create a Separate keystore - 12.51

while performing the parallel migration from r6sp5 to r12.51 I gave the steps to separate a key-store in the r6sp5 environment. once that step is complete and migration of all app servers to the new environment are done - it is best to create a separate key-store for the r12.51 environment (reason being clients are already asking for another upgrade to .52).

with this in mind, below are the steps to create a separate key-store for r12.51. CA documentation is pretty straight forward in this case which is an exception.

• create a directory server (I used DSEE11g) on available port (30389/30636)
• create new suffix under it 'DC=Netegrity,DC=DOMAIN,DC=net' - in step 5 make sure to initialize top entry for the suffix while creating it. this is an important step.

• command to register the new key-store in the policy server : smldapsetup reg -hostX.X.X.X -p30389 -d"cn=directory manager" -wPASSWORD -r"DC=Netegrity" -k1
• verify in the console and correct if any mistakes
• command to generate the schema for keystore  : smldapsetup ldgen -fJune2014_newkeystoreschema.txt -k1
• command to update the schema into keystore  : smldapsetup ldmod -fJune2014_newkeystoreschema.txt -k1
• in policy server management console - keys tab - enable agent key generation
• start policy server and watch the logs.

IBM Heap Analyser - Java.lang.OutofMemoryError: Java heap space

IBM Heap Analyser -

I started getting "Java.lang.OutofMemoryError: Java heap space" when trying to read a heapdump file using the heap analyser. used the below on a windows 2008r2 server where I had 64bit java  installed. specified the initial and max heapsize and it started working.

D:\Program Files\Java\jdk1.7.0_25\bin>java -Xms2g -Xmx6g -jar d:\temp\ha450.jar

Siteminder r6 - separate keystore from policy store

We have r6sp5 siteminder environment which we are looking to parallel upgrade to r12sp3 soon. below are some detailed steps how to separate the KeyStore from the policy store in a r6sp5 environment. The siteminder documentation is very vague in its description of how to do this.

***************

1.Take the backup of existing keys for the policy server:
smobjexport.exe -dsiteminder -wP@55word -okey.smdif -x -v

2. Create a new LDAP Key Store instance in your directory server.
3. Now open the Siteminder smconsole and go to the data tab-> Select Key Store, then uncheck the option-Use Policy Store Database. And fill the details for your newly created Keystore (like IP: Port, username, password and root DN) in this Keystore tab. After this click OK.

4. Open Command Prompt, go to /bin and perform the following command :-
smldapsetup ldgen -fnewkeystoreschema.txt -v -k1
This will create a schema file for your new keystore instance

6. Also at the same location run the following command :-
smldapsetup ldmod -fnewkeystoreschema.txt -v -k1
This will create the Schema in your New LDAP keystore from this schema file

7. run
smobjimport.exe -dsiteminder -wP@55word -ikey.smdif -k -v

8. Now we are done with the creation of new keystore. Start the policy server and check the logs.
*****************

Slow Performance on Windows 7 while browsing IIS Apps - AutoTuning

We recently migrated all our IIS applications from old Windows 2000 Servers to Windows 2008. It was not a smooth ride but we did manage to get 99% of them into the new servers. There were ofcourse some apps with exe's that were not supported or cannot move to x64. Parallely most of our users were being upgraded from their Windows XP to Windows 7 PC/Laptops.

We found that users connecting from Win7 to IIS face performance problems in the corporate network. The performance was so bad that it took 20+ seconds to display a single page. We also found that the sites worked perfectly when users connected to IIS via a reverse proxy or when they connected using a Windows XP machine.

So the problem was with Windows 7 and by trial and error method we found that AutoTuning was the issue. I think Microsoft enabled AutoTuning by default in Windows 7 and somehow that setting is not compatible with our network gear.

To disable AutoTuning on a Windows7 Machine.
1) open command prompt as Administrator
search for cmd in ‘Start’ and press CTRL+SHIFT+ENTER instead of just enter.
2) paste the below command to get Ok.
netsh interface tcp set global autotuning=disabled