Documentum 23.2 PostgreSQL 15.2 on Arch Linux (WSL2) Install Guide

This is a step-by-step guide to install Documentum 23.2 in WSL2 using the Arch Linux image with PostgreSQL 15.2. This is probably the smallest possible installation you can do (considering that Documentum binaries do not work on Alpine) and it is obviously totally unsupported 😀

Initial Configuration

After installing the WSL2 Arch distribution from the Microsoft Store, we need to change the keyboard locale and update/install some packages:

[dmadmin@aldago-desktop ~] sudo vim /etc/locale.gen
en_US.UTF-8 UTF-8
[dmadmin@aldago-desktop ~] sudo locale-gen

[dmadmin@aldago-desktop ~] sudo pacman -Syu

[dmadmin@aldago-desktop ~] sudo pacman -S tcl expect ttf-dejavu libxtst unzip inetutils net-tools libxrender postgresql core/libxcrypt-compat unixodbc git freetype2-docs fontconfig

[dmadmin@aldago-desktop ~] sudo ln -s  /usr/lib/  /usr/lib/

PostgreSQL Configuration

First we need to configure PostgreSQL:

[dmadmin@aldago-desktop ~] sudo mkdir /run/postgresql
[dmadmin@aldago-desktop ~] sudo chown postgres:postgres /run/postgresql

[dmadmin@aldago-desktop ~]  sudo -iu postgres
[postgres@aldago-desktop ~]$ initdb --locale $LANG -E UTF8 -D '/var/lib/postgres/data/'

[postgres@aldago-desktop ~]$ echo "host all all md5" >> /var/lib/postgres/data/pg_hba.conf
[postgres@aldago-desktop ~]$ echo "listen_addresses='*'" >> /var/lib/postgres/data/postgresql.conf

[postgres@aldago-desktop ~]$  pg_ctl -D /var/lib/postgres/data/ start
[dmadmin@aldago-desktop ~]$ sudo passwd postgres
New password:
Retype new password:
passwd: password updated successfully
[dmadmin@aldago-desktop ~]$ psql -U postgres
psql (15.2)
Type "help" for help.

postgres=# \password postgres
Enter new password for user "postgres":
Enter it again:
postgres=# exit

Next, we need to install yay in order to install psqlodbc:

[dmadmin@aldago-desktop ~] git clone
[dmadmin@aldago-desktop ~] cd yay
[dmadmin@aldago-desktop ~] makepkg -si
[dmadmin@aldago-desktop ~] yay -S psqlodbc

And finally, we can configure the odbc connection:

[dmadmin@aldago-desktop ~] sudo vim /etc/odbc.ini

[dmadmin@aldago-desktop ~] sudo vim /etc/odbcinst.ini
Driver = /usr/lib/
Driver64 = /usr/lib/
Setup64 = /usr/lib/
FileUsage = 1

[dmadmin@aldago-desktop ~]$ isql -v MyPostgres
| Connected!                            |
|                                       |
| sql-statement                         |
| help [tablename]                      |
| echo [string]                         |
| quit                                  |
|                                       |
SQL> quit

Documentum Server

First, we need to create the DB folder:

[dmadmin@aldago-desktop ~]$ sudo -iu postgres
[postgres@aldago-desktop ~]$ mkdir /var/lib/postgres/data/db_dctm232_dat.dat
[postgres@aldago-desktop ~]$ exit

The Documentum folders and JDK:

[dmadmin@aldago-desktop ~]$ sudo mkdir -p /opt/documentum/sw && sudo mkdir -p /opt/documentum/product/23.2
[dmadmin@aldago-desktop ~]$ sudo chown -R dmadmin:dmadmin /opt/documentum

[dmadmin@aldago-desktop documentum]$ wget
[dmadmin@aldago-desktop documentum]$ tar -xvf OpenJDK17U-jdk_x64_linux_hotspot_17.0.6_10.tar.gz

Add environment variables to .bash_profile:

[dmadmin@aldago-desktop documentum]$ vim ~/.bash_profile

export DM_HOME

export DM_JMS_HOME


export JAVA_HOME


export PATH

export LC_ALL



[dmadmin@aldago-desktop ~]$ source ~/.bash_profile

Reserve ports and configure limits.conf:

[dmadmin@aldago-desktop ~]$ sudo vim /etc/services
dctm232 50000/tcp # dctm 23.2 repo
dctm232_s 50001/tcp # dctm 23.2 repo

[dmadmin@aldago-desktop ~]$ sudo vim /etc/security/limits.conf
dmadmin – core -1

And now you can simply install content server normally 🙂

Opentext (Documentum) vs. Logging configuration (ActiveMQ)

I was going to name this Documentum vs Logging configuration, but this seems to be a recurrent error on Opentext where their engineers fail to understand how logging works (exactly this same issue can be seen in Appworks, for example).

