Documentum provides one authentication plug-in with Content Server, this plug-in
allows you to use the Netegrity SiteMinder Policy Server with Content Server. The
plug-in supports Web-based Single Sign-On (SSO) and strong authentication.


Documentum Netegrity Authentication Plugin 'dm_netegrity'
=========================================================
The Documentum Netegrity Authentication Plugin allows the Documentum Content Server to authenticate users based on Netegrity Single Sign-On tokens instead of passwords. This enables Documentum web application for Netegrity Single Sign-On. In order to use this plugin, it is necessary to purchase the Netegrity SiteMinder product.

Before installing documentum netegrity plugin, Please check if the following requirements are met

1. Create 4.x web-agent on policy server using the Policy Server User Interface. Click the check box for
"Support 4.x agents" and enter the relevant information like shared secret. This is required because the plugin is
custom agent and Policy Server will communicate with the plugin only when the "support for 4.x agents" option is
enabled. (See Policy Server Design Manual).

2. Check whether dm_user object created for the netegrity user has either user_name, user_os_name or user_ldap_dn attribute
set to the value that matches the user credentials that was used to get the token at the application server side
integration.
This is required because plugin not only validates the token, it retrieves the user credentials
from the session specification. The plugin checks if this value from the session
specification matches with any one of the settings of the user_name, user_os_name or user_ldap_dn.


To install the Documentum Netegrity authentication plugin, follow these instructions:

1. Copy the file
dm_netegrity_auth.dll (Windows) or
dm_netegrity_auth.so (Solaris / AIX / Linux)
dm_netegrity_auth.sl (HPUX)
to the authentication plugin location (usually $DOCUMENTUM/dba/auth).

2. Copy the file dm_netegrity_auth.ini to the same location.
Edit this file and set all mandatory parameters.

3. Copy the supporting shared libraries:
Windows: copy the files smagentapi.dll & smerrlog.dll to %DM_HOME%\bin
Solaris/AIX: copy the files libsmagentapi.so & libsmerrlog.so to $DM_HOME/bin
Linux: copy the files libsmagentapi.so, libsmcommonutil.so & libsmerrlog.so to $DM_HOME/bin
HPUX: copy the files libsmagentapi.sl & libsmerrlog.sl to $DM_HOME/bin

4. Restart the docbase. You can verify that the plugin has been loaded by looking in the main server log file ($DOCUMENTUM/dba/log/.log) for an entry starting with "[DM_SESSION_I_AUTH_PLUGIN_LOADED]info".

This completes the server-side installation. Refer to the WDK documentation to setup the application server side.


To test the plugin infrastructure turn on server tracing flag "trace_authentication". The tracing information will be
written to the server log and plugin specific tracing will be written into dm_netegrity_.log that resides in
$DOCUMENTUM/dba/log directory.

How to configure LDAP Object in Documentum

To setup an LDAPConfig Object and import the users you may follow the steps documented in the eContent Server Administrator Guide, Appendix C, "Using an LDAP Directory Server". However, please note the following three items that are not detailed in the documentation.

1. You must provide an email address in the LDAP server and LDAP Configuration object in Documentum Administrator (DA).

2. Use groupofuniqueNAMES instead of groupofuniquemembers. The groupofuniquenames is defined in the schema, where as the groupofuniquemembers is not.





STEPS FOR TESTING LDAP FUNCTIONALITY:

Below is the procedure for testing the LDAP functionality briefly without checking in detail.

1. Install Netscape Directory Server on NT or Unix. A schema is made automatically when you install LDAP server.


2. Add a user and group into LDAP Directory Server, by Netscape LDAP Directory Server, and PLEASE PROVIDE EMAIL ADDRESS.


3. Make an LDAP Configuration object in a Docbase, using DA. Below is a sample of the setting:



Hostname : your computer name or IP address where LDAP server runs,

Port : default 3891 Note but it depends on your LDAP Server so
consult the LDAP team for this.

Person Object Class : person

Group Object Class : groupofuniquenames [NOT groupofuniquemembers]

Person Search Base : o=xyz.com (This is the domain name of the computer where LDAP server is installed.)

Group Search Base : o=xyz.com (Same as Person Search Base)


Enabling LDAP Changelog Information : uncheck


Name : uid

OS Name : uid

Email Address : mail


4. Restart Docbase


5. Run LDAPSynchornize job


6. Check whether users and groups defined in LDAP server are imported into the Docbase in DA.


7. Try to connect to the Docbase with Intranet Client (IC) or Desktop Client (DTC) as the user defined in LDAP Server.



Again, the following items are correction or clarification to the documentation:

1. Provide an email address in the LDAP server and LDAP Configuration object in Documentum Administrator (DA).

2. Use groupofuniqueNAMES instead of groupofuniquemembers. The groupofuniquenames is defined in the schema, where as the groupofuniquemembers is not.

3. Restart Docbase once you have created a LDAP Configuration object.

Please feel free to given feedback/comments/suggestions/improvements.

Deleting bulk number of objects is a daily task in administrating the Documentum Server and its not possible to delete more than couple of thousands objects using DA or even iDQL because it takes lot of time or sometimes it hangs the server. So best way to do it is through create a text file of API commands for those objects which need to be deleted and i have compiled some steps to do that in easy way . It can be automated by using writting some job but if you need to delete instantenously by running script . Here is the solution.

1:- Create a dql file to extract object_ids of the objects which you want to delete

example

Name this file something like "extract_objectIds.dql"
---------------------------------------
select 'destroy,c,'as destroy,r_object_id from dm_document
go
quit

---------------------------------------
2:- Create a batch file to run this dql command created in above file named like

extract_objectId.bat

----------------------------------------
@echo off
setlocal & pushd


rem -=-=-=-=-=-=-=-=-=--
rem - Set these values -
rem -=-=-=-=-=-=-=-=-=--
set DOCBASE_NAME=xxxx
set DCMT_SUPERUSER=yyyy
set DCMT_SUPERUSER_PW=zzzzz

echo
"%DM_HOME%\bin\idql32" %DOCBASE_NAME% -U%DCMT_SUPERUSER% -P%DCMT_SUPERUSER_PW% -Rextract_objectIds.dql >object_Ids.log
:EOF
endlocal & popd

-----------------------------------

3:- Extract all the API commands from the log you got in previous step in your objectid.log into a new file called "destroy_objects.api"
for example , your object_Ids.log must be containing data like

destroy,c, 09xxxxxxxxxxxxxx
destroy,c, 09xxxxxxxxxxxxxx
destroy,c, 09xxxxxxxxxxxxxx
destroy,c, 09xxxxxxxxxxxxxx

4: Create a new batch file or update the above batch file and run iapi command file using the batch file.

New Batch file example (destroy_objects.bat)

----------------------------------------------
@echo off
setlocal & pushd

rem // $Id$
rem -=-=-=-=-=-=-=-=-=--
rem - Set these values -
rem -=-=-=-=-=-=-=-=-=--
set DOCBASE_NAME=xxxx
set DCMT_SUPERUSER=yyyy
set DCMT_SUPERUSER_PW=zzzzz


rem Destroying Objects
echo
echo.
""%DM_HOME%\bin\iapi32" %DOCBASE_NAME% -U%DCMT_SUPERUSER% -P%DCMT_SUPERUSER_PW% -Rdestroy_objects.api -lobjectsDeleted.log

:EOF
endlocal & popd
------------------------------------------------

Run this batch file by setting your Docbase Name , UserId, Password.

Thats it.

Happy Destroying Objects.

Note: