Open Mic Webcast. Troubleshooting Sametime Policies

Transcription

1 Open Mic Webcast Troubleshooting Sametime Policies Date: March 30, 2016 Speaker: Sandy Lee Panelist: Casey Toole, Jennifer Isola-Mayes and Nancy Pittman

2 Troubleshooting Sametime Policies 2

3 Agenda What is Sametime policy policies.user.xml file Custom policies How to find user assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 3

4 Agenda What is Sametime policy policies.user.xml file Custom policies How to find user assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 4

5 What is Sametime policy Server side access controls to allow or disallow user access to Sametime features Examples: Save Chat History, File Transfer and Audio Video Applies to Sametime stand-alone client, Notes Embedded Sametime client, Web and Mobile clients Enforced at each client login Supports custom policies which can be assigned to users and/or groups Policies are stored in DB2 datasource Community Server(s) locally cache to policies.user.xml file located off the Domino program directory and Community Server cache is for Instant Messaging (Chat) and Media Manager (Audio/Video and SIP) Sametime Meeting Server(s) locally cache meeting policies in memory If a Sametime Cluster or Community of servers the policies must be the same on all servers. You can verify by comparing the policies.user.xml files on each server. The files should be updated 'hourly', if you see very old xml file then that indicates possible issues. Reference: 5

6 What is Sametime policy There are three types of policies that can be assign to a user or group. Type Description Examples Instant Messaging (im) Allows/Disallows features for Chat clients including the Standalone, Embedded client, Mobile Chat client Chat History Custom Emoticons dmin_ssc_policies_comm_list.dita?lang=en Meetings (ms) Allows/Disallows features for meeting clients including Standalone, Embedded, Browsers, Mobile Meetings Screen sharing Allow control feature Media Manager (av) dmin_ssc_policies_meet_list.dita?lang=en Allows/Disallows features for Standalone, Embedded client, Mobile for (audio and video features provided by Sametime Media Manager). SIP-based calling (VoIP feature provided by Sametime Media Manager). Allow access to audio only Set resolution and line rates Cap bandwidth dmin_ssc_policies_media_list.dita?lang=en Reference: 6

7 What is Sametime policy On start up and every 60 minutes by default the Community Server(s) update the policies.user.xml file by pulling down the information. Configuration Refresh interval can be changed. Configuration Refresh interval is set to 30 minutes for the Meeting Server which can be changed. The client has a 60 minute refresh interval. The same Sametime System Console Rest API is used for both types of refresh. You might need to wait up to two hours to see a policy change on the client! If possible stop and start the server (or ST Policy service if Windows OS) and relogin to the client. Reference: 7

8 What is Sametime policy Directory and Configuration refresh intervals are stored in Community Services document of the (stconfig.nsf) for Instant Messaging and Media Manager policies. This value can be modified through the Sametime System Console interface. Stop and start the Community server to recognize the change. Directory refresh interval (minutes): ST Policy uses as groups cache refresh interval. Configuration refresh interval (minutes): ST Policy uses as rules/assignment refresh interval. Stconfig.nsf document Sametime System Console User Interface select Community Servers, do this for every server. Reference: 8

9 What is Sametime policy Meeting Server policies are also administered through the Sametime System Console. BUT Meeting Servers pull their policies directly from DB2 and cache in memory. Their interface is in the Manage Policies section. A user logs into Meeting Server. Meeting shelf or browser requests policy thru API Meeting Server code. Meeting Server looks up the user's policy in memory cache and sends the meeting policy to the client. Sametime System Console User Interface Reference: 9

10 What is Sametime policy Sametime automatically provides two predefined policies for each of the three policy types. All authenticated users are assigned to the Default Policy. All unauthenticated users are assigned to the Anonymous Policy, the only policy guest users receive. Administrators create additional custom policies and assign users and groups, applying weight to the policies. 10

