[sims] SIMS and active directory - logons

[mrbios]

Ok i've been reading threads from yesteryear, and what we really want I'm fairly certain can't be done, but im going to ask anyway

 

I know that i can add "ConnectionType" to trusted or trustedauto in the connect.ini to along with domain\username as someones username to enable a single sign on method of logon, but what we really want is a way of connecting the usernames in sims to active directory, taking the username and password....but still require you to type that password in order for sims to load, rather than going in via a single sign. Can this be done?

 

I've considered the terminal services route but that just doesn't work for us in my opinion, don't have the resources to have 80 concurrent instances of sims running on VMs. Not to mention i have my doubts about the performance of reports etc.

 

As much as I agree with comments in past threads talking about "why can't staff just lock their PCs" the SLT don't seem overly willing to push teachers into common sense and, somewhat understandably, don't want to lose the extra level of security they feel from being able to be logged in and having a second level of authentication to sims.

[3s-gtech]

Yup, we've done it via a .net application that checks the credentials against AD, and opens SIMS via trustedauto if they tally. Problem is, matt40k will now come along and slag us off for this again, so I'll leave it at that.

[mrbios]

Yup, we've done it via a .net application that checks the credentials against AD, and opens SIMS via trustedauto if they tally. Problem is, matt40k will now come along and slag us off for this again, so I'll leave it at that.

 

Forget him i want to know how it's done! (I don't know the back story to this)

 

Is the application easily transferred or is it something specific to your school? I'd love to try if possible.

Edited September 9, 2014 by vikpaw
language

[vikpaw]

There are some very recent threads where you can read Matt's views on the idea.

 

I think it works quite well.

 

However I much prefer an MIS that just does proper single sign on.

[3s-gtech]

Proper single sign on would be so much better, I agree, and the way ours works is pretty shakey really (a user could just create a shortcut to C:\Program Files (x86)\SIMS\SIMS .net\Pulsar.exe to bypass it) but for our staff, it gives an authentication layer where SIMS would just be open otherwise.

 

The application is currently built with our domain specific code compiled into it, but we could share the rest of the code, and you could recompile it in VS.

[mrbios]

Proper single sign on would be so much better, I agree, and the way ours works is pretty shakey really (a user could just create a shortcut to C:\Program Files (x86)\SIMS\SIMS .net\Pulsar.exe to bypass it) but for our staff, it gives an authentication layer where SIMS would just be open otherwise.

 

The application is currently built with our domain specific code compiled into it, but we could share the rest of the code, and you could recompile it in VS.

 

That'd be fantastic if you could!

 

I think even though you mention a way around it, i can think of a lot of preventative measures to stop people even being able to do that. I think the likelihood of a student knowing that path let alone knowing when to use it AND get around the preventative measures i could put in place to stop it are pretty unlikely, especially considering they first need to get past the main issue of actually getting to a staff PC (PCs with sims on we don't permit students to use anyway) with a member of staff logged on. From the sounds of things it'd be a suitable solution to our issue

 

If you're willing to share the code i'd be very grateful, will PM my email.

[vikpaw]

Can you hide pulsar from the user but run the script as a user with privilege?

I think you might find the sims drive would need to be mapped as that user too though.

There must be a way to block it somehow or at least make it harder to access.

[SovietRussia]

Here is the release - SIMSLauncher.zip

 

Contains SIMSLauncher.exe and launcher.xml - edit the XML to suit your preferences!

 

XML

Domain: put your domain (staff etc)

School Name: put your school name

Pulsar: put your path to Pulsar.exe

Force User: put this to true to force the current logged in username to pre-fill the username box.

 

Instructions

Point your SIMS.net shortcut to the SIMSLauncher.exe

Make sure the launcher.xml is in the same directory as SIMSLauncher.exe (You could put both of them in SYSVOL)

Sign in with any AD credential (it does not have to match the current logged in user - this can be changed in the code if you want me to)

If the credential is correct, it will launch the SIMSPATH value defined in the launcher.xml

 

(There is no support for this file provided by us)

 

https://www.dropbox.com/s/b9fio0vklgvh6fy/SIMSLauncher.zip?dl=0

Edited September 9, 2014 by SovietRussia

[mrbios]

That's awesome thank you, works a treat.

 

One question though: How do you manage updates with this?

I thought the path "C:\Program Files (x86)\SIMS\SIMS .net\SIMSLoad.exe" "C:\Program Files (x86)\SIMS\SIMS .net\Pulsar.exe" had to be run in order for sims to update? As far as I'm aware linking to pulsar.exe without simsload.exe at one point in the past meant sims didn't check for updates when the time came? or am i wrong in my thinking there?

[3s-gtech]

This program is designed to work with SOLUS3. We took the link to SIMLoad out because it just slows down the opening of SIMS when SIMSLoad isn't used. We'd need to change the code if you run SOLUS2.

[mrbios]

Ahh ok, sadly i am a lowly SOLUS2 user

 

I've asked our LEA for SOLUS3 multiple times over the past year after originally told it was being tested, they don't appear to be interested in making it happen though.

[SovietRussia]

If you edit the value in the launcher.xml (SIMSPATH) to SIMSLoad - then it should work as you wish it to.

 

(In theory you can put any link there, you can even link to IE and get people to put a password in before IE loads - its 100% flexible)

Edited September 9, 2014 by SovietRussia

[mrbios]

If you edit the value in the launcher.xml (SIMSPATH) to SIMSLoad - then it should work as you wish it to.

 

(In theory you can put any link there, you can even link to IE and get people to put a password in before IE loads - its 100% flexible)

 

Ah got it, directing it to simsload.exe didn't work as that wouldn't do anything (presumably that just does an update check, so without pointing to pulsar.exe it wont actually load sims) sticking my sims shortcut in the sims .net folder and directing the xml to "SIMS .net.lnk" containing simsload and pulsar works though

[vikpaw]

Sims Launcher - takes me back to teh actual SIMS launcher days

 

Can you not put the full path required as the path in teh xml file, so put simsload then the path to pulsar as a parameter all in speech marks?

this is what a regular sims shortcut does.

 

If you're solus 2, you can still use it with path to pulsar, you just need to run simsload remotely after an upgrade, or make a separate link that does simsload first .

 

edit: sorry, just realised you got it working with the link.

Edited September 9, 2014 by vikpaw

[3s-gtech]

Oh yeah, I forgot that you had to link both for Pulsar to load - been a good while since we switched. Your method is ideal in that case.

[matt40k]

There are some very recent threads where you can read Matt's views on the idea.

 

Yer, pretty much given up trying to explain to people how it's a bad idea - clearly people can't understand how bypassing Microsoft security is not a good idea. Add the fact the SIMS dumps temp data into My Docs and the users temp folder and I still wonder why re-authentication is better then Windows + L in certain peoples eyes.

 

Anyway, better go, I need to run this unsigned exe to force me to reauthenticate my Outlook so I can send an email asking why they fill I should have those annoying UAC prompts