // Try again
          result = call();
        } else {
          // Too many failed attempts: now this is a fatal error
          throw new RetryException();
        }
     } catch (FatalErrorException e) {
        // This one should not be retried
        Throwables.propagate(e);
     }
     return result;
  }

AODocs is designed to work seamlessly with Google Drive, and our top priority is to leverage all the integration possibilities offered by the Google APIs. We are very excited to see that new features are added very often in the Admin SDK, the Google+ API, the Drive API that will allow AODocs to provide more options to system administrators and improve the experience for our end users.

Thomas Gerber profile Thomas is the CTO of Altirnao. Before founding Altirnao, Thomas has led a team of senior technologists and architects on High Availability/High Performance implementations of enterprise software.

If you didnt attend Google I/O 2010 you can see the videos of every session on YouTube. All of the Enterprise sessions are now online. See the link at the bottom of this post. Over the next week every session from every track will be available. Check out the Google I/O site for a complete list of session abstracts and videos.

There was a big focus on developing software for businesses at Google I/O this year, centered around three themes: build and sell apps in the Marketplace, customize and extend Googles apps, and build your own apps for internal use. The news kicked off the day before Google I/O with the announcement of Gmail contextual gadgets and many enhancements for Google Apps Script, including JDBC support. Then during the keynote, we launched Google App Engine for Business and announced our collaboration with VMware, and continued with the announcement of Google Wave (Labs) availability in Google Apps and Exchange support in Android 2.2 (aka Froyo).

Altogether there were more than a dozen technical sessions focused on the enterprise and more than 20 Google Apps Marketplace vendors demoing in the Enterprise Developer Sandbox.

Here’s a recap of a few of the sessions below. You can find the videos and slides for these sessions on the linked session title:

• Scripting Google Apps for business process automation - Google’s Evin Levey showed off the latest developments from Google Apps Script, and explained how developers can use the tool to automate business processes.
  
  
• Reach new customers fast: Learn how to sell your cloud app on the Google Apps Marketplace - Google’s Scott McMullan was joined by Jay Simmons (Atlassian), Chuck Dietrich (SlideRocket) and Amit Kulkarni (Manymoon) to discuss best practices for launching an app in the Google Apps Marketplace. This session was followed by a technical overview of how developers integrate apps with the Marketplace.
  
  
• Building context-aware extensions for Gmail - Deep dive on Gmail contextual gadgets - Google recently launched Gmail contextual gadgets, allowing developers to intelligently surface their apps directly in the Gmail message UI based on the content of the message. In this session, Dan Holevoet of Google explained how to create and distribute these gadgets.
  
  
• Run corporate applications on Google App Engine? Yes we do. Google CIO Ben Fried and his team discussed how Google runs real-world business applications on App Engine, and gave practical advice on how enterprise IT developers can make App Engine work with firewalls, legacy systems and proprietary systems. We unveiled this video yesterday along with the rest of the App Engine videos, but are reiterating it here as this session is quite relevant to the enterprise.
  
  
• Making Freemium work - converting free users to paying customers - In this panel moderated by Google’s Don Dodge, venture capitalists Brad Feld, Dave McClure, Jeff Clavier, Matt Holleran and Joe Kraus discussed strategies for building free products that can be upgraded to paid versions.
  

You can also find all videos for Enterprise I/O 2010 sessions in this YouTube playlist.

We’re excited to see the great strides our enterprise developer community has made, and were looking forward to seeing even more innovation and progress at next year’s I/O. We hope to see you then!

Posted by Don Dodge, Google Apps team

Review:
Today, TeamViewer announces a new beta version of its popular remote control software for Windows, Mac and Linux PCs. The latest release, named TeamViewer 9 Beta, introduces new features aimed at businesses, developers and end-users as well as security improvements.

The most noteworthy security addition in TeamViewer 9 Beta is two-factor authentication. It allows users to add an extra layer of protection to their accounts by using security codes, that can be sent to their mobile devices and, alternatively, generated by dedicated mobile apps. On Macs, TeamViewer 9 also adds the option to increase the password strength in QuickSupport.

"TeamViewer has always been focused on remote support functionality", says the companys head of product management Kornelius Brunner. "With TeamViewer 9, we are going back to the roots and offering even better features for support teams in companies large and small".

Service Queue is a new TeamViewer 9 Beta feature aimed at IT staffs, that provides the option to assign, manage and share requests for immediate support. Users who join remote support sessions can now use a unique code, that is created specifically for that session, instead of having to exchange a username and password. The unique code can be distributed as a link.

The software adds the option to save customized customer modules with the companys branding (for Host, QuickJoin or QuickSupport) in the TeamViewer Management Console. The modules can be tailored, as needed, to a customer, group or support provider. The customers will receive the latest TeamViewer version, following any modifications.

TeamViewer 9 Beta introduces tab support. This allows users to open multiple remote control sessions and view multiple displays in a single window. Tabs can flash, indicating new activity.

Wake-on-LAN is now supported, allowing users to trigger a remote wake of the PCs they wish to control. The feature only works between devices connected to the same local network.

In TeamViewer 9 Beta users can take advantage of a univeral clipboard, which allows them to copy and paste content from their current device to a remotely-controlled one (files, folders, text and tables are supported). The formatting is carried over.

Using an FTP server, the software allows users to send files to devices and contacts without initiating remote control sessions. This offers an alternative to cloud-based storage services in such instances.

Specifically for Mac users, TeamViewer 9 Beta also adds the file box for quick sharing while using the software and the option to add a disclaimer when creating customized QuickSupport modules, which users have to accept before launching the software.

TeamViewer 9 Beta informs users of any new notifications in the Computers & Contacts area. The notifications include alerts for TeamViewer monitoring, ITBrain, new service cases, new contact requests and service cases assigned to the user. Read more