Novell Corporation

Technical Notes:

SoftSolutions

Document & Security Server

(DSS)

Printed: June 14, 1995

Prepared by: Jerry Winkel

Outline

Introduction

Purpose

Benefits

Before loading the DSS

Function

Scan

Sync

Input commands

Loading the DSS

Dataset changes

Sample oam command lines

Date and time stamps (time zone variables)

DSS files

DSS configuration file

Backups

Reconstructions

Requirements

Server

Troubleshooting

various subjects

Introduction

The purpose of this document is to provide the SoftSolutions Administrator with a greater understanding of how the Document & Security Server (DSS) operates. The first section explains the purposes and benefits of the DSS. Following sections discuss in greater detail how the DSS operates as well as hints on maximizing its performance. The last section is meant to be a resource for the administrator when errors occur, providing answers to over 35 commonly asked questions.

Purpose

SoftSolutions has always provided strong internal document security. This internal security is sufficient if users cannot access the objects or documents outside of SoftSolutions. However, users often have access to these object files either at the operating system command line or through file management utilities. To enforce the security designated by the author/creator, the access rights specified by the operating system should be set to match the access rights specified by SoftSolutions.

Several utilities have been released with SoftSolutions 2.0 and 3.x that accomplish this task under Novell NetWare networks. One of these utilities, NW3SEC , can be used with versions 3.x by including the / ossec switch in the command lines of the Object Access Modules (OAMs). NW3SEC changes access rights to the object file in the NetWare Bindery to match as closely as possible the access rights of the SoftSolutions profile. Unfortunately, this approach has several limitations, one of which is the delay in updating changed access rights. This method also results in many NetWare trustee assignments, which complicates server administration.

The Document & Security Server (DSS) is designed to overcome these limitations and provide a simple method of enforcing SoftSolutions security outside of SoftSolutions. When invoked, the Document & Security Server removes all trustee assignments to managed directories and files, except for those of "exempt" users. Therefore, most users are not able to access managed SoftSolutions objects without first invoking SoftSolutions. The "exempt" function allows backup and other system management programs the ability to access objects outside of SoftSolutions.

When an object is accessed in SoftSolutions, the appropriate OAM determines whether or not the document is located on a NetWare server which is running a DSS. If it is located in this environment, the OAM requests access to the object from the DSS. At this point, the DSS either assigns file level trustee rights to the object file, or copies it to the location specified by the OAM (echo or temp directory). If the object is to be copied, the DSS will grant the user temporary access to the object, which is then copied by the client software. User rights to the object in the secured directory are then revoked. After edits have been completed, the DSS reverses the process placing the newer copy of the document back in the secured path.

The DSS also performs all deletions and returns status information requested by the OAMs. The DSS revokes users' access rights to objects when they are finished accessing the object.

BENEFITS

1)	Objects managed by SoftSolutions are protected against unauthorized access at the operating system level.

2)	System management functions, such as backups, can be performed as you would
normally.

3)	Trustee assignments are granted at run time, based on current SoftSolutions Document Security and only exist while the document is in use. No special utility must be run. Even if users have rights to a document through SoftSolutions, they will not be able to access the document from the operating system level.

4)	All security configurations possible within SoftSolutions can be enforced at the operating system level.

5)	Very few network trustee assignments will exist at any given time, so system administration will be easier.

6)	Performance of searches within SoftSolutions will continue to be very fast because security enforcement during searches will continue to be done by SpeedSearch ®.

7)	Moving and copying documents from one location to another on the same server will be performed very quickly and will generate very little network traffic, because the document will not cross the network from the server to the workstation.

BEFORE LOADING THE DSS

Before loading the Document & Security Server, network administrators should be aware of several issues related to its use:

1)	The Document & Security Server is not required, but if used, must be loaded on each server containing documents managed by SoftSolutions.

2)	The DSS may be used with or without the SoftSolutions Server Enhancement Module (SEM).

3)	The Document & Security Server will remove all trustee file assignments for all files and
directories under secured paths.

4)	For multiple file servers, DSS must be running on each file server that contains SoftSolutions documents or that has a SoftSolutions Temporary or Echo Location. The Temporary or Echo Location directories do not need secured paths. In other words, whichever file servers contain Echo and Temporary Location directories, they must also have DSS loaded.

5)	In multiple datasets , "launch" and "preview" functions can use the same Echo or Temporary Location directories. But, these directories cannot be mixed for a particular function type. For example:

If one "launch" uses the /E= switch, all launch functions must use the /E= switch.

If one "preview" uses the /T= switch, all preview functions must use the /T= switch.

6)	In multiple dataset environments, duplicate Document Numbers should not be permitted to exist. To ensure this, the beginning Document Number for each dataset should be different. For example, Dataset NY might begin with Document Number 1 and Dataset LA with 100,000. The range between beginning Document Numbers should be sufficient for each dataset's potential growth.

Function

SCAN

When the DSS is invoked it keeps an internal list or table of users who are actively accessing documents. The purpose of SCAN is to manage this internal list. SCAN should be run frequently in order to keep this list current. The default configuration file specifies SCAN to be run every 15 to 30 minutes.

As SCAN goes through the internal list, it asks the server if the users on the list still have an active connection. If the server responds that the connection has been terminated, SCAN will then take them off the internal list. If a user logs out of SoftSolutions in an abrupt manner (lockup, gpf, cold boot) the network connection will have been terminated though SoftSolutions still considers them a connected user. In this scenario SCAN will remove them from the list.

SYNC

When the SYNC function is invoked the DSS starts at every secured path and removes all trustee rights that do not match the internal list of current or exempt users. This process can take several minutes to perform. Thus, it is only run once every 24 to 48 hours. This process is normally run at night when the majority of users are not on the network.

There are two types of SYNC's that may be performed; REPORT and REVOKE. The sync report is used to generate a list of documents to which proper rights have not been applied. During a sync report no rights are removed. After the sync report has finished this report is available in the log file specified in the DSS.CFG. A sync revoke performs the same task as the sync report, however, it removes the improper trustee file assignments as it runs.

INPUT COMMANDS

The following commands are available from the master console after the DSS is loaded.

Exempt-	The EXEMPT command is used to specify a Novell user whose rights are not to be altered by the DSS. The NetWare user name is to be entered not the SoftSolutions user name.

Help-	This displays a HELP screen of valid commands.

Scan-	This command begins a SCAN search.

Secure-	This command will add an additional directory that the DSS is to manage. The following syntax should be used: <volume:\directory\subdirectory>. The DSS will secure the specified directory and all subdirectories, up to 10 levels deep.

Sync-	The SYNC command begins a SYNC search. The mode defined in the configuration file is assumed if the {report/revoke} parameter is not used. The mode of automatically invoking SYNC searches is reset to the mode defined in the configuration file once manually-invoked SYNC searches are completed.

Unload-	The UNLOAD command is used to unload the DSS.

LOADING THE DSS

Dataset Changes:

Before loading the Document & Security Server (DSS) three changes to the SoftSolutions Dataset should be made.

1)	/DSS switch should be added to the end of every OAM command line in the APPLICATIONS screen. This switch is used to notify the OAMs that the Document & Security Server is to be used.

2)	The %p parameter should be changed to %p%f on the command lines for OAMLAUNC, OAMPREVI and OAMEND.

3)	Also, on the OAMLAUNC, OAMPREVI and OAMEND command lines, you may use one of the following switches:

/e=[echo location]-This switch is used to specify the location where documents will be copied and edited. These documents will be copied, not moved, to their original location after editing is finished.

/t=[temp location]-This switch is used to specify the location where documents will be copied and edited. These documents will be moved, not copied, to their original location after editing is finished.

When using these switches you can either specify a directory or you can use the variables %ec (echo directory) or %tmp (temp directory). I. e. /t=%tmp or /t=c:\temp

The editing the documents in a location other than where they normally reside is a unique function of the DSS. By editing documents in a temp location on a local drive you cut down on network traffic. If neither the /e or /t switches are used, the document is edited in its original location. The DSS grants rights to the file during editing and revokes them when editing is completed. If the echo or temp directories are not going to a local drive but to another server, the DSS must also be loaded on that server.

Note: The command line of OAMEND must contain all the parameters found on the command lines of OAMLAUNC and OAMPREVI. For instance, if a /e= echo location is specified on the command line of OAMLAUNC and a /t= temporary location is specified on the command line of OAMPREVI, OAMEND must use both of those parameters. This is because OAMEND (end access) is called on both a preview and a launch(open).

In some cases, such as Novell WordPerfect and Microsoft Word, the use of /e or /t switches are required. This is because some applications create temporary files in the same directory as the document, and therefore require rights to that directory. The default OAMPREVI code does not require a /e or /t parameter.

The following are sample OAM command lines:

OAMARCHI	ssoam.int %h %j %p%f h:\arch\ %q %n.%v /novmap /dss

OAMCOPY	ssoam.int %h %j %p%f %pd%fd /novmap /dss

OAMDELET	ssoam.int %h %j %p%f /novmap /dss

OAMDIRCR	ssoam.int %h %j %p /novmap /dss

OAMDIRST	ssoam.int %h %j %p /novmap /dss

OAMEND	ssoam.int %h %j %p%f /novmap /dss /t=%tmp

OAMFILES	ssoam.int %h %j %p%f /novmap /dss

OAMLAUNC	ssoam.int %h %j %p%f /novmap /dss /t=%tmp

OAMMOVE	ssoam.int %h %j %p%f %pd%fd /novmap /dss

OAMPREVI	ssoam.int %h %j %p%f /novmap /dss

OAMRESTO	ssoam.int %h %j h:\arch\%q\%n %v %p%f /novmap /dss

Bold text has been added to original command line.

Incorrect settings in these command lines is the leading cause of errors when operating the DSS. The OAM command lines are very sensitive to the order in which the variables appear as well as the use of spaces.

Date and Time Stamps:

The DSS compares the date and time stamps of the source and destination files during a copy. Therefore, for this comparison to produce correct results, the client (workstation) and server (where DSS is installed) must have the time zone information set up properly. All time zone settings are in relation to GMT (Greenwich Mean Time), or UTC (Coordinated Universal Time).

Setting the Server Time Zone

On the NetWare server that will run DSS.NLM, the time zone is set at the file server's console:

SET TIME ZONE = [Time Zone Abbreviation][{+/-}d]{Daylight Savings Time Zone Abbreviation}

where [Time Zone Abbreviation] is an abbreviation for the standard time zone, [{+/-}d] is the number of time zones sooner or later (+/-) than UTC (in hours--one or two digits), and {Daylight Savings Time Zone Abbreviation} is an optional abbreviation for Daylight Savings time. For example:

SET TIME ZONE = CST6CDT

Note: NetWare 4.x users: For time zones that are offset a fraction of an hour (such as 30 minutes) past a full time zone hour, the minutes can be added after the hour's number by separating the hours and minutes with a colon (:). For example: SET TIME ZONE = NST3:30NDT

For the server, these abbreviations can be several characters in length, although three is usually sufficient to indicate a time zone (e.g., "MST" for "Mountain Standard Time"). The abbreviations are not standardized--they can be made up (note the abbreviations in the following examples).

Note in the following examples that the + is optional, but the - must be included. Also note that the numbers are always in reference to UTC, even if not so noted by the abbreviations used.

Setting the Time Zone for ...

SET TIME ZONE = EST5	East coast's Eastern Standard Time ("EST" = Eastern Standard Time)

SET TIME ZONE = PST+8	West coast's Pacific Standard Time

SET TIME ZONE = PST8	West coast's Pacific Standard Time

SET TIME ZONE = PST+8PDT	West coast's Pacific Daylight-savings Time ("PDT" = Pacific Daylight-savings Time)

SET TIME ZONE = TST9	Tokyo, Japan's Standard Time

SET TIME ZONE = AST10	Sydney, Australia's Standard Time

SET TIME ZONE = MEZ1	Germany's Standard Time (Continental Europe)

SET TIME ZONE = GMTGDT	London's Daylight-savings Time ("GDT" = Greenwich Daylight-savings Time)

When the SET TIME ZONE command is given, NetWare reads the time zone abbreviation (alphabetical characters only), reads one or two numbers (including any + or - sign), and then reads the optional Daylight Savings Time code, if there. If any alphabetical characters follow the one or two digit Time Zone number, NetWare considers that Daylight Savings Time may be in effect at some time during the year.

Note: Make sure the CLIB.NLM is UNLOADED when you set the time zone variable on the server (we recommend that you put it in the autoexec.ncf before you load clib ). CLIB will not read the time zone variable again once it is loaded. So, if you are in the Mountain time zone and you have loaded clib and changed your time zone to MST7MDT , your server still thinks that it is Eastern time zone even though it tells you that you have it set to Mountain time zone.

Setting the Client Time Zone

For each client (workstation) under DSS's influence, the time zone is set as a DOS environment variable:

SET TZ = [Time Zone Abbreviation][{+/-}d]{Daylight Savings Time Zone Abbreviation}

The difference in the syntax (from the server's) is that "TIME ZONE" is abbreviated as "TZ." For the Client, the [Time Zone Abbreviation] and {Daylight Savings Time Zone Abbreviation} abbreviations must be exactly three characters each.

