Common Debug Protocol

****************************************** ***START UPDATE 10/3/2016*****************

LAPI and its client installer has become very hard to find. Moreover clients written in LAPI  in say Java/.NET will only work if your Livelink a.k.a Content Server is of version less than CS16.Readers who are new to LL programming is encouraged to read this to the approach and not to the exact lines of the code.What I mean is when you used to program in LAPI you were basically passing parameters to discrete calls by modelling it based on the webgui of livelink .SOAP based webservices called CWS is also the same,so if you do not try to do the task in the webgui and try to understand the business rules you will almost have no success in CWS too. OT is notorious for not putting fully functioning use cases and a walk through,so whenever possible I write code assuming the user has not worked in Livelink for X number of years and try to educate you all. Livelink,Content Server,Enterprise Server all of this has been Livelink’s marketing brand name changes over the years.CS i sused in many of the integrations like AGA, XECM, RMLINK  and you know you are programming against livelink if you see a link that looks like this  http(s)://somefriendlyURL/livelink.exe|cs.exe|llisapi.dll|cs.dll|livelink.In many places SAP/ SP /Exchange will be configured to talk to Archive Server and then they will use Livelink to read into archive server and turn that into LL objects for better presentment/RM and other aspects. The AGA product is moving away from LAPI(not sure totally or not) to REST API in LL.

**********************************************END UPDATE****************************

 

 

In most cases I have noticed that programmers brought into livelink a.k.a Content Server web server programming lack a general understanding of livelink and its business rules.The Vendor maintained links   is written almost to a starting novice but again people will run into problems.To mitigate this one has to have a simple protocol

  1. Ask the livelink team a representative container(folder ,project,compound documents,document work spaces all of them are shells or containers to hold additional objects) that the CWS programmer can access using the webgui.
  2. Ask how is authentication enforced.In almost 90% of places it will be SSO(NTLM,IWA,other LDAP methods)
  3. In most cases CWS application where you source the WSDL’s from will be “anonymous” because that is the level of documentation OT gives admins which means that the CWS user has to be manual user in livelink also known as a user with a password the livelink admin team gives you
  4. I have published several successful posts here  that allow me to do SSO(IWA/NTLM) that is because I know how to set it correctly.Most of it was looking at IWA webservices samples.
  5. I have installed and configured OTDS as well ,it is a re-directional(kerberos implementation) .Simply put when you access a link such as http://localhost/livelink/llisapi.dll if OTDS authentication is involved your call is redirected to the OTDS server(Tomcat in the version I tried).The kerberos token that is prevalent in your domain login is used to establish who you are against a configured LDAP appliance like AD and returned back to the livelink server.Anybody who knows enough about livelink URL’s know the web escaped URL’s, you should see the re-direction when using wireshark or fiddler as well.  This ideas are my interpretaion and not OT’s so take this with a piece of slat.
  6. The above OTDS authentication is overkill if Livelink was employed as a DMS or in your org people know that Livelink is there.It would make sense to tunnel xECM SAP Users your piggy backing on MYSAPSSO2   mostly integrations form other systems who want a seamless experienec.Altogether it is very easy to setup and implement save for the fact that creating SSO against AD is basically a one click operation.

Allright so what is the post about

If you are a .NET CWS/EWS programmer you will basically be sending this token with each service client call because livelink is http and state based and you never know if  the request is being handled by the same server or the same thread.

