{"id":35642,"date":"2024-11-06T20:48:00","date_gmt":"2024-11-06T19:48:00","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/?p=35642"},"modified":"2024-11-06T17:25:31","modified_gmt":"2024-11-06T16:25:31","slug":"documentum-impact-of-java-17-and-java_tool_options","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/","title":{"rendered":"Documentum &#8211; Impact of Java 17 and JAVA_TOOL_OPTIONS"},"content":{"rendered":"\n<p>If you are familiar with Java, you probably know that starting with JDK 9, you may need to add some &#8220;<em>&#8211;add-exports<\/em>&#8221; or &#8220;<em>&#8211;add-opens<\/em>&#8221; parameters to the JAVA_TOOL_OPTIONS. This is the <a href=\"https:\/\/docs.oracle.com\/en\/java\/javase\/17\/migrate\/migrating-jdk-8-later-jdk-releases.html#GUID-7BB28E4D-99B3-4078-BDC4-FC24180CE82B\" target=\"_blank\" rel=\"noreferrer noopener\">Strong Encapsulation<\/a>, which started with JDK 9 and was only displaying warnings until JDK 16. With Java 17, however, it is now fully in effect so you may start seeing some issues if you don&#8217;t have the correct configuration.<\/p>\n\n\n\n<p>If I&#8217;m not mistaken, Documentum 23.2 introduced support for JDK 17 for the runtime. Then Documentum 23.4 added full support for JDK 17 and it seems that binaries are now being compiled with this version as well. Therefore, I thought it would be interesting to write a blog about the consequences of not defining JAVA_TOOL_OPTIONS when trying to install and run Documentum.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-i-binaries\">I. Binaries<\/h3>\n\n\n\n<p>Installing the Documentum binaries without first defining the JAVA_TOOL_OPTIONS doesn&#8217;t generate any errors or warnings. Even if you install with DEBUG logs enabled, nothing strange pops up in the logs:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; highlight: [4,14,22,23,24,28,29,30,31]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 ~]$ cd $INSTALL_DIR\/CS23.4\/logs\n&#x5B;dmadmin@cs-0 logs]$\n&#x5B;dmadmin@cs-0 logs]$ ls\nDocumentum_Server_Install_02_20_2024_10_53_30.log  install.log\n&#x5B;dmadmin@cs-0 logs]$\n&#x5B;dmadmin@cs-0 logs]$ grep -iE &quot;error|warn&quot; install.log\n&#x5B;dmadmin@cs-0 logs]$\n&#x5B;dmadmin@cs-0 logs]$ grep -A8 ^Summary Documentum_Server_Install_*.log\nSummary\n-------\n\nInstallation: Successful.\n\n42 Successes\n0 Warnings\n0 NonFatalErrors\n0 FatalErrors\n&#x5B;dmadmin@cs-0 logs]$\n&#x5B;dmadmin@cs-0 logs]$ grep -C2 &quot;DFC&quot; Documentum_Server_Install_*.log\n                          Status: SUCCESSFUL\n\nInstall Merge Module:     $INSTALL_DIR\/CS23.4\/Documentum_DFC_Environment.iam.zip\n                          Status: SUCCESSFUL\n                          Additional Notes: NOTE - Installing: Documentum_DFC_Environment.iam.zip\n\nCustom Action:            com.documentum.install.shared.installanywhere.plugins.DiWAExtractArchive\n---\necho &quot;Initiating Merge Module installation...&quot;\ncd &quot;\/tmp\/417199.tmp&quot;\n&quot;$JAVA_HOME\/bin\/java&quot; -cp &#039;$INSTALL_DIR\/CS23.4\/Documentum_DFC_Environment.iam.zip&#039;:&#039;\/tmp\/install.dir.3033\/InstallerData&#039;:&#039;\/tmp\/install.dir.3033\/InstallerData\/installer.zip&#039; -noverify -Xms262114000 -Xmx262114000 com.zerog.lax.LAX &quot;\/tmp\/417199.tmp\/mergeModuleLax1.lax&quot; lax_no_temp_file\necho &quot;...Install Merge Module script complete.