11.0.4 logon & refresh issues

[hardstep]

Hi Folks
Anyone having this issue ?...
Background : upgraded from 11.0.3 to 11.0.4 (single server in place upgrade), rebooted server, cleared browser cache
Issue : when logging into CA from the browser it takes approx 15 seconds to get the logon / splash screen, once the logon screen appears it takes a further 15/20 seconds to logon.
(Previous version would take 1-2 seconds max).

Also things like:
- My Preferences
- Admin - My Content
- Admin - Data sources
- Admin - Configuration
all take excessive amounts of time to appear in the browser (chrome and IE)

Has anyone had similar slow response issues ?.
Cheers
Nick

[ZenCog]

Have you tried with different browsers (Chrome/Firefox) and differerent IE versions? In earlier C11 versions I saw that especially older IE browsers were a lot slower than Chrome/Firefox or latest IE11 .

In 11.0.4 IE support has changed slightly because IE10 did work with 11.0.3 portal. However, 11.0.4 portal seems to render web pages completely wrong (alignment of UI elements are wrong).

[hardstep]

Hi ZenCog
As I mentioned in the post - i've tried both Chrome and IE browsers which were working perfectly with v11.0.3 before the upgrade.
Having spoken to IBM support today - they also identified the same issue when you upgrade over the top of v11.0.3.

I have this morning uninstalled v11.0.4 completely and reinstalled to see if the problem disappears and surprise surprise the issue has gone !.
Yet another example of the in-place upgrade process not working properly !.
Every FP release i've tried causes issues and i've ended up installing each FP from scratch to resolve the issues (see previous posts).
Another poor release with no proper QA !!!.

N

[ZenCog]

Aaah. Okey. Thanks for sharing that mystery with us. So far I have upgraded couple 11.0.3 environments to 11.0.4 and I have been just lucky to avoid that problem simply because I have indeed installed 11.0.4 in a parallel folder (and merging config files to this new folder). However, I have used the old contentStore database content directly in the new installation. Seems to work. More safe way might be to do it via export-import packages but haven't gone through that effort.

Some IBM documents (but couldn't find links to those docs at this point) say that it is okey to install 11.0.y on top of old 11.0.x folder but I just wanted to keep the old installation until the new one has proven to be functional. In the future I will just stick to that plan.

[hardstep]

Hi ZenCog
I agree - installing into separate directories and moving content between versions definitely is my way going forward.
I took IBM at their word when they said (and marketed this release) that you could install over the top of a previous version and things would *just* work.
I've seen plenty of posts previously where people have done this without issue - so let's hope that in subsequent releases they make this feature more robust and do more testing around this.
Cheers
N   

[prince9]

Aaah. Okey. Thanks for sharing that mystery with us. So far I have upgraded couple 11.0.3 environments to 11.0.4 and I have been just lucky to avoid that problem simply because I have indeed installed 11.0.4 in a parallel folder (and merging config files to this new folder). However, I have used the old contentStore database content directly in the new installation. Seems to work. More safe way might be to do it via export-import packages but haven't gone through that effort.

Some IBM documents (but couldn't find links to those docs at this point) say that it is okey to install 11.0.y on top of old 11.0.x folder but I just wanted to keep the old installation until the new one has proven to be functional. In the future I will just stick to that plan.

Hello ZenCog, 
have you got SSO working with 11.0.4 using IIS?
I did a clean install and having various issues.
Would mind sharing installation of 11.0.4 and also what configuration files to copy from old one to new one
Thanks

[prince9]

Hi ZenCog
I agree - installing into separate directories and moving content between versions definitely is my way going forward.
I took IBM at their word when they said (and marketed this release) that you could install over the top of a previous version and things would *just* work.
I've seen plenty of posts previously where people have done this without issue - so let's hope that in subsequent releases they make this feature more robust and do more testing around this.
Cheers
N

Hi Hardstep,
Are you using cognos 11.0.4 with IIS?
Can you please share what content need to be moved from previous versions to new versions?
Any help would be greatly appreciated.
Thanks

[ZenCog]

have you got SSO working with 11.0.4 using IIS?  I did a clean install and having various issues.
Would mind sharing installation of 11.0.4 and also what configuration files to copy from old one to new one

No, we are having IIS and SSO login problems in all those upgraded 11.0.4 Cognos portals. Like we know, the sso/iis login configuration changed between C10 and C11. Now it has changed a bit more between 11.0.3 and 11.0.4 versions.

Following page explains what should be done in 11.0.4 version, but SSO doesn't seem to work or some IIS proxy re-write rule is missing in this document.
http://www.ibm.com/support/knowledgecenter/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_sso_actdirserver.html

IBM tech support is looking at this issue and don't know yet if this is just a documentation bug or software bug or environment specific configuration error (for example we have more than one authentication data sources in Cognos configurations so it might have something to do with this problem). Waiting for IBM's reply.

