EMC Document Sciences xpression

Transcription

1 EMC Document Sciences xpression Version 4.6 Installation Guide EMC Corporation Corporate Headquarters Hopkinton, MA

2 Legal Notice Copyright EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED AS IS. EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. Adobe and Adobe PDF Library are trademarks or registered trademarks of Adobe Systems Inc. in the U.S. and other countries. All other trademarks used herein are the property of their respective owners. Documentation Feedback Your opinion matters. We want to hear from you regarding our product documentation. If you have feedback about how we can make our documentation better or easier to use, please send us your feedback directly at ECD.Documentation.Feedback@emc.com

3 Table of Contents Revision History Chapter 1 Before You Install xpressionhome Documentum Edition and Enterprise Edition xpublish or CompuSet Scenarios Disk Space Requirements Requirements for Windows UAC Settings on Windows Non-English Windows Versions on Client Computers Requirements for UNIX Platforms User Validation User Profiles The User to Install xpression Verify Environment Settings Using xwindows Authentication on the xpression Server Local User Authentication LDAPUser Authentication LDAP Settings from the xpression Installer LDAPUser Parameters LDAP_NAME_ATTRIBUTE LDAP_ADMIN_PWD LDAP_ADMIN_DN LDAP_USER_FILTER LDAP_USER_MODE LDAP_MEMBER_ATTRIBUTE LDAP_GROUP_FILTER LDAP_SERVER_URL LDAP_NAME_CONTEXT LDAP_GROUP_CONTEXT LDAP_INITIAL CONTEXT FACTORY USE_START_TLS LDAPS Configuration Start TLS Configuration Multi-Domain LDAP Configuration LDAP_DOMAIN_NAME.DOMAIN[x] LDAP_SERVER_URL.DOMAIN[x] LDAP_DOMAIN_CONTEXT.DOMAIN[x] LDAP_ADMIN_USER.DOMAIN[x] LDAP_ADMIN_PASSWORD.DOMAIN[x] LDAP_USER_FILTER.DOMAIN[x] LDAP_GROUP_FILTER.DOMAIN[x] LDAP_INITIAL_CONTEXT_FACTORY.DOMAIN[x] LDAP_DISPLAY_ATTRIBUTE.DOMAIN[x] LDAP_AUTH_ATTRIBUTE.DOMAIN[x]

4 Table of Contents LDAP_MEMBER_ATTRIBUTE.DOMAIN[x] LDAP_QUERY_USERS_FOR_PICK_LIST.DOMAIN[x] LDAP_QUERY_GROUPS_FOR_PICK_LIST.DOMAIN[x] Switching from ADUser to LDAPUser SiteMinder Authentication Access Through FastPath Access Through Direct Login User Exit Authentication Clustering xpression Groups Messages Unicast Multicast Local Cast Horizontal Cluster Requirement Vertical Clusters SAP System Landscape Requirements, Recommendations, and Limitations xpression Requires Exclusive Environment JBoss and WebLogic Installation Paths Multiple Instances of xpression Installing Multiple xpression Servers on the Same Machine Databases That Require a Database Client Removing Existing xpression Server Installing the xadapter Database Issues Copying an xpression Database Migration Limitation for Oracle Databases License Validation with Linux Autograph and xpression on the Same Server Chapter 2 Step One: Configure DB2 Database About the xpression Database DB2 on Linux Step One: Start the Database Manager Start the Database Manager Service with Windows Services Start the Database Manager from the Command Line Start the Database Manager on UNIX and Linux Step Two: Create a New DB2 Database Create the Database from the Command Line DB2: Create the Database with IBM DB2 Control Center Step Three: Create a New Database User Creating the User from the DB2 Command Line Processor Creating the User from DB2 Control Center Step Four: Create Buffer Pool and Tablespaces Creating an 8K Buffer Pool and Table Spaces With the Command Line Creating an 8K Buffer Pool and Table Spaces With the DB2 Control Center Step Five: Run xpression Database Scripts Step Six: Test the xpression Database Step Seven: Modify Database Configuration Modifying a DB2 Database Configuration Step Eight: Back Up Your Database Step Nine: Enable Full-Text Searching Create DB2DBDFT Environment Variable

5 Table of Contents Create DB2DBDFT Variable on Windows Create DB2DBDFT on UNIX and Linux Enable Full-Text Search Automatically Updating Your Index Auditing Your xpression Database DB2 Stopwords DB2 Limitations Chapter 3 Step One: Configure Oracle Database About the xpression Database Important Information About Oracle Databases Using Oracle with Other Databases The Oracle Client Application Oracle Requirement Migration Limitation Step One: Create a New Database Step Two: Create a New Database User Creating the User with SQL Plus Creating the User from the Oracle Enterprise Manager Database Express Step Three: Run xpression Database Scripts Step Four: Test the xpression Database Step Five: Back Up Your Database Step Six: Configure Full-Text Searching For Windows Installations Auditing Your xpression Database Oracle Stopwords Chapter 4 Step One: Configure SQL Server Database About the xpression Database The SQL Server Client Application Database Authentication Configuring Windows Authentication SQL Limitations and Known Issues Full-Text Search Limitation Merant Drivers for SQL Server Step One: Create a New Database Create a New Database on SQL Server Step Two: Create a New Database User Step Three: Run xpression Database Scripts Step Four: Test the xpression Database Test Your xpression Database on SQL Server 2008 R2/ Step Five: Installing Microsoft JDBC Driver Microsoft SQL Server JDBC Driver Step Six: Final Configuration Tasks Determine Port Number Back Up Your Database List of Stopwords Auditing Your xpression Database

