\n[dmadmin@cs-0 ~]$ # Definition of parameters, to fill the file\n[dmadmin@cs-0 ~]$ otdsauth_properties="$DM_HOME\/OTDSAuthLicenseHttpServerBin\/config\/otdsauth.properties"\n[dmadmin@cs-0 ~]$ otds_base_url="https:\/\/otds.dns.com\/otdsws"\n[dmadmin@cs-0 ~]$ install_owner="dmadmin"\n[dmadmin@cs-0 ~]$ repo="dbi01"\n[dmadmin@cs-0 ~]$ otds_resource_id="12345678-1234-5678-9abc-123456789abc"\n[dmadmin@cs-0 ~]$ otds_resource_key="AbCd1234efGH5678IJkl9=="\n[dmadmin@cs-0 ~]$\n[dmadmin@cs-0 ~]$ # First, to make sure the file is in "unix" file format. It's often provided by OT as DOS, even on linux, which is a problem...\n[dmadmin@cs-0 ~]$ awk '{ sub("\\r$", ""); print }' ${otdsauth_properties} > temp.properties\n[dmadmin@cs-0 ~]$ mv temp.properties ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ chmod 660 ${otdsauth_properties}\n[dmadmin@cs-0 ~]$\n[dmadmin@cs-0 ~]$ # Configuration of the properties file\n[dmadmin@cs-0 ~]$ sed -i "s,otds_rest_credential_url=.*,otds_rest_credential_url=${otds_base_url}\/rest\/authentication\/credentials," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,otds_rest_ticket_url=.*,otds_rest_ticket_url=${otds_base_url}\/rest\/authentication\/resource\/validation," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,otds_rest_oauth2_url=.*,otds_rest_oauth2_url=${otds_base_url}\/oauth2\/token," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,synced_user_login_name=.*,synced_user_login_name=sAMAccountName," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,auto_cert_refresh=.*,auto_cert_refresh=true," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,cert_jwks_url=.*,cert_jwks_url=${otds_base_url}\/oauth2\/jwks," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,admin_username=.*,admin_username=${install_owner}," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,.*_resource_id=.*,${repo}_resource_id=${otds_resource_id}," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$ sed -i "s,.*_secretKey=.*,${repo}_secretKey=${otds_resource_key}," ${otdsauth_properties}\n[dmadmin@cs-0 ~]$\n<\/pre><\/div>\n\n\n2. Repo – OTDS Authentication (turned auth+lic)<\/h2>\n\n\n\n With the new license requirement in conjunction with the fact that it is not handled by the JMS anymore, the URL to be configured in the Repository has been changed too. If you are upgrading your environment from a previous version, you will normally already have an “app_server_name<\/em><\/strong>” for “OTDSAuthentication<\/em><\/strong>“, with an URL of “http(s):\/\/hostname:port\/OTDSAuthentication\/servlet\/authenticate<\/em><\/strong>” (where hostname<\/strong> is either localhost or your local hostname \/\/ port<\/strong> is 9080 or 9082 for example). With the new version of Documentum, this will need to be changed to “http:\/\/localhost:port\/otdsauthlicense<\/strong>” (where port is 8400 by default).<\/p>\n\n\n\n# Example of commands to add a new entry for "OTDSAuthentication" (if it already exists, you need to change the "append" to "set" the correct ID)\nAPI> retrieve,c,dm_server_config\nAPI> append,c,l,app_server_name\nSET> OTDSAuthentication\nAPI> append,c,l,app_server_uri\nSET> http:\/\/localhost:8400\/otdsauthlicense\nAPI> save,c,l\n<\/pre><\/div>\n\n\nNote:<\/span><\/strong> When I first saw that new standalone process through Java, I was a bit skeptical\u2026 The OTDS Authentication used to run through the JMS. That means that you could configured your Tomcat with all security and best practices and it would apply to the OTDS Authentication as well. With the new standalone process, it is only available through HTTP and it also only listens on localhost\/127.0.0.1<\/span>\u2026 I guess that means that you can forget about the failover across Documentum Servers if you have a High-Availability environment! The source code isn’t available so I don’t know if we could force it to HTTPS on another address with the help of Java Options, and the documentation doesn’t mention anything in that regard either (and I don’t want to de-compile the classes)\u2026 So not very good I would say. The only workaround would be to setup a front-end but that over-complicates things.