IBM Connections using Active Directory and Nested Groups

Posted by:

Case:
Customer wants to use nested groups in Access control for Communities, also it should be reflected in I'm a Member when user is looking for their communitys and so on. Connections was 4.5CRx

Google search Links that where tried, but did not work for me (for some reason unknown).
https://www.lbenitez.com/2015/11/how-to-enable-nested-ldap-groups-in-ibm.html
https://www-01.ibm.com/support/docview.wss?uid=swg21321308
https://www-10.lotus.com/ldd/lcforum.nsf/869c7412fe5d56b7852569fa007826e3/4aa9a40d4818785f85257b3b004e3240?OpenDocument
https://www.communardo.de/home/techblog/2014/06/04/nested-groups-ibm-connections/

Found something that worked for me (seems logical looking at the description).
https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx
coming from thread
https://social.technet.microsoft.com/Forums/scriptcenter/en-US/f238d2b0-a1d7-48e8-8a60-542e7ccfa2e8/recursive-retrieval-of-all-ad-group-memberships-of-a-user?forum=ITCG

Description:
All groups specified user belongs to, including due to group nesting (Notes 10, 19)
eg. (member:1.2.840.113556.1.4.1941:=cn=Jim Smith,ou=West,dc=Domain,dc=com)
All members of specified group, including  due to group nesting (Note 10)
eg. (memberOf:1.2.840.113556.1.4.1941:=  cn=Test,ou=East,dc=Domain,dc=com) 
Note 10.
The string 1.2.840.113556.1.4.1941 specifies LDAP_MATCHING_RULE_IN_CHAIN. This applies only to DN attributes. This is an extended match operator that walks the chain of ancestry in objects all the way to the root until it finds a match. This reveals group nesting. It is available only on domain controllers with Windows Server 2003 SP2 or Windows Server 2008 (or above).

NOTE: 
All of this is of course done in the context of Deployment Manager.
After doing the changes a full resynch needs to be done with all nodes in the cluster (sometimes also take down node and use synchNode from the node) and restart the node.

Solution is to change my setting in Websphere to reflect this:
nestgroup1
nestgroup2
nestgroup3

Also changed for performance reasons the following (optional):
Reason:
https://www.ibm.com/support/knowledgecenter/SSAW57_8.0.0/com.ibm.websphere.wim.doc/disablingnestedgroupsearches.html
Solution is to change according to instructions

How does it look in the files before and after the change, here are snippets of this:

wimconfig.xml before the change:
      <config:groupConfiguration>
        <config:memberAttributes name="member" objectClass="group" scope="nested"/>
        <config:membershipAttribute name="memberof" scope="nested"/>
      </config:groupConfiguration>

wimconfig.xml after the change:
      <config:groupConfiguration>
        <config:memberAttributes name="member:1.2.840.113556.1.4.1941:" objectClass="group" scope="nested"/>
        <config:membershipAttribute name="memberOf:1.2.840.113556.1.4.1941:" scope="nested"/>
      </config:groupConfiguration>

security.xml before the change (you can not cut and paste any of these because some parameters are unique to your environment):
  <userRegistries xmi:type="security:WIMUserRegistry" xmi:id="WIMUserRegistry_1" serverId="" serverPassword="{xor}" realm="defaultWIMFileBasedRealm" ignoreCase="true" useRegistryServerId="false" primaryAdminId="wasadmin" registryClassName="com.ibm.ws.wim.registry.WIMUserRegistry"/>

security.xml after the change (you can not cut and paste any of these because some parameters are unique to your environment):
  <userRegistries xmi:type="security:WIMUserRegistry" xmi:id="WIMUserRegistry_1" serverId="" serverPassword="{xor}" realm="defaultWIMFileBasedRealm" ignoreCase="true" useRegistryServerId="false" primaryAdminId="wasadmin" registryClassName="com.ibm.ws.wim.registry.WIMUserRegistry">
    <properties xmi:id="VMMURProperty_1" name="com.ibm.ws.wim.registry.grouplevel" value="1"/>
  </userRegistries>
 

Shortcut to this document: https:// https://https://stage.infoware.com/?p=7180
Thats all folks

0

Blog

, , , , , , , , , ,

IBM Connections experts available for you

Posted by:

Do you need access to experts with market leading knowledge of IBM Connections? Are you starting up a new Connections project or do you need help with one that is in progress? Could you use the help of a recognized expert to help you solve the issues that are delaying deployment? We can help!

Infoware have been working with IBM Connections since 2008 and have consultants with broad and deep knowledge of IBM Connections environments and development. When it comes to deploying new environments, upgrading existing installations, integrating with other systems or systems development our consultants are world class.

