So no problem anymore.

Regards

Lars

The certificate in the keystore should be renewed. No one can remember the password for the old keystore so i  maked a new one with the new certificate. but it won't work.

These are the commands that i used.

"C:\Program Files\Java\jdk1.6.0_04\bin\keytool.exe" -keyalg "RSA" -alias *.odense.dk -import -file D:\certifikat\stjerneodensedk\odense-dk.crt -trustcacerts -keystore odensedk

"C:\Program Files\Java\jdk1.6.0_04\bin\keytool.exe" -keyalg "RSA" -alias tdcssl -import -file D:\certifikat\tdcroot\danid-sslchain-tdcroot-tdcssl.cer -trustcacerts -keystore odensedk

"C:\Program Files\Java\jdk1.6.0_04\bin\keytool.exe" -keyalg "RSA" -alias entrustssl -import -file D:\certifikat\tdcroot\tdc-sslchain-entrustssl-entrustssl.cer -trustcacerts -keystore odensedk

"C:\Program Files\Java\jdk1.6.0_04\bin\keytool.exe" -keyalg "RSA" -alias tdcroot -import -file D:\certifikat\tdcroot\tdc-sslchain-entrustssl-tdcroot.cer -trustcacerts -keystore odensedk

When i use the new keystore i get this error in the log.

(E) Accept failed: 'No available certificate or key corresponds to the SSL cipher suites which are enabled.'  (SYSTEM - BOOSTERServer(443 SSL))

One of the difference is that the new cert is with 2048 key where the old one was with 1024 key.

Can that be a problem.

Regards

Lars Soerensn

Yes - new code is available for NTLM2. Contact me via email or the partner you purchased it through. This is a free update for customers who are under annual maintenance.

Brendon.

I switched to Sun Java SDK version 1.6.0_20.

I replaced puakma.jar with the latest one I had from you.

Still no luck. :-(

It would be nice if I could delimit the data by <br>.

It is configured to do SSO for IE-users accessing Lotus Domino. Authentication is NTLM.

It works just fine for Windows XP users. I am unsure about their IE version, probably IE 7.

They are testing Windows 7 with Internet Explorer 8. And with that combination SSO does not complete.

When the browser tries to accesses the url that should get them to the Domino content, they end up with a blank page.

I have had a look at the HTTP headers, and I can see that the browser does not succesfully authenticate with Puakma ESSO.

The last HTTP header I see between the browser and Puakma ESSO is when ESSO tells the browser:

WWW-Authenticate: NTLM TlRMTVNTUAACAAAAAAAAAAAAAAABAgAATlRMTVNTUAA=

So that is the second reply from Puakma.

What should come next is that the browser does a new GET including something like this:

Authorization: NTLM LOOONG sting

followed by the Puakma ESSO replying with a 

Set-Cookie: LtpaToken=

But for some reason the browser does not send that GET.

I have had the browser configured to have the site in qestion in both the Trusted and Intranet zones with no effect.

I hope you can help.

BOOSTERUnavailableFile=../html_public/unavailable.html

exists on your booster instance. Most likely the backend server is not available (wrong port? wrong hostname? in booster.config).

as result - white page in the brouser. Hepl my pls!

########## BOOSTER CONFIGURATION FILE #################
#Default if server not specified
HOSTS~*=localhost:8001
FORCESSL~*=1
POLLPATH~*=/
POLLMETHOD~*=HEAD
FORCECLIENTSSL~*=0

#Specific server mappings
#HOSTS~dev.mystock.ru=
#FORCESSL~www.test.com=1
#POLLPATH~www.test.com=/
#POLLMETHOD~www.test.com=GET

########## PUAKMA CONFIGURATION FILE #################
#********* MAIN **********
#Determines what error messages etc will be displayed & in what language
LanguageFilePath=../config/msg_en.lang
SystemTempDir=../temp/
#TCP/IP host name
SystemHostName=mysite.ru
#LogDateFormat=yyyy-MM-dd HH:mm:ss
LogDateFormat=dd/MM/yyyy HH:mm:ss
LogFile=../logs/puakma.log
PuakmaClassPath=puakma.jar
PuakmaJDBCJarPath=../jdbc/
PuakmaAddInPath=../addins/
PuakmaLibPath=../lib/
SessionTimeout=60
MaxSessions=-1
LogSessions=0
NoDBLog=1
AddIns=puakma.addin.booster.BOOSTER
Authenticators=puakma.security.pmaDefaultAuthenticator
#valid SystemDebugLevels=0 to 5 (0=none, 5=everything)
SystemDebugLevel=5
IPExcludeFile=../config/ipexclude.config
AggressiveAntiHacking=0

#********* JDBC SETTINGS **********
# Note: Paths/urls are CaSe senSitive!
#*** for mysql ***
SystemDBName=puakma
SystemDBURL=jdbc:mysql://localhost:3306/
SystemDriverClass=org.gjt.mm.mysql.Driver
SystemUser=root
SystemPW=%%$%%74XyrN7AmJRM287BcUY6pg==

HTTPMimeFile=../config/mimetypes.config

#********* BOOSTER SETTINGS **********
BOOSTERPorts=80
BOOSTERPortTimeout=30000
BOOSTERPortBacklog=100
BOOSTERPollInterval=120
BOOSTERMaxThreads=400
BOOSTERMinThreads=40
BOOSTERThreadCreateTimeout=5000
BOOSTERShutdownWaitSeconds=3
BOOSTERMaxURI=1024
BOOOSTERLogNameFormat=yyyyMMdd
BOOSTERTextLog=../logs/boosterlog_*.log
BOOSTERCompressionLog=../logs/compress_*.log
BOOSTERUnavailableFile=../html_public/unavailable.html
BOOSTERgzip=0
BOOSTERCompressTypes=text/*,image/jpg,image/jpeg,*javascript*
#BOOSTERNoCompressTypes=text/xml
BOOSTERDebug=1
#BOOSTERReplaceHosts=www.puakma.net:8001,*:81,*:8001,*
BOOSTERReplaceHosts=*
BOOSTERSSLKeyRing=../config/selfcert.kyr
BOOSTERSSLKeyRingPW=%%$%%74XyrN7AmJRM287BcUY6pg==
BOOSTERHostConfig=../config/booster.config
#BOOSTERHeaderProcessors=NTLMLTPA
BOOSTERUseRealHostName=1
BOOSTERServerCacheMB=0
BOOSTERUseSharedCache=0
BOOSTERMaxgzipKB=512
BOOSTERMaxCacheableObjectKB=512
BOOSTERMaxCacheMinutes=1440
BOOSTERFixContentTypes=1
BOOSTERRemoveCacheInfo=1

WEBSSONotAuthMessage=You are not authorized to access this site
WEBSSOLDAPUser=
WEBSSOLDAPPW=
WEBSSOLDAPServer=ldap://webwise1/
WEBSSOSecretB64=BmnlHk3nM9r1mHxfuH4xs2ziXvc=
WEBSSOUseNTNameOnly=0
#WEBSSODomain=.puakma.net
SystemKey=bsTmaNA4s7MTI7CrlCk9V25S0wf3rXWdO82wibUm5vEyjDh/kViDQFeRSdopPldM

You don't need to include any path information as the browser's URI will supply that. The booster.config file supplies a host to host mapping.

HOSTS~websphere.net=websphere.net:10040

Brendon.

I have a win2003 server with puakma and wse 6.1 installed. WSE is listing on port 10040.

in booster.config I have this setting

HOSTS~websphere.net=websphere.net:10040/wps/portal

This give me the error:

13/07/2009 16:41:05: (I) BOOSTER listening on port 80  (SYSTEM - BOOSTERServer(80))
13/07/2009 16:41:07: (I) -- UNLICENSED - FOR NON-COMMERCIAL USE ONLY --  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
13/07/2009 16:41:07: (I) 1 servers are now available for websphere.sbr.cyso.net  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
13/07/2009 16:41:18: (E) Could not allocate a free thread. Waited 5000ms. 400 threads currently allocated  (SYSTEM - pmaThreadPoolManager)
13/07/2009 16:41:18: (E) Could not process the proxy request due to a threading error  (SYSTEM - BOOSTERServer(80))

Setting it to:

HOSTS~websphere.net=ibm.com

works OK

Thanks

The site that has the problem has got more than one Domain Controller. It has two.

I tried configuring Puakma ESSO to use both, but gave up. I ended up with having Puakma use just one of them.

Could my issue be related to that?

I will look into your other suggestions and questions....

Any hints on how to go about doing the keyring bit?

I noteiced that there was a file called keyring.kyr in one of the Puakma installation directories...

If this is "standard Java stuff" you are perfectly welcome to say so, preferably with a good link to a resource where I can read about it.

BOOSTERPorts=80,443SSL

The ssl suffix tells booster to treat the connection as secure rather than a 'plain' http connection. Note, you'll also need to set up the keyring etc to use the right certificate for your domain.

In most cases, it is not required to run SSL on the domino server as all connections are to the ESSO server and domino sits behind a firewall, but of course this is up to you.

If SSL is running on Domino, be sure to use the correct booster.config reference:

HOSTS~notestest01-sso=notestest01:443SSL

I have been trying different combinations of setup in booster.config and puakma.config. With not much success.

Domino is configured to allow SSL on port 443.

When accessing Domino through Puakma on port 80 everything works fine.

In puakma.config I have

BOOSTERPorts=80,443

In Booster.config I have tried this:

#notestest01
HOSTS~notestest01-sso=notestest01:80
FORCESSL~notestest01-sso=0
POLLPATH~notestest01-sso=/favicon.ico
POLLMETHOD~notestest01-sso=GET

I now let a browser point at:

https://notestest01-sso/mail/mail.nsf

The browser just times out.

if I go to:

http://notestest01-sso/mail/mail.nsf

I get through.

I would like to get the https-url to work. What to do?

2009-04-30 13:36:19: (I) BOOSTER Reverse proxy startup. Version 2.103.0  (SYSTEM - BOOSTER)

Thanks.

reload booster

from the server console.

I am wondering if my problem could be related to the bug that was fixed in ESSO version 2.105.0:

If a server set a far (eg 5 days) future expiry date that exceeded the maximum cache time, the "Expires:" http header would not honour the original expiry date set by the http server.

How do I see what version of ESSO the server is runnig?

If i look at http://sever/testsso I get a line saying this:

Server:   Puakma Enterprise Server Platform v4.1.0 Build:783 - 16 January 2008

Thanks!

From the above it sounds like the problem is with the one workstation? If so, try removing it from the domain and re-adding it, maybe this will reset its permissions within the domain.

Are you using NTLM or Kerberos as the authentication method?

What is the Windows server version and Windows client version? Is the version of Internet Explorer (I assume) the same as the other workstations?

I recently installed Puakma ESSO for a customer running Lotus Domino. They needed the seamles Single Signon.

It works just fine.

Except a couple of users are not getting through to the Domino Server.

In the puakma.log I see this error message:

2009-04-29 14:12:25: (E) ORG\USER: 0xC000006D DOMAINCONTROLLER/172.x.x.xx: jcifs.smb.SmbAuthException: Logon failure: unknown user name or bad password.  (SYSTEM - WindowsLTPA)

I have replaced selected items in the line above with dummy text.

The way I read this, the puakma ESSO does a check with the Domain Controller to see if the user should be allowed to access, and Puakama decides (based on the answer of the Domain Controller) that the user should not be allowed to enter.

There is some additional information.

The same user is also logged in with the same ORG\USER name from a different workstation on the same network. From that workstation he does get access.

I have had a look at the HTTP headers going back and forth between the browser and Puakma, and it looks like the handshake is proceeding like it should doing GET and getting a request to AUTHENTICATE a couple of times, where the last reply from the Puakma server is a negative (I don't have the exact reply text available right now).

I have an idea that the problem comes from the fact that the same user is logged in on a different workstation at the same time. I tried to then shut down both workstations and then starting up just the workstation that had the problem. No cure there.

I know that the workstation that has the problem is not a standard WIndows installation like most installations on the customer's site. My next theory is that the Domain Controller somehow has the workstation flagged as "tainted" somehow and that this could be the problem.

I need some suggestions on how to move on with handling the problem.

And I would also like to know a bit more about what the verification between Puakma and Domain Controller actually does.

What domino version are you running ?

Probably go for something like: 

HOSTS~www.seriousmowers.com=internal.seriousmowers.com

or (if the http server is on the same box as booster)

HOSTS~www.seriousmowers.com=www.seriousmowers.com:9000

There are 2 other sites running just on http which work fine through the web booster OK.  The site with the problems should be http up until when someone tries to add an item to a basket and goes to the checkout.  At this point it should switch to https.

I am not the web developer, I am setting up the web booster for DWA, but as this site has been built it would be really nice if I could route it through the web booster.

Any help really greatfully received as I am tearing my hair out now.  Thanks.

BOOSTERNoCompressTypes=application/xml 

or

BOOSTERNoCompressTypes=*/xml 

21/01/2008 12:23:03: (D) (22) POST /servlet/DWABuddyList HTTP/1.€1
Accept: */*
Accept-Language: en-gb
Referer: http://MAIL.SERVER.COM/mail/jsplatt.nsf/iNotes/Proxy/?OpenDocument&Form=s_BuddyList
Content-Type: application/xml
UA-CPU: x86
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; InfoPath.1)
Host: webmailuk.goodridge.net
Content-Length: 160
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: __utma=171024694.1008659655.1190646864.1194867161.1199458219.19; __utmz=171024694.1199458219.19.6.utmccn=(organic)|utmcsr=google|utmctr=goodridge.net|utmcmd=organic; LtpaToken=AAECAzQ3OTQ4ODQxNDc5NEMwODFDTj1Kb25hdGhhbiBTcGxhdHQvT1U9VUsvTz1Hb29kcmlkZ2UGQG82fhJ3+G8CZCp6C+ZjDPZVPQ==; ShimmerS=ET:20080121T155545%2c90Z&R:0&AT:M

BOOSTERUseRealHostName=1

Depending on the backend server, use a 0 or 1 to turn this feature on or off. 

I will open a link in the browser that is password protected ! 

http://domain/konto.pma/ManBuch?OpenAction&buchung=K 

for this link i need a password and username, is it possible to give the username and password in the link ? 

John

 John

The dates in HTTP headers are GMT (may explain the 1 hour difference).  If Booster finds an "Expires: " http header it checks to see if is a past date. If the expiry date is in the past, then it uses the current time plus 1 second as the expiry date. If the expiry date is valid and in the future, then it just uses that value.

If this is not working for you, can you:

a) check to se if the time on the booster server is correct

b) send me the http headers that domino is outputting so we can verify here that all is working as it should.

send to bupson -at- wnc.net.au 

I'm evaluating WebBooster for my company and have installed it on a Domino testserver. WebBooster will be used pimarily for one large web app and if tests are succesful will be rolled out to a dozen or so web servers used by different customers. The design of the web app includes a large number of static javascript libraries and images that are currently served from the domino\html folder. The application's start page for example includes about 50 images.

For performance reasons we recently configured the server (using site rules) to add far-future expires headers to those resources. That way, the resources are cached on the user's workstation and served from the cache until the expiry date. The browser doesn't even check on the server if the resource is different from the local version. This gave us quite an increase in performance (a lot less HTTP GET's to be performed an every request).

WebBooster however, seems to overwrite the expires header with a date/time that is approximately 1 hour before the time that the image was served to the browser.

Any thoughts on this? Is this by design? Can it be disabled for certain paths?

Thanks,

Mark 

 When trying to import the request.csr I go the following errors:

Syntax error in certificate

and next

 Type mismatch in methid ForAllInit: FROMVAR found, Unknown expected.

 I'm using jre1.6.0_03 and Notes/Domino 8

 Tried to generate a new keystore.kyr for DWA trying a post back from 2005 ( http://www.puakma.net/puakma/discuss.pma/item?ReadPage&ID=231 ) but it doesn't work. Could anyone help me out to create a working keystore.kyr?

Regards, Ronald 

If ESSO does a login (handshake and issuing of an LTPA token) remove any jsessionid cookie AND if WEBSSOjesssionidHome= is set then go to the URL specified there.

 I would suggest that you make it configurable wether it should do like that or not.

Sub Postopen(Source As Notesuidocument)
 
 Dim cookie As String
 Dim cookieSize As Long
 Dim flag As Long
 Dim httpServer as String
 
 httpServer = "http://portal-sso"
 
 cookie = String( 255 ,0)  
 cookieSize = Len( cookie )
 
 flag = InternetGetCookie( httpServer , Null , cookie , cookieSize )  
 If  flag = 0 And cookieSize > Len(cookie) Then
  cookie = String(cookieSize, Chr(0))   
  flag = InternetGetCookie( httpServer , Null , cookie , cookieSize )
 End If 

End Sub 

WEBSSOjsessionidHome=

This tells booster that if there is no jsessionid cookie and this parameter is specified, then redirect the user to the home URI. The issue I can see is that if you have an old jsessionid cookie (that is expired) and you access the home uri something like what you describe may happen. Perhaps upon Booster ESSO login we should always remove the jsessionid cookie?

I now get a portal page with this text: 

"Your portal session has timed out because of no activity. Please start a new session at your portal Home"

The funny thing is that your portal home is the URL I was trying to get at in the first place.

I now enter the same URL in the browser again and everything works like expected - I see the portal home page.

 I can now browse the portal like I want to. 

I now close my browser and open it up again and go to the same URL again. Works just fine.

I have this parameter set in my booster configuration file:

WEBSSOjsessionidHome=/wps/myportal

But from how I read the ESSO documentation, that parameter is for a special situation?

Is there a way of getting around this problem? 

Too bad. 

I suggest two possibilities:

1. the method call is not passing a large enough buffer to accept all the cookie data - are you catching the reply code for the method call? what is it? eg http://forums.microsoft.com/MSDN/ShowPost.aspx?PostID=1893982&SiteID=1 The ltpatoken cookie is pretty big ;-)

2. There is a bug in the MS code that somehow fails if one of the cookies is an in memory one. 

The browser user (MS IE) accesses the portal through Puakma ESSO.

In the application we hava a javascript that writes a cookie.

Inside a Windows application (Lotus Notes) we now read the cookie using the InternetGetCookie function supplied by wininet.dll (http://msdn2.microsoft.com/en-us/library/aa384710.aspx and http://msdn2.microsoft.com/en-us/library/aa385326.aspx).

The problem is that the InternetGetCookie function does not return the cookie.

If we don't access the Portal application through ESSO, we are able to access the cookie using the InternetGetCookie function.

So somehow it looks like ESSO does something to the cookie that makes InternetGetCookie unable to return it.

We have looked at what kinds of debug information is supplied for InternetGetCookie. It is extremely limited.

Any suggestions on how to fix this? 

