When installing a new Remote Content Server (High Availability), everything was going according to the plan until we try to login to DA using this new CS: the login using the Installation Owner (dmadmin) failed… Same result from dqMan or any other third party tools and only the iapi or idql sessions on the Content Server itself were still working because of the local trust. When something strange is happening regarding the authentication of the Installation Owner, I tink the first to do is always to verify if the dm_check_password is able to recognize your username\/password:<\/p>\n
[dmadmin@content_server_01 ~]$ $DOCUMENTUM\/dba\/dm_check_password\nEnter user name: dmadmin\nEnter user password:\nEnter user extra #1 (not used):\nEnter user extra #2 (not used):\n$DOCUMENTUM\/dba\/dm_check_password: Result = (245) = (DM_CHKPASS_BAD_LOGIN)<\/pre>\n<\/p>\n
As you can see above, this was actually not working so apparently the CS is thinking that the password isn’t the correct one… This might happen for several reasons:<\/p>\n
<\/p>\n
1. Wrong permissions on the dm_check_password script<\/h3>\n
This script is part of the few scripts that need some specific permissions to be working… This is either done by the Installer if you provide the root’s password during the installation or you can run the $DOCUMENTUM\/dba\/dm_root_task script manually using the root account (using sudo\/dzdo or asking your UNIX admin team for example). These are the permissions that are needed for this script:<\/p>\n
[dmadmin@content_server_01 ~]$ ls -l $DOCUMENTUM\/dba\/dm_check_password\n-rwsr-s---. 1 root dmadmin 14328 Oct 10 12:57 $DOCUMENTUM\/dba\/dm_check_password<\/pre>\n<\/p>\n
If the permissions aren’t the right ones or if you think that this file has been corrupted somehow, then you can re-execute the dm_root_task again as root. It will ask you if you want to overwrite the current files and it will in the end set the permissions properly.<\/p>\n
<\/p>\n
2. Expired password\/account<\/h3>\n
If the OS password\/account you are testing (Installation Owner in my case) is expired then there are several behaviors. In case the account is expired, then the dm_check_password will return a DM_CHKPASS_ACCOUNT_EXPIRED error. If it is the password that is expired, then in some OS, the dm_check_password won’t work with the bad login error shown at the beginning of this blog. This can be checked pretty easily on most OS. On a RedHat for example, it would be something like:<\/p>\n
[dmadmin@content_server_01 ~]$ chage -l dmadmin\nLast password change : Oct 10, 2016\nPassword expires : never\nPassword inactive : never\nAccount expires : never\nMinimum number of days between password change : 0\nMaximum number of days between password change : 4294967295\nNumber of days of warning before password expires : 7<\/pre>\n<\/p>\n
In our case, we are setting the password\/account to never expire to avoid such issues so that’s not the problem here. By the way, an expired password will also prevent you to use the crontab for example…<\/p>\n
<\/p>\n
To change these parameters, you will need to have root permissions. That’s how it is done for example (press enter to just use the proposed value if that’s fine for you). The value between brackets is the current\/proposed value and you can put your desired value after the colon:<\/p>\n
[root@content_server_01 ~]$ chage dmadmin\nChanging the aging information for dmadmin\nEnter the new value, or press ENTER for the default\n\n Minimum Password Age [0]: 0\n Maximum Password Age [4294967295]: 4294967295\n Last Password Change (YYYY-MM-DD) [2016-10-10]:\n Password Expiration Warning [7]:\n Password Inactive [-1]: -1\n Account Expiration Date (YYYY-MM-DD) [-1]: -1<\/pre>\n<\/p>\n
3. Wrong OS password<\/h3>\n
Of course if the OS password isn’t the correct one, then the dm_check_password will return a BAD_LOGIN… Makes sense, isn’t it? What I wanted to explain in this section is that in our case, we are always using sudo\/dzdo options to change the current user to the Installation Owner and therefore we never really use the Installation Owner’s password at the OS level (only in DA, dqMan, aso…). To check if the password is correct at the OS level, you can of course start a ssh session with dmadmin directly or any other command that would require the password to be entered like a su or sudo on itself in our case:<\/p>\n
[dmadmin@content_server_01 ~]$ su - dmadmin\nPassword:\n[dmadmin@content_server_01 ~]$<\/pre>\n<\/p>\n
As you can see, the OS isn’t complaining and therefore this is working properly: the OS password is the correct one.<\/p>\n
<\/p>\n
4. Wrong mount options<\/h3>\n
