UCF "Security Warning"

Hi,

We have a UCF problem. We install our UCF package on all clients with pre installation. This works fine.

But recently all our clients upgraded to IE6.x and now we recieve an "security warning" to ask if we trust content from EMC.

Offcourse we don't want our end users give that choice.

Is there a server side setting so we can make sure the clients don't deal with this "security warning"?

Thnx,

Bert

Find more posts tagged with

Comments

spinkj

If you get an answer to this let me know. Basically there is a file created in the client-side UCF install called ucf.whitelist.xml. When the user clicks OK the server gets added to the whitelist file. I have not found a way of setting up a whitelist on say the Webtop server and installing this as part of UCF.

Depending on your environment you could get your guys to use a pre-install script to install UCF (was possible in 5.3 have not tested in 6.x) and then once installed you could overwrite the blank ucf.whitelist.xml with a file containing you server name or names using a script. Will depend on writing a login script etc.

Jed

IngoZ

I tried to take a look at the code to find some "hidden key" where this could be turned off but to no avail. I am interested if anyone else found anything besides pre-install. (This would result in a lengthy internal certification process - think of updates/hotfixes etc... )

spinkj

Hmmm..... Next trick would be to l

a: Submit as case to EMC Support and see if they would consider this as a Feature Request, then escalate through your account manager. A simpe fix would be to have an option to put the whitelist server-side in one of the UCF config files and have it referenced by the client installer.

b: Look at modifying the WhiteList code in ucfinit.jar which is pretty drastic

c. If you do not want to pre-install UCF another option may just be to copy the whitelist file as part of your network login script.The path would be known, e.g.

c:\Document and Settings\<user name>\Documentum\ucf\<host-name>\shared\config

If you change the version number of the file by adding an "a" to it, you MIGHT find that the UCF install does not over-write the file. If it does then option c. above is not going to help. Might go off and test this now...

spinkj

Hi,

Did a little local test...

Step 1: blew away the whole local UCF folder structure, except ucf.whitelist.xml...

Step 2: Changed the file to read:

<?xml version="1.0" encoding="UTF-8"?>

<?dctm fileVersion="5.3.0.3a" compatibilityVersion="5.3.0.3"?>

<host>localhost</host>

</trustedHost>

</trustedHost>

</whitelist>

Step 3: Logged into Webtop and got UCF to initialise.

What happened was that it seems the bit of code that generates the ucf.whitelist file looks for any existing files reads in the trustedHost values and then writes a new file, because after UCF initialisation I had:

<?xml version="1.0" encoding="UTF-8"?>

<?dctm fileVersion="5.3.0.3" compatibilityVersion="5.3.0.3"?>

</trustedHost>

<host>localhost</host>

</trustedHost>

</whitelist>

Note that the procesed preserved my whitelist values but obviously re-wrote the file as the fileversion was reset and the order of the hosts was altered, i.e. jed is now first entry and localhost is second.

So, I guess the upshot of all this is that you could have a small login script that copies your own ucf.whitelist.xml file to the correct directory....

GouravMukherjee

The security warning if I understand the question correctly has nothing to do with the UCF whitelist. When UCF starts you get two dialog boxes.

One is to ask if you trust the EMC application: This is because UCF is installed/launched using an applet (ucfinit.jar/ucfinit.cab) This is generated by JRE and you probably need to change some settings in it to keep this from popping up. Do let me know if you would like me to tell you more on this.

The second one asks if you trust the host: This is in fact generated by UCF, and is placed as a security measure and it should ideally not be circumvented. It doesn't really pose too much of a discomfort really, as it is only one click when UCF is installed for the first time/updated or you connect to a new app server.

BTW, please note, if you plan to change any code in the applets, you will need to re sign it, other wise it won't work....

DCTM_lc

Hi All,

We have a similar issue where some of the users keep getting this "Trusted host" pop-up everyday they login to webtop for the first time.

On troubleshooting, I noticed that the Documentum folder itself is getting deleted for those users and hence whitelist.xml everytime they log off. I have checked with our desktop team and found that there are no logon, logoff or startup/shutdown scripts that would do that.

Any idea on where it takes the parameter to delete it then?

Thanks,

Lovely