This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal


Apr 9, 2013, 8:09 AM
69 Posts
topic has been resolvedResolved

OpenSocial again, 403

  • Category: OpenSocial - Embedded Experiences
  • Platform: Windows
  • Release: 9.0
  • Role: Administrator
  • Tags: embedded experience,connections,opensocial
  • Replies: 16

I had a poorly working configuration inherited from beta and after we migrated to Connections 4.5 I decided to complete a new configuration. So I took another server to serve as Shindig and configured everything according to Connections and Domino documentation, was pretty easy I have to say. much better than Connectons 4 configuration.

However it does not work. I get an error in my trace

CLPEE6017W: Error preloading the gadget at https://conn.acme.com/connections/resources/web/com.ibm.social.as/gadget/ActivityStreamNotes.xml 
{"message":"Unable to retrieve spec for https:\/\/conn.acme.com\/connections\/resources\/web\/com.ibm.social.as\/gadget\/ActivityStreamNotes.xml. 
HTTP error 403","code":403}

I checked Connections log and there are no errors there. I also checked the IHWS logs and I see requests to the gadget and I see reply with code 200, no403. So it must be the proxy on Domino who is denying access to my Notes client? How can I solve this issue?

Apr 9, 2013, 3:37 PM
34 Posts
RE: OpenSocial again, 403
The 403 indicates that the proxy on the Domino Server with Shindig is rejecting the request.  It uses the proxy rules set for the Widget during the Widget approval process. The "PushToCredStore" agent, which must be enabled, will push the appropriate data to the credential store during the approval process.  Ensure it is enabled.

The Domino Server with Shindig reads the proxy data from the credential store during the Gadget rendering process.  The Domino Server with Shindig will cache the proxy data in memory for an hour (by default).  You can force it to reload the data by running "tell http osgi social refresh proxy".  The same is true for OAuth data as well, which you can force to be read into memory by using "tell http osgi social refresh all", which will force all OAuth, proxy, and gadget capabilities data to be refreshed from the credential store.

See more here about the data I've referred to: http://www-10.lotus.com/ldd/dominowiki.nsf/xpDocViewer.xsp?lookupName=Administering+IBM+iNotes+9.0+Social+Edition#action=openDocument&res_title=Widgets_created_from_an_OpenSocial_gadget_9.0&content=pdcontent
Apr 10, 2013, 9:22 AM
69 Posts
RE: OpenSocial again, 403

Thank you for your reply Stanton, the agent was actually not enabled, my fault. The toolbox is an old database, I thought agents were enabled there. I will wait unti everything completes and check again.

Apr 11, 2013, 12:00 PM
69 Posts
RE: OpenSocial again, 403

OK, now widgets are OK, OGSi is working, agents are enabled, widgets deployed

When I try to open the Updates widget I am being asked to complete the OAuth authorization procedure. I click on the link and instead of getting to the page to approve or deny the authorization, I get

No errors are visible in the Connections log however in the HTTP server log I see that my client IP is requesting the URL I pasted and then Connections is requesting the oauth error page URL. But I could not find any log messages, also debug and tracing settings for OAuth are not described in Connections documentation.

Apr 11, 2013, 7:23 PM
34 Posts
RE: OpenSocial again, 403
The URL to Connections has this as a query parameter: redirect_uri=https%3A%2F%2Fmail.acme.com%2Ffiesta%2Fgadgets%2Foauth2callback

Is that redirect_uri the same one you registered with Connections when you registered the OAuth client?  They need to match exactly, including the scheme.  If you don't have SSL enabled on Domino you can change the redirect_uri that domino generates.

See the following:
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Integration_with_IBM_Connections_4_OSC90#Before+you+begin
http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Server-centric_settings_OSC90#OAuth+Callbacks
Apr 11, 2013, 9:09 PM
69 Posts
RE: OpenSocial again, 403

OK, I see. I just followed the IC 4.5 documentation http://www-10.lotus.com/ldd/lcwiki.nsf/xpDocViewer.xsp?lookupName=IBM+Connections+4.5+documentation#action=openDocument&res_title=Registering_IBM_Notes_as_a_consumer_of_the_Activity_Stream_and_Embedded_Experience_gadgets_ic45&content=pdcontent

It says

callbackurl is where to redirect to when the gadget has been granted authorization. This should be: http://yourdominoserver.domainx.com/fiesta/gadgets/oauth2callback where yourdominoserver is the name of your shindig server.