DOS reads the alphabetical characters, then reads the next one to two numbers, including any + or - sign. DOS then reads the optional {Daylight Savings Time Zone Abbreviation}, which can be used to indicate to the user that Daylight Savings Time is in effect. The 3-character abbreviations are not standardized--they can be made up (note the abbreviations in the above examples).

DSS Files:

There is no installation program for the DSS. Copy all the files from the SoftSolutions 4.1 Document & Security Server diskette to the server containing the documents that will be managed by SoftSolutions. These files may be placed in the SoftSolutions programs directory, the NetWare SYSTEM directory, or any other directory the system administrator chooses.

The DSS files to be copied include: dss.nlm, dss.ctx, dss.txt dss.tln, dss.cfg.

DSS Configuration File:

The configuration file (DSS.CFG) contains basic setup information used by the Document & Security Server. The following is a list of options that may be included in this file.

Logfile

The DSS writes information to the logfile during various operations. This information includes: starting and ending times, beginning and ending times of SYNC searches, improper rights found during SYNC searches (and possibly their deletion), as well as errors that may occur.

This option specifies the location (in [Volume]:[Path] format) and name of the file to which log information is written. It also specifies whether the logfile is appended to, overwritten, or renamed when the DSS is invoked. The syntax for this line is as follows:

LOGFILE [Full path and filename] {Overwrite/Append/Rename}

Ex.	LOGFILE WORK:\DSS\LOGS\DSS.LOG Rename

Append is assumed if the {Overwrite/Append/Rename} parameter is not included. Monitor the logfile if the "Append" option is used, since the logfile can become very large.

Secure

This option is used to specify which directories, and subdirectories thereof, are to be secured. The path entered must be in [Volume:Path] format--drive letters cannot be used.

Secure all paths that will be used as document location segments. Any document with a location segment outside of a secured path may produce unpredictable results. To ensure that all document paths will be in secured location segments you should not allow the location field on the profile to be visited.

The SECURE option can be entered in the configuration file more than once. The syntax for this line is as follows:

SECURE [Full Path of Directory]

Ex.	SECURE WORK:\DOCS

In this example, the directory WORK:\DOCS, and its subdirectories are managed by the DSS. If multiple secure statements are going to be used, they must each be on a separate line.

Note: Temporary directories should not be in the secured path.

Note: Do not specify the server/volume in the SECURE statement.

Exempt

This option is used to specify Novell users whose rights will not be deleted by the DSS during a SYNC REVOKE search. The EXEMPT option can be entered in the configuration file more than once. The syntax for this line is as follows:

EXEMPT [Novell User or Group Name]

Ex.	EXEMPT JOHND

In this example, the rights of user JOHND will not be deleted by the DSS during a SYNC REVOKE search.

Scan

The SCAN option is used to determine whether SCAN searches are performed, and if so, the interval between searches, specified in minutes. A SCAN search determines whether an internal list of outstanding granted rights and connections are still valid. The scan is performed very quickly, and should be performed fairly often. A suggested interval is 15 to 30 minutes. The syntax for this line is as follows:

SCAN [# of Minutes]

SCAN 15

In this example, SCAN searches will be performed every 15 minutes.

Note: The DSS will grant access to a file when the user retrieves it. If the user reboots the workstation, access rights to the document remain intact until the SCAN option recognizes that the user had improperly exited the file; it then revokes access it had previously granted.

Sync

The SYNC option is used to determine whether SYNC searches are performed, and if so, the interval between searches, specified in hours. A typical interval is once per day. A SYNC search determines whether the trustee rights of all secured directories and files are valid and given by the DSS. This line is also used to determine whether the search revokes improper rights or just reports them. The syntax for this line is as follows:

SYNC {Report/Revoke} [Next Synchronization Time] [Interval in Number of Hours]

SYNC Report 02:00 48

In this example, the DSS will perform a SYNC at 2AM every forty-eight hours, and improper rights are reported, but not corrected. Revoke is assumed when neither Report nor Revoke are specified.

Sample Configuration File

LOGFILE WORK:\DSS\LOGS\DSS.LOG Overwrite

SECURE WORK:\DOCS

SECURE SYS:\SS\DOCS

EXEMPT TONY

EXEMPT JOHND

SCAN 15

SYNC Revoke 02:00 48

Load Command

The DSS is invoked by entering the following command from the NetWare System Console:

LOAD DSS {/C=[Configuration File]}

Ex.	LOAD DSS /C=WORK:\DSS\DSS.CFG

The [Configuration File] parameter is the location and name of the configuration file. (The default name is DSS.CFG)

Note: If the DSS is not loaded yet the /dss switch has been added to the OAM command lines, users will not be able to retrieve documents. The will receive the message, "804: Timeout waiting for reply from security server".