<\/p>\n\n\n\n3. Status (#1)<\/h2>\n\n\n\n At that point in time, assuming that you have your OTDS Partition \/ Resource \/ Access Role and that you have a Documentum version < 24.4 (with the “old” URL configured in the “dm_server_config<\/em><\/strong>“), you should be able to log in with any OTDS account (and inline accounts as well, obviously).<\/p>\n\n\n\nHowever, for higher versions, such as our 25.4 environment, you should still not be able to log in to the Repository. Trying to do so with either an inline account or an OTDS-enabled account would both result in failure with this message:<\/p>\n\n\n
\n[dmadmin@cs-0 ~]$ # Definition of parameters, to test the log in\n[dmadmin@cs-0 ~]$ repo="dbi01"\n[dmadmin@cs-0 ~]$ inline_test_account="adm_morgan"\n[dmadmin@cs-0 ~]$\n[dmadmin@cs-0 ~]$ # Trying to log in to the Repository\n[dmadmin@cs-0 ~]$ iapi ${repo} -U${inline_test_account}\nPlease enter password for adm_morgan:\n\n\tOpenText Documentum iapi - Interactive API interface\n\tCopyright (c) 2025. OpenText Corporation\n\tAll rights reserved.\n\tClient Library Release 25.4.0000.0134\n\nConnecting to Server using docbase dbi01\n[DM_SESSION_E_AUTH_FAIL]error: "Authentication failed for user adm_morgan with docbase dbi01."\n\n[DM_LICENSE_E_NO_LICENSE_CONFIG]error: "Could not find dm_otds_license_config object."\n\nCould not connect\n[dmadmin@cs-0 ~]$\n<\/pre><\/div>\n\n\nTo be more precise, without any configuration on a 25.4 environment, you can log in in a few ways, fortunately, otherwise it would break Documentum. Some “exceptions” were put in place by OpenText and from what I could see, it appears that the current behavior is as follows (GR = Global Registry):<\/p>\n\n\n\n
\nLog in through iAPI \/ iDQL will only work with “dmadmin” and other default GR-linked accounts (dm_bof_registry \/ dmc_wdk_presets_owner \/ dmc_wdk_preferences_owner) in a GR Repository<\/li>\n\n\n\n Log in through iAPI \/ iDQL will only work with “dmadmin” in a non-GR Repository<\/li>\n\n\n\n Log in through DA will work with “dmadmin”<\/li>\n\n\n\n Log in to any other DFC Client will not work with any account<\/li>\n<\/ul>\n\n\n\n4. OTDS – License, inline partition and business admin<\/h2>\n\n\n\n So far, I talked about things that would mostly be setup\/available if you have a Documentum environment already using OTDS for its Authentication. Now, let’s proceed with the OTDS configuration related to the license management, with screenshots and example.<\/p>\n\n\n\n
4.1. Uploading a license key<\/h3>\n\n\n\n Let’s start with uploading the license key for Documentum into OTDS:<\/p>\n\n\n\n
\nLog in to “https:\/\/otds.dns.com\/otds-admin<\/em><\/strong>” with the “admin<\/em><\/strong>” account (=otadmin@otds.admin)<\/li>\n\n\n\nGo to “License Keys<\/em><\/strong>“<\/li>\n\n\n\nClick on “Add<\/em><\/strong>“<\/li>\n\n\n\nSet the “License Key Name<\/em><\/strong>” to “dctmlicense<\/em><\/strong>“<\/li>\n\n\n\nSet the “Resource ID<\/em><\/strong>” to the Repository Resource ID previously created<\/li>\n\n\n\nClick on “Next<\/em><\/strong>“<\/li>\n\n\n\nClick on “Get License File<\/em><\/strong>” and browse your local filesystem to find the needed license file (.lic)<\/li>\n\n\n\nClick on “Save<\/em><\/strong>“<\/li>\n<\/ul>\n\n\n\nYou should end up with something like this:<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t4.2. Creating a Partition for “inline” accounts<\/h3>\n\n\n\n Then, let’s create a new non-synchronized partition that will be used to store the Documentum inline accounts:<\/p>\n\n\n\n
