How to set account permissions for a service account

I am going to be integrating a Google Search Appliance with Documentum and I want to create an account that can be used for "reading" the content for indexing purposes.

I created a folder in the "documentum" repository and placed 6 documents in it. I then connected the appliance up with their "Connector", using my own account, which has full rights. The search system found over 700 documents. There were tons of logs and service message files discovered. I don't want those.

I created a new account and tried to use that but I receive errors back that there is insufficient rights to access certain columns.

With the Connector, you can restrict the system to only pull content of specific object types. I have selected "dm_document" as the only object type and then the columns "a_content_type", "authors", "keywords", "object_name", "r_content_size", "r_creation_date", "r_modify_date", "r_object_type", "subject" and "title".

Does anyone have any suggestions what group and/or privileges to configure for this account? Ideally, all I'd want to see is what is in the "documentum" repository that people add. In this case, I would expect just to get back 6 documents.

Thanks!

Terry

Find more posts tagged with

Comments

bacham2

Two choices:

1. Make sure that the user has access to all required documents using ACLs (e.g. dm_world: READ or add user to ACL or to a group listed in ACL)

2. Make the user a superuser

Hicham

onixterry

Thanks for your reply.

I do not see a group called "dm_world" in the groups area. However, I did note that my folder, with my docs, has "dm_world" assigned to it. How do I assign my user to "dm_world"?

I was able to find the "dm_superusers" group and assign my user to that group. However, that brings me back to my original problem - the system now finds all of the audit logs and error messages, etc. I only want to be able to index the user-created content.

Thanks

Terry

bacham2

Superuser is a privilege. You need to grant this user that privilege.

dm_world is not a group but a placeholder in ACLs. It defines the acces rights of any user who is not listed in the ACL either explicitely or as part of a group. I suggest that you read about it in the Documentum Fundamentals manual.

As for your problem, there is no undisputed definition as to what "user-created" content is. Typically, you could start with all the customer-specific document types which derive from dm_document. However, it's really customer specific.

myshih1

Hello.

In a Windows envionrment, we are asked to grant Documentum's service accounts (RDRA, RDR,ERMS, xPlore PrimaryDsearch) Local Administrator permissions.

Attempting to set least-privilages, we removed the service account from the Local Administrators group, the account only belongs to the 'log on as a service' (no other User Right Assignment), and granted the account full control to the xPlore directories.

The serivces start automatically fine and lasts for about 20 minutes before they die. This is repeatable.

Any ideas as to what other rights or permissions are required?

M. Shih

Haroon_A

Did you look at windows event logs to see what happens? It may give you some clues as where to look for.

myshih1

Yes.

The System event log logs the following after the services die:

Log Name: System

Source: Service Control Manager

Date: 3/18/2013 11:55:48 AM

Event ID: 7034

Task Category: None

Level: Error

Keywords: Classic

User: N/A

Computer: [REDACTED]

Description:

The Documentum TMORDRA service terminated unexpectedly. It has done this 1 time(s).

Trying to get add'l info using ProcMon and ProcExp. It looks like the services are tied to Java.exe, then calls cmd.exe. I've verified the service account has full controll on Java.exe and RX on cmd.exe.

Any other ideas?

M. Shih

Haroon_A

I believe for index server host, the index directory has to be excluded from anti-virus scan. Not sure if that's the case with you or not.

myshih1

Apparently for this server I'm reviewing, it does not have anti-virus software installed.

Searching the internet, I came across this article: Blue Fish Development Group » Blog Archive » Changing Documentum’s Installation Owner

It claims adding in addition to file level ACLs, adding the service account to the User Right: 'Act as part of the operating system' is required. For grins, I did it, but after multiple gpupdate /force and reboots, the services still start fine, but die at 20 minutes.

Any other developers or engineers know of this?

M. Shih

myshih1

Updated Information:

After combing through ProcMon, I have correlated four similar PM entries with when the four services die:

Process Name: dctmservice.exe
Operation: RegQueryValue
Path: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMegaFiles
Result: NAME NOT FOUND
Detail: Length 20

Even with the services in a Started state, the registry entry for "DisableMegaFiles" does not exist in that particular tree.

EMC: please tell us why your services are looking for the specified registry key.

M. Shih

bacham2

This has really nothing to do with the orginal post. Why don't you create a new thread?