Changing Connections database passwords

If you've had to change the passwords for your Connections database user, you'll know this is not a straightforward process. I went through it late last week and documented it for reference. Hopefully this will save you some time if you need to do the same. Execute the steps exactly as listed, especially the timing of restarts. Failing to restart a particular component at the indicated time may lead to unpredictable results.

Step 1: Stop all application server nodes
Stop all application server JVMs. Leave the deployment manager and node agents running.

Step 2a: Update WAS data sources (GUI option)
If you use this option, skip Step 2b. Note: This option can take a long time due to the need to update alias information individually for nearly two dozen aliases.

1. Connect to the administration console
2. Navigate to Security -> Global security -> Java Authentication and Authorization Service -> J2C authentication data
3. Sort on the User ID column and locate the entries for the database user (e.g. LCUSER)
4. For each alias bound to the database user:
   1. Click the alias name
   2. Update the password
   3. Click OK
   4. Click Save
5. Sync the nodes
6. Restart the deployment manager

Step 2b: Update WAS data sources (wsadmin option)
If you use this option, skip Step 2a. Note: This option is much faster than the first option.

1. Copy the updateJ2CDatabaseAliases script (see below) to a directory on the deployment manager system. For this example, I'll use C:\IBM\Scripts
2. Start wsadmin as the primary admin user
3. Type sys.argv = ["new_password"] and press Enter
4. Type execfile('C:/IBM/Scripts/UpdateJ2CDatabaseAliases.py') and press Enter
5. Confirm that the script runs without errors
6. Sync the nodes
7. Restart the deployment manager

Step 3a: Update Cognos Content Store credentials (GUI option)

Use this option for any system with a GUI available. If you use this option, skip Step 3b. Note: The Cognos application server and associated components should not be running at this time.

1. Run the following command: <CognosBI_Install_Dir>\CognosBI\bin64\cogconfig.bat
2. Navigate to Local Configuration -> Data Access -> Content Manager -> IBM Cognos Content Store
3. Update the User ID and password field by clicking the edit button to the right
4. Click the Save button in the toolbar
5. Close IBM Cognos Configuration and click No when prompted to start the service

Step 3b: Update Cognos Content Store credentials (No GUI option)
Use this option for any system that does not have a GUI available. If you use this option, skip Step 3a. Note: The Cognos application server and associated components should not be running at this time.

1. Run the following command: <CognosBI_Install_Dir>/CognosBI/bin64/cogconfig.sh -e /tmp/cogstartup_unencrypted.xml
2. Edit /tmp/cogstartup_unencrypted.xml. Search the file for the <crn:instances name="database"> tag. Within this tag will be <username> and <password> sub-tags, which will now be unencrypted and show the actual username and password. Modify the password tag with the new password
3. Back up the existing <CognosBI_Install_Dir>/cogstartup.xml file and then copy /tmp/cogstartup_unencrypted.xml to <CognosBI_Install_Dir> and rename it to cogstartup.xml
4. Run <CognosBI_Install_Dir>/CognosBI/bin64/cogconfig.sh -s. This will re-encrypt the values and start the BI server
5. Run <CognosBI_Install_Dir>/CognosBI/bin64/cogconfig.sh -stop. This will stop BI server

Step 4: Update the Metrics and Cognos data sources

1. Start the Cognos application server JVM
2. Set the JAVA_HOME environment variable to the WAS installation directory's java directory (e.g. set JAVA_HOME=C:\IBM\WebSphere\AppServer\java)
3. Open cognos-setup.properties and update the following properties:
   1. cognos.db.user
   2. cognos.db.password
   3. metrics.db.user
   4. metrics.db.password
4. Run cognos-configure-update.bat and check cognos-configure.log for validations errors
5. Repeat Step 3 if the removePassword option is set to true in cognos-setup.properties. Otherwise skip this step
6. Run transformer-logon-set.bat -cognos.server.url=http://<your_server>/cognos and check transformer-logon-set.log for validation errors
7. Restart the Cognos application server JVM
8. Start the Connections application server JVMs
9. Connect to https://<your_server>/cognos/servlet/dispatch/ext in a browser and log in as the Cognos administrator
10. Click Launch -> IBM Cognos Administration
11. Navigate to Configuration -> Data Source Connections
12. Click METRICS_CUBE_DS -> METRICS_CUBE_DS
13. Click the Set properties button under the Actions column on the right and select the Signon tab.
14. Click Edit the signon... to update the new Metrics database password
15. Click OK twice to save the change

updateJ2CDatabaseAliases.py script

import string

# The first argument is mandatory and is the new password
try:
    PASSWORD = sys.argv[0]
except (IndexError):
    print 'Usage:'
    print 'sys.argv = ["new_password"]'
    print 'execfile("updateJ2CDatabaseAliases.py")'
    sys.exit(-1)

J2C_DATABASE_ALIASES = "newsJAASAuth:oauthpJAASAuth:oembedJAASAuth:searchJAASAuth:profilesJAASAuth:activitiesJAASAuth:blogsJAASAuth:communitiesJAASAuth:homepageJAASAuth:cs-connectionsCell01/LCUSER:dogearJAASAuth:filesJAASAuth:forumsJAASAuth:metricsJAASAuth:wikisJAASAuth:mobileJAASAuth"

aliases = string.split(J2C_DATABASE_ALIASES, ':')

for alias in aliases :
    print "Updating " + alias + " J2C alias password"
    options = '-alias ' + alias + ' -password ' + PASSWORD
    AdminTask.modifyAuthDataEntry([options])
  
AdminConfig.save()