If you check the catalina.out file from latest DCTM 22.4 you’ll see a recurrent trace, which is extremely annoying and it will fill up the log as it writes constantly the same lines:

20:13:28.071 [ActiveMQ Journal Checkpoint Worker] DEBUG - Checkpoint started.
20:13:28.071 [ActiveMQ Journal Checkpoint Worker] DEBUG - Checkpoint done.
20:13:31.639 [ActiveMQ InactivityMonitor WriteCheckTimer] DEBUG org.apache.activemq.transport.AbstractInactivityMonitor - WriteChecker: 10000ms elapsed since last write check.
20:13:31.639 [ActiveMQ InactivityMonitor Worker] DEBUG org.apache.activemq.transport.AbstractInactivityMonitor - Running WriteCheck[tcp://]

This comes from ACS using ActiveMQ, which is deployed under tomcat/shared/dc_lib. You can try modifying under ACS application or in Tomcat, nothing will work. Why? Because in the dc_lib folder OT also added the logback libraries, without any configuration whatsoever. So by doing this, besides having a nice mix of every single logging library known to men and women, we’ll get a ton of crap on catalina.out.

So how do we solve this?

Brute force approach: Remove the logback jars 😀

Common sense developer approach: Add the following parameter to JMS startup: -Dlogback.configurationFile=file:/opt/documentum/tomcat9.0.65/bin/logback.xml

And the file should have the following contents:

<?xml version="1.0" encoding="UTF-8"?>
<configuration scan="true" debug="true">
  <appender name="stdout" class="ch.qos.logback.core.ConsoleAppender">
      <pattern>[%t] [%4p] [%d{ISO8601}] %c{1}: %m%n</pattern>
  <appender name="R" class="ch.qos.logback.core.rolling.RollingFileAppender">
      <pattern>[%t] [%4p] [%d{ISO8601}] %c{1}: %m%n</pattern>
    <rollingPolicy class="ch.qos.logback.core.rolling.TimeBasedRollingPolicy">

  <logger name="org.apache.activemq.spring" additivity="false">
    <level value="WARN"/>
    <appender-ref ref="R" />
    <appender-ref ref="stdout" />

  <logger name="org.apache.activemq.web.handler" additivity="false">
    <level value="WARN"/>
    <appender-ref ref="R" />
    <appender-ref ref="stdout" />

  <logger name="org.apache.activemq.xbean" additivity="false">
    <level value="WARN"/>
    <appender-ref ref="R" />
    <appender-ref ref="stdout" />
  <logger name="org.apache.activemq" additivity="false">
    <level value="INFO"/>
    <appender-ref ref="R" />
    <appender-ref ref="stdout" />

  <root level="INFO">
    <appender-ref ref="stdout"/>
    <appender-ref ref="R"/>

Now you’ve removed useless logging from catalina.out, configured it properly, and placed it on its own file. Not so difficult, right?

Documentum 22.4 PostgreSQL WSL2 Install Guide

This is a step-by-step guide to install Documentum 22.4 in WSL2 using the Ubuntu 20.04 image with PostgreSQL 14.


