Manually disabling LDAP authentication - Revision history

Jderrick: Reformatting IBM CMOD LDAP examples, expanded warnings, reformatted links to IBM

2017-12-14T18:15:40Z

Reformatting IBM CMOD LDAP examples, expanded warnings, reformatted links to IBM

← Older revision		Revision as of 18:15, 14 December 2017
Line 1:		Line 1:
			{{TOCright}}
	=== What happened? ===		=== What happened? ===

Line 9:		Line 10:
	Of course, without being able to start Content Manager OnDemand or being able to log in, you can't turn LDAP off. If you check the OnDemand Library Server's console output, you might find errors like these:		Of course, without being able to start Content Manager OnDemand or being able to log in, you can't turn LDAP off. If you check the OnDemand Library Server's console output, you might find errors like these:

	~~<code>~~		arssockd (ARCHIVE): ARSSOCKD 2 437 ARS0437E The OnDemand stash file >< either does not exist or is not valid. Return Code=4.

	arssockd (ARCHIVE): ARSSOCKD 2 437 ARS0437E The OnDemand stash file >< either does not exist or is not valid. Return Code=4.

	~~</code>~~

	If your server does start up, but you can't log in, you'll need to follow these instructions to turn off LDAP authentication, so you can try to figure out what went wrong.		If your server does start up, but you can't log in, you'll need to follow these instructions to turn off LDAP authentication, so you can try to figure out what went wrong.

	These instructions will manipulate the contents of the CMOD database directly to disable LDAP. ~~USE THESE INSTRUCTIONS WITH CAUTION~~.		[[File:Attention.png\|80px\|left]] WARNING: These instructions will manipulate the contents of the CMOD database directly to disable LDAP. You could damage your OnDemand server if you're not careful. ALWAYS ensure you have a backup of your database to restore from. Alternately, you can use <code> arsdb -xlvf </code> to export a copy of the IBM CMOD database tables, which can be imported again to revert any changes you may have made with the <code> arsdb -ilvf </code> command.

	=== Directions ===		=== Directions ===
Line 23:		Line 20:
	First, check your database:		First, check your database:

	~~<code>~~
	$ db2 connect to archive		$ db2 connect to archive

Line 31:		Line 27:
	SQL authorization ID = ODADMIN		SQL authorization ID = ODADMIN
	Local database alias = ARCHIVE		Local database alias = ARCHIVE
	~~</code>~~

	Then check the system to see what the current value of the SYS_MASK field is:		Then check the system to see what the current value of the SYS_MASK field is:

			$ db2 "select SYS_MASK from arssys"

	~~<code>~~
	~~$ db2 "select SYS_MASK from arssys"~~

	SYS_MASK		SYS_MASK
	----------		----------
Line 43:		Line 37:

	1 record(s) selected.		1 record(s) selected.
	~~</code>~~

	Even if the value returned on your system is different, you can still use the following SQL to turn off the LDAP option:		Even if the value returned on your system is different, you can still use the following SQL to turn off the LDAP option:

	~~<code>~~
	$ db2 "update arssys set sys_mask=bitandnot(sys_mask, 4)"		$ db2 "update arssys set sys_mask=bitandnot(sys_mask, 4)"
	DB20000I The SQL command completed successfully.		DB20000I The SQL command completed successfully.
	~~</code>~~

	To double check that the change was made, simply repeat the query to see that the value has changed.		To double check that the change was made, simply repeat the query to see that the value has changed.

	~~<code>~~
	$ db2 "select SYS_MASK from arssys"		$ db2 "select SYS_MASK from arssys"

Line 62:		Line 52:

	1 record(s) selected.		1 record(s) selected.
	~~</code>~~

	If your starting value was a different number -- for example, 20, then your result should be "16".		If your starting value was a different number -- for example, 20, then your result should be "16".
Line 71:		Line 60:
	As always, don't forget to wrap up your session by closing your connection to the database:		As always, don't forget to wrap up your session by closing your connection to the database:

	~~<code>~~		$ db2 terminate
	$ db2 terminate		DB20000I The TERMINATE command completed successfully.
	DB20000I The TERMINATE command completed successfully.
	~~</code>~~

	If your CMOD server wasn't able to start, try starting it at this point. If your CMOD server was able to start, but you weren't able to log in, stop and start the Library server so the change can take effect.

	~~=== Additional Resources ===~~		If your CMOD server wasn't able to start, try starting it at this point.

