IBM Connections - "Security role to user/group mapping" reset after installing/uninstalling maintenance updates

I saw this in my IBM Connections Fixes RSS feed a few days back: -

Problem

"Security role to user/group mapping" is reset after installing or uninstalling maintenance updates.

Cause

"Security role to user/group mapping" information is written in the each application's ear (ex. Blogs.ear).
When maintenance update is installed or uninstalled, the fix application process repackages the EAR, then calls to re-install the EAR. It forces the node synchronization which overwrites what's actually there in DM and Node config directory.

Environment

All Platforms

Resolving the problem

If you have customized security role mappings in the WebSphere Application Server Integrated Solutions Console for the IBM Connections applications, these customized security roles will be needed to be re-mapped.

Technote 1598514 - "Security role to user/group mapping" reset after installing/uninstalling maintenance updates

Ooops, IBM HTTP Server and Red Hat Enterprise Linux

Saw this the other day, having installed IHS on Red Hat Enterprise Linux 6.2

...
[Fri Jun 22 21:01:04 2012] [notice] Using config file /opt/IBM/HTTPServer/conf/httpd.conf
[Fri Jun 22 21:01:04 2012] [notice] IBM_HTTP_Server/7.0.0.0 (Unix) configured -- resuming normal operations
[Fri Jun 22 21:01:04 2012] [notice] Core file limit is 0; core dumps will be not be written for server crashes
libgcc_s.so.1 must be installed for pthread_cancel to work
[Fri Jun 22 21:01:04 2012] pid 19395 mod_backtrace backtrace for sig 6 (thread "pid" 19395)
[Fri Jun 22 21:01:04 2012] pid 19395 mod_backtrace main() is at 8062200
[Fri Jun 22 21:01:04 2012] pid 19395 mod_backtrace end of backtrace
...

The problem was swiftly resolved with: -

$ yum install libgcc_s.so.1

TECH-P09 Web Application Bridge (WAB): “No Coding!” Integration Style for External Web Applications in WebSphere Portal

Saw this: -

TECH-P09 Web Application Bridge (WAB): "No Coding!" Integration Style for External Web Applications in WebSphere Portal

Jason Cornell, Product Manager, IBM Web Content Manager
Samit Narula, Web Experience Software Developer, IBM

The enterprise today provides web experience through multiple web applications which are non-uniform in technology used, standards followed, and so on. Web Application Bridge, aka WAB, as a technology allows an enterprise to use its existing or acquired infrastructure, however heterogeneous it might be, to be integrated within WebSphere Portal. Internally, WAB uses the latest features that the WebSphere platform offers. It provides an agile integration approach for legacy as well as the latest web applications, without needing to tap into exposed APIs or requiring any developer involvement. Another useful aspect of WAB is to facilitate a message-driven integration style that can even make different web applications interact with each other. Any deployment professional armed with just the knowledge of the topology and security environment of a web application can surface it within the WebSphere Portal using WAB. This session will provide details on what makes WAB such a potent integration mechanism. We will provide insights on how to integrate different types of web applications, how various authentication mechanisms can be configured for trust association, how WAB allows the external web application to be a part of the Portal collaboration environment, and trips and tricks for administrators.

on the WebSphere Portal Family Wiki.

It's a 53-minute video of a session that Jason and Samit gave at the recent Exceptional Web Experience conference in Austin, TX.

Definitely worth a watch ...

Running IBM HTTP Server via Linux scripts and sudo

This is to allow non-root users to start and stop IHS via sudo scripts. It also allows IHS to automatically start following a server restart.

As root

(1) Copy the init scripts into place

$ cp ~/ibmhttp* /etc/init.d/

(2) Set executable permissions

$ chmod a+x /etc/init.d/ibmhttp*

(3) Register the services

$ chkconfig --add ibmhttpd
$ chkconfig --add ibmhttpadmin

(4) Check the autostart options

$ chkconfig --list | grep ibm

ibmhttpadmin       0:off    1:off    2:off    3:on    4:on    5:on    6:off
ibmhttpd           0:off    1:off    2:off    3:on    4:on    5:on    6:off

(5) Add to the /etc/sudoers file

Add: -

hayd    ALL=NOPASSWD: /sbin/service ibmhttpd *
hayd    ALL=NOPASSWD: /sbin/service ibmhttpadmin *

to the end of /etc/sudoers.