The funny thing is that if you enter http://cognosbox/ibmcognos/sso/cisapi/v1/login URL and then type in http://cognosbox/ibmcognos/bi/ URL, the SSO login works. Almost like the new 11.0.4 IIS/SSO configuration doc is missing some IIS re-write or re-direct rule.

If anyone here has manged to get IIS/SSO login working in C11.0.4 version then please share your experience and did you follow the instructions shown in the web doc linked above or tweaked something else?

If you want to migrate C11.0.3 configuration to C11.0.4 version then you have to export the existing configuration in Cognos Configurator tool, copy the exported XML file as c1104\analytics\configuration\cogstartup.xml file and open the new Configurator. The first time you open the Configurator the cogstartup file will be upgraded to support the new version.

[prince9]

I got the same link as you have and now I got SSO working but having other issues like
Can open report studio but not able to use it (all options disabled)
already created dashboard is saying that it cannot access Data module...

Thanks

[rayden0123]

Hi,
With my 11.0.4 installation the SSO stopped working. When I enter the url http://cognosserver/cognosfolderalias/ - We get prompted for a windows logon screen where we enter the id and password - after 3 items it crashes the IIS application pool and website returns a 503 Service unavailable. Has anyone else faced this ? This is a 2 server install. IBM support has not been very helpful. BTW This was 11.0.4 installed on top of a working 11.0.3 environment.  :(

[ZenCog]

Prince9. Got SSO working with the new info in the web page linked above (looks like IBM updated and modified the content yeasterday). If someone there is fighting with IIS/SSO then check at least these after following the instructions in the web page:

- /ibmcognos/ folder needs to be APPLICATION folder in IIS, not a virtual directory if /ibmcognos/sso/ application folder is not using the default application pool. And in that case both ibmcognos and sso app folders must use the same application pool.
- /ibmcognos/ folder needs to use "Windows Integrated auth" IIS security option also, not just sso app folder (in C10 it used to be so that cgi-bin app folder or cognosisapi.dll file there had to be WinIntegrated but /ibmcognos/ didn't have to).


>having other issues like Can open report studio but not able to use it (all options disabled)

Don't have that problem here. RStudio seems to be working fine and all properties and options available. At first I did have some weird HTML rendering problems but after clearing local browser cache things started to work OK.

[ZenCog]

With my 11.0.4 installation the SSO stopped working. This was 11.0.4 installed on top of a working 11.0.3 environment.

See comments from Hardstep. He installed on top of 11.0.3 and got all sort of weird login problems. After installing 11.0.4 on a new fresh folder problems were gone. I have done handful of 11.0.4 upgrades here and always used a new separate folder, but re-using the old content store database and configuration file (of course after taking backups of originals).

Also. In some of those 11.0.4 servers we have an old C10.2.2 also running there at the same time. Those versions must use different application pools in IIS. At one point I accidentally re-used the old app pool and this caused weird problems when the same app pool had two different versions of cognosisapi.dll file.

[hardstep]

Just to add to the conversation thread...when I spoke to IBM support the other day they mentioned there were some SSO issues with 11.0.4.
They didn't mention specifics - but it was clearly causing them a few headaches.

My advice (for what it's worth) - install clean version of 11.0.4 and remove any previous IIS configs !... at least then you can rule out any over the top gremlins !.

Cheers
Nick

[rayden0123]

See comments from Hardstep. He installed on top of 11.0.3 and got all sort of weird login problems. After installing 11.0.4 on a new fresh folder problems were gone. I have done handful of 11.0.4 upgrades here and always used a new separate folder, but re-using the old content store database and configuration file (of course after taking backups of originals).

Hi - I just did a fresh install and facing a new error after following the steps in the posts above. I get the ERR: 403 - looking for help !!

[ZenCog]

I just did a fresh install and facing a new error after following the steps in the posts above. I get the ERR: 403

I have seen the same error if those /ibmcognos/bi/ URL-rewrite rules in IIS config are wrong. Just go through them and make sure that
- If the fresh install and configuration uses the same IIS virtual app folder names then the new ibmcognos/bi folder may remember old re-write rules. Remove /ibmcognos/sso and /ibmcognos folders in IIS configuration and when you re-add them and see old rules in /ibmcognos/bi/ re-write list then delete these rules and just write them again.
- No extra whitespaces, missing chars or other typo errors in rules
- Order of rules must be correct (use the order listed in the below linked web page).
- Check"stop processing the subsequent rules" checkbox option per rule. The first one must be "FALSE" unticked and rest of the rules "TRUE" ticked (if that option is available because redirect action doesn't have this option at all because it will be treated as "TRUE" automatically).
- Both /ibmcognos/ and /ibmcognos/sso/ folders are application folders in IIS and use the same application pool. Both IIS folders must have "Intergrated Windows Authentication" authentication option enabled and anonymous disabled.
- /ibmcognos/sso/ application folder uses cisapi request name in a handler mapping configuration even when the actual file reference is still cognosisapi.dll.

