Archive for category: Frontpage Article

Problem:

When we try to connect to an SQL database with TLS1.2 on and TLS1.0 off, we get this error:

The test connection operation failed for data source x on server x at node <node> with the following exception:

java.sql.SQLException: The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption.

Error: “SQL Server did not return a response. The connection has been closed.

ClientConnectionId:x”.

DSRA0010E: SQL State = 08S01, Error Code = 0. View JVM logs for further details.

 

Resolution:

TLS 1.2 and SQL Server require a fix from Microsoft to work.

 

To get the Content Store connection working:

– Ensure that the unrestricted jre policy files are added and in cognos configuration you add the SHA256 ciphersuites.

– Use the latest SQL Server jdbc driver (at least 7.0) for the java version that Cognos uses. You can find the latest SQL Server JDBC driver here: https://docs.microsoft.com/en-us/sql/connect/jdbc/download-microsoft-jdbc-driver-for-sql-server?view=sql-server-ver15

– Edit install_location\bin64\startwlp.bat (Windows) to add the following lines after the line set JVM_ARGS=-Xmx4096m -XX:MaxNewSize=2048m -XX:NewSize=1024m %DEBUG_OPTS%:

set JVM_ARGS=”-Dcom.ibm.jsse2.overrideDefaultTLS=true” %JVM_ARGS%

NOTE: The startwlp.bat file no longer exists in 11.1.5 and higher. 

– Edit install_location\bin64\bootstrap_wlp_os_version.xml to add the following lines after the line <param condName=”${java_vendor}” condValue=”IBM”>-Xscmaxaot4m</param>:

<param>”-Dcom.ibm.jsse2.overrideDefaultTLS=true”</param>

– Edit install_location\bin64\cogconfig.bat (Windows) to add the following lines after the line set J_OPTS=%DD_OPTS% %J_OPTS%:

set J_OPTS=”-Dcom.ibm.jsse2.overrideDefaultTLS=true” %J_OPTS%

– If SQL Server has ‘Force Encryption’ set to ‘Yes’ (meaning that it is using an SSL certificate), you will need to import the SQL Server certificate into the Java cacerts keystore for your JRE. For example (using the Cognos JRE):

1. Obtain the root Certificate Authority certificate that issued your SQL Server’s certificate (or the self-signed server certificate if it was not issued by a Certificate Authority), and copy to the computer where Cognos Analytics is installed. For example, copy the file sqlcert.cer to the root directory, c:\sqlcert.cer
2. Type cd C:\Program Files\ibm\cognos\analytics\ibm-jre\jre\lib\security
3. Type , for example, C:\Progra~1\ibm\cognos\analytics\ibm-jre\jre\bin\keytool -import -trustcacerts -file “c:\sqlcert.cer” -keystore cacerts -alias SQLCert

– Start Cognos Configuration using cogconfig.bat you modified in the previous step. Important: You must start IBM Cognos Configuration using cogconfig.bat

To get the SQL Server Native Client Connection:

Download a version of the Native Client that supports TLS 1.2 as per Microsoft’s KB Article: https://support.microsoft.com/en-ca/help/3135244/tls-1-2-support-for-microsoft-sql-server

To get the JDBC data source connection working:

– Go to Cognos Administration -> Configuration tab -> Dispatchers and Services
– Click on the dispatcher server to drill down to the services
– Beside the QueryService, click the Set Properties button
– Go to the Settings tab
– Add the following the Additional JVM Arguments for the QueryService setting

-Dcom.ibm.jsse2.overrideDefaultTLS=true

– Click OK
– Click on the Status tab
– Select System
– Click on the server to drill down to the services
– Beside QueryService, click the drop down arrow
– Select “Stop immediately”
– Wait 30 seconds for it to fully stop
– Click the drop down again and select “Start immediately”

 

You can also review the article from IBM:

https://www-01.ibm.com/support/docview.wss?uid=swg22016796

PROBLEM

How do I suppress Back-Office PO Receiving (PO30) Receiving Delivery and Putaway (PO134) delivery tickets when the Mobile Supply Chain Management (MSCM) Delivery Documents are all that is needed.

 

RESOLUTION

One way to disable the Back-Office PO Receiving (PO30) Receiving Delivery and Putaway (PO134) delivery ticket is to remove* the printer from PO Receiving (PO30) or create a dummy printer to stop the back-office delivery ticket from printing.

*Removing the printer from PO Receiving (PO30) only works if the user does not have a default printer assigned to them. After being removed, the default printer will simply populate back in the field upon clicking change.

Additionally, an enhancement to PO Company Setup (PO01) was added which provides a flag called “Delivery and Putaway Ticket Print” which allows disabling the delivery ticket printing at the company level.

 

 

 

What forms are secured by CB04.1 (Cash Ledger Security) when a User Class is assigned to a Cash Code in CB00.2?

 

On CB04.1-CB04.2, you are restricting what a user is able to do with that specific Cash Code.

 

Some examples of forms that would give you an error are:

CB00.2, CB00.3, CB20, CB80, CB220, CB90.4, CB90.1, CB221, CB80, CB10, CB15, CB175, CB180, CB185, CB190, CB210, CB211, CB215, CB25, CB260, and CB30.

 

When the user tries to inquire on or use that Cash Code, he would get the error message that “user does not have access rights” if he is set to not have inquiry or maintenance access.

 

CB06 and CB99 do not give you an error when trying to use the cash code tied to that Security User Class.

 

CB04.1 security does not restrict the user from using the Cash Code in other modules (like AP and AR).