If the /C= parameter is not used, the DSS will look for the configuration file in the directory that contains the DSS. If the configuration file cannot be located or the /C= parameter is not used, an error message is displayed and the DSS is not loaded.

Note: The DSS must be loaded on each server containing SoftSolutions documents, even if the documents are not located in secured paths. Only one DSS needs to be loaded on a server since it can handle the requests of multiple datasets.

BACKUPS

The DSS does not need to be unloaded to perform backups.

RECONSTRUCTIONS

The DSS does not need to be unloaded prior to running Reconstructions or Compactions.

Requirements

Install SoftSolutions 4.1 for Windows or DOS on the server using the SoftSolutions INSTALL program. (See the SoftSolutions Installation Guide for information on installing the SoftSolutions programs and data.)

Ensure that 150KB of file server memory is available for DSS.

Ensure that you have the correct DSS version. Versions 4.0 and 4.1 of the DSS.NLM and the client software are incompatible with each other (e.g., SoftSolutions 4.0 will not work with a 4.1 DSS.NLM, nor will SoftSolutions 4.1 work with a 4.0 DSS.NLM).

CLIB.NLM dated March 1993 or later (e.g., CLIB 3.11d, CLIB 3.12f) is required. CLIB 3.12g cannot be used.

Troubleshooting

Subject:	DSS & Time Stamps

The DSS relies on the accuracy of the time stamp on a file to know when it needs to copy documents from the server to the workstation and back to the server again. If the workstation and server are not synchronized to the same time, problems may occur. In one case, the DSS was properly copying a document to the local echo directory on a retrieve, but after the document was edited and saved on the workstation, it was not being copied back up to the server. The server and the workstations were set at the same time by using the NetWare 'systime' command, but the server and the workstations thought they were in different time zones. The NetWare 4.01 server had been set to be in the Central time zone. The workstations had no specific time zone information, and so they defaulted to the Eastern time zone (this is due to the Borland run time libraries that are used to build our product). This affected the timestamp comparison the DSS performs. The work around is simple: the workstation must be configured to be in the same time zone as the server. This is done by setting an environment variable on the workstation :

"SET TZ=MST7MDT".

This problem was not seen in NetWare 3.x servers because its installation program doesn't ask the user for any time zone information and assumes Eastern. Since the Borland run time libraries also default to Eastern, everything worked correctly. The install of NetWare 4.x specifically asks the user for time zone information, and the user will certainly set it up correctly. If the site is not in the Eastern time zone them may start to see problems.

If you see problems where the DSS is not copying documents to the workstation, or vice-versa, check to see what time zone the server is set at, and then set the TZ environment variable to match.

The format of the TZ environment string follows:

TZ = zzz[+/-]d[d][yyy]

'zzz' is a three-character string representing the name of the current time zone. All three characters are required. For example, the string "PST" could be used to represent Pacific Standard Time. This string is simply a representation of the time zone name, and can be whatever I want it to be (it must be three characters long).

[+/-]d[d] is a required field containing an optionally signed number with 1 or more digits. This number is the local time zone's difference from GMT in hours. Positive numbers adjust westward from GMT. Negative numbers adjust eastward from GMT. For example, the number 5=EST, +8=PST, 0=London, and -1=continental Europe. This is the number that is actually used in the time calculations in the product.

[yyy] is an optional three-character field that represents the local time zone daylight saving time. For example, the string "PDT" could be used to represent Pacific daylight saving time.

Subject:	DSS Setup

If users have rights to the parent directory of a secured path and the Inherited Rights Mask for the secured directory is NOT properly set they will continue to have rights in the secured path that will NOT be revoked by the DSS during a SYNC. This is because the user will not appear as a trustee to the secured directory.

Subject:	Error opening file and DSS

A user with the DSS was getting the message "error opening file: c:\echo\<filename>". They were using the /e= switch with the DSS, when they removed this they received, "error opening file: f:\<path & filename>".

As it turned out the problem was from missing tildes on the application command line for WordPerfect for Dos. They had "... f:\apps\wp51\wp.exe %p%f /u=%u] %i" instead of "... f:\apps\wp51\wp.exe~%p%f~/u=%u] %i".