&quot;\n##### SCRIPT END ############\n&#x5B;dmadmin@cs-0 logs]$\n<\/pre><\/div>\n\n\n<p>However, there are only 2 log files. There should be 4, because the Documentum Server binaries installer triggers the DFC installation through another Java process (as shown above) and that will (should) generate 2 more log files. But if this is your first time installing Documentum or this particular version, you might think that OpenText changed their process a bit and now there are only 2 logs, it doesn&#8217;t really matter as long as there are no errors\u2026<\/p>\n\n\n\n<p>So, you might think that there is no impact, right? Well, try again! From what I could see, the content of $DM_HOME appears to be the expected one. It contains the Documentum binaries, the &#8220;<em>java.ini<\/em>&#8221; files, etc\u2026 Same thing for $DOCUMENTUM\/dba, it looks good. However, if you look directly under $DOCUMENTUM, there is one thing that you might find strange, and that is the fact that there is no DFC, even though the installation is done. This is because the JAVA_TOOL_OPTIONS was not defined before running the installer and unfortunately, the java subprocess silently failed\u2026<\/p>\n\n\n\n<p>If you look at the &#8220;<em>java.ini<\/em>&#8221; file, it contains DFC references, but the files\/folders are not there:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; highlight: [4,6,17,20]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 logs]$ cd $DOCUMENTUM\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ grep &#039;^java&#039; $DM_HOME\/bin\/java.ini\njava_library_path = $DOCUMENTUM\/java64\/JAVA_LINK\/lib\/server\/libjvm.so\njava_version = 1.7\njava_classpath = $DOCUMENTUM\/product\/23.4\/dctm-server.jar:$DOCUMENTUM\/dctm.jar:$DOCUMENTUM\/config:$DOCUMENTUM\/java64\/JAVA_LINK\/lib\njava_alias_file = $DOCUMENTUM\/dfc\/dfc.aliases\njava_options = &quot;-Xms32M -Xmx64M -XX:+UseSerialGC -Djava.net.preferIPv4Stack=true -Djava.security.egd=file:\/\/\/dev\/.\/urandom&quot;\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ ls -l $DOCUMENTUM\/java64\/JAVA_LINK\/lib\/server\/libjvm.so\n-rw-r--r-- 1 dmadmin dmadmin 24022392 Jul 18  2023 $DOCUMENTUM\/java64\/JAVA_LINK\/lib\/server\/libjvm.so\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ ls -l $DOCUMENTUM\/product\/23.4\/dctm-server.jar\n-rwxr-xr-x 1 dmadmin dmadmin 291 Feb 20 10:53 $DOCUMENTUM\/product\/23.4\/dctm-server.jar\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ ls -l $DOCUMENTUM\/dctm.jar\nls: cannot access &#039;$DOCUMENTUM\/dctm.jar&#039;: No such file or directory\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ ls -l $DOCUMENTUM\/config\nls: cannot access &#039;$DOCUMENTUM\/config&#039;: No such file or directory\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>If you have a look at the &#8220;<em>~\/.com.zerog.registry.xml<\/em>&#8221; file created by the installer, you will see the Documentum Server product but no DFC. Same thing for the &#8220;<em>DctmRegistry.xml<\/em>&#8221; file created by the installer, it contains the Documentum and Java versions but not for the DFC. Please do your best to ignore the WildFly section, Documentum replaced WildFly with Tomcat since its version 21.2, but the file isn&#8217;t yet fixed:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: xml; highlight: [37,38]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 server]$ cat ~\/.com.zerog.registry.xml\n&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;\n&lt;registry install_date=&quot;2024-02-20 10:53:35&quot; version=&quot;1.1&quot; last_modified=&quot;2024-02-20 10:53:47&quot;&gt;\n\t&lt;products&gt;\n\t\t&lt;product name=&quot;Documentum Server&quot; id=&quot;0bc3e8a8-1f03-11b2-b1a7-9350af98073e&quot; upgrade_id=&quot;0bc3e8a8-1f03-11b2-b1a7-9350af98073e&quot; version=&quot;23.4.0.143&quot; copyright=&quot;2011&quot; info_url=&quot;&quot; support_url=&quot;&quot; location=&quot;$DOCUMENTUM&quot; last_modified=&quot;2024-02-20 10:53:43&quot;&gt;\n\t\t&lt;!&#x5B;CDATA&#x5B;]]&gt;\n\t\t\t&lt;vendor name=&quot;Documentum, a division of OpenText&quot; id=&quot;0bc3e8a7-1f03-11b2-b1a7-9350af98073e&quot; home_page=&quot;http:\/\/www.documentum.com&quot; email=&quot;&quot;\/&gt;\n\t\t\t&lt;feature short_name=&quot;ContentServer&quot; name=&quot;Documentum Server&quot; last_modified=&quot;2024-02-20 10:53:43&quot;&gt;\n\t\t\t&lt;!&#x5B;CDATA&#x5B;This installs the application feature.]]