We have a portfolio of customer success stories for projects integrating IBM Connections with web content management systems such as EPI Server and IBM Docs with branding, customizations and systems integration.

We are recognized experts at adding extended functionality to IBM Connections environments as well as having specialist skills in user adoption methodologies and systems training.

 

 

Apart from IBM Connections we also offer expertise on IBM Chat, IBM WebSphere Portal, IBM WebSphere and IBM Notes/Domino.

 

Contact us if you are interested in our services or in a partnership.

 

0

Blog

, , ,

Community Templates by DomainPatrol Social

Posted by:

first: Happy Prosperous New Year! We hope you had a couple of relaxing days around Christmas and now are ready for new adventures in 2016!

This is just a short newsflash with two interesting topics we think you'll like:

New release of DomainPatrol Social for IBM Connections. This will put a smile on all of you Community Managers. We have seen for a long time that a key focus for companies today is to seek to minimize the time and effort they waste on creating something that already exist. To stop reinvent the wheel for good, and instead focus on developing new inventions.

The new function we're talking about is Community Templates. This will let you re-use your perfectly good and working Communities over and over again, with modifications if you like. Find the Community you would like to clone, select which parts of it you want to copy and click OK. Simple as that.

The release is ready to ship, so email us right away for more information, quotes, evaluation license or anything else.

And remember, DomainPatrol Social solves the most difficult tasks in IBM Connections concerning contents and users, such as Merge Communities, Move Communities, Move and Merge Blogs, Activities, Files, Wikis etc. We also handle Complete User Management for Files, Blogs, Wikis etc. Merge Profiles or Copy User Access. Take care of your orphan content today.

New project starts, others end. The organization is constantly changing and consequently your needs.

 

2

Blog

, , , , , , , , , , ,

Error when installing IBM Connections 5.5 with CCM!

Posted by:

Last week I started to install IBM Connections 5.5 in our lab to prepare my self for upcoming customer projects with installation or upgrading customers' sites to Connections 5.5. This first install was done on a single Windows server but I used LDAP from a current Sametime environment (so I can integrate Sametime and Connections later on).

Windows Server Configuration
———————————————-
4 CPU, 16 GB RAM
C:\ 50 GB, D:\ 100 GB

I used IBM Connections Wiki Documentation (https://www-01.ibm.com/support/knowledgecenter/SSYGQH_5.5.0/welcome/welcome_admin.html)  but also the great "step-by-step" document written by IBM Connections Support Engineer Charlie Price (https://alturl.com/a3if4). "Step-by-step" guides can be great but do NOT trust them all the way, ALWAYS read the official wiki/technote documentation from IBM!

I installed the following software on a Windows 2008 R2 Server.
– WAS 8.5.5.7
– IBM HTTP Server 8.5.5.7
– DB2 10.5 FP6
– TDI 7.1.1 FP3
– Installation Manager 1.8.3

After installing all the above, creating WAS cell and profiles, configuring LDAP, creating DB2 databases, populate profiles and configuring IBM HTTP Server,  is it was time to do the actual Connections install. As this test environment will be used to evaluate all the features in version 5.5, I also chose to install IBM Connections Content Manager (CCM). To be able to install CCM you have to specify a folder that contains the correct FileNet installation software. For Windows you need to download these files and add them to the folder:

– 5.2.1-P8CPE-WIN.EXE
– 5.2.1.2-P8CPE-WIN-FP002.EXE
– 5.2.1.2-P8CPE-CLIENT-WIN-FP002.EXE
– IBM_CONTENT_NAVIGATOR-2.0.3.EXE
– IBM_CONTENT_NAVIGATOR-2.0.3.5-FP005.EXE

After answering all the Connections Installation Wizard questions and settings, I could finally click on the "Install" button 🙂
But unfortunately the installation ended with an error message…. 🙁

The IBM Installation Manager logs indicated that the Connections Installation Wizard where unable to finish some of its "post-install task". After a closer look in the IM logs I could see that the installation wizard where trying to uninstall Connections. OK, I then opened the install.log in the Connections install folder, in my case D:\IBM\Connections. This log contains information about all WAS configuration and Connections application installations that is done during installing Connections. I soon found this in the log:

Create CCM data directory: [D:\IBM\Connections\data\shared\ccm]
Replace place holders in template file [D:\IBM\Connections\lib\filenet\ce_silent_install_windows.txt] to new file [D:\IBM\Connections\tmp\ce_silent_install_windows.txt].
RUN: "D:\Download\CCM\FileNet\5.2.1-P8CPE-WIN.EXE" -i silent -f "D:\IBM\Connections\tmp\ce_silent_install_windows.txt"

