1. ORIS Portal Evaluation Demonstration Paul Prestin Office of Research Information Services

2. ORIS Objectives Identify ease of implementation for basic client side technologies (html, javascript, css) Identify extent of built in support for AJAX and RIA abilities Establish if external (Cross Domain) sources can be utilized fr “Mashup” abilities

3. ORIS Basic Tests Achieved Have Javascript? Have ability to write to the screen? Have built in Javascript library (jQuery)? Can load external script Can call functions within external script Can request to external service (GET request) Ability to receive response from external service

4. ORIS Limitations Experienced Neither Portal does an equivalent form of content sanitation –uPortal was most flexible in it’s sanitation. Allowing for two alternate forms. Full or None. –Liferay defaults to an auto cleansing and is a poor implementation. Issue where <CDATA tag was not detected and a duplicate will be injected. Breaking the script. –Liferay also auto minimizes all inline JavaScript Makes for a difficult debugging at times Benefit being speedy by default!

5. ORIS Limitations Experienced (Cont.) Could not figure out a way to do a postback/response back through the originating server. May require specialized portlet or additional research Could not figure out how to do a client cert (x509) attachment for service authentication Would require specialized portlet for secured services Built in support within jQuery library for cross domain unsecured service calls done through JSONP (JSON with Padding). Required Service Modification to support JSONP Essentially a callback parameter is specified within the GET request. The service would use this parameter to “wrap” the json in a method call ….callback( { json } ). The client would then auto evaluate based on the response being received and by calling the callback function.

6. ORIS Limitations Experienced (Cont.) HTML or XHTML Cross Domain requests are unsupported by default (browser cross domain sandboxing). JSONP or Script delivery is required. –With a proxy on the originating server (Portal) handling requests and responses between the client and the content server HTML/XHTML services “should” be workable. (Did not get evaluated due to time constraints and possibility of need for portlet via java integration)

7. ORIS Evaluated Functionality (1)Client Request to Portal (2)Portal to Content Server Request (3)Content Server to Portal Response (4)Portal to Client Response (5)Client Script/JSONP call to cross domain Content Server (6)Script/JSONP response to Client Poor Security Configuration Fine For Insecure Content

8. ORIS Most Ideal Scenario (Un-Evaluated) (1)Client Request to Portal (2)Portal to Content Server Request (x509 attached) (3)Content Server to Portal Response (TLS/SSL Secured) (4)Portal to Client Response (5)Client XmlHTTP request to Portal (6)Portal proxied request to Content Server (x509, TLS/SSL (7)Content Server response to Portal (8)Portal XML/HTML/XHTML/JSON/SCRIPT response to client Optimal Security Configuration

9. ORIS Demo uPortal LifeRay