IBM Verse on Premises Integration with Connections and Docs issue with iNotes\_WA\_Security\_NonceCheck

Created: 2. November 2017
Last Update: 6. December 2021
Author: Christoph Stoettner
Read in about 2 min · 215 words

Fountain pen and a notebook — Photo by Aaron Burden | Unsplash

During the week we integrated IBM Connections and IBM Docs in our test environment and everything worked fine. Then we moved the configuration to production and most of the stuff was working, like showing Business cards, profile pictures and Connections files to add into mails. Docs Viewer and uploading files from a mail to Connections generated an error: “because of an internal server error”

IMG 02112017 180230 0

IMG 02112017 180238 0

I digged into it with Burpsuite and Fiddler4 , in the meantime a customer called me and described the same symptoms. Within the traces I found that the systems which didn’t upload the files had following header set:

X-IBM-INOTES-NONCE: <none>

and the working one had:

X-IBM-INOTES-NONCE: 2640941AE5454F5853E6732F79E7D2F5

So i searched a little bit on X-IBM-INOTES-NONCE and found that is introduced in Notes/Domino 8.5.2 and shall prevent XSS.

You can disable this with iNotes_WA_Security_NonceCheck =0 and this is mentioned in a technote , that sometimes proxies or F5 needs this setting. First we tried that on our testsystems and we seemed to be right, the upload was broken too.

We removed the notes.ini entry (or set it to 1) and after a http restart the file upload from VOP and the IBM Viewer worked!

IMG 02112017 171042 0

Thanks to Thomas who digged into this with me today.

Update 2017-11-20

IBM released a technote on this.

Talks 2017

Social Connections 12 in Vienna

Author

Christoph Stoettner

I work at Vegard IT GmbH as a senior consultant with a focus on collaboration software, Kubernetes, security and automation. I mainly deal with HCL Connections, WebSphere Application Server, Kubernetes, Ansible, Terraform and Linux.

Sometimes my daily work results in technical talks and blog articles, which you can follow here more or less regularly. You can find the presentations in the main menu under public speaking .

I created a list of tools I use regularly, most of which have been released under an open source license.

In my spare time I read a lot, test all kinds of technical software and gadgets and try to follow about 200 RSS feeds.
Here you can find a collection of them.

This is my private blog, all opinions are my own.

Additional fix (LO74465) for Connections CR3 and Notes 9 Social Edition

IBM sent me a mail today, their logs show that i downloaded CR3 and they want to tell me, that i need one fix more, when i use Notes 9 Social Edition.

I was really surprised and impressed.

Here the download link for LO74465 .

Created: 22. March 2013
Last Update: 6. December 2021 Read in about 1 min