Subject:	Lotus 1-2-3 Release 4, Autosave feature

Lotus 1-2-3 Release 4 also has an autosave option. Lotus tries to save the document in it's actual location, which causes problems with the title bar and with using the DSS. There is not a way for us to intercept this autosave call, so we recommend that it not be used.

Subject:	Transport requested was not found

If you use Windows Standard mode, you must load TBMI2 .COM before starting Windows. If you load TBMI2 and go into Windows Enhanced mode, the SEM and DSS will not work, you will see Transport Requested not found with the SEM and you will get IPX transfer errors with the DSS.

Subject:	Error 804 Timeout waiting for reply from DSS

If you encounter the message "804: Timeout waiting for reply from Security Server", and you are not using the DSS, more than likely during the installation of SoftSolutions, you selected that you are using the DSS. To remedy the problem they need to remove the /DSS from the end of their OAM command lines.

You must also remove the %f from the %p%f arguments on the OAMLAUNC, OAMPREVI, and OAMEND command lines. The /e= and /t= switches should be removed as well.

Subject:	4.0 and bindery emulation

Can you have a 4.0 NDS compliant network setup and still be able to use SoftSolutions?

Users do not need to have 4.0 servers set with bindery emulation if the users attach to all the servers and map drives to them before entering SoftSolutions. The DSS and /novmap need to have bindery emulation enabled for them to work, and if the user is not going to use either of them SoftSolutions will work fine as long as it does not have to dynamically map drives and attach to servers.

The disadvantages are numerous and one of them is that all the attachment and drive mapping have to be done before login into SoftSolutions. Some clients are willing to live with the inconveniences.

Subject:	Using /T with DSS

Even though the /T switch copies documents to the temp file location, file server attachments created to retrieve the document are not released until the user releases the document and returns back to the original dataset.

Subject:	DSS and rights in SS prog directory

A user was getting strange errors while retrieving documents with the DSS. The System Administrator could retrieve them just fine, but other users would get such errors as "Insufficient rights" or "Error in OAM call".

The problem ended up being the fact that normal users did not have write access to the SoftSolutions program directory.

Subject:	0 byte files with DSS and WPWIN52

Application integration problems seem to be causing the DSS to create 0 byte files.

If intermittently, you get 0 byte documents written up to the file server when using the /T DSS option. Integration problems in newmac.wcm may be the cause. Newmac.wcm was not in the wpwin programs directory but was in his macro directory. Adding a new profile and opening WordPerfect caused WordPerfect 5.2 to report "cannot find newmac.wcm". If the user selected WordPerfect not to search for newmac.wcm, a zero byte file would be created in the temporary file location. If the user added text to the document and then did a file|Save As|Copy Profile Copy Document, the DSS would copy the save 0 (zero) byte file to the network (it did not save all of the work in the source document).

Subject:	DSS - Three error messages.

1)	From a workstation when opening a document from the profile screen: "715-Error in OAM call". This happens with any document.

2)	On the file server they had the message in the SEC.LOG, "Unable to allocate memory for string file <long path to document file>".

3)	On monitor screen "DSS error [6 Opening string file dss.ctx]".

The echo directory may be set to a location on the network where you have no rights.

Subject:	702: Unable to create directory

With the DSS loaded and right after SYNC revoke has run, you try to create a new profile. Before the profile finishes indexing, you see the error 702: Unable to create directory. You can retrieve previously created documents just fine.

Check the DSS.CFG file and make sure that the Logfile and Secure lines have the following information:

VOLUME:\<directory structure> NOT SERVER:VOLUME:\<directory structure>

Subject:	800: Unable to Initialize IPX.

Every time I try to open a document I get the following error: 800: Unable to initialize IPX.

This error can occur if they are using an old ipx.com or ipxodi, but in this case, the ipx drivers were good. They had selected the DSS button on the installation screen. (A problem that usually causes error 804: Timeout waiting for reply form DSS) The error was corrected by removing %f and the /dss, /e, and /t switches from the OAMs.

Subject:	File|Save in WPWin 6.0a

Using WPWin 6.0a you get a WP Save As dialog when doing a File|Save. Everything else with the integration worked fine. The problem turned out to be that there was insufficient space on the C: drive. The DSS was being used with the /e switch pointing to the C: drive.

Subject:	DSS Timing

If I save a document as a new version and then reopen it, any changes made in the new version are lost. The second version is essentially a copy of the original.

