EMC Documentum Connector for Microsoft SharePoint Add-in

EMC Documentum Connector for Microsoft SharePoint Add-in Version 7.2 Installation Guide EMC Corporation Corporate Headquarters Hopkinton, MA 01748-9103 1-508-435-1000 www.emc.com

Legal Notice Copyright 2013 2016 EMC Corporation. All Rights Reserved. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED AS IS. EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. For the most up-to-date listing of EMC product names, see EMC Corporation Trademarks on EMC.com. Adobe and Adobe PDF Library are trademarks or registered trademarks of Adobe Systems Inc. in the U.S. and other countries. All other trademarks used herein are the property of their respective owners. Documentation Feedback Your opinion matters. We want to hear from you regarding our product documentation. If you have feedback about how we can make our documentation better or easier to use, please send us your feedback directly at ECD.Documentation.Feedback@emc.com

Table of Contents Preface... 5 Chapter 1 Prerequisites... 7 Chapter 2 Installing Connector for SharePoint... 9 Deploying Documentum Foundation Services Extensions (DFSX)... 9 Creating the Add-in... 10 Deploying the DC4SP Add-in Server... 10 Uploading the App to SharePoint... 13 Installing the Add-in... 13 Chapter 3 Installing and Configuring Add-ins... 15 Installing and Configuring the D2 Plug-in... 15 Chapter 4 Troubleshooting... 17 The ClickOnce UCF Client Cannot Start Up... 17 Office 365 Unable to Recognize SDFOnline.app as Valid Package... 18 Blocked Content... 18 Unable to Edit App Part... 19 Unable to Add SDFOnline.app to Office 365... 19 Http Error 500.21 Internal Server Error... 19 Tuning for Large File Upload... 20 Tuning DFS Data Synchronization... 20 Using Manual Authentication... 20 Using Ticketed Login with Privileged Client... 21 Clearing Script Cache in Web Browsers... 21 Clearing Script Cache in Internet Explorer... 21 Clearing Script Cache in Firefox... 21 3

Table of Contents 4

Preface Intended Audience This document is intended for system administrators responsible for installing EMC Documentum Connector for Microsoft SharePoint Add-in on Office 365. Revision History Revision Date February 2016 Description Updated the following sections: Chapter 1, Prerequisites Creating the Add-in, page 10 Deploying the DC4SP Add-in Server, page 10 Removed the section Installing the UCF Client. January 2016 December 2015 Replaced all instances of provider host with DC4SP Add-in server. Updated Deploying the DC4SP Add-in Server, page 10 for Language Pack release. Initial publication. 5

Preface 6

Prerequisites Chapter 1 Before you install the Documentum Connector for Microsoft SharePoint Add-in, ensure that the following prerequisites are met: SharePoint prerequisites: SharePoint Online Deployment: Office O365 account OR SharePoint On Premise Deployment: SharePoint 2013 SP1 Ensure that the SharePoint On Premise server machine is in the domain and install SharePoint as a valid domain user. SharePoint server must be configured for apps installations: Follow the instructions in the following Microsoft link. https://msdn.microsoft.com/en-us/library/office/fp179923.aspx SharePoint server must have SSL enabled SharePoint web application. Additionally, follow the SharePoint On Premise Deployment steps described in the DC4SPaddinFAQ Guide. This section helps you to configure the SharePoint server as required. The SharePoint On Premise Deployment steps are not required in the production environment because the SharePoint server is configured by a certified SharePoint system administrator who has valid production-ready certificates. However, in an internal setup, there can be challenges to procure production grade certificates. Therefore, you require locally created certificates and have to configure the SharePoint accordingly. DC4SP add-in Server prerequisites: Microsoft Windows Server 2012 Standard Edition enabled with IIS Microsoft SQL Server 2012 Express Ensure you have a valid X.509 SSL Certificate (.pfx format) for the DC4SP Add-in Server 7

Prerequisites This server should be on the DMZ for SharePoint Online Deployment, and it should be publicly accessible and the firewall should be bypassed to access Documentum Content Server. Documentum prerequisites: EMC Documentum Content Server 7.2 EMC Documentum Foundation Services 7.0, 7.1, and 7.2 Note: The Multiple File Upload control requires Microsoft Silverlight 4 or higher as an additional requirement. Microsoft Silverlight is no longer supported on Chrome. The EMC Documentum Connector for Microsoft SharePoint Add-in Release Notes provides detailed information about the system requirements and compatibility matrices. Separate servers are needed for the DC4SP Add-in server and the Sharepoint server in case of the SharePoint On Premise Deployment. Before installation, ensure that the SharePoint Administrator account has administrator access to the SharePoint farm and has access to the SQL Server to install solutions. For optimal performance, EMC recommends the following server configuration: Server A Server B Server C Server D Share Point Online or Share Point 2013 SP1 On-premise Server DC4SP Add-in server Documentum Foundation Services DFSX Documentum Content Server Note: You must install Connector for SharePoint on the IIS web server. You can install Documentum Foundation Services on the IIS web server, but it might affect the performance of the IIS web server. 8

Chapter 2 Installing Connector for SharePoint This chapter provides instructions for installing Connector for SharePoint. To install Connector for SharePoint: 1. Deploy Documentum Foundation Services Extensions (DFSX). 2. Create Add-in details. 3. Deploy the DC4SP Add-in server. 4. Upload the App to SharePoint. 5. Install the Add-in. Deploying Documentum Foundation Services Extensions (DFSX) The Documentum Foundation Services Extensions (DFSX) is an extension of EMC Documentum Foundation Services (DFS). DFSX implements several web services that Connector for SharePoint uses. You must deploy DFSX on the server where you install DFS. Note: Do not deploy DFSX on the Java Method Server that is bundled with the Content Server installation suite. 1. Download the dfsx.war file. 2. Create a folder named dfsx. 3. Extract the dfsx.war file to the dfsx folder. You can rename dfsx.war to dfsx.zip and unzip the file to the dfsx folder. Note: Do not use the built-in Windows compression utility to extract the dfsx.war file because it may corrupt the file. Instead, use a ZIP utility. 4. Navigate to the dfsx\web-inf\classes directory and open the dfc.properties file. 5. Replace the existing lines with a #include statement that references to the dfc.properties file of DFS. For example: #include C:\tomcat\webapps\emc-dfs\WEB-INF\classes\dfc.properties You can also update the dfc.properties file by copying the settings from the dfc.properties file that installs with the Content Server. For example, on a Windows 9

Installing Connector for SharePoint installation of Content Server, the dfc.properties file is located in the Documentum\config directory. 6. Zip the dfsx folder and rename the zip file to dfsx.war. 7. Copy the updated dfsx.war file to the <TomcatHome>\webapps directory to deploy DFSX. You can verify the DFSX deployment by visiting the following URL in a web browser: http://localhost:8080/dfsx/services/dfsx/documentserviceex?wsdl If you cannot view WSDL, restart the web or application server where you installed DFS and DFSX. Note: You can also use the DFS-DFSX Test Application to test the deployment of DFSX. You can download this application from the EMC download site. Creating the Add-in 1. Log in to the SharePoint admin. 2. Create or open a SharePoint App Catalog. 3. Modify the URL. For example, if the URL of your site is http://mysite.sharepoint.com/ then modify it to http://mysite.sharepoint.com/_layouts/15/appregnew.aspx 4. Provide the following information: Client Id: Automatically generated. Client Secret: Automatically generated. Title: Title for your app. App Domain IP: Fully Qualified Domain Name (FQDN) of the DC4SP Add-in server. Redirect URI: Local host URL of the IIS system. URL format: https://<dc4sp addin server FQDN>/WebPartPage/BrowseWebPartPage.aspx Note: Ensure that you save the details you provided for future reference. 5. Click Create. Deploying the DC4SP Add-in Server 1. In the DeploymentBatchFiles folder, edit the AutoDeployment.bat file in an editor. The following table provides the name of the parameters, sample values and its description. Parameter Name Sample Value Description WebSiteName SDFOnline The name of the website you want to create. WebSiteDir C:\inetpub\wwwroot The location of the virtual directory for your website. 10