	~~The root cause of this issue~~ is ~~that~~ you ~~likely do not have a stash file configured for LDAP on CMOD~~. ~~Here are some IBM Knowledgebase Articles about Content Manager OnDemand stash files and LDAP:~~		If your CMOD server was able to start (and is still running) but you weren't able to log in, stop and start the Library server so the change can take effect.

			=== Additional CMOD LDAP Resources ===

	~~Content Manager OnDemand V9~~.~~0/9.5 LDAP authentication process:~~		The root cause of this issue is that you likely do not have a stash file configured for LDAP on CMOD.

	~~http~~:~~//www-01.ibm.com/support/docview.wss?uid=swg21597246~~		Here are some IBM Knowledgebase Articles about Content Manager OnDemand stash files and LDAP:

	~~Content Manager OnDemand V8~~.~~5 and later~~ LDAP authentication ~~to active directory server fails with an error:~~		[http://www-01.ibm.com/support/docview.wss?uid=swg21597246 IBM CMOD LDAP authentication on V9.0/9.5]

	http://www-01.ibm.com/support/docview.wss?uid=swg21610510		[http://www-01.ibm.com/support/docview.wss?uid=swg21610510 IBM CM OnDemand V8.5 and later LDAP authentication to active directory server fails]

	~~Using arsstash files for authenticating to DB2, Oracle, or LDAP:~~		[http://www-01.ibm.com/support/docview.wss?uid=swg21608635 Using OnDemand arsstash files for authenticating to DB2, Oracle, or LDAP]

	http://www-01.ibm.com/support/docview.wss?uid=swg21608635

Jderrick: Added bit-and-not code to simplify instructions. Credit to Alessandro Perucchi.

2015-08-03T14:28:54Z

Added bit-and-not code to simplify instructions. Credit to Alessandro Perucchi.

← Older revision		Revision as of 14:28, 3 August 2015
Line 21:		Line 21:
	=== Directions ===		=== Directions ===

	First, check your ~~system to see what the current value of the SYS_MASK field is~~:		First, check your database:

	<code>		<code>

	$ db2 connect to archive		$ db2 connect to archive

Line 32:		Line 31:
	SQL authorization ID = ODADMIN		SQL authorization ID = ODADMIN
	Local database alias = ARCHIVE		Local database alias = ARCHIVE
			</code>

			Then check the system to see what the current value of the SYS_MASK field is:

			<code>
	$ db2 "select SYS_MASK from arssys"		$ db2 "select SYS_MASK from arssys"

Line 41:		Line 43:

	1 record(s) selected.		1 record(s) selected.

	~~$ db2 terminate~~
	~~DB20000I The TERMINATE command completed successfully.~~
	</code>		</code>

	If the ~~result of this query~~ on your system is ~~the same as the example~~, you can ~~issue~~ the following ~~commands~~ to ~~disable~~ LDAP~~. If your results are different, skip to the next section.~~		Even if the value returned on your system is different, you can still use the following SQL to turn off the LDAP option:

	<code>		<code>
			$ db2 "update arssys set sys_mask=bitandnot(sys_mask, 4)"
	~~$ db2 connect to archive~~

	~~Database Connection Information~~

	~~Database server = DB2/AIX64 10.1.4~~
	~~SQL authorization ID = ODADMIN~~
	~~Local database alias = ARCHIVE~~

	$ db2 "update arssys set sys_mask=0"
	DB20000I The SQL command completed successfully.		DB20000I The SQL command completed successfully.
	~~$ db2 terminate~~
	~~DB20000I The TERMINATE command completed successfully.~~

	</code>		</code>

	If the ~~results of~~ the query ~~are different on your system, you likely have other options enabled~~.		To double check that the change was made, simply repeat the query to see that the value has changed.

	<code>		<code>

	$ db2 "select SYS_MASK from arssys"		$ db2 "select SYS_MASK from arssys"

	SYS_MASK		SYS_MASK
	----------		----------
	20		0

	1 record(s) selected.		1 record(s) selected.

	~~$ db2 terminate~~
	~~DB20000I The TERMINATE command completed successfully.~~
	</code>		</code>

	~~In this~~ example, ~~simply subtract 4 from~~ the value ~~returned on your system~~, and ~~update the field in the database accordingly:~~		If your starting value was a different number -- for example, 20, then your result should be "16".

			If the value hasn't changed, then LDAP wasn't enabled, and your problem is elsewhere.

