OD 6.2 test deployment failed

Hi All,

I have installed TS6.7.1 SP1 and OD6.2.0.0 on windows 2003 Server. I tested the OD using the below clt.

I:\iw-home\OpenDeploy\OpenDeployNG\bin>iwodcmd.exe start test.xml

Locating OpenDeploy service.
Got OpenDeploy service
>>>>>-- Start deployment test.
iwodstart running in default synchronous mode.
Need to wait for deployment to complete.
***ERROR - Starting deployment.
Caught exception. Details: REQUEST_DENIED

In the logs i am getting the below.

CLT: 2008-04-08 14:24:41 BST GMT+01:00 OpenDeploy CLT proxy bound on [localhost:3434]
SVR: 2008-04-08 14:24:41 BST GMT+01:00 *** OPENDEPLOY SERVER FINISHED STARTUP. ***
CLT: 2008-04-08 14:24:54 BST GMT+01:00 Allowing execution from 127.0.0.1/127.0.0.1
API: 2008-04-08 14:24:54 BST GMT+01:00 Requested start of deployment test
API: 2008-04-08 14:24:54 BST GMT+01:00 User SH1\-adm-sahos0 login on od-admin role but is not an od-admin user on this OpenDeploy host.
API: 2008-04-08 14:24:54 BST GMT+01:00 User SH1\-adm-sahos0 not in od-user role either.
API: 2008-04-08 14:24:54 BST GMT+01:00 Request denied. User: SH1\-adm-sahos0, login role: od-admin, deployment: test, request: START_DEPLOY

We are using AD based Authen.

I:\iw-home\OpenDeploy\OpenDeployNG\bin>iwodservergetversion.bat
Version 6.2.0.0.0 Build 68916 Interwoven 20071109
I:\iw-home\OpenDeploy\OpenDeployNG\bin>iwodauthorize -r list od-user
OpenDeploy server host: localhost, RMI registry port: 9173
Specified role: od-user
** ERROR: Failed performing OD security function.
Message: REQUEST_DENIED
I:\iw-home\OpenDeploy\OpenDeployNG\bin>

I have read the OD Admin docs. We dont want to use the boot strap user. Previously we used OD6.0.0 in that a fresh install would work without any setting changes (test deployment)

Any help would be of great use.

Thanks
Prem

Find more posts tagged with

Comments

Adam Stoller

Hi All,

I have installed TS6.7.1 SP1 and OD6.2.0.0 on windows 2003 Server. I tested the OD using the below clt.

I:\iw-home\OpenDeploy\OpenDeployNG\bin>iwodcmd.exe start test.xml

Locating OpenDeploy service.
Got OpenDeploy service
>>>>>-- Start deployment test.
iwodstart running in default synchronous mode.
Need to wait for deployment to complete.
***ERROR - Starting deployment.
Caught exception. Details: REQUEST_DENIED

[...]
Any help would be of great use.

Thanks
Prem

If you have the OD Admin GUI installed - log in to the GUI and add yourself as an od-admin or an od-user with access rights to the deployment(s) you wish to run (you'll have to login to the GUI as the bootstrap administrator the first time)

Alternatively, edit the deploy.cfg file - and find the line that says:

Deploy.cltProxyAuthCheck:   y

and change the 'y' to an 'n' and then stop / start the OD base server process

C:\> net stop iwod60
C:\> net start iwod60

prem_pratick

Hi ,

Deploy.cltProxyAuthCheck: y solved the issue.

Thanks
Prem

catorarn

Solution stack: Solaris10/TS672/OD62base (same machine)

Hi guys, I have an Deploy Task setup in a workflow model. This workflow model works in production on a windows2003 machine in one customer. Now I implement the same model into a solaris 10 TS672/OD62patch1 base server and I get this OpenDeploy message as in your thread returned:

ERROR - Caught exception in runIt(). OpenDeploy Status Unknown. FAILED. Locating OpenDeploy service. Got OpenDeploy service ***ERROR - Caught exception in runIt(). Details: REQUEST_DENIED Please check that the OpenDeploy server is running.

