Ok, I hope you are able to listen, you are able to hear me right, please type in your names, good morning, I hope it is not too early for you guys, good morning, we are waiting for others to join in, in case you know someone who might be sleeping and waiting for your call, just quickly call them up, if you think that will work, good morning, good morning, till where we have done weights chapter, we have done standing way right, that just the Doppler effect is left, isn't it? Ok, so Doppler's effect and weights are there, so I will be taking that up when we will meet once later on, because some of you were not there in the last class on waves, so we will start with ray optics, ok, so we will come back to whatever is the leftover portion of the waves, ok, so we will talk about beats and Doppler's effect later on, right now since it is a live session and it is getting recorded as well, so let us start a fresh chapter itself, so that it is more meaningful when it gets recorded, ok, good morning, yeah Bharat, we have that for Kmon, so today I thought of starting ray optics, we will be meeting once before Kmon, if not possible meeting once, then we can have a live session again, just for that those small topics we will have a quick session on it, ok, good morning, so I think we have a good enough presence now in terms of attendance, we can start, right, let us start this chapter ray optics, so today we thought of starting this chapter ray optics, ok, this was a topic in class 12th, but fortunately and unfortunately it is put in class 11th, it is good for you in class 12th because now your syllabus will get over very quickly, ok, and you will have ample amount of time to take mock test in class 12th, but in class 11th the load has increased, you are able to hear me, you are able to hear me, right, ok, so the ray optics is nothing but it is a study of light, ok, now when people have started studying about the light, the first one to study the light properly or systematically was of course Isaac Newton, ok, so Isaac Newton was, Isaac Newton was fascinated with the idea of everything being a particle, ok, because he has already developed mechanics, ok, in mechanics we deal with masses and everything behaves like a particle and it moves with some velocity, it has certain momentum, ok, and there is a fixed path and every moment you will be able to pinpoint, ok, wherever the particle is, suppose the mass moves over here, so you will know exactly the location of particle, you know its velocity, its acceleration, so this is how the notion of particle is, ok, so Newton considered the light also as something which is having the similar behavior, ok, so he thought of light made up of very, very small particles and they move just like another mass moves, ok, and when they encounter an obstacle it will bounce off elastically, ok, so it is like elastic collision, so this is how Newton was developing the entire branch of study of light, ok, so you know in the meanwhile there were couple of scientists like Huygens was one of the prominent names, so he came up with the idea of, you know, light is not a particle, he used to say that, ok, light is a wave, ok, now what is a wave, so a wave is like, you know, when you throw a stone in water, you see water ripples, right, so it is all over, right, the wave is all over, you cannot pinpoint that, ok, this is a wave, you cannot say, ok, this point is a wave, so wave is a distribution of energy which travels, ok, so you cannot exactly pinpoint the location of a wave, so that is where fundamentally the idea of wave is different from the idea of particle, fine, so there was of course during that time Newton was very, very prominent figure and because of that the idea of light being wave was not getting momentum, as in it is like somebody saying I said Newton that no you are wrong, light can be a wave, ok, but then of course there were certain experiments which these guys devised like Huygens and others who were developing the notion that light can be a wave, so they devised some experiment, but then Newton always used to come back and say that, ok, fine, these are the observation which you have found out assuming light is a wave, but then same observation can be explained by assuming light is a particle and here is the reasoning behind it, ok, so every time there was this claim that light is a wave Newton used to explain everything using the fundamentals of light being a particle, so long, long time it was very prominently accepted that light is a ray, it is not a wave, ok, but then there was this experiment which destroyed the complete notion of that light can be a ray only, which is Young's double slit experiment which is interference and there was this diffraction also, so Young's double slit experiment came first, so he just clearly, I mean we will talk about the Young's double slit experiment in class 12, but just I am giving you a flavor of how these ideas were developing, so that particular experiment cannot be explained by, you know, the fact that light can be a particle, ok, so I will just give you a small glimpse of what Young's double slit experiment is, that particular thing will come up in class 12 when you will talk about the Young's double slit experiment in a wave optics chapter, but I will just tell you a small this thing, intro of Young's double slit experiment, ok, so in Young's double slit experiment you have two slits from which light can come in, ok, so if light is a particle then the particle will enter from here and light as a particle will enter from there, ok, so you should see that there should be a bright spot over here, light will go straight if it is a particle, ok, and will go straight if light is a particle and will hit here as a bright spot and this one, the middle one should be the darkest spot, isn't it, but then what was found was completely different, this thing which was expected to be a dark spot happens to be the brightest spot, ok, so if light is a particle it is like you are you are throwing a ball from here, so it should strike here, how come the ball is coming over here, ok, so that Newton could not explain and but then this can be very well explained by assuming light is a, you know, light is a wave, ok, but later on of course quantum physics came in and they have their own reasoning of how the white bright spot is forming in between, so will not get into all that, but I hope you are appreciating the fact that you cannot explain the behavior of light by assuming it to be a wave or assuming it to be a particle because there are certain experiment which could only be explained by assuming light is a particle, ok, so what do you think light is, what is the proper definition of light, can anyone type in, what is the proper definition of light, ok, that crying thing is my daughter, the voice you are hearing is my daughter's voice, what is light, Bharat came up with a technical definition, sensational definition, right, see the thing is, yes, yes, like all of you are correct, you know, there is nothing wrong in whatever you are saying, alright, so for a layman, if you want to explain to a layman what is a light, you will just say that, you know, light is something which will help you to see, if light is not present, you will not be able to see, ok, if light is not present, you will not be able to see, so the idea is that we are studying light, we are studying light, write down, we are, I will take time to start the chapter, ok, I will spend half an hour just talking about why it is useful, so we are studying light because there is a spectrum of wavelength 400 to 700 nanometer of em wave can be used to see something, to see something, ok, now why seeing something is very important in physics, why can't this chapter be a biology chapter, you know, there are two parts of it, ok, one is what happens inside the IE and exactly how the transmission of, you know, some sense get developed and goes inside the brain and how you see it, that part is taken by the biology, ok, but in physics you know that observation is the key part, observation is the key part in physics, ok, because if observation is not there, physics is just a philosophy, it doesn't remain factual, so if observation is key part, of course, the touch, the smell, the sense of vision and how you hear, these things are very important, right, and more so in physics, it is about what you hear and what you see, ok, when we talk about how we hear, we have to study sound waves, so that we have already done, in fact the study of sound can be utilized for many other purposes, we are not getting into that, but the light is, the sense of vision is extremely important for us to observe anything, ok, and we as, we human beings are blessed with capability that we can use these EM waves which is between 400 nanometer to 700 nanometer wavelength to see a particular object, ok, and how we see that, how we see the object, what is the process, how do we see, anyone quickly talk about it, how do we see, I mean it is fine that you need a light, but what is the exact process of seeing an object, ok, light reflects off from the object, we are not getting into what happens once the light enters the eye, ok, retina and all we will be doing later on, photons reflect off an object and enters our eyes, ok. See, reflection is maybe not required, for example, I know that all of you when you go to sleep, you take your mobile phone with you and in the dark room also you are able to see your mobile phone, right, so there is no light that reflects off from the mobile phone and enters your eye, ok, mobile phone has its own light. Similarly, you can see the sun in the sky, it is not that some light get reflect off from the sun, ok, sun has its own light, so that is the reason why ultimately one thing should be common that light from object should enter the eye, ok. Now, this light can be because of reflection or because of its own light, your brain's visual cortex, we are not getting to inside the eye, do not enter, ok, we are dealing with what happens just before the light enters the eye, ok. So, this is how we see, now tell me, do we see the object or its image, we do not see the object, we only see the image, fine, the image is just a manifestation of object, isn't it, right. So, it I mean we even if you directly look at the object, some image will get formed somewhere, ok, inside your eye or whatever it is, then only you will be able to see it. So, it is not that you are seeing an object, you are basically feeling the image of an object, ok and object, sorry the image represents the object, ok. Now, because of this that you are seeing the image, not the object, several tricks can be played, ok. So, if there is this object over here, if light from this object reflects off from the mirror like this and then enters your eye like this, you will feel that object is somewhere here, ok, you will feel that object is here, you will not feel that object is there, fine.  