Installing Connector for SharePoint Parameter Name Sample Value Description iisapppoolname SDFOnline The name of Application Pool Identity PortNumber 83 The port number used for hosting your application. PackagePath C:\7.2 The location of the binaries package. ClientID Random value The Client ID value taken from https://<youro365site>/ _layouts/15/appregnew.aspx ClientSecret Random value The client secret value taken from https://<youro365site>/ _layouts/15/appregnew.aspx ProviderHostMachineName providerhost.emc.com DC4SP Add-in server. AutoEvents No Ensures that the remote events for Microsoft Office 365 to Documentum work in a DMZ environment. Default value is No. Language Pack C:\7.2\localization\ Select the required language pack from the localization folder to be installed. D2 Yes To deploy D2 plug-in 2. Run the AutoDeployment.bat file. Default value is No. 3. Perform Step 4 to Step 9 for SharePoint On Premise Deployment. Otherwise, skip to Step 9. 4. The X.509 SSL Certificate (.pfx format) should be placed in a folder on the DC4SP Add-in Server. Note: To create a certificate for internal use, follow the SharePoint On Premise Deployment steps described in the section Creating SSL Certificate for DC4SP Add-in Server in the DC4SPaddinFAQ Guide. 5. In IIS manager of the DC4SP Add-in Server, select the ServerName node in the tree view on the left. Select the Server Certificates icon and import the X.509 SSL Certificate (.pfx format). Ensure that you provide a strong password. 6. Create a corresponding.cer file on the DC4SP Add-in Server: a. In IIS manager, select the ServerName node in the tree view on the left. 11

Installing Connector for SharePoint b. Double-click Server Certificates. c. In Server Certificates view, double-click <X.509 SSL Certificate (.pfx format) to display the certificate details. d. On the Details tab, choose Copy to File to launch the Certificate Export Wizard, and then click Next. e. Use the default value No, do not export the private key, and then click Next. f. Use the default values. click Next. g. Click Browse, browse to C:\Certs, name the certificate <certificatename>, and then click Save. The certificate is saved as a.cer file. h. Click Next. 7. Copy the.cer <certificatename.cer> file, created in Step 6 to the SharePoint On Premise server machine and run the following scripts: a. In the SharePoint 2013 Management Shell, start a new file and add the following lines to it to create a certificate object: $publiccertpath = "C:\Certs\sdf.cer" $certificate = New-Object System.Security.Cryptography. X509Certificates.X509Certificate2($publicCertPath) b. Add the following line to ensure that SharePoint treats the certificate as a root authority. New-SPTrustedRootAuthority -Name "sdf" -Certificate $certificate c. Add the following line to get the ID of the authorization realm. $realm = Get-SPAuthenticationRealm d. Your remote web application uses an access token to get access to SharePoint data. The access token must be issued by a token issuer that SharePoint trusts. In a high-trust app for SharePoint, the certificate is the token issuer. Save the issuer ID and password for future references. Add the following lines to construct an issuer ID in the format that SharePoint requires: specific_issuer_guid@realm_guid: $specificissuerid = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX" $fullissueridentifier = $specificissuerid + '@' + $realm e. Add the following lines to register the certificate as a trusted token issuer. The -Name parameter must be unique so in a production configuration, it is common to use a GUID as part (or all) of the name, but in this context, you can use a friendly name. The IsTrustBroker switch is needed to ensure that you can use the same certificate for all the high-trust apps you develop. The iisreset command is required to make your token issuer registered immediately. Without it, you might have to wait as long as 24 hours for the new issuer to be registered. New-SPTrustedSecurityTokenIssuer -Name "SDF On Premise" -Certificate $certificate -RegisteredIssuerName $fullissueridentifier IsTrustBroker iisreset f. Run the following commands: $serviceconfig = Get-SPSecurityTokenServiceConfig $serviceconfig.allowoauthoverhttp = $false $serviceconfig.update() Note: SharePoint 2013 does not normally accept self-signed certificates. So when you use a self-signed certificate for debugging, add the commands mentioned in this step to turn 12