  • Host:
    Windows 11 x64 8GB RAM
  • WSL2:
    Ubuntu 20.04 LTS

WSL2 Configuration

  • Make sure you’re using the Ubuntu 20.04 image with WSL2:

wsl -l -v
* Legacy Stopped 1
* Ubuntu-20.04 Running 2

  • Create dmadmin user and add it to the sudoers group:

aldago@laptop:/$ sudo adduser dmadmin
Adding user `dmadmin’ …
Adding new group `dmadmin’ (1001) …
Adding new user `dmadmin’ (1001) with group `dmadmin’ …
Creating home directory `/home/dmadmin’ …
Copying files from `/etc/skel’ …
New password:
Retype new password:
passwd: password updated successfully
Changing the user information for dmadmin
Enter the new value, or press ENTER for the default
Full Name []: dmadmin
Room Number []:
Work Phone []:
Home Phone []:
Other []:
Is the information correct? [Y/n] y

aldago@dctm:/$ sudo usermod -aG sudo dmadmin

  • Configure nameserver to access Internet:

dmadmin@dctm:~$ sudo vi /etc/resolv.conf

  • Install pacakges:

dmadmin@dctm:~$ sudo apt-get update
dmadmin@dctm:~$ sudo apt -y install tcl expect

PostgreSQL Configuration

  • Install required packages:

 dmadmin@dctm:~$ sudo sh -c ‘echo “deb $(lsb_release -cs)-pgdg main” > /etc/apt/sources.list.d/pgdg.list’
dmadmin@dctm:~$ wget –quiet -O – | sudo apt-key add –
dmadmin@dctm:~$ sudo apt -y update
dmadmin@dctm:~$ sudo apt -y install postgresql-14

  • Start the PostgreSQL service:

dmadmin@laptop:~$ sudo service postgresql start
* Starting PostgreSQL 14 database server [ OK ]

  • Configure the postgres user:

dmadmin@dctm:~$ sudo passwd postgres
New password:
Retype new password:
passwd: password updated successfully

dmadmin@laptop:~$ sudo -u postgres psql postgres
psql (14.5 (Ubuntu 14.5-2.pgdg20.04+2))
Type “help” for help.

postgres=# password postgres
Enter new password:
Enter it again:
postgres=# exit

  • Restart PostgreSQL service to apply the changes:

dmadmin@dctm:~$ sudo service postgresql restart
* Starting PostgreSQL 14 database server [ OK ]

phpPgAdmin Configuration

  • Install required packages (we need to manually update to 7.13 if we’re using PostgreSQL 14):

dmadmin@dctm:~$ sudo apt install -y phppgadmin

dmadmin@dctm:~$ wget
dmadmin@dctm:~$ tar -xvf phpPgAdmin-7.13.0.tar.gz
dmadmin@dctm:~$ sudo mv /tmp/phpPgAdmin-7.13.0 /usr/share/phppgadmin

  • Configure phpPgAdmin:

dmadmin@dctm:~$ sudo vi /usr/share/phppgadmin/
$conf[‘extra_login_security’] = false;

  • Restart httpd service to apply the changes:

dmadmin@dctm:~$ sudo /etc/init.d/apache2 restart
* Restarting Apache httpd web server apache2

Now you should be able to login to the console from http://localhost/phppgadmin/.

ODBC Configuration

  • Install required packages:

dmadmin@dctm:~$ sudo apt -y install unixodbc unixodbc-dev odbc-postgresql

  • Configure .ini files:

dmadmin@dctm:~$ sudo vi /etc/odbc.ini

dmadmin@dctm:~$ sudo vi /etc/odbcinst.ini
Driver = /usr/lib/x86_64-linux-gnu/odbc/
Driver64 = /usr/lib/x86_64-linux-gnu/odbc/
Setup64 = /usr/lib/x86_64-linux-gnu/odbc/
FileUsage = 1

  • Test the connection:

dmadmin@dctm:~$ isql -v MyPostgres
| Connected!                                  
| sql-statement                               
| help [tablename]                         
| quit                                             

Documentum server

  • Create folders:

dmadmin@dctm:~$ sudo mkdir -p /opt/documentum/sw && sudo mkdir -p /opt/documentum/product/22.4
dmadmin@dctm:~$ sudo chown -R dmadmin.dmadmin /opt/documentum

  • Install openJDK 11.0.16 (remember to remove “anon” from the list of disabled algorithms or the installer will fail to connect to the repository)

dmadmin@dctm:/opt/documentum$ tar -xvf ./sw/OpenJDK11U-jdk_x64_linux_hotspot_11.0.16_8.tar.gz -C .

