HCL Connections Docs 2.0.1 installer fails on Windows - "can not create directory"

 I just recently started a new Connections envoirnment including Docs.
After performing the default Connections installation I prepared the Windows envoirnment for the Docs 2.0.1. After all network path & mounts were set I started the installation....
After some time the Installation Manager cancelled the installation "can not create directory K:". K: is the shared data drive for Docs-Editor component. To workaround the issue I just started installing 2.0 CR3 instead. This installation was successfull.

Afterwards I tried to reproduce the issue in my testing envoirnment on Windows: Same issue here. 2.0 CR3 installation works fine - 2.0.1 installer fails with error message "can not create directory". I opened a case @HCL and after several months they came to the following conclusion:

We discussed this issue in team again and per our communication with L3/Dev, the current installer behavior is a more proper logic as most of customers has few knowledge about CIFS.
We embed checking steps to help them build once and success all the time. If you have security concerns, you can configured CIFS with SYSTEM before the Docs installation. After installation, you can try to change CIFS mount user to the one you'd prefer. But make sure the user you choose has privilege to allow the user that running Docs program access CIFS. The info center documentation will be updated and we will clearly state that customer must configure CIFS with SYSTEM user, as we already have notes in place that the procedure of mounting the shares must be done by SYSTEM user. From current documentation you are correct, I also didn't see it is a "must". It only says, if customer wants to start CIFS automatically, it is a must.

 Lessons learned : always install Docs with Websphere running as "SYSTEM"

IBM Connections - side-by-side migration of Activities fails - table mismatch - OPNACT . OA_NODE

I had a few migration from 5.5 to 6.0 within the last weeks and I came accross the following error every time:

11/02/17 10:32:39.347 CET] Processing table -{ OA_NODE->OA_NODE }- 
11/02/17 10:32:39.347 CET] SELECT * FROM "ACTIVITIES"."OA_NODE" 
[11/02/17 10:32:39.722 CET] Transferring table --{ ACTIVITIES.OA_NODE} -- to table --{ACTIVITIES.OA_NODE }--
[11/02/17 10:32:39.957 CET] ERROR: Error validating data. The number of values is not equal to the number of columns in the destination table OA_NODE
 [11/02/17 10:32:39.957 CET] ERROR: The number of values is 38 while the number of columns is 37 
 [11/02/17 10:32:39.957 CET] error.executing.transfer com.ibm.wps.config.DatabaseTransferException: Column number mismatch

I was able to solve this error by just adding the missing table in the target database (DB2) with the following command:

  ALTER TABLE ACTIVITIES.OA_NODE ADD COLUMN OWNERMEMBERUUID CHAR(36) NULL;
ALTER TABLE ACTIVITIES.OA_NODE ALTER COLUMN OWNERMEMBERUUID DROP DEFAULT;
ALTER TABLE ACTIVITIES.OA_NODE ALTER COLUMN OWNERMEMBERUUID DROP NOT NULL;
ALTER TABLE ACTIVITIES.OA_NODE ALTER COLUMN OWNERMEMBERUUID SET DATA TYPE CHAR(36);
CALL SYSPROC.ADMIN_CMD( 'REORG TABLE ACTIVITIES.OA_NODE' ); 

I opened a PMR for this because I wanted to know what was causing this issue:
The table itself was no longer used in 5.5 which is why it was removed from the 5.5 createDB.sql and the upgrade-50CR1-55.sql script at some point.
But all "old" 5.0 envoirnments that were migrated to 5.5 still have this obsolete table.

To solve this problem you may also just delete the column and its index from the OA_node table in the source db. Thanks to David McCarthy from ICS Support IRL for this hint.


Regards,
Jan

IBM Verse On Premise - problems with integration of IBM Connections Files

I just setup an testing envoirnment for Verse On Premise.
To get the full features I also tried to integrate IBM Connections which enables you to use business cards, photos & also let you use your Connections files for your mail correspondence.


After performing all required steps based on the official documentation it seems to be working fine:

 But when I tried to attach a file from IBM Connections I got the error message "service unavailable".
Checking the IHS access logs the following error is printed:

 [24/Feb/2017:10:00:55 +0100] "OPTIONS /files/basic/api/people/feed?self=true&xhr=1&sq=1 HTTP/1.1" 403 162
[24/Feb/2017:10:00:55 +0100] "OPTIONS /profiles/atom/profile.do?mcode=5b65e3542ff4be446f8cd1db987ac3df HTTP/1.1" 403 162

I tried to find a cause why the access should be "forbidden" but I couldn't find any indicator in theSysOut logs and also accessing the referenced URLs directly was working fine - so I asked Google for a solution.

Luckily I found this article from Roberto Boccadoro. He also had the same error and one of his buddies found a solution:
Instead of using the provided IHS configuration of IBM add the following lines to your configuration in the VirtualHost section:

RewriteEngine on

# Minor change to adjust for Cloud vs On-Premises API variation of parameter name
RewriteCond %{REQUEST_METHOD} PUT
RewriteCond %{QUERY_STRING} ^(.*)uid=(.*)
RewriteRule ^/profiles/photo.do /profiles/photo.do?%1userid=%2 [L]

# Added necessary CORS headers when Origin header present
Header unset Access-Control-Allow-Origin
SetEnvIf Origin "^https://(vop_server_hostname\.)?(domain_name)$" origin_is=$0
Header always set Access-Control-Allow-Origin %{origin_is}e env=origin_is
Header always set Access-Control-Allow-Credentials "true" env=origin_is
Header always set Access-Control-Allow-Headers "X-Requested-With, Content-Type, slug" env=origin_is
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT" env=origin_is

