OpenText ECM/LiveLink

Debugging LAPI Errors Can Actually Be Simple!

For those of you that write LAPI code for Content Server it can be next to impossible to figure out why things are not working the way they should or what the error you are getting back really means. There is a very simple trick that experienced Content Server developers use to make the debugging process much easier.

The trick is based on the fact that LAPI is really just a front end for passing information back and forth to the Content Server engine that is executing Oscript. If you are familiar with the Content Server Builder you can place break statements on the appropriate LAPI function and then trace through it to see what is getting passed into the function, how Content Server is processing it and what is being returned to your application.

There are several Ospaces that contain the executable oscript behind the LAPI calls. Most of these begin with "API" such as APIBASE, APICORE, APIDOC, etc. As with general Oscript development the key is being able to find the function you are calling in these Ospaces. Luckily the API functions have the same name as their LAPI calls and the API related Ospaces correspond to a basic set of functionality within Content Server. For example APIDOC has all the Library or Enterprise functions that deal with object manipulation.

If your LAPI application is calling CreateObjectEx and you need to find out why it is not creating your object you can find the corresponding Oscript function in the APIDOC ospace under the APIDocuments object. We recommend putting a break on the Execute script. When your LAPI code executes the CreateObjectEX call it will pause while it waits for a response from the Content Server engine. At that point look at your Builder screen and you will notice it is in debug mode at the Execute break point you set. From there you can step through the script execution and see what is passed in from your application, what lines are being executed and what is getting passed back to your application. That should be enough information to resolve the problem.

If you are not familiar with the Content Server Builder and how to use the debugging facility you should be aware that it takes some practice and familiarity before you can be productive. If you need some specific help with your LAPI application or the Builder you can send email to support@syntergy.com and one of our very experienced developers will help you.

If you have any questions about this Content Server tip you can send an e-mail to supportsyntergy.com or call Syntergy support at (888) 373-7027 or (858) 779-9642.

Content Server Security Tips

LL Cookie Encryption Key Vulnerability
Content Server releases 9.1.0.4 and 9.2.0.1 include a concern related to the cookie handling security feature. This feature can be undermined if the mechanism is not properly configured. An attacker with OScript programming knowledge and access to a Content Server Builder may be able to construct a 'valid' cookie for a Content Server user and authenticate his/her requests as that user.

OpenText has provided a detailed Security Alert about this issue. The alert number is 20002004 dated 2/27/2004. The document is available on the Knowledge Center.

Be Careful When Distributing Your opentext.ini File
The main Content Server configuration file is the opentext.ini file in the config directory. This file contains 3 passwords that are not encyrpted. These passwords must be in the opentext.ini file for Content Server to work correctly. Because the passwords are encoded and not encrypted they can easily be determined by people with the appropriate knowledge. The entries are:

1. In the [General] Section the "AdminCookie=QWRtaW4vbGl2ZWxpbmsA" is the Admin user name followed by a "/" and the password. These are base64 encoded not encrypted.
2. In the [General] Section the "adminpwd=bGl2ZWxpbmsA" is the password for the Admin.index page. It is also base64 encoded and not encrypted.
3. In the "[dbconnection:Livelink]" section the "encodeduserpwd=bGl2ZWxpbmsA" is the database password. It is also base64 encoded and not encrypted.

These entries should be removed before this file is sent to anyone. The opentext.ini file is included in the systemreport so these entries should be removed from it before it is sent to anyone.

Denial of Service Attacks Through LAPI Port
If your Content Server instance is not using LAPI you should block the port Content Server is configured to use for LAPI in order to prevent a denial of service attack. In some cases knowledgeable people have connected to the LAPI port (2099 for example) and kept refreshing it. Eventually they can tie up all of the Content Server threads and slow Content Server performance dramatically.

If your Content Server system contains mission critical information you need to continually audit your Content Server instances for security threats. The items above are only some of the known issues. If you would like information on Syntergy's security auditing service please contact our corporate office at (858) 779-9642 or send an e-mail to infosyntergy.com.