  • Set up environment variables:

dmadmin@dctm:~$ vi .bash_profile
#Required for X11 forwarding
export DISPLAY=$(ip route | awk ‘/default via / {print $3; exit}’ 2>/dev/null):0


export DM_HOME

export DM_JMS_HOME


export JAVA_HOME


export PATH

export LC_ALL


  • Reserve ports for services:

dmadmin@dctm:~$ sudo vi /etc/services
dctm224 50000/tcp # dctm 22.4 repo
dctm224_s 50001/tcp # dctm 22.4 repo

  • Configure limits.conf:

dmadmin@dctm:~$ sudo vi /etc/security/limits.conf
dmadmin – core -1

  • Run the installer:

dmadmin@dctm:/opt/documentum/sw/cs$ tar -xvf documentum_server_22.4_linux64_postgres.tar
dmadmin@dctm:/opt/documentum/sw/cs$ chmod 777 serverSetup.bin
dmadmin@dctm:/opt/documentum/sw/cs$ ./serverSetup.bin

By default, Documentum now requires “strong” passwords, this means with minimum length of 16 characters. You can reduce this to 8 by defining the following environment variable:


Docbroker and repository

  • Create the tablespace file for the repository (dctm224):

dmadmin@dctm:/$ su – postgres
postgres@dctm:~$ mkdir /var/lib/postgresql/14/main/db_dctm224_dat.dat
postgres@dctm:~$ exit

  • Run the configurator:

dmadmin@dctm:/opt/documentum/product/22.4/install$ ./

And you’re good to go 🙂

Experimental D2-SmartView SDK

The experimental preview of the D2 SmartView SDK is finally available to download. This comes packaged as a zip file containing the SDK, which is a combination of Maven, NPM and NodeJS (not the most attractive combination for Documentum old-timers :D)

So, once we get the zip file, we can do the following to install the SDK:

mkdir sviewsdk
cd sviewsdk/
mv ../d2/ .

chmod u+x *.sh
sudo apt-get update
sudo apt install maven
mvn -version

sudo apt install nodejs
node -v

sudo apt install npm
curl -sL | sudo bash -
sudo apt-get install -y nodejs
node -v

sudo npm install -g npm@latest
sudo npm install -g grunt-cli


As the “supported” NPM versions are 12-14, we should manually install 14. You should now run “npm update” to make sure everything is, well, up to date. Then you can launch the documentation by running “npm run documentation”

d2sv-sdk@22.4.0 documentation
node ./utils/doc-server.js

Starting documentation server at

And if you open localhost:7777/sdk:

After reading through the documentation, we should try to run the “workspace assistant”. For this, I had to manually run the following command as the ws-init script didn’t work properly: “sudo npm run postinstall”. After this, you can run the start command “npm start”

d2sv-sdk@22.4.0 start
node ./utils/run-generator-cli.js interface

And you’ll see the “assistant”:

You can browse through the options to see what’s available. For this first test I opted for using the included examples and then compiling them:

After this, I copied the resulting jar file artifact (on the “target” folder, and not the “dist” folder, as the documentation wrongly states) to Smartview and… Smartview no longer starts 😀 So I guess I’ll have to keep investigating… good luck

Remote DAR install

A usual challenge when trying to automate Documentum operations is how to streamline the installation of dar files. These are done via a huge application (composer, basically a customized eclipse) that teams usually mount into some container / server to run these intalls.

However, there’s a simpler way to get this to work: by using a REST endpoint.

1. Create a method to run the dar intall from the content server by running a command line script:

java -Ddfc.keystore.file=$DOCUMENTUM/config/dfc.keystore -Ddar=$1.dar -Dlogpath=/tmp/darinstaller.log -Ddocbase=$2 -Duser=dmadmin -Ddomain= -Dpassword=dmadmin -cp $DM_HOME/install/composer/ComposerHeadless/startup.jar org.eclipse.core.launcher.Main -data $DM_HOME/install/composer/workspace -application org.eclipse.ant.core.antRunner -buildfile $DM_HOME/install/composer/deploy.xml

Note that this is an example where we’re willingly ignoring the user/password authentication as this will be delegated to the REST call.

