We have Ondemand 10.5 running in Linux. We are setting up LDAP sync with Active Directory. Below is our configuration.

ARS_LDAP_SERVER=xxxxx.yyy.zzz.com
ARS_LDAP_PORT=636
ARS_LDAP_USE_SSL=TRUE
ARS_LDAP_BASE_DN=DC=xxxx,DC=yyyyy,DC=zzz,DC=com
ARS_LDAP_BIND_ATTRIBUTE=sAMAccountName
ARS_LDAP_MAPPED_ATTRIBUTE=CN
ARS_LDAP_ALLOW_ANONYMOUS=FALSE
ARS_LDAP_REFERRALS=FALSE
ARS_LDAP_BIND_MESSAGES_FILE=
ARS_LDAP_IGN_USERIDS=admin
ARS_LDAP_IGN_GROUPS=admin,admin1
ARS_LDAP_KEYRING_FILE=/ars/certs/ondemand.kdb
ARS_LDAP_KEYRING_LABEL=CERTS
ARS_LDAP_SERVER_TYPE=AD
ARS_LDAP_GROUP_FILTER=(&(objectClass=group)(CN=ONDM*,OU=ONDM-IN,OU=APPS,dc=xxxx,dc=yyyy,dc=zzz,dc=com))
ARS_LDAP_USER_FILTER=(&(objectclass=user)(memberOf=CN=ONDM*,OU=ONDM-IN,OU=APPS,dc=xxxx,dc=yyyy,dc=zzz,dc=com))
ARS_LDAP_GROUP_MAPPED_ATTRIBUTE=CN


Multiple Security Groups under OU: APPS/ONDM-IN

ONDM-ADMINS
ONDM-USERS-READONLY
ONDM-OPS

When running ARSLSYNC, we are able to pull the groups all under the OU which starts with the name ONDM.
But not able to pull the users. Seems memberOf attribute running at DN level not allowing wildcard. If we provide the group name explicitly, we are able to get the users.

Anyone did any similar setup, Kindly advise,

This is quite an old forum, but if it helps, please check the initial encryption key for arssockd.

Reference: https://www.ibm.com/support/pages/ibm-content-manager-ondemand-native-encryption (PDF on page 5)

# Create key store
gsk8capicmd_64 -keydb -create -db "odkeys.p12" -pw "myKeyDBpasswd" -type pkcs12 -stash

# Update Key to arssockd
arssockd -I <INSTANCE> -d "keystore_type=PKCS12,keystore_location=/opt/IBM/ondemand/V10.5/config/odkeys.p12,keystore_mkl=*"

# Checked by
arssockd -I <INSTANCE> -D

Hello teera_aoo -

When I get an unable to connect message here is what I try first:


1. Ping the arssockd server host from Windows.  Does that work?

2. Next try the port:

Powershell - (failure shown first, then I opened up the firewall and retried successfully)

PS C:\Users\ed.arnold> test-netconnection 10.1.203.52 -port 1447
WARNING: TCP connect to (10.1.203.52 : 1447) failed
WARNING: Ping to 10.1.203.52 failed with status: TimedOut


ComputerName           : 10.1.203.52
RemoteAddress          : 10.1.203.52
RemotePort             : 1447
InterfaceAlias         : Wi-Fi
SourceAddress          : 192.168.1.133
PingSucceeded          : False
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded       : False



PS C:\Users\ed.arnold> test-netconnection 10.1.203.52 -port 1447


ComputerName     : 10.1.203.52
RemoteAddress    : 10.1.203.52
RemotePort       : 1447
InterfaceAlias   : Ethernet 2
SourceAddress    : 10.111.105.47
TcpTestSucceeded : True

3. If both of these fail it's time for a packet trace to see where the packets are going or not going

Ed Arnold

I'm having trouble accessing the main page (ICN admin desktop) after deploying ICN. All deployment steps completed successfully, and the JDBC datasource test passed.

Can anyone suggest a solution?

ICN:
Cannot connect to the web client.
The web application server might not be running or cannot be reached because of network problems.
Ask your system administrator to review the web application server log files.

In SystemOut.log:
[7/25/25 17:42:51:654 ICT] 0000009d SystemErr     R CIWEB Error: [@x.x.x.x] com.ibm.ecm.jaxrs.Actions.loadAndExecuteAction() Failed processing
javax.servlet.ServletException: Failed to initialize.
        at com.ibm.ecm.jaxrs.GlobalConfiguration.initialize(GlobalConfiguration.java:84)
        at com.ibm.ecm.jaxrs.GlobalConfiguration.process(GlobalConfiguration.java:177)
        at com.ibm.ecm.jaxrs.Actions.loadAndExecuteAction(Actions.java:951)
        at com.ibm.ecm.jaxrs.Actions.handleAction(Actions.java:134)
        at com.ibm.ecm.jaxrs.Actions.handlePostActions(Actions.java:204)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:90)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
        at java.lang.reflect.Method.invoke(Method.java:508)
        at com.ibm.ws.jaxrs20.server.LibertyJaxRsServerFactoryBean.performInvocation(LibertyJaxRsServerFactoryBean.java:650)
        at com.ibm.ws.jaxrs20.server.LibertyJaxRsInvoker.performInvocation(LibertyJaxRsInvoker.java:108)
        at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:96)
        at com.ibm.ws.jaxrs20.server.LibertyJaxRsInvoker.invoke(LibertyJaxRsInvoker.java:176)
        at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:191)
        at com.ibm.ws.jaxrs20.server.LibertyJaxRsInvoker.invoke(LibertyJaxRsInvoker.java:364)
        at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:101)
        at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:73)
        at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:111)
        at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:309)
        at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:136)
        at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:280)
        at com.ibm.ws.jaxrs20.endpoint.AbstractJaxRsWebEndpoint.invoke(AbstractJaxRsWebEndpoint.java:147)
        at com.ibm.websphere.jaxrs.server.IBMRestServlet.handleRequest(IBMRestServlet.java:192)
        at com.ibm.websphere.jaxrs.server.IBMRestServlet.doPost(IBMRestServlet.java:150)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
        at com.ibm.websphere.jaxrs.server.IBMRestServlet.service(IBMRestServlet.java:138)
        at com.ibm.ws.webcontainer.servlet.ServletWrapper.service(ServletWrapper.java:1235)
        at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:779)
        at com.ibm.ws.webcontainer.servlet.ServletWrapper.handleRequest(ServletWrapper.java:478)
        at com.ibm.ws.webcontainer.servlet.ServletWrapperImpl.handleRequest(ServletWrapperImpl.java:179)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.invokeTarget(WebAppFilterChain.java:143)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:96)
        at com.ibm.ecm.filters.JAXRSFilter.doFilter(JAXRSFilter.java:42)
        at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:197)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
        at com.ibm.ecm.filters.CSPFilter.doFilter(CSPFilter.java:89)
        at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:197)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
        at com.ibm.ecm.filters.ESAPIWafFilter.doFilter(ESAPIWafFilter.java:265)
        at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:197)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
        at com.ibm.ecm.filters.CORSFilter.doFilter(CORSFilter.java:85)
        at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:197)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
        at com.ibm.ecm.jaxrs.ContextFilter.contextFilter(ContextFilter.java:75)
        at com.ibm.ecm.jaxrs.ContextFilter.doFilter(ContextFilter.java:55)
        at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:197)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
        at com.ibm.ecm.filters.SessionTimeoutFilter.doFilter(SessionTimeoutFilter.java:79)
        at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:197)
        at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
        at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:979)
        at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1119)
        at com.ibm.ws.webcontainer.servlet.CacheServletWrapper.handleRequest(CacheServletWrapper.java:82)
        at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:966)
        at com.ibm.ws.webcontainer.WSWebContainer.handleRequest(WSWebContainer.java:1817)
        at com.ibm.ws.webcontainer.channel.WCChannelLink.ready(WCChannelLink.java:382)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:465)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.handleNewRequest(HttpInboundLink.java:532)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.processRequest(HttpInboundLink.java:318)
        at com.ibm.ws.http.channel.inbound.impl.HttpInboundLink.ready(HttpInboundLink.java:289)
        at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.sendToDiscriminators(NewConnectionInitialReadCallback.java:214)
        at com.ibm.ws.tcp.channel.impl.NewConnectionInitialReadCallback.complete(NewConnectionInitialReadCallback.java:113)
        at com.ibm.ws.tcp.channel.impl.AioReadCompletionListener.futureCompleted(AioReadCompletionListener.java:175)
        at com.ibm.io.async.AbstractAsyncFuture.invokeCallback(AbstractAsyncFuture.java:217)
        at com.ibm.io.async.AsyncChannelFuture.fireCompletionActions(AsyncChannelFuture.java:161)
        at com.ibm.io.async.AsyncFuture.completed(AsyncFuture.java:138)
        at com.ibm.io.async.ResultHandler.complete(ResultHandler.java:204)
        at com.ibm.io.async.ResultHandler.runEventProcessingLoop(ResultHandler.java:775)
        at com.ibm.io.async.ResultHandler$2.run(ResultHandler.java:905)
        at com.ibm.ws.util.ThreadPool$Worker.run(ThreadPool.java:1909)
Caused by: java.lang.IllegalStateException: Data store is null
        at com.ibm.ecm.configuration.GlobalConfig.initializeDatabaseConfiguration(GlobalConfig.java:114)
        at com.ibm.ecm.configuration.GlobalConfig.initialize(GlobalConfig.java:62)
        at com.ibm.ecm.configuration.Config.initialize(Config.java:112)
        at com.ibm.ecm.jaxrs.GlobalConfiguration.initializeConfig(GlobalConfiguration.java:93)
        at com.ibm.ecm.jaxrs.GlobalConfiguration.initialize(GlobalConfiguration.java:76)
        ... 70 more