How to Find a Specific Document Stored in External Storage

From time to time there is a need to find the physical document that is stored in Content Server external storage. The need could arise because Content Server is temporarily down or a virus has been detected in the external storage area and you need to identify the owner of that document. Also, if you are moving a complicated form from one system to another you will need to know how to identify where the form data is stored in the external storage area.

Whether you are trying to find a document in the external storage area or you are trying to identify the information associated with an item stored in external storage, the process is simple and straightforward. (Note: This only works if you are using external file storage for your Content Server instances):

1. On the source system find the object id of the document you want to locate in external storage. The easiest way to do this is to click on the document "Info" function and look for "&objId=" in the URL. The associated number is the object id. For this example assume the object id is 4425.
2. Using a SQL query tool execute the following sql to identify the location of the document.
   
   a. select max(providerid) from dversdata where docid = 4425
       • Assume the result is: 4427
   
   b. select providerdata from dversdata where providerid = 4427
       • Assume the result is: 0000\004\4427.dat

Find the file in your external file storage folder identified in the second sql statement. For example if your root external file storage is c:\externalstorage the file will be c:\externalstorage\ 0000\004\4427.dat

If you have identified a document in external storage and you want to know the information about that document the process is reversed:

1. 1. Find the providerid of the file in your external file storage folder. For example if your root external file storage is c:\externalstorage and the file name is c:\externalstorage\ 0000\004\4427.dat, the providerid is 4427.
2. 2. Using a SQL query tool execute the following sql to identify the locate the information about this document.
   
   a. select docid from dversdata where providerid = 4427
       • Assume the result is: 4425
   
   b. You can either select appropriate meta data from the dtree table using the docid to look up the document
       • Select name from dtree where docid = 4425
   
   c. or you can substitute the docid value 4425 into a document info page url to go directly to that documents info page. Note that the second approach assumes you have permission to access the document.

If you have any questions about this Content Server tip you can send an e-mail to support@syntergy.com or call Syntergy support at (888) 373-7027 or (858) 779-9642.

Copying Web Forms

A common problem with organizations implementing Content Server Web Forms is the inability to transfer forms from the development system to the production system. Most organizations test the form on the development system and then manually recreate the same form on the production system. This process is less than reliable due to the possibility of making a mistake when recreating the form. The more complex the form the more likely of creating a mistake.

Unknown to most organizations is a simple process that eliminates the need to recreate forms on different systems. If you are working with Web Forms and have a need to copy these forms from one instance of Content Server to another follow these steps (Note: This only works if you are using external file storage for your Content Server instances):

1. Create a simple one-field form template of the same name as your source form on the target Content Server instance
2. On the source system find the object id of the form template you want to copy. The easiest way to do this is to click on the form template and look for "&objId=" in the URL. The associated number is the object id. For this example assume the object id is 7691.
3. Using a SQL query tool execute the following sql to identify the location of the form template.
   
   a. select max(providerid) from dversdata where docid = 7691
       Note: Assume the result is: 7852
   
   b. select providerdata from providerdata where providerid = 7852
       Note: Assume the result is: 0000\007\7852.dat
4. Find the file in your external file storage folder identified in the second sql statement. For example if your root external file storage is c:\externalstorage you should copy the file c:\externalstorage\ 0000\007\7852.dat
5. On the target system find the object id of the form template you created in step one. The easiest way to do this is to click on the form template and look for "&objId=" in the URL. The associated number is the object id. For this example assume the object id is 2525.
6. Using a SQL query tool execute the following sql to identify the location of the form template.
   a. select max(providerid) from dversdata where docid = 2525
       Note: Assume the result is: 4444
   
   b. select providerdata from providerdata where providerid = 4444
       Note: Assume the result is: 0000\004\4444.dat
7. Find the file in your external file storage folder identified in the second sql statement. For example if your root external file storage is d:\externalstorage the file you want to replace with the file copied in step 4 above is d:\externalstorage\ 0000\004\4444.dat
8. Once you have replaced the file on the target system with the file on the source system your form template has been copied. You can then add any views making sure that any URL references represent the target system URL.
9. Add your form template to the appropriate workflow maps.

Questions

If you have any questions about these Content Server tips you can send an e-mail to supportsyntergy.com.

Forums

Tek-Tips: Content Server technical support forum and mutual help system for computer professionals.