2. Create a REST extention point to run this. This a simple example of the controller class:

public ContentfulObject createObject(@PathVariable("repositoryName") final String repositoryName,  @RequestBody final InstallDarInfo createObject,  @TypedParam final SingleParam param,  @RequestUri final UriInfo uriInfo)
        throws Exception {

    createObject.addAttribute(new Attribute("object_name",createObject.getDar()));

    ContentfulObject result = sysObjectManager.createSysObjectUnderParentFolder(createObject, "/Temp/installDAR", true, param.getAttributeView());

    Map<String, Object> params = Collections.singletonMap(ViewParams.POST_FROM_COLLECTION, (Object) true);  

    runInstallDARMethod(repositoryName, result.getId(), (String)result.getAttributeByName("object_name"),"/Temp/installDAR") ;
    return (ContentfulObject) getRenderedObject(repositoryName, (ContentfulObject)result, param.isLinks(), uriInfo, params);

private void runInstallDARMethod(String repository, String objectId, String fileName, String folderPath) throws DfException {

    String dqlMethod="execute do_method with method='m_InstallDAR', arguments='"+ objectId + " " + fileName + " " + repository + " " + folderPath + "', launch_async=true, run_as_server=true";
    this.queryEngine.execute(QueryResultItem.class, dqlMethod+";", QueryType.QUERY, 0, 100);

As you can see, this simply takes the file attached to the REST call, stores it on a temporary folder on the repository, and then calls the method to run this.

With this, you can also handle something that, if you’ve played with Documentum cloud images, you might have already realized that OT engineers do not know: The additional artifacts that come with DAR files (install parameters, locales, referenced dar files, etc. The usual stuff “nobody” uses in the real world). Also, you can process several files (ie: zip file containing everything needed to install), you can store the output log, return the log, use different build files depending on your needs, etc.

However, this still presents a challenge: you need to deploy this on DCTM-REST and create a method to run the script that needs to be placed on the CS.

So, is there anything else we can do? Yes 😀

From a couple versions back (20.x?) Documentum has included a JMS servlet to run DAR installs (InstallDarServlet). This is a rather “simple” class that basically receives a couple of parameters (repository, user, login ticket and an object_id from a dar file existing in the repository) and it will run a simple dar install. This servlets presents “great room for improvement”, so you can create a class with the same name and package, copy the code (so you don’t break whatever OT is using this for) and then add a handler for a multipart REST message which does everything we’ve discussed before and then replace this class on the CS. By doing this you will get:

  1. Simplest deployment for deploying DAR files automatically (just replacing one class and restarting JMS, as the servlet is already present on web.xml)
  2. You really don’t need to store anything on the repository, this can be run synchronously (be aware of long running DAR installations) and return the whole log, or you can store everything in the repository as audit trail.
  3. You can handle install parameters, locales, referenced dar files, etc. (which again, seems something that OT engineering have never heard of, who really uses locales? everyone loves systems on English :D)
  4. You can control the access to this servlet via user/password, by allowing only certaing IPs to call it and using trusted login to install DAR files, etc

Opentext vs. Linux

I was testing DCTM 22.4 when I decided to shutdown the repository and oh, surprise!

dmadmin@aldago-desktop:~$ dm_shutdown_dctm224
Stopping Documentum server for repository: [dctm224]

Picked up JAVA_TOOL_OPTIONS: -Djava.locale.providers=COMPAT,SPI
Picked up JAVA_TOOL_OPTIONS: -Djava.locale.providers=COMPAT,SPI
/opt/documentum/dba/dm_shutdown_dctm224: 65: shopt: not found
/opt/documentum/dba/dm_shutdown_dctm224: 67: [[: not found
Picked up JAVA_TOOL_OPTIONS: -Djava.locale.providers=COMPAT,SPI

“shopt: not found”? “[[: not found”? What the… let’s check the dm_shutdown_dctm224 script:

################## DOCUMENTUM SERVER SHUTDOWN FILE ######################

WHAT.THE.XXXX? You’re using shopt and [[ and you choose sh as shell which DOES NOT support it? With the amount of available shells that exist you have to pick the one that doesn’t support this? Well, another “bug” for the long history of “issues” on Linux systems… (by the way, on the new workflow designer, finally someone has decided to put Linux paths in the Linux distribution log files instead of “C:\…”, however someone also forgot the initial / before the path… maybe on next version)

Documentum Thumbnail Server Security violation error

At some point on time, you might come across thumbnails not showing in your application and the following error on the Thumbnail Server log:

