Friday, 9 March 2012

IBM Web Content Manager - Cluster Installation – setting WCM_HOST and WCM_PORT

Saw this on Graham Bucknell's blog this morning, and wanted to share it as it's something that has cropped up for me in the past

When you set up a WebSphere Portal cluster, the WCM_HOST and WCM_PORT environment variables need to be changed so they point to your webserver address. This is important for syndication. If you don't make this change, syndication will go through the individual node instead of the load balancing webserver. This is a problem if the individual node goes down – syndication will also stop too!

As you'd expect, Graham has the solution: -

This is easily remedied with a quick ConfigEngine script:

Want to know more ?

Then check out the post here 


Nice one, Graham, thanks for sharing ….

Wednesday, 7 March 2012

CWWIM4520E The 'javax.naming.ServiceUnavailableException - Fun and Games with WebSphere Application Server and Microsoft Active Directory

So I've seen two semi-related issues between WebSphere Application Server (WAS) 7 and Active Directory in the past 24 hours.

In the first instance, I saw: -

[06/03/12 17:00:58:130 GMT] 0000001a exception     E com.ibm.ws.wim.adapter.ldap.LdapConnection getDirContext CWWIM4520E  The 'javax.naming.ServiceUnavailableException: ldap_f5.server.ibm.com:636; socket closed' naming exception occurred during processing.

[06/03/12 17:00:58:131 GMT] 0000001a exception     E com.ibm.ws.wim.adapter.ldap.LdapConnection getDirContext 
                                 com.ibm.websphere.wim.exception.WIMSystemException: CWWIM4520E  The 'javax.naming.ServiceUnavailableException: ldap_f5.server.ibm.com:636; socket closed' naming exception occurred during processing.
...

This turned out to be due to a mis-configured load balancer ( Big IP F5 ) which wasn't "passing" traffic through to the back-end Active Directory domain controllers.

Once I changed WAS to use one of the DCs rather than the Big IP load-balanced hostname ( aka Virtual IP or VIP ), I then saw: -

...
[07/03/12 11:19:38:463 GMT] 0000002a ServerCache   I   DYNA1071I: The cache provider "default" is being used. 
[07/03/12 11:19:38:655 GMT] 0000002a exception     E com.ibm.ws.wim.adapter.ldap.LdapConnection getDirContext CWWIM4520E  The 'javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 775, vece^@]; Resolved object: 'com.sun.jndi.ldap.LdapCtx@4ae04ae0'' naming exception occurred during processing.

[07/03/12 11:19:38:657 GMT] 0000002a exception     E com.ibm.ws.wim.adapter.ldap.LdapConnection getDirContext 
                                 com.ibm.websphere.wim.exception.WIMSystemException: CWWIM4520E  The 'javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 775, vece\u0000]; Resolved object: 'com.sun.jndi.ldap.LdapCtx@4ae04ae0'' naming exception occurred during processing.
...

Thanks to this Technote: -


I fairly quickly discovered that the problem was: -

...
The AD-specific error code is the one after "data" and before "vece" or "v893" in the actual error string returned to the binding process

525 user not found
52e invalid credentials
530 not permitted to logon at this time
531 not permitted to logon at this workstation
532 password expired
533 account disabled
701 account expired
773 user must reset password
775 user account locked

e.g. that the so-called service account that we're using to bind to the Domain Controller had been locked.

My AD specialist confirmed this, and unlocked the account …..

Job done :-)

Performance management tools for IBM WebSphere Portal

A link to this article popped into my inbox this morning, thanks to a weekly newsletter that summarises the support position for IBM WebSphere Portal and IBM Web Content Manager

This article describes the tools and how they were used to evaluate an IBM® WebSphere® Portal 7.0 performance and/or problem determination issue during a recent engagement at a customer site.

The list of tools addressed here is not complete; specifically, it does not include well known commercial tools used in many environments for load testing, such as CA Wily Introscope, IBM ITCAM, and HP LoadRunner. Instead, the tools we will discuss are a supplement to the customer-supplied tools. The process of performance management is complex and beyond the scope of this document.


This has specific relevance to me as my project is about to implement CA Wily Introscope and IBM Tivoli Composite Application Manager to monitor WebSphere Application Server ( underlying WebSphere Portal, IBM Web Content Manager and IBM Connections ) and DB2 UDB respectively.

Will be having a good read …..

Sunday, 4 March 2012

Blue Screen of Death … well almost

Yesterday I took delivery of a Humax HDR-FOX T2 device; this is a so-called Personal Video Recorder (PVR), which is somewhat anacrhonistic - a Hard Disk Recorder is, perhaps, a better name, hence the model name :-)

The Humax ( also known as a Hummy ) contains a pair of Freeview HD tuners, allowing me to record two different Freeview digital TV channels at the same time, which is rather useful.

There were a number of reasons for the purchase, including the fact that the Humax devices were listed as Best Buys by Which? a wee while back.

As an example, the Humax can connect to the internet, via Ethernet or a USB WiFi adapter, providing access to internet TV and radio - for me, access to the BBC iPlayer was a definite advantage.

This also allows me to use the Hummy (!) as a DLNA media server, which should allow me to play media recorded from Freeview across my home network using my Mac, iPad and iPhone - we'll see :-)

Thus far, I've only tested the so-called TV Portal feature of the device, via an Ethernet cable, contacted to my Mac, which was sharing it's WiFi connection.

I've ordered a USB WiFi adapter - an Edimax EW-7711USN N150 High Power WiFi USB Adapter with Detachable 3dBi Antenna - from Amazon; once it arrives, I'll test DLNA etc. and report back ...

