IBM Connections Directory Search breaks when User have quotes in a profile field

Created:
Last Update:
Author: Christoph Stoettner
Read in about 2 min · 372 words
HCL Connections Search TDI Tivoli Directory Integrator

Fountain pen and a notebook

Photo by Aaron Burden | Unsplash

On one of my IBM Connections Site i had a problem with directory search (better the typeahead search). When we searched single characters no business cards are displayed.

2012 03 19 13 18 11

I use Firebug for Chrome here and you see, that the search gets an result back from Connections, but no business cards are displayed.

When i open this get statement i get a list of profile documents in JSON format:

2012 03 19 13 23 48

In this case i a got a list of about 20 User profiles. When i search a little bit more detailed i get an error of a Javascript, which should interpret the JSON list. Thanks to the developer (I think it is a dojo script)! “There was an error!” is a great response for troubleshooting and searching the error on Google or Bing!

2012 03 19 13 26 01

The list has following format:

{
   "identifier":"member",
   "label":"name",
   "items":[
      {
         "name":"John Doe",
         "userid":"70026A2C-BE77-8491-C125-XXXXXX",
         "uid":"john.doe@stoeps.tld",
         "member":"john.doe@stoeps.tld",
         "type":"0",
         "ext":{
            "first":"",
            "groupwareEmail":"john.doe@stoeps.tld",
            "guid":"70026A2C-BE77-8491-C125-XXXXX",
            "mobileNumber":"+49 (123) 12 34 567",
            "floor":"2nd",
            "email":"john.doe@stoeps.tld",
            "countryCode":"DE",
            "givenName":"John",
            "jobResp":"Assistant",
            "faxNumber":"+49 (123) 456789",
            "bldgId":"Member of "Android Lovers"",
            "uid":"john.doe@stoeps.tld",
            "sourceUrl":"ldap://ldapserver:389/(undefined=_search_base_)?(&(ObjectClass=*)(Attribute=1))",
            "surname":"Doe",
            "key":"00009asdkfjakf",
            "displayName":"John Doe",
            "telephoneNumber":"+49 (1234) 56789",
            "distinguishedName":"CN=John Doe,OU=Admin,OU=DE,O=STOEPS",
            "workLocationCode":"Munich",
            "timezone":"Etc/GMT+12",
            "lastUpdate":"2012-03-05 14:23:34.504"
         }
      }
   ]
}

Problem here is the field bldgId: "Member of "Android Lovers"".

You can see double ” which are not masked. Our IBM Connections User can fill nearly everything in the fields in Profiles, but get no warning if he uses quotes and quotes are not masked, when they are stored in the database.

So when you have on user who uses quotes in one of his Profile fields, the typeahead search displays no results for character searches which contains this user (and no error message).

Finding such fields with regular expressions

I tested the typeahead search on all characters and copied the result of the GET statement out of Firebug and developed a regexp to find double quoted strings:

:\"\"[a-zA-Z0-9\.\/\+\-\:\s äöüÄÖÜ]\"

On Mac OS X you can use RegExRX or Notepad++ on Windows to test this regexp and you will get the wrong field values.

TDI and Typeahead

You can see in the result list, that TDI Search Urls are saved in each profile document too! "sourceUrl":"ldap://ldapserver:389/(undefined=search_base)?(&(ObjectClass=*)(Attribute=1))", so please be careful, when you configure your search strings, because a double quoted attribute breaks typeahead search too!

Comments
Error
There was an error sending your comment, please try again.
Thank you!
Your comment has been submitted and will be published once it has been approved.
Success!
Your comment has been posted successfully.

Comments

Loading comments...

Leave a Comment

Your email address will not be published. Required fields are marked with *

Suggested Reading
Aaron Burden: Fountain pen and a notebook

IBM Connections APAR LO73245

I read an open APAR on IBM Connections today (login required!): LO73245

Description:

TDI’s sync_all_users.sh doesn’t allow us to import departmentNumbers longer than 16 chars, although the database schema supports values up to 24 chars.

And as local solution:

worked around the issue with creating a custom field

I had a very similar problem with validation of LDAP Search filter (which is saved in employee-table too) and searched longer to solve this (I set sync_store_source_url=false), but the real error was like here in validate_dbrepos_fields.properties.

When you open validate_dbrepos_fields.properties (in your tdisol directory) you found following:

deptNumber=16

So here is the validation error and not in the database! You can solve the APAR without using a customField, when you set deptNumber to 24.

Created:
Last Update: Read in about 1 min
Card image cap

Be careful with search-admin role in HCL Connections

I showed, in several slides and sessions, how you can use the search-admin role in the search application of HCL Connections for troubleshooting and reviewing some key configurations.

In several environments, my user or other administrative users have this role, just to access the link to /search/serverStatus for example.

Created: Read in about 3 min
Aaron Burden: Fountain pen and a notebook

Search fails with the error CLFRW0060E: Input-output exception

IBM released a tech document on friday with title: Search fails with the error CLFRW0060E: Input-output exception .

This document solves one of my problems i had in a demo environment since two weeks. I traced the environment, checked j2ee roles, reinstalled CR3 and 4, redeployed search and activities, but i always got an error, when the search wants to access the activities seed list.

So what happened? I want to show the /search/serverStatus page in a course and for this i want to remove all warnings and errors. When you don’t set SEARCH_SEEDLIST_TIMEOUT, you get a warning, that the variable is not set.

Created:
Last Update: Read in about 2 min