In-Cider Knowledge: Group Policy Firefox Extension

Group Policy Extension query

Thu, 02 Aug 2007 22:38:13 GMT

Someone contacted me to ask me a question about how to use the Group Policy extension to set a proxy url for their organisation. Because of the odd way this whole spaces thing is set up, I couldn't reply to his message! Anyway, worth posting for everyone who has been trying it to see how its done.

If you download the Group Policy Extension zip, you will see an example ADM template. Install the extension (better to install to %ProgramFiles%\Mozilla Firefox\extensions and not the user's profile) and apply the admin template to your local group policy and set the home page to whatever and you should see it sets and locks that.

For the proxy, you need to set 2 preferences: network.proxy.autoconfig_url and network.proxy.type. The first is obviously the url of your proxy and the second is type, which you want to set to 2 (set it in the Administrative Template as a string, not a DWORD). You need to set both to get them to work. So, just add those entries to the Admin Template in the same way as the browser.startup.homepage entry and it should be good to go.

Anyway, an ADM template to do this will look like:

CLASS MACHINE

CATEGORY "Mozilla Firefox Group Policy Settings"

KEYNAME "Software\Policies\ADM\Firefox\Locked"

POLICY "General Settings"
PART "Homepage" EDITTEXT REQUIRED
VALUENAME browser.startup.homepage
END PART
END POLICY

POLICY "Proxy"
PART "Type (set 2 for autoconfig)" EDITTEXT REQUIRED
VALUENAME network.proxy.type
END PART
PART "autoconfig url" EDITTEXT REQUIRED
VALUENAME network.proxy.autoconfig_url
END PART
END POLICY

END CATEGORY

You can tidy it up and make it a lot more "user friendly"!

If anyone has any questions about this or anything else Firefox Group Policy related, feel free to contact me at the address to the left of the page: mark(dot)sammons(at)ed(dot)ac(dot)uk (replace the dots and ats obviously!)

No re-extension for Firefox 1.5

Sun, 24 Jun 2007 20:39:47 GMT

On the 5th June, I brought up the possibility that Firefox 1.5 was going to be re-extended, with the sighting of a Firefox 1.5.0.13 on Mozilla's FTP site. Well, it now seems that this is not going to come to fruition and Firefox 1.5.0.12 is actually the final release in the Firefox 1.5.* family.

Interestingly, Firefox 1.5's close relation, Thunderbird 1.5 will carry on being supported until October 18th because Thunderbird 1.5 wasn't released until April 18th, so there is likely to be a Thunderbird 1.5.0.13 and possibly more. Seeing as both Thunderbird 1.5 and Firefox 1.5 have the same layour engine underneath (Gecko 1.8), I wonder if many of the fixes they'll release for Thunderbird between now and then could actually have been easily rolled into Firefox updates? Obviously, there's a simplistic edge to that - the testing and build QA would have taken time. However, it shows that the current Mozilla policy of supporting versions for only 6 months after newer versions are released is not ideal and is quite easily picked apart.

Now, this is something that I have moaned on and on about on this blog for some time. I am not the only one to, though. Mike Kaply, who has been doing some sterling work in enterprise deployment tools for Firefox, especially the CCK Add-on, has been blogging a bit recently about Firefox and the enterprise. Read more here: http://www.kaply.com/weblog/. Mike was also a great help to me when I was doing the Firefox Group Policy extension (although it should be an add-on, now, I guess, seeing as the nomenclature for extensions has changed!).

It seems both myself and Mike have had very similar experiences when dealing with others and corporate deployment of Firefox and have come to similar conclusions. I also read he is forming an Enterprise Working Group for Firefox, so possibly a new hope there for Firefox in the enterprise. Can but hope, even if I have seen this flase dawn all too many times before...

Defaulting

Wed, 23 May 2007 22:12:27 GMT

A user of the Group Policy Firefox Extension managed to find a cunning problem with it last week. Damn!

