|IBM Connections – How to switch to a custom global unique ID for users
IBM Connections – How to switch to a custom global unique ID for users
many of our todays support cases is related to non-working profiles in IBM Connections.
If users change their name, switch from one to another location or simply get a new account their profile in IBM Connections might get inactivated because the hash key between LDAP and database has changed.
There are three possible hash keys:
- UID: Often a bad choice, as this might change
- eMail: Also a bad choice
- GUID: Unique ID – a good choise
So GUID is the attribute you should go for if you have non-unique eMail or UID values in LDAP.
GUID is a canonical String that is generated from:
- AD: objectGUID / objectSID
- Domino: dominoUNID
But in daily use the GUID value is not really as shiny as it seems… Due to the fact that many Domino administrators copy documents (STRG-C + STRG-V) duplicate dominoUNIDs can occur – which might kill an IBM Connections profile. I heard from customers with Active Directories who delete an AD account and recreate it if a person changes names… The IBM Connections profile gets inactivated.
But some customers implemented another unique key (such as employee number) into their LDAP in order to avoid such problems. The question comes up, how do I need to configure IBM Connections to make use of this new unique ID?
Everything is documented in detail and works very well (Please note that you should be very careful using this approach if you have CCM libraries in use – this change might break the access rights for all users!!!):
1. Depending on what attribute shall be used you need to first define a wim extension:
1.1 Attributes that are not part of PersonAccount schema – go to ../DMGR/config/cells/CELLNAME/wim/model and create a file “wimxmlextension.xml”
<?xml version="1.0" encoding="UTF-8"?>
1.2 If your customer uses a LDAP attribute that is already part of the PersonAccount schema you can directly go to 2)
2) Open the wimconfig.xml (here we add customerUserID as an supported attribute):
<config:attributes name="userPassword" propertyName="password"/>
<config:attributes name="customUserID" propertyName="customUserID"/>
3) open and edit the LotusConnectionsconfig.xml file and add the following part:
<sloc:serviceReference profiles_directory_service_extension_enabled="true" serviceName="directory" custom_user_id_attribute="customUserID"/>
4) Make a full resync of all nodes
5) TDI: edit the file “map_dbrepos_from_source.properties” and map the new customerUserId to GUID:
6) TDI: open the file “profiles_tdi.properties” and change the field “sync_updates_hash_field” from:
sync_updates_hash_field=uid (or mail)
7) start sync_all_dns.sh and check if the profiles have been correctly updated:
db2 “select PROF_GUID from EMPINST.EMPLOYEE” should show the new customerUserID`s
8) Revert back the change in profiles_tdi.properties so that the sync_updates_hash_field is set back to the guid value
A profile with the canonical String from a dominoUNID:
A profile with the customUserID as identifier:
Nov 07, 2016
| Recent Blog Posts
Exchange integration into WebSphere Portal (SSO – Kerberos)|
Tue, Sep 26th 2017 12:03p GIS Techblog
Exchange integration into WebSphere Portal (SSO – Kerberos)
During the last years working with Portal I had several challenges with WebSphere Portals HTTP Outbound Proxy (aka. Ajax Proxy) in terms of authenticating backend calls to various other systems.
What we`ve done so far in terms of SSO / backend authentication:
– Authenticating using LTPAToken
– Authenticating using SAML
– Authenticating using SPNEGO / Kerberos (this was a new one for me)
The challenge this time
User provisioning for IBM Connections Cloud – You have the choice|
Mon, Aug 28th 2017 1:42p GIS Techblog
User provisioning for IBM Connections Cloud – You have the choice
Customers who use IBM Cloud for Connections, Sametime or other applications face the problem to manage their cloud accounts. For some single users you can use the Web frontend to add or change user accounts or to assign subscriptions and licenses to users. But in real world scenarios it is not possible to manage thousands of users manually or to keep them synchronized with an on-prem user repository or LDAP.
This can be handled
SAML & IBM Connections 5.5 – not a dream team|
Fri, Aug 18th 2017 7:45a GIS Techblog
last week we had to fight with an activation of SAML on a IC 5.5 CR3 environment.