I think it is quite confusing. We do have SSL enabled on our Domino server. So I guess now I have to register gadgets again?

But I assume I need to remove that previous registration first? I could not find how can I do this. Do you have a tip for me there?

Apr 12, 2013, 12:08 PM
34 Posts
RE: OpenSocial again, 403
Hi Alex,

The Connections documentation should instruct you to pick HTTPS, if enabled on Domino.  The OAuth2 specification strongly recommends using TLS for the redirect_uri.  http://tools.ietf.org/html/rfc6749#section-3.1.2.1  I'll make sure that documentation is updated.

Here is my recommendation moving forward:
  1. Use the information I sent in my last post (http://www-10.lotus.com/ldd/dominowiki.nsf/dx/Server-centric_settings_OSC90#OAuth+Callbacks) to update your domino server such that it generates redirect_uris with HTTP instead of HTTPS.  This should allow you to verify that the rest of the connections integration is working.
  2. Once you're done with #1, register a new OAuth client on connections, but use HTTPS instead. Update the widgets you have to use the new client id and secret from the new OAuth client you registered. Reset your domino server to send HTTPS (undo what you did in #1).  Try the Connections behavior again.  Having two registered OAuth clients on Connections should not hurt anything.
To your other question, I could not find a way to remove an OAuth client that has been registered, but admittedly, I am not an expert in this area.  You may find the following resource useful.  The commands here are used under the covers when you use the NotesRegistrar.  http://www-10.lotus.com/ldd/lcwiki.nsf/xpDocViewer.xsp?lookupName=IBM+Connections+4.0+documentation#action=openDocument&res_title=Authorization_Management_Commands_ic40&content=pdcontent
Apr 12, 2013, 1:35 PM
69 Posts
RE: OpenSocial again, 403

Stanton, the authorization worked well.You are amazing, thank you very much. Updates works.

However for some reason EE is showing up in any emails. I remember that I didn't do anything specific with beta to make it work but now I just see regular notification mails :(

Apr 24, 2013, 9:10 AM
23 Posts
RE: OpenSocial again, 403

Dear Alex,

Did you already fixed your problem with EE. Because I have the same problem. Updates widget(plugin) is working but not the Embedded Experience widget(plugin).

No errors !!

Thank you. :)

Apr 24, 2013, 11:25 AM
69 Posts
RE: OpenSocial again, 403

Hi Gert-Jan,

No, I still have this issue, busy with it now. I removed the EE gadget and try to reconfigure it

Regards, Alexey

Apr 24, 2013, 11:33 AM
69 Posts
RE: OpenSocial again, 403

Stanton,

When using NotesRegistrar.registerGadgets in Connections, the *.Gadget.oauth.xml files have http URLs for OAuth calls. This is generated by Connections and there is no way to influence this. I guess it should be https

Regards, Alexey

Apr 24, 2013, 1:19 PM
23 Posts
RE: OpenSocial again, 403

 

Alex, thanks for you answer.

Hi Staton, Can you tell me the requirements for the Embedded Experience plugin. Because If a open a "connections" mail nothing is happen. I'm not receiving any error except "errors" below

 

 