	~~<code>~~

	~~$ db2 connect~~ to ~~archive~~		As always, don't forget to wrap up your session by closing your connection to the database:

	~~Database Connection Information~~

	~~Database server = DB2/AIX64 10.1.4~~
	~~SQL authorization ID = ODADMIN~~
	~~Local~~ database ~~alias = ARCHIVE~~

	~~$ db2 "update arssys set sys_mask=16"~~
	~~DB20000I The SQL command completed successfully.~~
	~~$ db2 terminate~~
	~~DB20000I The TERMINATE command completed successfully.~~

			<code>
			$ db2 terminate
			DB20000I The TERMINATE command completed successfully.
	</code>		</code>

Jderrick: Re-worded.

2015-07-28T13:26:28Z

Re-worded.

← Older revision		Revision as of 13:26, 28 July 2015
Line 5:		Line 5:
	=== Symptoms and error messages ===		=== Symptoms and error messages ===

	The documentation for enabling LDAP isn't perfect, and in CMOD version 9.0 and higher, enabling LDAP can cause OnDemand to not start up after issuing the "[[arssockd]] -S" command. Of course, without being able to start Content Manager OnDemand, you can't ~~log in to~~ turn LDAP off. If you check the console output, you might find errors like these:		The documentation for enabling LDAP isn't perfect, and in CMOD version 9.0 and higher, enabling LDAP can cause OnDemand to not start up after issuing the "[[arssockd]] -S" command, or refusing to allow logins.

			Of course, without being able to start Content Manager OnDemand or being able to log in, you can't turn LDAP off. If you check the OnDemand Library Server's console output, you might find errors like these:

	<code>		<code>
Line 13:		Line 15:
	</code>		</code>

	~~Alternately, you may have enabled LDAP, and the~~ server ~~was able to~~ start, but you'~~re no longer able to~~ log in, ~~and~~ you'~~d like~~ to turn off LDAP so you can ~~log in and~~ figure out ~~why~~.		If your server does start up, but you can't log in, you'll need to follow these instructions to turn off LDAP authentication, so you can try to figure out what went wrong.

	These instructions will manipulate the contents of the CMOD database directly to disable LDAP ~~so you can resume troubleshooting~~. USE THESE INSTRUCTIONS WITH CAUTION.		These instructions will manipulate the contents of the CMOD database directly to disable LDAP. USE THESE INSTRUCTIONS WITH CAUTION.

	=== Directions ===		=== Directions ===

Jderrick: /* Directions */

2015-07-28T13:24:01Z

Directions

← Older revision		Revision as of 13:24, 28 July 2015
Line 97:		Line 97:

	</code>		</code>

			If your CMOD server wasn't able to start, try starting it at this point. If your CMOD server was able to start, but you weren't able to log in, stop and start the Library server so the change can take effect.

	=== Additional Resources ===		=== Additional Resources ===

Jderrick: /* Symptoms and error messages */

2015-07-27T22:25:05Z

Symptoms and error messages

← Older revision		Revision as of 22:25, 27 July 2015
Line 12:		Line 12:

	</code>		</code>

			Alternately, you may have enabled LDAP, and the server was able to start, but you're no longer able to log in, and you'd like to turn off LDAP so you can log in and figure out why.

	These instructions will manipulate the contents of the CMOD database directly to disable LDAP so you can resume troubleshooting. USE THESE INSTRUCTIONS WITH CAUTION.		These instructions will manipulate the contents of the CMOD database directly to disable LDAP so you can resume troubleshooting. USE THESE INSTRUCTIONS WITH CAUTION.

Jderrick: Tweaked spacing.

2015-04-14T21:16:39Z

Tweaked spacing.

← Older revision		Revision as of 21:16, 14 April 2015
Line 29:		Line 29:
	Local database alias = ARCHIVE		Local database alias = ARCHIVE


	$ db2 "select SYS_MASK from arssys"		$ db2 "select SYS_MASK from arssys"

Jderrick: Consistency & formatting.

2015-04-14T21:16:04Z

Consistency & formatting.

← Older revision		Revision as of 21:16, 14 April 2015
Line 21:		Line 21:
	<code>		<code>

	$ db2 ~~"select SYS_MASK from arssys"~~		$ db2 connect to archive

	SYS_MASK		Database Connection Information
	----------
	4		Database server = DB2/AIX64 10.1.4
			SQL authorization ID = ODADMIN
			Local database alias = ARCHIVE


			$ db2 "select SYS_MASK from arssys"

			SYS_MASK
			----------
			4

	1 record(s) selected.		1 record(s) selected.