[DEBUG] : [DM_TS_T_RETRIEVE_DOCBASE_THUMB] Retrieving docbase thumbnail...
[DEBUG] : [DM_TS_T_RETRIEVE_STORE] Retrieving storage area...
[DEBUG] : getting storage area for docbase: xxxxxxxxx store: tcs_thumbnail_store_01
[DEBUG] : [DM_TS_T_CHECK_SECURITY] Checking security...
[DEBUG] : About to start reading files...
[DEBUG] : Trusted content store found, will use DFC for decryption
[DEBUG] : Content paramters are: format= null; page=null; page modifier=null
[DEBUG] : will be validating & retrieving object 09xxxxxxxxxxx
[DEBUG] : Session ok for xxxxxx
[ERROR] : Security violation: Url store details mismatches with objectID 09xxxxxxxxxxx

In this case you’ll probably will be wondering what’s going on. Well, this is basically a SCE (Severe Concept Error) coming from the talented team. Let’s check the faulty code coming from the getThumbnail servlet:

if (session != null) {
    IDfSysObject originalDoc = (IDfSysObject) session.getObject((IDfId) new DfId(objectId));

   String actualPath = originalDoc.getPathEx2(thumbFormat, thumbPage, thumbPageMod, false);
    int storeIndex = actualPath.indexOf(store);
    if (storeIndex != -1) {
        actualPath = actualPath.substring(storeIndex).replace("/", "\\");
        if (!actualPath.equalsIgnoreCase(store + "\\" + store)) {
            throw new IllegalAccessException();
    } else {
        throw new IllegalAccessException();

If you look closely you’ll realize the absurdity of this line: int storeIndex = actualPath.indexOf(store);

This clearly shows the lack of understanding about Documentum as:

  1. This creates a constraint between the filestore name, and the name of the folder on the disk
  2. Hi OT Engineering team, have you ever heard of something called dm_location object? If you already have the session, and you have the filestore, why don’t you get the folder location from the associated dm_location object instead?

So, until OT decides to fix this, if for some reason your folders on disk are not named exactly as your thumbnail stores, you already know why thumbnails might not show up.

OpenSAML authentication with Webtop 16.7.9

If you’re using SAML authentication with Webtop and you upgrade to 16.7.9 you’ll experience some issues (=it doesn’t work) if you need to sign the request to your IdP. Why is this happening?

In latest Webtop version Opentext has upgraded the bundled opensaml libraries from version 2 (released on 2011, support stopped on 2018) to version 4. In this many years that have passed since version 2 was released, the way the connection is done has been completely changed.

However, in this case OT engineering team properly updated the code that handles the request to the IdP. Unluckily, they didn’t do the same with the code that signs the request :/

Checking the code, you can see really weird castings between same types on the getServiceProviderSignature method:

       X509Certificate certificate = (X509Certificate)privateKeyEntry.getCertificate();
        BasicX509Credential credential = new BasicX509Credential();
        signature = (Signature)Configuration.getBuilderFactory().getBuilder(Signature.DEFAULT_ELEMENT_NAME).buildObject(Signature.DEFAULT_ELEMENT_NAME);

From this code, we can tell that OT was able to properly follow the instructions on how to send a request to the IdP ( but they were not so diligent with the signature process (, so what they basically did was “force the code to compile”.

Well, if you bother to follow the opensaml blog post containing the instructions on how to sign a request with OpenSAML 4 you’ll get something like this new fancy getServiceProviderSignature method:

//getServiceProviderSignature compatible OpenSAML 4
private Credential getServiceProviderSignature() {
    BasicX509Credential credentialx509=null;
    if (StringUtil.isEmptyOrNull(this.m_serviceProviderJKS) || StringUtil.isEmptyOrNull(this.m_serviceProviderJKSPwd) ||
        StringUtil.isEmptyOrNull(this.m_serviceProviderJKSKeyEntryPwd) || StringUtil.isEmptyOrNull(this.m_serviceProviderJKSKeyEntryAlias)) {
        traceMsg("Keystore proeprties are not configured properly for SAML request signing. So returning the signature as nullConfigure keystore properties if signing is enabled in Webtop and IDP configurations.");
        return null;
    try {
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        FileInputStream fileInputStream = new FileInputStream(new File(this.m_serviceProviderJKS));
        char[] jksPassword = this.m_serviceProviderJKSPwd.toCharArray();
        char[] jksEntryKeyPassword = this.m_serviceProviderJKSKeyEntryPwd.toCharArray();
        keyStore.load(fileInputStream, jksPassword);