ARS0188E - IBM Content Manager OnDemand server issues the message "ARS0188E Unable to create thread. The return code is X" and exits.

Unfortunately ARSSOCKD ends without enough diagnostic information to tell where the issue was.

Starting at 10.5.0.8 CMOD on z/OS, instead of just terminating, now ends with a dump.

Support can analyze the dump and should be able to localize the root cause.

Ed

// JOBCARD
//*       
//* -----------------------------------------------------------------
//*                                                                   
//*  CHANGE THE OPERANDS ON THE FOLLOWING SET STATEMENTS             
//*  TO REFERENCE THE DATA SET NAMES APPROPRIATE FOR                 
//*  YOUR INSTALLATION.                                               
//*                                                                   
//*     SRCLIB  REFERENCES THE LIBRARY WHICH CONTAINS                 
//*             THE SOURCE CODE PARTS.                               
//*                                                                   
//*     TGTLIB  REFERENCES THE TARGET HFS TO CONTAIN                 
//*             THE LOAD MODULE.                                     
//*                                                                   
//*                                                                   
//PROCESS   OUTPUT  DEFAULT=YES,CLASS=*,JESDS=ALL,OUTDISP=HOLD       
//SRCLIB    SET SRCLIB='ARS.SMPE105.SARSINST'                         
//TGTLIB    SET TGTLIB='/u/some/target/exits'                               
//*                                                                   
//* -----------------------------------------------------------------
//*                                                                   
//COMP     EXEC PGM=CCNDRVR,                                       
// PARM=('/OPTFILE(DD:COPTS)')                                     
//STEPLIB  DD DSN=CEE.SCEERUN,DISP=SHR                             
//         DD DSN=CBC.SCCNCMP,DISP=SHR                             
//COPTS    DD *                                                     
DEFINE(OS390)                                                       
DEFINE(UNIX)                                                       
DEFINE(ARS_COPYRIGHT)                                               
DEFINE(MVS_PRAGMA)                                                 
DEFINE(_THREAD_SAFE)                                               
DEFINE(_OPEN_SYS)                                                   
DEFINE(_XOPEN_SOURCE_EXTENDED)                                     
DEFINE(__OS390__)                                                   
OPT(2)                                                             
GOFF                                                               
XPLINK                                                             
CSECT                                                               
INLRPT                                                             
LIB                                                                 
ARCH(10)                                                           
TUNE(12)
LONGNAME                                                             
RENT                                                                 
SOURCE                                                               
LIST                                                                 
NOSEQ                                                               
NOMAR                                                               
SPILL(512)                                                           
//SYSIN    DD  DSN=&SRCLIB(ARSUPERM),DISP=SHR                       
//USERLIB  DD  DISP=SHR,DSN=ARS.SMPE105.SARSINST                     
//SYSLIB   DD  DISP=SHR,DSN=ARS.SMPE105.SARSINST                     
//         DD  DSNAME=CEE.SCEEH.H,DISP=SHR                           
//         DD  DSNAME=CEE.SCEEH.SYS.H,DISP=SHR                       
//SYSUT1   DD  UNIT=SYSDA,DISP=(NEW,DELETE),                         