&gt;\n\t\t\t\t&lt;component ref_id=&quot;0bc3e943-1f03-11b2-b1dd-9350af98073e&quot; version=&quot;1.0.0.0&quot; location=&quot;&quot;\/&gt;\n\t\t\t\t&lt;component ref_id=&quot;83d6f5b2-1f03-11b2-880c-f48d0aec226e&quot; version=&quot;1.0.0.0&quot; location=&quot;&quot;\/&gt;\n\t\t\t\t&lt;component ref_id=&quot;0bc3e944-1f03-11b2-b1da-9350af98073e&quot; version=&quot;1.0.0.0&quot; location=&quot;$DOCUMENTUM\/uninstall\/server\/Uninstall&quot;\/&gt;\n\t\t\t&lt;\/feature&gt;\n\t\t\t&lt;feature short_name=&quot;Task Ch&quot; name=&quot;Task Chaining Framework&quot; last_modified=&quot;2024-02-20 10:53:43&quot;&gt;\n\t\t\t&lt;!&#x5B;CDATA&#x5B;&lt;Enter Product Feature description here -- do not forget to assign this Feature to desired Install Sets&gt;]]&gt;\n\t\t\t\t&lt;component ref_id=&quot;83d0837d-1f03-11b2-84f5-f48d0aec226e&quot; version=&quot;1.0.0.0&quot; location=&quot;&quot;\/&gt;\n\t\t\t\t&lt;component ref_id=&quot;83d6f5b2-1f03-11b2-880c-f48d0aec226e&quot; version=&quot;1.0.0.0&quot; location=&quot;&quot;\/&gt;\n\t\t\t\t&lt;component ref_id=&quot;0bc3e944-1f03-11b2-b1da-9350af98073e&quot; version=&quot;1.0.0.0&quot; location=&quot;$DOCUMENTUM\/uninstall\/server\/Uninstall&quot;\/&gt;\n\t\t\t&lt;\/feature&gt;\n\t\t&lt;\/product&gt;\n\t&lt;\/products&gt;\n\t&lt;components&gt;\n\t\t&lt;component id=&quot;83d0837d-1f03-11b2-84f5-f48d0aec226e&quot; version=&quot;1.0.0.0&quot; name=&quot;AG- Task Ch&quot; location=&quot;&quot; vendor=&quot;Documentum, a division of OpenText&quot;\/&gt;\n\t\t&lt;component id=&quot;83d6f5b2-1f03-11b2-880c-f48d0aec226e&quot; version=&quot;1.0.0.0&quot; name=&quot;AG- ContentServer, Task Ch&quot; location=&quot;&quot; vendor=&quot;Documentum, a division of OpenText&quot;\/&gt;\n\t\t&lt;component id=&quot;0bc3e943-1f03-11b2-b1dd-9350af98073e&quot; version=&quot;1.0.0.0&quot; name=&quot;InstallAnywhere VM Component&quot; location=&quot;&quot; vendor=&quot;Documentum, a division of OpenText&quot;\/&gt;\n\t\t&lt;component id=&quot;0bc3e944-1f03-11b2-b1da-9350af98073e&quot; version=&quot;1.0.0.0&quot; name=&quot;InstallAnywhere Uninstall Component&quot; location=&quot;$DOCUMENTUM\/uninstall\/server\/Uninstall&quot; vendor=&quot;Documentum, a division of OpenText&quot;\/&gt;\n\t&lt;\/components&gt;\n&lt;\/registry&gt;\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ cat DctmRegistry.xml\n&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot; standalone=&quot;no&quot;?&gt;\n&lt;registry&gt;\n    &lt;product id=&quot;CS&quot; name=&quot;Documentum Server&quot;&gt;\n        &lt;release base-version=&quot;23.4.0000.0143&quot; install-date=&quot;Tue Feb 20 10:53:48 UTC 2024&quot;&gt;\n            &lt;components&gt;\n                &lt;component&gt;\n                    &lt;name&gt;dfc&lt;\/name&gt;\n                    &lt;version\/&gt;\n                &lt;\/component&gt;\n                &lt;component&gt;\n                    &lt;name&gt;jdk&lt;\/name&gt;\n                    &lt;version&gt;17.0.8&lt;\/version&gt;\n                &lt;\/component&gt;\n                &lt;component&gt;\n                    &lt;name&gt;wildfly&lt;\/name&gt;\n                    &lt;version&gt;11.0.0&lt;\/version&gt;\n                &lt;\/component&gt;\n            &lt;\/components&gt;\n        &lt;\/release&gt;\n    &lt;\/product&gt;\n&lt;\/registry&gt;\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>Without JAVA_TOOL_OPTIONS, the DFC doesn&#8217;t get installed with the Documentum binaries but the rest looks good. If you want, you can manually install the DFC (as you would do on a standalone client, even without the options) and it would work. So, I&#8217;m not sure why it&#8217;s not handled properly by OpenText, but I guess that&#8217;s another small bug \/ improvement to be done.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-ii-connection-broker\">II. Connection Broker<\/h3>\n\n\n\n<p>Let&#8217;s assume you didn&#8217;t see that there was no DFC present, and you proceeded with installing a Connection Broker without the JAVA_TOOL_OPTIONS defined. In this case, the installation of the Connection Broker looks fine and there are no errors in the generated logs. Once it has been installed, you can see the running process and the start\/stop scripts have been created, so it looks good. You could then proceed with a Repository installation, and it seems that not defining the JAVA_TOOL_OPTIONS (or not having a DFC present) isn&#8217;t a problem to install a Connection Broker.<\/p>\n\n\n\n<p>However, if you try to connect to it with the dmqdocbroker utility, or through the iAPI command, you will detect the missing DFC as it will fail and will generate a &#8220;<em>dmcl_err_PID#pid#_#timestamp#.txt<\/em>&#8221; log file:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; highlight: [6,7,14]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 server]$ source $DM_HOME\/bin\/dm_set_server_env.sh\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ ls dmcl_err_*\nls: cannot access &#039;dmcl_err_*&#039;: No such file or directory\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ iapi\nIAPI failed to run because of a failed status returned from dmAPIInit()\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ ls dmcl_err_*\ndmcl_err_PID3836_02-20-24_11.01.22.txt\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ cat dmcl_err_PID*.txt\nCan&#039;t find  class &#039;com\/documentum\/dmcl\/impl\/DmclApiNativeAdapter&#039;\n\nJava VM created with library $DOCUMENTUM\/java64\/JAVA_LINK\/lib\/server\/libjvm.so\njava.class.path for Java VM is $DOCUMENTUM\/product\/23.4\/dctm-server.jar:$DOCUMENTUM\/dctm.jar:$DOCUMENTUM\/config:$DOCUMENTUM\/java64\/JAVA_LINK\/lib\n\njava.lang.NoClassDefFoundError: com\/documentum\/dmcl\/impl\/DmclApiNativeAdapter\n\nJava VM created with library $DOCUMENTUM\/java64\/JAVA_LINK\/lib\/server\/libjvm.so\njava.class.path for Java VM is $DOCUMENTUM\/product\/23.4\/dctm-server.jar:$DOCUMENTUM\/dctm.jar:$DOCUMENTUM\/config:$DOCUMENTUM\/java64\/JAVA_LINK\/lib\n\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>If you read between the lines, it should be pretty straightforward as you can see missing classes related to DMCL (Documentum Client Library) that the DFC relies on.<\/p>\n\n\n\n<p>In conclusion, there is no problem installing a Connection Broker without defining the JAVA_TOOL_OPTIONS, but connecting to it will obviously require a DFC. Whether you install the DFC manually (standalone) or via the Documentum Server binaries (bundled) doesn&#8217;t make any difference, it will work either way.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-iii-repository\">III. Repository<\/h3>\n\n\n\n<p>Let&#8217;s assume you still didn&#8217;t see the missing DFC and you just proceeded so far based on the error-free logs, still without any JAVA_TOOL_OPTIONS definitions. Under such circumstances, the Repository installation will quickly fail, because it starts the Repository processes at the beginning. However, the Repository wouldn&#8217;t be able to register itself with the Connection Broker since there is no DFC. That&#8217;s most probably where you would try to connect to the Repository or the Connection Broker yourself, and see the errors I mentioned just above.<\/p>\n\n\n\n<p>If you manually installed the DFC, it would go a little further as the Repository would be able to register to the Connection Broker. In such cases, it would still fail, but a bit later, during the CAS section of the installation:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; highlight: [7,8]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 server]$ cat $DM_HOME\/install\/logs\/install.log\n...\n11:08:25,549  INFO &#x5B;main] com.documentum.install.server.installanywhere.actions.DiWAServerVerifyDataIni - The installer will verify data_dictionary.ini for the repository.