So, you can play all sorts of tricks, you can you know magnify, bring the image closer, invert it vertically, horizontally. So, this particular thing that it you can magnify and bring it closer, these two things are very very important because once you have some device, you know some optical device, some lens setup or mirror setup, you know you can, you can magnify the object, you can bring the object closer, you will feel the, you know you can observe it in greater detail, ok. So, you know the first study when the science was developing, the first formal study was done for the stars and moons and suns, planets. So, because of that, optics became very popular during that, during those days. So, you can you know using telescope, you can bring the far away object nearby and you can you know sense the the details of it. So, you can observe better and that is what the key in physics is, you know using your using just your eyes, you may feel that at a particular location only one star is there, but if you have some instrument which can create a proper magnified image, you will you will suddenly realize, ok it is not just one star, there are like 20 to 30 stars in a single place, just that you are not capable to you know visualize it or properly see that is why you are feeling it is just one star. So, because you can use the optical instruments to to completely change the sense of vision and sense of observation, that is why optics is more important, ok. So, not only just you can observe something which is very very far, you can also you know right now if you look into your room, you may feel that nothing is there, ok. It just I mean you feel that some bigger objects only, but when you zoom in, zoom it in, you can use the electron microscope or some very powerful microscope, you will realize that there are bacterias, viruses and all those gaseous molecules are around surrounded surrounding you. So, then you will, so what you have done using optical instruments, you have enhanced your sense of vision, right. So, that is why it is more important, in fact this is one of the most important branch of physics, because until and unless you you increase your sense of observation, if you increase sense of observation, then only you will be able to you know design something or do something in a much better way, then you will be more aware of your surroundings, ok. So, that is the reason why it is one of the most important branch of physics, ok. Now, and because of that only people have started learning about study of light. So, initially when they are developing this idea of light, they have already, they were already aware of sound wave, sound wave study was done much before than the study of light. So, they thought that even light needs a medium to travel, ok. So, they were very strong in that opinion. In fact, couple of great scientists have suggested that entire universe is filled with a liquid called ether, ok. And light uses this ether to travel, just like sound uses the gas to travel as a sound wave, light also uses ether which is present an invisible fluid in the universe which is utilized by the light to travel from one place to other, ok. And of course, which is wrong, right. So, later on it was clearly established that you know take an example of a sun only. So, there is a huge vacuum between sun and earth, but light every day comes from sun to the earth passing through that vacuum. So, you know it was then established that light doesn't require any medium and there is nothing called ether which is present anywhere you know in this universe like that. So, but then this ether which I am talking about this is not the same ether which you have, you might have studied in chemistry, ok that is different, all right. So, it was established that light is an EM electromagnetic wave which doesn't require any medium, ok. But then of course, it was not established earlier when Newton was studying it like a particle or like a ray. So, you know so, but then whatever observation was taken by the Newton, some of it can be only explained by the fact that light is a particle and it travels in a straight line and bounces off elastically, all right. It is ether. So, yeah. So, you know so, that is the reason why you need to understand first that why we are studying light as a particle and then light is a wave later on in wave optics, ok. Now, just take an example of yourself only, ok. You like do you behave to the same situation at the same I mean at the same time similarly, no, right. So, for example, if you are in a school, ok and you are with your friend, ok, you might be behaving in a different way, ok. And similarly, if you are with your teacher like for example, with me, ok. So, your behavior will change of course, right. So, and then suppose you are angry, you will have some other behavior and then suppose you are playing football, some of you might be very quiet in a classroom and as soon as you get into football field, you will some of you will see that what happened to that guy I mean it has he has completely changed. So, the behavior keep on changing depending on the kind of scenario or situation you are in, ok. So, you have you know in they have multiple behavior depending on what kind of situation you are in, ok. Similarly, the light can behave in two ways. Light can behave like a particle, ok and light can behave like a wave, ok depending on scenario. These are the behavior of light, ok. They do not define what is light, ok. This is let us say behavior 1 and this is behavior 2. Depending on which scenario the light is in, the light will behave like a particle and if you change the scenario, the light will start behaving like a wave. It is like when light is happy, it will behave like a particle and when light is angry, it will behave like a wave, ok. So, these things do not define what light is, it just light two behaviors of the light, ok. Now, in class 11th, in class 11th, you have ray optics, ok. You have behavior number one which is ray optics which we will be talking about, ok. This is also called as geometrical optics. Why it is called geometrical optics? Because you will be dealing with lot of straight lines, angles, how image gets formed. So, geometry has a key role in visualizing this stuff, ok. So, that is why it is also called the geometrical optics, fine. So, geometrical optics or ray optics is, you know, I can say that it is as big as, if not bigger than I think laws of motion chapter, ok.  I think I have, have we done gravitation yet or gravitation is still pending? gravitation is done, right? Ok, gravitation is not done, all right. Ok. So, the ray optics, all of you, ray optics, the study of it can be divided into three parts, ok. These are the two major chunks. First is the reflection, second one is refraction, ok. And then you have one more small topic, instruments. Of course, once you discuss the fundamentals after the end, there should be practical usage of it. So, that is covered in instruments section, ok. In fact, ok, you, you have that in school test on Monday, on Monday. So, we will take up gravitation maybe on Sunday. Sunday we will discuss gravitation. We will try to finish the gravitation coming Sunday, ok. All right. So, let us talk about it now. So, reflection, you can, you have reflection, two subparts are there from the plane surface, ok. And then from the spherical surface. And in your syllabus, you just have these things, ok. You have concave, concave mirror and convex mirror, fine. All right. So, this is a small chunk and of course, we will be studying the laws of reflection or the basics of reflection before even getting into these kind of scenarios. But then I am just listing down the scenarios right now, ok. And when we talk about refraction, so we will have refraction from plane interface. See, when reflection happens, the light after reflection comes back to the same medium. So, light, if it is in air, after reflection it remains in air only. In refraction, the light will travel from one medium to another medium.  So, we will talk about refraction through the plane interface, how light travels in a plane interface and then get into the second medium like this, ok. Then you have refraction from the spherical interface, ok. This is spherical interface. So, the same flat interface could be spherical, ok. This is medium 1 and this is medium 2, ok. So, we will talk about that and then you will have study of lenses. Are you able to hear me? Ok. Yeah, there was a power failure that will happen once in a while. Ok. So, we will be talking about two kinds of lenses, you know. We will be talking about concave lenses and then we will be talking about convex lenses, ok. Now, the way lenses are different from interface is something like this. I am drawing the basic lenses, ok. I am not drawing other all kinds of lenses. Are you able to hear me? Ok. All right. So, what I was talking here was that a lens is different from the interface, ok. Because both sides of the lens have the same medium, ok. Both sides have the same medium, ok. Now, you can claim that a lens has two interfaces that is also correct, ok. So, you can study the lens as two spherical interfaces, interface 1 and interface 2 or you can study the lens together at once, ok. Since lens is very common, so we study it together at once, ok. So, both sides of the lens should have the same medium that you must remember, ok. So, this is the study of the lenses and then we have, then we have prism, ok. Small topic is their prism, ok. So, we will be talking about prism in refraction. So, this is the entire study of refraction and then in optical instruments, we have just basic instruments in our syllabus, ok. One is of course, microscope and then we have telescope. So, we will be talking about these two instruments in this chapter and then there will be small topics like scattering, then polarization. Now, polarization is in wave optics. So, there will be small, small side topics, but that does not become a part of this tree. So, this is like 95 percent of the entire syllabus of the ray optics, ok. Is it clear, ok? So, we will start this chapter now, ok. So, of course, we will be starting with the most basic of all reflection, ok. Now, what is reflection? What is reflection? We will be doing gravitation before your test, do not worry, ok. But since we have started this, let us continue with this, at least for this class, ok. What is reflection? Anyone? You have done this in class 10, bouncing. It need not be a polished surface. If bouncing or the thing happens only for the polished surface, then you will not be able to see any unpolished object in presence of, you know, bulb. So, that is why that polished thing is not required. So, reflection is nothing but, you know, bouncing of the light between the two mediums. What happens is, suppose there is this, if there is a reflection of core boundary, of course, there should be a boundary between two mediums, ok. So, the reflection is a phenomena of the boundary between the two mediums, where the light comes, hits the interface and comes back to the same medium, ok. So, the light hit after hitting the interface comes back to the same medium in which it was earlier. So, this is reflection, ok, straightforward definition it is, ok. And one more thing you must remember that light travels in a straight line undeviated, if in a single medium and without reflection, of course, ok. So, till the reflection happens, the light will go straight, ok. And after reflection, light can deviate its path just after reflection, but the after reflection also whatever is a path, it will keep on going straight, alright. So, this is the phenomena of reflection. Now, let us talk about the laws of reflection first, ok. Just like we have studied any chapter before studying any chapter, we first discuss the laws, right. For example, laws of motion, we discuss the laws, kinematics, we have three equations of motion, walk by energy, we have work energy theorem. So, we need to know what are the laws the reflection follows, then only we can talk about how we analyze the reflection, ok. Let us talk about laws of reflection. What is the first law? Anyone? Ok, write down the angle of incidence should be equal to angle of reflection. Now, that is the second law, but anyways, is it? Many books you will find this as the first law and the other one as the second law, but it hardly matters, you know, it does not matter. These two laws are not depending on each other. So, they can be existing independently also. So, there is no connection as such, level of reflection, ok. Now, angle of incidence, now first of all you need to understand, again the screen is off, alright. So, angle of incidence, first of all you need to understand that angle is always between two lines, ok, between two lines. You need two lines for angle. So, angle of incidence, of course, there will be some incident direction, ok. So, you need another direction to create an angle, ok. Similarly here, angle of reflection, one direction is reflected ray, but you need one more direction to create the angle, fine. So, to create the angle of incidence is angle between, the angle of incidence is the angle between incident ray and the normal, ok. As a few of you are sending me WhatsApp messages, I hope you understand, I cannot read WhatsApp message right now. So, just come on the chat box here, only you can type in if it is relevant, otherwise you just, you do not need to type in WhatsApp messages to me right now, ok. So, the angle is always between the two lines, the first line is incident ray and the second line is normal. Similarly, angle of reflection is angle between reflected ray and the normal, but what is this normal? The normal is perpendicular to the interface only, ok, but then the interface, if it is straight, you know, then all the normals will be in the same direction, they will be parallel lines, ok. So, the angles or the direction of the normal will not change. So, angle will not change, but it does not matter, you know, your interface could be a curved, ok, like this, could be irregular shape like this. Now, you cannot just say normal to the surface, ok, because every point, there will be a different normal. So, that is why you need to specify which normal you are talking about. So, it is perpendicular to the interface, normal is perpendicular to the interface at the point of reflection, ok. So, angle of incidence is also referred as angle i, which I will be keep on differing as angle i, ok. It is the angle between incident and the normal and angle of reflection is angle between reflected and the normal. You guys, I am going very slow, ok. I am repeating my points again and again. So, all of you listen carefully, ok, because soon we will be moving to slightly advanced level concept as well. So, if you pay attention when the basics are discussed, then of course, you will be able to do the advanced level. You cannot just directly start doing the difficult question without paying attention to the basics, ok. So, that is why I always spend more time when I talk about basics. Anyways, so, now this is the law, ok. Now, this law can be best understood if you draw some diagram, you know. So, let us draw some diagram to understand that in more detail.  