Use the Web content member fixer task

 

+

Search Tips   |   Advanced Search

 

Use the member fixer task to check whether any users or groups referenced in IBM Lotus Web Content Management items have been renamed or deleted and fix these references. Member fixer is used to:

The member fixer task's function is to check all of the items in a specified library for references to users and groups that no longer exist in the current user repository. In report mode, it will report all the references to members. In fix mode, these references can be fixed, either by replacing them with references to members that exist, or by removing the references. The fix parameter determines whether the member fixer task runs in report or fix mode.

References to members in library items contain the distinguished name of the member as well as a unique ID for the member. This unique ID is an internal id that is unique over time, and is different to the distinguished name. This means if a member is deleted and another member is created with the same distinguished name, the two members will have different unique IDs. The mismatched_id parameter can be used to update or remove references from web content items to users with these unique IDs.

When a member that has been given permissions on a library is deleted, the member permissions are entirely removed from the library, so that any inherited permissions for items in the library will also be removed. Therefore, the member fixer task can not be used to update these permissions to a different member. However, when an LDAP transfer is carried out, the member permissions on the library are maintained. So, the member fixer task can be run after an LDAP transfer to update or remove these permissions


Custom Mapping

To update a reference to a member that does not exist with a member that does exist, member mappings can be defined in a custom mapping file. Where the member fixer task does not find a mapping in this file for a member, it will search the user repository for members with the same ID as the member that no longer exists. If such a member is found, it will update the reference with this user or group, or remove the reference, as specified by the alt_dn parameter. If no such member is found, this member is classified as 'invalid' and will be updated or removed as specified by the invalid_dn parameter.

If custom mapping is required perform the following steps to map the user and group domain names before running the member fixer task:

  1. Update the following properties in...

      profile_root/PortalServer/wcm/shared/app/config/wcmservices/MemberFixerModule.properties

    • cn=contentAuthors,dc=lotus,o=ibm->cn=contentEditors,dc=rational,o=ibm

      Completely replace one distinguished name with another.

    • cn=[ID],dc=websphere,o=ibm->cn=[ID],dc=tivoli,o=ibm

      Replace part of a distinguished name. This example will change all of the distinguished name except the common name.

    Further examples are listed in MemberFixerModule.properties.

  2. You then run the member fixer task using the option...

    -DaltDn


Running the Member Fixer task:

  1. Open a command prompt.

    The library specified in the command is the library to be scanned by the member fixer task. If the query parameter "library" is omitted, the default library that has been configured in WCMConfigService.properties will be used.

  2. To create a report of users or groups referenced in Web Content Management items that need fixing...

      cd profile_root/ConfigEngine:
      ./ConfigEngine.sh run-wcm-admin-task-member-fixer -DPortalAdminId=username -DPortalAdminPwd=wpsadmin -Dlibrary="MyLibrary"

    An administrator user name and password is not required if you have already specified the portal administrator username and password using the PortalAdminId and PortalAdminPwd settings in wkplc.properties.

    Before progressing to the next step and running the member fixer task in fix mode, ensure that the report mode indicates that the updates will happen as you require. A summary of the updates will be shown by the command. A detailed report containing the updates that will be made for each item will be shown in

    profile_root/logs/WebSphere_Portal/SystemOut.log

    If the report indicates that the update will not happen as required, change the member fixer task parameters and run the report mode again. Repeat this process until you are satisfied that the fixes will be applied correctly. This is important because the fixes made by the member fixer task when run in fix mode may not be easy to undo if incorrect fixes are applied.

  3. If there have been changes to users and groups, update the items that reference them...

      ./ConfigEngine.sh run-wcm-admin-task-member-fixer -DPortalAdminId=username -DPortalAdminPwd=wpsadmin -Dlibrary="MyLibrary" -Dfix=true

    An administrator user name and password is not required if you have already specified the portal administrator username and password using the PortalAdminId and PortalAdminPwd settings in wkplc.properties.

    If the member fixer task indicates that certain mismatched member conditions exist, append the specified parameters to the command:


    Table 1. Member fixer conditions

    Condition description Command to correct condition
    Nonexistent users or groups have alternate distinguished names (DNs) available.

    • To update the items that reference the nonexistent users or groups, append -DaltDn=update to the command.

    • To remove the members that reference the users or groups append -DaltDn=remove to the command.

    If users or groups have invalid distinguished names (DNs) the report will list these as "invalid". This means the distinguished name doesn't exist and there is no alternate distinguished name available.

    • To remove users and groups that have invalid distinguished names append -DinvalidDn=remove to the command.

    • To update users and groups that have invalid distinguished names with the portal administrator user's distinguished names append -DinvalidDn=update to the command.

    Users or groups have been found with mismatched unique IDs.

    • To fix the mismatched unique IDs append -DmismatchedId=update to the command.

    • To remove users and groups with mismatched unique IDs append -DmismatchedId=remove to the command.

  4. After the member fixer task has run, review the SystemOut.log to verify that the member fixer task ran correctly. The member fixer task may not be able to save items that fail validation, such as items that contain invalid fields.

    You must edit these items to make them valid and then run the member fixer task again.


Running the Member Fixer in a federated security environment

In a federated security environment with multiple realms, you can specify the realm to run the member fixer task on by adding -Drealm=realmName to the command. If this parameter is omitted the default realm will be used.

The member fixer task will check whether there are any members and groups referenced in items that are under any of the base distinguished names defined for the specified realm and fix these references. References to members can only be updated with references to members in the specified realm.

Additionally, the member fixer task can be used to check whether there are any members and groups referenced in items that are not under any of the base distinguished names defined for any of the realms in the environment and fix these references. To do this, follow the same steps described above for a single realm environment and add -DnoRealmDn=true to the command.

In a federated security environment with multiple realms, the member fixer task should be run for each realm in turn to make sure that all of the references are fixed.


Preserving dates

You can preserve the last modified date of items updated by the member fixer task by adding -DpreserveDates=true to the command. Otherwise the last modified date will be updated when the member fixer task is run.


Restrict which items types to fix

You can restrict which objects types are processed by appending -DrestrictOn=ItemType to the command.

For example: -DrestrictOn=Content,Style,Template,Taxonomy,Category,Site,SiteArea,Workflow,WorkflowStage,WorkflowAction,Cmpnt.

If not specified, all object types will be updated.


Parameters to set for large repositories

To prevent your session timing out before the task has finished, you can append the option...

-DsessionTimeOut=timeOut

This sets the number of seconds in which the task must complete before its session will timeout. The default session timeout is 14,440 seconds, which is 4 hours. For large repositories you should increase this setting.

For example: -DsessionTimeOut=36000, which is 10 hours.


Locked items

By default, locked items will be unlocked and processed when you run the member fixer task. To ignore locked items while running the task, add...

-DforceUnlock=false


Examples

These options can be combined when the conditions occur at the same time.

For example, if alternate DNs are available for nonexistent users and groups and there are mismatched unique IDs, you would use the following command:

If there have been changes to users and groups that are within the specified realm or that are not within any realm, update the items that reference them by entering the following command:


Parent topic:

Maintain Web content