\n11:08:25,561  INFO &#x5B;main] com.documentum.install.server.installanywhere.actions.DiWAServerProcessingScripts - The installer will execute the : Repository HeadStart script.\n11:08:44,233  INFO &#x5B;main] com.documentum.install.server.installanywhere.actions.DiWAServerProcessingScripts - The installer will execute the : Updating format objects script.\n11:08:58,234  INFO &#x5B;main] com.documentum.install.server.installanywhere.actions.DiWAServerProcessingScripts - The installer will execute the : Creating Electronic Signature Objects script.\n11:09:06,970 ERROR &#x5B;main] com.documentum.install.server.installanywhere.actions.DiWAServerProcessingScripts - The installer failed to execute : Creating Electronic Signature Objects. Please check output file $DOCUMENTUM\/dba\/config\/gr_dbi\/dm_cas_install.out for more information.\ncom.documentum.install.shared.common.error.DiException: The installer failed to execute : Creating Electronic Signature Objects. Please check output file $DOCUMENTUM\/dba\/config\/gr_dbi\/dm_cas_install.out for more information.\n...\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>Let&#8217;s follow the trail and look at the CAS logs then:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; highlight: [9,10,11,12,13,14]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 server]$ cat $DOCUMENTUM\/dba\/config\/gr_dbi\/dm_cas_install.out\nStart running dm_CAS_install.ebs script on docbase gr_dbi.gr_dbi\nCreate method esign_pdf\nCreate type dm_esign_template\nCreate Integration cabinet...\nCreate \/Integration\/Esignature folder...\nCreate \/Integration\/Esignature\/Templates folder folder...\nImport Default Signature Page Template\nSetting a_storage_type for dm_esign_template object to filestore_01\njava.lang.RuntimeException: Failed to get calling context\n\njava.lang.RuntimeException: Static initialization for determining class call context failed. See DFC log for more details\n\nFailed to import Default Signature Page Template\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>Is that better? Not really\u2026 Let&#8217;s continue and take a look at the DFC logs:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; highlight: [3]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 server]$ cat $DOCUMENTUM\/logs\/log4j.log\n2024-02-20 11:09:06,924 UTC ERROR &#x5B;com.documentum.fc.client.security.impl.util.ClassContextFetcher] (main) Static initialization for determining class call context failed\njava.lang.reflect.InaccessibleObjectException: Unable to make protected native java.lang.Class&#x5B;] java.lang.SecurityManager.getClassContext() accessible: module java.base does not &quot;opens java.lang&quot; to unnamed module @64b8f8f4\n        at java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:354) ~&#x5B;?:?]\n        at java.lang.reflect.AccessibleObject.checkCanSetAccessible(AccessibleObject.java:297) ~&#x5B;?:?]\n        at java.lang.reflect.Method.checkCanSetAccessible(Method.java:199) ~&#x5B;?:?]\n        at java.lang.reflect.Method.setAccessible(Method.java:193) ~&#x5B;?:?]\n        at com.documentum.fc.client.security.impl.util.ClassContextFetcher.&lt;clinit&gt;(ClassContextFetcher.java:63) ~&#x5B;dfc.jar:?]\n        at com.documentum.fc.client.DfTypedObject.getCallStackStartingAtTopOfStack(DfTypedObject.java:1075) ~&#x5B;dfc.jar:?]\n        at com.documentum.fc.client.DfTypedObject.isCalledByTrustedCaller(DfTypedObject.java:1042) ~&#x5B;dfc.jar:?]\n        at com.documentum.fc.client.DfTypedObject.verifyInternalAttributeAccessRights(DfTypedObject.java:1016) ~&#x5B;dfc.jar:?]\n        ...\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>Finally, some useful details! The CAS installation section of the Repository failed because of some inaccessible objects \/ protected classes. It even tells you that it&#8217;s about the &#8220;<em>java.base<\/em>&#8221; module that does not &#8220;<em>opens java.lang<\/em>&#8220;\u2026 If you have been using Java in the last 7 years, you should know what this means and what to do.