How to change the user of the $ZF user

Question

Question

Richard Housham · Apr 24, 2017

#Callout #Object Data Model #Access control #Caché

Hi I've created a word macro in order to convert doc to txt via the command line, this works fine via the command line by myself or another user but when I try as an the intersystems user which runs under LocalSystem it doesn't work.

So can I change the user, or set the $ZF to run as a different user?

Or do I have to try another way to convert doc to txt - it's looking like libreOffice?

I just wanted to stick with word because I could be guaranteed on the result being accurate.

Thanks

Regards

Richard

Discussion (11)2

Log in or sign up to continue

John Murray · Apr 24, 2017

Your reference to LocalSystem means I assume you're running Cache on Windows. On this platform Cache processes started by Cache (e.g. telnet logins, web application handlers, Studio connections) will run at the OS level as whatever Windows account the Cache service is set to log on as (see Windows service control manager tab as shown below).

If you make your Cache service run as a specific account rather than as Local System, then all of the processes started by Cache will run with those credentials.

I don't know if this will help you.

UPDATE: Starting at 2015.2 (I think), it is important to use the cinstall.exe utility (located in your installation's bin subdirectory) to change which account the service runs as:

cinstall setserviceusername <InstanceName> <username> <password>

If you don't do this but instead only change the setting in the Log On tab of the service (screenshot above), then in certain circumstances the $ZF() functions may return a -1 failure code. ~~See http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY=...~~ Search the docs for "setserviceusername" for more details.

1 0

score 0 · Answer 1 · 2017-11-07T11:45:11-05:00

Hello John,

I'm trying to get more information about a similar $ZF issue, and running the caché instance as a Windows user rather than Local SYSTEM. I have this link from IS to help me out:

http://docs.intersystems.com/latest/csp/docbook/DocBook.UI.Page.cls?KEY=GCRNA_C157184

But I was hoping to get a little bit more info from the link you sent out; unfortunately the link gives me a "missing" error. Do you think you can find that link again?

This is my issue: after we upgraded from 2014 to 2016, the ability to use call out (such as w $zf(-1,"dir *.*") ) is gone. IS recommended using the cinstall command, as noted above, but it's not working. I'm asking IS about it now... We run our instances under a particular user, not as local system.

I can update this thread with the solution.

Thanks,

Laura Cavanaugh

score 0 · Answer 2 · 2017-04-25T04:48:44-04:00

You're welcome Richard. As author of the question you're entitled to mark my answer as "accepted" by clicking the checkmark alongside it. Here's a screenshot that may help, but just don't click the checkmark on the screenshot

score 0 · Answer 3 · 2017-04-25T06:44:17-04:00

Hi, Richard.

...to have cache run as a different user to access that macro...

Running Caché for Windows using a dedicated user account (so called service account) may have some other advantages:

Caché processes get ability to use MS network resources (shared folders), e.g. Caché Backup can be performed directly to remote folder;
Kerberos authentication can be used.

So long story short just going down the libre office route.

Why do you expect that libre office route would be shorter? Do you plan to use another (not $zf(-1,...)) approach?

score 0 · Answer 4 · 2017-04-26T04:14:33-04:00

If you did not install Caché with minimal security, make sure your Caché user has sufficient privileges in Caché to run $ZF(-1 : you need the %System_CallOut resource.

score 0 · Answer 5 · 2017-11-07T12:10:23-05:00

The link broke when "latest" doc changed from 2017.1 to 2017.2. I suggest you search for "setserviceusername" in the doc of whichever version you're dealing with.

score 0 · Answer 6 · 2017-11-07T12:17:06-05:00

John Murray · Nov 7, 2017

And my DC post here might also be useful to you.

0 0

score 0 · Answer 7 · 2017-04-25T12:18:51-04:00

Running Caché for Windows using a dedicated user account (so called service account) may have some other advantages:
Mmmm maybe - but given that it wasn't an option on install it's not something that our Server Guys want to do and I don't blame them really. Just seems like it could lead to places that we don't want to be.

Why do you expect that libre office route would be shorter? Do you plan to use another (not $zf(-1,...)) approach?
Yeah still using $ZF but instead of using word and a macro to do the conversation just use libreOffice. It can do the conversation straight out of the box (after little play with the command line options). I just wanted to use Word because I thought it would be more reliable but it was just turning into a nightmare to get working.

score 0 · Answer 8 · 2017-04-25T16:47:32-04:00

For reference, I think if you'd chosen anything other than Minimal security during the install wizard it would have asked you which Windows account to run the service under.

score 0 · Answer 9 · 2017-04-25T04:41:34-04:00

Thanks for your quick response it's nice to know I have a place to go when I get stuck.

Having said that it's getting a bit ridiculous, install word with a macro and then to have cache run as a different user to access that macro (which might have all manner of issues).

So long story short just going down the libre office route.

Thanks though for the advice and your answer.

Richard

score 0 · Answer 10 · 2017-04-25T12:17:11-04:00

Running Caché for Windows using a dedicated user account (so called service account) may have some other advantages:
Mmmm maybe - but given that it wasn't an option on install it's not something that our Server Guys want to do and I don't blame them really. Just seems like it could lead to places that we don't want to be.

Why do you expect that libre office route would be shorter? Do you plan to use another (not $zf(-1,...)) approach?
Yeah still using $ZF but instead of using word and a macro to do the conversation just use libreOffice. It can do the conversation straight out of the box (after little play with the command line options). I just wanted to use Word because I thought it would be more reliable but it was just turning into a nightmare to get working.