I have the following Deployment variables:

ODHost: bewcmd01
ODPort: 39173
ODDeploymentName: UHBDeployments/UHB_SyncToTeamSite

I have the following deploy.cfg:

[html]
#
# deploy.cfg
#
# This deploy configuration file is a Java property file and must
# be named deploy.cfg.
# It is read by the OpenDeploy server during startup.
#
# Unless otherwise specified, each configuration property is public,
# has a case sensitive name, has a case insensitive value,
# and is stripped of leading and trailing whitespace during use.
#

#--- The server config file name. Case sensitive.
#
# The server config file must be located in OpenDeploy
# home's etc directory. Only the file name is specified here.
#
# This property is REQUIRED.
#
# Example: for a OD base: Deploy.serverConfig: odbase.xml
# Example: for a OD receiver: Deploy.serverConfig: odrcvr.xml
#
Deploy.serverConfig: odbase.xml

#--- The server nodes file. Case sensitive.
#
# The server nodes file must be located in OpenDeploy
# home's etc directory. Only the file name is specified here.
#
# This property is REQUIRED.
#
# Example: Deploy.serverNodesConfig: odnodes.xml
#
Deploy.serverNodesConfig: odnodes.xml

#--- The bootstrap user name. Case insensitive.
#
# Whenever the Open Deploy server (base or receiver) starts up,
# it will add the bootstrap user specified here to the OD server's
# od-admin role database.
#
# The bootstrap user is usually the first user you use to login
# to the OD Admin GUI so you can create other users.
#
# The bootstrap user *MUST* be a valid od-admin role user
# on the Operations Server that is servicing this OD server.
# The Operation server performs the authentication check when
# a user logs into the OD Admin GUI.
# Note that the Operating System platform of the
# Operation Server and the OD Server can be different.
#
# For a Windows Operations Server, the format is:
#
# domain-name\\user-name
#
# Example: Deploy.bootStrapUserName: FINANCE\\john
# where FINANCE is the user's domain or workgroup,
# john is the user name
#
# For a Unix Operations Server, the format is:
#
# user-name
#
# Example: Deploy.bootStrapUserName: john
# where john is the user name
#
# In addition to the bootstrap user specified here, the OD server
# automatically adds two other default bootstrap users:
#
# \\Administrator
# root
#
# This property is OPTIONAL.
# To comment it out, place a # at the beginning of the line.
#
Deploy.bootStrapUserName: root

#--- Allow default bootstrap users. Case insensitive.
#
# When the OpenDeploy server (base or receiver) starts up
# and there is no od-admin role file /db/od-admin,
# OpenDeploy automatically adds the following default bootstrap
# users to the od-admin role:
#
# \Administrator
# root
#
# If you prefer OpenDeploy server not to create these default
# bootstrap users, you can do so by setting this property to "no".
#
# The od-admin role file doesn't exist when it is the very
# first time OpenDeploy is starting up or when the file was
# manually removed.
#
# If the od-admin role file already exists, setting this
# property to "no" will cause OpenDeploy server at startup time
# to lookup the default bootstrap users and delete them if they exist.
#
# The valid input values are "yes" or "no". The default is "yes".
# If the value specified is not "yes" or "no", the default
# setting of "yes" will be used.
#
# This property is OPTIONAL.
# To comment it out, place a # at the beginning of the line.
#
#Deploy.allowDefaultBootStrapUser: yes