\nGo to “Partitions<\/em><\/strong>“<\/li>\n\n\n\nClick on “Add<\/em><\/strong>” and then “New Non-synchronized User Partition<\/em><\/strong>“<\/li>\n\n\n\nSet the “Name<\/em><\/strong>” to “dctminline<\/em><\/strong>“<\/li>\n\n\n\nClick on “Save<\/em><\/strong>“<\/li>\n<\/ul>\n\n\n\nYou should end up with something like this (Note: “dbi<\/em><\/strong>” is a synchronized partition coming from a development LDAP that I created for this demo environment):<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t4.3. Allocating a license to a Partition<\/h3>\n\n\n\n Now, let’s allocate the license to that inline Partition (“dctminline<\/em><\/strong>“), so that later, when the users get added, they will be able to take a license from the pool to log in to the Repository. Please note that I specifically didn’t allocate the license to the LDAP Partition (“dbi<\/em><\/strong>“), to show the difference later on:<\/p>\n\n\n\n\nFor the Partition “dctminline<\/em><\/strong>“, click on “Actions<\/em><\/strong>” and then “Allocate to License<\/em><\/strong>“<\/li>\n\n\n\nSelect the correct license, if you have multiple. For my parameters, it should be “dctmlicense – dbi01<\/em><\/strong>“<\/li>\n\n\n\nSelect the correct counter, if you have multiple (like System Accounts \/ X2_Premium \/ \u2026)<\/li>\n\n\n\n Click on “Allocate to License<\/em><\/strong>“<\/li>\n<\/ul>\n\n\n\nYou should see a message saying that it was successfully allocated:<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t4.4. Creating a “Business Admin” account<\/h3>\n\n\n\n The next step in OTDS is to create what OpenText calls a “Business Admin<\/em><\/strong>” account. When someone tries to log in to Documentum or a Client Application, Documentum will use that account to contact OTDS to check whether there are enough licenses available and if the person trying to log in is allowed to do so (i.e. has a license allocated). We will configure that connection on Documentum side later, but for now, let’s create that Business Admin account:<\/p>\n\n\n\n\nFor the Partition “otds.admin<\/em><\/strong>“, click on “Actions<\/em><\/strong>” and then “View Members<\/em><\/strong>“<\/li>\n\n\n\nClick on “Add<\/em><\/strong>” and then “New User<\/em><\/strong>“<\/li>\n\n\n\nSet the “User Name<\/em><\/strong>” to “businessadmin<\/em><\/strong>“<\/li>\n\n\n\nClick on “Next<\/em><\/strong>“<\/li>\n\n\n\nSet the “Password Options<\/em><\/strong>” to “Do not require password change on reset<\/em><\/strong>” (dropdown)<\/li>\n\n\n\nSet the “Password Options<\/em><\/strong>” to “Password never expires<\/em><\/strong>” (checkbox)<\/li>\n\n\n\nSet the “Password<\/em><\/strong>” to XXX<\/em><\/strong> (remember that password, it will be used later)<\/li>\n\n\n\nSet the “Confirm Password<\/em><\/strong>” to XXX<\/em><\/strong> (re-enter here the account password)<\/li>\n\n\n\nClick on “Save<\/em><\/strong>“<\/li>\n<\/ul>\n\n\n\nYou should end-up with a new account in the “otds.admin<\/em><\/strong>” Partition (3rd for me, the default “admin<\/em><\/strong>” account + another one for the OTDS Resource for “dbi01<\/em><\/strong>” Repository):<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\t4.5. Granting permissions to the “Business Admin” account<\/h3>\n\n\n\n The last step is then to grant the necessary permission to the newly created Business Admin account, so it can check the license details:<\/p>\n\n\n\n