	$ db2 terminate		$ db2 terminate
	DB20000I The TERMINATE command completed successfully.		DB20000I The TERMINATE command completed successfully.
	</code>		</code>

Jderrick: Changed heading.

2015-04-14T21:15:02Z

Changed heading.

← Older revision		Revision as of 21:15, 14 April 2015
Line 3:		Line 3:
	You were likely trying to configure Content Manager OnDemand for [[Glossary#Acronyms\|LDAP]], and now OnDemand won't start after enabling the LDAP Authentication checkbox in the OnDemand Administrator Client.		You were likely trying to configure Content Manager OnDemand for [[Glossary#Acronyms\|LDAP]], and now OnDemand won't start after enabling the LDAP Authentication checkbox in the OnDemand Administrator Client.

	=== ~~Issue~~ ===		=== Symptoms and error messages ===

	The documentation for enabling LDAP isn't perfect, and in CMOD version 9.0 and higher, enabling LDAP can cause OnDemand to not start up after issuing the "[[arssockd]] -S" command. Of course, without being able to start Content Manager OnDemand, you can't log in to turn LDAP off. If you check the console output, you might find errors like these:		The documentation for enabling LDAP isn't perfect, and in CMOD version 9.0 and higher, enabling LDAP can cause OnDemand to not start up after issuing the "[[arssockd]] -S" command. Of course, without being able to start Content Manager OnDemand, you can't log in to turn LDAP off. If you check the console output, you might find errors like these:

Jderrick: Initial edit.

2015-04-14T21:08:03Z

Initial edit.

New page

=== What happened? ===

You were likely trying to configure Content Manager OnDemand for [[Glossary#Acronyms|LDAP]], and now OnDemand won't start after enabling the LDAP Authentication checkbox in the OnDemand Administrator Client.

=== Issue ===

The documentation for enabling LDAP isn't perfect, and in CMOD version 9.0 and higher, enabling LDAP can cause OnDemand to not start up after issuing the "[[arssockd]] -S" command. Of course, without being able to start Content Manager OnDemand, you can't log in to turn LDAP off. If you check the console output, you might find errors like these:

<code>

arssockd (ARCHIVE): ARSSOCKD 2 437 ARS0437E The OnDemand stash file >< either does not exist or is not valid. Return Code=4.

</code>

These instructions will manipulate the contents of the CMOD database directly to disable LDAP so you can resume troubleshooting. USE THESE INSTRUCTIONS WITH CAUTION.

=== Directions ===

First, check your system to see what the current value of the SYS_MASK field is:

<code>

$ db2 "select SYS_MASK from arssys"

SYS_MASK
----------
4

1 record(s) selected.

$ db2 terminate
DB20000I The TERMINATE command completed successfully.
</code>

If the result of this query on your system is the same as the example, you can issue the following commands to disable LDAP. If your results are different, skip to the next section.

<code>

$ db2 connect to archive

Database Connection Information

Database server = DB2/AIX64 10.1.4
SQL authorization ID = ODADMIN
Local database alias = ARCHIVE

$ db2 "update arssys set sys_mask=0"
DB20000I The SQL command completed successfully.
$ db2 terminate
DB20000I The TERMINATE command completed successfully.

</code>

If the results of the query are different on your system, you likely have other options enabled.

<code>

$ db2 "select SYS_MASK from arssys"

SYS_MASK
----------
20

1 record(s) selected.

$ db2 terminate
DB20000I The TERMINATE command completed successfully.
</code>

In this example, simply subtract 4 from the value returned on your system, and update the field in the database accordingly:

<code>

$ db2 connect to archive

Database Connection Information

Database server = DB2/AIX64 10.1.4
SQL authorization ID = ODADMIN
Local database alias = ARCHIVE

$ db2 "update arssys set sys_mask=16"
DB20000I The SQL command completed successfully.
$ db2 terminate
DB20000I The TERMINATE command completed successfully.

</code>

=== Additional Resources ===

The root cause of this issue is that you likely do not have a stash file configured for LDAP on CMOD. Here are some IBM Knowledgebase Articles about Content Manager OnDemand stash files and LDAP:

Content Manager OnDemand V9.0/9.5 LDAP authentication process:

http://www-01.ibm.com/support/docview.wss?uid=swg21597246

Content Manager OnDemand V8.5 and later LDAP authentication to active directory server fails with an error:

http://www-01.ibm.com/support/docview.wss?uid=swg21610510

Using arsstash files for authenticating to DB2, Oracle, or LDAP:

http://www-01.ibm.com/support/docview.wss?uid=swg21608635