Cookie content:
db
C12571390048947B
portaltest/
1088
3191320448
29882012
1551208816
29882004
*
view
0.Mapper%5CPr%20Nr
portaltest/
1088
3191320448
29882012
1551368816
29882004
*
unid
86C94C8E7D63D0B3C125714C0035FD30
portaltest/
1088
3191320448
29882012
1551368816
29882004
*

 Cookie content:
LtpaToken
2s4SA0l/Cn13mQkLE583Y30qxMcdFBCktowzY/oszDty3dXiBj+aQpjKkVfwARYumWBveg16x1kjoxElZ6RcyF27BFbchxgCct3V4gY/mkLjI2z27ygOBPbzRMtpjn0XFv1hk98OxsMsLweQu27x+4+2UPHReGHqgr1uHCKjuqGScKACMtS9ME1+vdheyjmeqhSYcUi7Xj5na3FY7VFi05UpPNvT2gCspSruYlfTpZlkbJ4IQqbncWEspXxMdplz5be4EYap3Yff/dHjKiW/FD4z/ZJC5o5Lf83oRmQMYSPDhBEYwC2O7EhHzCPh1kxZXrW02oFk+49vPLFkXISlCoTKtmrD4iLXGOqF69eEFe0=
portal-sso/
1024
3433217280
29882070
3480086112
29882003
*
db
C12571390048947B
portal-sso/
1088
2021320448
29882012
387458816
29882004
*
view
0.Mapper%5CPr%20Nr
portal-sso/
1088
2021320448
29882012
387458816
29882004
*
unid
86C94C8E7D63D0B3C125714C0035FD30
portal-sso/
1088
2021320448
29882012
387618816
29882004
*

http://www.google.com.au/search?hl=en&q=ie6+post+ssl&btnG=Google+Search&meta=

I believe MS has a patch to fix the issue. 

Any idéas?

/Christer 

We're keep getting this error continously in the puakma.log:

-------------------------------------------
08/06/2007 11:21:48: (E) BOOSTERTransferWorker run(): javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake  (193.14.107.65 - BOOSTERreq (443))
08/06/2007 11:21:48: (D) 0 class=com.sun.net.ssl.internal.ssl.SSLSocketImpl method=readRecord line=742
1 class=com.sun.net.ssl.internal.ssl.SSLSocketImpl method=performInitialHandshake line=1030
2 class=com.sun.net.ssl.internal.ssl.SSLSocketImpl method=readDataRecord line=678
3 class=com.sun.net.ssl.internal.ssl.AppInputStream method=read line=75
4 class=java.io.BufferedInputStream method=fill line=218
5 class=java.io.BufferedInputStream method=read1 line=256
6 class=java.io.BufferedInputStream method=read line=313
7 class=java.io.FilterInputStream method=read line=90
8 class=puakma.util.ByteStreamReader method=readLine line=137
9 class=puakma.addin.booster.BOOSTERTransferWorker method=readLine line=558
10 class=puakma.addin.booster.BOOSTERTransferWorker method=readHeaders line=577
11 class=puakma.addin.booster.BOOSTERTransferWorker method=run line=129
12 class=puakma.addin.booster.BOOSTERRequestManager method=run line=135
13 class=puakma.system.pmaThread method=run line=118
  (SYSTEM - pmaSystem)
08/06/2007 11:21:48: (D) Attempting to use host:[192.168.252.8] port:443  (193.14.107.65 - BOOSTERreq (443))
08/06/2007 11:21:48: (E) BOOSTERTransferWorker run(): javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake  (193.14.107.65 - BOOSTERreq (443))
08/06/2007 11:21:48: (D) 0 class=com.sun.net.ssl.internal.ssl.SSLSocketImpl method=readRecord line=742
1 class=com.sun.net.ssl.internal.ssl.SSLSocketImpl method=performInitialHandshake line=1030
2 class=com.sun.net.ssl.internal.ssl.SSLSocketImpl method=readDataRecord line=678
3 class=com.sun.net.ssl.internal.ssl.AppInputStream method=read line=75
4 class=java.io.BufferedInputStream method=fill line=218
5 class=java.io.BufferedInputStream method=read1 line=256
6 class=java.io.BufferedInputStream method=read line=313
7 class=java.io.FilterInputStream method=read line=90
8 class=puakma.util.ByteStreamReader method=readLine line=137
9 class=puakma.addin.booster.BOOSTERTransferWorker method=readLine line=558
10 class=puakma.addin.booster.BOOSTERTransferWorker method=readHeaders line=577
11 class=puakma.addin.booster.BOOSTERTransferWorker method=run line=129
12 class=puakma.addin.booster.BOOSTERRequestManager method=run line=135
13 class=puakma.system.pmaThread method=run line=118
  (SYSTEM - pmaSystem)
-------------------------------------------

We're using SSL both  to the client and to the domino server.

Is this error caused by the SSL handling in Web Booster or by firewalls between the client and Web Booster?

Thanks,

/Christer 

I sent you an e-mail with an Excel file (m0.xls) that I used during my tests.

Thanks a lot,

Eduardo

efreitasrj@gmail.com 

/Christer 

Thanks again for your response and attention.

Actually when I first installed Booster it was not compressing XLS files at all. I read the manual and did exactly what you described in your post. 

I am examining the Domino response in Firefox and Internet Explorer using Firebug and Fiddler. The original file, was 1MB in size. When I changed the parameters above to compress application/vnd.ms-excel, I can see that Web Booster is serving the file with a slight compression, dropping the file size to around 900kb. The response headers prove that the file has been gzipped.

When I use the servlet code that I sent you, I get the same gzipped response but with 300kb ! 

If you are also using GZipOutputStream in your code, I'm not quite sure where the problem is... Jdk version, maybe ??

My Web Booster version is  2.98, which I think is failry recent...

Any ideas ?

Sorry for all the trouble. 

Eduardo 

BOOSTERCompressTypes=text/*,image/jpg,image/jpeg,*javascript*,application/vnd.ms-excel

Also ensure BOOSTERNoCompressTypes= is either commented out (disabled) or does not include the excel types. 

I found some old servlet code and adapted it to work with Excel files (the code is very specific in regard to the response type, although it could easily be adapted to other types of file). It uses the java.util.zip class and was compiled under jdk1.5.0_08. When I access my XLS file using this servlet, the compressed gzip file served is 290kb as opposed to the 1MB original file and the 900kb Puakma web booster compressed XLS file.

I'd love to use Puakma but it would have to be good at binaries too. What I don't understand is why is Puakma is  great on compressiong Javascript and HTML and performs so poorly when it comes down to binary...

Here is the servlet's source code. Do you see any particular difference in it that would make it behave so differently from Puakma's compression ?

********************************************** 

import lotus.domino.*;

import java.io.*;
import java.util.*;
import java.util.zip.*;
import java.lang.*;
import javax.servlet.*;
import javax.servlet.http.*;

/**
 * A servlet example of a method by which
 * attachments are always downloaded by
 * the browser
 *
 * Creation date: (4/6/2002 1:25:45 PM)
 * @author: Jon LeDrew
 */
public class GzipAttach extends javax.servlet.http.HttpServlet {
   
/**
 * Process incoming HTTP GET requests
 *
 * @param request Object that encapsulates the request to the servlet
 * @param response Object that encapsulates the response from the servlet
 */
public void doGet(javax.servlet.http.HttpServletRequest request,javax.servlet.http.HttpServletResponse response) throws javax.servlet.ServletException, java.io.IOException {

    ServletOutputStream op;
    InputStream is;
    BufferedInputStream bis;
    String unid;
    String filename;
    String dbpath;

    try {

    //request parameters Notes UNID, Attachment Filename and the Database Path.
        unid        = request.getParameter("unid");
        filename    = request.getParameter("filename");
        dbpath      = request.getParameter("dbpath");

        /***************************************************************
        public boolean getAttachment obviously returns a boolean value
        and sets the private BufferedInputStream bis if the db, doc and attachment are found
        ***************************************************************/
        bis = getAttachment(unid, filename, dbpath);

        if (bis != null) {

            int bytesA = bis.available();
            //the size of the attachment. no. of bytes

            byte [] attachment = new byte[bytesA];
            //create a new byte array specifying the size the same as the size of the attachment

            response.setContentType("application/vnd.ms-excel");
            response.setHeader("Content-Encoding","gzip");
           
            op = response.getOutputStream();
            GZIPOutputStream gz=new GZIPOutputStream(op);
            //set the response details

            while (true) {
                int bytesRead = bis.read(attachment, 0, attachment.length);
                if (bytesRead < 0)
                    break;
                    gz.write(attachment, 0, bytesRead);
        }
            //read the BufferedInputStream into the byte array
            //write the array to the ServletOutputStream

            //clean up
            bis.close();
            op.flush();
            gz.close();
            op.close();
        } else {
            //Send an error if getAttachment returns false.
            response.sendError( response.SC_INTERNAL_SERVER_ERROR,
                    "Could not find the specified attachment - <a href=\"/"
                        + dbpath + "/0/" + unid + "/$file/" + filename + "\">" + filename + "</a>" );

            /**************************************************************
            If custom error messages are required.
            response.setContentType("text/html");
            pw = response.getWriter();
            pw.println("Error");
            **************************************************************/
        }
   
    } catch (IOException e) {
        response.sendError( response.SC_INTERNAL_SERVER_ERROR,
                    "An IO error ocurred while trying to retrieve file" );
        //e.printStackTrace();
    }
}
/**
  * Creation date: (4/6/2002 1:30:20 PM)
 * @return boolean
 */
public BufferedInputStream getAttachment(String unid, String filename, String dbpath) {

    InputStream is = null;
    BufferedInputStream bis = null;
    NotesThread nThread = new NotesThread();
    //New instance NotesThread

    try {
        nThread.sinitThread();
        Session sess = NotesFactory.createSession();

        /*************************************************************************
        This method creates a Notes Session.  This method uses the local user config if the server is 'local'
        and uses the server permissions if the database is referenced on a server.
        Use Session sess = NotesFactory.createSession((String) null,ID,Password);
        where ID and Password are valid values for a users internet name and password
        *************************************************************************/

        Database dwnldsrvlt = sess.getDatabase(null, dbpath);

        /*************************************************************************
        Set dwnldsrvlt using Session's getDatabase method.  getDatabase(String server, String dbpath)
        null indicates that the session environment is to be used.
        *************************************************************************/

        if (dwnldsrvlt.isOpen()) {
            Document doc = dwnldsrvlt.getDocumentByUNID(unid);
            if (doc != null) {
                EmbeddedObject em = doc.getAttachment(filename);
                if (em != null) {
                    is = em.getInputStream();
                    bis = new BufferedInputStream(is);
                    if (sess != null){
                        sess.recycle();
                    }
                }
            }
        } else {
            dwnldsrvlt.open();
            Document doc = dwnldsrvlt.getDocumentByUNID(unid);
            if (doc != null) {
                EmbeddedObject em = doc.getAttachment(filename);
                if (em != null) {
                    is = em.getInputStream();
                    bis = new BufferedInputStream(is);
                    if (sess != null){
                        sess.recycle();
                    }
                }
            }
        }
    } catch (NotesException ne) {
        /****************************************************************
    Exception caught if the database or document aren't found.
        Returning false executes the finally clause and terminates the NotesThread.
        pw.println(ne.id + " " + ne.text); for custom messages on failure to find the db, doc or
        the attachment.
        ****************************************************************/
    ne.printStackTrace();
           
    } catch (Exception e) {
    e.printStackTrace();
               
    } finally {
        nThread.stermThread();
        //Terminate the thread.
        return bis;
    }
}//end getAttachment
}
 

Thanks,

/Christer

By default browsers only accept gzip or deflate as built in compression algorithms. See the http "Accept-Encoding: gzip,deflate" header sent by most browsers.

Thanks,

/Christer 

Is there anything that I can do to increase this ratio, even  if at server's performance decrease ?

Thanks in advance.

Eduardo de Freitas
efreitasrj@gmail.com

HTTPMaxURI=1024

You will most likely get the error:

414 "Invalid Request, URI too long" 

String sChoiceArray[] = new String[]{"s1", "s2", "s3"};
ActionDocument.setItemChoices("YourField", sChoiceArray);

StringBuffer sHTML = hdi.getHTML(false);
//sHTML is the html required to make the combo box, this can then be put in a computed field on a page.

//you can also change the name of the field dynamically:
hdi.setName("NewFieldName");

Alternatively you can also use a temporary document rather than ActionDocument, eg:
HTMLDocument docTemp = new HTMLDocument(pSystem, pSession); 

If the poll times out, I suggest that you allow for a second or even a third try before flagging the host down. This of course could be configurable. 

In the experience of my customer - using Nagiros for general server availability-checking - HTTP just is not very reliable. Therefore a re-check would probably be a good idea.

You say that the setting controls the timeout between the browser and booster and booster and the host.

The poll happens from the booster to the host. So unless you have actively chosen that the poll timeout should follow its own rules, the poll timeout aught to be the same as is configured in  BOOSTERPortTimeout.

If you have the poll timeout set to be different from the BOOSTERPortTimeout, what is the timeout?

BOOSTERPortTimeout= controls the timeout between the browser and booster and booster and the host, not the poll timeout. 

I saw that you had a somewhat similar discussion here: http://www.puakma.net/puakma/discuss.pma/item?ReadPage&ID=360

From that thread I can see that you made a change to Booster. What change was that?

As to my problem, it looks like the myhost that Booster is boosting sometimes isn't replying - either it's too slow or the reply must be malformed.

How long does Booster wait for a reply? I expect that it' the puakma.config setting:

BOOSTERPortTimeout=30000

Is that milliseconds?

 I could try and turn that value up.  Actually I will try that out and see if that works better.

BOOSTERPollInterval=120

This is the number of seconds between polling events.

Polling is important because Booster needs to know if a host is up or not so that requests are not sent to a host that is unavailable.

The POLLPATH is the URL on the backend server that is retrieved, so / would just get the default page for that host. We recommend making a small text file (or similar, eg /poll.txt) to ensure the processing overhead for polling is very small.

POLLMETHOD sets the HTTP method used for retrieving that file. HEAD will instruct the host to return only the http headers and no content, reducing processing overhead and network I/O.

We can probably adjust the polling process logic, we just need to know a little more about your issue. 

In Booster.config there is a couple of lines that have to do with polling:

POLLPATH~myhost=/
POLLMETHOD~myhost=HEAD

What happens if I leave out these two lines? Will it stop trying to poll?

I am asking because myhost sometimes have short periods where it is unavailable, but when Booster polls at such a time, it will flag myhost as unavailable for x secoonds (puakma.config variable controls how long).

I would probably prefer if booster did not poll that particular host.

Have you got any other suggestions as to how to handle the problem that I have (excluding doing something to make sure myhost is up all the time :-))?

 I would like to know when it would be a good idea to use HEAD, POST etc. in the POLLMETHOD.

Thanks!

To enable load balancing, you need:

WINDomainName=YOURDOMAIN
WINDomainLoadBalance=1

This is only relevant for NTLM authentication. 

If yes - what is the syntax?

I would expect it to be like this:

windomaincontroller=hostname1,hostname2

I have configured an ESSO server like that and it runs, but I don't know if it is actually using both Windows Domain Controllers.

BOOSTERMaxURI=1024

This is a precaution to prevent buffer overflow attempts. Default is 512

But I see a problem that looks like it comes from portlet URLs that are long. 

I am talking about the URLs that are used inside portlets for triggering a reload of the portal page, causing one or more portlets to react on what was clicked. These URLs tend to always be extremely long.

When I click the longer ones, the browser (Internet Explorer) instantly reports a "Cannot find server" (Window title) and "The page cannon be displayed".

I have had a look at what's going on using IEHTTPheaders. It looks like the browser removes some characters from the end of the URL.

It also looks like the browser fires two GET commands.

Finally - I have done a tell booster debugheaders on - I can see that when I do click one of these URLs, booster apparently doesn't even receive the GET from my browser.

Any suggestions? 

I found that changing the puakma.config parameter WEBSSOLDAPRealm was important.

At first it was like this - the default:

WEBSSOLDAPRealm=localhost\\\389

Then I changed it to this:

WEBSSOLDAPRealm=myldapserver.mydomain.com\\\389

This got me from not being signed on to being signed on. Which of course was a lot better than before.

I would like to know some more about how to use this parameter and its syntax. 

Great support as always - thanks :-) 

For more information on the IE6 behaviour, please see http://www.websina.com/bugzero/kb/browser-ie.html

We had some code in there to work around this issue but is for some reason broken. We will supply an update for you to test - let us know how you go. 

Internet Explorer <-> Puakma ESSO <-> MS Internet Information Server version 6
The ESSO version is very recent.

What we want is for an ASPX page located on the IIS to be able to retrieve the Domino LTPAtoken and then access Domino data using that token.
This works - we are seeing it working.

So, what is the problem?
Bascially when we do POST to the IIS through the ESSO, some of the NTLM handshaking is forwarded to the IIS. The IIS tries to do the handshaking, but somewhere in the communication ESSO, IIS and the IE client get confused.
When we do a GET we don't see this issue because IE does not try to do the NTLM handshake again.

By the way - we are using Wireshark to do packet sniffing on the server running Puakma ESSO in order to see what is going on.

I will try with a bit more detail for you:
We have a page on the IIS server. An aspx page. Bascially what it does is it looks for the LTPAtoken in the HTTP request from the browser user, it then includes that token when requesting data on a Domino server, thereby impersonating the Internet Explorer user. The page then build a return page that is displayed to the user.
The first time we access this aspx-page we do a GET. http:/server/pages/page.aspx.
No problems this far.

The page that is returned includes a button, and in the HTML we have a FORM tag. The button does a submit of the page - a POST. We are still located at the same URL - http:/server/pages/page.aspx.
And it is when we do the submit that we see the problem. It's odd.
The HTTP header of the POST request from Internet Explorer contains the LTPAtoken of course. But for some reason it also contains a "field" (by field i mean a HTTP header part just like the session cookie "field") with NTLM handshaking data.
The NTLM handshaking data that is included is exactly the same data that we have seen as part of the _initial_ NTLM hanshake. It's like the browser "thinks" "I'm doing a POST and I can see that earlier on I did a NTLM handshake, so just to make sure, I will re-initiate a hanshake".
So, what happens when ESSO gets this HTTP request. First it participates in the handshaking with IE. It starts requesting IE for more NTLM handshaking data and gets some, but then it looks like ESSO discovers that the request already contains a LTPAtoken, and it therfore decides to forward the POST to the IIS - _including_ the NTLM handshake data. And that's what makes things come apart - that the ESSO forwards the NTLM handshaking data. I don't have the details here, but it ends up with the IE timing out.

For debugging purposes we have also tried to include a simple link on the aspx page in question. One that leads from the first page to a second page on the IIS (GET). If we click such a link, we don't see the behaviour I describe above. Not NTLM handshake data is included ind the HTTP request, and everything works fine.

To me the obvious request would be for a way of configuring ESSO to not forward/proxy NTLM handshakes or to configure that specific HTTP header "fields" should not be forwareded/proxied.