\nGo to “Users & Groups<\/em><\/strong>“<\/li>\n\n\n\nClick on “Groups<\/em><\/strong>“<\/li>\n\n\n\nSearch for the group named “otdsbusinessadmins<\/em><\/strong>” (there should be 1 result only)<\/li>\n\n\n\nFor the Group “otdsbusinessadmins<\/em><\/strong>“, click on “Actions<\/em><\/strong>” and then “Edit Membership<\/em><\/strong>“<\/li>\n\n\n\nClick on “Add Member<\/em><\/strong>“<\/li>\n\n\n\nSearch for the user named “businessadmin@otds.admin<\/em><\/strong>” (= user “businessadmin<\/em><\/strong>” created in “otds.admin<\/em><\/strong>” Partition)<\/li>\n\n\n\nSelect the checkbox for that account<\/li>\n\n\n\n Click on “Add Selected<\/em><\/strong>“<\/li>\n<\/ul>\n\n\n\nYou should see a message saying that it was successfully done:<\/p>\n\n\n\n\n\t\t\t\n\t\t\t\tThat completes the configuration on the OTDS Admin UI. There are quite a few manual steps to be done, but fortunately, you should (normally) only do that once. The documentation mention other steps about creating a Resource for the inline Partition but that’s only required in case you are going to create accounts inside OTDS and you expect them to be pushed to Documentum. In our case, since the inline accounts already exist in Documentum and we want to do the opposite, we don’t need a Resource for that. There are also other steps about creating roles and whatnot, but for the testing \/ initial setup that we are doing here, it’s not needed either.<\/p>\n\n\n\n
5. Repo – “dm_otds_license_config” object<\/h2>\n\n\n\n Now that OTDS is fully configured, the last step, as previously mentioned, is to tell Documentum which account it can use for license checks. This is done through the “dm_otds_license_config<\/em><\/strong>” object that you will need to create:<\/p>\n\n\n\n[dmadmin@cs-0 ~]$ # Definition of parameters, to create the license config object\n[dmadmin@cs-0 ~]$ otds_base_url="https:\/\/otds.dns.com\/otdsws"\n[dmadmin@cs-0 ~]$ install_owner="dmadmin"\n[dmadmin@cs-0 ~]$ repo="dbi01"\n[dmadmin@cs-0 ~]$ otds_license_name="dctmlicense"\n[dmadmin@cs-0 ~]$ otds_business_admin_username="businessadmin"\n[dmadmin@cs-0 ~]$\n[dmadmin@cs-0 ~]$ # Set the password in a secure way\n[dmadmin@cs-0 ~]$ read -s -p " --> Please enter the password here: " otds_business_admin_password\n --> Please enter the password here: XXX\n[dmadmin@cs-0 ~]$\n[dmadmin@cs-0 ~]$ # Creation of the license config object\n[dmadmin@cs-0 ~]$ iapi ${repo} -U${install_owner} -Pxxx << EOC\ncreate,c,dm_otds_license_config\nset,c,l,otds_url\n${otds_base_url}\/rest\nset,c,l,license_keyname\ndctmlicense\nset,c,l,business_admin_name\n${otds_business_admin_username}\nset,c,l,business_admin_password\n${otds_business_admin_password}\nsave,c,l\nreinit,c\napply,c,NULL,FLUSH_OTDS_CONFIG\nEOC\n\n\n\tOpenText Documentum iapi - Interactive API interface\n\tCopyright (c) 2025. OpenText Corporation\n\tAll rights reserved.\n\tClient Library Release 25.4.0000.0134\n\nConnecting to Server using docbase dbi01\n[DM_SESSION_I_SESSION_START]info: "Session 012345678000aa1b started for user dmadmin."\n\nConnected to OpenText Documentum Server running Release 25.4.0000.0143 Linux64.Oracle\nSession id is s0\nAPI> ...\n000f424180001d00\nAPI> SET> ...\nOK\nAPI> SET> ...\nOK\nAPI> SET> ...\nOK\nAPI> SET> ...\nOK\nAPI> ...\nOK\nAPI> ...\nOK\nAPI> ...\nSUCCESS\nAPI> Bye\n[dmadmin@cs-0 ~]$\n<\/pre><\/div>\n\n\nThe “FLUSH_OTDS_CONFIG<\/em><\/strong>” apply command is only required if you modify an existing “dm_otds_license_config<\/em><\/strong>” object. However, I still added it, as this is a nice and simple way to make sure that the Repository is able to communicate with the standalone Java process (“OTDSAuthLicenseHttpServerBin<\/em><\/strong>“).<\/p>\n\n\n\nIf it succeeds, you should see the “SUCCESS<\/em><\/strong>” message at the end. If it fails to communicate (e.g. you have an issue in your “dm_server_config.app_server_uri<\/em><\/strong>“), you should get an error about not being able to open a socket or something similar.<\/p>\n\n\n\n
![\"\"](\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2026\/01\/OTDS_license_1-1024x258.png\")