D:\IBM\Connections>"D:\Download\CCM\FileNet\5.2.1-P8CPE-WIN.EXE" -i silent -f "D:\IBM\Connections\tmp\ce_silent_install_windows.txt"
Exit code: 0
RUN: "D:\Download\CCM\FileNet\5.2.1.2-P8CPE-WIN-FP002.EXE" -i silent -f "D:\IBM\Connections\tmp\ce_silent_install_windows.txt"

D:\IBM\Connections>"D:\Download\CCM\FileNet\5.2.1.2-P8CPE-WIN-FP002.EXE" -i silent -f "D:\IBM\Connections\tmp\ce_silent_install_windows.txt"
Exit code: -1
ERROR:  FileNet [ce] installer [5.2.1.2-P8CPE-WIN-FP002.EXE] failed, exit code [-1]:
Traceback (most recent call last):
File "D:\IBM\Connections\lib\ccm.py", line 318, in do_install
self.install_filenet_software()
File "D:\IBM\Connections\lib\ccm.py", line 371, in install_filenet_software
self.install_fn_component(c)
File "D:\IBM\Connections\lib\ccm.py", line 413, in install_fn_component
raise Exception("FileNet [%s] installer [%s] failed, exit code [%s]:" % (comp, binary, result))
Exception: FileNet [ce] installer [5.2.1.2-P8CPE-WIN-FP002.EXE] failed, exit code [-1]:
LotusConnections Component [CCM] install is FAILED
—

The installation continued after this,  installing all the other applications, the "only" failed installation was the CCM application. OK, So now I started to troubleshoot this error. Was the 5.2.1.2-P8CPE-WIN-FP002.EXE file corrupt? I downloaded a new one and tried to install Connections again but I got the same error message. I then checked the VMware resources, had I enough CPU or RAM? Yes. How about free disk space for the temp folder? CCM needs at least 6 GB otherwise the installation will fail. No that wasn't it. I tried to install Connections once more, this time I made a copy of the D:\IBM\Connections\FileNet folder under installation so I could investigate all the files created in this folder during installation. This as the Connections Installation Wizard deletes this folder when it fails to make a successful installation of IBM Connections. It's hard to troubleshot if logs and other files are deleted by the installation… 🙂

So what did I find in the FileNet folder? In the log file ce_install_log_5.2.1.2.txt I found the following error:

—
so jan 24 20:05:08:104 Error while building the EAR file in the installer
Status: FATAL ERROR
Additional Notes: FATAL ERROR – sö jan 24 20:05:10:818 [ERROR]
BUILD FAILED
D:\IBM\Connections\FileNet\ContentEngine\lib\mergeears.xml:99: The following error occurred while executing this line:
D:\IBM\Connections\FileNet\ContentEngine\lib\mergeears.xml:135: The following error occurred while executing this line:
D:\IBM\Connections\FileNet\ContentEngine\lib\mergeears.xml:202: Unparseable date: "01/24/2016 08:05 em"
at org.apache.tools.ant.taskdefs.Touch.checkConfiguration(Touch.java:256)
at org.apache.tools.ant.taskdefs.Touch.execute(Touch.java:280)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:292)
at sun.reflect.GeneratedMethodAccessor6.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:56)
at java.lang.reflect.Method.invoke(Method.java:620)
at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106)
at org.apache.tools.ant.Task.perform(Task.java:348)
at org.apache.tools.ant.Target.execute(Target.java:435)
at org.apache.tools.ant.Target.performTasks(Target.java:456)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1393)
at org.apache.tools.ant.helper.SingleCheckExecutor.executeTargets(SingleCheckExecutor.java:38)
at org.apache.tools.ant.Project.executeTargets(Project.java:1248)
at org.apache.tools.ant.taskdefs.Ant.execute(Ant.java:440)
at org.apache.tools.ant.taskdefs.CallTarget.execute(CallTarget.java:105)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:292)
at sun.reflect.GeneratedMethodAccessor6.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:56)
at java.lang.reflect.Method.invoke(Method.java:620)
at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106)
at org.apache.tools.ant.Task.perform(Task.java:348)
at org.apache.tools.ant.Target.execute(Target.java:435)
at org.apache.tools.ant.Target.performTasks(Target.java:456)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1393)
at org.apache.tools.ant.helper.SingleCheckExecutor.executeTargets(SingleCheckExecutor.java:38)
at org.apache.tools.ant.Project.executeTargets(Project.java:1248)
at org.apache.tools.ant.taskdefs.Ant.execute(Ant.java:440)
at org.apache.tools.ant.taskdefs.CallTarget.execute(CallTarget.java:105)
at org.apache.tools.ant.UnknownElement.execute(UnknownElement.java:292)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:95)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:56)
at java.lang.reflect.Method.invoke(Method.java:620)
at org.apache.tools.ant.dispatch.DispatchUtils.execute(DispatchUtils.java:106)
at org.apache.tools.ant.Task.perform(Task.java:348)
at org.apache.tools.ant.Target.execute(Target.java:435)
at org.apache.tools.ant.Target.performTasks(Target.java:456)
at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1393)
at org.apache.tools.ant.Project.executeTarget(Project.java:1364)
at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41)
at org.apache.tools.ant.Project.executeTargets(Project.java:1248)
at org.apache.tools.ant.Main.runBuild(Main.java:851)
at org.apache.tools.ant.Main.startAnt(Main.java:235)
at org.apache.tools.ant.launch.Launcher.run(Launcher.java:280)
at org.apache.tools.ant.launch.Launcher.main(Launcher.java:109)
Caused by: java.text.ParseException: Unparseable date: "01/24/2016 08:05 em"
at java.text.DateFormat.parse(DateFormat.java:369)
at org.apache.tools.ant.taskdefs.Touch.checkConfiguration(Touch.java:249)
… 44 more

Total time: 9 seconds

—
So I opened the mergeears.xml file and looked at the row 202. Hmm, something with dates??? OK, lets ask Google about "mergeears.xml:202: Unparseable date". The first hit I got was this one.
https://www-01.ibm.com/support/docview.wss?uid=swg1PJ43439 from december 15, 2015. "CPE FIX PACK INSTALLER FAILS WHEN USING FINNISH(FINLAND) ON WINDOWS". Aha! So that was the cause. Well I am not using Finnish but as I am sitting in Stockholm, Sweden my Windows Server is using Swedish as date format and location (for system locale I use English US). So it appears there is a bug in the 5.2.1.2-P8CPE-WIN-FP002.EXE fixpack, that will make the installation fail if the date format and location on the operating system is something other than English…

"… The 5.2.1.2-CPE installer fails with a fatal Unparseable date
error when Region and Language is set to Finnish(Finland) on
Windows.  It's probable that this is a general installer issue
that will fail for any Region and Language that has a different
date format.

The problem is fixed in the ant script, which should now work
for any non English locales also Resolved by 5.2.1.3-P8CPE-FP003 and higher."

The workaround for this is to always use English as date format and location during installation of IBM Connections. After the installation is done you can change date format and location to the one that you prefer. 🙂

So did it work? Yes, I changed date format and location to English, tried to install IBM Connections again and now the installation finished SUCCESSFULLY with that lovely little green icon!

3

Administrator, Blog

, , , , , , , , ,

I’m featured IBM Champion on the new IBM Social Business User Community site

Posted by:

Are you interested in the IBM Social Business user community? Then this site is a place for you.

Here you can read about events from both IBM and independent user groups, webcasts, twitter feeds, blogs and testemonials.

A place to get together, share ideas and talk about what’s new in social.

And if that is not enough, right now I'm featured IBM Champion on the site as well.

So why wait, click here now.

0

Blog

, , , , , , , , ,

Merry Christmas & Happy New Year from Infoware

Posted by:

It's soon Christmas and we all look forward to holidays with lots of relaxing days with friends and families. We would like to take this opportunity to thank all our customers, partners, resellers and friends for a fantastic year!

To all of you from all of us we wish you a very warm, friendly, delicious, happy Christmas and a prosperous, sparkling New Year!

See you all again in 2016!

Instead of Christmas gifts we have this year made a donation to the scientists at The Swedish Cancer Society, where they are trying to find a cure for cancer.

 

0

Blog

IBM Champion newbie! (and a rock star?)

Posted by:

This must be a perfect Tuesday. Yesterday I received the news that I am selected as IBM Champion for Social Business for 2016. My phone almost got over heated from all the congrats messages, Twitter mentions and emails. I was thinking: "Is this how it feels to be a rock star?" It must be. 🙂

This has been a fantastic year for me which started in Orlando and IBM ConnectED, rolled on with Social Connections in Boston, working hard through spring and summer with lots and lots of projects and deals to complete and now peaked in November and Social Connections in Stuttgart.

Thanks to the IBM Champion team for selecting me, thanks to those who nominated me, thanks to my company Infoware for believing in me, and thanks to the Social Connections team for challenging me to do great things.

You are all awesome!

 

2

Blog

, , , , , , ,

Page 4 of 6 «...23456