Thanks for your suggestion. We tried clearing the cache and ctrl-refresh but without success. We went to Tools.Internet Options.Delete Files & Delete Cookies, let me know if this is not what you meant.

We have had a look using an HTTP debugger, it seems like the request doesn't even get to web booster and also because it happens so quickly. It works Ok however without Web Booster switched on.

Dominic

We have an application that we are looking to use with WeBooster. We have carried out a number of tests and have an outstanding issue that maybe someone has had before.

HTTPS with Web Booster & Domino works fine on some machines, but on others we get Page Not Found errors + javascipt Object/Field not found. The Javascript errors occur independently of the Page Not Found error. The errors occur in the same place in the application.

* 2 out of 4 test machines have no problems, the other 2 do.
* HTTP with webbooster & Domino works fine on all machines.
* HTTPS with just Domino, and no Web Booster works fine.
* We still get the problem when setting Domino & Web Booster to communicate via HTTP, and Web Booster listening on SSL.

On my machine I cannot get the errors to display although I did manage it once about a week ago.

I have debugging and header debugging switched on and at level 5 and no errors reported. I have switched off compression with BOOSTERgzip=0 and caching with BOOSTERServerCache=0, the problems still occur.

Any help much appreciated,

Thanks

Dominic

- Have Puakma handle all incoming requests on set BOOSTERPorts=80,443SSL in booster.config file
- Turn off SSL entirely on Domino.
- Force Puakma to redirect all HTTP traffic to SSL (which is what I want)- is FORCECLIENTSSL~*=1 now an option?

 So assuming this works, can I use my existing keyfile.kyr and.sth files? do I need to use the keytool.exe utility? 

I've seen this link http://www.puakma.net/puakma/discuss.pma/item?ReadPage&ID=231  but I don't think it applies to me or does it?

Thanks.

-Adam

I would like Webbooster to handle all incoming HTTP and SSL requests.  I am really only interested in Webbooster's GZIP compression and don't care if it handles the SSL encryption calculations or Domino does.

I already have Domino running SSL with keyfile.kyr and keyfile.sth files.

I am confused by the documentation and some of the discussion on this forum.

I know I have to have Domino use different ports for HTTP and SSL.  So assuming I change Domino's HTTP port to run on 8001 and SSL to run on 8002 - what steps do I have to do to get Webbooster to work?

Do I have to create new keyfile files for Webbooster to use?  (I've seen references to this in this forum - but not sure if this applies to my situation).  Could someone let me know the correct settings in the config file?

I put in

WEBSSOLtpaCharSet=CP850

Now his name looks like it should and group membership is computed like it is supposed to.

Thanks!

I love your response time Brendon :-)

tell booster debugheaders on

should tell you what's what. If you can paste the web server reply here that would help us see what's going on. 

WEBSSOLtpaCharSet=Xxxx

 Where Xxxx is the new Java charset to use. Check your config file and remove this line if it exists.

Authentication works fine. I ACL-protected Domino resources through the booster server.

I have a user who has a Common Name component that contains a national character.

For this user I see a problem with the name that Domino now sees:

The user does get a LTPA token. But when I display a Domino page containing @Name([abbreviate]; @UserName), the name displayed contains a different character than the national one that is supposed to be a part of his name.

Also, if i use @UserNamesList, I don't see all the groups that the user belongs to, but only * and */=Organisation.

I have installede the Java SDK, I was using just the JRE before - it doesn't change anything.

I access a Domino server version 7 through the booster.

When I access a regular Domino page like names.nsf, I authenticate and get the expected result.

When I access a servlet on the Domino server from a browser I don't  get what I Expect.

The servlet is supposed to returns XML.

If I access the servlet directly without involving booster, I do get  the expected XML.

If I access the servlet through booster, the browser (MS-IE) displays an error page saying "The XML page cannot be displayed" and "XML document must have a top level element".

I have installed Ethereal on my booster server in order to see what is going on. Here is what I see:

The NTLM-handshaking works fine, and the browser moves on to GET the servlet URL including the LTPA token. 

The servlet returns a package including the HTTP 200 OK status. But this package contains no XML.

After this the booster receives two packages from domino containing "Continuation or non-http traffic"  according to Ethereal. These packages are HTTP packages, and when I look inside the packages, I see the XML that I was expecting to see in my browser.

All in all booster receives three packages from Domino. The HTTP 200 OK and the two Continuation packages.

Here's the puzzle: Booster only forwards the first HTTP 200 OK package to the browser. The two continuation packages are dumped.

Any advice? 

 Waaahhh!  :-)  Thank you very much indeed, sadly I've never received it.  I guess it may have ended up in the spam folder which gets nuked.  Would you be able to resend it please?

 Many thanks

 Steven

 Is this something that can easily be done with Web Booster?

 Thanks in advance

 Steven

-Dnetworkaddress.cache.ttl=10
-Dsun.net.client.defaultConnectTimeout=10000

Change the defaultConnectTimeout to suit your needs (value is in milliseconds) 

One thing that became quickly apparent was our connection to the net was maxed out :-( Tornado was chugging along happily serving up the content, but trying to squeeze it through a small pipe. We need more bandwidth.....!

There are a few things happening locally here with our ISP and we should be being upgraded to a faster connection in a couple of weeks.

Please bear with us until we get the bigger pipe....

 When booster detects the http server has fallen over/stopped currently booster still serves up a html page.  If the LoadBalancer on the front is pointed towards web booster to obtain a heartbeat then it still believes there to be a valid http server available and will still continue to direct traffic to this web server.

Ideally what should happen is that when the http server that web booster is sat in front of disappears then web booster should not serve anything. 

This in turn will allow the load balancer to recognise the http server has failed and will not direct traffic to the http server that has fallen over/become unavailable.

Adding this would be very useful in a clustered environment with load balancer sat on the front.

Thanks in advance

Steven J McCormick

So to summarize: When booster detects no available hosts in its cluster you want booster to drop the connection.

...or to return a specific http error code? 

Using the pollmethod and pollpath config option in web booster it can be determined whether the underlying domino http task is running or not.  However webbooster still returns a html page if the server is down. If there is a load balancer on the front of this which itself is polling web booster it will never know that the domino server is down or not as its getting a response back from web booster.

 Is there a way around this per chance please?

Thanks in advance

Steven

I recommend either a) creating a new database for testing and adjusting the dev copy's data connection to point to it (this is best option - the dbname also won't get clobbered in a design refresh). b) is to leave the connection the same as production so you have two versions of the app (dev and prod) pointing to the same data source. The danger with this approach is that you may"accidentally" destroy the production data during your testing so use this approach with caution!

The simplest approach is usually the best :-) 

What would be your recommended approach to having the development copy access different tables?

I thought the following:

Create a keyword called myTable and give it a value say myTableName
When I want to create a TableManager object I then use

TableManager t = new TableManager(pSystem, pSession, null, pSession.getKeywordValue("myTable"));

Now I can set the keyword value to be different in my prod and dev apps - therefore use different tables.

To upgrade SOAPDesigner:

- In your browser go to http://yourtornadoserver.com/system/webdesign.pma
- Click on system/SOAPDesigner
- Go to Application Settings and change the name (or delete it)
- Click File > Import and import a new system~SOAPDesigner.pmx
- The new code will be imported and new widgets automatically started

The above process is the same for all web apps (only trick is the webdesign app - make sure you rename it rather than deleting it!!). We don't currently have the ability to do an "in place" refresh but this is something we (or the OS community :-) ) will probably do down the track. 

I downloaded the complete Vortex IDE and I'm trying to connect to Tornado, but I'm getting a "Java NullPointerException" error in the "Open Application" dialog box when I select my server's connection parameters (localhost with the standard sysadmin user and password.)

Any suggestion as to what to do about that error? I've tried running with JRE 1.4.2_11 and 1.5.0_07, but same results.

Also, how am I supposed to update the SOAPDesigner.pmx file on the server?  I saw a reference to using the "system\webadmin" application, but I don't see a way to "replace" the design of the SOAPDesigner.pma that's already installed with Tornado.

I'm a Domino developer here in the US and I've been looking for a product that has similar features, only works better for web development.  I'm considering launching an ISV and need a better tool than Domino to deploy applications.

I think the move to Open Source is a great idea -- you'll recover revenue with a significantly greater demand for consulting services! 

The above will produce the equivalent of: <a href="JavaScript:editCostCode('24');">CostCode Name&nbsp;</a> 

<xsl:attribute name="href"><xsl:value-of select="/data/@path"/><xsl:text>/dlgWork?OpenPage
&amp;id=</xsl:text>

However, my dlgWork page is a "pseudo dialog box" that I want opened with certain attributes - size, width, etc. I normally open this page via javascript passing the appropriate parameters.

Is it possible to call the javascript fuction from the XSL stylesheet?

The new features you requested have been implemented and emailed to you.

 Brendon

A host based scenario is easier to manage (and code!), but the URI approach will provide more flexibility.  

Just had a quick look at the config settings are there doesn't seem to be a setting to force that. It looks like a fairly easy tweak, so I will send you a new puakma.jar. AT this stage I think the best option is a new setting in booster.config, probably something like FORCECLIENTSSL~*=1 which will tell booster to redirect the browser client to use SSL for communications.

Note that there is also the ability to write your own java class which extends HTTPHeaderProcessor and load that in puakma.config (BOOSTERHeaderProcessors=YourCustomClass) This header processor then has the ability to intercept (and redirect) the requests before Booster.

All communications is based on SSL. User is automatically redirected to SSL when start the session via HTTP (set in Domino – Server Document, Ports, Internet Ports, Web, TPC/IP port status: redirect to SSL

Target situation:

Domino is running HTTP without SSL and data are first packed by Web Booster and next is encrypted by Puakma. (shortly: Domino <-HTTP-> Web Booster <-HTTPS-> Browser)

Question:

How redirect session from HTTP to HTTPS automatically on Puakma (similar function as on Domino: redirect to SSL). 

Comment: When user start session with manually written prefix HTTPS, cummunication is run as expect. I need only automatic redirection from http://targetserver.com to htttps://targetserver.com

Thank you in advance for tips.

Petr 

Once installed it's very easy to edit puakma.config to make any system changes. You may need to tweak pmastart.sh to point to the correct version of Java if it's not in the path. 

HTTPGenerateETags=0 

When any user accesses a resource on Domino, they doen't get authenticated. 

I get the following lines in puakma.log. What could the NullPointerException be?
 

05/04/2006 17:06:19: (D)  HTTPHeaderProcessor: WindowsLTPA  (10.1.69.1 - BOOSTERreq (8080))
05/04/2006 17:06:19: (E) customHTTPHeaderProcessing() java.lang.NullPointerException  (10.1.69.1 - BOOSTERreq (8080))
05/04/2006 17:06:19: (D) 0 class=java.util.Hashtable method=put line=-1

HOSTS~*=10.100.105.2:443SSL

We have several applications that execute DBLookups against the Domino NAB. Since we have been using WebBooster these have failed. I am presuming these lookups are failing because WebBooster is talking via http to Domino (the only host mapping available in the booster.config file).

How can we get WebBooster to talk to Domino via SSL or am I missing something?

We have created a public "sandbox" server for you to play with. The idea being you can use this server to see what Tornado is all about. You have rights to do everything. I realise some will use this for evil so we'll monitor the usage and turn it off if it is abused. We will like restart the instance every couple of days back to a fresh install.

You can access it at: http://sandbox.puakma.com 
Login: sysadmin
Password: password

You can also connect to this using Vortex. Have a play and let us know what you think!

I was excluding XML from being compressed.

Thanks.

Domino is version 7.0.

I am using Web Booster for traffic boosting, not Single signon.

If I access a  Domino Web Access database file from a web browser (MS-IE) that has not accessed the file before, I am unable to install the DWA ActiveX component.

If I access DWA from a client that has the ActiveX component installed, I experience sluggishness. For instance, If I want to use "reply to sender", i takes upt to 5 seconds to load the page. I am on a 100 Mbit network with no users.

If I access DWA directly without the Web Booster doing traffic boosting, the same page will load in just 1-2 seconds.

If I access the Inbox, it takes perhaps 10 seconds to load.

If I load the Inbox directly without the Web Booster, the page will load in 2-3 seconds.

It is not a server having performance issues. RAM and CPU useage is extremely low while I am accessing DWA.

Any suggestions? 

To install it, fire up your browser http://yourserver/system/webdesign.pma (or use Vortex). Then pick File > Import. locate the pmx and upload it. 

It is also quite likely customers are yet to upgrade to the latest shipping version, so if I know the version being run I can tell easily whether an upgrade to a newer puakma.jar will fix the issue. 

The latest version of Booster will be released shortly.

The latest version available for download appears to be 2.70, the changelogs you reference mention 2.93?  Confused. :-)

Thanks in advance,

Steven.

we have an interesting problem with web booster removing the file attachment from a post when the file size is small. For file > approx 15K of PDF format the upload is always sucessfull. Anything smaller and the file is "lost" by web booster. We are aware of this problem http://www.modwest.com/help/kb2-260.html. Our web booster config files are below:

Thanks in advance for your help, Ian.

########## BOOSTER CONFIGURATION FILE #################
#
# This file controls how the reverse proxy task resolves
# host requests. This allows multiple hosts to sit behind
# the BOOSTER.
# Once the file is changed, the server must be restarted.
#
#
######################################################

#Default if server not specified
HOSTS~*=gblond088sg4:8080
FORCESSL~*=1
FORCESSL~gblond088sg4=1
#FORCESSL~euocn11.nl.eu.abnamro.com=1
#FORCESSL~euocn12.nl.eu.abnamro.com=1
POLLPATH~*=/test.GIF
POLLMETHOD~*=HEAD

#Specific server mappings
#HOSTS~www.test.com=www.puakma.net:8001
FORCESSL~ocean.nl.eu.abnamro.com=1
#POLLPATH~www.test.com=/
#POLLMETHOD~www.test.com=GET

#For cluster config, assumes nodes are identical
#HOSTS~mail.test.com=www.puakma.net:81,www.puakma.net:82,www.puakma.net:83

########## PUAKMA CONFIGURATION FILE #################
#
# This file controls how puakma behaves and is required for
# successful system operation.
# Before making any changes to this file, please make a backup.
# Once the file is changed, the server must be restarted.
#
# The paths in this file assume execution from the /bin/ dir
#
#
######################################################

#********* MAIN **********
#Determines what error messages etc will be displayed & in what language
LanguageFilePath=../config/msg_en.lang
SystemTempDir=../temp/
#TCP/IP host name
SystemHostName=gblond088sg4
#LogDateFormat=yyyy-MM-dd HH:mm:ss
LogDateFormat=dd/MM/yyyy HH:mm:ss
LogFile=../logs/puakma.log
PuakmaClassPath=puakma.jar
PuakmaJDBCJarPath=../jdbc/
PuakmaAddInPath=../addins/
PuakmaLibPath=../lib/
SessionTimeout=60
MaxSessions=-1
LogSessions=0
NoDBLog=1
AddIns=puakma.addin.booster.BOOSTER
Authenticators=puakma.security.pmaDefaultAuthenticator
#valid SystemDebugLevels=0 to 5 (0=none, 5=everything)
SystemDebugLevel=0
IPExcludeFile=../config/ipexclude.config
AggressiveAntiHacking=0

#********* JDBC SETTINGS **********
# Note: Paths/urls are CaSe senSitive!
#*** for mysql ***
SystemDBName=puakma
SystemDBURL=jdbc:mysql://localhost:3306/
SystemDriverClass=org.gjt.mm.mysql.Driver
SystemUser=root
SystemPW=password

HTTPMimeFile=../config/mimetypes.config

#********* BOOSTER SETTINGS **********
BOOSTERPorts=80,443SSL
BOOSTERPortTimeout=3600000
BOOSTERPortBacklog=100
BOOSTERPollInterval=10
BOOSTERMaxThreads=400
BOOSTERMinThreads=40
BOOSTERThreadCreateTimeout=5000
BOOSTERShutdownWaitSeconds=3
#BOOSTERMaxURI=512
BOOOSTERLogNameFormat=yyyyMMdd
BOOSTERTextLog=../logs/boosterlog_*.log
BOOSTERCompressionLog=../logs/compress_*.log
BOOSTERUnavailableFile=/puakma/html_public/unavailable.html
BOOSTERgzip=1
BOOSTERCompressTypes=text/*,image/jpg,image/jpeg,*javascript*
#BOOSTERNoCompressTypes=text/xml
BOOSTERDebug=0
#BOOSTERReplaceHosts=www.puakma.net:8001,*:81,*:8001,*
BOOSTERReplaceHosts=*
BOOSTERSSLKeyRing=../config/selfcert.kyr
BOOSTERSSLKeyRingPW=password
BOOSTERHostConfig=../config/booster.config
#BOOSTERHeaderProcessors=NTLMLTPA
BOOSTERUseRealHostName=0
BOOSTERServerCacheMB=256
BOOSTERUseSharedCache=0
BOOSTERMaxgzipKB=2048
BOOSTERMaxCacheableObjectKB=1024
BOOSTERMaxCacheMinutes=1440
BoosterCacheContentTypes=image/*,*javascript*,text/css
BoosterFixContentTypes=1

WEBSSONotAuthMessage=You are not authorized to access this site
WEBSSOLDAPUser=
WEBSSOLDAPPW=
WEBSSOLDAPServer=ldap://webwise1/
WEBSSOSecretB64=BmnlHk3nM9r1mHxfuH4xs2ziXvc=
WEBSSOUseNTNameOnly=0
#WEBSSODomain=.puakma.net

BOOSTERMaxURI=999

where 999 is the number of bytes you want to accept. This is a security feature in Booster to stop attempted buffer overflow exploits by malicious web clients. 

Take a look also in the Domino Security handbook: sg247017.pdf (from the IBM site) 

Change the http port that each domino instance listens on to (for example) 81.

Install booster and have it listen on port 80 (should be in the default install), it will also listen on all available network cards

Edit the [install_dir]/puakma/config/booster.config file and add two entries, one for each domino server, eg:

HOSTS~yourdomserver1.yourco=yourdomserver1.yourco:81
HOSTS~yourdomserver2.yourco=yourdomserver2.yourco:81

Thanks for the reply.  I have one machine with two partitioned domino servers running on it and each domino server has its own ip address.  Take web booster out of the picture and you just hit each individual ip address to get to the two domino http servers.  What I'm after is to have web booster in and serve both ip's but on the same host/machine. 

Thanks in advance.

Steven

BOOSTERInterface=192.168.0.44

Otherwise Booster will listen on all available ips. 

Not entirely sure what you're asking - can you provide more info on your environment, eg how you want it to work? 

We had already installed the 831167 fix but the issue still occurs with http or https.

Puzzled .... we can reproduce it at will using the rather odd sequence of clicks and so forth described earlier ... note that it happens intermittently when using the file upload 'normally' - ie click button to open file dialogue, click file, click open ... click upload.