6 Table of Contents Chapter 5 Step Two: Configure Application Server Before Installation Configuring WebSphere WebSphere Paths Your WebSphere Installation Location Create an xpression Profile Create Profile with the manageprofiles Command Setting Up a Profile as a Windows Service Deleting a Profile from the Command Line Deleting a Window Service Creating a Profile with the Profile Management Tool Configure the Application Server Start Your Server Start the WebSphere Administrative Console Configure WebSphere Variables USER_INSTALL_ROOT Variable JAVA_HOME Variable XPRESSIONHOME Variable XPRESSION_EAR Variable Database Driver Variable Set Class Loading Mode Set Transaction Timeout Enable Pass By Reference Set Host Alias Add Image to MIME Type on WebSphere Configure JVM Settings Configure Data Sources Create an Authentication Alias Creating a DB2 Data Source Creating an Oracle Data Source Creating a SQL Server Data Source Relational Customer Data Sources Setting resultsetholdability attribute for DB Deploy the xpression Enterprise Archive File Pre-Deployment Configurations Deploying the xpression Enterprise Archive File Deploying the JMS-Enabled xpression Adapter Import LDAP Server Certificate to Truststore Configure Cookies Settings Set Transport Option for CSIv WebSphere Users and Permissions Configuring WebLogic Understanding Your Server Paths Understanding User Names Create a New WebLogic Configuration Extract the xpression Enterprise Archive Files Configuring JBoss Add Environment Variables Determine Your HTTP Server Port Prepare Your JBoss Environment for Installation Chapter 6 Step Three: Install xpression Server About the Installer Running the xpression Installer The Choose xpression Edition Page The Choose Installer Type Page The xpression Installation Folder Page The Select Application Server Type Page

7 Table of Contents Selecting Application Server Installation Directory Selecting Application Server Home Directory The Select JDK Installation Folder Page The Select EAR Folder Page The Application Server Information Page The HTTP Server Connection Page The Select Driver Page The "Database URL Settings" Page The Server Page The User Authentication Security Settings Page The LDAP Authentication Page The Documentum Settings Page The Cluster Settings Page The Performance Settings Page The User Selection Summary Page The Pre-Installation Summary Page Restart Your Server Installing the Server in Silent Mode Creating the xpression Server Silent Mode Response File Running the xpression Server in Silent Mode Chapter 7 Step Four: Configure xpression Server Additional Steps for Linux and UNIX Configuring Local Authentication for Non-Root Users Configurations for Using the xpression Documentum Repository Editing bash_profile for JBoss on Linux Additional Configurations for WebSphere Increasing Application Server Memory Library File Usage Configurations for CompuSet Jobs in RMI Mode Additional Configurations for WebLogic Setting Java Options for UNIX Systems Defining Path for xpression Logging Starting the xpression Server Configuring xpression on WebLogic Configure Data Sources DB2 JDBC Driver Oracle JDBC Driver Microsoft SQL Server Driver Configuring WebLogic When Publishing xpresso for Word Documents from xbatch Manually Deploy the Enterprise Archive File Configure JTA Starting the Enterprise Archive Files Increasing Memory Size Increasing Maximum Message Size Additional Configurations for JBoss Increasing Memory Settings Configuring Data Sources on JBoss Windows Authentication with Microsoft SQL Server Using a Relational Database with JBoss Using a Non-Default Data Source with JBoss Configuring Additional Components Define Path for xpression Logging Filenet Configuration Starting and Stopping the Server

8 Table of Contents Installing an xpresso Client on the Same Machine as the xpression Server Configuring the xpression Diagnostic Utility Oracle Database Settings for BatchRunner Configuring User Access for xadmin and xdashboard Resetting the Super Administrator User Password Connecting CompuSet Bridge to the Server Chapter 8 Installing and Configuring Client Applications xdesign Chinese Language Paths Requirement for Windows Exporting Searchable Document Lists Installing xdesign Installing xdesign in Silent Mode Changing Log Location for Silent Mode Installer Creating the xdesign Silent Installer Response File Running the xdesign Silent Installation Update LAN Settings xpresso for Word Before You Install Directory for Temporary Files Supported Data Types Installing xpresso for Word Registering Your Software xpresso for Adobe InDesign Before You Install Requirements for Windows Users About InDesign Versions Directory for Temporary Files Installing the xpresso Plug-ins into the Extension Manager Installing on Windows Installing on Macintosh About the Java Environment Performing a Macintosh Installation Multiple User Access to InDesign on Macintosh Registering Your Software xpresso for Dreamweaver Before You Install Requirement for Windows Users About Dreamweaver Versions Supported Data Types Directory for Temporary Files Installing on Windows Installing on Macintosh Registering Your Software Managing Certificates of HTTPS Servers Configuring xresponse Internet Explorer Settings xresponse User Access Installing VBA ecor.properties Configuration Configuring xrevise xrevise User Access Running xrevise on a non-xdesign Machine

9 Table of Contents Configuring Application Startup Order xeditor About Smart Client Installation Access Rights to Install xeditor Preparing Your Environment Java Runtime Environment Microsoft.NET Framework Install VBA Internet Explorer Settings Adobe PDFMaker Installing xeditor Pushing the xeditor Installation From the Server Verifying the Installation About Deploying xpressforms Validating Properties Files Deploying xpressforms Environment About xpression Adapter Configuring WebSphere MQ Add Queues to WebSphere MQ Configure the JMS Provider Configuring xpression Adapter for WebLogic Using XQuery Outside of xpression XQuery Command Line Utility XML Converter Command Line Utility Installing the Command Line Utilities Sample Commands Chapter 9 Verifying Your Installation Step One: Check Basic Connectivity Examine Server Logs Access xadmin Supply Your License Access Locales Step Two: Import Sample Test Data Step Three: Configure Access Rights Step Four: Test Assembly in xdesign Chapter 10 Integrating with Third-Party Software Integrating with Documentum Step One: Configure Documentum System User Name Step Two: Install Documentum Foundation Classes Step Three: Configure Application Server Adding Paths to Support xpression Batch Configuration Steps for WebSphere Configuration Steps for WebLogic Configuration Steps for JBoss Configuration Steps for Process Builder Users Step Four: Create an ECM Configuration Setting DFC Registry Mode for xpression Documentum Repository Installing the Sample Workflow Deploying the Sample Application Configuring the Sample Workflow Run the Sample Workflow After Updating an Activity Template Adding Formats for Archiving