The C11.0.4 SSO/IIS configuration steps: http://www.ibm.com/support/knowledgecenter/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_sso_actdirserver.html

And make sure that IIS service and application pool identity has a permission to read those webcontent and cgi-bin Cognos folders. As a temporary test you could try to change the application pool identity in IIS config to use your own AD domain account. If it works this way then check file permission (normally IIS app pool identities should have read access).

[hardstep]

There is another thread going on regarding SSO issues here :
https://community.watsonanalytics.com/discussions/questions/24040/cognos-analytics-1104-sso-will-not-work.html

With references to the detail that ZenCog mentions above ! (nice work ZenCog !).

[prince9]

Thnx Zencog.

[prince9]

@Zencog :got the SSO working now  but having a strange issue like not able to see contents inside folders like datamodules/reports or folder properties. 
When I hit dispatcher on 9300/bi and login then I can see everything..

[rayden0123]

ZenCognos - Believe me i have tried all these steps multiple times - including uninstalling all versions on the server and re-installing and re-configuring. But am still being prompted for a windows security screen and does not take my ad / password.

[rayden0123]

@Zencog :got the SSO working now  but having a strange issue like not able to see contents inside folders like datamodules/reports or folder properties. 
When I hit dispatcher on 9300/bi and login then I can see everything..

Worked with IBM - they changed the URI For Dispatcher to http://Servername:9305/bi/v1 instead of the original 11.0.3 which was http://Servername:9305/p2pd/servlet/dispatch/ext and the SSO worked. But I have the same problem with SSO working. Can't access packages / create new reports or modify anything. Cant say what the problem is. Everything works fine if we use the Gateway URI which is http://servername:9305/bi/v1/disp

[ZenCog]

Worked with IBM - they changed the URI For Dispatcher to http://Servername:9305/bi/v1 instead of the original 11.0.3 which was http://Servername:9305/p2pd/servlet/dispatch/ext and the SSO worked. But I have the same problem with SSO working. Can't access packages / create new reports or modify anything. Cant say what the problem is. Everything works fine if we use the Gateway URI which is http://servername:9305/bi/v1/disp

Hi,

That Cognos11 Configuration issue is something I forgot to mention earlier. IF you copy the old C10 exported cogstartup.xml configuration file to C11 environment then gateway and dispatcher URIs may be in the old C10 format. I used "reset to default" in C11 configurator to set gatewayURI and external dispatcher URI values to C11 format and set correct hostname and port numbers.

At the moment I used following syntax in URI values in C11 configuration (couple of them use different syntax than C10, so be careful if you import the old confgi file):
Gateway Settings Gateway URI=http://mycognosboxname:9300/bi/v1/disp
Gateway Settings Dispatcher URIs for gateway=http://mycognosboxname:9300/bi/v1
Dispatcher Settings External Dispatcher URI=http://mycognosboxname:9300/p2pd/servlet/dispatch
Dispatcher Settings Internal Dispatcher URI=http://mycognosboxname:9300/p2pd/servlet/dispatch
Other URI Settings Dispatcher URI for external applications=http://mycognosboxname:9300/b1/vi/disp
Other URI Settings Content Manager URIs=http://mycognosboxname:9300/p2pd/servlet

And now to the "non-working Dashboard/DataModeling" components and random blank properties screens. I have seen that problem also and it turn out to be missing MIME types in IIS. Please make sure that you have added following MIME type in IIS either in top iis server level or at least in /ibmcognos/ virtual directory level:

.json=application/json
.template=text/html
.woff=application/font-woff
.woff2=application/font-woff2
.svg=image/svg+xml

If you don't have template and json MIME types then the behaviour is exactly what you described (ie. C11 portal seems to be working just fine except the new dashboard fails to retrieve any data and properties windows are blank).

The IBM "11.0.4 SSO/IIS" web page lists woff=application/x-font-woff mime type but it is an old unofficial mime type defined by W3C consortium and woff2 is listed in the IBM's web page as font/woff2.  However, if you do Google search then most of other places document them as application/font-woff and font-woff2 mime types. See https://en.wikipedia.org/wiki/Web_Open_Font_Format web page (this page mentions that font/woff might work in some browsers, but it recommends to use application/font-woff format).

[rayden0123]

Hi,

That Cognos11 Configuration issue is something I forgot to mention earlier. IF you copy the old C10 exported cogstartup.xml configuration file to C11 environment then gateway and dispatcher URIs may be in the old C10 format. I used "reset to default" in C11 configurator to set gatewayURI and external dispatcher URI values to C11 format and set correct hostname and port numbers.