Now, to visualize the first law of reflection, let us draw an incident ray everywhere. So, this is the incident ray, light is coming like this, ok. And here, light is let us say coming like that, ok. And there, the light is let us say it goes like this, ok. Now, everywhere, can you draw angle of incidence which is let us say angle i and angle of reflection which is r. All of you try to do this. Done? All of you done? The first step is what? The first step is to draw the normal at the point of reflection, ok. We cannot talk about angles if we do not have normal, ok. How to draw normal for a circle? You know that? How to draw normal? Anyone? Normal for the circle will be radius direction, right. Line passing through the center is normal to the circle. Understood? Yes. All right. Now, let us draw the reflected ray, ok. Now, reflected ray should make same angle as the angle made by incident and the normal, ok. This is angle, ok. This is angle of reflection. So, angle i should be equal to angle r. Similarly, this is angle i and this should be angle r. They both should be equal, ok. Now, here how we will draw the normal? The step number one is to draw the tangent over here, ok. So, a tangent is like this, ok. And then the step number two is to draw a line that is 90 degree to the tangent, ok. So, it will be this, ok. So, this blue line is the normal, ok. So, your angle of incidence is very, very small, ok. So, let me change this a bit. So, let me make angle of incidence bigger. This is the incident light, let us say, ok. So, this is your angle of incidence, all right. And angle of reflection is this. This line, when it bounces off from the surface, it will make angle r with the normal. So, angle i should be equal to angle r, all right. So, like this, you can draw angle of incidence and angle of reflection at any interface, ok. So, I hope it is the first law is very clear now. Let us talk about the second law, ok. The second law of reflection says that incident ray, normal and reflected ray all lie in the same plane, ok. So, all three lines must lie in the same plane. This is incident ray, normal and reflected, incident normal reflected. All three must lie in the same plane, ok. But normal is not given to you, right. Normally something which you have constructed, only incident and reflected ray are something which is given to you as in light comes in that direction and goes after reflection in the reflected ray direction. So, when you have only two lines, you can always pass, you know, you can pass a plane passing through these two lines, ok, because they intersect at a particular location, ok. So, the normal should lie in the plane containing the incident ray and the reflected ray, getting it? So, if there is a vector, let us say normalization of incident ray vector, let us say mu times incident vector plus lambda times reflected ray vector, all right. So, this is how you ensure that these three vectors as in this one, normal and this one, they lie in the same plane. This is one way. Other thing is the box product between the three vectors. I am not sure whether you are aware of the box product and linear combination, but I am telling you so that you have that at back of your mind, ok. So, the box product of n, i and r should be 0, ok. Box product is nothing but n dot i cross r, this should be equal to 0, fine. So, basically we will talk about these vector notation little bit later when you become comfortable with vectors later on, but I am just telling you that this law is not useless. It is not that you can just know it and do not ever use in problem solving, ok. So, just like Newton's third law probably some of you thought that it cannot be used to problem solving, it is just a fact which you should keep in your mind, but later on you realize that there are some practical usages of problem solving Newton's first law and third law. Similarly, this law itself can be utilized for the problem solving if I start talking about incident ray normal and reflected in terms of vectors. So, I can say that incident ray is 2 i cap plus 3 j cap direction and reflected ray is let us say 12 j plus 15 i direction. So, find out the normal direction. So, then you need to use this particular law of reflection, ok. All right. So, these are the only two laws of reflection and let us take few scenarios now, but before we even do that in this entire chapter, in this entire ray optics chapter, you must remember that how image is getting formed, the light from the object, object's light should reach, this is the bottom line. If you get a feel of this, you will understand entire thing of this chapter, you know, very easily. So, object's light should reach observer, ok. This is the key thing. So, what you should do in any problem solving, what you should do? You should first locate where is the, so I cross r, should it be in the direction of n. No, if you, ok, let me go back to the previous, good question. There you go. I cross r will give you what? I cross r will give you a vector that is perpendicular to i as well as r, ok. So, I cross r basically gives you a vector that is perpendicular to the plane containing i and r and if normal vector is in the plane of i and r, so dot product between I cross r and n should be 0 because n should be perpendicular to I cross r since it is in the plane of i and r, ok, that is why. But then I have skipped that particular thing, I will talk about in greater detail maybe in class 12th when you study vectors in mathematics as well. Ok, so this is the bottom line, ok. Bottom line is this, object's light should reach the observer. Now, it is a good question, Ashish. So, this is the bottom line, ok. So, whenever you solve a problem, ask yourself where is the object, ok and then of course, ask yourself where is the observer, ok. So, your entire problem solving when you ask to find the image is to make sure light from the object reaches the observer, ok. Now, when light from the object reaches the observer in between it will encounter few optical things like for example, it will encounter a lens, it will encounter a mirror, you know. So, when it encounters these things in between the path, ok, then the light will deviate, light will deviate, ok. So, we will have formula or equation of how light will deviate and what is the effect because the light is getting deviated, ok. So, whenever light from object reaches the observer in between suppose lens is there. So, we will use lens formula, ok. In between mirror is there, we will use mirror formula. So, like that, it is a very straightforward, simple chapter where the light from the object should reach the observer, ok. And another thing that is very nice about this chapter, you know, is that this chapter is not connected to any chapter, ok. It is a standalone concept which you can understand and master without knowing kinematics, without knowing laws of motion, Vagpa energy, ok. So, this is your chance to, it is a chance for you to start from the scratch a particular concept and master it without even depending on your previous virtues. So, if you have not studied hard enough or good enough till now, this is your chance at least this chapter you do not have any such thing like, you know, since I did not studied in the start, so I could not do this properly. So, this will, this is a standalone topic, ok. So, let us talk about the reflection from the mirror first, plane mirror, plane, plane mirror, ok. Let us say, this is your plane mirror and you want to find, you need to form an image of an object that is placed along this line, ok. Let us say, here is this object, oh, ok. Before we start talking about how the image is getting formed in the plane mirror, let me tell you few things about formation of image itself, which you might have studied in class 10, but I just want to discuss that again. See, here is this observer, ok. This is your eye, this is your eye, ok. So, if light is coming from this direction, light is coming like this into your eye, like this, you will feel that the object is along this line, isn't it? Somewhere along this line, the object is agony, all right, but then you will not be able to pinpoint what is the location of the object using just one ray, but then you will have an idea of which direction it is. The image could be here, could be here, could be there, could be anywhere along this line, but one thing is sure that it will be along this line only, ok. Now, suppose you have one more ray coming from the object or let us say image, then you will have this ray also, like this. The two rays are there now, so you will say that the object should be along this path also and along this path also. So, same logic applies here that somewhere along this line the image should be, ok, and same logic applies to the previous line also that somewhere along this line the image or object should be, ok, all right. So, this point is a point which is common in both the directions, right. So, if I say that there is the object lies in along these two rays, then of course the intersection point is a point which lies in the both on the both the lines, ok. So, you need at least you need minimum two rays, ok, to form image. Are you getting it? So, this is, this you need to remember that you cannot just draw one line, one ray coming from the object and hope to find the location of the image, ok. You need at least two rays, all right. Now, you do not need to draw multiple rays. You do not need to draw like five or six rays coming from the object. You just draw two of the rays wherever these two rays will intersect, same point other rays will also intersect. So, remember this, ok, two rays you need to draw and then you need to look at the image. Now, tell me this is the object, ok. In this case this is the object, ok. This is the mirror, ok. These shaded lines I am drawing just to tell you that which side you know it is celward. So, this is the mirror, this one. Tell me where is the observer? Where is the observer? The object, where is the observer? Same side as the observer, ok. Now, yeah, yeah, left side. Observer cannot be behind the mirror, right. The observer will not be able to see anything. So, observer has to be here. Now, the observer will directly look at the object like this. What is the use of the mirror then? Observer is directly seeing the object. If a observer directly sees the object, then there is no need of a mirror, ok. But what observer is seeing is not the object directly, but observer is looking at the mirror, fine. Observer is looking at the mirror. So, observer is not capturing the rays, observer is not capturing the rays arising out of the object.  