TM1 10.1 not connecting

tomago · Post by **tomago** » Sun Feb 12, 2012 10:49 pm

I have installed TM1 10.1
Installed and services running.
when i try and connect i get the error
N6) Client not registered

When i go through the LDAP Load Tool, get the config file, and connect ok.
when i test LDAP authentication, it succeeeds
when i test TM1 authentication - 80: SystemServerClientNotFound

Please help

Gregor Koch · Post by **Gregor Koch** » Sun Feb 12, 2012 11:04 pm

I thought you did not want to go to 9.5.2 because it is the newest version. Now you are on the newest... not that the version of TM1 necessarily has anything to do with your login problem. Just a bit surprised by the change of mind as I don't think the different TM1 versions will solve or has solved any of your issues you describe.
Maybe add some of the information (TM1 configuration and what has changed with the upgrade, is it also a new machine, new TM1 service account, ... etc) from your 'upgrade' thread.

tomago · Post by **tomago** » Sun Feb 12, 2012 11:25 pm

i figured i would go to 10, so that ppl wouldn't respond with 'upgrade and then see how you go"

i have managed to connect, using the default admin account

now i need to modify so that i can authenticate with LDAP
not having much luck getting authentication with LDAP working.
can someone please assist

nick_leeson · Post by **nick_leeson** » Mon Feb 13, 2012 1:01 am

I have installed TM1 10 and its all working well although I am not using it with LDAP.

Have you tried at looking at the below settings to help you ?

## Optional LDAP Settings

# PasswordSource
# Determines the source of authentication
# Type: Optional, Static
# Two options:
# * TM1 (default) - Compares the user-entered password to the password in the TM1 database.
# * LDAP - Compares the user-entered password to the password stored in on the LDAP server.
#PasswordSource=LDAP

# LDAPPort
# TM1 attempts to bind to an LDAP server on the specified secure port. If you do not enter an LDAPPort value, TM1 uses the default value, port 636
# Type: Optional, Static
# This must be a secure (SSL) port.
#LDAPPort=636

# LDAPHost
# Uses the domain name or dotted string representation of the IP address of the LDAP server host. If you do enter a value for LDAPHost, TM1 uses the default value, localhost.
# Type: Optional, Static
#LDAPHost=localhost

# LDAPUseServerAccount
# Determines if a password is required to connect to the server when using LDAP authentication.
# Type: Optional
# To connect directly to the LDAP server using integrated authentication, set this parameter to T. Set this parameter to T whenever the IBM Cognos TM1 server and LDAP server exist on the same domain.
# To use a password before connecting, set this parameter to F. When LDAPUseServerAccount is set to F, you must also set the LDAPPasswordFile and LDAPPasswordKeyFile to successfully connect to the LDAP server using SSL.
#LDAPUseServerAccount=T

# LDAPSearchBase
# A base distinguished name (DN) in the LDAP directory. For example:
# ou=people,o=company.com
# Specifies the node in the LDAP tree at which the search for the TM1 user being validated begins. For example, if the distinguished names are of the form:
# uid-bjensen, ou-people, o=company.com
#
# then the search base would be:
# ou-people, o=company.com
# This is a required field if using LDAP Authentication.
#LDAPSearchBase=cn=users,dc=company,dc=com

# LDAPSearchField
# cn
# The name of the LDAP attribute that is expected to contain the name of the TM1 user being validated. If you do not enter an LDAPSearchField value, the default value is cn, which is also the default value for Microsoft Active Directory.
#LDAPSearchField=cn=user

# IPVersion
# Select IPv4 or IPv6
# Sets IP protocol.
# Type: Optional, Static
#
# Three options:
# * ipv4 - use ipv4 (default)
# * ipv6 - use ipv6
# * dual - use ipv6 with support for ipv4
IPVersion=ipv4

Cheers

tomago · Post by **tomago** » Mon Feb 13, 2012 1:31 am

I have tried configuring this to be like my previous versions
here is the previous setup
can't get the new version to login with LDAP with these settings however.

[TM1S]
ServerName=sdata
SecurityPackageName=Kerberos
#SecurityPackageName=NTLM
IntegratedSecurityMode=2
PasswordSource=LDAP
#LDAPUseServerAccount=T
UseSSL=T
DataBaseDirectory=F:\Tm1s7\TomagoData\
LoggingDirectory="F:\Tm1s7\log"
AllowSeparateNandCRules=T
AdminHost=SERVER1
PortNumber=12345
Protocol=TCP

MaximumLoginAttempts=10
ClientVersionMaximum=91

LDAPPort=636
LDAPHost=site.tomago.com.au
LDAPWellKnownUserName="cn=Tm1service,ou=Service-Accounts,ou=All-Users,dc=domain,dc=com,dc=au"
LDAPWellKnownPassword=applix04
LDAPSearchBase="ou=All-Users,dc=domain,dc=com,dc=au"
LDAPSearchField=sAMAccountName

nick_leeson · Post by **nick_leeson** » Mon Feb 13, 2012 1:59 am

Any errors ?? What does the error log say ?

tomago · Post by **tomago** » Mon Feb 13, 2012 2:11 am

When i have the login as LDAP
i get LDAPUserNotFound

But i have connected via ET LDAP and exported all the users fine. when i connect as the default admin account, and check clients/groups i can see all the users ok

are you able to help me translate my original settings into the new format of the tm1s.cfg?

i tried doing the tm1crypt.dll and creating key files etc

Gregor Koch · Post by **Gregor Koch** » Mon Feb 13, 2012 2:17 am

Hi
Have you tried hashing (#) the ClientVersionMaximum=91
The syntax for this would be 9.1.something any ways.