#--- The RMI Connection ports.
#
# OpenDeploy requires 2 sets of RMI connection ports.
# One set is for server administration.
# Thes other set is for event reporting.
#
# Within each set of RMI connection ports, each port can be a
# unique port number or they can share the same port number(s).
# This implies OpenDeploy requires a minimum of 2 different
# connection port numbers for RMI, one for each set.
#
# Valid port range is 1 - 65535 where 1-1024 are considered
# to be reserved ports by the Operating System. Also, 0 can be used
# to allow the Operating System to choose any available port.
#
# The default value for the server administration RMI connection ports:
# Deploy.rmiConnectionPort1: 24071
# Deploy.rmiConnectionPort2: 24071
# Deploy.rmiConnectionPort3: 24071
# Deploy.rmiConnectionPort4: 24071
# Deploy.rmiConnectionPort5: 24071
# Deploy.rmiConnectionPort6: 24071
# Deploy.rmiConnectionPort7: 24071
#
# The default values for the event reporting RMI connection ports:
# Deploy.rmiConnectionPort8: 24078
# Deploy.rmiConnectionPort9: 24078
# Deploy.rmiConnectionPort10: 24078
# Deploy.rmiConnectionPort11: 24078
# Deploy.rmiConnectionPort12: 24078
# Deploy.rmiConnectionPort13: 24078
# Deploy.rmiConnectionPort14: 24078
# Deploy.rmiConnectionPort15: 24078
#
# In case any of the default ports are in use by other processes,
# you can modify all or any of these properties to your own
# port numbers.
#
# If a non-integer port number or a port number outside of the
# valid range is specified, OpenDeploy will use the default value
# for that port.
#
# If a duplicate port is specified between the 2 sets of ports,
# OpenDeploy will not use any of the specified ports and will
# use all default ports instead.
#
# These properties are OPTIONAL.
# Remove # at the beginning of the line to make property active.
#

#-- server administration RMI connection ports:
Deploy.rmiConnectionPort1: 24071
Deploy.rmiConnectionPort2: 24071
Deploy.rmiConnectionPort3: 24071
Deploy.rmiConnectionPort4: 24071
Deploy.rmiConnectionPort5: 24071
Deploy.rmiConnectionPort6: 24071
Deploy.rmiConnectionPort7: 24071
#
#-- event reporting RMI connection ports:
Deploy.rmiConnectionPort8: 24078
Deploy.rmiConnectionPort9: 24078
Deploy.rmiConnectionPort10: 24078
Deploy.rmiConnectionPort11: 24078
Deploy.rmiConnectionPort12: 24078
Deploy.rmiConnectionPort13: 24078
Deploy.rmiConnectionPort14: 24078
Deploy.rmiConnectionPort15: 24078

#--- The RMI server binding IP Address or hostname. Case sensitive.
#
# The RMI server binding IP address or hostname is used to specify
# a specific IP address or hostname OpenDeploy should use
# in setting up its RMI services.
# The RMI services are used for servicing the OpenDeploy
# Administration server and for supporting event reporting.
#
# This property is useful when the host where the OpenDeploy
# base/receiver server is installed has multiple hostnames/IP addresses.
# This property allows the user to tell the OpenDeploy base/receiver
# server which hostname/IP address it should use to communicate to the
# OpenDeploy Administration server.
#
# Please make sure the value specified is correct.
# This value is passed to Java RMI as a property. The result
# is unpredictable when the value is invalid.
#
# If this property is not specified, by default, OpenDeploy will use
# the local hostname.
#
# This property is OPTIONAL.
# Remove # at the beginning of the line to make property active.
#
# Examples:
# Deploy.rmiServerBind: 10.234.567.890
# Deploy.rmiServerBind: bewcmd01
#
#Deploy.rmiServerBind: bewcmd01

#--- The RMI server port number.
#
# The RMI server port number is used to specify
# a specific TCP port number that OpenDeploy should use
# in setting up its RMI registry service.
# The RMI registry is used for servicing the OpenDeploy
# Administration server and for supporting event reporting.
#
# Please make sure the value specified is correct.
#
# If this property is not specified, by default, OpenDeploy will use
# port 9173.
#
# This property is OPTIONAL.
# Remove # at the beginning of the line to make property active.
#
# Examples:
# Deploy.rmiServerPort: 9173
#
Deploy.rmiServerPort: 39173