So, you can see yourself without you know seeing yourself on a mirror, but that is not what you are doing here in front of mirror. You look at the mirror, right. You do not look at the object. So, you look at the mirror. So, whatever rays, whatever rays that are bouncing off from the mirror, these rays which are coming out from the mirror after reflection from the mirror, these rays this observer will capture. Getting it, ok. So, can you draw the location of the image in this case quickly? Find out the location of the image. Yeah, yeah, yeah. See that is correct, but I want you to draw and find out. Like since your childhood days, you might be knowing that the location of image in case of this drawn. You need how many rays to form the image? You need two rays. One ray, let us say is this, ok. This is one ray. Now, it will reflect off from the mirror. So, it will follow law of reflection, right. In order to follow the law of reflection, you need to know the normal direction. So, this is the normal direction, ok. So, it will reflect off like this. Angle of incidence is equal to angle of reflection. This is how it will reflect off, ok. And then one ray you can pass like that. So, let us say this is another ray. It goes like this. Now, tell me what is the angle of incidence over here? Angle of incidence when the ray goes like this, what it is? Angle of incidence is 0. So, angle of reflection should also be 0, isn't it? So, light should come back along the same path, ok. So, now this thing is extremely important. You are going to use this particular phenomena again and again. So, write down somewhere that I mean it is something which is obvious, but then obvious is Newton's second law also. So, application is at times becomes tricky. So, write down that when the light hits the interface, hits the interface, when the light hits the interface at 0 degree with the normal or along the normal. So, when the light hits the interface, along the normal, when the light hits the interface along the normal, the reflected light will come back along the same normal. So, the reflected ray will come back like this. This is the reflected ray. Now, will these two ray ever meet? This is the reflected ray 1, this is reflected ray 2. Will these two ever meet? They will not meet. So, there is no as such image gets formed. There is no as such image that gets formed, but if observer is here, if observer is here, then the observer will feel that these two rays are coming from up. He will feel. He will just feel that. Are you guys able to hear me? Skin crashed. Like them, able to hear me, right? Skin crash away, crash. So, the observer will feel as if light is coming from this point. So, this point let us represent it by capital I, alright? But then in reality, there is no such light there. It is like when you stand in front of mirror, you will feel that you are behind the mirror, but there is no light that is coming from behind the mirror. So, this kind of image, I know that you are aware of it. It is called virtual image, okay? And this angle is equal to that angle, alright? Then this angle is angle of incidence and this is angle of reflection. These two are equal and this angle of reflection is this angle. These two angles are also equal and this angle will be again then be equal. So, these two are similar triangles. Not only that, this side is common, right? This side is common and hence these two triangles are congruent, fine? So, let us say this is P. So, because they are congruent, distance OP should be equal to distance OI, fine? So, this is how the image from the plane mirror gets formed and the characteristic of image. Write down the characteristic of image. It is virtual, first of all, plane mirror always forms virtual image. Then it is erect and laterally inverted. Laterally inverted as in whatever is your left hand side will become your right hand side and your right hand side becomes your left hand side, okay? So, right now it is a point object. So, you will not be able to visualize how it is erect. So, if you make it a bigger object like this, if you make it a bigger object like this, then you will see that the image of this point will get formed over here. Same distance. This point is from here. From here, you will have at the same distance, the image gets formed, okay? So, this is the image of this point P. So, P becomes P1, okay? And this point Q, this will become Q1, okay? So, all these point will get translated here. So, this is the image. So, which is erect image, okay? But the left hand side will become right hand side and right hand side will become left hand side. The light would reach the observer. Which observer, Nikhil? I did not get you. Anyways, so, this is the characteristic of image, alright? So, let us solve a numerical on this plane mirror, okay? Suppose this is U. So, all of you are like 5 feet at least, right? So, let us say this is 5 feet. 5 feet, how many meters are there? 1.5 meters around. So, let us say this is U, 1.5 meters, alright? This is your feet. This is your feet and this is your head, okay? And this is your eye. So, this is your eye.  Fine? The distance between head and eye, Kirnava approximately, let us say 10 centimeter. It is 10 centimeter, okay? You need to tell me the minimum, minimum length of mirror required by you to see yourself completely. Solve this. If you please try 75, okay? So, initially, you just, when you solve such question where you need to find a minimum height or something like this, you just assume you have bigger mirror like this, okay? And then draw a ray diagram to look at the image and then you just erase the not useful part of the mirror, okay? So, basically, the ray from the feet should reach the eye to look at the feet, right? And the ray from the head should reach the eye to look at the head. So, basically, if ray from the head and feet reaches the eye, then you are able to see the entire from head to feet, isn't it? So, if ray from the feet has to reach the eye and if it has to follow the law of reflection, then the normal should be coming as a perpendicular bisector, right? So, it should be like this, the ray should go from here like this and then it should reach like this, okay? So, that is the reason why these two triangles are congruent, right? So, this line has to be perpendicular bisector of head to feet. So, light will travel like this, then you are able to see the feet, okay? And then you should be also be able to see the head, right?  And then the light from, oh, what happened? Light from the head will reach the eye like this, okay? It has to be perpendicular bisector, otherwise angle of incidence will not be equal to angle of reflection. So, these two angles should be same, that is why it has to be perpendicular bisector.  You do not require this part of the mirror, right? So, just erase it and you do not need this part as well. So, this is the height of the mirror which you require, all right? This one. So, how much is that? How much is that? So, draw a line like this, okay? So, this length, this length is half of the length between eye and the feet, okay? When phi is 0.1, this one and then plus you need to add this distance, this one, which is how much? This is 10 centimeter divided by 2, okay? So, that is 0.1 divided by 2, that is 0.05, okay? This is how much? 1.4 divided by 2, this is 0.7 and this is 0.05. So, 0.75 centimeter length of mirror should be there, okay? So, like this you can solve this particular question. Yeah, height till the eyes, what do? 1.5 is complete.  It is head to feet, total height. Yeah, yeah, centimeters, okay? Understood all of you? Okay, you might be getting the right answer with that logic but if I argue like why symmetry you should be using here, if there is no answer with you for that, then you are doing it wrong, okay? So, you may get the answer but then the person who will be setting J advance paper very well knows that there will be students who will be trying to apply symmetry logic or they will be trying to apply the shortcuts to arrive at the answer. So, they will intentionally make questions in which it may look like you will be applying symmetry but you will not get the correct answer if you try to apply some shortcuts, okay? So, won't it be 70? Is there any doubt in the way I have solved it? Tell me that, okay? Tell me that if you have any doubt. See, the ray from the feet should reach the eye, okay? So, if it reaches the eye, this angle, eye should be equal to angle R, this length should be equal to that length, okay? So, the total eye to feet length is 1.5 minus 1, 1.5 minus 0.1. So, this length eye to feet is divided into two equal parts. So, this is 0.7 and then similar same logic between head to eye. So, 10 centimeters divided into two equal parts. So, 5 centimeter 10 by 2 which is this length from here till here, okay? Fine. So, this is for the plain mirror, all right? Let us try to see what about this spherical mirror, okay? Spherical mirror.  So, suppose this is a sphere, okay? So, if you cut the sphere between these two points, you will get a spherical mirror, all right? So, your spherical mirror will look like this, all right? Now, if you silver this side, it becomes concave mirror, okay? And if you silver the inner portion like this, it will become convex mirror. So, this is just a nomenclature and if you want to remember it, you can remember like this, you know, that since this side is silvered, the back side is silvered, the ray has to come from this side.   It is like a cave sort of thing when you come from this side. So, it is called concave, okay? And the other one will of course be then convex, all right? So, let us first study the concave mirror and then we will try to, you know, extrapolate whatever we have studied with respect to concave mirror in convex, okay? So, there will be certain things that will be used, that we will be using to analyze the concave mirror, fine? So, just note down few things. This point is called pole, okay? This point is pole. The center of the mirror is called the pole, okay? The size of this mirror is aperture, okay? Fine? All right? Aja, can you tell me one thing? If you look the mirror from this side, what you will feel this to be? You will feel this to be a straight line or what? The projection along this line, if you look at from this side, left hand side, will it look like a straight line? What will be the shape of it? I know exactly what problems you have not for you. Tell me, Bharat has told straight lines, head on, others, what do you think? It will look like a straight line? Remember, what I am asking you, simply you look the mirror like this, what shape you will see, okay? So, that's not correct. That's not correct. First, tell me, first, let me show you how the sphere looks like. This is nice. This is the sphere, okay? This is the sphere, okay? So, if you cut a part of a sphere, if you cut a, yes, that's correct, that's correct. If you cut a part of a sphere and make it a mirror, okay? The projection along the direction which you are looking at it, it will be circular, okay? So, what you are doing is, you know, you are cutting a portion of it.  