When you say
"when i test TM1 authentication - 80: SystemServerClientNotFound"
how do you actually do that? From a 9.1 Perspective client?

You have not changed anything in you cfg and it worked in 9.1?

Is it the same machine, same TM1 service account? Has the AD password changed after someone put it in the public domain?

Gregor Koch · Post by **Gregor Koch** » Mon Feb 13, 2012 2:21 am

Maybe this can give a few pointers:

http://www.ibm.com/developerworks/data/ ... ge498.html

tomago · Post by **tomago** » Mon Feb 13, 2012 2:24 am

Gregor Koch wrote:Hi
Have you tried hashing (#) the ClientVersionMaximum=91
The syntax for this would be 9.1.something any ways.

yeah, that has all been removed

When you say
"when i test TM1 authentication - 80: SystemServerClientNotFound"
how do you actually do that? From a 9.1 Perspective client?

i have gone past this step now, issue is LDAP authentication not working

You have not changed anything in you cfg and it worked in 9.1?

9.1 config all working fine

Is it the same machine, same TM1 service account? Has the AD password changed after someone put it in the public domain?

new server, no changes to ad passwords

tomago · Post by **tomago** » Mon Feb 13, 2012 3:51 am

i have enabled LDAP tracing and here are results when trying to login with LDAP
1560 [2] DEBUG 2012-02-13 03:50:04.855 TM1.LDAPAuth Succesfully connected to LDAP server
1560 [2] DEBUG 2012-02-13 03:50:04.855 TM1.LDAPAuth LDAP SSL cipher strength = 128 bits
1560 [2] DEBUG 2012-02-13 03:50:04.855 TM1.LDAPAuth LDAP ERROR: 0x22 - search failed

nick_leeson · Post by **nick_leeson** » Mon Feb 13, 2012 4:53 am

I suspect its a LDAP issue rather than TM1 one.

http://support.microsoft.com/kb/218185

LDAP_INVALID_DN_SYNTAX "0x22 The distinguished name has an invalid syntax."

Resolution is here

http://world.episerver.com/modules/foru ... x?id=12176

Cheers

tomago · Post by **tomago** » Mon Feb 13, 2012 5:13 am

my syntax hasn't changed
LDAPSearchBase="ou=All-Users,dc=domain,dc=com,dc=au"

i have just configured 9.5 and it's working fine.
must be the way 10.1 handles LDAP differently?

Steve Vincent · Post by **Steve Vincent** » Tue Feb 14, 2012 8:38 am

hope not!

long shot but is the TM1 service running with the same account that 9.5 was?

tomago · Post by **tomago** » Wed Feb 15, 2012 4:40 am

the tm1 server service is running with the same account that i have working for 9.1 and 9.5, and what i tried for 10.1

nick_leeson · Post by **nick_leeson** » Thu Feb 16, 2012 2:07 am

Please could you use the parameter IPVersion=ipv6 !!

tomago · Post by **tomago** » Fri Feb 17, 2012 12:36 am

i have given up on 10.1
i will use 9.5.2 and worry about going to 10 and higher next year

jameswebber · Post by **jameswebber** » Tue Jul 10, 2012 9:18 am

I'm having a similar issues with Cognos Express authenticating against the active directory namespace.
I know this was working on Thu 14/06/2012 .

But has since stopped working...perhaps around a week.
I have yet to figure out the extract fix but I'm sure this is windows server 2008 r2 related.

Steps you can use.

Firstly run ldp.exe (install Active directory tools on your computer if you don't have them already)
Check that you can connect okay to your ldap server like ldap.company.com:389 (or 636)

I found I couldn't on my pc until I disabled the windows firewall.

If this was the case you will need ldp.exe on your server. Add the server role "Active directory lightweight directory services"
Now test you can connect to ldap. I couldn't
Stopped all my server windows firewalls, rebooted and now I can connect using standard windows

However I still can't connect into Cognos Express using my AD namespace I get:
the provided credentials are invalid. Please type your credentials for authentication.

I'm now thinking that perhaps a windows server update has coused this as I have a virtual server that was all setup with CE9.5 I have not touched for 6 months which is also not working but was working connecting to AD before.

See this topic I created:
http://www.tm1forum.com/viewtopic.php?f=3&t=7684

Anyway hope the AD testing tool helps

TM1 Forum

TM1 10.1 not connecting

TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting

Re: TM1 10.1 not connecting