Error : Authorization failed, could not find identities in service context

I have used AXIS to generate stubs for DFS services and then used these to connect to and query a documentum repository. These worked fine with 6.5 SP2 but we have now applied SP3 and I get the error below. I believe that the error is due to the SP3 update but don't know for sure:

Error : Authorization failed, could not find identities in service context with token "temporary/company-710ebf/172.27.65.0-1294920590524-4884304557404590227-5"

I have included what I hope are the relevent SOAP request/responses plus Java code below. Please could someone help me by either suggesting the change to the code that is required or if this is not required then the configuration change that I need to make. Or failing that if it is not related to the SP3 update then where else I could investigate.

Any help with this question would be very gratefully received,

Thanks

Steve

<?xml version="1.0" encoding="http://schemas.xmlsoap.org/soap/envelope/" standalone="no"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Body>
<ns8:register xmlns:ns2="http://context.core.datamodel.fs.documentum.emc.com/" xmlns:ns3="http://properties.core.datamodel.fs.documentum.emc.com/" xmlns:ns4="http://query.core.datamodel.fs.documentum.emc.com/" xmlns:ns5="http://profiles.core.datamodel.fs.documentum.emc.com/" xmlns:ns6="http://content.core.datamodel.fs.documentum.emc.com/" xmlns:ns7="http://core.datamodel.fs.documentum.emc.com/" xmlns:ns8="http://services.rt.fs.documentum.emc.com/">
<context>
<ns2:Identities xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" password="admin" repositoryName="documentum" userName="admin" xsi:type="ns2:RepositoryIdentity"/>
</context>
</ns8:register>
</soapenv:Body>
</soapenv:Envelope>

<?xml version="1.0" standalone="no"?>
<S:Envelope xmlns:S="http://schemas.xmlsoap.org/soap/envelope/">
<S:Body>
<ns2:registerResponse xmlns:ns2="http://services.rt.fs.documentum.emc.com/" xmlns:ns3="http://context.core.datamodel.fs.documentum.emc.com/" xmlns:ns4="http://properties.core.datamodel.fs.documentum.emc.com/" xmlns:ns5="http://profiles.core.datamodel.fs.documentum.emc.com/" xmlns:ns6="http://query.core.datamodel.fs.documentum.emc.com/" xmlns:ns7="http://content.core.datamodel.fs.documentum.emc.com/" xmlns:ns8="http://core.datamodel.fs.documentum.emc.com/">
<return>company-710ebf/172.27.65.0-1294920590524-4884304557404590227-5</return>
</ns2:registerResponse>
</S:Body>
</S:Envelope>

Query Service - SOAP Request
============================

<?xml version="1.0" encoding="http://schemas.xmlsoap.org/soap/envelope/" standalone="no"?>
<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
<soapenv:Header>
<wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd">
<wsse:BinarySecurityToken xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsse:QualificationValueType="http://schemas.emc.com/documentum#ResourceAccessToken" wsu:Id="RAD">company-710ebf/172.27.65.0-1294920590524-4884304557404590227-5</wsse:BinarySecurityToken>
</wsse:Security>
</soapenv:Header>
<soapenv:Body>
<ns7:execute xmlns:ns2="http://query.core.datamodel.fs.documentum.emc.com/" xmlns:ns3="http://properties.core.datamodel.fs.documentum.emc.com/" xmlns:ns4="http://core.datamodel.fs.documentum.emc.com/" xmlns:ns5="http://content.core.datamodel.fs.documentum.emc.com/" xmlns:ns6="http://profiles.core.datamodel.fs.documentum.emc.com/" xmlns:ns7="http://core.services.fs.documentum.emc.com/">
<query xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" queryString="SELECT name, mime_type, description FROM dm_format" xsi:type="ns2:PassthroughQuery">
<ns2:repositories>documentum</ns2:repositories>
</query>
<execution cacheStrategyType="DEFAULT_CACHE_STRATEGY" maxResultCount="1000" maxResultPerSource="1000" startingIndex="0"/>
</ns7:execute>
</soapenv:Body>
</soapenv:Envelope>

Exception reported by AXIS
==========================

SerializableException Failed to execute query [SELECT name, mime_type, description FROM dm_format]
Error : Authorization failed, could not find identities in service context with token "temporary/company-710ebf/172.27.65.0-1294920590524-4884304557404590227-5"

Java Code to Register Context
=============================

public static String registerContext(String webserviceRoot, String user, String password,
String repository) throws DFSException
{
String token = null;
List<String> errors = new ArrayList<String>();

try
{
RepositoryIdentity identity = new RepositoryIdentity();

   identity.setUserName(user);
   identity.setPassword(password);
   identity.setRepositoryName(repository);

ServiceContext serviceContext = new ServiceContext();
serviceContext.getIdentities().add(identity);