We reverted the application from https to http in order to determine if it was limited to SSL comms only as this is what the application should be using, however, checking packet data encrypted with modern cypher strengths is only for well seasoned!

So we are in rather a predicament ... it is definately occurring with http ... any suggestions on possible avenues - we are trying to avoid making application code changes at this stage ....

Many thanks again,

Giles

We will test this further and provide an update. 

We traced through the source and the total time is taken as a snapshot from when each http request starts. The long response could be due to some socket timeout? There was also a fix (see changelog) on the 3/1/06 that changed the behaviour of how keep-alive works in booster.

Load testing tools don't always behave the same way as a regular browser would, (eg not sending if-modified-since headers so cache hits are low) so will only be an approximation of real world performance.

How does booster behave for regular browser users?

If the config file says to compress a file, booster will compress it and compare it's size to the original uncompressed. If the uncompressed size is the same, Booster will send the file uncompressed. The compression log shows everything just so you can see what is and what isn't being compressed. In some instances compressing a small gif file will actually make it bigger!

WebServer time is the time it takes for the web server to process the requests, from the time booster sends it to the time booster gets a reply from the webserver. Total time is WebServerTime plus the time it takes for booster to do its thing. 

http://www.modwest.com/help/kb2-260.html

http://support.microsoft.com/default.aspx?kbid=831167

How Booster works with Domino is determined by a variety of factors in both the web browser's http headers and the server's http headers on reply. eg whether the client supports gzip compression, whether the server has already compressed the content, the content type, what rules for caching have been set on booster, etc. This is difficult to answer in a generic fashion.

Session timeout only applies to Tornado server. It controls the amount of time a session will remain idle on the server before being removed. boosterporttimeout controls the amount of time booster has no data from the client or server before severing the ip connection. This figure may require a little tweakign depending on what your http server is doing, for example if the is a lot of http server processing before a reply is sent, then a longer timeout value will be required. We recommend using the default and then tuning booster. 

maxthreads is the maximum number of worker threads booster will allow. eg a setting of 100 will allow a maximum of 100 concurrent requests to be processed by booster. 

portbacklog is the ip queuing mechanism, a value of 20 will allow up to 20 ip connections to be queued (waiting for booster thread to become available to service them). Typically this will only be used when more than the maxthreads number of connections make simultaneous requests.

Q: How can I add the libraries to the project without uploading the whole project to the server? 

Next select httphostmap.config from the dropdown list and the file contents will be displayed.

Edit as required. You can map host names and/or URIs (paths), eg:
www.puakma.net=/puakma/website.pma
/ide=/puakma/website.pma/Vortex

...so in your case:
www.yourdomain.com=/group/yourapp.pma/OptionalAnyExtraParts

Click the 'Save Configuration' button. 

Finally, the change won't be immediate. Click the 'Console' tab and enter the command 'tell http hostmap reload'. Done. Test by entering the URL in your browser and your application should be shown.

How to I configure the server to display my site? I believe this is setting the HTTPHostMap.

BOOSTERgzip=0 

I.e. running Puakma on a 16-way box, whereby only 2 CPU's are allocated to Puakma?

Do I need to pay for 16 CPU's or just 2?

Thanks

 http://www.faqs.org/rfcs/rfc2821.html says 451 is a "Requested action aborted: error in processing", equally as vague.

Check your server has a public reverse dns lookup too - some sites abort if you do not have one due to potential spam.

 Message has permanent errors and will be removed '451 4.5.0 SMTP protocol violation, see RFC 2821. 45si504345wri
2005/11/21 21:46:16    Error    Could not complete SMTP transfer. '451 4.5.0 SMTP protocol violation, see RFC 2821. 45si504345wri '
2005/11/21 21:46:16    Information    Transferring message 107B26E34FB to gsmtp185.google.com for 'xxxxx@gmail.com'

Chris 

Applying the MS patch to the browser fixes the issue. Another way to check if it is browser specific is to use another browser (Firefox?) and see if the behaviour is the same.

There should be little difference if booster is running on SSL or not. The HTTPS encryption happens at the socket level long before Booster gets hold of the data. Internally, nothing unique happens to a secure connections. 

Is the MAILERDomain setting in puakma.config then of relevance if going the direct option? 

I'm running Domino 6.0.3 on a Win 2003 server with Puakma ENTERPRISE SERVER v3.13 Build:508

I have a multipart form that I use to upload a text file to the server via a Java servlet hosted on the Domino server. When executing the code via HTTP everything is fine - I'm getting a 100% sucess rate. When executing via HTTPS I can only upload a text file of 1 small line of text and always have to recycle my browser (IE6) before each load (under HTTP I do not need to do this).

Now, I'm fairly sure that the reason for this is java.net.SocketException. My log file (Puakma) is full of the following line

16/11/2005 21:05:04: (E) 12 java.net.SocketException: Software caused connection abort: socket write error  (10.14.2.29 - BOOSTERreq (443))

So I figure whats happening is that before the request has been fully processed by the servlet the multipart has been droped from the request and the servlet can't get at it any more.

I have included 2 extracts from the log. The 1st is through HTTPS where it fails. The 2nd through HTTP where it passes.

So, I guess my question is..... what causes the java.net.SocketException and how do I fix it?

Many thanks in advance for any help received, Ian.

THIS FAILS

16/11/2005 21:05:04: (D) 12 POST /servlet/UploadFileToOctopus?userid=CN=Andy%20Harris/OU=GB/O=ABNAMRO/C=NL HTTP/1.1  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 12 Header read. content=4431 bytes connection=Keep-Alive  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 12 processDataPackage()  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 12 Sending headers. ToClient=true  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 12 Sending standard output. client=true len=4431  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (E) 12 java.net.SocketException: Software caused connection abort: socket write error  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 11 POST /servlet/UploadFileToOctopus?userid=CN=Andy%20Harris/OU=GB/O=ABNAMRO/C=NL HTTP/1.1  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 11 Header read. content=4431 bytes connection=Keep-Alive  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 11 processDataPackage()  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 11 Sending headers. ToClient=true  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:04: (D) 11 Sending standard output. client=true len=4431  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:05:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:06:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:07:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:08:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:09:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:10:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:11:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:12:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:13:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:14:45: (D) Checking: http://gblond088sb9/  (SYSTEM - puakma.addin.booster.BOOSTERAvailabilityThread)
16/11/2005 21:15:04: (E) 11 SocketTimeout: java.net.SocketTimeoutException: Read timed out  (10.14.2.29 - BOOSTERreq (443))

THIS IS OK

16/11/2005 21:21:06: (D) 6 POST /servlet/UploadFileToOctopus?userid=CN=Andy%20Harris/OU=GB/O=ABNAMRO/C=NL HTTP/1.1  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Header read. content=932 bytes connection=Keep-Alive  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 processDataPackage()  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Sending headers. ToClient=true  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Sending standard output. client=true len=932  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Content sent: 932 bytes  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Reading server headers  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 HTTP/1.1 200 OK  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Header read. content=262 bytes connection=null  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 processDataPackage()  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Reading server content ready for gzip 262  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 GZIP Output: text/xml 262/220 16.03%  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Sending headers. ToClient=false  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 6 Reading client headers  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 5 GET /Applications/G-L/gceg_mn.nsf$FILES/uploadDataTransform.xml HTTP/1.1  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 5 Header read. content=0 bytes connection=Keep-Alive  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 5 processDataPackage()  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 5 Sending headers. ToClient=true  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 5 Sending standard output. client=true len=0  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:06: (D) 5 Reading server headers  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:07: (D) 5 HTTP/1.1 304 Not Modified  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:07: (D) 5 Header read. content=0 bytes connection=null  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:07: (D) 5 processDataPackage()  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:07: (D) 5 Sending headers. ToClient=false  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:07: (D) 5 Sending standard output. client=false len=0  (10.14.2.29 - BOOSTERreq (443))
16/11/2005 21:21:07: (D) 5 Reading client headers  (10.14.2.29 - BOOSTERreq (443))

1: Send mail directly from Tornado to the destination host, based on MX records

2: Relay all mail to a single host

To relay through a single host, add the following to puakma.config

MAILERSmartHost=10.100.30.11
MAILERSmartHostPort=25

Omitting the above settings will tell the MAILER task to send mail directly to the destination.

'Connection reset' usually means the receiving host has dropped the connection. Perhaps relaying is not allowed from the address you are at?

Could not complete SMTP transfer. 'Connection reset'

Is this perhaps a TCP window size related problem between our Puakma server and the ISP's SMTP server?

Thanks, Chris 

You can also use this process for installing on to machines with no GUI. Install into a temp dir on a machine with a GUI, then copy the files to the non-GUI machine.

Thanks,

Chris 

When using computed pages, the items don't exist yet because the server doesn't know what page you will be using for the computed page. Computed pages are rendered after the action is run.

Same problem when accessing domino web access.

This occurs because the SSO key is generated from websphere and not in domino.

Brendon... any news ?

 TIA.

But I still use SSL for client connections to web booster.

I don't know if that assumption is correct though. Is the connection between Web Booster and localhost secure by default? Does it even get to the network or is the connection limited to the machine only?

The two following entries are important:
BOOSTERSSLKeyRing=../config/selfcert.kyr
BOOSTERSSLKeyRingPW=password

This specifies where to find the keyring file (created with Java's keytool.exe) and the passowrd to access the file.