You would see .NET code like this

DocumentManagement.OTAuthentication dmOTAuth = new DocumentManagement.OTAuthentication();
ContentService.OTAuthentication     csOTAuth = new ContentService.OTAuthentication();
SearchService.OTAuthentication      ssOTAuth = new SearchService.OTAuthentication();

and things like

string token = authclient.AuthenticateUser(username, password);
if (token != null)
{
ssOTAuth.AuthenticationToken = token;
dmOTAuth.AuthenticationToken = token;
csOTAuth.AuthenticationToken = token;

}

contextID = dm.GetVersionContentsContext(ref dmOTAuth, dataID, 0);

the above is akin to a logged in user trying to download.the ref keyword is modern .net above 2.5 CLR or higher

If you are a JAVA CWS/EWS

In Java, however, you don’t need to do this and instead you set authentication information into the object representing the service. In your code you do this

setSoapHeader((WSBindingProvider) search, otAuth);

There are many more subtle differences with Java and .NET but for the most part it should work cleanly

If one were interested in debugging at the livelink server

  • Method 1: Login to the livelink URL that usually ends in /llisapi.dll or livelink.exe or livelink.Do you see an authentication screen that looks like an HTML page and not one that looks like a windows auth prompt?.If you were seamlessly taken into the application then this “instance” of livelink server has its authentication set to some authentication.assuming the simplest mechanism it could be IWA also interchangeably known as NTLM,SSO etc etc.
  • Method 3-Put Fiddler and learn how to use it when you hit a webserver.Then you can actually see your WSAPI client code making requests in Action.Many  times they are going to indicate something.
  • Method 4: There is a livelink sysadmin request handler that goes like <LIVELINKURL>?func=admin.testargs.Do you see “REMOTE_USER” filled and a auth mechanism something resembling this  AUTH_TYPE =Negotiate REMOTE_USER =DOMAIN\USERID or userid@domain REQUEST_METHOD =GET Then chances are this livelink is protected by a auth method other than “anonymous” Most webservices samples written by OT pertains to simple anonymously authenticated livelink servers.Do you have SSO samples lying in the web or here.Sure search for Guy Pomerleaux or me for a few who have ventured with it in the forums .Just by trial and error of the Web.Config and App.Config I have suceeded.Why wouldnt OT put a official sample,guesses are different web server different ways of deploying livelink,too much work to officially support it although the OTDS mechanism is kind of a middleware to address that 🙂
  • Method 5:Search Debugging Livelink when people or programs search use the Livelink Search API to call it. While it looks integrated believe it or not the searching is a different software and it can be used for any general purpose searching.Read OT history as the first searching company in the world(Yahoo search Engine :).Sometimes it becomes difficult to create queries properly so it is very easy however I do it like this.Isolate a named server(some address that wont be like a LB URL).Find that server’s Opentext.ini and in the [options] area add wantSearchLogs=true.Then run a search from the GUI.In all likelihood for each search you will find a new txt file that will contain the query.Try to understand it and repurpose. Similar files will exist in the Admin server for prospector queries and intelligent classification queries.

Now I have given you many pointers that would lead to successful coding.However let it be known that a livelink can be configured in very many different ways such as an admin can put a expiration  of livelink cookie to a very low value,you could be bouncing off livelink servers ,your code may come from a redirected system such as SAP or SP lots of problems could occur if the architecture is not well understood by replying people like me or even you.I am not a OT employee but have worked enough to know certain things that could occur.So my simple request to you would be to as much as possible educate yourself and the forum about the same. Also try the simplest mechanisms of OT code first to iron out the difficulties.It should not be too  hard.

Advertisements

Java Samples for Content Webservices

 
I LOST ALL CONTENT WHICH WAS STORED IN COMMUNITIES.OPENTEXT.COM.IF YOU ARE A STARTER READING THIS AND WOULD LIKE TO SEE THE ORIGINAL CONTENT DEPENDING ON TIME I HAVE I CAN SEND YOU SNIPPETS.LEAVE A COMMENT TO SUCH EFFECT.

Java Samples for Content Webservices are few and far in between.OT mainly puts samples in C# and many  a times I myself wonder if my company did not allow me to do that how I would do that in Java.In all truth OT ships a massive application called TreeView.java and TreeView.s ln for both languages .But the java thing takes a lot of setup especially if one was not keeping active in that world.However I used the NetBeansIDE to actually do most of that so I use that debugging environment to try all my java stuff Recently I debugged how to run a Live Report in livelink via C# webservices.Then somebody wanted me to show them how to do it via Java.One of these days I want to return to seeing if I can do all this command line with nothing else other than notepad.