   ContextRegistryServiceStub stub = new ContextRegistryServiceStub(webserviceRoot
     + "/services/core/runtime/ContextRegistryService");
   RegisterResponse response = stub.register(register);
   token = response.getReturn();
}
catch (RemoteException e)
{
   errors.add("Failed to register context");
   StackTraceElement[] stackTraceElement = e.getStackTrace();
   for (int i = 0; i < stackTraceElement.length; i++)
   {
    errors.add(stackTraceElement[i].toString());
   }
   throw new DFSException(errors, e);
}
catch (Exception e)
{
   errors.add("Failed to register context");
   errors.add(e.getMessage());
   throw new DFSException(errors, e);
}

return token;
}
}

Java Code to make query
=======================

public DataPackage callQueryService_execute(String serviceRoot, String token,
String repositoryName, String query, int maxResults, int maxResultsPerSource)
throws DFSException
{
DataPackage resultsDataPackage = null;
List<String> errors = new ArrayList<String>();

try
{
// instantiate stub
QueryServiceStub stub = new QueryServiceStub(serviceRoot + serviceEndpoint);

   // add security header to stub for subsequent calls
   ServiceClient client = stub._getServiceClient();
   client.addHeader(DFSConsumerSecurityHelper.getSecurityHeader(token));

   // set up the query
   PassthroughQuery passthroughQuery = new PassthroughQuery();
   passthroughQuery.setQueryString(query);

// set the repositories to search
passthroughQuery.getRepositories().add(repositoryName);

   // set up execution object
   com.emc.documentum.fs.services.core.Execute execute = new com.emc.documentum.fs.services.core.Execute();
   execute.setQuery(passthroughQuery);

   // optionally set up query execution options
   QueryExecution queryExecution = new QueryExecution();
   queryExecution.setCacheStrategyType(CacheStrategyType.DEFAULT_CACHE_STRATEGY);
   queryExecution.setMaxResultCount(maxResults);
   queryExecution.setStartingIndex(0);
   queryExecution.setMaxResultPerSource(maxResultsPerSource);
   execute.setExecution(queryExecution);

boolean moreResultsToGet = true;
resultsDataPackage = new DataPackage();

   while (moreResultsToGet && resultsDataPackage.getDataObjects().size() < maxResults)
   {
    // invoke the service
    ExecuteResponse res = stub.execute(execute);

// get the results
QueryResult queryResult = (QueryResult) res.getReturn();

    // check for errors
    QueryStatus queryStatus = queryResult.getQueryStatus();
    RepositoryStatusInfo repStatusInfo = queryStatus.getRepositoryStatusInfos().get(0);
    if (repStatusInfo.getStatus() == Status.FAILURE)
    {
     System.out.println(repStatusInfo.getErrorTrace());
     throw new RuntimeException("Query failed to return result.");
    }

    // return data package object
    resultsDataPackage.getDataObjects().addAll(
      queryResult.getDataPackage().getDataObjects());
    moreResultsToGet = queryStatus.isHasMoreResults();
    queryExecution.setStartingIndex(queryExecution.getStartingIndex()
      + queryResult.getDataPackage().getDataObjects().size());
    execute.setExecution(queryExecution);
   }
}
catch (SerializableException e)
{
   errors.add("Failed to execute query [" + query + "]");
   for (DfsExceptionHolder ex : e.getFaultMessage().getExceptionBean())
   {
    errors.add("Error : " + ex.getMessage());
   }
   throw new DFSException(errors, e);
}
catch (Exception e)
{
   errors.add("Failed to execute query [" + query + "]");
   errors.add(e.getMessage());
   throw new DFSException(errors, e);
}
return resultsDataPackage;
}
}

Message was edited by: Jerry Silver - I removed the long string from the title that was messing up the formatting of the forum.

Find more posts tagged with

Comments

mszurap

Hi,

Have you tried to use unregistered calls?

SteveBlatch

Thanks for the suggestion - though I don't think it will solve the problem? I need to use registered calls otherwise I won't get authenticated and so won't be able to access the data - right?

Regards

Steve

mszurap

No. Registered calls are not needed for every call to access protected resources. When you register your context, your session can be maintained on the server side, so multiple calls are faster, consume less resources. If you don't use registered context calls, then your credentials (you still need to send the required information in the servicecontext in the soap header) needs to be validated, session must be created and the session is likely to be released on the end of the DFS service call. It requires more resources, but in clustered environments you must use this, as the token is bounded to the server which issued it, so on a failover, the other node won't accept the token of the other application server node.

Mike

SteveBlatch

Mike

Thanks for your answer but it doesn't really solve the problem - just shifts it to somewhere else. The code I originally posted worked against DF65 SP2 DFS so am wondering whether something has changed in SP3 that means that it no longer works. So my question is really has anything changed in the security header format between SP2 and SP3. Please can someone help to answer this question,

Thanks

Steve

MartyPhee

Did you ever figure this out. I"m running into issues with the same type of call.

rajeshshivekar

Hi Steve/Marty,

Can you try replacing emc-dfs-rt.jar file on the client? not sure if it will help but you can try.

Thanks,

Rajesh