Unable to start Documentum 7.2 Dev Edition - Lockbox stable value threshold

I have downloaded and installed Documentum 7.2 Dev Edtion, following the instructions here:

But I am trying to install it on a KVM hypervisor ( not VMWare ),

When I try to start it, the repository fails to start with the following error:

[dmadmin@demo-server ~]$ tail -f /opt/dctm/dba/log/MyRepo.log

The Lockbox stable value threshold was not met because the system fingerprint has changed. To reset the system fingerprint, open the Lockbox using the passphrase.

2016-02-11T17:19:58.007113 5121[5121] 0000000000000000 [DM_CRYPTO_F_KEYSTORE_INIT]fatal: "Failed to initialize keystore at /opt/dctm/dba/secure/aek.key. Internal error - 1057226525"

This post:

suggests that using 7.2 P03 dm_crypto_manage_lockbox would resolve this issue - but that isn't available to me as we are just trialling Documentum.

Is there any workaround for this ( I would be happy to wipe and recreate the repository if some someone could explain how if that would fix it )?

Many thanks

Dave

Find more posts tagged with

Comments

jswenson

463824 : After patching the O/S repository fails to start with 'The Lockbox stable value threshold was not met because the system fingerprint has changed.' https://support.emc.com/kb/463824

So the utility needs to be obtained from a 7.2 P03 Content Server installation on a Linux environment. And copied to the product/7/2/bin directory and executed from there.

i am in the process of doing this now and will upload the utility when I have it.

We are also logging a defect on this.

Andrea Paci

Hi ,

You are using KVM hypervisor rather than VMWare, this could be the reason why you are hitting this error. It is very likely that the OS detects changes to the underlying virtual hardware and makes the necessary reconfiguration.

Changing the hostname, IP address, MAC address, CPU, OS (even a patch)…etc… can affect lockbox; you must then reset the host finger print.

As you already found out, the Documentum Content Server 7.2 Patch Notes provide instructions on how to reset host finger print.

CS-50306

Add a new tool dm_crypto_manage_lockbox to change lockbox passphrase and to reset host finger print.

To reset the host, type the following command:
dm_crypto_manage_lockbox.exe -lockbox a.lb -resetfingerprint -lockboxpassphrase password@123P
To change the passphrase, type the following command:
dm_crypto_manage_lockbox.exe -lockbox a.lb -lockboxpassphrase Password@123 -changepassphrase -newpassphrase password@123P

The following KB articles include this information too:

KB 467434 - Reset lockbox and passphrase with tool dm_crypto_manage_lockbox - https://support.emc.com/kb/467434
463824 - After patching the O/S repository fails to start with 'The Lockbox stable value threshold was not met because the system fingerprint has changed.' - https://support.emc.com/kb/463824

In any case, deleting and recreating the repository should resolve the problem.

Hi ,

Were you able to use the dm_crypto_manage_lockbox tool from the enterprise version in the developer edition?

We would all be happy to know

jswenson

I just received a location for the utility and instructions from engineering. So I am testing this today.

Thanks,

Joe

Petrep

Dear All,

would it be a problem to post the solution here as well?

Please share dm_crypto_manage_lockbox here - I don't have access to the EMC download links or KB articles, I only have the VM and need to do testing for my client.

Thank you,

Peter

jswenson

Hi Peter,

I don't see a way to insert a file into this discussion. The only option are video and image.

I wrote a KB article on this issue: https://support.emc.com/kb/484319 which contains !the dm_crypto_manage_lockbox utility. If you are an EMC customer you should be able to access KB articles.

We have a Defect logged with engineering on this as well, CS-54129. We are looking for an ETA for a fix. I can ask them to post the utility on the site from where you downloaded the image.

Also note: Since lockbox is enabled on the Content Server you will still get an error trying to start the Content Server even after running the utility to reset the fingerprint. You will also need to run the dm_crypto_boot utility on each restart of the content server and provide the lockbox passphrase each time..

Let me know if you have any questions.

Cheers,

Joe

jswenson

Yes the utiltiy worked on 7.2 developer edition. But it is Linux so the commands are only slightly different than what you posted.

I wrote a KB: https://support.emc.com/kb/484319 which describes the steps.

Since Lockbox passphrase is set on the CS, you also will need to run dm_crypto_boot utility (as per KB 471961) each time the Content Server is restarted.

Cheers,

Joe

DROA

Hi Joe

Thanks for these updates. We are also just trialing Documentum so don't have access to the EMC KB. Please let us know when the utility has been posted with the Dev VM and I'll give it a try.

Kind Regards

Dave

jswenson

Your best bet is to go with the 7.1 Developer Edition. Its available on the same download page as the 7.2 edition. It is only 5.3 GB in size so its much easier to download and install and has no lockbox to deal with.

I updated the engineering task asking the to make the utility available on the Developer Download page I they aren't able to do a new build quickly.

Camille3DS

Hello,

same thing here. So I'm waiting for the upload link of the dm_crypto_manage_lockbox script.

Thanks !