Finally the last thing that can prevent you to login to your docbases remotely is some wrong options on your mount points… For this paragraph, I will suppose that $DOCUMENTUM has been installed on a mount point \/app. So let’s check the current mount options, as root of course:<\/p>\n
[root@content_server_01 ~]$ mount | grep \"\/app\"\n\/dev\/mapper\/VG01-LV00 on \/app type ext4 (rw,nodev,nosuid)\n[root@content_server_01 ~]$\n[root@content_server_01 ~]$ cat \/etc\/fstab | grep \"\/app\"\n\/dev\/mapper\/VG01-LV00 \/app ext4 nodev,nosuid 1 2<\/pre>\n<\/p>\n
That seems alright but actually it isn’t… For Documentum to work properly, the nosuid shouldn’t be present on the mount point where it has been installed! Therefore we need to change this. First of all, you need to update the file \/etc\/fstab so this change will remain after a reboot of the linux host. Just remove “,nosuid” to have something like that:<\/p>\n
[root@content_server_01 ~]$ cat \/etc\/fstab | grep \"\/app\"\n\/dev\/mapper\/VG01-LV00 \/app ext4 nodev 1 2<\/pre>\n<\/p>\n
Now, the configuration inside the file \/etc\/fstab isn’t applied or reloaded if \/app is already mounted. Therefore you need to remount it with the right options and that’s how you can do it:<\/p>\n
[root@content_server_01 ~]$ mount | grep \"\/app\"\n\/dev\/mapper\/VG01-LV00 on \/app type ext4 (rw,nodev,nosuid)\n[root@content_server_01 ~]$\n[root@content_server_01 ~]$ mount -o remount,nodev \/app\n[root@content_server_01 ~]$\n[root@content_server_01 ~]$ mount | grep \"\/app\"\n\/dev\/mapper\/VG01-LV00 on \/app type ext4 (rw,nodev)<\/pre>\n<\/p>\n
Now that the mount options are correct, we can check again the dm_check_password:<\/p>\n
[dmadmin@content_server_01 ~]$ $DOCUMENTUM\/dba\/dm_check_password\nEnter user name: dmadmin\nEnter user password:\nEnter user extra #1 (not used):\nEnter user extra #2 (not used):\n$DOCUMENTUM\/dba\/dm_check_password: Result = (0) = (DM_EXT_APP_SUCCESS)<\/pre>\n<\/p>\n
As you can see, this is now working… That’s a miracle ;).<\/p>\n","protected":false},"excerpt":{"rendered":"
When installing a new Remote Content Server (High Availability), everything was going according to the plan until we try to login to DA using this new CS: the login using the Installation Owner (dmadmin) failed… Same result from dqMan or any other third party tools and only the iapi or idql sessions on the Content […]<\/p>\n","protected":false},"author":20,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[525],"tags":[995,996,129,997],"type_dbi":[],"class_list":["post-9418","post","type-post","status-publish","format-standard","hentry","category-enterprise-content-management","tag-authentication","tag-dm_check_password","tag-documentum","tag-password"],"acf":[],"yoast_head":"\n
Documentum story - Authentication failed for Installation Owner with the correct password - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Documentum story - Authentication failed for Installation Owner with the correct password\" \/>\n<meta property=\"og:description\" content=\"When installing a new Remote Content Server (High Availability), everything was going according to the plan until we try to login to DA using this new CS: the login using the Installation Owner (dmadmin) failed… Same result from dqMan or any other third party tools and only the iapi or idql sessions on the Content […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2016-11-29T06:00:09+00:00\" \/>\n<meta name=\"author\" content=\"Morgan Patou\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@MorganPatou\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Morgan Patou\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/\"},\"author\":{\"name\":\"Morgan Patou\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"headline\":\"Documentum story – Authentication failed for Installation Owner with the correct password\",\"datePublished\":\"2016-11-29T06:00:09+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/\"},\"wordCount\":792,\"commentCount\":0,\"keywords\":[\"Authentication\",\"dm_check_password\",\"Documentum\",\"Password\"],\"articleSection\":[\"Enterprise content management\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/\",\"name\":\"Documentum story - Authentication failed for Installation Owner with the correct password - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\"},\"datePublished\":\"2016-11-29T06:00:09+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Documentum story – Authentication failed for Installation Owner with the correct password\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/#\\\/schema\\\/person\\\/c4d05b25843a9bc2ab20415dae6bd2d8\",\"name\":\"Morgan Patou\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g\",\"caption\":\"Morgan Patou\"},\"description\":\"Morgan Patou has over 12 years of experience in Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex & critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\\\/Banking, and the Pharmaceutical industry.