<\/p>\n\n\n\n<p>If, instead of running the Repository installer, you tried to ping the Connection Broker (after installing the DFC), you would have seen something very similar from the command line. It would be related to the same java.base module but this time, it does not &#8220;<em>export sun.security.x509<\/em>&#8220;:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; highlight: [3,9,19]; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 server]$ dmqdocbroker -t `hostname -f` -p 1489 -c ping\n2024-02-20 11:10:29,630 UTC ERROR &#x5B;com.documentum.fc.client.security.impl.IdentityManager] (main) &#x5B;DFC_SECURITY_IDENTITY_INIT] no identity initialization or incomplete identity initialization\njava.lang.IllegalStateException: Error creating sun.security.x509.X509CertInfo object\n\tat com.documentum.fc.client.security.internal.ReflectionUtil.createExact(ReflectionUtil.java:52) ~&#x5B;dfc.jar:?]\n\tat com.documentum.fc.client.security.internal.CreateIdentityCredential.createSelfSignedIdentity(CreateIdentityCredential.java:247) ~&#x5B;dfc.jar:?]\n\tat com.documentum.fc.client.security.internal.CreateIdentityCredential.&lt;init&gt;(CreateIdentityCredential.java:94) ~&#x5B;dfc.jar:?]\n\tat com.documentum.fc.client.security.impl.InitializeKeystoreForDfc.execute(InitializeKeystoreForDfc.java:52) ~&#x5B;dfc.jar:?]\n\t...\nCaused by: java.lang.IllegalAccessException: class com.documentum.fc.client.security.internal.ReflectionUtil cannot access class sun.security.x509.X509CertInfo (in module java.base) because module java.base does not export sun.security.x509 to unnamed module @64b8f8f4\n\tat jdk.internal.reflect.Reflection.newIllegalAccessException(Reflection.java:392) ~&#x5B;?:?]\n\tat java.lang.reflect.AccessibleObject.checkAccess(AccessibleObject.java:674) ~&#x5B;?:?]\n\tat java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:489) ~&#x5B;?:?]\n\tat java.lang.reflect.Constructor.newInstance(Constructor.java:480) ~&#x5B;?:?]\n\tat com.documentum.fc.client.security.internal.ReflectionUtil.createExact(ReflectionUtil.java:46) ~&#x5B;dfc.jar:?]\n\t... 14 more\ndmqdocbroker: A DocBroker Query Tool\ndmqdocbroker: Documentum Client Library Version: 23.4.0000.0180\nUsing specified port: 1489\nSuccessful reply from docbroker at host (cs-0) on port(1490) running software version (23.4.0000.0143  Linux64).\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>It responds correctly (last line), somehow, but you still get a nice exception. On the other hand, if you define the JAVA_TOOL_OPTIONS, then there is no exception anymore:<\/p>\n\n\n<div class=\"wp-block-syntaxhighlighter-code \"><pre class=\"brush: bash; title: ; notranslate\" title=\"\">\n&#x5B;dmadmin@cs-0 server]$ export JAVA_TOOL_OPTIONS=&quot;-Djdk.util.zip.disableZip64ExtraFieldValidation=true -Djava.locale.providers=COMPAT,SPI --add-exports=java.base\/sun.security.provider=ALL-UNNAMED --add-exports=java.base\/sun.security.pkcs=ALL-UNNAMED --add-exports=java.base\/sun.security.x509=ALL-UNNAMED --add-exports=java.base\/sun.security.util=ALL-UNNAMED --add-exports=java.base\/sun.security.tools.keytool=ALL-UNNAMED --add-opens=java.base\/java.lang=ALL-UNNAMED --add-opens=java.base\/java.lang.invoke=ALL-UNNAMED&quot;\n&#x5B;dmadmin@cs-0 server]$\n&#x5B;dmadmin@cs-0 server]$ dmqdocbroker -t `hostname -f` -p 1489 -c ping\nPicked up JAVA_TOOL_OPTIONS: -Djdk.util.zip.disableZip64ExtraFieldValidation=true -Djava.locale.providers=COMPAT,SPI --add-exports=java.base\/sun.security.provider=ALL-UNNAMED --add-exports=java.base\/sun.security.pkcs=ALL-UNNAMED --add-exports=java.base\/sun.security.x509=ALL-UNNAMED --add-exports=java.base\/sun.security.util=ALL-UNNAMED --add-exports=java.base\/sun.security.tools.keytool=ALL-UNNAMED --add-opens=java.base\/java.lang=ALL-UNNAMED --add-opens=java.base\/java.lang.invoke=ALL-UNNAMED\ndmqdocbroker: A DocBroker Query Tool\ndmqdocbroker: Documentum Client Library Version: 23.4.0000.0180\nUsing specified port: 1489\nSuccessful reply from docbroker at host (cs-0) on port(1490) running software version (23.4.0000.0143  Linux64).