DA - dmadmin can login without valid password

rgriebel

Hi,

after Docbase cloning, the user dmadmin is able to login into the DA without a valid password. During the cloning process we changed the hostname. We processed the following steps:

1. Shutdown all the repositories on the target server 
2. Backup the database 
3. Rename the AEK file or rename it and move it some where else 
4. From sql on the database update dm_docbase_config_s set i_crypto_key = ' '
5. From sql on the database update dm_docbase_config_s set i_ticket_crypto_key = ' '
6. from sql: SQL> select r_object_id from dmi_vstamp_s where i_application = 'dm_docbase_config_crypto_key_init'; 
7. delete from dmi_object_type where r_object_id = 'returned r_object_id from above'; 
8. SQL> commit; 
9. SQL> delete from dmi_vstamp_s where r_object_id = 'returned r_object_id from step above' 
10. SQL> commit; 
11. SQL> select r_object_id from dmi_vstamp_s where i_application = ¿dm_docbase_config_ticket_crypto_key_init¿; 
12. SQL> delete from dmi_object_type where r_object_id = 'returned r_object_id from above'; 
13. SQL> delete from dmi_vstamp_s where r_object_id = 'returned r_object_id from step above' 
14. SQL> commit 
15. run this file from $DM_HOME/bin: dm_crypto_create 
16. - To re-encrypt the dbpasswd.txt file do the following 
cd $DM_HOME/bin 
17. dm_encrypt_password -repository <repository name> -rdbms -encrypt <database password> 
18. You need to do all modification on the database for each repository NOT just step 15!! 
19. Startup the repositories.

The trace output for the dmadmin login is :

Tue Apr 06 12:53:46 2010 123000: 3400[6016] AT 6016:

Final Auth Result=T, LOGON_NAME=dmadmin,

AUTHENTICATION_LEVEL=9,

OS_LOGON_NAME=dmadmin,

OS_LOGON_DOMAIN=s-waugz2favt01,

CLIENT_HOST_NAME=S-WAUGZ2FAVT01,

CLIENT_HOST_ADDR=192.168.213.66,

USER_LOGON_NAME_RESOLVED=1,

AUTHENTICATION_ONLY=0,

userID=110227b080000102,

USER_NAME=dmadmin,

USER_OS_NAME=dmadmin,

USER_LOGIN_NAME=dmadmin,

USER_LOGIN_DOMAIN=S-WAUGZ2FAVT01,

USER_EXTRA_CREDENTIAL[0]=S-WAUGZ2FAVT01,

USER_EXTRA_CREDENTIAL[1]=,  

USER_EXTRA_CREDENTIAL[2]=,

USER_EXTRA_CREDENTIAL[3]=005056b157a0,    USER_EXTRA_CREDENTIAL[4]=DM_TOKEN=AAAAAQAAAOQAAAACAAAAAUux81JPdFpSAAAAOGZhdn

Byb2QAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAHMtd2F1Z3oyZmF2dDAxAAAAAATTAAAAAAAAAAAAAAAAAGZhdnByb2QAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAAAAAAFMtV0FVR1oyRkFGGDAxAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

AAAAAAAAAAAAAAMDA1MDU2YjE1N2EwAAAAZFZtcW5KczNZbVZOQm1RWEVrMVNlK2trSWhHMHZOQU

RjejZqK3laREZ2NVpDN1hrZDVjR0ZBPT0=,     

USER_EXTRA_CREDENTIAL[5]=

From my point of view the authentication level 9 is not correct for dmadmin. How can i change the authentication level from 9 to 8?

Thanks.

Ragnar

bacham2

I suppose that your app server is installed on the same machine is Content Server and running as the Documentum installation owner account (dmadmin by default). That's generally not a good idea because it could be a security hole.This is probably what is happening in your case: Content Server opens the session because trusted login succeeds (because app server is running as dmadmin).

If you need to keep it that way, add the following line to the dfc.properties file used by DA:

dfc.session.allow_trusted_login = false

Hicham