#--- The CLT Proxy Options
#
# The CLT Proxy is a socket listener that by default will
# bind on localhost port 3434 and only allow localhost requests.
# The following options can be used to customize operation.
#
# Deploy.cltProxyEnable is used to enable/disable the proxy
# values: y/n
# Deploy.cltProxyPort is used to specify a port to use
# values: numeric port
# Deploy.cltProxyHost is used to specify address that listener will bind on
# values: dot-notation or long/short hostname
# For localhost, use "localhost"
# Deploy.cltProxyAllowedHost is used to specify comma delimited list of
# allowed remote hosts
# values: dot-notation or long/short hostname
# For localhost, use "localhost"
# Deploy.cltProxyAuthCheck is used to enable/disable authorization checking
# values: y/n
#
# These properties are OPTIONAL.
# Remove # at the beginning of the line to make property active.
#
Deploy.cltProxyEnable: y
Deploy.cltProxyPort: 3434
Deploy.cltProxyHost: localhost
Deploy.cltProxyAllowedHost: bewcmd01, localhost
#Deploy.cltProxyAuthCheck: y
Deploy.cltProxyAuthCheck: n

#--- The key file for access control. Case sensitive.
#
# The key file for access control must be located in
# OpenDeploy home etc directory. Only the file name is specified here.
#
# This key file is used to control which OpenDeploy
# Admin server can access this OpenDeploy server.
#
# Each OpenDeploy Admin server is configured to
# use a specific ContentServices Foundation (CSF) Access Service
# for authenicating users at login time.
# The CSF Access Service uses a key file which is located
# in /etc directory. The key file
# is unique to the specific Access Service.
#
# For added security, it is possible to do the following:
# In order for the OpenDeploy Admin Server to access
# this OpenDeploy server, the key file from the Access Service
# the OpenDeploy Admin Server is configured to use must be copied
# into the OpenDeploy server etc directory (/etc).
# The name of the key file can be different between the
# Access Service and OpenDeploy server but the content
# must be the same.
#
# The above always applies to OpenDeploy Web Service clients.
# Each OpenDeploy Web Service client for this OpenDeploy
# server must authenicate with the Access Service whose
# key file is same as this OpenDeploy server.
#
# Deploy.accessKeyFile:
#
# This property is use to tell OpenDeploy the name of the
# key file in /etc.
# There can only be 1 key file specified.
# Default is passphrase.
#
# Deploy.useAccessKeyFileForAdmin:
#
# OpenDeploy Web Service always requires a key file in OpenDeploy.
# It is possible to configure the OpenDeploy server to not
# require the usage of a key file for OpenDeploy Admin accesses.
# This property is used to do this. Valid values:
# n = not require a key file for OpenDeploy Admin accesses
# y = require a key file for OpenDeploy accesses
# Default is n.
#
# These properties are OPTIONAL. Examples:
#
# Deploy.useAccessKeyFileForAdmin: n
# Deploy.accessKeyFile: passphrase
#
Deploy.useAccessKeyFileForAdmin: n
Deploy.accessKeyFile: passphrase

#--- Teamsite version
#
# teamsiteVersion is used to specify the version of the TeamSite server.
# Specify the exact teamsite version for OD to talk to teamsite.
# This property is REQUIRED, if you are talking to teamsite releases >= TS6.5
# This property is OPTIONAL, if you are talking to teamsite releases lower than TS6.5
#
#
teamsite.version: 6.7.1
teamsite.version: 6.7.2
[/html]

I found in the Interwoven Support DB that some engineers suggested to put this:

Deploy.cltProxyAuthCheck: n

that does not seem to make an effect. I had it originally on y.

The customer spent a day earlier trying to configure the Deployment Task, but they gave up and used perl instead.

I want to fix this for them and avoid using a perl script.

Adam Stoller

[...]I found in the Interwoven Support DB that some engineers suggested to put this:

Deploy.cltProxyAuthCheck: n

that does not seem to make an effect. I had it originally on y.

The customer spent a day earlier trying to configure the Deployment Task, but they gave up and used perl instead.

I want to fix this for them and avoid using a perl script.

When you made that change on the Base Server - did you stop/start the server? (I don't know if iwodcmd serverreset is sufficient, so an actual /etc/init.d/iwod60 restart is better in this case) - the REQUEST_DENIED error is usually a result of the authcheck being performed and the user who owns the process not having the requisite permissions.