\n&#x5B;dmadmin@cs-0 server]$\n<\/pre><\/div>\n\n\n<p>In summary, defining the JAVA_TOOL_OPTIONS is required for both the Documentum Server binaries (or more specifically the subprocess starting the DFC part) and the Repository installation. It also helps at runtime with utilities such as dmqdocbroker\/iapi\/idql. The documentation tells you what you need to do, but what I find interesting is that OpenText already includes these options in several places, such as the Repository installer (Server_Configuration_Program.bin), the Remote Repository installer (cfsConfigurationProgram.bin), the ComposerHeadless DAR deployer (dardeployer.ini), the ComposerHeadless java.ini file, and the Tomcat startup script\u2026 So basically, OpenText has already done some work, but it&#8217;s clearly not enough to have a fully functional setup. So why\u2026? I guess we might see some changes related to this in the future, so let&#8217;s see!<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>If you are familiar with Java, you probably know that starting with JDK 9, you may need to add some &#8220;&#8211;add-exports&#8221; or &#8220;&#8211;add-opens&#8221; parameters to the JAVA_TOOL_OPTIONS. This is the Strong Encapsulation, which started with JDK 9 and was only displaying warnings until JDK 16. With Java 17, however, it is now fully in effect [&hellip;]<\/p>\n","protected":false},"author":20,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[197,525],"tags":[567,1176,2609,214,1627,1760],"type_dbi":[],"class_list":["post-35642","post","type-post","status-publish","format-standard","hentry","category-application-integration-middleware","category-enterprise-content-management","tag-dfc","tag-docbroker","tag-documentum-2","tag-java","tag-jdk","tag-repository"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.6) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Documentum - Impact of Java 17 and JAVA_TOOL_OPTIONS - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Documentum - Impact of Java 17 and JAVA_TOOL_OPTIONS\" \/>\n<meta property=\"og:description\" content=\"If you are familiar with Java, you probably know that starting with JDK 9, you may need to add some &#8220;&#8211;add-exports&#8221; or &#8220;&#8211;add-opens&#8221; parameters to the JAVA_TOOL_OPTIONS. This is the Strong Encapsulation, which started with JDK 9 and was only displaying warnings until JDK 16. With Java 17, however, it is now fully in effect [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2024-11-06T19:48:00+00:00\" \/>\n<meta name=\"author\" content=\"Morgan Patou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@MorganPatou\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Morgan Patou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/\"},\"author\":{\"name\":\"Morgan Patou\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"headline\":\"Documentum &#8211; Impact of Java 17 and JAVA_TOOL_OPTIONS\",\"datePublished\":\"2024-11-06T19:48:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/\"},\"wordCount\":1165,\"commentCount\":0,\"keywords\":[\"dfc\",\"docbroker\",\"Documentum\",\"Java\",\"jdk\",\"repository\"],\"articleSection\":[\"Application integration &amp; Middleware\",\"Enterprise content management\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/\",\"name\":\"Documentum - Impact of Java 17 and JAVA_TOOL_OPTIONS - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"datePublished\":\"2024-11-06T19:48:00+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-impact-of-java-17-and-java_tool_options\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Documentum &#8211; Impact of Java 17 and JAVA_TOOL_OPTIONS\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\",\"name\":\"Morgan Patou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"caption\":\"Morgan Patou\"},\"description\":\"Morgan Patou has over 15 years of experience in Digitalization &amp; Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex &amp; critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache HTTPD\\\/Tomcat, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\\\/Banking, and the Pharmaceutical industry.