10 Table of Contents Upgrading the Sample Workflow Integrating with FileNet Implementing FileNet Configurations for JBoss Configurations for WebLogic Configurations for WebSphere Configuring FileNet in xadmin Setting Up the FileNet ECM Server Setting Up the Filenet ECM Configuation Chapter 11 Installing Language Packs Installing a Language Pack for the Server On the Server On the Client Installing a Language Pack for xdesign Installing a Language Pack for xpresso for Word Installing a Language Pack for xpresso for Adobe InDesign Installing a Language Pack for xpresso for Dreamweaver Setting the Internet Explorer Language for xpresso Clients Chapter 12 Uninstalling, Reinstalling, and Removing xpression Uninstall, Reinstall, and Remove Uninstalling xpression Server Preparations for Uninstalling xpression Server on Windows Undeploy Enterprise Archive Files Uninstall the Server Uninstalling xpresso Client Applications Modifying, Repairing, or Removing xdesign Reinstalling xpression Server Removing xpression Completely Chapter 13 Upgrading xpression Chapter 14 Troubleshooting xpression Server Errors During Start Up The Installer Cannot Access JVM Cannot Start the Server on JBoss xdashboard Log On Page Not Displayed Error While Attempting to Connect to xadmin xresponse xpression Database Error with DB DB2 Error When Deleting or Updating Very Large Document xdesign Enabling Access Keys Error xpresso for Word Enabling the xpresso COM Add-in Current Installation No Longer Functions Substituting Font Not Found Corda Builder Not Launching Presso for Adobe InDesign Valid License Being Called Invalid

11 Table of Contents Current Installation No Longer Functions Corda Builder Not Launching xeditor Unable to Reinstall xeditor Chapter 15 Deprecated Documentum Edition Configure xpression for Documentum Deploy Documentum Edition DAR File Create ECM Configuration Define Documentum Users and Roles

12 Table of Contents 12

13 Revision History Revision Date January 2017 October 2016 October 2016 August 2016 July 2016 November 2015 Description Replaced ecor2 with xresponse in Deploying the xpression Enterprise Archive File, page 90. Removed references to always_anti_join and always_semi_join from section 7.6 Added a note to the installation section to help avoid file corruption on installation or upgrade. Added section Configuring WebLogic When Publishing xpresso for Word Documents from xbatch, page 119 Updated sections Configure Cookies Settings, page 92, Switching from ADUser to LDAPUser, page 27 and Microsoft SQL Server Driver, page 117. Initial publication 13

14 Revision History 14

15 Before You Install Chapter 1 Before installation, ensure that your system meets the requirements. The xpression Release Notes contains the system requirements for this release. Note: To avoid security issues, refer to the security guides of your application server, database server and operating system to configure them properly. Installation and Upgrade Warning xpresso for Adobe Dreamweaver CC (release 2014) should not be installed with other xpresso clients on the same operating system (MAC or Windows) for the following reasons: MAC OS The installation process for xpresso for Adobe Dreamweaver CC (release 2014) installs the x86 (32 bit) framework. However the installation process for xpresso for Adobe InDesign CC (release 2014) installs the x64 (64 bit) framework. These Adobe programs share some common files and libraries. This means that those shared files may be overwritten by any one of the above installation processes, and this may cause your existing xpresso clients to crash. Windows xpresso for Adobe Dreamweaver CC (release 2014) uses a different version of the JRE than the one used in xpresso for Adobe InDesign CC (release 2014) or xpresso for Word. The JRE is installed in the common files folder that is shared by all xpresso clients. Using a different version of the JRE may cause the xpresso for Adobe Dreamweaver CC (release 2014) to crash. xpressionhome The term "xpressionhome refers to the location where xpression is installed on your server. The default location on Windows servers is C:\xPression Documentum Edition and Enterprise Edition xpression Documentum Edition is deprecated in this release. EMC recommends that you upgrade to xpression Enterprise Edition, which contains all the functionality of the Documentum Edition. When using the Documentum Edition, contact EMC Document Sciences Support for additional information. 15

16 Before You Install Documentum Edition can be acquired as a separate add-on to the standard Enterprise Edition server, or as a separate installation that installs the server, but not the Enterprise Edition applications. When installing Documentum Edition, the steps are similar with the standard Enterprise Edition steps. Differences are noted in this guide where they occur. See Chapter 15, Deprecated Documentum Edition for configuration steps for Documentum Edition. xpublish or CompuSet Scenarios xdesign and the xpression Server must both have CompuSet functionality activated to ensure that CompuSet functions properly. If the server has CompuSet enabled, but xdesign does not, the user will not be able to open or edit CompuSet documents in xdesign. If xdesign has CompuSet enabled, but the xpression server does not, the xdesign user will not be able to access or publish CompuSet documents. Ensure that your xdesign and xpression Server environments are both enabled or both disabled. You can select whether to install CompuSet in the installation wizard that is described in Running the xpression Installer, page 98. For descriptions and instructions for all CompuSet features, see the xpression CompuSet User Guide. Disk Space Requirements The xpression installation program requires approximately 520 MB to run. The Disk Space Information page in the installer shows that you need 174 MB to install the xpression Server. However, this refers only to the size of the files being copied to your system. The installer itself requires the remaining space. Ensure that your server has the required disk space allotment of a minimum of 520 MB. Requirements for Windows Review the following requirements for Windows platforms: UAC Settings on Windows, page 16 Non-English Windows Versions on Client Computers, page 17 UAC Settings on Windows To install xpression Server on Windows system, ensure that your installing account is Administrator or in the Administrators group, and check the following User Account Control (UAC) settings: If UAC is set to Default, the installing account for xpression Server must be the built-in Administrator. If the installing account is not the built-in Administrator but a member of the Administrators group, set UAC to Never notify. 16