Well I created two word documents, my guess is the poster did not speak english  very well,did not know livelink nor did know java to start with  .Hence I dumbed it enough for people to follow in almost any criteria.

 

Having livelink and its builder helps me in my endeavours and so Oscript remains my first love although I am getting farther and farther from it all

 

I have these files in the Communities website

If I had a LR taking a string parameter  how to write that in Java(C# is available aplenty)

If I had a LR taking a integer parameter how to write that in Java(C#is available aplenty)

There is a bug with Live Report Extensions.A poster in KB said that OT is aware of it.

Why Having LR Extensions(something that Webreports) company produces breaks Livereport calling with Webservices of OT

 

 

CONTENT SERVER CS10 SINGLE SIGN ON

Simple Easy To Understand Livelink Authentication using Just IWA

Update- I have  successfully implemented OTDS (Auth & Sync).OT wants all of us to install Tomcat and use java based OTDS for all the things that is Authentication(letting people into livelink) and Synchronization(Creating those people in livelink). Oscript based Directory Services called CSDS will stop shipping when 10.5 dev is complete.I still don’t like the fact that a livelink URL is redirected to TC to come back to livelink,when it could be avoided.That is the mechanism of a OTDS authentication implementation.If left to me I would use OTDS synchronization and just IWA for livelink.

My colleague John taught me how to record video so it is my yet another attempt to teach other users how to make your livelink  single sign on

These are my assumptions.You want to run Single Sign on in your livelink.Your livelink is running on windows and uses IIS7/7.5.

  • Chore #1-Prepare the IIS website for IWA.IWA is called NTLM some times ,  but if you use Fiddler to watch a request you will see a 401 Challenge against AD. Theory is you are accessing a protected resource and the web server will check against AD. No where remotely connected to livelink software.I also say AD because most companies use that.If your company used something else it would do that.

Kyle Bailey was the first guy to use IIS7 on livelink this link will not work If you do not know preliminaries about IIS learn it.

OT uses almost ditton info in their install documentation

Watch this Video of how I check that.

 

 

 

 

 

Checking if IIS is upto our job of providing IWA?

  • Chore #2-You have to enable the livelink website or VD for IWA. For administrative reasons I usually put a anonymous  website so I can login as ‘Admin’ or any other user whose password I can change. I will also create my userid in that livelink before I do this so I don’t get knocked out. So if my domain info was appudomain\appunair in livelink I would create my userid as appunair in lower case

Checking if the Livelink website or Livelink Application is IWA enabled

  • Chore #3-You have to find CSDS. Oscript Directory services for your version and install it in livelink. Most livelink modules are executable that just drop them into the staging folder. The author assumes the user knows how to do that .If your manager says to do OTDS frown at him and when he is not watching you do this instead.
  • As of CS10 Update 6 the code to vet the REMOTE_USER into livelink is in core code.All you need is put the livelink webapp as IWA, go to the admin.index and make sure you say “use webserver for authentication” radio button.Here’s an article that was mostly written by me in the Knowledge Base
  • If your users are using livelink purely thru the webgui this is more than adequate for you.How ever if you find yourselves saying yeah this is fine,but how do I get 2000 users into livelink,that is when “Synchronization” code in CSDS or OTDS comes into play.You can create users in livelink by writing about 20 lines of code reading from a spread sheet as well.
  • If you have Programmers who were using SSO with lapi or CWS applications they can either change the WSDL to point to the OTDS WSDL .AFAIK it is not possible to entertain coding that des SSO without Oscript Directory Services.