\",\"sameAs\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/morgan-patou\\\/\",\"https:\\\/\\\/x.com\\\/MorganPatou\"],\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/morgan-patou\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Documentum - Impact of Java 17 and JAVA_TOOL_OPTIONS - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/","og_locale":"en_US","og_type":"article","og_title":"Documentum - Impact of Java 17 and JAVA_TOOL_OPTIONS","og_description":"If you are familiar with Java, you probably know that starting with JDK 9, you may need to add some &#8220;&#8211;add-exports&#8221; or &#8220;&#8211;add-opens&#8221; parameters to the JAVA_TOOL_OPTIONS. This is the Strong Encapsulation, which started with JDK 9 and was only displaying warnings until JDK 16. With Java 17, however, it is now fully in effect [&hellip;]","og_url":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/","og_site_name":"dbi Blog","article_published_time":"2024-11-06T19:48:00+00:00","author":"Morgan Patou","twitter_card":"summary_large_image","twitter_creator":"@MorganPatou","twitter_misc":{"Written by":"Morgan Patou","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/"},"author":{"name":"Morgan Patou","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"headline":"Documentum &#8211; Impact of Java 17 and JAVA_TOOL_OPTIONS","datePublished":"2024-11-06T19:48:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/"},"wordCount":1165,"commentCount":0,"keywords":["dfc","docbroker","Documentum","Java","jdk","repository"],"articleSection":["Application integration &amp; Middleware","Enterprise content management"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/","url":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/","name":"Documentum - Impact of Java 17 and JAVA_TOOL_OPTIONS - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2024-11-06T19:48:00+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/documentum-impact-of-java-17-and-java_tool_options\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Documentum &#8211; Impact of Java 17 and JAVA_TOOL_OPTIONS"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8","name":"Morgan Patou","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","caption":"Morgan Patou"},"description":"Morgan Patou has over 15 years of experience in Digitalization &amp; Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex &amp; critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache HTTPD\/Tomcat, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\/Banking, and the Pharmaceutical industry.","sameAs":["https:\/\/www.dbi-services.com\/blog\/author\/morgan-patou\/","https:\/\/x.com\/MorganPatou"],"url":"https:\/\/www.dbi-services.com\/blog\/author\/morgan-patou\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/35642","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=35642"}],"version-history":[{"count":3,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/35642\/revisions"}],"predecessor-version":[{"id":35645,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/35642\/revisions\/35645"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=35642"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=35642"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=35642"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=35642"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}