//   SPACE=(32000,(30,30)),DCB=(RECFM=FB,LRECL=80,BLKSIZE=3200)     
//SYSUT4   DD  UNIT=SYSDA,DISP=(NEW,DELETE),                         
//   SPACE=(32000,(30,30)),DCB=(RECFM=FB,LRECL=80,BLKSIZE=3200)     
//SYSUT5   DD  UNIT=SYSDA,DISP=(NEW,DELETE),                         
//   SPACE=(32000,(30,30)),DCB=(RECFM=FB,LRECL=3200,BLKSIZE=12800)   
//SYSUT6   DD  UNIT=SYSDA,DISP=(NEW,DELETE),                         
//   SPACE=(32000,(30,30)),DCB=(RECFM=FB,LRECL=3200,BLKSIZE=12800)   
//SYSUT7   DD  UNIT=SYSDA,DISP=(NEW,DELETE),                         
//   SPACE=(32000,(30,30)),DCB=(RECFM=FB,LRECL=3200,BLKSIZE=12800)   
//SYSUT8   DD  UNIT=SYSDA,DISP=(NEW,DELETE),                         
//   SPACE=(32000,(30,30)),DCB=(RECFM=FB,LRECL=3200,BLKSIZE=12800)   
//SYSUT9   DD  UNIT=SYSDA,DISP=(NEW,DELETE),                         
//   SPACE=(32000,(30,30)),DCB=(RECFM=VB,LRECL=137,BLKSIZE=882)     
//SYSUT14  DD  UNIT=SYSDA,SPACE=(32000,(30,30)),                     
//             DCB=(RECFM=FB,LRECL=3200,BLKSIZE=12800)               
//SYSPRINT DD SYSOUT=*                                               
//SYSCPRT  DD SYSOUT=*                                               
//SYSLIN   DD DSN=&&OBJ,                                             
//             DISP=(MOD,PASS),                                     
//             UNIT=SYSALLDA,LRECL=80,RECFM=FB,BLKSIZE=3120,         
//             SPACE=(TRK,(30,30))                                   
//LKED     EXEC PGM=IEWL,COND=(4,LT,COMP),                           
//     PARM='AC=1,CASE=MIXED,OPTIONS=OPTS'                           
//SYSLIB   DD  DISP=SHR,DSN=CEE.SCEEBND2                             
//OPTS     DD  *                                                     
    XREF                                                             
    AMODE=31,MAP                                                     
    RENT,DYNAM(DLL)                                                 
//SYSLMOD  DD PATH='&TGTLIB'                                         
//SYSUT1   DD UNIT=VIO,SPACE=(CYL,(10,2)),DISP=(NEW,DELETE)           
//SARSLOAD DD DISP=SHR,DSN=ARS.SMPE105.SARSLOAD                       
//SCEELIB  DD DISP=SHR,DSN=CEE.SCEELIB                                 
//SYSPRINT DD SYSOUT=*                                                 
//SYSDEFSD DD DUMMY                                                   
//SYSLIN   DD  DSN=*.COMP.SYSLIN,DISP=(OLD,DELETE)                     
//         DD  DDNAME=SYSIN                                           
//SYSIN    DD  *                                                       
   SETOPT PARM(PATHMODE(0,7,5,5),EXTATTR(APF))                         
    INCLUDE SARSLOAD(ARSZUXFX)                                         
    INCLUDE SCEELIB(CELHS003,CELHS001)                                 
    NAME    arsuperm(R)                                               
//*

Yes.  The snag is that encryption happens at load time -- all new documents will be encrypted, but old documents will remain un-encrypted.  You can reload the documents to force the data to be encrypted at rest.  This also remains true for Globally Unique IDs and Hash values -- only new data will receive the features.

-JD.

OpenText is an archive, BUT : They have not the compress ratio that CMOD have , and the license are expensive. They usually start low, but after 1 year they increase.
I guess OpenText is a more "live archive", CMOD is a cold archive .. you store, search and view. Simple, but effective.

Hi ! Have anyone added encryption at rest on a working environment before ?

BR,
Anne

I learned that new function level is available for Db2.

At this time, there is no plan for CMOD to require any of these new functions.

Db2 13 - What's new - Function level 507 (PH64907 - April 2025)

Function level 507 introduces online conversion of table partitions from PBR to PBG, enhanced concurrency for system temporal tables, LASTUSED support for application plans, more flexibility for temporal and archive-enabled tables, and greater than 64 GB allocation quantities.