Header always set Access-Control-Max-Age "1000" env=origin_is
Header always set Access-Control-Allow-Methods "POST, GET, OPTIONS, DELETE, PUT" env=origin_is
# Header always set Access-Control-Allow-Headers "X-Requested-With, Content-Type, Origin, Authorization, Accept, Client-Security-Token, Accept-Encoding, slug" env=origin_is
Header always set Access-Control-Allow-Headers "X-Requested-With, Cache-Control, Content-Language, Content-Type, Expires, Last-Modified, Pragma, slug, X-Update-Nonce" env=origin_is
Header always set Access-Control-Expose-Headers "Content-Disposition, Content-Encoding, Content-Length, Date, Transfer-Encoding, Vary, ETag, Set-Cookie, Location, Connection, X-UA-Compatible, X-LConn-Auth, X-LConn-UserId" env=origin_is

# Added a rewrite to respond with a 200 SUCCESS on every OPTIONS request.
RewriteCond %{REQUEST_METHOD} OPTIONS
RewriteRule .* - [R=200,L]

# Remove the Origin header if it exists for other requests (POST, GET, DELETE, PUT). Causes problems with Connections returning 403 response.
RequestHeader unset Origin env=origin_is

....I would have never expected a RewriteRule to be the workaround for a 403 error but now I finally got my envoirnment running 😌

IBM Connections 5.5 CR2 - CCM Upgrade does not complete " the deploy application task has one or more blank passwords "

This week I wanted to install CR2 in my test envoirnment.
IBM Connections upgrade worked perfectly but the CCM upgrade stopped working after around 20 minutes.
Checking the "fn-ce-update.log" actually showed the cause for the problem immediatly:

"C:\IBM\Connections\FileNet\ContentEngine\tools\configure\configmgr_cl" execute -task deployapplication -profile CCM
The Deploy Application task has one or more blank passwords:
Application server administrator password

Do you want to specify these passwords now (passwords will not be saved to disk and will only be used to run the task) (yes/no)? [no]

Wait, what?  I didn't provide this information....
 
Searching on the web, Google directed me to the blog of Nico Meisenzahl . He provided a easy solution for this problem:

• navigate to \FileNet\ContentEngine\tools\configure\profiles\CCM\
• edit "applicationserver.xml"
• look for <property name="ApplicationServerAdminPassword">

• and set the right value for the property -  <value>MYADMINPW</value> 

 You will also have to do this for the CEClient-script (\FNCS\configure\profiles\CCM\applicationserver.xml) if you are performing a update/rollback for this component.

During updates I am always using "baretail" to check the progress of the upgrades. This may spare you much time. Otherwise you will wait more than 1 hour and nothing further will happen.


Hope this will help you.


Happy New Year !

Jan

IBM Traveler 9.0.1.13 server released

IBM just released FP13 for IBM Traveler. You can get it here. 
It will be available on Passport Advantage by August 25th.
The following APAR fixes are included:

LO89772 - Multiple replies sent to meeting chair from invitee using Apple Native Calendar
LO82881 - Domino server may crash if $NTTrack field is corrupted.
LO89471 - Traveler invitee status may be incorrect if using mixed case Internet addresses.
LO89606 - Number of recipients limited to 100 when sending mail from a mobile device.
LO89745 - Traveler server enters constrained state when load balancing a large number of users.
LO89840 - IBM Verse mobile application fails to download entire mail for very large mail documents.
LO89952 - Deleted device still present in the Web Administration UI after the 30 day reap interval.
LO89954 - E-mail not in sent folder on mobile device when user sends and files an e-mail in Notes client

IBM Traveler 9.0.1.13 Release Notes

Traveler FixList

Source: ibm.com

multiple vulnerabilities in IBM Connections

IBM just reported multiple XSS and other vulnerabilities in IBM Connections (all versions).
You will have upgrade your Connections envoirnment to the most recent version & apply the provided IFs to get rid of them.


 CVEID: CVE-2016-0310
DESCRIPTION: IBM Connections 5.5 and earlier is vulnerable to possible host header injection attack that could cause navigation to the attacker's domain.
CVSS Base Score: 4.6
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111450 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N)

VEID: CVE-2016-0305
DESCRIPTION: IBM Connections is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's Web browser within the security context of the hosting Web site, once the URL is clicked. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials.
CVSS Base Score: 5.4
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111422 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)

CVEID: CVE-2016-0307
DESCRIPTION: IBM Connections 5.5 and earlier allows remote attackers to obtain sensitive information by reading stack traces in returned responses.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111447 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

CVEID: CVE-2016-0308
DESCRIPTION: IBM Connections 5.5 and earlier is vulnerable to possible link manipulation attack that could result in the display of inappropriate background images.
CVSS Base Score: 3.5
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111448 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)


 

IBM Domino and TLS - Part 4 - How To fix your trust & security issues

"The server does not support Forward Secrecy" (PFS)
Ciphers supporting PFS were introduced with Domino 9.0.1 FP3 IF2. The only thing you need to do is to upgrade your Domino to the most recent version. You may also have a look at this article.
Please keep in mind that PFS may significantly raise the CPU usage of your servers in huge envoirnments (8000+ users).


This was my last part of "How to fix your trust & security issues".
I hope I was able to help some of you and I would appreciate any kind of feedback from you !

Regards,
Jan