It's also possible that the Java code for initiating deployments might not honor that setting, since it isn't really a "CLT" then. I'm assuming you're trying to do this with Java - yes? If so, perhaps the code you're using to initiate the deployment might be beneficial to share...

catorarn

I got it to work with these instructions (thanks to Yogesh Kumar!):

1- put the passphrase from /opt/interwoven/iw-home/private/etc in /opt/interwoven/od-home/etc
2- /etc/init.d/iwod60 stop and /etc/init.d/iwod60 start

Venus00

I am getting the same error only for few users.

--> Is there any way to add user entry somewhere to get the ProxyAuthCheck pass for those Users?

I dont have the GUI available for OD,but I can run CLT and make entry in a file.

Adam Stoller

I am getting the same error only for few users.

--> Is there any way to add user entry somewhere to get the ProxyAuthCheck pass for those Users?

I dont have the GUI available for OD,but I can run CLT and make entry in a file.

The CLT is iwodauthorize - the command-line options may vary depending on the version of the software you are using - so be sure to run with the

-h

flag as well as checking the CLT manual.

Reghunath

I would like share my experience on fixing the same deployment user role error.

I was having the same issue but above given guidelines didn't resolve.
In addition below error was showing up in the log every couple of minutes
2010-09-03 09:33:53.273 GMT-0400 serverLog [RMI TCP Connection(1478)-10.20.168.141] - API: ***ERROR - Failed to get user and role. No CSContextString. Request app: APP_ODEVENTREPORT

In ODBase log, on start up i noticed this line

2010-09-02 16:37:23.579 GMT-0400 serverLog [OpenDeploy Main] - SVR: Strict Authentication enabled....

There is one more flag in odbase.xml named strictAuthentication. The odbase log has been referring this. Admin ref Document says by default this is set to "no", but its set to "yes" in our case.
Refer page no 178 in OD 7.1 Administration Guide "Restricting Access to Users with Opendeploy Roles(Strict Authentication)"

Regarding Deploy.cltProxyAuthCheck flag.

As I'm using CLT commands to invoke deployment, does this flag will have any impact? I believe for CLT commands the system doesn't need proxy authentication(as in browser based setting), right?.

Hope this finds helpful...

~ R

Adam Stoller

...
Regarding Deploy.cltProxyAuthCheck flag.

As I'm using CLT commands to invoke deployment, does this flag will have any impact? I believe for CLT commands the system doesn't need proxy authentication(as in browser based setting), right?.

Since the name of the flag is Deploy.cltProxyAuthCheck - why would you think this doesn't apply if you are using the CLT to initiate a deployment?
If you don't want to have to go through the iwodauthorize process (either via CLT or GUI) to allow all your users (generally via workflow task steps) to initiate deployments, then you want to set the above to "n" (or "no") and restart the OD Base Server process.

Reghunath

Yes, I did set this flag to 'n' as mentioned in the setting and restarted the OD server(even the windows server once just to make sure).

After several times trying out this option, i went through the documentation back tracing the below OD Log message
2010-09-02 16:37:23.579 GMT-0400 serverLog [OpenDeploy Main] - SVR: Strict Authentication enabled....

I was able to find out the flag "StrictAuthentication" in the documentation, mentioned above in my post.

Thanks
Reghu.

Adam Stoller

Yes, I did set this flag to 'n' as mentioned in the setting and restarted the OD server(even the windows server once just to make sure).

After several times trying out this option, i went through the documentation back tracing the below OD Log message
2010-09-02 16:37:23.579 GMT-0400 serverLog [OpenDeploy Main] - SVR: Strict Authentication enabled....

I was able to find out the flag "StrictAuthentication" in the documentation, mentioned above in my post.

Thanks
Reghu.

Okay - I see where this is covered in the documentation. I'm guessing that either the documentation is wrong (i.e. the default is "yes") or some other aspect of the installation (SitePublisher / LiveSite perhaps) modifies the default value from "no" to "yes". I'm basing this on a single installation of 7.1 that I have on my laptop, in which SP/LS was enabled - and my odbase.xml has strictAuthentication="yes" in it - and I know I didn't make that change myself.

You could try changing the setting to "no" and restart the OD base server process and see if that resolves the problems you are having (which I'm not entirely sure what they are) - and/or contact Support and question them about both the documentation with regard to this attribute and with regard to your issue(s).