Unfortunately, the "set as default" functionality has a small flaw. Well, actually, its a huge flaw for those setting boolean values. The problem is, with boolean, if Firefox's default for a value is "TRUE" and you use the extension to set the value to "FALSE", if the user sets the value back to "TRUE", the next time Firefox runs it looks at the value and thinks, "the user hasn't set that value, so I'll set it to the default the extension says". So, it'll constantly be set to "FALSE" on every run (hope you understood that!).

I am looking into this. Things are pretty hectic for me because I have finally bought my first flat and am in the process of moving. However, I'll try and find a late night to crack this one.

Firefox 1.5 and the Stay of Execution

Fri, 04 May 2007 20:26:16 GMT

As I suggested here, it looked as if Mozilla would budge on their plans to kill Firefox 1.5 on the 24th April. They certainly left it late to change their mind - that happened on no less than the 24th April, the day it was meant to be killed. Talk about a last minute stay of execution!

As I suggested before, Firefox 1.5.0.12 is still in the works and supported for Firefox 1.5 will end once that has been released. According to Mozilla's schedules, the release of that is scheduled for May 22nd, so a few weeks before the reaper comes along to finish it off.

Be warned though, after that, Mozilla will use their automatic update mechanisms to move people forcibly from Firefox 1.5 to 2.0. If you don't want that, make sure your users aren't getting automatic updates.

Firefox Group Policy Extension - Fixed in 2.0.0.3/1.5.0.11?

Mon, 26 Mar 2007 21:32:04 GMT

I was, obviously, extremely concerned about the group policy extension falling over spectacularly after the last releases of Firefox. It was, in a weird way, something I always expected to happen, eventually - the extension, because it manipulates preferences in Firefox at the loading stages of Firefox, is always going to be susceptible to race conditions because Firefox loads preferences at the same time. If changes happen to the ordering or mode of Firefox loading preferences (for example, if it started to load the default prefs for Firefox after, as opposed to before it processed extensions), it could render the extension useless.

The problems were not the only issues with Firefox 2.0.0.2 and Firefox 1.5.0.10 and the 2.0.0.3 and 1.5.0.11 releases have, thankfully, been hurried out. As far as I can tell, these eliminate these issues, although contact me at mark.sammons(at)ed.ac.uk if you find otherwise.

I am still looking at the extension to see if there are any way of mitigating this. However, to a large extent, I just have to trust that Mozilla will not break this functionality on a more permanent basis.

A Different Take On Firefox Enterprise Customisation

Tue, 20 Mar 2007 21:55:26 GMT

Mike Kaply, who provided invaluable advice to me in the early days of doing the Firefox Group Policy Extension, is doing a very interesting guide to Firefox and customising it for the Enterprise over at his blog:

http://www.kaply.com/weblog/category/enterprise/

Its very interesting comparing what Mike is doing with this, his work at IBM and his work on the Client Customisation Kit (CCK) and the stuff I am doing as well as Frontmotion, Sandusky and others.

I had always hoped to investigate the CCK further and even see if I could contribute (there was a third party who did a lot of this work in bugzilla call, #337679) but time and all that jazz. Anyway, Mike is a lot more knowledgeable in Firefox and Enterprise stuff, so it should be an interesting read.

Firefox Group Policy Extension Issue - Race Condition

Tue, 20 Mar 2007 21:34:15 GMT

Many thanks to Mikko, who discovered that the Firefox Group Policy Extension is currently suffering from an annoying bug.

The bug seems to have been introduced with Firefox 1.5.0.10 and Firefox 2.0.0.2 and introduces a race condition into the browser for users after upgrade from a previous version, or when using an existing profile. The bug effectively causes the extension to fail to run to completion. These seem to have been quite buggy releases of Firefox, disappointingly, but I'll blog about that another time.

I'm currently testing a fix so hope to get this released within the next couple of days.

Deploying Small Things (config files, firefox extensions, etc)

Wed, 31 Jan 2007 21:07:32 GMT

I got a recent comment on this blog asking about how to deploy the Firefox Group Policy extension through the use of start up scripts. I far better, and easier to manage, way is to use MSI. This begs the question, how do you turn an extension into an MSI?

