BUG? ISSUE? OCI Configuring Cognos for Report Distribution by Email

[gmilazzoitag]

Hi all.

is this doc still valid?

This question depends on this: until OCI 6.4 I was always able to perform the chances in IBM Cognos Configuration with no issues.

Starting from 7.0.1 and now on a NEW 7.0.2 installation I got a lot of errors!!!

Configuring OnCommand Report for report distribution by email.docx

(fixed url, the original post did not get the link)

First, once inserted the correct mailserver parameters (smtp relay, no user, no password, absolutely anonymous relay) and I click on Test this happen:

Problems were encountered during validation.CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'External JMX credential' located in 'Environment' is currently invalid.CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'Shared secret' located in 'Portal Services' is currently invalid.CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'User ID and password' located in 'IBM Cognos Content Store' is currently invalid.CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'Account and password' located in 'Notification' is currently invalid.

If I attempt to save the configuration the validation process locks with thi error.

[Validation]
[ ERROR ] CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'External JMX credential' located in 'Environment' is currently invalid.
[ ERROR ] The parameter named 'Shared secret' located in 'Portal Services' is currently invalid.
[ ERROR ] CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'Shared secret' located in 'Portal Services' is currently invalid.
[ ERROR ] CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'User ID and password' located in 'IBM Cognos Content Store' is currently invalid.
[ ERROR ] CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'Account and password' located in 'Notification' is currently invalid.

 I would hope that this does not depend on the no user/no password (I repeat, relay is anonymoys also for the autosupport functions of OCI and DWH servers). I don't understand how this worked in OCI 6.4...

If I, just to test, put in the sender email field a user and a password, and I click "test" the error is the same but it is referred to an invalid configuration in IBM Cognos Content Store

Problems were encountered during validation.CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'External JMX credential' located in 'Environment' is currently invalid.The parameter named 'Shared secret' located in 'Portal Services' is currently invalid.CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'Shared secret' located in 'Portal Services' is currently invalid.CAM-CRP-1064 Unable to process the PKCS #7 data because of an internal error. Unable to read the contents of the keystore 'D:/SANscreen/cognos/c10_64/configuration/csk\jCSKKeystore'. Reason: java.io.IOException: com.sun.crypto.provider.SealedObjectForKeyProtector
The parameter named 'User ID and password' located in 'IBM Cognos Content Store' is currently invalid.

Regards,

[ostiguy]

Hey Giacomo,

So you have seen this both on OCI upgrades as well as new OCI installs? This is one of those issues where some people in the field have seen it, but I believe only one bug has been filed with engineering. I am trying to determine which NetApp support cases exist for this issue (I have found at least 2), and what the status of them is. I just stalked down the engineering manager who owns the DWH as he came in from the parking lot to let him know I am raising a ruckus on this.

I wonder if localization could possibly be the story here - some of the incidents of this issue are with European OCI instances. Our US pre-sales SEs do not seem to be encountering this issue. Not all OCI POCs involve tweaking the Cognos config, so perhaps that is a factor why we don't see more of it. My recommendation - get a case open with NetApp support, there is a generic OCI serial number that can be used for cases for OCI POCs. Let me know the case #. I will let the OCI support manager know that this needs escalation to engineering.

I think there is a decent change OCI engineering will need to work with you in conjunction with IBM Cognos supportto determine what is going on.

Matt

Edit: the paragraph spacing was lost for some reason

[gmilazzoitag]

Hi Matt,

thank you for prompt answer, as usual! 

Just to clear. This last issue I have on a official installation for 600 TB (buyed, s/n 134000442). Times ago (and the first I observed) I had on a 6.4 -> 7.0.1 upgrade.
Sure I will avoid to configure reporting by email in my next POCs!

First of all I can tell you that language localization files provided worked fine, I've jsut replaced in their folders and now I've dwh portal in italian and no more errors running IBM Report Studio.

I've done this also because in your answer you had the suspect that in some way it could depend from localization.

Unfortunately the, let me say, certificate/secuirty error, does not depend from localization for I still have them after the new "it" files have been copied and a restart of DWH server.

I will open a case but, I'm not resident here, and more that point out that there's another bug of the same tipe, I think I cannot do more...

Regards,

[hotz]

I agree. This doesn't seem to be a localization issue. Seen this in my own lab where all localization settings are on English/US, it's reproducible. I suspect this is a java issue of some sort.

[gmilazzoitag]

Yes. An in my answer to Matt nevertheless I've applied all the needed local files the issue is the same. I agree with you about Java and Java security issues. Looking for same similar error on the web I've read dozens of Cognos users reporting issues quite similar.

I'm going to open a case just to enforce this bug. Being not resident there it seems very difficult to follow it.

Regards,

PS) I've fixed the link to the doc I was referring in the opening thread

Configuring OnCommand Report for report distribution by email.docx

[hotz]

Agreed. Opening a bug is the way to go here.

[hotz]

Hmm, that's troubling.

Can you enter the serial number of the license shown in 7.0.x versions in the Setup/Licensing section?

[gmilazzoitag]

Never mind...

At last I was able to browse somewhere in the "serial for my customer" and system accepted the serial of OCI...

And, I've unfortunately deleted my preceding content! 😄

Too tired and late for me today! 😉

Thanks a lot

[hotz]

Sounds good. Thanks for the effort.

[gmilazzoitag]

Case opened. 
#2005463616

[ostiguy]

Hey Giacomo,

I have been travelling this week, so I haven't had the chance to look at your case notes. Hopefully you have been made aware that we now understand the root issue, and have been given access to the workaround via NetApp support.

Basically, OCI 7.0.1 / 7.0.2 have a Java path issue with the DWH, where when the OCI DWH is installed to a path without a space character in it. This results in the wrong internal install of Java being used by Cognos, which does not have the special .jar files that allow Cognos to unlock, manipulate and save the Cognos configuration file - editing the Cognos configuration to store the SMTP server settings is the most common way of running into this issue.

Taking care to install the DWH to a path with a space in it will avoid this issue - on US English, "Program Files" is a default.

Support has been given a procedure from OCI engineering to remediate OCI 7.0[1-2] installs being impacted by this. I will follow up on this post when I am certain when this issue will be fixed in future OCI releases, and which future OCI releases are known to contain this fix

Matt

[gmilazzoitag]

Good news bad news Matt! 🙂

I use i.e. d:\sanscreen to simplify localization of files  and there's a bug for this...great.

Ok, I'll do the backup of dwh db, reinstall everything with a preceding "Program Files" or maybe "SAN Screen" (joking).

Thank you,

[hotz]

Giacomo,

A reinstall shouldn't be necessary. I think there is an easier workaround, by just copying the missing files over to the correct directory. I've tried it in my lab and it worked for me.

I just don't know if the workaround has been officially approved. Let me try to find out before sharing it here in case the solution hasn't been provided to you already in the case you opened.

Regards,

Gerhard

[gmilazzoitag]

Hi Gerhard,

that's good.

Can you provide more detailed informations (what to copy and where)?
I could do it.
Regards,

[hotz]

Hi Giacomo,

turns out OCI Engineering created a batch file you can run in the environment to fix the issue (attached).

Regards,

Gerhard

[gmilazzoitag]

Thank you very much!

Regards,