11 What is Sametime policy Managed-settings.xml file gives admins control of desktop client preference settings. For example, if the policy allows Save Chat History then managed-settings.xml file can be used to push out where to store the chats on each desktop client. Or if policy allows users to use meetings, then managed-settings.xml can push out the name of the meeting server and the port to each client. Watch for upcoming Open Mic on Managed-settings.xml, Managed-Community-Configs.xml and Domino Policies Reference: 11

12 Agenda What is Sametime policy policies.user.xml file Custom policies How to find user assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 12

13 policies.user.xml For environments managed by Sametime Console, policies are configured only in the SSC, required for Sametime 9.0. Instant Messaging and Media Manager policies are cached in \domino\policies.user.xml file as mentioned. Sametime Community servers connect to port 9080 for HTTP and 9443 for HTTPS to retrieve policies. If Sametime System Console is not available to the Community server then the last pulled version of policies.user.xml file will be used for Instant Messaging and Media Manager policies. Do not edit the policies.user.xml file. 13

14 policies.user.xml - Instant Messaging 14

15 policies.user.xml You can find the different policy IDs at these web pages: Instant messaging policy Ids Meetings policy Ids Media services (audio and video) policy Ids 15

16 Agenda What is Sametime policy policies.user.xml file Custom policies How to find user assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 16

17 Custom policies To create a custom Policy, click the tab corresponding to the type of Policy, then click New Policy Name: Enter a name describing the policy, to avoid trouble don't use \ or special characters in names Check the desired settings, click OK when complete Once the Policy is created, it must be assigned to a LDAP group or individuals Choose the Policy to be assigned, then click Assign 17

18 Custom policies Click the Add Users" or "Add Groups button In the search for field, enter the name of the group or individual, then click the Search button. Check the box next to the name of the group or individual. Then click Assign. Example of adding User: Reference: 18

19 Custom policies Add any other groups or individuals that should also be applied to the policy. Then click Done when complete. will appear at top of page if assignment was successful. Message 19

20 Agenda What is Sametime Policy policies.user.xml file Custom policies How to find user assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 20

21 How to find user assigned policy Go to the Sametime System Console Manage policies Find Active Policies button. Search on the user name and you will find their assigned policies from DB2 tables. Reference: 21

22 How to find user assigned policy On the Community server, you can verify the settings are pulled appropriately by reviewing policies.user.xml. Search for the custom policy and once found, search for <policyassignment> section. <assignment id= will be set to a DN or the UUID representation of the user or group. In this example, the server is Active Directory and the attribute being used is objectguid (which is the UUID). Mary Santo was assigned to the Test Custom Policy. Type=2 is a user assignment and Type=1 is a group assignment.. Active Directory Attributes: Mary Santo 22

23 How to find user assigned policy UUID (Universally Unique ID) or DN (distinguished name) Policy assignments use UUID attribute by default. After upgrading to Sametime 9.0 server, you should upgrade policies to use the UUID attribute. The LDAP attribute used for UUID is different for every LDAP Server type. For example, Domino LDAP the attribute name is Dominounid and Active Directory attribute is objectguid. If the UUID attribute does not exist or is invalid, then the DN can be used by picking DN when creating or editing the LDAP Deployment Plan's Advanced Person Settings. Domino Directory (LDAP format only): Dominounid IBM Security Directory Server: ibm-entryuuid Microsoft Active Directory: objectguid Novell edirectory: guid Reference: 23

24 Agenda What is Sametime Policy policies.user.xml file Custom policies How to find user assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 24

25 Policy weight and precedence To change the weight of a policy, select the name of the policy, then click Move up to increase the weight or Move down to decrease the weight in the list. The Default and Anonymous policies cannot have their weight changed. Reference: 25

26 Policy weight and precedence If you don't have the LDAP search filters configured correctly, users will only get the default policy. Search filter to use when resolving a user name to distinguish name is the search filter used by Policy. As mentioned, by default the Sametime 9.0 server will use the UUID attribute for policy assignment. Make sure there is not a * (wildcard) next to the %s in the search filters for the UUID attribute. Active Directory Example: Review this technote for details on the UUID being used in a custom java filter: Reference: 26