Petrep

I have tried downloading Dev Edition 7.1, and run into this error:

" 15:58:07,766 ERROR [org.jboss.as.server.deployment.scanner] (DeploymentScanner-threads - 1) JBAS015052: Did not receive a response to the deployment operation within the allowed timeout period [300 seconds]. Check the server configuration... "

Steps to reproduce the issue:

1. Downloaded CS_71_CentOSPostgres_Image.rar and started it (on my Windows 7 laptop)

(Please note that I did not change anything in the VM configuration during my tests)

2. Once the VM loaded, I logged on as dmadmin using the password: password

3. I opened a terminal window

4. I typed: ./documentum.sh start

5. Finally, I received the error above (and the whole VM became irresponsible, probably because of low memory - separate issue)

I can of course fix this issue, but I wanted to point out that there are several issues with the 7.1 VM as well.

In my opinion, the biggest problems with the 7.1 VM are:

- if I log on to DA, and click on: User Management / Groups:

I get: “a query error has occurred”

- Internet access is not enabled on the VM by default? This is a must, I have to create test java programs on my windows laptop and be able to connect to the Documentum VM

- DQL does not get translated correctly to PostgreSQL according to forumers - Oracle db should be supported

- CTS server should be added to the VM so we could do basic testing, this is also a must..

For all these reasons above, I stopped testing the 7.1 version back in December, and I was waiting for 7.2 to come out, but I can see that there are a lot of issues on this version, too

If you have other suggestions, please let me know,

Many thanks,

Peter

Andrea Paci

, the script has been attached to https://support.emc.com/kb/484319

, good article!

Camille3DS

Thanks.

I don't have access to the KB but I just saw that the link has been posted on the original article about the VM.

Thanks a lot !

jswenson

I am working with engineering and product management to get this addressed.

Stay tuned...

Joe

jswenson

There are a few minor issues with 7.1 Developer Edition but can easily be worked around. I have it up and running as well as a customer I am working with.

I will report these issues to engineering as well.

Thanks,

Joe

jswenson

Hi Again,

Engineering has made the dm_crypto_manage_lockbox tool available in the Developer Edition announcement page.

This is placed under ‘Post Update’ section at the end of the blog post.

https://community.emc.com/community/edn/documentum/blog/2015/11/21/documentum-72-developer-edition

Here is a direct link to the tool download page:

Also, engineering has informed me that they won't be providing patched builds for the Developer Edition.releases.

So the other minor issues will have to be addressed by the users.

I am curious about the issue with DQL not being interpreted correctly by postgreSQL.

If you have specific examples or DQL that is failing which impacts the usability of the Developer Edition releases I think engineering should be made aware of this.

Thanks,

Joe

Camille3DS

Thank you.

I have an ultimate question : my VM is now working and I'm installing DFCs on an another host, but I can't find anywhere in the README.txt the "dm_bof_registry" password. Can you help me ?

I have an error when trying with password "password" :

"[DFC_DOCBROKER_REQUEST_FAILED] Request to Docbroker "demo-server:1489" failed"

(my hosts file has the demo-server IP and the ping command works).

Thanks !

Camille3DS

Ok , my bad, my hosts file wasn't good (I did add the line "x.x.x.x demo-server" but you also have to delete the "demo-server" name on the lines of localhost and 127.0.0.1), but I still have the problem of the "dm_bof_registry" password.

I do have now the error :

"Authentication failed for user dm_bof_registry with docbase MyRepo."

I already had this error trying to connect via iapi.

Thanks a lot

jswenson

I tried to get this dm_bof_registry password info from engineering, but they misunderstood my question.

Here is the text of a KB article: 426685:

Authentication failed for user with docbase <docbase_name>, getting [DM_SESSION_E_AUTH_FAIL]error:

Article Number 000426685

========================================================================================

Issue: Users not able to login or search via webtop, getting [DM_SESSION_E_AUTH_FAIL]error:"Authentication failed for user dm_bof_registry with docbase <docbase_name>. error.

This behavior is normally seen in D7 environment where users use Webtop 6.7 SP2 with D7 as there is no Webtop for D7 as of now, and get below error:

[DM_SESSION_E_AUTH_FAIL]error:"Authentication failed for user dm_bof_registry with docbase <docbase_name>. error.

Cause: dm_bof_registry password encryption.

Change: Need to re-encrypt the dm_bof_registry password and have to replace with the existing dm_bof_registry password in dfc.properties file.

Resolution Need to re-encrypt the dm_bof_registry password and have to replace with the existing password by below process:

Check for "dfc.jar" and "aspectjrt.ja" under "C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\da\WEB-INF\lib\" (if not manually copy the file from the downloaded DA.zip that is under "da\WEB-INF\lib" to "C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\da\WEB-INF\lib")

Execute the below via command prompt:

"C:\Program Files\Java\jre6\bin"\java -cp "C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\da\WEB-INF\lib\dfc.jar;C:\Program Files\Apache Software Foundation\Tomcat 6.0\webapps\da\WEB-INF\lib\aspectjrt.jar" com.documentum.fc.tools.RegistryPasswordUtils <PASSWORD>

You will get an encrypted password.

Copy the encrypted password and paste it in the dfc.properties.

Clear the Application Server cache, restart application server and the issue should be resolved.

========================================================================================

Cheers,

Joe

vjayk

How to update the java version for documentum content server