So, what you will have, okay? I am not able to draw it over here. It's a 3D thing. So, you understand, right? If you chop off along this direction, if you take a knife and cut along this direction, okay? You will have a circular this thing. Are you getting my point? All of you able to understand? So, that is the reason why you will see a circle over here. It's a part of a sphere, okay? It is part of a sphere. It is not a part of some 2-dimensional shape. So, although it looks like a circle, but it is not a circle, this is a sphere, okay? So, if you cut from here, you will have a section like this that will come out, fine? So, any further doubt, please visit your lab. You will have some lenses and mirrors over there. And that is the reason why it is called aperture also. Aperture, the literal meaning of aperture is what? A small opening, okay? So, opening cannot be a straight line like, I mean, it can be, but generally when they say opening, it means a circular opening, okay? So, remember that. So, this is the thing, right? And then you will have all the spherical mirrors. We will have a center of curvature, right? What is center of curvature? Center of curvature is a center of the sphere of which this mirror is a part of, fine? So, you have cut the mirror from this sphere. So, center of curvature is this. So, along this line somewhere, let us say this is the center of curvature. See, okay? All right? Now, tell me how many normals are possible for this mirror? How many normals can we draw? Is it only one or two or three? How many normals I can draw? I can draw infinite normals, okay? Any line that passes through the center, any line that passes through the center is a normal only, okay? But there will be one special normal. This is a special normal that not only passes through the center, it also passes through the pole, okay? This special normal is called principal axis. This is called principal axis. Now, till now, till now, we have only discussed about geometrical parameters, isn't it? We have only discussed about geometrical parameters, okay? But the practical usage of the mirror is to deviate the light, isn't it? That is a sole purpose. You are having mirror to deviate the light in a particular direction and try to play around with the magnification or the location of image and things like that, okay? But these are just geometrical parameters. None of them, none of them, you know, can directly tell you how much light can be deviated or sort of tell you an indication of what is, how powerful this mirror is, okay? So, we define an optical parameter which can be an indicator of how powerful it is or optical parameter. It gives you an it gives you an idea of how powerful the mirror is, okay? And that optical parameter is called focal length, okay? This optical parameter will be common across. We will be talking about this optical parameter in lenses also, okay? But then since we are introducing it for the first time, we need to talk about the basics of it first, okay? So, this optical parameter will give you an indication of how powerful or how much it can potentially deviate the light and all, getting it? All of you understood? Now, this optical parameter could be, you know, it is up to you how you define the optical parameter, right? So, you can say that, okay, if a light goes like this, you know, light, if it comes like this, how much it will deviate, that is an indicator of how powerful the mirror is, okay? But then, you know, there is nothing special about this particular light which you have chosen in general, okay? But then there will be one particular kind of rays which will be, you know, sort of unique or something which you can, you know, it will be easy for you to generalize. For example, a light that is parallel to the principal axis like this, if there is a light ray that is parallel to the principal axis, if it goes like this, okay? Then this ray of light will deviate, okay? And when it deviate, it will pass through a point in the principal axis. This is, let us say f, okay? Now, how will you get this value of f? You know, that you can use the law of reflection. So, this is the normal, okay? This is the normal angle of incidence. This angle should be equal to that angle. So, like that, you can get the value of where f should be, okay? Now, greater is this angle, this angle, angle of reflection, greater it is, the shorter will be the length between p and f, getting it. So, pf is small for larger deviation, fine? The deviation angle is what? Deviation angle is, let us say this is the original direction and this is the original direction, okay? And finally, it goes like this, this one. Are you able to understand what I am saying here? Able to get it? Any doubts till now? Any doubts till now? Please type in, it is clear. So, pf basically, you can say it represents deviation. So, I can say that pf can be used as an optical property, okay? So, the length pf, length pf is also referred as focal length, okay? So, what is the definition of focal length? What is the definition of focal length? Focal length is a distance of a point, okay? Distance of a point on the principal axis. It is a distance of a point on the principal axis, which, distance of a point on the principal axis, which is the point of intersection, which is the point of intersection between principal axis and the parallel rays to the principal axis, distance from the pole, okay? So, this definition is universal. So, you know, you do not need to have a, let us say, spherical mirror. You can have a lens also. You can have any combination of lens and mirror, mirrors only or multiple lenses. So, I can ask you to find out the focal length of the combination of lens and mirror, of combination of only lenses, of anything, okay? So, but this definition is universal. That focal length is a distance from the pole to the point where the parallel rays to the principal axis hit the principal axis, fine? So, this you should always remember, okay? So, these are the few of the notations of the, what do you call, of the spherical mirror, okay? So, now let us try to find out where the image will get formed, okay? Let us try to derive the mirror formula. So, that is what we are trying to do now. We are trying to derive mirror formula, okay? So, all of you draw very, very clearly a concave mirror, okay? It should be in a full page, draw it clearly, concave mirror. This is my concave mirror. Draw on concave mirror. Now draw the principal axis. This is the principal axis, okay? It should be like this, you draw it, okay? Then you draw the, then you draw the object. This is the object. Okay. Let us first analyze the ray diagram before getting into any formula. So, let us not discuss formula right now. We will discuss the ray diagrams first. Then it will become easier for you. Ray diagrams for mirrors, okay? All right. So, what I was saying was that just like in kinematics and in any physics chapter, in fact, you can understand the concept using algebra or using some numerical methods or you can, if you are very good at visualization, you can use graphs and try to visualize a scenario and then you will get the answer very quickly, okay? Similarly, in ray optics, you will have formulas. Definitely, you will have a lot of equations and formulas which you can utilize to arrive at the answer. But at the same time, there is one branch of optics which deals with the ray diagram, okay? It is like understanding kinematics using formulas and understanding kinematics using graphs. So similarly, you can understand the optics using ray diagram, okay? So, ray diagram will really help you in visualization. And in fact, many of the good questions up to J advanced level, you cannot hope to solve completely by using numerical method. You must have a good hold of drawing a ray diagram or you must have a good visualization. So, it helps you to visualize a particular scenario, a ray diagram. Although it may not help you to arrive at the exact numerical answer, let's say, it will not be like, okay, numerical answer will be 10.3. It will not give you the exact answer, but it will very well help you to visualize what is happening, okay? For example, things like, you know, if I am just telling you something which you may or may not know, but just I am giving an example, you know, that for example, if two erect images are formed from the spherical mirror, if two erect images are formed from the spherical mirror and both the images are virtual, okay? One is enlarged and other is diminished, okay? So, if you have a good hold of ray diagram, then you know that if it is enlarged virtual image, it has to be from concave mirror. And if it is diminished virtual image, it has to be from concave mirror, sorry, convex mirror. So, these kinds of things you must be well versed with. And also a few things like, you know, you cannot take virtual image on this screen. For example, you might have seen in your lab only, you put a screen to form image, right? So, if it is a real image, then only you can put a screen and capture the light to form the image. But if it is a virtual image, there is no light which is coming from a certain point. So, you cannot capture it on a screen. So, if it is just given that the image is getting formed on the screen and things like that in a questionnaire if it is written, then of course, it is a real image, okay? And you know, all real images from the mirrors, spherical mirrors will be inverted. So, all these small, small things will really help you to solve problems. So, that is why I am taking ray diagrams right now before taking any equations as such, okay? So, draw this object like this. So, this is pole, let us represent it by letter P. Then there will be a focus F, let us say this is F. This is center of curvature C, okay? Now, can you draw a ray diagram? Can you draw a ray diagram to capture where the image of this object will be? Where is observer? Observer is behind the object, but it is not looking at the object directly, but it is looking at the mirror, okay? It is looking at the mirror. So, whatever comes out from the mirror, the observer is seeing. Done. So, you just need two rays, okay? You just need two rays of light. So, one ray, it is always preferred to draw one ray that goes from, goes parallel to the principal axis because you know that if it is a ray that is parallel to principal axis, it has to pass through the focus. There is no other option, this, okay?  Now, second ray, many of the students, they draw like this, a ray that passes through the focus. What will happen to that ray? Anyone of you? If this ray that passes through the focus, okay? Then what will happen to this? The ray will become parallel to the principal axis. Yes. So, remember this thing. If there is a parallel ray, it will pass through the focus. If the ray passes through the focus, it becomes parallel to the principal axis. So, you will get getting it. Now, you have another option to draw the line. So, you could have drawn this line as well, a ray that passes through the center of curvature. Since it is not to the scale, so that is, let me shift the center of curvature itself. So, here is the center of curvature, C, okay? What will happen to this ray? If extended till this point, imagine mirror is getting extended, no, what would have happened to this ray? It will come back. It is a normal direction. So, it will go like this and it will come back like that, okay? So, image will be here only, fine? So, you can pick any of the two to draw the image of an object. It traces its path, correct? Fine? You can see the ray diagram and there are many other ray diagram that will be taking up in the next session in the evening, okay? So, that is it for the first session. We will have another session in the evening. Most probably, it will be at 4 pm itself. If it gets delayed to let us say 5 pm, I will let you know before, much before, okay? All right? So, thanks for coming. So, I hope you have learned quite a bit, say optics, okay? Fine? So, see you in the evening time. We will have another session. Bye-bye. Hey, all of you like the session, okay? YouTube.