For this, we need WiX, something I looked at back in the summer (when I had a rather over-ambitious idea that I would be able to keep up with Mozilla Corp. by producing WiX scripts for Firefox). The reason why WiX is particularly good in the instance of deploying a small number of files is it makes the scripts really quick, easy to write, easy to follow and easy to debug!

So, to Firefox Group Policy extension, how to convert this into an MSI. Firstly, place the XPI in the Firefox extensions folder in Program Files\Mozilla Firefox and load Firefox. When it asks you to install it, it will break open the XPI into its parts. It is this post-install state that you need to replicate in your WiX script.

For this extension it breaks down into a folder called "{ea0a9200-c3f7-11d9-9669-0800200c9a66}". Inside the folder are 2 files, install.rdf and chrome.manifest. There is also a folder called chrome, which contains a single file, admxpi.jar.

So, the WiX script is pretty small and simple. Download: http://homepages.ed.ac.uk/mcs/admxpi.wxs

If you then follow the instructions as per a previous entry on this blog: http://in-cider.spaces.live.com/blog/cns!1F17474AB1F2CE52!361.entry

You can turn it into an MSI like here: http://homepages.ed.ac.uk/mcs/admxpi.msi

If you use the MSI, please test it works in your environment first. Feel free to email me with any questions regarding it: mark.sammons(at)ed.ac.uk. It doesn't have any GUI options, so if you need to change the paths, you'll have to edit the WiX script and do the candle and light stages to generate the MSI (be careful when using system paths like Program Files or Windows - you need to use the proper naming...see: http://msdn2.microsoft.com/en-us/library/aa372057.aspx)

Shouldn't I Be Partying?

Sun, 31 Dec 2006 20:07:54 GMT

Well, yes.

But...as promised:

A new 2.0.0.1 and beyond compatible version of the Firefox Group Policy Extension:

http://homepages.ed.ac.uk/mcs/GPOforFirefox_311206.zip

Now, I'm off to have a few drinks in a wild, windy and wet Edinburgh.

Happy New Year everyone...

A Very Firefox Hole-y Christmas

Fri, 29 Dec 2006 13:34:50 GMT

I hope everyone is having a good Christmas and awaiting a Happy New Year.

Apologies for not blogging recently, but this has been a hectic December only broken up by the amount of holiday I have had to try and use up.

Firstly, apologies for anyone who is using the Firefox Group Policy extension who has upgraded to Firefox 2.0.0.1 and found the extension doesn’t work. I do have a fix but unfortunately, I haven’t been able to upload a newer version which does work to the ftp server.

I’ve had a go several times in the past year about things that Mozilla need to do before their applications are seriously “enterprise ready”. However, I never thought I would have to suggest to them that the week before Christmas is really not the time to be releasing security fixes – even if people are around (I haven’t been), then updating their machines, especially in an enterprise with tens of thousands of machines, is not really practical that week. To be honest, looking at the security fixes, it could have waited until the first week in January.

For instance, look at Frontmotion, they haven’t updated their 1.5.x since 1.5.0.7 and only 2.0 is released. This goes back to something I said earlier in the year about relying on third parties for installers, tools and patches – these third parties, including myself, do go on holiday and that could leave your machines at risk. It’s a risk that Mozilla should not be allowing people to take, or at least not recommending.

Anyway, I hope to upload the newest 2.0.0.1 compliant version of the Group Policy extension tomorrow (30th December) so anyone unlucky enough to be working can apply it. Thanks to Christophe for notifying me of this issue…

Firefox Group Policy Extension - New Release, Real Defaults

Wed, 15 Nov 2006 20:17:18 GMT

I've updated my Firefox Group Policy extension (known by a variety of names from GPO for Firefox extension, ADMXPI and Firefox Group Policy extension, but probably from now on just as Firefox Group Policy extension).

It can be downloaded here: http://homepages.ed.ac.uk/mcs/GPOforFirefox2_151106.zip

So, for those who haven't been following this thing, how this works is that it installs as a normal extension in Firefox 1.5 and above and allows you to set any preference in either a default or locked state, and also on a per-computer or per-user basis.