If you are using the DSS, your servers need to be synchronized! Your servers may be only about ten seconds apart, but that was enough to cause the problem. The 4.0 version of the DSS requires that the workstation and the server be synchronized if they are using the /t or /e switches. The reason is that the echoed copy of the document gets time stamped by the workstation and the permanent copy gets time stamped by the server. If the echoed copy, the one where modifications are being made, has an older time stamp than the document on the server, it will not be saved. This should not be a problem in 4.0a .

Subject:	Error Creating Directory

When I run ssimppro, my error log is filled with "error creating directory server/vol:\path", and the profiles do not get created.

You had a %P%F on your OAMDIRCR. Some added the %f when the DSS was installed. The only OAMs where the %f needs to be added are OAMLAUNC, OAMPREVI, and OAMEND . Note - There are other OAMs which contain the %f. Only modify OAMLAUNC , OAMPREVI , and OAMEND .

Subject:	715 OAM Error

Every time any user on the system tries to open a document from the profile screen, the message "ERROR 715: ERROR IN OAM CALL" appears. If they look at the console screen it says "ERROR 6: DSS.CTX". The DSS log file repeats the message "Unable to allocate string [path to file user is attempting to open]".

The echo and temporary file locations have been set to areas where users do not have write rights. Change the echo & temporary file locations to an area where all users have rights. Also check the oamlaunc, oamprevi and oamend to make sure that /e and /t point to areas where all users have write rights.

Subject:	500+ user licence NetWare

There is a problem using 500 or 1000 user licence NetWare servers. If your user connection is above 256, the / nwb switch or the DSS could log you in as someone else or not at all.

This problem is a compatibility issue between the version of the NetWare SDK that we use and the newer SDK that supports 500+ users. The older SDK returns a BYTE (256 possible values) for the user connection, yet the newer SDK returns a WORD (65536 possible values) for the user connection.

We have worked around the problem in 4.0a by always prompting for the UserID if the number of connections allowed by the server is greater than 256 (500 & 1000 user NetWare).

This has been fixed in SoftSolutions 4.1.

Subject:	250 User License

The DSS problem with NetWare licenses greater than 250 DOES NOT affect NetWare installs with a 250 user license.

Subject:	Two things on the DSS

1.	Can I run the 4.0a DSS with the 4.0 client or the 4.0 DSS with the 4.0a client?

2.	Can I load more than one DSS per server?

The answer to both of these questions is no.

Subject:	DSS and workstation time synchronization

SYSTIME is the command to synchronize a workstation's time with that of the default server or with a specified server. This is helpful when using the DSS.

Subject:	DSS reminder

Remember that the DSS does not ever need to be unloaded (even when doing reconstructions!)

Subject:	DSS /t= on the oam command line; wp51

Any changes they make to an original file is lost with the DSS loaded. They have /t command on the oam line. For example, they create a file|save|reopen and add more information|save. The next time they go into the file they get the original without the changes.

NetWare 4.02 is setup in the eastern time zone. The PC defaults to the eastern time zone. Therefore everything should work fine, but it doesn't. Adding 'SET TZ = EST5' to the autoexec.bat file corrected the problem.

Subject:	Do not use DSS to secure Archive directories

The DSS should not be used to secure archive directories. The DSS will not function correctly if it is unable to have a drive mapping--OAMARCHI and OAMRESTO currently do not handle dynamic drive mapping.

Subject:	SoftSolutions 4.0A SEM & DSS with 4.0 programs

SoftSolutions 4.0A Server Enhancement Module can be used with SoftSolutions 4.0 programs. The 4.0A DSS is NOT compatible with 4.0 programs.

Subject:	SS4.0A DSS problem

User upgraded from SS4.0 to SS4.0A. They are unable to copy documents to secured paths.

The DSS logfile shows: "Unable to Allocate Memory for string sys2:\{30 more characters \ the document name} [6]". The log gets created when a non Novell Supervisor tries to File|copy a public document to a secured path. The error message "OAM failed" appears on the users screen. The problem does not happen to NetWare supervisors.

The user trying to do the copy does not have read rights to the DSS.CTX. Give everyone file level rights to the DSS.CTX and the problem will go away.

Subject:	SSOCR vs DSS Setup

PROBLEM: Users launching and image to SSOCR, selecting the Overwrite option, would receive the error "SoftSolutions unable to retrieve document" A System Manager who was EXEMPT in the DSS.CFG was able to launch successfully BUT there would be a copy of the converted document on the root of the current network drive.