At the moment I used following syntax in URI values in C11 configuration (couple of them use different syntax than C10, so be careful if you import the old confgi file):
Gateway Settings Gateway URI=http://mycognosboxname:9300/bi/v1/disp
Gateway Settings Dispatcher URIs for gateway=http://mycognosboxname:9300/bi/v1
Dispatcher Settings External Dispatcher URI=http://mycognosboxname:9300/p2pd/servlet/dispatch
Dispatcher Settings Internal Dispatcher URI=http://mycognosboxname:9300/p2pd/servlet/dispatch
Other URI Settings Dispatcher URI for external applications=http://mycognosboxname:9300/b1/vi/disp
Other URI Settings Content Manager URIs=http://mycognosboxname:9300/p2pd/servlet

And now to the "non-working Dashboard/DataModeling" components and random blank properties screens. I have seen that problem also and it turn out to be missing MIME types in IIS. Please make sure that you have added following MIME type in IIS either in top iis server level or at least in /ibmcognos/ virtual directory level:

.json=application/json
.template=text/html
.woff=application/font-woff
.woff2=application/font-woff2
.svg=image/svg+xml

If you don't have template and json MIME types then the behaviour is exactly what you described (ie. C11 portal seems to be working just fine except the new dashboard fails to retrieve any data and properties windows are blank).

The IBM "11.0.4 SSO/IIS" web page lists woff=application/x-font-woff mime type but it is an old unofficial mime type defined by W3C consortium and woff2 is listed in the IBM's web page as font/woff2.  However, if you do Google search then most of other places document them as application/font-woff and font-woff2 mime types. See https://en.wikipedia.org/wiki/Web_Open_Font_Format web page (this page mentions that font/woff might work in some browsers, but it recommends to use application/font-woff format).

Thanks @ZenCog. I have everything setup the way you have described above. But for some reason - my Package/ Report Permissions are not flowing through when I am using SSO. That is the reason - I cant use the packages to create a new report and get errors related to missing packages when i am opening an existing report. On the other hand - if I login to the dispatcher directly - all my security permissions are being shown and everything seems to be working.

Any suggestions why this is happening ? Thanks much for everyone's assistance.

[rayden0123]

@ZenCog - sorry i meant gateway directly (http://servername:9305/bi/v1/disp)

[ZenCog]

Thanks @ZenCog. I have everything setup the way you have described above. But for some reason - my Package/ Report Permissions are not flowing through when I am using SSO

Really strange. Shouldn't be the case of wrong namespaceID in the new configuration because in that case things wouldn't work even via dispatcher URL.

One note about my existing gateway URI settings. I think I should use http://mycognosboxname/ibmcognos/bi/v1/disp Gateway URI instead of "Gateway Settings Gateway URI=http://mycognosboxname:9300/bi/v1/disp" value as I mentioned above. Both values work when using browser to consume Cognos content but externally referenced Cognos links would use this GatewaySettings-GatewayURI value, so it better be SSO compatible URL instead of direct dispatcher port.

Back to your problem. Very strange. One more thing you might wanna try is to tweak IIS request filtering settings. IIS has a security feature where IIS can reject URL request if the url or queryString parameter list is too long. This used to cause problems already in C10 administration screens if the server had lots of dynamic cubes (dynamiccube admin screen somehow posted the whole list of cube properties back to the web server).

Anyway. Solution to this problem was to increase this IIS request filtering values:
- IIS admin manager
- Choose "Default Web Site"
- Choose "Request Filtering" icon
- Click "Edit Feature Settings..." link on the right side of the window
- Increase "Maximum URL length (bytes)" and "Maximum query string (bytes)" values. I have set both to 8192 bytes.

Also, check IIS caching option. Maybe your browser is caching something it is not supposed to do.
- IIS admin manager
- Choose "HTTP Response Headers"
- Click "Set common headers" on the right side
- Make sure that "HTTP Keep alive" is selected.
- I have also set "Expire web content after 3 days" option to increase performance (ie client browser caches static URL content for X days before re-loading it from a server).

Anyway. Try to unselect this "expire web content" option AND then clear browser cache. If you use IE browser then remember to UNTICK "preserve favourites web site data" option in delete dialogbox. Otherwise IE won't clear local cache if you have Cognos web address in favourites links.

And do you get the same behaviour both in IE and Chrome browsers? If other browser works then it would tell us that problem is probably in local browser settings and not in server side. If both browsers have the same problem then there is still something wrong in the server side.

[Jeff H.]

I was wondering if people could post what the server configuration is for SSO that they have working.

I'm trying to get SSO working on Windows Server 2012 / IIS 8.5 but have had no luck with the suggestions in this thread. We're trying both the REMOTE_USER / NTLM approach and Kerberos Authentication.