IBM Support

Suddenly all users are prompted to logon with Native authentication (instead of Cognos CAM authentication) - triggered by IIS AppPool recycling

Troubleshooting


Problem

System is configured so that users logon using CAM authentication (in other words, they logon to Controller using their Windows usernames and passwords. This works OK for a long time (for example many months).
However, suddenly one day the users are prompted to logon with the standard Controller 'native' logon prompt.
  • The administrator checks the security settings, but they are still set to authenticate via Cognos CAM authentication.

Symptom

For a long time (for example several months) the users are correctly prompted to logon to Controller via a Cognos CAM logon prompt.

Suddenly, all users find that they are prompted with a 'Native' logon screen (the next time that they launch Controller) instead:



Problem is very rare. Typically the system works OK for many months before/afterwards.

Cause

Limitation in third-party (non-IBM) architecture that is used to host Controller.
  • Specifically, the Microsoft IIS application pool has tried to recycle, but there was a problem with the recycle process.
 
More Information:
By default, Microsoft IIS application pools recycle every 29 hours (1740 minutes), which therefore means a different time each day. Almost always, this does not cause a problem for Controller.

However, very rarely (perhaps every few months or so) the recycling causes an issue where the main Controller system loses its ability to correctly read the settings inside here: C:\Program Files\ibm\cognos\ccr_64\ControllerProxyServer\web.config
 
=> Controller therefore defaults back to some other settings, which can cause strange symptoms.

Environment

Problem has been seen with Controller 10.2.1, but it is believed to also (rarely) occur with later versions too.

Diagnosing The Problem

On the Controller application server, launch Microsoft 'Event Viewer' and open the 'Windows Logs' - 'System' log. There is an event similar to the following:
Log Name: System
Source: Microsoft-Windows-WAS
Date: 24/01/2018 14:33:53
Event ID: 5074
Task Category: None
Level: Information
Keywords: Classic
User: N/A
Computer: SERVERNAME
Description:
A worker process with process id of '11908' serving application pool 'Cognos Controller' has requested a recycle because the worker process reached its allowed processing time limit.

Resolving The Problem

Fix:
Feedback from customers is that by modifying the Controller application pool settings (so that it does not recycle during the time period when most users are using the system) the problem never occurs again in the future.
  • NOTE: This time (for example 1am) should be when the fewest users are on the system
  • In other words, it does not require downtime (no users on the system). Instead, it merely requires as few users on the system as possible.
 

Steps:

The following steps are based on Windows 2012. The steps may need to be varied slightly if using a different operating system.

1. Logon to the Controller application server

2. Launch Event Viewer, and open the 'System' Log

3. Search for a 'WAS' entry similar to the one shown above (inside 'Diagnosing the problem' section)

  • Make a note of the name of the application pool (for example 'Cognos Controller' or '.NET 2.0')
  • This will vary depending on your environment!
 

4. Launch 'Internet Information Services (IIS) Manager'

5. Locate the application pool that is being used by Controller (see step 3 above)

  • In the printscreens below, we are changing one called '.NET 2.0':

5. Right-click on the relevant application pool, and choose 'Recycling':




6. Change the setting so that it recycles at a 'quieter' time (the minimum number of users possible, using the system).
  • This reduces the possibility that the recycling clashes with Controller.

EXAMPLE: In one real-life customer case, the customer never had any users working on the system overnight. Therefore the solution was to:
  • Untick "Regular time intervals"
  • Tick "Specific times", and set to: 01:00

===========================================
 
Workarounds:
On the (rare) occasions where it has been seen, customers have found several different methods to instantly cure the problem:

Method #1
On the Controller application server, launch 'Controller Configuration'.
  • Open section 'Server Authentication'
  • Change the setting to 'Native' and press 'Save'
  • Change the setting to 'CAM Authentication' and press 'Save'

Method #2
On the Controller application server, launch 'Controller Configuration'.
  • Click on the green 'tick' button in Report Server.

Method #3
On the Controller application server, launch a Command Prompt. Type the following command:
  • IISRESET

Method #4
On the Controller application server, launch IIS Manager. Restart the application pool which is in use by the 'ControllerProxyServer' website.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS9S6B","label":"IBM Cognos Controller"},"ARM Category":[{"code":"a8m50000000KzLjAAK","label":"Logon Issues"}],"ARM Case Number":"","Platform":[{"code":"PF033","label":"Windows"}],"Version":"10.2.0;10.2.1;10.3.x;10.4.x","Line of Business":{"code":"LOB10","label":"Data and AI"}}]

Document Information

Modified date:
16 June 2020

UID

swg21990348

Page Feedback