Solved

Windows 2012 Server - calling a PGM from within IBM Domino XWorks script hangs

Posted on 2013-10-24
10
782 Views
Last Modified: 2013-11-26
One of my customers custom app's using IBM Xworks (domino web) to run a pgm to handle Electronic Forms. They produce PDF files using a converter (omniformat) from PDF995 to convert a HTML page into a PDF. Works perfect on 2003 and on 2008, but in Windows 2012 if I run the command from a DOS window - works fine, but when it's called from within Domino Script - it just hangs and never produces the PDF.

Odd thing is, I can launch Xworks as a desktop program and it works, but when I run XWorks as windows service I have the problem.  My answer was build the new server under 2008R2 but they wanted 2012.  Right now we are running it as a desktop app, but that is less than optimum.

I thinking this has some interactive security problem with 2012 - I know that part of the OS is really tightened up. I looking for some guidance from either more experienced Windows Server expert or Domino developer.
0
Comment
Question by:mkc451
  • 5
  • 3
  • 2
10 Comments
 
LVL 4

Expert Comment

by:umeli
Comment Utility
Hi
Have you tried to run the domino with a service account or with the usual Local System Account?
0
 
LVL 2

Author Comment

by:mkc451
Comment Utility
Logged in to system account with check box to allow desktop interaction... might try logging it on as administrator ... might work better.
0
 
LVL 10

Expert Comment

by:larsberntrop
Comment Utility
One thing to watch out for is using data on a drive which is actually a a share on a different System.  a logged in user can access that, a Local System account cannot.
0
 
LVL 2

Author Comment

by:mkc451
Comment Utility
Nope -- data is all local on D: drive partition. The URL is on that box and it's the using the XWorks web server. Odd thing is I can run the omniformat command from Command line w/no problem. The issue is when it's called from XWorks script. I did verify I was wrong, it's running under Administrator when it's running as a service so it should have full access. I did also check and make sure the directory it creates that PDF in has complete access for everyone.
0
 
LVL 4

Expert Comment

by:umeli
Comment Utility
Hi
Have you run the setup as "Administrator"? Maybe the Windows UAC prohibits something
0
Do You Know the 4 Main Threat Actor Types?

Do you know the main threat actor types? Most attackers fall into one of four categories, each with their own favored tactics, techniques, and procedures.

 
LVL 2

Author Comment

by:mkc451
Comment Utility
Yep tried setup as admin also -- no luck. I am sure it's a security issue. If we launch Domino as a service using Administrator or Local system account(which is normally how it works), the shell command in Lotus script will launch the converter but the converter hangs (like it's waiting for authorization to run imho.) ... But it we run the XWorks domino server a desktop app, it works fine.

I am going try one more thing this weekend, instead of launching the Omniformat command I am going to write a batch file, with a passed parameter. Then launch it from the script as a bat file. I can set the compatibility options for elevated permissions, but I am afraid it will still hang waiting for the authorization prompt.
0
 
LVL 10

Expert Comment

by:larsberntrop
Comment Utility
When called from the shell command I think the environment (path, temp,  etc.) is different from when run interactively.
<perusing www.omniformat.com>
Aha!

In the Omniformat FAQ  I found this:
How is HTML processed by OmniFormat and HTML2PDF995?
OmniFormat uses Word to convert from HTML and MHTML by default. HTML2PDF995 uses the Microsoft Internet Explorer control. It is faster and more accurate than Word for rendering and printing of HTML and MHTML. Adding "Use HTML2PDF995=1" (Do not include the quotes) to the [OmniFormat] section of ..\pdf995\res\pdf995.ini will configure OmniFormat to use HTML2PDF995 instead. In addition, HTML2PDF995 may be called from other applications or the command line to convert HTML to PDF by passing the full path or URL of the desired file to be converted.

Header text, footer text and margins should be specified in the Internet Explorer-File-Page Setup dialog.
and
How do I convert Office documents when running OmniFormat as a Service?
When running as a OmniFormat as a Service you may need to change the logon account from Local System to Local Administrator for the OmniFormat Service.