Installing Connector for SharePoint off SharePoint s normal requirement to use HTTPS when remote web applications call into SharePoint. If you do not add the commands mentioned in this step, you get a 403 (forbidden) message when the remote web application calls SharePoint using a self-signed certificate. You will reverse this step in a later procedure. Turning off the HTTPS requirement means that the requests from the remote web application to SharePoint are not encrypted, but the certificate is still used as a trusted issuer of access tokens which is its main purpose in high-trust apps for SharePoint. For an internal setup created using a non commercial SSL certificate, the value of $serviceconfig.allowoauthoverhttp must be set true. 8. Locate the web.config file on the DC4SP Add-in Server and specify the following settings: <add key="clientsigningcertificatepath" value="<.pfx certificate location> /> <add key="clientsigningcertificatepassword" value="<password for the.pfx certificate>" /> <add key="issuerid" value="<issuer ID>" /> For more information on Create high-trust SharePoint Add-ins, follow the instruction on the Microsoft website. Note: For autoevents to work in IIS, locate the DC4SP Add-in Server and verify if.svc mime type is listed. If it is not listed, add a new mime type with.svc extension and specify Mimetype= application/octet-stream. Also ensure that in IIS Server Manager > Roles and Features,.NET 4.5 and WCF (all components) are installed. 9. In IIS manager of the DC4SP Add-in server, select sites node in the tree view on the left, expand and select <yoursite>, select edit bindings on the right, select the https binding, edit it and map the X.509 SSL Certificate. Enter the hostname details as well. Uploading the App to SharePoint 1. Navigate to the App Catalog created previously. 2. In the Apps for SharePoint page, click upload. 3. Navigate and upload the SDFOnline.app file from the deployment package. After the upload is successful, the Valid App Package value is shown as Yes. Installing the Add-in 1. In the Site settings option, click Add an app. 2. Click From Your Organization and add the uploaded App to the site. 3. When prompted, click Trust It to add it to the trusted list of Apps. 4. Navigate to the Site Contents page and verify if the App you added is displayed. 5. Navigate to the SharePoint site and edit the site. 13

Installing Connector for SharePoint 6. Click INSERT > App Part > BrowseWebPart Title > Add. 7. Click Save. 14

Chapter 3 Installing and Configuring Add-ins Installing and Configuring the D2 Plug-in The D2 plug-in provides the D2 Browse Web Part for you to perform D2 file operations based on your D2 configuration. The plug-in also extends the Connector for SharePoint data services to support uploading or checking in documents from SharePoint as well as checking out documents to SharePoint. Before installing the plug-in, you must also have EMC Documentum D2 installed and configured on the repository. Complete the following steps to install and configure the D2 plug-in: 1. Ensure that the D2 plug-in value has been set to Yes while deploying the DC4SP Add-in server. 2. Activate the D2 plug-in SharePoint. a. In the Site settings option, click Add an app. b. Click From Your Organization and add the uploaded App to the site. c. When prompted, click Trust It to add it to the trusted list of Apps. d. Navigate to the Site Contents page and verify if the App you added is displayed. e. Navigate to the SharePoint site and edit the site. f. Click INSERT > App Part > D2BrowseAppPart Title > Add. g. Click Save. 15

Installing and Configuring Add-ins 16

Chapter 4 Troubleshooting This chapter contains information about troubleshooting common Connector for SharePoint installation problems. The ClickOnce UCF Client Cannot Start Up If the ClickOnce UCF Client cannot start up on an end user client and the message Unable to install this application because an application with the same identity is already installed shows up, it means that the end user already cached a version of the current ClickOnce UCF Client on the client. To fix this issue, you must delete the following items: The UcfInstaller folder in the system directory, for example, C:\Users\<user name>\ucfinstaller The Documentum folder in the system directory, for example, C:\Users\<user name>\documentum The files in the \AppData\Local\Apps\2.0 folder in the system directory You then clear the application cache by completing the following steps: 1. Download and install the Windows SDK from Microsoft official site. For Windows 7 client, you can download from http://www.microsoft.com/en-us/download/details.aspx?id=8279. 2. Open a command prompt. 3. Go to the path where mage.exe is located. For Windows 7 32-bit, the path is C:\Program Files\Microsoft SDKs\Windows\v7.0A \bin. For Windows 7 64-bit, the path is C:\Program Files (x86) \Microsoft SDKs\Windows\v7.0A\bin. 4. Execute the command Mage.exe -cc. The Application cache cleared notice appears. 17

Troubleshooting Office 365 Unable to Recognize SDFOnline.app as Valid Package Problem While deploying a batch script, the SDFOnline.app created by the batch script is recognized as invalid package when uploaded to Office 365. Cause Due to file compression issues Office 365 does not recognize SDFOnline.app as valid package while running the batch script. Resolution Follow the steps below to manually update the package: 1. Create a new folder and copy SDFOnline.app from download center. 2. Rename the SDFOnline.app file to SDFOnline.zip. 3. In the Rename dialog box, click Yes to proceed. 4. Extract and move the contents in the zip folder to a new location. 5. Edit the AppManifest.xml file and perform the following actions: Replace 10.63.112.12 IP value with host machine name Provide the client ID in the ClientId Note: Similarly change the IP value in the remaining files to host machine name. 6. Save the file. 7. Compress the files and rename the compressed folder name to SDFOnline.app. Blocked Content Problem The content is blocked and you receive the following error: Content was blocked because it was not signed by a valid security certificate. For more information, see About Certificate Errors in Internet Explorer Help. Cause The content gets blocked because it is not signed by a valid security certificate. Resolution Ensure that the host machine name is updated in all App Files before uploading the App File to Office 365. 18