Hello everyone, this is a session on progress on enterprise Fedora desktop. Roughly a year ago we did a talk at the GoaDec where the idea was to show that with relatively small effort we can combine server developments that were happening for the last seven years with the desktop improvements to produce something that makes Fedora and other Linux distributions that try to use the same bits reasonably usable in corporate environments. And then after that I was sort of advocating that when we talk about enterprise free software desktop, we're actually talking about the desktop we use at home because our life is effectively a life of split identities. So you're your own at home, you're somebody at work, you need to have access to all of those identities at the same time, share files, access social networks, your blended identity. You might have identity disorder as well but that's the reality. And overall if we look at the enterprise desktop it's really a combination of three big things. So it's a client enrolled into some centralized identity management system. It's a tool to perform business tasks whatever is defined as your business regardless of the actual details of that business. And it's a subject to centrally defined access controls and those centrally defined access controls actually differentiate us from a desktop. And we in Fedora we have plenty of identity management systems but as I'm representing here free IPA and Sampa teams we kind of have two of those sort of highlighted, right? You can do your own identity management system based on Kerberos and LDAP or other means, there are plenty of them now but in Fedora we can now install free IPA the main controller right from Anaconda as a role and we were discussing yesterday in the server working group that you can do more in future and do something with it. And on the desktop side it's obviously a client to that system so you need to do something with it and we're also working on the Sampa AD part for I think four years now. It's not an easy feat. We still have something like 50-70 patches to be merged upstream to fully support MIT Kerberos so that after that we can start thinking about bringing it in Fedora as a supported solution and their fun will start because people start deploying and complaining and doing the bugs so we're looking for that around Fedora 26. And then we have agents that actually represent what the server side thinks the clients should be doing, right? These agents they give you identity services so in POSIX environments that's POSIX attributes your UID, GID, home directory and what not shell which is a stronger preference for everyone and people fight against them as they fight against choice of the editor but then you have authentication services and it's strongly coupled with the way how applications actually treat that authentication there are different methods and so on. Then if you're authenticated you need to be authorized specifically in the corporate environment. Authorize it or not to access certain resources and certain applications that's kind of clear thing and then the tools to simplify access. There are a couple examples so Fedora and free ABA so a client that is enrolled in free ABA uses SSSD project and a demon as an agent and we have both NSS, SSS and Palm SSS modules configured in the standard Fedora stack even if you don't use SSSD that doesn't change anything but it allows you to switch on SSSD and don't change any configuration it just start magically working and then SSSD performs a bunch of things fetching the data from free ABA server and applying decisions authorization decisions based on that data and one of the examples is also that OpenSSH uses the SSSD to look up public keys of the servers you connect as OpenSSH client to verify the identity but it also is used by OpenSSH server to verify a public key of the user connected to itself and the same for certificates that will be related and also the pseudo rules can be configured globally and sets for specific services and specific servers that you can access if you're a member of this group or that or if you're in certain decision and for the Samba AD case while there's no Samba AD in Fedora yet there is a copper that we kind of do the test builds with you still can be a client to active directory which means you can be the client to Samba AD as well because Samba AD tries to be compatible protocol wise with active directory and you can have two different combinations one of them is a pure use of Samba tools like windbind or a hybrid combination where SSSD is used to actual authentication and identity management and windbind is used for the tasks where you have to do SMB protocol magic that's all beneath the floor so what we can do with this what what user would see and the thing is we need to have some metric that we can say that we are successful or not here and one of the simplest metrics is the amount of we are talking about single sign-on into desktops effectively if you're centrally defined you centrally authenticate that there's no need to have this all authentication happen every single step and ask the users to enter password so let's do the passwords as the metrics by our metrics will be a password so a typical situation if you reboot the machine and you put into the operating system prompt which might optionally ask you to decrypt your hard drive to boot password verification there might be some some stuff on it then you're signing into a typical a local account then you jump on the VPN because before that you cannot really authenticate against the thing on the VPN if you're working in the office and you're in the wired network and you might be just happy but in reality we could work from the hotel from home and we don't have access to VPN every time then we get the Kerberos credentials and finally authenticate to the services with single sign-on that's good but how far we are from going into this imaginary situation you boot into operating system you use your remote credentials and you access applications that are on VPN you immediately there well let's try to log in I hope this is the videos that we actually recorded in February for the DevCon they stand still as a practical example so I'm logged in into the system and I got some ticket Kerberos ticket while I'm not on VPN and I use that ticket to actually log into VPN and let me see if I press one button but basically you can see that I logged into the desktop somehow magically I got the Kerberos ticket I logged into VPN and now on VPN I've got the rest and I can actually access my resources at no point I entered any credentials other than the original ones so yes this is a client for free IPA the free IPA server runs a special thing called KD Kerberos proxy it's an HTTPS service that effectively tunnels request for Kerberos over the Internet while Kerberos itself was designed to be used in the hostile environments like Internet there are a couple of exchanges that are not really protected well they could be used to attack you so far and use an HTTPS tunnel sort of takes care of these first few steps that not protected and this is actually was developed first by Microsoft trying to solve problems of their own clients in 2007 they deployed this in Windows 2008 server and it's as the actual spec very well defined so in 2014 not any of my column implemented the spec first as a separate application then we got disintegrated in free IPA and later in 2015 the guys from OpenConnect VPN implemented this in C and integrated with the OpenConnect server so we have I think NOM.org now running this proxy for two years already and using this to access Git repositories with Kerberos credentials exactly what happened in this video and yeah OpenConnect is one of those that supported OpenVPN does not support Kerberos and ten years people are struggling to explain to OpenVPN developers that what is the use case and how it works well instead of OpenVPN IKE version 2 spec has progress on formally defined the GSS API which is the API to do the single sign-on including Kerberos in the spec and LibreS1 is working on implementing that spec so we're going to get this the funny part that IKE feed two extensions that Microsoft did since 2000 yeah I think 2000 and they have this in the Windows 2000 onwards effectively give you the same ability you do GSS API inside the swan IKE IPsec implementation on Windows site already for 15 years plus we're coming there so if you have a VPN yes that's good thing but you probably don't want to trust people with a Kerberos ticket to login into your VPN infrastructure you want to have some assurance that these people are not stealing the tickets but use it some more serious means to obtain the ticket and free IPA supports two-factor authentication internally and through the other radius-based means but effectively you can use variety of means to define those factors and one of them is the free OTP application which is based on Google Authenticator before it became proprietary it's now a clean it was always okay yeah but the idea was coming from that one yes and free OTP is this is an official for our project by the way yes it's our first one and Nathaniel did this work and it works on Android iOS yes of course that will be good so one thing that free IPA 44 will add in this thing is the ability to say how strong was your initial ticket did you use two-factor authentication to obtain it or did you use something else and then use this information to say I only can get access to that service if the original ticket was with multi-factor authentication this is not yet deployed anywhere it's coming out in free IPA 44 this August so it will allow you to get VPN limited by two-factor authenticated Kerberos tickets obtain it over the Kerberos process we can go multiple processes on it so how it works again we continue with the previous demo and here what I'm doing is it was done in a VM and I took the Yubiqui inserted it in a USB port of my machine and actually to get access to that I create a special group that has the actual writeable access to the USB device and that's why I'm doing this in the console you cannot have access to USB device from the browser you limit it there so and I programmed this Yubiqui in a such way that basically saying add a token into the first slot of this USB key I don't care what you put there defaults are there it programmed the physical hardware and then sent the token information to IPA server so that IPA server now knows that this user can log in with two-factor authentication and because the user here has OTP type as one of options to log in it can can log in so now we locked the screen and immediately an attempt to unlock the screen SSSD notices that the server actually on the Kerberos negotiation responds that this user can do OTP so we instead of printing a password here we know the user because it's a it's a lock screen right instead of password we asked first factor which is the phrase just say that you enter your Kerberos password and then the token code that you get so I enter hopefully yes is the token value we used to have this problem that if you enter them together then the next step would be that GDM or whatever is running there on the locking is GDM passes the whole password whatever is the password to unlock your credential store and your password now is random effectively because it has this token value that will never repeat theoretically right so on the next login you will never unlock your credential store because it's encrypted by a password that's one strings configurable by the way first factor and second factor they are not it's coming from SSSD and we are thinking how to do that yes yes and that's that's one of the discussions we have we have Alan and others for how to get this user experience better but for you really can can just join things together and you already get a very powerful thing so let's see yeah we logged in and the and another thing here is that I got a totally new ticket now totally fresh one compared to what they had before it did not renew it created a completely new one replace it yes yes we cannot see it from anywhere here but because we don't have on the client side actually an API to we just market or in the Kerberos upstream yes last week but at the time when this was done we did not have any API for Kerberos clients or JSS API clients to look up into the ticket and see if there is a tag that you can analyze somehow so this is a summary we got again the credentialer sent to it only once after we programmed the token we handled the login show it a different prompt or a sequence of prompts there might be more we support two factors but nothing nothing prevents have a system with multiple factors and if you haven't been at the talk that Nathaniel ran this morning about the secure automated decryption and he was talking about using a tree of factors to define up to whatever define in the the access levels making security not binary bodies slide and scale which is really interesting going forward so yeah if we got those credentials what could we do with them do you want to yeah chairman yep so once we have some Kerberos tickets what are we going to do with it so we saw that you can log in through GDM you get a Kerberos ticket I mean if you have a if your server is configured to do two factor authentication you get asked twice and so forth so finally you end up with a Kerberos ticket so what now so so you can pretty much use it with any service that uses JSS API by any service I mean it can be a file storage thing like it could be own cloud for example a web that server it could be a printer or could be SSH and so on it could be email so so I'm going to show like various things which we can do with the