In the meantime, back to the purpose of this post ….

Having plugged the Humax into my LCD TV, a Toshiba 32KV500B, via the supplied HDMI cable, I was soon up and running, and happily recording and scheduling.

However, I was somewhat perturbed to note that the telly displayed a blue screen ( hence the title of this post ) for 3-4 seconds each time I changed channels, either via the [Program Up] and [Program Down] buttons, or via the Electronic Programme Guide (EPG).

I tried switching the HDMI cable from one port to another ( the telly has two ports, the other is used for the iPad and iPhone via an Apple HDMI adapter ).

Sadly, I wasn't able to resolve the problem, and assumed that it was a fault with my TV - my aunt has the same model of Humax, used with a Sanyo LCD telly, and doesn't see the same problem.

However, before I "wrote off" the TV, I thought back to the initial set up of the Humax - one of the first screens that I saw, having set  the language, tuned the Freeview channels, confirmed the location of my TV transmitter etc. I'd seen a screen that asked me about the display resolution.

At the time, I accepted the default … which was 1080i.

Can you see what I did wrong ?

My telly is "HD-ready" rather than "Full HD" which, apparently, means that it's not capable of displaying a full High Definition - it can only handle 720p

 Supports High Definition 720p resolution. A HD ready TV will be able to display High Definition images from any HD source.

whereas the Humax can generate all the HD outputs; 1080p, 1080i, 720p, 576p and 576i.

So, as a final confirmation, I ran back through the initial setup of the TV ( sadly losing all my scheduled programmes ! ), and chose 720p this time around.

Having done that, I'm pleased to report that there's no longer any blue screen ( or, more seriously, loud popping noise which I heard intermittently ) when I toggle through the channels.

So, I'm feeling rather pleased with myself :-)

*UPDATE* Having read the Humax User Manual [PDF] I note that there's a rather useful V-FORMAT button on the Hummy's remote control: -

Note: Some TVs/Displays may not support all Video Resolutions, to change this in the future please use the V-FORMAT button on your remote control.

so I needn't have reset the device, thus losing all my scheduled programmes :-(

Still I do love the Find feature within the Humax's EPG; it allows me to search for programmes by name or genre e.g. drama, movie etc.

Will post back re the WiFi access in a week or so ….

Friday, 2 March 2012

IBM Web Content Manager delivery solutions for your website

This came to my attention earlier; one of my IBM UK colleagues kindly shared the link via a blog post in IBM Connections, which then popped up in Notes via the Connections Alerts plugin in my sidebar :-)

Stefan Hepper - Comment lines: Choosing the right web content management delivery solution

The IBM Web Content Manager software offers different solutions for delivering web content to your users. This article explains all the solutions available and why you would chose each.

The article is here - it's definitely worth checking out, whether you yet use IBM Web Content Manager, or not.

Thursday, 1 March 2012

More on the Global Security Toolkit (GSK) and OpenSSL on Linux

This is just a bunch of links right now, but has been extremely useful to me in the past few days …..

IBM SDK for Java 6 - Security information


IBM SDK Policy files

I needed to use this as I have a requirement to import 2048-bit SSL root/intermediate certificates into the SSL keystore for IBM HTTP Server, and IHS only supports 1024-bit certificates out-of-the-box

IBM's SDKs ship with strong but limited jurisdiction policy files. Unlimited jurisdiction policy files can be obtained from the link above. The ZIP file should be unpacked and the two JAR files placed in the JRE's jre/lib/security/ directory. These policy files are for use with IBM developed SDKs. The same files are used for the Version 1.4 and Version 5 SDKs. Details of downloads of unlimited jurisdiction policy files for the Solaris and HP platforms can be found in the IBM Security Guide for those platforms.


Key Management Utility command-line interface (gsk7cmd) syntax

This is somewhat self-explanatory, but extremely useful.


Migrating OpenSSL certificates from the Apache HTTP Server to the IBM HTTP Server KDB file

This was useful in helping me understand how to move certificates from one format to another e.g. PKCS12 to PEM etc.


Setting up a public key infrastructure

This includes some examples of how to use gsk7cmd to view certificate details etc.

$ gsk7cmd -cert -details -db myBrokerTruststore.jks -label CACert


Can't receive certificate in Ikeyman: All the signer certificates must exist in the key database

This has some great examples of how to use the openssl command to look at certificates e.g.

$ openssl x509 -text -in certificate_from_certificateauthority.crt|grep Issuer:

IBM HTTP Server and CentOS Linux - Global Security Toolkit (GSK) not playing nicely

I'm breaking new ground, at least for me, with SSL certificates etc. within IBM HTTP Server on a current project, and have been expanding my knowledge of the Global Security Toolkit (GSK) on my own CentOS environment.

I've written about CentOS and IBM software before so this is merely a continuation of the series :-)

So when I saw an exception trying to run certain GSK commands such as gsk7cmd, I immediately assumed that I might be missing a shared library of some sort.

I confirmed this by running: -

$ cd /opt/IBM/HTTPServer/bin
./gsk7ver 

which returned: -

/opt/IBM/HTTPServer/gsk7/bin/gsk7ver: error while loading shared libraries: libstdc++.so.5: cannot open shared object file: No such file or directory

I fixed this by running: -

$ yum install libstdc++.so.5

and was then able to re-run GSK commands, including gsk7ver.

More to come …...

Note to self - Firefox and local connections

 Whilst trying to hit my NAS from Firefox on my Mac, I kept seeing errors such as:- Unable to connect Firefox can’t establish a connection t...