contentengine Archives - iparagons blog

Procedure to Change System User Password in IBM CPE 5.5.1

March 1, 2019

In IBM CPE 5.5.1, users can change the password of the System User via Administration Console for Content Platform Engine (ACCE). The procedure is required if the System User account does NOT change but the password will change. If both the user account and password are changed at the same time, no special process is required in IBM CPE 5.5.1.

Change System User Password IBM CPE 5.5.1

With the CPE running, change the current System User’s password in the LDAP to the desired new value.

Note: In Case Your system user is also admin user and bind in WAS CPE or ICN/ICM JVM profile and you have to perform additional changes in WAS Console.

Procedure to Change Password:

Before Changing password in LDAP, open WAS Console, go to global security settings, federated repositories, AD tab tab like this:

Log onto ACCE using a domain admin account. If the System User is the domain admin, the new password will be used to login.
After successful logon, go to Directory Configuration tab and change the user’s password as described:

administration_console_for content_platform_engine_directory_config_tab

Navigate to the properties tab for the domain.
Edit the System User name, retype the System User name using different case (e.g. all caps, all smalls, just something different).
Edit the password to be that of the desired (e.g. the new password of System User) account and Save.

administration_console_for content_platform_engine_properties_tab

Verify proper system function. For example, navigate to ACCE to the Workflow system down to the configuration of a component queue. If this is possible, the PE service is able to utilize the System User as expected. Furthermore, if same user is used for Component queues than you have to change its password there as demonstrated here:

No special procedure is required further. Even you just don’t need to restart CPE enable WAS JVM. But for safe side, you can restart IBM FileNet P8 services. You also need to verify Content Platform Engine (CPE) Health page.

In case you want to change both user and password following steps will be performed:

Create a new user in LDAP.
Logon to ACCE, with the previous user name and password.
Go to domain properties tab.
Retype New user name in any case (lower, uper or mix letter).
Retype its newly user’s modified password.
Save and close.
Verify system functionalities completely.

Remember:

In IBM CPE 5.5.1, bootstrap user complexity has been removed and its now works as system user instead of bootstrap user. Once you updated to version 5.5.1, it’s no more longer associated to GCD and JNDI bindings.

For more details go to following tech notes:

https://www-01.ibm.com/support/docview.wss?uid=ibm10737163

https://www.ibm.com/support/knowledgecenter/en/SSNW2F_5.5.0/com.ibm.p8.security.doc/p8psh017.htm

IBM Case Manager Client

IBM Case Manager Client Search Template Takes Time or Failed to Search Document

November 13, 2018

I’ve recent experienced a problem while using search template in IBM Case Manager Client (ICM). This issue arises after upgrading ICM from 5.1.1.x to 5.3.x in my case. Secondly, in our environment, CPE and XT on same JVM while, ICM and ICN are deployed on anther WAS profile. When tried to search document by providing metadata for that document, it takes some time first of all and after that, an exception occurred which is described below:

Problem:

Your request cannot processed. An error occurred on the Application Server Contact your system administration with the following information: FNRCD0009, CIWEB1016.

Environment:

WAS 8.5.5.x

ICM 5.3.x

ICN 3.0.x

CPE 5.2.x

Solution to resolve IBM Case Manager Search Template Loading:

Based on the error number FNRCD0009, CIWEB1016 I found this is an error related to Content Platform Engine (CPE) search (mostly text search).

Please perform the following steps:

1) Open the ICN web Admin console

2) Open Repositories

3) Select the affected repository

4) Connect to the repository as the repository admin

5) Open the Search tab

6) Increase the timeout setting x2 (e.g. 600)

7) Test the search template.

If it is still the same, go on and also following the following steps:

1) Increase the transaction lifetime timeout and the ORB Service timeout for WAS.

Open the WAS Admin console > Application server > Container Services > Transaction Service:

Set Total transaction lifetime timeout = 300

Open the WAS Admin console > Application server > Container Services > ORB Service:

Set Request timeout = 300

2)In the CPE server, increase the transaction lifetime timeout and the ORB Service timeout for the CPE application.

Open the WAS Admin console > CPE Server > Container Services > Transaction Service:

Set Total transaction lifetime timeout = 300

Open the WAS Admin console > CPE server > Container Services > ORB Service:

Set Request timeout = 300

Again, test the search in ICM client. Problem will be resolved.