SCENARIO: A system manager launches an image to SSOCR, selects WP60 as the format type and WP60 as the Application code. The DSS moves the TIF file to the temp location as defined on the OAM command line (/T=%TMP). The file is converted to text, then moved back to the proper location on the network and the profile is updated properly. However, the TIF file is still in C:\TEMP, and the converted WP document was found on the root of H:\. Another copy of the converted WP document was found in the proper location with a 2 second difference on the time stamp from the one found on H:\.

RESOLUTION: Change the OAM command lines from /T=%TMP to /T=C:\TEMP. SSOCR was written with a version of the API which could not interpret %TMP properly. The SSOCR program was being passed a backslash instead of the full path to the document and because H:\ was the current drive, the document was saved there instead of overwriting the TIF file in C:\TEMP. Basic users were getting the error because they did not have WRITE rights to the root of the network drive.

This is an issue within the API so any utility or program written with this version of the API will have this problem. The API itself was enhanced for 4.0a but not all utilities and programs for 4.0a are utilizing the new function call which interprets %EC and %TMP properly. Hard coding the /T= and /E= locations on the OAM command line will work around this issue until all programs and utilities are enhanced. SoftSolutions 4.1 has resolved the problem.

Subject:	Universal Data

Universal Data has a DSS.NLM too. Any user with this conflict can rename our DSS.NLM to SEC.NLM or something else. We are not sensitive to the name of the file .

The users can either rename our DSS.NLM to something else or they can put our DSS.NLM in a different subdirectory than the IP DSS and load it with and explicit path. For example LOAD SYS:\SOFTSOL\DSS.NLM.

Subject:	721: Unable to open destination file

Every time a user tried to open a document in Word6 they would get the 721 error.

If your running the DSS add %f to the OAM command lines for oamlaunc, oamprevi, and oamend.

Subject:	DSS

PROBLEM:

The DSS had been running for a year but the network administrator just discovered that all users could see the "secured" documents. We looked in the DSS.CFG file and found that it said SYNC Report and not SYNC Revoke. We ran a SYNC Revoke from rconsole but no files were revoked. We double checked the .CFG file and the OAM command lines but still the revoke did not take. They were even using the /c switch to specify where the CFG file was located (even though it was in the system directory).

SOLUTION:

The user was typing LOAD DSS /c=j:\system instead of LOAD DSS /c=j:\system\dss.cfg. Leaving off the file meant the dss was loading without using the .cfg (apparently it was confused and thought that system was the name of the cfg file).

NOTE: I have found that 99% of DSS problems can be solved by running a SYNC Revoke. This is because they loaded the dss but had not run a SYNC yet and the cfg file has it scheduled for tomorrow morning. To make matters worse they usually remove everyone's rights and then load the dss--in effect taking away all rights to the documents but the dss had not done the revoking.

Also, remember that you are loading it from the server console. Network drive letters don't make sense here. Also, the server name is implied. You'll get an error with the server name in there. The actual syntax is:

load dss.nlm /c=vol:\<path>\dss.cfg

and if dss.nlm is in another directory besides the SYSTEM directory on the SYS volume, it is:

load vol:\<path>\dss.nlm /c=vol:\<path>\dss.cfg

Subject:	SDK -2/17/95

The current SDK does NOT work with the DSS if, and only if, you are creating external OAMS.

Subject:	Byte size 1175

WordPerfect for Windows 6.1 documents are being saved with 1175 bytes--even large documents with graphics were reduced to 1175. When retrieved later, these documents looked like empty files.

Some of the OAM command lines had a space between the %p%f. The 1175 bytes was coming from empty.wpd and then the document was probably trying to be saved as the path.

Subject:	Getting WPWIN file save as

When users were choosing file save as| new document in WordPerfect 6.0a, after filling out the new profile, they were being taken back to the WordPerfect file save as dialog box.

They had unloaded the DSS and did not grant rights back to the secured docs\ directory. Thus the users had no rights to create files in the specified location, so they got Wps file save as dialog box. Grant rights to \docs directory.

Subject:	Time Zone documentation in NetWare manuals

Earlier version of the NetWare manuals were incorrectly stated that time zones WEST of GMT are actually negative numbers and time zones that are EAST of GMT are represented with a + sign. (If no sign is given NetWare assumes it is positive)

Subject:	"Cannot find Netware.dll "

An error indicating that NETWARE.DLL cannot be found, will be displayed if the /DSS switch is used in an OAM command line and the Windows setup does not have NetWare specified as the network in SYSTEM.INI .