27 Policy weight and precedence For authenticated users with two or more policies, Sametime searches for an exact user ID match and then applies the highest weighted policy. If there is no match with user ID, then Sametime applies the highest weighted group match for the user ID. If no group matches are found for the user ID, the default policy is applied. Nested groups are supported and you can configure how many levels of nested groups Sametime will support. Default is 4 levels deep for Meeting policies and 1 level for Instant Messaging and Media Manager policies. Setting can be as high as 10 or set to -1 to denote no nested groups are supported. If a policy is assigned to a group nested more then the current nested setting, the user will receive the Default policy. NOTE: A large number in the Maximum Nested Group Depth can impact performance, we recommend no more then 3! Edit Sametime System Console for Meeting Server Edit sametime.ini parameter for the Community Server, then stop and start Domino Reference: 27

28 Policy weight and precedence By default the server searches ALL groups using the Group search filter looking for a match based upon the user ID. This is extremely inefficient. Starting in Sametime 8.5 a Policy GroupMembership field was add at the bottom of the LDAP document in STConfig.nsf. If you have memberof or for Domino LDAP the dominoaccessgroups attribute in the person document for their group assignments, then the attribute can used to quickly look up the user in their assigned groups. The GroupMembership default is: Example: Active Directory Example: LDAPsearch of Domino LDAP Instead use the group attribute when available! Reference: 28

29 Policy weight and precedence The policy with the highest weight wins the policy setting. But determining the highest weighted policy for a user you first need to determine which group or direct assignment applies to that user! Policy Behaviors: Nested Groups in Policy Assignment: 29

30 Agenda What is Sametime policy policies.user.xml file Custom policies How to find user assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 30

31 policyexceptions.xml There is a configurable way to assign policy based on Sametime client type and/or client version. You can either allow or restrict policy settings by creating a policyexceptions.xml file. The user still retrieves their regular policy assignment and then the exceptions are applied to that. For example, restrict all standalone Sametime clients from having Audio Video features. Create ONE policyexceptions.xml file only and place in the Domino program directory of the server(s). If Sametime Community or Sametime cluster of servers, all servers will have the same file. Administrator assigns a weight like other policies. policyexceptions.xml file is evaluated against other policies like the normal process. Use an ASCII editor like notepad++ Use commas to separate client_ids and client_versions parameters. Use a browser to confirm XML syntax is correct. Case SenSiTive Reference: 31

32 policyexceptions.xml Example: Set instant messaging exception for client to disable file transfer and increase contact list to 300 and media manager disable SUT for 4660,4661,4672 client types. <PolicyExceptionsRules> <Rule id="1" weight="10" product="im" client_versions="8500" client_id=" "> <Policy id="2005" value="0" /> <Policy id="2014" value="300" /> </Rule> <Rule id="2" weight="20" product="av" client_versions=" " client_id="4660,4661,4672"> <Policy id="sut.2014" value="0" /> </Rule> </PolicyExceptionsRules> Instant messaging policy Ids Meetings policy Ids Media services (audio and video) policy Ids Reference: 32

33 policyexceptions.xml The Rule id= is a unique number for the policy rule you are setting up. The product= will be either im, ms or av. The client_ids="<list of ids> the decimal representation of the client IDs that the exception applies. The client_versions= <list of client versions> set to the client version and must be 4 number representation. Use around the values. Since Sametime policies have weights, the rule will be given a weight. The user will get the policy that has the highest weight, so it is important to assign a weight to the policyexceptions.xml that will out weigh the existing policies. Set the weight= to the desired number. 33

34 policyexceptions.xml This technote has the client id types available: client_ids need to be converted from hexadecimal to decimal number before you can use them in the file. Hex value 0x130D Decimal value 4877 Hex value 0x1244 Decimal value 4676 Reference: 34