IBM Case Manager (ICM)

IBM Case Manager Client Case History tab is slow sometimes

November 6, 2018

Case history tab is slow sometimes in case management software (ICM), when viewing the History tab in the Case Information widget in IBM Case Manager Client, if the case has a large number of case history records associated with it and the Event table in Content Engine has a large number of records, the views might load very slowly. Sometimes the following timeout error occurs, with very slow responses:

The case history is unavailable because of the following error: timeout exceeded (CDEWG5206E).

Problem

Open a case in the IBM Case Manager Client and click to the History tab in the Case Information widget. As you change the views, such as “Show Summary/All” and “for All/Case/Comments/etc.”, they load very slowly, for example, nearly in one minute. Below is the screenshot of problem description:

Cause

The information displayed on the History tab is stored in the Event table in the Content Engine database. The Event table index might not have been updated or configured to fit your environment needs. This causes a database performance problem.

Environment

ICM 5.1.1.x / 5.2.1.x ? 5.3.x
WAS 7.x / WAS 8.x
CPE 5.1.x / 5.2.x

Solution

Stop IBM FileNet P8 Services.
In the Content Engine Platform database (Target OS Schema), create one new index with the following definition:

DB2:

CREATE UNIQUE INDEX I_CASE_FOLDER
ON db2admin.EVENT (U88E7_CMACMCASEFOLDER ASC, AUDIT_SEQUENCE DESC)
INCLUDE (OBJECT_CLASS_ID, SOURCE_OBJECT_CLASS_ID, HOME_ID)
COMPRESS NO ALLOW REVERSE SCANS

Oracle:

CREATE INDEX I_CASE_FOLDER ON EVENT
(U88E7_CMACMCASEFOLDER ASC, AUDIT_SEQUENCE ,OBJECT_CLASS_ID, SOURCE_OBJECT_CLASS_ID, HOME_ID)
LOGGING
TABLESPACE USERS
PCTFREE 10
INITRANS 2
MAXTRANS 255
STORAGE (
INITIAL 64K
NEXT 1M
MINEXTENTS 1
MAXEXTENTS UNLIMITED
PCTINCREASE 0
BUFFER_POOL DEFAULT
)
COMPRESS REVERSE ;

Once done. Start IBM FileNet P8 Services.
Test ICM Client and click on history tab in Case Information Widget again. Now there will be no delay and Case History will be shown timely as mentioned below:

For further details, please visit this tech note http://www-01.ibm.com/support/docview.wss?uid=swg21587662

IBM Content Platform Engine (CPE)

How to Change Bootstrap User Password – IBM CPE 5.x above

July 31, 2018

The Directory Service user account and password are normally used in two product components: FileNet Enterprise Manager (FEM), and the application server. A coordinated update procedure should be followed when there is a need to change the user account and/or password. This procedure applies to FileNet Content Engine 5.x and above.

These steps are required to do for IBM FileNet P8 so in 5.1 environment we use FileNet Enterprise Manager (FEM) while in 5.2, You have to use Administration Console for Content Platform Engine (ACCE). Following is the complete step by step procedure to change bootstrap user password cpe 5.1:

Backup the Engine-##.ear file, where ws denotes WebSphere, wl denote WebLogic, and jb denotes JBoss. You can then revert to last good known EAR file in case changing the password fails.
Path: /opt/IBM/FileNet/ContentEngine/tools/configure/profiles/CEConfig/ear/Engine-ws.ear
On the server containing Content Engine, start the Configuration Manager.
a. Load the Configuration Manager profile that describes your installation.
Path: /opt/IBM/FileNet/ContentEngine/tools/configure/./configmgr_cl gui (To Load Configuration Profile)
b. Click Configuration Bootstrap Properties. Do not change anything yet. The Bootstrap user password is the field you will change later in this procedure.
c. Leave this window open while doing the following steps.
Log in to Enterprise Manager (FEM) as GCD administrator gcd_admin.

a. In Enterprise Manager, right-click the Root Folder, and then click Properties.
b. Click the Directory Configuration tab.
c. Select the row that represents the configuration parameters pointing to the LDAP location that the Content Engine system user belongs to, and click Edit.
d. When the Modify Directory Configuration dialog box opens, view the value for the Directory Service User account.