        KeyStore.PrivateKeyEntry privateKeyEntry = (KeyStore.PrivateKeyEntry)keyStore.getEntry(this.m_serviceProviderJKSKeyEntryAlias, new KeyStore.PasswordProtection(jksEntryKeyPassword));
        PrivateKey privateKey = privateKeyEntry.getPrivateKey();
        X509Certificate certificate = (X509Certificate)privateKeyEntry.getCertificate();
        credentialx509 = new BasicX509Credential(certificate, privateKey);

    } catch (Exception e) {
        Trace.println("Failed to get the signature to sign the SAML authentication request: " + e.getLocalizedMessage());
        throw new RuntimeException(e);
    return credentialx509;

which should work perfectly (there are some additional modifications to other methods, but this should get you going).

Documentum D2 container image (or how not to build container images)

We already saw that OpenText clearly fails to understand the concept of container (TIP: a container is a process, not a VM) so it keeps providing “D2/da/webtop/rest” containers, when what they should provide is an “application server” container where end users would mount the custom war file on /webapps or whatever (by the way, this would simplify the yaml/helm charts from hell with the million options to try to configure D2/da/etc. via yaml).

Anyway, it seems that understanding that concept is a lost battle, however, you would expect that at least OpenText would know by now how to properly build a Docker image. Well, to anyone’s surprise (except to OpenText engineers I guess), latest D2 (22.2) image is 3.65GB!!!!!! (This is bigger than Content Server itself) 22.2 1eee2a974793 5 weeks ago 3.65GB

Let’s investigate this wizardry… If we open the image we can see several “big” folders:

Wonder what’s going on here… let’s check that 700mb folder:

Not only we have D2 exploded on Tomcat’s webapps folder, we also have the D2.war on the image… What else do we have on those +100mb folders?

Yum-update cache… (several times)

Python? on a Tomcat (D2) application server??

But, what’s going on here? Well, when you run a multi-staged container build, you need to understand that every command creates a new layer (something clearly explained in the Docker documentation) so you should be extra-careful and delete everything you copy/create in the same step if it doesn’t have to be present on the final image (as explained in the Docker best-practices documentation). So basically, when creating the image, OpenText is first copying D2.war image, then in another stage they extract the files, and then on another step the war file is deleted (or that’s what they think they are doing, but they’re just creating a new layer without the file, not really deleting it). Also, instead of running a single yum-update and deleting the cache on the same stage, the just keep running yum-updates as they need it, effectively creating multiple cache folders…

This image can be easily squashed and you’ll end up with this:

dctm-d2222 22.2 d3d968108687 13 days ago 1.83GB

Exactly the same image, but nearly 2GB smaller, and this is without even bothering to remove the cache/unnecesarry files:

We’ll see if for 22.3 OpenText learns to deliver proper containers or we still have to deal with these +3GB images…

WSL2 network configuration with Documentum

In a previous post (Documentum 21.4 PostgreSQL WSL2 Install Guide) we saw how to install Documentum in WSL2. However, if you try to connect from Windows to the WSL2 repository the connection might fail. Why is that? Windows automatically does NAT between the WSL2 machine and the host OS, however it does it with IPv6.

In order for this configuration to work properly we need to perform the following steps:

  • Configure /etc/hosts on the WSL2 machine so the hostname used in CS install resolves also to IPv6

sudo vi /etc/hosts       localhost       <your_hostname_here>.localdomain      <your_hostname_here> 
# We need to add to this line our hostname 
::1     ip6-localhost ip6-loopback <add_your_hostname_here>

  • Make sure ip_mode on server.ini is not set to v4only or set it to dualstack (which is the default value)

After doing these changes (and restarting docbroker/repository) a telnet localhost 1489 / telnet localhost <repository port> should work. So now we need to make our DFC client work with WSL2 NAT. For this we need to:

  • Change your on Windows to the following:[0]=::1

  • Then, we need to force Java to use IPv6 by default by setting the following properties:

And now you should be able to connect to a repository in WSL2 without problems.