35 policyexceptions.xml Run a Browser test Open your xml file using a browser and confirm it displays. Broken file may look like this which points you to the line and column needing a correction. 35

36 policyexceptions.xml IMPORTANT NOTE: The verification of Active Policy assignments for a user as discussed earlier through the Sametime System Console, DOES NOT apply to policyexceptions.xml because it resides outside of the Sametime System Console database source. 36

37 Agenda What is a Sametime policy policies.user.xml file Custom policies How to find a user's assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more I\information 37

38 Troubleshooting Sametime policies There are several places that Sametime policy can break: Sametime System Console Policy changes don't make it to DB2 datasource. Sametime Community Server - ST Policy service is not starting and policies.user.xml file is not updated. Sametime Desktop, Sametime Brower and Sametime Mobile clients Do not receive policy settings or policy assignment is incorrect. 38

39 Troubleshooting Sametime policies Sametime System Console DB2 access Check that the Sametime System Console can connect to the datasource in DB2. Review this link: If you change your administrator password in DB2, you must update your password in the Sametime System Console as well as the Meeting Server. This includes when there is an expired DB2 administrator password! Review this link: Sametime System console debug - *=info:com.ibm.sametime.*=all Exception:com.ibm.db2.jcc.b.SqlException SourceId:com.ibm.ws.rsadapter.spi.InternalGenericDataStoreHelper.getPooledCon ProbeId:1298 com.ibm.db2.jcc.b.sqlexception: [ibm][db2][jcc][t4][2012][11248] Connection authorization failure occurred. Reason: Password expired. Reference: 39

40 Troubleshooting Sametime policies policies.users.xml update fails When the SSC connects to the Community servers and the Community servers connect to the SSC, the connection is done with an authenticated bind. If the WASadmin password changes or expires your Policy updates will stop. Make updates to the WASadmin credentials. If the Domino Admin account or password changes you need to update that too. After enabling ST Policy debug on the Community server you see in the STPolicy*.txt file this error: [ 17:24: SEVERE 1 ] : DbXmlBlackBox : readsorteddataforproducts : ServiceException: Throwable: class com.ibm.sametime.console.admin.services.exception.serviceexception Message: com.ibm.sametime.console.common.http.api.exception.httpbadrequestexception: Unauthorized On the SSC: Reference: 40

41 Troubleshooting Sametime policies polices.users.xml update fails Reset WASadmin authentication credentials in the console.properties file on the Community server(s) after you make a back up of the file first! 1) Remove the SSCEncodedAuthorization= line 2) Add these two parameters with correct values to recreate the encoded authorization parameter: SSCUserName= SSCPassword= 3) Stop and start the Community Server 4) The SSCEncodedAuthorization will be re-created and the two parameters removed 5) CaSE sensitive! If the SSCEncodedAuthorization is not added back, check the CaSE! Reference: 41

42 Troubleshooting Sametime policies policies.user.xml update fails Check the date of policies.user.xml file to see when it was last updated Open the policies.user.xml file using a browser and ensure there are no display issues Check the console.properties file settings in the \console sub-folder off the Domino install directory SSCEncodedAuthorization=d2FzYEStaWHYcGOzc3dormQ= SSCSSLEnabled=false SSCHTTPPort=9080 SSCHostName=SSCserver.acme.com SelectedDeploymentId= a-STSTDDep SSCHTTPSPort=9443 LogLevel=FINEST 42

43 Troubleshooting Sametime policies policies.user.xml update fails Check that the Sametime System Console is configured in the sametime.ini file: POLICY_DB_BB_IMPL=com.ibm.sametime.policy.databasebb.xml.DbXmlBlackBox Not the to Stpolicy.nsf (old policy) which would be: POLICY_DB_BB_IMPL=com.ibm.sametime.policy.databasebb.notes.DbNotesBlackBox 43