\",\"sameAs\":[\"https:\\\/\\\/blog.dbi-services.com\\\/author\\\/morgan-patou\\\/\",\"https:\\\/\\\/x.com\\\/MorganPatou\"],\"url\":\"https:\\\/\\\/www.dbi-services.com\\\/blog\\\/author\\\/morgan-patou\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Documentum story - Authentication failed for Installation Owner with the correct password - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/","og_locale":"en_US","og_type":"article","og_title":"Documentum story - Authentication failed for Installation Owner with the correct password","og_description":"When installing a new Remote Content Server (High Availability), everything was going according to the plan until we try to login to DA using this new CS: the login using the Installation Owner (dmadmin) failed… Same result from dqMan or any other third party tools and only the iapi or idql sessions on the Content […]","og_url":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/","og_site_name":"dbi Blog","article_published_time":"2016-11-29T06:00:09+00:00","author":"Morgan Patou","twitter_card":"summary_large_image","twitter_creator":"@MorganPatou","twitter_misc":{"Written by":"Morgan Patou","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/"},"author":{"name":"Morgan Patou","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"headline":"Documentum story – Authentication failed for Installation Owner with the correct password","datePublished":"2016-11-29T06:00:09+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/"},"wordCount":792,"commentCount":0,"keywords":["Authentication","dm_check_password","Documentum","Password"],"articleSection":["Enterprise content management"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/","url":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/","name":"Documentum story - Authentication failed for Installation Owner with the correct password - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"datePublished":"2016-11-29T06:00:09+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/documentum-story-authentication-failed-for-installation-owner-with-the-correct-password\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Documentum story – Authentication failed for Installation Owner with the correct password"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/c4d05b25843a9bc2ab20415dae6bd2d8","name":"Morgan Patou","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/5d7f5bec8b597db68a09107a6f5309e3870d6296ef94fb10ead4b09454ca67e5?s=96&d=mm&r=g","caption":"Morgan Patou"},"description":"Morgan Patou has over 12 years of experience in Enterprise Content Management (ECM) systems, with a strong focus in recent years on platforms such as Alfresco, Documentum, and M-Files. He specializes in the architecture, setup, customization, and maintenance of ECM infrastructures in complex & critical environments. Morgan is well-versed in both engineering and operations aspects, including high availability design, system integration, and lifecycle management. He also has a solid foundation in open-source and proprietary technologies - ranging from Apache, OpenLDAP or Kerberos to enterprise-grade systems like WebLogic. Morgan Patou holds an Engineering Degree in Computer Science from ENSISA (\u00c9cole Nationale Sup\u00e9rieure d'Ing\u00e9nieurs Sud Alsace) in Mulhouse, France. He is Alfresco Content Services Certified Administrator (ACSCA), Alfresco Content Services Certified Engineer (ACSCE) as well as OpenText Documentum Certified Administrator. His industry experience spans the Public Sector, IT Services, Financial Services\/Banking, and the Pharmaceutical industry.","sameAs":["https:\/\/blog.dbi-services.com\/author\/morgan-patou\/","https:\/\/x.com\/MorganPatou"],"url":"https:\/\/www.dbi-services.com\/blog\/author\/morgan-patou\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/9418","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/20"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=9418"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/9418\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=9418"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=9418"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=9418"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=9418"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}