2013-04-24T15:17:30.254+02:00 WARNING Executing (eclipseSelectionChanged)();in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:30.301+02:00 WARNING Executing (eclipseSelectionChanged)();in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:30.316+02:00 WARNING Executing (eclipseSelectionChanged)();in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:32.801+02:00 WARNING Executing (eclipseSelectionChanged)([{"dataObject":{"senderId":"IBM Connections Administrator","status":"read","urls":["notes:\/\/ID01%2FDemo\/C1257B240054BFA9\/38D46BF5E8F08834852564B500129B2C\/8B72AE39E5BC305186F90ED033BB3D7D",null,"notes:\/\/ID01%2FDemo\/C1257B240054BFA9\/38D46BF5E8F08834852564B500129B2C\/8B72AE39E5BC305186F90ED033BB3D7D?dbid=131332120&viewid=78595608"],"timeSent":"Mar 19 4:28 PM","title":"[Files] Gert-Jan Alderlieste has shared 'Domino8.jpg' with you","data":{"Size":"10K","Subject":"[Files] Gert-Jan Alderlieste has shared 'Domino8.jpg' with you","Date":"Mar 19 4:28 PM","Who":"IBM Connections Administrator"},"id":"1122:8B72AE39E5BC305186F90ED033BB3D7D"},"type":"opensocial.Message"}]);in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:34.269+02:00 WARNING Executing (eclipseSelectionChanged)([{"dataObject":{"senderId":"IBM Connections Administrator","status":"read","urls":["notes:\/\/ID01%2FDemo\/C1257B240054BFA9\/38D46BF5E8F08834852564B500129B2C\/8B72AE39E5BC305186F90ED033BB3D7D",null,"notes:\/\/ID01%2FDemo\/C1257B240054BFA9\/38D46BF5E8F08834852564B500129B2C\/8B72AE39E5BC305186F90ED033BB3D7D?dbid=131332120&viewid=78595608"],"timeSent":"Mar 19 4:28 PM","title":"[Files] Gert-Jan Alderlieste has shared 'Domino8.jpg' with you","data":{"Size":"10K","Subject":"[Files] Gert-Jan Alderlieste has shared 'Domino8.jpg' with you","Date":"Mar 19 4:28 PM","Who":"IBM Connections Administrator"},"id":"1122:8B72AE39E5BC305186F90ED033BB3D7D"},"type":"opensocial.Message"}]);in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:34.441+02:00 WARNING Executing (eclipseSelectionChanged)([{"dataObject":{"senderId":"IBM Connections Administrator","status":"read","urls":["notes:\/\/ID01%2FDemo\/C1257B240054BFA9\/38D46BF5E8F08834852564B500129B2C\/8B72AE39E5BC305186F90ED033BB3D7D",null,"notes:\/\/ID01%2FDemo\/C1257B240054BFA9\/38D46BF5E8F08834852564B500129B2C\/8B72AE39E5BC305186F90ED033BB3D7D?dbid=131332120&viewid=78595608"],"timeSent":"Mar 19 4:28 PM","title":"[Files] Gert-Jan Alderlieste has shared 'Domino8.jpg' with you","data":{"Size":"10K","Subject":"[Files] Gert-Jan Alderlieste has shared 'Domino8.jpg' with you","Date":"Mar 19 4:28 PM","Who":"IBM Connections Administrator"},"id":"1122:8B72AE39E5BC305186F90ED033BB3D7D"},"type":"opensocial.Message"}]);in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:35.738+02:00 WARNING Executing (eclipseSelectionChanged)();in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:35.816+02:00 WARNING Executing (eclipseSelectionChanged)();in the container. com.ibm.rcp.opensocial.container.internal.ContainerPlugin
2013-04-24T15:17:35.832+02:00 WARNING Executing (eclipseSelectionChanged)();in the container.

Updates plugin is working.
So far I can check everything is configured correctly.

I'm using the same configuration in a second environment and the second environment is working correctly.

Please Help :)

 
Apr 24, 2013, 1:32 PM
69 Posts
RE: OpenSocial again, 403

I re-registered the gadgets with https, removed custom oauth URLs, removed old widgets from the toolbox and imported new ones. To speed up the process I disabled and enabled toolbox agents, updated widgets in OGSi and had to restart the Domino server. After that EE started to work in iNotes but I am getting a message that is shown in red where errors are normally shown. The message is

04/24/2013 03:28:41PM e-5C372F367B60FBF5498635B040FCB75A-2-body-ee::http://conn.acme.com/connections/resources/web/com.ibm.social.ee/ConnectionsEE.xml::default::[{"status":0,"responseText":""}]

Any ideas what this could mean?

Apr 24, 2013, 4:41 PM
23 Posts
RE: OpenSocial again, 403

For my first environment I re-installed Domino and Domino Social Plugin.

I'm still using the same toolbox and Credition Store database's but I first removed all existing plugins.
Then I imported the plugins again, but it is still not working.

Updates plugin is working but EE plugin not :(

Apr 25, 2013, 4:00 PM
23 Posts
RE: OpenSocial again, 403

In iNotes console I'm reveiving this error: 04/25/2013 05:46:41PM Neither the gadget nor url Embedded Experience are trusted to render.

Gadget still not trusted. 
Today I have started all over again.

- Deleted credit store and widget catalog database
- I delete credit store keys.

And recreate everything, except policy and configuration documents and server (social) settings.

Update widget is working but EE is still not working.

I'm a little bit lost now. :(

 

Apr 26, 2013, 3:58 PM
23 Posts
RE: OpenSocial again, 403

Problem solved :)

Connections notifications mails were included with http hyperlinks and not https hyperlinks.

So I changed this setting in the LotusConnections-config.xml from false to true: <forceConfidentialCommunications enabled="true"/>

I created a new notification and now EE is working :)


This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal