Content Server on AIX: 401 Unauthorized error

[Former Member]

Hi All,

I have Content Server installed on an AIX 6.1 server. Everything works fine until I turn adminsecurity on (=1).

When I do that, it asks for a login. Neither my SAP account nor my AIX account works.

I did some research that says that the entries in /etc/shadow needs to be the same as /etc/password.

Well, here's my issue, AIX doesn't have a /etc/shadow file. It has an /etc/security/passwd (which contains the password) and an /etc/security/user (which contains settings of the user). Has anyone had any experience with this? I want to have admin security on, and I'd prefer to not have to use NIS, but if I have to, I will.

Thanks!

Here is my cs.conf file entries:

[ContentServer]
TraceLevel=warning
AdminSecurity=1
AdminSecurityGroup=sigmasys
ContentStorageHost=sgm251.itsso.gc.ca
ContentStorageName=SD1
StorageDriver=FSStorage
PSEDir=/home/sd1adm/security
ContRepRoot=/usr/app/novus_cs/sd1/contrep
Storage=ContentStorage.DLL

[contRep-A6]
ContRepRoot=/usr/app/novus_cs/sd1/contrep

[Former Member]

Hi All,

I have Content Server installed on an AIX 6.1 server. Everything works fine until I turn adminsecurity on (=1).

When I do that, it asks for a login. Neither my SAP account nor my AIX account works.

I did some research that says that the entries in /etc/shadow needs to be the same as /etc/password.

Well, here's my issue, AIX doesn't have a /etc/shadow file. It has an /etc/security/passwd (which contains the password) and an /etc/security/user (which contains settings of the user). Has anyone had any experience with this? I want to have admin security on, and I'd prefer to not have to use NIS, but if I have to, I will.

Thanks!

Here is my cs.conf file entries:

[ContentServer]
TraceLevel=warning
AdminSecurity=1
AdminSecurityGroup=sigmasys
ContentStorageHost=sgm251.itsso.gc.ca
ContentStorageName=SD1
StorageDriver=FSStorage
PSEDir=/home/sd1adm/security
ContRepRoot=/usr/app/novus_cs/sd1/contrep
Storage=ContentStorage.DLL

[contRep-A6]
ContRepRoot=/usr/app/novus_cs/sd1/contrep

[Former Member]

Hi Anthony,

Content server Admin security fails with shadow passwords enabled in the

UNIX OS.

401 Unauthorized (bad local password)

Content Server with AdminSecurity enabled tries to read the users

hashed password details from standard /etc/passwd file. This entry is

missing for the user if the shadow password is enabled in UNIX OS.

Content Server Adminsecurity feature cannot be used unless we have the
hashed password in the /etc/passwd file.

There are two workarounds for this.

1)Bring the hashed password from the shadow file only previlaged to the
root user (The shadow password management varies among variuos flavours
of UNIX - on linux it is stored in /etc/shadow) to /etc/passwd file

2)Turn Off AdminSecurity by setting parameter
      AdminSecurity = 0
in cs.Conf file installed with Content server installation.
(PLEASE NOTE Content Server Installation by default sets this parameter
to 1)

We have not recieved any request from the customer regarding this issue. They either transfer the password or switch off the adminSecurity.

However for document related operations like upload/download,he can still keep the secuirty active, by activating the check signature and sending the certificates to the CS. When the signature is active,  KPRO will generate a url to content server which will contain secKey and the content server will create a new secKey and verify that against the url sent. If the secKey is same, then the operation will continue else an un-authorize 401 error is thrown.

If you still require the AdminSecurity at OS level as well then you need to go for the NIS only.

Best Regards,
Sneha