TM1 CAM Security Issue

[dan.kelleher]

Hi guys,

We're having an issue using CAM authentication with TM1.

We have 2 separate geographical instances (dedicated TM1 and BI servers in both locations) and it's working fine on one, but failing to log in on the other.

I have highlighted the notable variables in the tm1s.cfg file:

Code: Select all

IntegratedSecurityMode=5
UseSSL=F
AdminHost=
ServerCAMURI= http://XXXXX:9800/p2pd/servlet/dispatch
ClientCAMURI= https://XXXXX:8810/ibmcognos/cgi-bin/cognosisapi.dll
IPVersion=ipv4
ServerCAMIPVersion=ipv4
CAMPortalVariableFile=variables_TM1.xml

When we attempt to log in via CAM using TM1 perspectives, the following log entry is produced:

Code: Select all

6188   []   DEBUG   2014-09-08 13:34:09.929   TM1.Client   Destroying client abstraction 0x0000000003DEC410
6188   []   DEBUG   2014-09-08 13:34:09.929   TM1.Client   clientDestroy() destroys clih=0x0000000003DEBA10
6188   []   DEBUG   2014-09-08 13:34:09.929   TM1.Client.Detail   GetClient called from ..\tm1_r7s\TM1ClientImpl.cpp, line 728
6188   []   DEBUG   2014-09-08 13:34:09.929   TM1.Registration   Unregistering Client: CAMID("LDAP:u:xxx=YYYYY,ou=internal") 
6188   []   DEBUG   2014-09-08 13:34:09.929   TM1.Client   apsusrRemoveClientDeferredData: Request to remove deferred data without a valid session or client.
...
6492   []   DEBUG   2014-09-08 13:34:33.017   TM1.Client   Creating empty client.
6492   []   DEBUG   2014-09-08 13:34:33.017   TM1.Client   TM1ClientImpl::CreateClient: Returns new client '0x000000000347BA10'.
6492   []   DEBUG   2014-09-08 13:34:33.017   TM1.Registration   Registering Client: CAMID("LDAP:u:xxx=YYYYY,ou=internal") 
6492   []   DEBUG   2014-09-08 13:34:33.017   TM1.Client   Creating empty client.
...
6864   [1]   DEBUG   2014-09-08 13:34:55.466   TM1.Client.Detail   GetClient called from ..\tm1_r7s\TM1Thread.cpp, line 1173
5732   [2]   DEBUG   2014-09-08 13:34:55.513   TM1.CAMSecurity   SystemServerConnectGetClientWithCAMPassport - Entering
5732   [2]   DEBUG   2014-09-08 13:34:55.513   TM1.CAMSecurity   SystemServerConnectGetClientWithCAMPassport - Loaded CAM Dll
5732   [2]   DEBUG   2014-09-08 13:34:55.513   TM1.CAMSecurity   SystemServerConnectGetClientWithCAMPassport - Attempting to connect to https://XXXXX:9342/p2pd/servlet/dispatch
5732   [2]   DEBUG   2014-09-08 13:34:55.513   TM1.CAMSecurity   SystemServerConnectGetClientWithCAMPassport - Creating CAM User Object. Attempt: 1
5732   [2]   DEBUG   2014-09-08 13:34:55.529   TM1.CAMSecurity   SOAP 1.1 fault: SOAP-ENV:Client [no subcode]
"SSL error"
Detail: SSL authentication failed in tcp_connect(): check password, key file, and ca file.

Changing UseSSL=F to UseSSL=T doesn't resolve the issue.

Any help as always is greatly appreciated.

It's worth noting that the CAM authentication uses LDAP via SmartCard, where as we use SSO in the location that's working OK

Thanks,

Dan

[kangkc]

Suspect problem with the SSL with the ClientCAMURI. Are you able to test it with a non-SSL ISAPI gateway ?

ClientCAMURI= https://XXXXX:8810/ibmcognos/cgi-bin/cognosisapi.dll

[dan.kelleher]

Hi Kangkc,

Thanks for the advice.

I can confirm that the issue was due to having SSL enabled on the Cognos BI dispatcher URI.

We disabled it and it now works.

Thanks,

Dan