federal desktop once you have a Kerberos ticket there are still some rough edges here and there which we are trying to improve so this talk is mostly about like showing the improvements that we have made to smoothen some of the rough edges and what we are going to do further so so first we start with the browsers we'll come back to browsers towards the end but so let's start with browsers of it so essentially even if you have a Kerberos ticket and if you want to access a website or a web application which is supposed to work with these Kerberos tickets they don't really work smoothly I mean usually what happens is they fall back to some kind of basic HTTP authentication or you get redirected to some some sum of form where you have to manually type in your username password and then maybe tag in the second factor from your key this sum of form is kind of like the gdm screen that Alexander showed but you what quite often it's not like it's not separated as first and second factor you just have to enter a string which is basically your first factor and then you concatenate the second factor to it so this is not really ideal I mean it should just work because it's that's how it's supposed to be so for web browsers it's these web apps they advertise something called a negotiate authentication like WWW-negotiate in the authenticate header just like basic authentication so so one of the things that was missing was GNOME's HTTP stack which is Lipsu and then we have WebKit GTK on top of it it was it didn't have support for this negotiate scheme so that's why all these applications that have some form of web browser embedded into it or any applications that any application that is doing HTTP in some form wouldn't work with negotiate wouldn't work with a Kerberos authenticated setup so this was a problem for a while as you can see it was since 2009 so recently there was some movement on this so here you see an embedded WebKit GTK logging into a Kerberos authenticated resource without asking for a password the second time you already have a Kerberos token for the VDA li domain yeah so this is my home IP network setup which is sort of public except that the the actual IP server is on the private network so I need to be on VPN first and what I show it is that the GNOME online accounts didn't have any Kerberos ticket then I entered from the command line key in it and got the ticket and GNOME online account so we use the we actually getting a bit yes a bit of head of what we wanted to show let me get back here so we logged in in this epiphany window into free IPA without entering passwords because we used our Kerberos credentials yes and we did not get any redirect somewhere it is because this application this web application which is administrative console for IPA knows how to handle Kerberos itself and you can see that there are a couple users and unfortunately we cannot see the names but yeah the names but there's email set to some domain this domain is actually connected to some other source that we didn't stop before but let's get to that point so what was this is a combination of work common it's really a collaborative effort across the whole community so this effort started in 2009 then faded because there wasn't really enough strong willing people to complete it there were flying patches from Debian people from others from Intel guys to try to kind of reintroduce the Kerberos or JSS API support into Leap Soul and I think it took last two years or so to kind of understand what is the complexity and consult GNOME guys to finish this to complete this work this is all now merged in GNOME 3 so yeah so this is the this is the header that the website usually advertises WW authenticate negotiate so yes so why is this important so why is the Kerberos or negotiate support in Leap Soul when WebKit GDK important well actually WebKit GDK is just a Leap Soul application in this regard so most of the work was in Leap Soul so but anyway why is it important so one of the things it would let us do is that any application that uses HTTP via Leap Soul will now be able to deal with Kerberos for example you might have seen that you can mount your own cloud or other web depth shares in Nautilus and they are then available to any other GNOME or GDK application to your file chooser and so on those kind of things wouldn't work with Kerberos authenticated web depth store so those things will now be possible I mean there are still bugs Alexander has a prototype of a next cloud which uses Kerberos running but when I started to make it work there were some bugs I mean when you start doing DAF not pure HTTP but when you start using the DAF extensions against this setup it kind of gets lost in the beads of the technology yeah there are some protocol miscommunications that happen because actually the whole flow of this SAML was never expected to work over something not HTTP web depth is not strongly an HTTP it's another set of command that uses the same concept but there is a misunderstanding on the server side of how to handle certain redirects which basically prevent web depth to complete its operation which confuses clients and clients cannot obtain files because they did not finish the authentication it's going to take some time to work on it but the more important part is why we are looking into this is because we are effectively forced and we are moving ourselves through the social networks integration through effort of let's say Microsoft as well Microsoft security team is very concerned by passwords because people cannot handle passwords so they look into other methods of authentication and Windows 10 includes my passport thinking which is effectively a glorified auth to sequence against some HTTP server now you get something where you need to run things against an untrusted web server before you actually log in so we need to get a sandbox with a lockdown and execution environment for a browser engine right before the log on but we need to know how we connect to a network there so there should be a way to choose a network profile then this means network manager needs to be run before the log on and get access but we get down to the rabbit hole really really deep we need to access user specific data and it also says that the UX should be quite different and think about cases where not talking about graphical logon but SSH logon with such sequence it's going to be confusing and if you have your servers running on Azure or other networks if Amazon let's say will force everyone to use the same authentication schemes like Microsoft tries to introduce Linux systems will be in a big disadvantage so we try to address something that probably most of us will not see in the next two or three years but when we get hit by it will be hit quite hard that's what your Windows 10 machine actually does if you're registered with Microsoft Password yes and then you get captive portals in between and get all the stuff all together and for the offline logons they have cached sessions but before you get cached sessions you have to be online yes so for users this actually the work that we did actually means that you can do some neat things yes we will skip the part that was actually there so we add a Google account so this video like domain has a Google apps yes so for this t.vda link I got the Google apps connected to it and set up so that this user with its email is mapped to a certain user in Google apps and then you can authenticate and the authentication actually happens against epsilon instance not the Google apps at no point Google apps sees my password the only thing they see is my email validated by my identity provider so I am in control of my credentials and where they could be used and then I can login I can get inside manage files on Google Drive open documents and Google Docs read email and so with all the user date on my side the infrastructure here just to be clear is that there is Kerberos is authenticating to epsilon, epsilon is using sandals to authenticate Google so the end result is that you use your Kerberos ticket to login to Google through your own identity provider yes yes so once we got there with the Google apps as a service provider it talks to our instance via epsilon and epsilon website has a perfect documentation how to set this up if you have PIPA you have epsilon configuration then setting this up against Google apps is like five minutes or so there are still some rough ages but you can do it so what happens if you don't have Kerberos credentials you will get a window from your identity provider asking for user name and password and then you enter those credentials but then everything works as it is the problem is that at the point when session cookie expires you have to re-enter those credentials manually and nobody will be asking you well probably no online accounts will show you that the credentials expired you have to enter them but with the Kerberos ticket they can be automatically renewed without your involvement if you are allowed so we are also trying to make some improvements to the UI for Kerberos accounts in our settings app it's not an app but the settings UI that we have so till now so far you have seen that it's pretty much just a slider which you can sort of destroy your credentials cache and it shows whether the ticket is valid or not but we want to do a bit more than that so I've got this kind of prototype hacked up so you can now kind of force renewal of tickets manually which might be useful if you have two factor authenticated setup we usually try to automatically renew the tickets before they expire but if you have two factor going on then you need some human interaction to enter the second factor it basically shows that even on the old that's the kind of renewal sorry I didn't get the question you said that the two factor authentication when you get renewed you still have to have the second factor I think so Kerberos renewed because Kerberos has a 90 other Kerberos library allows you to specify prompts and if the Kerberos library client understands those prompts it will prompt your likened PAM case SSSD actually translates the Kerberos prompts into PAM prompts that's why you see it in the GDM because GDM at least stands PAM prompts but here you get it from the normal library so what I guess I'm asking is is that renewed button a literal Kerberos renewal or is it renewed or re-came in the last few years that's what we were discussing yesterday so the thing is like if I understood it correctly the renewal can fail if the KDC doesn't allow you to renew of course so in that case the idea is to fall back to a simple KM of course right I mean if you K and a dash R it's a different term for that then because that's going to get serious I mean it's the right UI I think but I think the wrong terminology well it depends on whether you know what K and a dash R is so we can discuss this and as I say this is subject to heavily discussion actually we had like a year of discussion already on things we got to this point thanks to Leap Soap improvements now we can actually show user experience designers what we meant to have their technical and our discussions proved that translating the technical terms into a good flow a workflow is really really hard without being able to kind of physically touch it I guess it all depends on how much of the underlying technology you want to review to the yes so the other part is you could have a collection of credentials and you might want to say that a particular credential is the primary one that is picked up by default and this is not yet supported but we want to have this supported the renewal part is as you saw just it was it is quite complicated but if we got back to the browsers it's also a complicated thing so when I think half a year ago we sat down with red hats people who work on Firefox and we tried to identify a set of bugs that really prevent us having a good user experience with Kerberos and JSS API overall in Firefox we found out maybe like a 10 ground standing bugs and we started to address them some of them are things that really matter from the UX point of view like automated discovery things, automated configuration but we couldn't get to that point without discussing them with Firefox user experience designers and to get to that level