The setup was:
IBM Connections 5.5 CR3 as test instance
ADFS Server 3.0 (I know… it is only tested with ADFS 2.0 – but works with 3.0 too)
We followed the instructions from the IBM Connections Knowledge Center. Smooth setup everything standard procedure. When testing this setup, the redirect to the IdP was initiated. After logging into the IdP the browser was redirected to IBM Connections ACS
IBM Docs – Migration from DB2 –> ORACLE|
Fri, Jul 7th 2017 9:52a GIS Techblog
IBM Docs – Migration from DB2 –> ORACLE
within our last big project, we had the challenge to transfer the IBM Docs database from DB2 to ORACLE. Within this database comments and other document related data is stored.
Officially there is no script available to perform this move using DBT (remove constraints / transfer / reapply constraints). We looked into the database and figured out how to perform this task using DBT – so we are not dependent on any other products. We m
IBM Connections – trouble adding additional nodes|
Wed, May 31st 2017 2:52p GIS Techblog
IBM Connections – trouble adding additional nodes
we are currently involved in a project where we installed a 1 node IBM Connections 6 Cluster and later added a second node to the cell.
So far so good… Everything that needs to be done after adding the second node is described here … Everything? Yes, mainly… but not in the mandatory details as I think! Missing custom properties and other settings might result in non-functional nodes. Especially not setting httpSess
SNOUG 2017 Presentation – SikaConnect goes External|
Thu, Mar 23rd 2017 1:06p GIS Techblog
SNOUG 2017 Presentation – SikaConnect goes External
yesterday I was at SNouG in Zurich. I had a great time there – good speakers and a overall perfectly organized event (would we expect sth. else from Switzerland? )
Raymond Weber from SIKA Informationssysteme AG and I did a session about the SIKA Extranet Feature:
Whiteboard in IBM Sametime Meeting 9.0.1 removed|
Fri, Mar 17th 2017 10:43a GIS Techblog
Whiteboard in IBM Sametime Meeting 9.0.1 removed
IBM implemented in Sametime Meeting 9.0.1 a whiteboard function as technical preview. Ben described in his articel how to enable this feature:
With the current cumulative Fix 901-ST-General-FP-SMOL-AK4G43 for the Meeting Server IBM has removed this function.
The response on my PMR was:
“I can confirm The Meetings Whiteboard feature release is being put on hold indefinitely.
Wikis content not accessible…|
Thu, Jan 26th 2017 10:54a GIS Techblog
Wikis content not accessible…
it`s been quite a long time; many projects at the moment so that blogging needs to wait
Last week we had a very interesting problem at one customer’s environment. When accessing a Wiki, the page was displayed blank – no content was available. Browsing to older versions of this wikis worked.
The error in the log:
Parsing error… Wikis content (the body) gets store in the filesystem as xml files. If you access a Wiki there is a XML parser
Automatic WebSphere plugin modification II – PowerShell for Windows|
Thu, Dec 1st 2016 6:54p GIS Techblog
Automatic WebSphere plugin modification II – PowerShell for Windows
some months ago I published a shell script to automatically modify the Primary / BackupServer definition in a WebSphere plugin-cfg.xml file.
As we have several Windows customers we decided to transfer this script to PowerShell so that it is also useable for a Windows Cluster installation. My colleague Jan Bruns did a great job implementing this script.
It basically works the same way as the Linux script:
IBM Connections Docs – file preview not possible for some CCM pdf files|
Thu, Nov 17th 2016 2:15p GIS Techblog
IBM Connections Docs – file preview not possible for some CCM pdf files
last week we had trouble in a customer environment using the file preview functionality for some pdf files (only those that were uploaded using CCM).
Instead of a preview the message was displayed:
At the same time we saw the following warning in the log:
The mime-type was set to “image/pcl” instead of “application/pdf”… this mime-type is not supported by IBM Docs File viewer. We had to dig deep into th