44 Troubleshooting Sametime policies policies.user.xml update fails REST API Useful to confirm that the Sametime System Console is running and available to the Community Server As a troubleshooting step, run these commands from a browser on a Community Server to rule out DNS, FW or networking issues. These are the same calls the Community server, STPolicy Service makes to the Sametime System Console The URLS require your WebSphere authentication you should start with a clean browser and see a 'basic' REST API prompt when authenticating. If SPNEGO is enabled see To retrieve policy settings - Retrieve All policy ids - To retrieve a specific policy - To retrieve policy assignments - /stpolicy/policyusers/<policy.id> 44

45 Troubleshooting Sametime policies policies.user.xml update fails Retrieve policy settings from the SSC - Retrieve All policy ids, default and custom

46 Troubleshooting Sametime policies policies.user.xml update fails To retrieve a specific policy setting - To retrieve policy assignment for users

47 Troubleshooting Sametime policies Sametime Community Server - ST Policy service is not started Check the \trace\sametimeyymmdd.log for ST Policy errors on start-up of the Community server Look for (E)rror messages, (I)nfo and (W)arning are okay Here is the version of ST Policy service If Windows OS check for errors in the System and Application Event viewers Enabled the sametime.ini debug parameter for ST Policy, stop and start of Domino is required for the new debug setting [Debug] POLICY_DEBUG_LEVEL=1 change to POLICY_DEBUG_LEVEL=5 while troubleshooting Review \trace\stpolicy_yyddmm_hhmm_#.txt files for errors message 47

48 Troubleshooting Sametime policies Sametime Desktop, Sametime Brower and Sametime Mobile clients Users do not receive policies.user.xml or DB2 settings or policy assignment is incorrect. Use the Sametime System Console to validate that the policies are in the database and assigned to the user. 'Find Active Policies' Check policy settings with the REST API URL command to find which is set, uniqueid = UUID or externalname = DN <p:policy-attribute id=\"assignment.property\" type=\"string\" current-value=\"uniqueid\" default-value=\"uniqueid\" Confirm that the UUID attribute is in the three Community LDAP search filters 48

49 Troubleshooting Sametime policies Sametime Desktop, Sametime Brower and Sametime Mobile clients Users do not receive policies.user.xml or db2 settings, policy assignment is incorrect. Group Membership consideration If using the Policy GroupMembership field in the LDAP document make sure the configuration is correct for your LDAP type. Do you see Group attribute of memberof or DominoAccessGroups in the person documents? Default setting 49

50 Troubleshooting Sametime policies Sametime Desktop, Sametime Brower and Sametime Mobile clients Users do not receive policies.user.xml or db2 settings, policy assignment is incorrect. Verify the GroupMembership setting matches the Sametime System Console group membership setting: 50

51 Troubleshooting Sametime policies Sametime standalone and Notes client Embedded debug Parameters 1. Locate the client workspace as explained in Reference link below. 2. On the computer where you use the client, use a text editor and open the rcpinstall.properties file. 3. Insert the following lines near the end of the file with no trailing spaces. com.ibm.collaboration.realtime.community.internal.config.level=finest com.ibm.collaboration.realtime.policy.sametime.level=finest 4. Stop and start the client and once logged in, quickly check if the policy setting is wrong. 5. Run the collect logs: In the Notes embedded client, click Help > Support > Collect Support Data. In the stand-alone Connect Client, click gear icon > Help > Support > Collect Support Data. Reference: 51

52 Troubleshooting Sametime policies Sametime standalone and Notes client Embedded debug parameters Using a browser start by looking for severe policy errors in the error-log0.xml files. You want to see what is reported on the client start up. Typically no errors are found in the error-log files. Reference: 52

53 Troubleshooting Sametime policies Sametime standalone and Notes client Embedded Sametime Debug Parameters Next using a browser look for policy errors in the trace-log0.xml files. You want to see what is reported on the client start up. If no errors (severe) then start searching for the policy value that is not correct. Example im.2011, search for 2011 or Multiple Look for Adding Final policy which states what value is active for the user. Reference: 53

54 Troubleshooting Sametime policies Mobile and Web browser clients do not get policies Use the Sametime System Console to validate that the policies are in the database and assigned to the user 'Find Active Policies' If custom policy then check the policies.user.xml file on the Community server for assignment Enable the Community server policy debug and search for user to find what policies show assigned Enable the ST Proxy server debug and search for the user to see if any errors for policy. *=info: com.ibm.rtc.stproxy.*=all: com.ibm.collaboration.realtime.*=all Reference: 54

55 Troubleshooting Sametime policies Mobile and Web browser clients do not get policies Check for the policy settings found by the STProxy server for the user: [01/10/16 14:47:04:035 IST] CommunityServ 2 com.ibm.collaboration.realtime.stproxy.services.community.communityservi ce policyqueried { [Key:2001 Value:0] [Key:2002 Value:0] [Key:im.enableOrganizationTreeView Value:0] [Key:2020 Value:0] [Key:2021 Value:500] [Key:4 Value:com,bat] [Key:3000 Value:1] [Key:1 Value:1] [Key:2 Value:1000] [Key:3 Value:1] [Key:2016 Value:512] [Key:im.allowTransferringFilesToNwayParticipants Value:0] [Key:2015 Value:300] [Key:2014 Value:0] [Key:2013 Value:1] [Key:2019 Value:0] [Key:2018 Value:20832] [Key:2017 Value:20830] [Key:2010 Value:1] [Key:2011 Value:0] [Key:2012 Value:] [Key:im.enableOfflineMessages Value:0] [Key:im.maxNumberUsersToReceiveSingleFileInOneFileTransferSession Value:10] [Key:2002 Value:1] [Key:2005 Value:1] [Key:2004 Value:1] [Key:2006 Value:365] [Key:im.allowTransferringMultipleFilesAndFolders Value:0] [Key:2009 Value:1] [Key:2008 Value:1] [Key:2026 Value:1] [Key:2023 Value:1] [Key:2024 Value:1] [Key:2025 Value:1] Reference: 55

56 Agenda What is a Sametime policy policies.user.xml file Custom policies How to find a user's assigned policy Policy weight and precedence policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more I\information 56

57 Known Issues Sametime Desktop, Sametime Brower and Sametime Mobile clients Users do not receive policies. Be sure the Community Server is not a Limited Use server. This version of Community server has very few policy options. Reference: 57

58 Known Issues Active Directory (AD) has a policy retrieval issue when isbinary is set to false If you modify your directory settings, or add a directory outside of the Guided activity, then the 'isbinary' setting may be set to false incorrectly. When this happens, the resolve request for that user assignment will fail on the Community Server side, and the user will not get the correct policy assignment. Use to verify the setting. Contact IBM to get help with setting to true. 58

59 Known Issues Notes client with Embedded Sametime Users do not receive all policy settings like the stand-alone client. Notes client with Embedded Sametime you want to make sure that this policy setting is enabled on Comuunity server(s). This applies the policies that the stand-alone client receives to the Embedded client. If not enabled you won't have File Transfer or screen capture available. im.3000.label = Allow all Sametime Connect features to be used with integrated clients (IC) Reference: 59

60 Known Issues Sametime mobile client cannot login "Login Error: The login information does not match any existing accounts. Check your user ID and password Sametime Policy setting for "Allow mobile client." If this option is not selected, this login error may occur. Reference this technote: Reference: 60

61 Agenda What is a Sametime policy policies.user.xml file Custom policies How to find a user's assigned P\policy Policy weight policyexceptions.xml file Troubleshooting Sametime policies Known issues Where to get more information 61

62 Where to get more information Sametime Administration Guide STPolicy will not start on the Sametime Community server Understanding, configuring and troubleshooting Sametime policies 62

63 Questions Press *1 on your telephone to ask a question. Visit our page or our page for details on future events. To help shape the future of IBM software, take this quality survey and share your opinion of IBM software used within your organization: IBM Collaboration Solutions Support page IBM Collaboration Solutions Support 63