As the non-root user e.g. hayd

(1) Check the sudo permissions

$ sudo -l

Matching Defaults entries for hayd on this host:
    requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS
    DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1
    PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE
    LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY
    LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL
    LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User hayd may run the following commands on this host:
    (root) NOPASSWD: /sbin/service ibmhttpd *
    (root) NOPASSWD: /sbin/service ibmhttpadmin *

(2) Test the scripts

$ sudo /sbin/service ibmhttpd status

IBM HTTP Server is not running:

$ sudo /sbin/service ibmhttpadmin status

IBM HTTP Server is not running:

(3) Use the scripts

$ sudo /sbin/service ibmhttpd start

Starting IBM HTTP Server:                                  [  OK  ]

$ sudo /sbin/service ibmhttpadmin start

Starting IBM HTTP Server: /opt/IBM/HTTPServer/bin/adminctl start: admin http started
                                                           [  OK  ]

(4) Check processes and logs

$ ps auxw | grep -i httpd

root     22928  0.0  0.1   5488  2664 ?        Ss   01:02   0:00 /opt/IBM/HTTPServer/bin/httpd -d /opt/IBM/HTTPServer -k start
nobody   22930  0.0  0.0   5076  1444 ?        S    01:02   0:00 /opt/IBM/HTTPServer/bin/httpd -d /opt/IBM/HTTPServer -k start
nobody   22931  0.0  0.0   5488  1712 ?        S    01:02   0:00 /opt/IBM/HTTPServer/bin/httpd -d /opt/IBM/HTTPServer -k start
nobody   22932  0.0  0.0 283220  1844 ?        Sl   01:02   0:00 /opt/IBM/HTTPServer/bin/httpd -d /opt/IBM/HTTPServer -k start
root     23100  0.0  0.0   4312  1512 ?        Ss   01:14   0:00 /opt/IBM/HTTPServer/bin/httpd -f /opt/IBM/HTTPServer/conf/admin.conf
root     23102  0.0  0.0   4304   788 ?        S    01:14   0:00 /opt/IBM/HTTPServer/bin/httpd -f /opt/IBM/HTTPServer/conf/admin.conf
ihsadmin 23103  0.0  0.1  77164  3468 ?        Sl   01:14   0:00 /opt/IBM/HTTPServer/bin/httpd -f /opt/IBM/HTTPServer/conf/admin.conf

$ netstat -aon | grep 80

tcp        0      0 :::80                       :::*                        LISTEN      off (0.00/0/0)
tcp        0      0 :::8008                     :::*                        LISTEN      off (0.00/0/0)

$ cat /opt/IBM/HTTPServer/logs/error.log

[Sat Jun 23 01:02:03 2012] [notice] PLUGIN: mod_was_ap22_http: apache_log_header: WebSphere Plugins loaded.
[Sat Jun 23 01:02:03 2012] [notice] PLUGIN: mod_was_ap22_http: apache_log_header: --------------------Plugin Information-----------------------
[Sat Jun 23 01:02:03 2012] [notice] PLUGIN: mod_was_ap22_http: apache_log_header: Bld version: 7.0.0
[Sat Jun 23 01:02:03 2012] [notice] PLUGIN: mod_was_ap22_http: apache_log_header: Bld date: Aug 19 2008, 23:45:47
[Sat Jun 23 01:02:03 2012] [notice] PLUGIN: mod_was_ap22_http: apache_log_header: Webserver: IBM_HTTP_Server
[Sat Jun 23 01:02:03 2012] [notice] PLUGIN: mod_was_ap22_http: apache_log_header: --------------------------------------------------------------
[Sat Jun 23 01:02:03 2012] [notice] Using config file /opt/IBM/HTTPServer/conf/httpd.conf
[Sat Jun 23 01:02:03 2012] [notice] IBM_HTTP_Server/7.0.0.0 (Unix) configured -- resuming normal operations
[Sat Jun 23 01:02:03 2012] [notice] Core file limit is 0; core dumps will be not be written for server crashes