4. Locate the value for the Directory Service (AD) User account. This should be the same value as described in step 3d.
a. Navigate to the authentication provider panel containing the ID and password for the Directory Service User account.
WebLogic: this will be the value of the Principal field in the Authentication Provider for the WebLogic domain containing Content Engine.
WebSphere: this will be the bind user account in the Profile containing Content Engine. JBoss: the Directory Service User account is contained in the login-config.xml file.

b. Do not change anything yet. Leave the console open while doing the remaining steps.
5. Log in to your directory server (AD).
a. Navigate to the location containing the account for the Content Engine system user.
b. Change its password.
c. Save and apply.
6. Return to Enterprise Manager Dialog box.
a. Change the Directory Service User’s password to the new password.
b. Click Apply and OK to close the dialog box.
7. Return to the window containing Configuration Manager.
a. In the Configure Bootstrap Properties task, set the Bootstrap Operation property to Modify Existing.
b. Confirm that the Bootstrapped EAR file property contains the path to the bootstrap file you need to edit.
Path: /opt/IBM/FileNet/ContentEngine/tools/configure/profiles/CEConfig/ear/Engine-ws.ear
c. Change the Bootstrap user password. Use Configuration Manager’s features to save and run the task.
d. Run Configuration Manager’s Deploy Application.

8. Restart the application server or machine.
9. Verify the change by logging on to Enterprise Manager as a GCD administrator (gcd_admin) and performing a user and group look up.
Open FEM–Edit–Provide New Password in the Password
Field-Apply-OK-Connect
10. If you are using p8admin to connect to CE, you need to retype the new
password on the Process Engine Process Task Manager (PE PTM) Security
tab and on the AE/XT PTM for component manager (General Tab).
Path: /opt/IBM/FileNet/ProcessEngine/./vwtaskman

11. To Change password for ICMSupportOperations component properties file
Path: /opt/IBM/FileNetWebClient/Router/./routercmd.sh
Change these passwords one by one.
11.1 CE_Operations–Advanced Tab–Change Password
11.2 ICM_SupportOperations–Advanced Tab–Change Password
11.3 RM_Operations–Advanced Tab–Change Password
11.4 RM_Workflowutil–Advanced Tab–Change Password
12. If p8admin is used for the JAAS credentials configuration of a component
adaptor, you need to reenter the password.

Path: Login to WorkplaceXT-Tools-Administration-Process Configuration Console-Right Click on PE_1-Connect-Component Queues-Adaptor Tab-Change Password-Commit the Changes.
12.1 CE_Operations-Adaptop Tab-Change Password
12.2 ICM_SupportOperations Adaptop Tab-Change Password
12.3 RM_Operations– Adaptop Tab-Change Password
12.4 RM_Workflowutil– Adaptop Tab-Change Password
12.5 WS_Request– Adaptop Tab-Change Password
13. Reboot the Application Server or machine.
14. Verify the Changes.

Please visit this ibm tech note for details: http://www-01.ibm.com/support/docview.wss?uid=swg21442694.

In case of failure or password change activity unsuccessful, you can revert back as mentioned here:

Connect to GCD schema.

Revert back Active Directory (AD) Bootstrap User Password.

Stop Application Server Services.

select * from FNGCD order by 1;

select LAST_EPOCH_ID from FNGCD where EPOCH_ID=0;

UPDATE FNGCD SET EPOCH_ID=EPOCH_ID * -1 where EPOCH_ID=109;

Note: Change EPOCH_ID value as per your environment.

COMMIT;

Restart Services.

Note: If your environment is on CPE 5.5.0, IBM Would not allow to change password for bootstrap user account because workflow system unable to start after changing password. For details please review: https://www-01.ibm.com/support/docview.wss?uid=ibm10739669 . In 5.5.1 environment you can easily change bootstrap user’s password using ACCE.

Please advise users – Do not change the password of bootstrap user in CPE 5.5.0.

If the customer has already changed the password, there are two ways to recover:

a) Change the password of the bootstrap user back to original value.

b) Upgrade the CPE 5.5.0 to 5.5.1. In CPE 5.5.1 users is able to change the password of bootstrap users using ACCE.

contentengine