I currently have 3 domino servers each with it's own SSL key. Would I be right in thinking that if I place a WebBooster server infront of all and add an SSL key to this server I would not need to then have SSL enabled on the 3 backend domino server but still maintain a secure connection between the browser and the Webooster.

Also is there any further documentation for setting up Webbooster in an SSL/Advanced configuration environment. I have seen the BOOSTERPorts= mentioned with 443 and 443SSL in other posts but haven't seen this mentioned in the Documentation at all.

Dan

We await the Websphere SSO update eagerly as well....

Thanx

Dave

Thanks

.... set to an empty string to not show any page at all

BOOSTERPollInterval=10

It's now only referenced as polls regulary (not frequently ;-) )

we would like to set it to more like 5-10 sec.

If the incoming URI matches a file in that folder on Booster it will be served. URIs that don't match will be passed to the backend http server.

Note: 2.70 or later of booster is required to support this feature (see changelog) 

anything new regarding SSO and Websphere ?

/Andreas

I'm worried about that the CPU overhead would wipe out the benefit of compressed traffic .

22/06/2005 11:24:56: (D) 3 Reading server headers (10.10.1.21 - BOOSTERreq (80) )
22/06/2005 11:24:56: (D) 3 HTTP/1.1 200 OK (10.10.1.21 - BOOSTERreq (80))
22/06/2005 11:24:56: (D) 3 Header read. content=0 bytes connection=close (10.10 .1.21 - BOOSTERreq (80)) 

Is the servlet looking for something special in the URL or http headers? Can you add some debugging info to the servlet? From the above it looks like it is sending a zero byte reply.

I am not sure what i should be looking for, but i still cannot access the servlet. I still need to specific the port in the url to bypass the Web Booster! Thanks for the help. There is no problem, if i cannot get this solved, but if you need to use me as a test subject, then i'll help you try and get this solved! Thanks Patrick Niland

The console command 'tell booster debug on' will give you a great level of detail to determine what is happening both inside Booster and what Domino is returning.

So, I cannot to use my own certificate (generated by Domino CA) in 443 port using LOTUS DOMINO (Non compatible with PEM files)?

-------------------

All the keystore management is taken care of by keytool.exe which ships with the JVM (full SDK). This means we are restricted (if there are restrictions) to the formats supported by keytool, not Web Booster.

I guess that i will need to use BOOSTERPorts=443

I have a Domino with SSL (provided by my Domino CA). The Web Booster doenst works.

Domino doesn't support PEM files. Text by Notes help: "Before you request a certificate from a third-party CA, make sure the CA uses the PKCS format, not some other format, such as Privacy-Enhanced Mail (PEM)."

Is it possible to use the Puakma Wb Booster with the Domino SSL?

======

You will need to use BOOSTERPorts=443SSL

There should be a test (expired) certificate in the standard install which should work fine for testing. To install youur own certificate you will need to insert your own certificate in the keyring file using keytool.exe which comes with the Java SDK. The basic instructions are as follows:

1. make a self certified certificate
2. create a CSR and send to certifying authority
3. get the reply and paste into a new test file called something like server.pem
4. execute: c:\j2sdk1.4.2_03\bin\keytool -keyalg "RSA" -import -file server.pem -trustcacerts -keystore yourkeyring.kyr
Enter keystore password:  xxxxx
Certificate reply was installed in keystore

see also http://www.orionserver.com/docs/ssl.html

To use the templating feature, in the application settings section of the application to be the TEMPLATE. Put a unique name in the "Is a template:" field eg "Cannibal2". Next open the app settings of the application to inherit from the template and in the field marked "Inherited from:" put the same value eg "Cannibal2".

If you wish to force a design refresh, simply tell the agenda task (through the server console or programmatically) to run the action now:
tell agenda run /system/webdesign.pma/RefreshDesign

Using templates is a very powerful feature. On this site we run about 5 instances of our content management system (Cannibal) which allows us to make a single design change and have that reflected in all application instances.

We acknowledge that a remote design refresh would be very handy and are currently thinking about the best way to achieve that. SOAP and XML over http seems like a good solution but there are a number of complexities. 

There should be a test (expired) certificate in the standard install which should work fine for testing. To install youur own certificate you will need to insert your own certificate in the keyring file using keytool.exe which comes with the Java SDK. The basic instructions are as follows:

1. make a self certified certificate
2. create a CSR and send to certifying authority
3. get the reply and paste into a new test file called something like server.pem
4. execute: c:\j2sdk1.4.2_03\bin\keytool -keyalg "RSA" -import -file server.pem -trustcacerts -keystore yourkeyring.kyr
Enter keystore password:  xxxxx
Certificate reply was installed in keystore

see also http://www.orionserver.com/docs/ssl.html

I guess that i will need to use BOOSTERPorts=443

I'm trying to do the same setup. We are running Websphere and Domino with the SSO key generated by websphere. I've tried the 3 keys offered by the LTPA export from websphere, with no success.

I think that there might be an other problem. The LTPA key is given to the browser when the user login to websphere. The key can be used to pass to domino sites. This doesn't work the other way around. If I login to domino, I still have to login to websphere.

Can this be solved ?

I like  this soulution very much. Then you can configure for your situation.

Is the search using exact match or is it truncating (asterisk) ? If it is truncating, then I suggest that you also make that configurable:

WEBSSOSearchTruncate=1 or 0

BOOSTERDebug=1

in puakma.config should show detailed output. 

I would also like to knwo if there is a way to log the activity NTLMLTPA plugin. I cannot see anything in the starndard log

Thanks

/Andreas

When I export the SSO key from websphere I obtain a file whose content looks like my previous post. If you want one with the actual values, please provide me a mail address I can sent to.

But If you look at my previous post ( the one with the conten of the websphere sso key).. which of the field would you think I need to use in the puakma conf file?

Thanks

/Andreas

cn, alias, sn, givenname, uid 

The message you are getting means that the NT network name matches multiple LDAP records. One idea we have here is to allow you to set the LDAP search attributes in the puakma.config file, eg:

WEBSSOSearchAttributes=cn,alias,sn

Thoughts? 

When one user tries to access the Domino server through the Web Booster, an error is generated on the Puakma Web Booster console:

<LOG> 

2005-05-19 09:37:33: (E) Too many name matches for 'gitte'  (SYSTEM - pmaSystem) 

</LOG>

 We have been trying some LDAP lookups ourselves - using the ldapsearch.exe that comes with Lotus Notes. To us it looks like the LDAP lookup that the NTLMLTPA makes is using the asterisk in its search. Searching for 'CN=gitte*'.

It also could be that it does its search in Person Document fields that we do not find relevant.

Please could you tell me about how the LDAP query is being done, and what fields are accessed. And of course I would like to know about any configuration settings that I should use to tweak how the lookups are performed.

I have not tried using the SSO module with a SSO key generated from websphere but I still have problems
a SSO key looks as follow (I have removed our data)

#IBM WebSphere Application Server key file
#Mon Apr 04 14:47:17 CEST 2005
com.ibm.websphere.CreationDate=<Value removed for privacy reasons>
com.ibm.websphere.ltpa.version=1.0
com.ibm.websphere.ltpa.3DESKey=<Value removed for privacy reasons>
com.ibm.websphere.CreationHost=<Value removed for privacy reasons>
com.ibm.websphere.ltpa.PrivateKey=<Value removed for privacy reasons>
com.ibm.websphere.ltpa.Realm=<Value removed for privacy reasons>\:389
com.ibm.websphere.ltpa.PublicKey=<Value removed for privacy reasons>

I have tried the values without succes the values:
com.ibm.websphere.ltpa.3DESKey
com.ibm.websphere.ltpa.PrivateKey
com.ibm.websphere.ltpa.PublicKey

Any clue?
Does one of the above value need to be converted to be used as WEBSSOSecretB64?

Thanks a lot

I think I have an idea about why our LTPA_DominoSecret is empty. We don't generate our SSO keys in domino but we import those generated in our websphere environment into the Notes Document (Using the action Keys\Import WebShere LTPA Keys). This step is necessary in order to have SSO across WebSphere and Domino.

Doing this results in the field scenario outlined in my first post.

Does NTLMLTPA support keys generated in WebSphere and imported in Domino?

Regards

/Andreas

We also have the other two fields you mention but these appear blank.

The product looks very good but I have a question regarding the configuration.

The guide shows how to configure SSO when using the R5  domino LTPA key. In this case the field LTPA_DominoSecret should be paste in the config file.

When using domino internet sites configuration (from R6), the SSO document have a field called LTPA_DominoSecret but the field is empty. What are the guidelines in this scenario?.

I can see that the SSO document has other similar fields LTPA_WS3DESData and LTPA_WSRSAData. Sould those be used instead? And how?

Thanks

BTW, I created a html page with images, but that images aren't displayed. I tried to put it in icons folder and same folder than HTML.

Any idea?

This line determines what is shown when the destination is unavailable. The problem is likely that is is ab absolut path. If you change it to:

BOOSTERUnavailableFile=../html_public/unavailable.html

it should work OK. The default install on windows is into /program files/puakma web booster/ so that would be why the path is not working. This entry was incorrect in the installation package and has now been updated.

BOOSTERUnavailableFile=../html_public/unavailable.html

it should work OK. The default install on windows is into /program files/puakma web booster/ so that would be why the path is not working. This entry was incorrect in the installation package and has now been updated.

Hi, when our Domino is out of service (backup off-line), I'd like to show a custom HTML page. Currently, the Webbooster only shows a text ""No servers are currently available".

Is it possible?

PS: I found in pukma.config the line "BOOSTERUnavailableFile=/puakma/html_public/unavailable.html", but it doesn't work.