Checking if the Livelink administration page is correct to allow IWA authentication

  • Chore #4-In case it does not work type ?func=admin.testargs. If you do not see REMOTE_USER is not coming thru you will have to trouble shoot. You have to be a sys admin to do that as well.Note admin.testargs is livelink oscript code spitting out web environment variables.You can find equivalent aspx files in the web.

Why do I not like RCS(OTDS) .It will take a good few years before it is stable. Also I do not like the idea of a call to livelink ,hopping over to Tomcat,to again call AD to return a ticket which again was the REMOTE_USER.Now you would surely benefit if your org wanted to make SAP talk to livelink .Also it is downright confusing if you have to write SSO code against livelink as well.It is confusing to write even when it is IWA on the web server

I feel unless OT is able to assure its existing IIS clientele(about 75 to 80 %) that OTDS will be a better alternative than the OOB IIS IWA, most customers will stay with trusted windows authentication rather than the contraption/conundrum.What they can do is to make the java code base in tomcat stronger rather than telling each customer the slightest crapping out of RCS results in a re-install.What OT does not understand is big companies cannot hot patch /change stuff right when OT wants is that is far from the truth in the ground.Obviously the Synchronization code with which one creates users and groups in livelink is very much better in this java version.Once again many people confuse synchronization to be somehow tied to authentication. Nicht, Nein they are no way connected.Synchronization just allows users and groups to be created and held synchronized based on a LDAP query both of the activities are in no way connected to each other.

If the reader now understands who is doing what then I see why a intelligent user could not use another server say apache or tomcat to do windows authentication and help the livelink world.I just wanted the users reading this to know that OT has no interest in teaching you how to configure IIS as it is expected that a web server admin knows all this.It just happens that Livelink is a webserved application and hence the livelink admin sort of is the IIS admin and so on.

Single Sign On and Content Web Services Update

Update 04/28/2016

Pre- Requisites– Livelink 10/10.5/16  Server configured for Single Sign On using IWA . This is for users/companies who allow REMOTE_USER to trickle into livelink. If you have configured your livelink to use OTDS or simply said if OTDS is actually responsible for providing the Authentication then this post does not address that.In CWS which involves a OTDS server you are sourcing your authentication(read a different WSDL than the livelink authentication WSDL) from that.The theory there is your wsapi computer or client will pass your kerberos authentication and OTDS will vet that with AD/DC and pass it back. This OTDS ticket is now usable in your code.

 

Sample Setup on the WSAPI WEBSERVER

  1. Copy the webservices from OpenText  to a folder in the IIS server.For ease we assume your livelink server is on the same host and knows how to handle REMOTE_USER.If you want to run your livelink on another server edit the Web.Config to give it the real server name and port.I doubt if my setup can span computers never tested it that way.
  2. Configure an application that looks like the screen capsso setup
  3. Make sure it has IWA turned onsso1and make sure Extended Protection is OFF
  4. If not already done create a logs directory that is at the same level as \bin and manage its permissions correctly.This can also be done by doing a setspn which is really an advanced topic.The intent is when the client code hits this WSDL the application pool identity will transfer your remote_user and windows will do all that mumbo_jumbo.windows acl
  5. Edit the Web.Config carefully after making a copy .I am showing you changes highlighted for Authentication,DocumentManagement& ContentService.The file is rife with several possibilities so start with these 3 and mature into SSL and others Web.Config
  6. Give the WSDL a whirl .If it cant create a service or the green lines it is not a fault of OT.This is all windows WCF configuration.Check Microsoft sites or google for your errors.Things I check is that if all is successful the logs directory will show windows logs
  7. If the WSDL can now be put into a real source code file and you get errors in your client file the log files will indicate the errors coming from livelink. Note if you were using code form anonymous livelink/wsapi  you need to rebuild the source after updating the wsdl’scode
  8. The above were tested on a CS10 with oscript directory services and patches for SSO. I wrote a client WS which uses windows authentication and gave it to our app dev team.

If you have the chance to code in this you will be very pleased