Troubleshooting Unable to Edit App Part Problem The edit option of the app part does not work. Cause The edit option of the app part does not work because the site is not added to the trusted sites list. Resolution Ensure that the site is added to the trusted sites list and viewed in the compatibility mode. Unable to Add SDFOnline.app to Office 365 Problem An installation error occurs while trusting SDFOnline.app. Cause This error occurs due to unavailability of valid DMZ infrastructure. Resolution In the AppManifest.xml file comment the below properties: <InstalledEventEndpoint>https://<Host Name>/Services/AppEventReceiver.svc< /InstalledEventEndpoint> <UninstallingEventEndpoint>https://<Host Name>/Services/AppEventReceiver.svc< /UninstallingEventEndpoint> Note: Refer Office 365 Unable to Recognize SDFOnline.app as Valid Package, page 18 to manually update the package. Http Error 500.21 Internal Server Error Problem The following error occurs when you try to execute the batch script: Http Error 500.21 Internal Server Error Cause This error occurs due to the Net framework mismatch or if the framework is missing. Resolution Before executing the batch file, run the following on the command prompt: %windir%\microsoft.net\framework64\v4.0.30319\aspnet_regiis.exe -i In a 32 bit system, run the following: 19

Troubleshooting %windir%\microsoft.net\framework\v4.0.21006\aspnet_regiis.exe i Tuning for Large File Upload You need to modify the Java memory settings on the application server to enable uploading large files from Connector for SharePoint via DFS. These settings allow a large enough Java heap size for the files to be loaded in memory. Note: These settings can be superseded by limitations of the DFS application server. Increase heap size for the application server by setting the Java Virtual Machine parameter as the following: -Xms4096m Xmx4096m XX:PermSize=64m XX:MaxPermSize=256m Xss256k XX:+DisableExplicitGC Xrs Tuning DFS Data Synchronization If you experience slow data synchronization between Documentum Content Server and the SharePoint server, you can modify the data synchronization time of DFS. The following line in the dfc.properties file of DFS determines the data synchronization time of DFS: dfc.cache.type.currency_check_interval=86400 The value is in milliseconds and ranges from 0 to 86400. For example, when you create a new Documentum type named customizedtype from EMC Documentum Administrator and set dfc.cache.type.currency_check_interval to 300 on the DFS and DFSX server, you can see the new type appears in Connector for SharePoint in 300 milliseconds. Using Manual Authentication When you use manual authentication, the user authentication data is cached on the SharePoint node when a user enters the information. If the user visits another node in a cluster, that authentication information is not available to Connector for SharePoint, the user needs to enter the authentication information again. To reuse the cache file, copy the cache file to other nodes in the cluster. The cache file is located at <DC4SP Add-in server web location>\_layouts\documentum\cache. You can also use various methods to synchronize the cache file between cluster nodes so the user needs to authenticate to each App Part only once. 20

Troubleshooting Using Ticketed Login with Privileged Client There can be performance issues when you use ticketed login and privileged client while generating the random number needed for this process. For Linux deployments, you can resolve this issue by adding the following parameter to the Java startup settings of the server you deployed DFS and then restart the server: -Djava.security.egd=file:///dev/urandom You can also add the following lines to the beginning of the dm_start_<server> script on the Content Server hosts: DEVRANDOM=/dev/urandom export DEVRANDOM Clearing Script Cache in Web Browsers Clearing Script Cache in Internet Explorer 1. Open the Internet Options dialog box in Internet Explorer. 2. On the General page, click Settings in the Browsing history section. 3. Click View files. The Temporary Internet Files folder appears. 4. Delete all the files in the Temporary Internet Files folder. Clearing Script Cache in Firefox 1. Open the Options dialog in Mozilla Firefox. 2. On the Advanced page, select Network. 3. In the Cached Web Content section, click Clear Now. 21