It does this by defining 4 areas in the registry: HKCU\Software\Policies\ADM\Firefox, HKLM\Software\Policies\ADM\Firefox, HKCU\Software\Policies\ADM\Firefox\Locked and HKLM\Software\Policies\ADM\Firefox\Locked. These 4 areas represent set but don't lock on a per-user basis, set and don't lock on a per-computer basis, set and lock on a per-user basis and set and lock on a per-computer basis respectively. Also, if you set the same value in 2 areas, they will override in this order.

So, for example, let's say you want to set a default for Firefox's homepage for a certain set of users to YouTube, you would create a key here, like so:

set this key: HKCU\Software\Policies\ADM\Firefox, value: browser.startup.homepage, data: http://www.youtube.com

But let's say on a certain lab computers you want the homepage locked to your intranet page, like so:

set this key: HKLM\Software\Policies\ADM\Firefox\Locked, value: browser.startup.homepage, data: http://www.our-intranet.co.uk

The intranet page would be applied for those users on these computers despite having a per-user setting as well. Obviously, the point is not to set these registry values directly, but to use an Administrative Template for group policy to do it. An example ADM template is included in the download package.

Now, importantly, this new version changes some functionality. Previously, the "set and don't lock" functionality used to override values in the user's prefs.js file. I have changed the functionality so now it is equivilant to "set a default value for" any pref defined at HKLM\Software\Policies\ADM\Firefox and HKCU\Software\Policies\ADM\Firefox. If a user already has a user-defined value for that preference in their prefs.js file, it WILL NOT override. Locked values will continue to override as ever.

This is how I always intended this extension to work - giving administrators the functionality to set and lock values, and also configure a default environment for users/computers where they don't necessarily want to enforce anything. This is useful in a University for example, where you could see the difference between the two being how Firefox is configured on a lab machine where you want values locked and on a Staff desktop where you don't want to lock the user down.

I haven't done a huge amount of testing with this to date, so please test it thoroughly before deploying it in your environment.

GPO Extension for Firefox 2.0

Wed, 06 Sep 2006 23:14:44 GMT

Not much more to say than what the subject line says. I've updated the my Group Policy for Firefox extension so it is compatible with Firefox 2.0 (well, tested on the current latest release of Firefox 2.0 Beta 2).

Download here: http://homepages.ed.ac.uk/mcs/GPOforFirefox2.zip

This is the first time I have looked at Firefox 2, and am concered to see a Disable button for Add-ons. Need to check if this will disable a mandatory extension like this one is meant to be. If it does, I'll either have to find a workaround or badger some of the guys in the Firefox dev community (and put it in bugzilla).

Another Firefox Enterprise Project...

Sun, 13 Aug 2006 22:14:26 GMT

Recently, I've been talking with a guy called Anthony who has a load of ideas about Firefox enterprise and has started his own Firefox Corporate Project.

More details can be found here: http://www.sanduskycomputers.com/downloads/fxcorp/

I like a lot of his ideas and he's gotten a very complete system going there including MSI creation ability, ADM templates (based on my Group Policy Firefox extension, as you'll tell from the templates), branding and all sorts of things. Good stuff, and I hope a lot of his work can be fed into the official work on this, because I don't know if it helps that there are numerous projects ongoing. I have punted this area around before between people, but I'd love to get together some sort of task force to try and see what can be taken from all the various projects and pushed into the direction for Firefox itself to go. Unfortunately, I don't think Mozilla are open to that sort of thing - for an open source project, development isn't half a closed club!

Talking of the Group Policy Firefox extension, its also at the heart of some work that has been done on Mike Kaply's excellent CCK project. I'm the first to admit that it maybe hasn't had the take up in businesses that FirefoxADM had (that I know of), but in a way its had a more important raison d'etre in that it has pushed group policy support in Firefox via different projects and hopefully its core code and ideas will be at the heart of official support in Firefox.

What I will do, though, is make an MSI using WiX for the extension so people can deploy it far easier