17 Before You Install Non-English Windows Versions on Client Computers When logging on to client applications in the xpression suite (xdesign, xresponse, and xrevise) xpression uses LDAP to verify credentials. On client machines using non-english versions of Windows, it is necessary to set the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet \Control\Lsa\ForceGuest key in the registry to 0. By default, this value is 1. Refer to your operating system documentation for instructions on editing the registry. This is an advanced procedure that should be attempted by qualified personnel only. This setting and the status of the Guest account has the following impact: on security: If the ForceGuest key is set to 1 and the guest account (invite in <language>) is enabled, then anyone can log in. If the ForceGuest key is set to 1 and the guest account is disabled, then no logons will succeed. If the ForceGuest key is set to 0, then authorized users can log in regardless of the guest account setting. For full security, the recommended settings are ForceGuest = 0 and guest account disabled. Requirements for UNIX Platforms Review the following UNIX requirements and recommendations. User Validation, page 17 User Profiles, page 18 The User to Install xpression, page 18 Verify Environment Settings, page 18 Using xwindows, page 18 User Validation User validation has been enhanced to enable the use of a shadow password file. When using a shadow password file, a binary executable is run as root to allow the shadow password file to be read and users authenticated. xpression now supports this authentication scheme. If you use a non-root-level user to install xpression and intend on using local authentication, you must complete the following configuration changes. If you fail to make these changes, xrevise and xresponse authentication will fail. To Configure User Validation 1. Navigate to the following directory: xpressionhome/drivers 2. Locate the *AuthUser file for your version of UNIX: SolarisAuthUser, AIXAuthUser, or LinuxAuthUser. 17

18 Before You Install 3. Change the owner of this file for the root user. For example: chown root:root SolarisAuthUser chmod 4655 SolarisAuthUser User Profiles The xpression Server installation program automatically writes the xpression environment variables to the local user profile of the user that ran the installation program. After running the installation program, you must log off and log back onto the server so that the current user profile can be updated with the environment changes. The User to Install xpression The user who installs xpression Server should be the same user who installed the application server. Verify Environment Settings Ensure that your environment settings contain the correct database path for your database. Using xwindows If you install through xwindows, set up the display environment to view the installation screens by typing: DISPLAY=computer_name:0.0;export DISPLAY Make sure the DB2 database on the client computer can connect to the DB2 server if the server is installed on a different computer. Authentication on the xpression Server xpression operates in a client/server environment where the xpression client user must log on to the xpression Server to gain access to the system. You can authenticate users for this system using one of two modes of authentication: Local User and LDAPUser authentication. Select your authentication mode in the xpression Server installation wizard. The selection you make is reflected in the dscsecurity.properties file in your xpressionhome directory. See the following topics: Local User Authentication, page 19 LDAPUser Authentication, page 19 18

19 Before You Install SiteMinder Authentication, page 30 User Exit Authentication, page 31 Local User Authentication This option enables user authentication on the local machine. Users with access to the local machine that hosts the xpression Server will also have access to xpression. You authenticate users for xpression by adding them to the local users list on your server. On a Windows system, when you select Local User authentication, the dscsecurity.properties file records the following information and comments out all Active Directory settings. IMPL_CLASS=com.dsc.uniarch.security.user.NTUser NT_AUTH=SERVERNAME The following example shows the IMPL_CLASS property for Linux users: IMPL_CLASS=com.dsc.uniarch.security.user.LinuxUser Note: When you are using local NTUser authentication, you cannot use the umlaut character (ä) in the user name. LDAPUser Authentication Lightweight Directory Access Protocol (LDAP) is a protocol for accessing information directories. When you select LDAP as your authentication method in the xpression Server installation wizard, you must supply a set of LDAP authentication settings. These settings are reflected in the ldapcfg.properties file. The path to ldapcfg.properties is stored in dscsecurity.properties, which is located in your xpressionhome directory. xpression supports the following facets of LDAP: Using LDAP as a user registry to authenticate user names and passwords. Retrieving a list of users or groups from an LDAP server. You can also set up a filter to narrow the number of users or groups you are retrieving. Determining which groups a user is a member of. With xpression, you can retrieve (but cannot change) the associations between users and groups. Enabling you to configure the group name values for your LDAP implementation. Both single domain LDAP and multi-domain LDAP configurations. Multi-domain LDAP configuration must be done after running the server installer. LDAPS and the Start TLS extension in LDAP V3. Using Active Directory through the LDAPUser interface. If you were previously using ADUser authentication, switch to use LDAPUser authentication. ADUser authentication is no longer supported. 19

20 Before You Install Note: LDAPUser authentication is non case-sensitive. If you have used case-sensitive authentication settings with common name (cn) and want to upgrade your xpression, see the xpression Upgrade Guide. This section contains the following topics: LDAP Settings from the xpression Installer, page 20 LDAPUser Parameters, page 21 LDAPS Configuration, page 23 Start TLS Configuration, page 24 Multi-Domain LDAP Configuration, page 24 Switching from ADUser to LDAPUser, page 27 LDAP Settings from the xpression Installer The xpression installer requires you to specify your authentication method, and then requests details about your LDAP configuration. The setting you configure in the installer are saved to two configuration files that can be manually updated. Your authentication method and the location of your LDAP configuration file are stored in the dscsecurity.properties file located in your xpressionhome directory. IMPL_CLASS=com.dsc.uniarch.security.user.LDAPUser LDAP_CFG_PATH=C:\\xPression\\ldapcfg.properties The LDAP configuration settings you define in the xpression installer are saved in the ldapcfg.properties file. By default, this file resides in the xpressionhome directory. If you move this file to a different location, update the LDAP_CFG_PATH property in the dscsecurity.properties file. This property controls where xpression looks for this information. LDAP_NAME_ATTRIBUTE=<uid>, <cn>, <custom_name> LDAP_ADMIN_PWD=<PASSWORD>\=\r\n LDAP_ADMIN_DN=uid=admin,ou=administrators,ou=topologymanagement,o=netscaperoot LDAP_USER_FILTER=(objectclass\=person) LDAP_MEMBER_ATTRIBUTE=uniqueMember LDAP_GROUP_FILTER=(objectclass=groupOfUniqueNames) LDAP_SERVER_URL=ldap://localhost:389 LDAP_NAME_CONTEXT=\cn=<commonName>,ou\=<organizationalUnit>, dc=<domainname>, dc=com LDAP_INITIAL_CONTEXT_FACTORY=com.sun.jndi.ldap.LdapCtxFactory LDAP_GROUP_CONTEXT=\cn=<commonName>,ou\=<organizationalUnit>, dc=<domainname>, dc=com LDAP_USER_MODE=<FILTER OR FILTERANDGROUP> USE_START_TLS=false xpression encrypts your LDAP password when writing it into the ldapcfg.properties file. You will find the password string in the file similar to the following one: LDAP_ADMIN_PWD=<PASSWORD>\=\r\n where PASSWORD is your password and \=\r\n is part of the encryption string. 20

21 Before You Install LDAPUser Parameters The following list contains descriptions of the LDAPUser parameters: LDAP_NAME_ATTRIBUTE, page 21 LDAP_ADMIN_PWD, page 21 LDAP_ADMIN_DN, page 22 LDAP_USER_FILTER, page 22 LDAP_USER_MODE, page 22 LDAP_MEMBER_ATTRIBUTE, page 22 LDAP_GROUP_FILTER, page 23 LDAP_SERVER_URL, page 23 LDAP_NAME_CONTEXT, page 23 LDAP_GROUP_CONTEXT, page 23 LDAP_INITIAL CONTEXT FACTORY, page 23 USE_START_TLS, page 23 LDAP_NAME_ATTRIBUTE By default, xpression provides supports UID (user ID; first initial and last name) or CN (common name; first name followed by last name). CN is selected by default. But xpression also supports any customized name for LDAP_NAME_ATTRIBUTE. For customized LDAP name attributes, you must manually configure the ldapcfg.properties file. For example: LDAP_NAME_ATTRIBUTE=sAMAccountName You can also authenticate groups of LDAP users for access to xpression. When you are using common name (cn) for the LDAP_NAME_ATTRIBUTE, you must ensure that all common names are unique. If your common names are not unique, you should set your LDAP_NAME_ATTRIBUTE to UserID (uid). This parameter is defined by your selection for LDAP Name Attribute in the xpression Server installation program. LDAP_ADMIN_PWD This parameter is the password for the LDAP_ADMIN_DN user or the directory object. Your plain text password entry will be encrypted once the xpression application is started. This parameter is defined by your input in the Bind Credential field in the xpression Server installation program. 21

22 Before You Install LDAP_ADMIN_DN LDAP_ADMIN_DN is a special user who has access to a designated sub tree for interested users and groups. Note that this user is not necessarily the LDAP server administrator. You can modify this entry to retrieve different users and groups from different LDAP directory levels. LDAP_USER_FILTER This parameter is the filter used to query for users associated with the object class. NOTE: If you do not want to pull individual user components from the group, set up the LDAP_USER_FILTER with a false condition. For example, 1=2. This parameter is defined by your input in the User SearchScope field in the xpression Server installation program. LDAP_USER_MODE Controls the way xpression retrieves users. This parameter has two modes: FILTER - xpression uses only LDAP_USER_FILTER to limit the users retrieved. FILTER is the default value. When using this value, xpression returns all users that are members of the organizational unit defined by LDAP_NAME_CONTEXT and meet the criteria in LDAP_USER_FILTER. FILTERANDGROUP - When using this value, xpression returns only the users that meet the following criteria at the same time: The users are members of the organizational unit defined in LDAP_NAME_CONTEXT; The users meet the criteria in LDAP_USER_FILTER; The users are members of the groups that: are members of the organizational unit defined in LDAP_GROUP_CONTEXT, and meet the criteria in LDAP_GROUP_FILTER. This parameter is defined by your selection for User Mode in the xpression Server installation program. LDAP_MEMBER_ATTRIBUTE This parameter is the name of the group s member attribute. The group instance should contain an attribute for recording its members. This attribute is uniquemember if the group s object class is groupofuniquenames. The resulting list displays all the users within each unique group. This parameter is defined by your input in the Member Attribute field in the xpression Server installation program. 22

23 Before You Install LDAP_GROUP_FILTER This parameter is the filter used to query for groups associated with the object class. This parameter is defined by your input in the Group Filter field in the xpression Server installation program. LDAP_SERVER_URL This parameter is the LDAP server URL. The port number must be provided in the URL if the LDAP server is not using the default port. A fully qualified name should be provided, for example: servername.docscience.com. This parameter is defined by your input in the Provider URL field in the xpression Server installation program. LDAP_NAME_CONTEXT Use as the root context to retrieve users. It is the search base for the entire LDAP directory tree. The search will remain in scope for this branch. If another branch in the tree also contains the interested users and groups, then the parent of the two branches should be configured as the search base. This is the distinguished name where the search will begin. This parameter is defined by your input in the User Context field in the xpression Server installation program. LDAP_GROUP_CONTEXT Use as the root context to retrieve groups. By default, this is set to match the LDAP_NAME_CONTEXT value. This parameter is only active when LDAP_USER_MODE=FILTERANDGROUP. or LDAP_USER_MODE=FILTER. This parameter is defined by your input in the Group Context field in the xpression Server installation program. LDAP_INITIAL CONTEXT FACTORY This parameter is the initial context factory for LDAP access. This value can be changed if you use a vendor other than Sun. USE_START_TLS This property enables Start TLS on your server. By default it is set to false. Manually set this property to true if you want to enable Start TLS. See Start TLS Configuration, page 24 for more information. LDAPS Configuration Before you begin, ensure your LDAP server supports LDAPS. Next, open ldapcfg.properties and set the LDAP_SERVER_URL property for your LDAP server. Ensure the server URL uses the LDAPS protocol. 23

24 Before You Install Start TLS Configuration Before you begin, ensure your LDAP server supports Start TLS. Next, open ldapcfg.properties and set the LDAP_SERVER_URL property for your LDAP server. Ensure the server URL uses the LDAP protocol (not LDAPS). Also, ensure the USE_START_TLS property is set to True. Multi-Domain LDAP Configuration The xpression Server installer enables you to set up single domain LDAP. To configure multi-domain LDAP, you must manually configure dscsecurity.properties after the installation is complete. Keep in mind the following items when planning your configuration: Domain names crossing the multiple forests will never be duplicated. They are globally unique. The filters of users and groups must be surrounded by parentheses. The xpression configuration will only retrieve the users who are specified by the user filter in the configuration file. It does not support retrieving the users based on the groups, which is supported by the single domain LDAP solution. xpression only provides weak encryption of the administrator passwords in the configuration file. To configure multi-domain LDAP, specify your LDAP details in the dscsecurity.properties file that is located in the xpressionhome directory on your server. 1. Open dscsecurity.properties for editing. 2. Locate the IMPL_CLASS property. To enable multi-domain LDAP, change the value of this property to: com.dsc.uniarch.security.user.multidomainldapuser. 3. Locate the MULTI_LDAP_CFG_PATH property. Set the value of this property to the location of your Multildapcfg.properties file. This file can reside anywhere on your file system as long as the path is defined in this property. However, EMC Document Sciences recommends storing this file in your xpressionhome directory for ease of maintenance. For example: MULTI_LDAP_CFG_PATH=C:\\xPression\\Multildapcfg.properties Caution: The Multildapcfg.properties file must use.properties as its extension. Errors may occur if it uses other file extensions such as.txt. 4. Save and close dscsecurity.properties. 5. Open Multildapcfg.properties to configure your LDAP settings. The configuration file must contain the following parameters: LDAP_DOMAIN_NAME.DOMAIN[x], page 25 LDAP_SERVER_URL.DOMAIN[x], page 25 LDAP_DOMAIN_CONTEXT.DOMAIN[x], page 25 LDAP_ADMIN_USER.DOMAIN[x], page 25 LDAP_ADMIN_PASSWORD.DOMAIN[x], page 26 24

25 Before You Install LDAP_USER_FILTER.DOMAIN[x], page 26 LDAP_GROUP_FILTER.DOMAIN[x], page 26 The following properties are optional: LDAP_INITIAL_CONTEXT_FACTORY.DOMAIN[x], page 26 LDAP_DISPLAY_ATTRIBUTE.DOMAIN[x], page 26 LDAP_AUTH_ATTRIBUTE.DOMAIN[x], page 26 LDAP_MEMBER_ATTRIBUTE.DOMAIN[x], page 26 LDAP_QUERY_USERS_FOR_PICK_LIST.DOMAIN[x], page 27 LDAP_QUERY_GROUPS_FOR_PICK_LIST.DOMAIN[x], page 27 The x inside of [] represents the sequence number of each domains. It must start at 0, and be increased by 1 for the next domain. Any increase greater than 1 will cause the loss of domains. 6. Save and close Multildapcfg.properties. LDAP_DOMAIN_NAME.DOMAIN[x] This is the name of the domain in LDAP. EMC Document Sciences recommends that you use the real domain name as the value for this parameter. For example: LDAP_DOMAIN_NAME.DOMAIN[0]=Domain1 LDAP_SERVER_URL.DOMAIN[x] The LDAP domain server URL including the protocol. For example: LDAP_SERVER_URL.DOMAIN[0]=ldap\:// LDAP_DOMAIN_CONTEXT.DOMAIN[x] The LDAP domain context. For example: LDAP_DOMAIN_CONTEXT.DOMAIN[0]=dc\=EMC,dc\=DocScience,dc\=Domain1 LDAP_ADMIN_USER.DOMAIN[x] This is the username of a user who has access to bind to the LDAP server and read the domain specified in the properties file. This user is not necessarily the LDAP server administrator. xpression will only read the directory, it will not write to it. A dedicated service account can be used for this task. In most cases, the value of this parameter is a DN or UPN. For example: LDAP_ADMIN_USER.DOMAIN[0]=uid\=admin,ou\=administrators,ou\=topologymanagement, o\=netscaperoot 25

26 Before You Install LDAP_ADMIN_PASSWORD.DOMAIN[x] The password for the LDAP_ADMIN_USER. When the xpression application starts, the plain text password entry will be weak encrypted. LDAP_USER_FILTER.DOMAIN[x] The filter used to query for users associated with the objectclass. For example: LDAP_USER_FILTER.DOMAIN[0]=(&(objectclass\=person)(cn\=a*)) LDAP_GROUP_FILTER.DOMAIN[x] The filter used to query for groups associated with the objectclass. For example: LDAP_GROUP_FILTER.DOMAIN[0]=(&(objectclass\=groupofuniquenames)(cn\=xpr*)) LDAP_INITIAL_CONTEXT_FACTORY.DOMAIN[x] The implementation class of context factory. The default value is com.sun.jndi.ldap.ldapctxfactory. LDAP_DISPLAY_ATTRIBUTE.DOMAIN[x] The attribute used for displaying when configuring the access of xpression resources, which is also the expected attribute of the user name for users logging in. The value of this parameter also could be uid, cn, etc. For example: LDAP_DISPLAY_ATTRIBUTE.DOMAIN[0]=cn LDAP_AUTH_ATTRIBUTE.DOMAIN[x] The attribute used for authentication. Authentication will be applied against the pair of the value of this attribute and password the users provided. The value of this parameter also could be DistinguishedName, etc. The default value is userprincipalname. If this optional parameter is not added to the Multildapcfg.properties, xpression will use the default value: userprincipalname. The value you specify for this parameter must be unique in all domains. For example: LDAP_AUTH_ATTRIBUTE.DOMAIN[0]=entrydn LDAP_MEMBER_ATTRIBUTE.DOMAIN[x] The attribute used for checking whether the groups contain the particular user. For example: LDAP_MEMBER_ATTRIBUTE.DOMAIN[0]=uniquemember 26

27 Before You Install LDAP_QUERY_USERS_FOR_PICK_LIST.DOMAIN[x] If this attribute is not specified, the default value is True. When set to True, xpression will query users from this domain and add them to the pick list used in xadmin. If set to False, xpression skips this domain when querying for users for the return list. For example: LDAP_QUERY_USERS_FOR_PICK_LIST.Domain[0]=false LDAP_QUERY_GROUPS_FOR_PICK_LIST.DOMAIN[x] If this attribute is not specified, the default value is True. When set to True, xpression will query groups from this domain and add them to the pick list in xadmin. If set to False, xpression skips this domain when querying for groups for the return list. For example: LDAP_QUERY_GROUPS_FOR_PICK_LIST.Domain[0]=true The following sample shows a Multildapcfg.properties with two domains. # 1st Domain LDAP_DOMAIN_NAME.DOMAIN[0]=Domain1 LDAP_SERVER_URL.DOMAIN[0]=ldap\:// :392 LDAP_DOMAIN_CONTEXT.DOMAIN[0]=dc\=EMC,dc\=DocScience,dc\=Domain1 LDAP_ADMIN_USER.DOMAIN[0]=uid\=admin,ou\=administrators, ou\=topologymanagement,o\=netscaperoot LDAP_ADMIN_PASSWORD.DOMAIN[0]=2L4uf+2MmW3p/TU= LDAP_USER_FILTER.DOMAIN[0]=(&(objectclass\=person)(cn\=a*)) LDAP_GROUP_FILTER.DOMAIN[0]=(&(objectclass\=groupofuniquenames)(cn\=xpr*)) LDAP_DISPLAY_ATTRIBUTE.DOMAIN[0]=cn LDAP_AUTH_ATTRIBUTE.DOMAIN[0]=entrydn LDAP_QUERY_USERS_FOR_PICK_LIST.Domain[0]=false LDAP_QUERY_GROUPS_FOR_PICK_LIST.Domain[0]=true LDAP_MEMBER_ATTRIBUTE.DOMAIN[0]=uniquemember LDAP_DISTINGUISHED_NAME_ATTRIBUTE.DOMAIN[0]=entrydn # 2nd Domain LDAP_DOMAIN_NAME.DOMAIN[1]=Domain2 LDAP_SERVER_URL.DOMAIN[1]=ldap\:// :393 LDAP_DOMAIN_CONTEXT.DOMAIN[1]=dc\=EMC,dc\=DocScience,dc\=Domain2 LDAP_ADMIN_USER.DOMAIN[1]=uid\=admin,ou\=administrators,ou\=topologymanagement, o\=netscaperoot LDAP_ADMIN_PASSWORD.DOMAIN[1]=2L4uf+2MmW3p/TU= LDAP_USER_FILTER.DOMAIN[1]=(objectclass=person) LDAP_GROUP_FILTER.DOMAIN[1]=(&(objectclass\=groupofuniquenames)(cn\=a*)) LDAP_DISPLAY_ATTRIBUTE.DOMAIN[1]=cn LDAP_AUTH_ATTRIBUTE.DOMAIN[1]=entrydn LDAP_QUERY_USERS_FOR_PICK_LIST.Domain[1]=false LDAP_QUERY_GROUPS_FOR_PICK_LIST.Domain[1]=true LDAP_MEMBER_ATTRIBUTE.DOMAIN[1]=uniquemember Switching from ADUser to LDAPUser This section will demonstrate how to reconfigure your authentication for LDAP user. For this demonstration, we will use a typical scenario where the goal is to pull users from two groups (cgroup1 and cgroup2). The ADUser method, which is no longer supported, pulls all users and groups that reside under the TestingAD OU. The LDAP method allows more focused approach, and 27

28 Before You Install only pulls users from the two groups that are found under the LDAP_NAME_CONTEXT defined in the ldapcfg.properties file. To Determine Whether You Are Using the ADUser Security Interface 1. Locate the dscsecurity.properties file in the xpressionhome directory on the xpression server. 2. Locate the IMPL_CLASS property in the properties file. 3. If the property is set to com.dsc.uniarch.security.aduser, you are using the ADUser Security interface. When you are using ADUser, your dscsecuritiy.properties file should resemble the following example. Each line that requires modification is highlighted in red. # File currently configured for Local authentication. # Use this file to change/modify your method of authentication. #IMPL_CLASS=com.dsc.uniarch.security.user.LDAPUser IMPL_CLASS=com.dsc.uniarch.security.user.ADUser #IMPL_CLASS=com.dsc.uniarch.security.user.NTUser #IMPL_CLASS=com.dsc.uniarch.security.user.MultiLDAPUser #NT_AUTH=xpro-vm4 #The following settings is for Active Directory AD_AUTH=LDAP://AD_Server/OU=TestingAD,DC=docscience,DC=com AD_USERS=LDAP://CN=Users,OU=TestingAD,DC=docscience,DC=com AD_GROUPS=LDAP://OU=TestingAD,DC=docscience,DC=com #SiteMinder = on #SSO_USER_HEADERS=SM_USER #SSO_GROUPS_HEADERS=SM_GROUPS,SM_USERGROUPS,SM_USERNESTEDGROUPS #SSO_GROUP_DELIMITER=^ #SSO_GROUP_FORMAT=LDAP #for User cache, the unit is second UserCredentialCacheTimeout=1800 #LDAP_CFG_PATH=c:/xPression/ldapcfg.properties To move from ADUser to LDAPUser, modify your dscsecurity.properties file as in the following steps: 1. Change the implementation class from ADuser to LDAPuser. This is done by "commenting out the ADuser line and removing the comment designation from the LDAPuser line. Using the sample dscsecurity.properties file as an example, remove the pound sign (#) from the beginning of the LDAPuser line and place it in front of the ADuser line as shown below. IMPL_CLASS=com.dsc.uniarch.security.user.LDAPUser #IMPL_CLASS=com.dsc.uniarch.security.user.ADUser 2. In the Active Directory section, comment out the AD_AUTH, AD_USERS, and AD_GROUPS lines. Using the sample dscsecurity.properties file as an example, place a pound sign (#) in front of each line as shown below. #AD_AUTH=LDAP://AD_Server/OU=TestingAD,DC=docscience,DC=com #AD_USERS=LDAP://CN=Users,OU=TestingAD,DC=docscience,DC=com #AD_GROUPS=LDAP://OU=TestingAD,DC=docscience,DC=com 3. Remove the comment designation from the LDAP_CFG_PATH line. Using the sample dscsecurity.properties file as an example, remove the pound sign (#) from the line as shown below. LDAP_CFG_PATH=c:/xPression/ldapcfg.properties 28

29 Before You Install 4. Save the dscsecurity.properties file. The resulting dscsecurity.properties file should resemble the following example. Each line that has been modified is highlighted in red. # File currently configured for Local authentication. # Use this file to change/modify your method of authentication. IMPL_CLASS=com.dsc.uniarch.security.user.LDAPUser #IMPL_CLASS=com.dsc.uniarch.security.user.ADUser #IMPL_CLASS=com.dsc.uniarch.security.user.NTUser #NT_AUTH=xpro-vm4 #The following settings is for Active Directory #AD_AUTH=LDAP://AD_Server/OU=TestingAD,DC=docscience,DC=com #AD_USERS=LDAP://CN=Users,OU=TestingAD,DC=docscience,DC=com #AD_GROUPS=LDAP://OU=TestingAD,DC=docscience,DC=com #SiteMinder = on #SSO_USER_HEADERS=SM_USER #SSO_GROUPS_HEADERS=SM_GROUPS,SM_USERGROUPS,SM_USERNESTEDGROUPS #SSO_GROUP_DELIMITER=^ #SSO_GROUP_FORMAT=LDAP #for User cache, the unit is second UserCredentialCacheTimeout=1800 LDAP_CFG_PATH=c:/xPression/ldapcfg.properties 5. Add your information from the AD_AUTH, AD_USERS, and AD_GROUPS lines to the ldapcfg.properties file. Using the sample dscsecurity.properties file as an example, you must copy the following information to the ldapcfg.properties file: OU=TestingAD,DC=docscience,DC=com 6. Open the ldapcfg.properties file. This file is located at the path defined in your dscsecurity.properties file under the LDAP_CFG_PATH property. 7. Locate the LDAP_ADMIN_DN line. In this line, add the information from the dscsecurity.properties file. Using the sample dscsecurity.properties file as an example, copy the following information to the LDAP_ADMIN_DN in the ldapcfg.properties file: OU=TestingAD,DC=docscience,DC=com The LDAP_ADMIN_DN line should look like the following code: LDAP_ADMIN_DN=cn\=user1,ou\=testingad,dc\=docscience,dc\=com 8. Locate the LDAP_ADMIN_PWD line. This parameter is the password for the LDAP_ADMIN_DN user or the directory object. Your plain text password entry will be encrypted once the xpression application is started. Supply the password for the LDAP_ADMIN_DN user. 9. Locate the LDAP_GROUP_CONTEXT line. In this line, add the information from the dscsecurity.properties file. Using the sample dscsecurity.properties file as an example, copy the following information to the LDAP_GROUP_CONTEXT in the ldapcfg.properties file: OU=TestingAD,DC=docscience,DC=com The LDAP_GROUP_CONTEXT line should look like the following code: LDAP_GROUP_CONTEXT=cn\=user1,ou\=testingad,dc\=docscience,dc\=com 10. Locate the LDAP_NAME_CONTEXT line. In this line, add the information from the dscsecurity.properties file. Using the sample dscsecurity.properties file as an example, copy the following information to the LDAP_NAME_CONTEXT in the ldapcfg.properties file: 29

30 Before You Install OU=TestingAD,DC=docscience,DC=com The LDAP_NAME_CONTEXT line should now look like the following code: LDAP_NAME_CONTEXT=cn\=user1,ou\=testingad,dc\=docscience,dc\=com 11. Locate the LDAP_SERVER_URL line. In this line, add the information from the beginning of the AD_AUTH property in the dscsecurity.properties file. At the end of the line, supply the correct port number for the server. Using the sample dscsecurity.properties file as an example, supply this value in the LDAP_SERVER_URL line as shown below. LDAP_SERVER_URL=ldap\://AD_Server\: Using the sample dscsecurity.properties file as an example, the resulting ldapcfg.properties file should look like this. Each line that has been modified is highlighted in red. #Fri Oct 07 16:57:53 PDT 2005 LDAP_NAME_ATTRIBUTE=cn LDAP_ADMIN_PWD=2L4uf+2MjXrh5mo\=\r\n LDAP_ADMIN_DN=cn\=user1,ou\=testingad,dc\=docscience,dc\=com LDAP_USER_FILTER=(objectclass\=person) LDAP_MEMBER_ATTRIBUTE=member LDAP_GROUP_FILTER=(&(objectclass\=group)( (cn\=cgroup1)(cn\=cgroup2))) LDAP_SERVER_URL=ldap\://AD_Server\:389 LDAP_NAME_CONTEXT=ou\=testingad,dc\=docscience,dc\=com LDAP_GROUP_CONTEXT=ou\=Groups,ou\=TestingAD,dc\=docscience,dc\=com LDAP_USER_MODE=FILTERANDGROUP LDAP_INITIAL_CONTEXT_FACTORY=com.sun.jndi.ldap.LdapCtxFactory 13. Save and close the ldapcfg.properties file. SiteMinder Authentication SiteMinder is a third-party application that enforces single sign-on authentication on web servers. xpression supports the use of SiteMinder for xrevise and xresponse, though some SiteMinder configuration is required. Currently, xpression must be configured manually for SiteMinder. After installing xpression, alter the dscsecurity.properties file by adding the property SiteMinder=on. # File currently configured for Local authentication. # Use this file to change/modify your method of authentication. IMPL_CLASS=com.dsc.uniarch.security.user.NTUser NT_AUTH=<SERVERNAME> SiteMinder=on SSO_USER_HEADERS=SM_USER SSO_GROUPS_HEADERS=SM_GROUPS, SM_USERGROUPS,SM_USERNESTEDGROUPS SSO_GROUP_DELIMITER=^ SSO_GROUP_FORMAT=LDAP #The following settings is for Active Directory #IMPL_CLASS=com.dsc.uniarch.security.user.ADUser #AD_AUTH=LDAP://<domain_ip_address>/DC=<domain_name> #AD_USERS=LDAP://CN=Users,DC=<domain_name> #AD_GROUPS=LDAP://DC=<domain_name> 30