you need to really have things smoothly working and one of the biggest issues that we had was at Firefox when you use JSS API it's a synchronous API you do something you do a single call it goes through all the library layers then does the networking connection and that networking connection might stuck because you don't have access to an actual server broken in the process and sometimes that might take minutes or so and it is done in the same UI thread that the whole UI is drawn you get the whole browser locked down you cannot switch to another tap and do something else at this time this was since forever since the Mozilla times and so guys we are working on implementing the fix for this which is effectively moving the authentication to a separate thread which actually revealed the number of bugs in Fedora design Firefox design and we got the patch accepted which broke some other platforms that was interesting experience so it was backed out and finally I think in two weeks ago it got finally merged with all the fixes and today Firefox 48 with the back port patches made into Fedora 24 updates test it is actually 48.0-5 that made today into the updates test there are still bugs there are some security bugs which were fixed in a privacy mode which was leaking your identities it is an interesting work you want to talk about the auto config one of our proposals we have for auto config is that upstream Mozilla doesn't want to turn it on but we think we might just try to turn it on and the idea here is that when you get to a website that asks you for Kerberos authentication then we'll just do it so long as you have an encrypted tunnel an interesting part if you look into all the documentation that says how to configure your browser to allow Kerberos authentication they all say you go into these preferences you enter this domain that is in fact a user that verifies that you can access a certain URI actually does a match so you can specify literally HTTPS.com as a value of that variable preference and that's it it will match all HTTPS or securely negotiated websites and then Kerberos library will try to obtain service ticket to that machine against your KDC and it's really not until your KDC gives you a ticket to that machine you connect to the machine so there is nothing leaking out to a web server until you get the ticket and usually it's your corporate KDC that controls whether they have a trust between that domain or not and they either reject or allow you to do the thing so we are at the point when with this simple change it does not include any domain name which basically allows us to do a global preference shipped and it's just a change in the default config yes it's a default config change no code change that's a nice thing in Chromium and Chrome it's a bit harder because you either have to buy a system wide setting with explicit domain or you have to do a command line options to launch it to enable the GSS API support and that's why fixing Lips Open WebKit GTK actually gives us a leverage for all the apps for all the embedded things and if you use email you are most likely embedding the embedded engine that presents UHD email within the application if that's a corporate email most likely it will get to some resources that might behind the scenes require authentication to fetch this icon or give picture that somebody put into the email I have a question about the Chromium can you tell me about the cameras configuration so the statically system wide method is it like a configuration file yes it's a configuration file that you cannot redefine as a user where is it stored it sees something the problem is it requires a domain name for every domain you want you can't just use HTTPS colon slash slash it has to be actually the nice thing about KDE that they have supported this by default in the Conqueror so if you use Conqueror well you might get some problems with the actual rendering of the pages but Kerberos authentication and KDE works and this is the policy we are recommending to all browsers that if you have HTTPS just do it automatically there's no leakage of information except to your own KDC yeah the quality you already trust yes and it's a mutual trust anyway between you and KDC otherwise it doesn't work I assume that Conqueror thing is actually supported at a lower level in the browser so anything yes hopefully it's probably the computer or something yes so the flow is synchronous we fix it, this is the bug I'm talking about and this is the Fedora Firefox 48.0 dash 2 which was submitted like a I think last week July 27 I think it didn't make actually into the updates testing because the dash 5 actually overrode it but of course we don't have a synchronous GSS API and that would be real and that would require a lot of standardization work between all the parties which is probably unlikely in reality is this something someone is going to try to do or it's not important so we tried to talk with Microsoft security people on this topic and their answer was clear they are moving away from passwords to other means of authentication so extending Kerberos Kerberos is a mutual authentication both parties know something that is effectively a password the password never leaves into the network it's used to do some sort of calculations for the exchange but it's effectively you need to have this mutual authentication they are moving to other schemes instead of mutual authentication and let the user experience base it on those schemes rather than fixing the fundamental problems at this point we don't want to commit to just trying to support them so practical use of it let's do another funny example again I'm k-ing it in as myself okay use epiphany to connect to the open cloud the instance I have I hacked this instance to support SAML so basically support authentication through epsilon and here epsilon does not ask me for the password because epsilon allows to authenticate with Kerberos on the inside I can work with the documents and I can do some stuff and the user is actually within on cloud is created on fly based on the information that epsilon returns to the application now on cloud has the community kind of split it and next cloud release it their software and the next cloud is actually included in the SAML plugin into the base open source version in on cloud case this was part of on cloud enterprise you had to pay to get it it's 10 lines of code or something integrating with epsilon so I was joking last year and I forced them that basically in 10 lines undermined the on cloud business that was kind of a joke with a future point where on cloud got split not because of me of course but it shows that if you have open core business it's probably not a good not a viable future business need to do something better okay this is epsilon authenticate and against free IPA and now we have supporting non-frequency and like we say there's some bugs in webdav user of the SAML based workflows and overall the SAML flow was supposed to be happening in the browser with a person actually entering credentials or taking it and for effectively it requires you execution of javascript but the server returns you to submit a form back to this system so if you have embedded browser engine which disables javascript for its own reasons and never shows anything to the user you stop to answer this problem SAML has a special profile called ECP basically for browser less clients and not all implementation supported and there are some bugs in it and as we found out even without ECP if you use a protocol different from STTP you get problems so we are still thinking how to fix this and the interesting part is that you can with a simple combination of things you can much further so this is the same environment you don't have any ticket now I authenticate not against my IPA environment but against Active Directory setup that they have at all and I effectively administrator from Active Directory with this ticket and the trust that I established between this Active Directory Forest and FreeAPA I can access resources in FreeAPA domain one of them is my own cloud setup so it's a cross forest trust between the Active Directory instance and FreeAPA so you are actually getting FreeAPA tickets about using your Active Directory login yes and again epsilon notices the Kerberos credentials they are correct valid and the user that is has this Kerberos principle SSSD resolves this user into something usable so epsilon generates a packet of information about this user and submits it to the application the application actually let me stop here you get some ID with the fully qualified username because it's the way how IPA presents this Active Directory users add in their domain here and this is the address in your own cloud terminology where you could send from federated own clouds to each other files against my instance so that first domain is from Active Directory the second one is from the other yes so this is the interesting part you effectively can reproduce a corporate environment at your home at your will if you need maybe you don't need but there are a lot of non-profit organizations non-governmental organizations that actually have some Windows environment and they want to have control over their setup over time while they migrate and they can do this migration without disturbing the actual business that they do like helping people and of course, yes, this is very very enterprise if you run it at home to a certain degree but why not and specifically if this is actually would be not a Windows server running this Active Directory but a Samba AD that would be totally free software implementing the cool enterprise stack yes, and a final thing I didn't get any question about this but what about the disk encryption how we can get rid of the the entering password at boot time boot time so this is a demo that Nathaniel prepared for Red Hat Summit a month ago and just mute it I'll mute it actually this one so here's two Windows, this is a server this is a machine that we are actually putting in the server we install some software called Tang which is a network bound server that verifies yeah, you can there are more details about it I hope the recording that was made will be published and you can see in more detail what was there but on the client side we say that this client is now bound to the server running to the Tang server running on this machine um and after we bound we actually say that the disk of this machine which is encrypted using locks will have encryption bound network network wise, yes to the Tang we just did the binding there on the left yes, it's hard to see yes, now it actually generates the drug out generates a new boot image oh yeah yeah, it's very good to have so you build a new initial range and it reboots here's the magic, I don't type the password on the left it waits until it connects to the server and the server grants access to the secret that was wrapped multiple times so that the server actually doesn't know what's in this secret that the client generated when it encrypted the partition or changed the key for the partition now, he stops the actual server and the yes, and he had to type a password so if you're in your home network or you're at work where you have access to your network the amount that actually can verify you're good yeah, it's kind of a data center at home very very enterprise yeah so that's all only really related to physical network yeah but the same technology it actually does not need to be network bound it could be bound to physical token that can be somehow detected like a Bluetooth beacon or NFC or something yeah it was a whole talk, watch it next week or when it occurs yes so the whole, yes one minute so we really, what we want to achieve with this is to control your own infrastructure and the other part which I don't write here is we are getting older improving experience while maintaining good security defaults is important there is a strong opposition to get the complex things in use like by 50, 60, 70 years old and so on and they still need the same level of security as the savvy young people we are improving this we are getting a chance to ourselves, not only to our parents to actually survive in a world where security is regularly threatened to even exist thank you