Also enlightening to read is the pdf995 FAQ!
Omniformat uses Pdf995 as a printer, which then produces a PDF.
They also have a developer FAQ

From what I gather, it uses the print process to create PDF files. and doing that as a service requires extra setup.  I'll try to find it.
0
 
LVL 10

Expert Comment

by:larsberntrop
Comment Utility
Installed Omniformat, and read the readme.html. It has a rather large section on html conversion:
HTML2PDF995:
OmniFormat uses Word to convert from HTML and MHTML by default. HTML2PDF995 uses the Microsoft Internet Explorer control. It is faster and more accurate than Word rendering and printing of HTML and MHTML. Adding "Use HTML2PDF995=1" (Do not include the quotes) to the [OmniFormat] section of ..\pdf995\res\pdf995.ini will configure OmniFormat to use HTML2PDF995 instead. In addition, HTML2PDF995 may be called from other applications or the command line to convert HTML to PDF by passing the full path or URL of the desired file to be converted. The path or URL must be in quotes. The PDF output file may be specified as the second argument. It must also be in quotes.

Example:

"c:\omniformat\html2pdf995.exe" "www.software995.com" "c:\pdf995\output.pdf"

Header text, footer text and margins should be specified in the Internet Explorer-File-Page Setup dialog. They may alternatively be specified by adding the following entries to the [Parameters] section of pdf995.ini:

HTML Header=header text
HTML Footer=footer text
HTML Margin Bottom=#
HTML Margin Top=#
HTML Margin Left=#
HTML Margin Right=#

If blank entries are desired it may be necessary to a value of "blank" (ie. HTML Header=blank).

Printing of background colors and images may be configured in Internet Explorer,Tools, Internet Options, Advanced, Printing. Adjust the "Print backrgound colors and images" box. It may also be specified programmatically. Specify a "yes" or "no" in the [Parameters] section of pdf995.ini:

HTML PrintBackground=yes|no

Running HTML2PDF995 and OmniFormat from the command line on a Web Server (requires an OmniFormat Server key):
The following JavaScript will generate a PDF and open it in the client's browser:

<%@ LANGUAGE=JScript %>
<%
//create the pdf
shl = Server.CreateObject("WScript.Shell")
argument = "\"c:\\omniformat\\html2pdf995.exe\" "
//argument = argument + "\"c:\\pdf995\\readme.html\" "
argument = argument + "\"www.epad995.com\" "
argument = argument + "\"c:\\inetpub\\wwwroot\\out.pdf\""
//run html2pdf995 and wait for it to return
shl .Run(argument, 0 , 1 )

//display the pdf
Response.ClearContent
Response.ContentType = "application/pdf"
Response.Redirect ("http://localhost/out.pdf")
%>

Internet Information Server information:

If you are having issues invoking Omniformat or html2pdf995, enable "Initialize & Script ActiveX control not marked as safe" in the Internet Explorer Security settings on the server.

The IWAM account requires user rights to the PDF995 and OmniFormat folders. It may also require write permission to the Internet Explorer Temp folder and List permission on the containing folder (in the case of the default installation, that would mean that the IWAM  account requires List permission on the C:\ folder (it does not need to propagate - it's just required so that when the security request for the permissions list on the folders is made, the system is allowed to view the permissions for the folders; remember that the folders in question are all merely objects in the C:\ folder).

The default IWAM setting - membership of the Guests and Web Applications groups is sufficient.  However, you will need to add the PDF995 printer to that user's context. This may be accomplished by using "runas" with Internet Explorer, and specifying PDF995 as the default printer, which will effectively set up all of the registry entries for that user. Alternatively, you can add printers by referring to Microsoft Knowledge base article Q184291. This article additionally gives details of how to configure the LocalSystem account for printing.  That will only be required if you are running your web application in the "Low" context (ie, in the same process as IIS).  Applications are configured by default to run in the "Medium" context (Out of process, but pooled) context, which runs under the IWAM account.

The following will also enable printing from IIS via the IWAM account: Log into the IWAM account (do not use Run As) )and print to pdf995 manually or html2pdf995 before invoking it in IIS. This will load the user profile. This may be achieved programmatically. See Microsoft's article: How To Programmatically Cause the Creation of a User's Profile. The password to the IWAM account can be accessed by following this Microsoft Article: PRB: Configured Identity Is Incorrect for IWAM Account. This will allow html2pdf995 to temporarily set a default printer.

If you cannot log on to the IWAM account using Control-Alt-Delete or do not wish to change the password for the IWAM account, html2pdf995 will attempt to use PDF995 as the default printer. You can adjust the printer used by default by adding a "Default Printer" entry to the [HTML2PDF995] section of pdf995\res\pdf995.ini. The default value is

Default Printer=PDF995,winspool,Ne00:

If you log in as the administrator, you can determine how the above setting should appear by setting PDF995 as the default printer and then looking at the Device setting in HKEY_USERS\.DEFAULT\Software\Microsoft\WindowsNT\CurrentVersion\Windows or HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows.

If you are having trouble with html2pdf995 and have Internet Explorer 6 installed, we recommend installing Internet Explorer 7 or later.

It may be necessary to adjust the web.config file so that "identity impersonate" is set to false if using ASP.NET. This may be done either in the global web.config file or in a web.config file in the directory containing the asp or aspx file which calls html2pdf995.exe. If using ASP, you can disable identity impersonate via IIS.

Autolaunch should be turned off using PdfEdit995 when running html2pdf995.exe on IIS.

When using Omniformat or html2pdf995 from IIS on Server 2003 or later, you may need to give
iusr_servername and/or iwam_servername full permissions to the folder having the input document.

The IWAM account may require read access to:

1. c:\document and settings\default user\local settings\application data\internet explorer\MSIMGSIZ.dat

2. c:\windows\system32\shell32.dll

3. c:\windows\system32\inetcpl.cpl

4. c:\windows\explorer.exe

The IWAM account may require read and possibly write access to the following registry keys:

HKLM\SOFTWARE\Microsoft\internet explorer
HKLM\SOFTWARE\Microsoft\Windows\currentVersion\InternetSettings\zonemap
HKLM\SOFTWARE\Microsoft\Windows\currentVersion\InternetSettings\5.0
HKLM\SOFTWARE\Microsoft\Windows\currentVersion\InternetSettings\cache

The following may be necessary for doc to pdf conversion with IIS6:

1. Installing FrontPage extensions to IIS will create a "MSSharePointAppPool"
2. In IIS properties, the Home directory tab for the website has to be switched from DefaultAppPool to "MSSharePointAppPool"
3. The the latest service pack for Microsoft Office 2003 may fail when OmniFormat calls MSWord. Uninstall Microsoft Office 2003 from the web server in order to remove the service pack. Reinstall Microsoft Office 2003 without the service pack

Error Handling:
Omniformat monitors Office format conversions and use of html2pdf995. If the conversion time exceeds 600 seconds, Omniformat will terminate instances of the Office application or html2pdf995, launch another instance of Omniformat if Omniformat is not processing from the command line and terminate itself. The timeout value can be adjusted by adding the following to the [Omniformat] section of pdf995\res\pdf995.ini where ## is the number of seconds desired:

Progress Timeout=##

Omniformat may be configured not to restart Office applications or html2pdf995 by adding the following to the [Omniformat] section of pdf995\res\pdf995.ini:

Terminate Helper Application=0

Omniformat may be configured to restart both itself and Word after processing a specified number of files. Configure this by adding the following to the [Omniformat] section of pdf995\res\pdf995.ini where ## is the number of files that should be processed before a restart:

FilesToProcessBeforeRestarting=##

So it appears you need an Omniformat server key to run it in the background, without the sponsor pages appearing, see http://pdf995.com/faq3.html, topic: How can I set up PDF995 as a shared network printer?
0
 
LVL 2

Accepted Solution

by:
mkc451 earned 0 total points
Comment Utility
We never actually found a proper solution. We had to stop running domino a service but run it from the login, it works that way and thats what the customer decided to do.
0
 
LVL 2

Author Closing Comment

by:mkc451
Comment Utility
This what we finally did .. not perfect but it works.
0

Featured Post

Complete VMware vSphere® ESX(i) & Hyper-V Backup

Capture your entire system, including the host, with patented disk imaging integrated with VMware VADP / Microsoft VSS and RCT. RTOs is as low as 15 seconds with Acronis Active Restore™. You can enjoy unlimited P2V/V2V migrations from any source (even from a different hypervisor)

Join & Write a Comment

For beginners of Lotus Notes user this is important to know about the types of files and their location supported by IBM Notes. Mostly users are unaware about how many file types are created and what their usages are. This Article is fully dedicated…
The article will show you how you can maintain a simple logfile of all Startup and Shutdown events on Windows servers and desktops with PowerShell. The script can be easily adapted into doing more like gracefully silencing/updating your monitoring s…
In this Micro Tutorial viewers will learn how to use Boot Corrector from Paragon Rescue Kit Free to identify and fix the boot problems of Windows 7/8/2012R2 etc. As an example is used Windows 2012R2 which lost its active partition flag (often happen…
This tutorial will walk an individual through the process of configuring basic necessities in order to use the 2010 version of Data Protection Manager. These include storage, agents, and protection jobs. Launch Data Protection Manager from the deskt…

772 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

11 Experts available now in Live!

Get 1:1 Help Now