$ cat /opt/IBM/HTTPServer/Plugins/logs/webserver1/http_plugin.log

[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - ERROR: lib_security: loadSecurityLibrary: Failed to load gsk library from /opt/IBM/HTTPServer/Plugins/gsk7/gsk7_32
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - ERROR: ws_transport: transportInitializeSecurity: Unable to load security library
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - ERROR: ws_server: serverAddTransport: Failed to initialize security
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - ERROR: ws_server: serverAddTransport: HTTPS Transport is skipped
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: Plugins loaded.
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: --------------------System Information-----------------------
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: Bld version: 7.0.0
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: Bld date: Aug 19 2008, 23:43:56
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: Webserver: IBM_HTTP_Server
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: Hostname = rhel6.uk.ibm.com
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: NOFILES = hard: 1024, soft: 1024
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: MAX COREFILE SZ = hard: INFINITE, soft: 0
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: DATA = hard: INFINITE, soft: INFINITE
[Sat Jun 23 01:02:03 2012] 00005990 f77276c0 - PLUGIN: --------------------------------------------------------------

( I'll come back to the security related errors later )

(5) Test the site via a browser i.e. http://localhost:80 or similar

(6) Reboot the server and check that the httpd tasks automatically start.

Enhancing WebSphere Portal & IBM Content Manager with Elastic Caching - Webcast - 18 July 2012

This popped up in my River of News earlier today: -

Websites and applications have become progressively more complex as our industry's technologies and methodologies advance. The load capacity and response times of modern applications are increasingly constrained by access to back-end datastores such as content repositories and general database systems which are difficult to scale up. Caching of content by applications as done by WebSphere's Dynamic Caching service can help with this problem but runs into a number of limitations including invalidation/consistency problems and application server memory constraints. 

WebSphere eXtreme Scale and the XC10 caching appliance can help address these challenges. If you are looking to improve customer experience by providing a basis for faster, more reliable web sites, the WebSphere eXtreme Scale product family offers an implementation of dynacache which stores cached content in an in-memory elastic data grid instead of using the default dynacache implementation which stores cached content in WebSphere Application Server heap space or on disk. There are numerous advantages to this configuration such as: caches can be much larger than what the application server heap would otherwise support while not paying the penalty of storing on disk, caches are shared between application server instances, and cached content can survive an application server restart. This implementation can be enabled without requiring any application code changes. 

Join us for a free webcast to learn: 

• The benefits of distributed in-memory data grids aimed at high-performance/high-scale data-intensive applications 
• Details surrounding the WebSphere eXtreme Scale dynacache provider 
• The performance benefits achieved from moving a Portal Dynacache instance into a data grid hosted by an DataPower XC10 caching appliance 
• The configuration steps needed to enable the WebSphere eXtreme Scale dynacache provider

Speakers: 

Yakura Coffee, Product Manager, IBM

Benjamin Parees, Senior Software Engineer, IBM

Want to attend ? Then click here for the details.

Required Reading - WebSphere Application Server V7: Session Management

Session support allows a Web application developer to maintain state information across multiple user visits to the application. In this IBM® Redpaper™ publication, we discuss HTTP session support in WebSphere® Application Server V7 and how to configure it. We also discuss the support for stateful session bean failover.

This paper is the stand-alone version of chapter 12 of WebSphere Application Server V7 Administration and Configuration Guide, SG24-7615.

Table of contents

• HTTP session management
• Session manager configuration
• Session identifiers
• Local sessions
• General properties for session management
• Session affinity
• Persistent session management
• Invalidating sessions
• Session security
• Session performance considerations
• Stateful session bean failover

WebSphere Application Server V7: Session Management

IBM Connections and NFS file locking

This from my mate, Ben, and is absolutely worth reading if you use IBM Connections and NFS.

...

A customer moved the shared storage (NAS) that Connections uses to new hardware. Check out by the testers showed that Connections was functioning correctly but by Monday morning it was apparent there were problems.

...

In brief, the client experienced an issue with the Red Hat Enterprise Linux nfslock service, which needs to be restarted. In addition, NFS v4 is recommended as it has better file-locking support.

Here's Ben's post: -

NFS file locking and it's affect on Connections