I am trying to troubleshoot an issue with LDAP and a specific user. Besides what is in the Audit Database is there another way to look to see the LDAP functionality that is being called and the response, like there is with OAuth and the ISCLOG? The Audit Log is returning a failure (Unexpected - /api/atelier login failure | InterSystems Developer Community) for this particular user, and I want to get proof that it might be something with the LDAP and not IRIS.

Thanks

Scott

We recently moved from using the Private Web Server, to using an Apache/Web Gateway setup and moved towards using the built in LDAP functionality within IRIS. Since then, we have 1 user that uses VSCode (/api/atelier) heavily that continues to have issues signing into IRIS through VS Code and the /api/atelier extension.

I am trying to troubleshoot two issues..

Trying to setup my first OAuth 2 client to authenticate against Epic's Interconnect instance that is hosting FHIR/Web Service API's. Epic's documentation says the JWT request has to be sent as a POST request..

Does 

GetAuthorizationCodeEndpoint

and 

GetImplicitEndpoint

automatically put the request into a POST request, or do I need to format a %Net.HttpRequest to POST?

Thanks

Scott

With System Alerting and Monitoring (SAM) being deprecated in the near future..

• What is everyone's go-to for Monitoring IRIS? 
• What is readily available?
• What is the cost surrounding it?

Just trying to get ideas floating around of what we might need to start looking at to satisfy IT leadership.

Thanks

Scott

I am attempting to setup my first OAuth2 client, as we are adventuring into the realm of making FHIR API calls to our EMR from HealthShare Health Connect. 

I have gone through and set up the Issuer Endpoint, and Client Configuration but now I want to test it and verify that the setup is correct. When I setup the Client Configuration, it would not allow me to use Discovery as it was saying I needed a "Client secret" but was not given one. So I set it up manually, thinking I hit all the information correctly.

We are moving away from Delegated Authentication in which I stored a username and password for our LDAP in a GLOBAL to be called by ZAUTHENTICATE.

Is there a way to pull in that GLOBAL into the LDAP Configuration within the Managment Portal instead of having to manually enter it? There seems to be an issue with Copy/Paste that the password isn't being set correctly when I use Copy/Paste.

Else I just export/import the LDAP Configuration from 1 server to another and manually update the Certificate to point to the correct file.

Thanks

Scott

Does the Version of the Web Gateway have to match the version of IRIS that is currently running? Or are they independent of each other since they are different components? I am looking to install the Web Gateway (non-PWS) as we move forward with securing our Management Portal and VS Code connections using TLS.

Thanks

Scott

This is probably not the right place, but I don't know who I can reach out to... I am trying to configure an Apache/Web Gateway to our instance of IRIS so we are no longer using the built-in PWS. Can anyone point me in the right direction to configure Apache/Web Gateway to repoint

http://<server name>:52773/... to the https://<server name>/...

gateway so our users will not notice? How do I do this in Apache, do I need to modify httpd.conf or the ssl.conf file? What is the correct syntax...

This is what I tried to do in the httpd.conf file

Will it hurt anything if I disable the user that installed IRIS, within IRIS? Does this cause a problem with background processes running or with the restart? I know the _Ensemble user is used to start/stop/restart objects within IRIS, just didn't see anything in the documentation about the user that installed IRIS.

Thanks

Scott

I am trying to move us to Securing the Management Portal using Apache and the Web Gateway.

Our Development environment/namespace only has 1 server, but both Test and Production have failover/DR mirroring containing 3 servers for Test, and 3 additional servers for Production. 

• Development - 1 server
• Test -2 server's setup for Failover, and 1 Async DR Mirror
• Production - 2 servers' setup for Failover, and 1 Async DR Mirror

In Test and Production, the mirroring is setup using an Arbiter and the VIP address is controlled at the Hardware level.

I recently started work on trying to Tighten Security in our Development Instance of IRIS that is running based on recommendations from our Audit as you might of seen from my other posts. I am currently trying to get into the Private Web Gateway Manager within IRIS as CSPSystem, but when I attempt to sign in nothing happens. 

I went through and reset the password in the CSP.ini and within IRIS for CSPSystem. I made sure it had the new GatewayRole per suggested 

https://docs.intersystems.com/healthconnect20231/csp/docbook/DocBook.UI.Page.cls?

I am trying to lock down security within our Development environment per requirements from a Security Audit that was done earlier this year. I need to try to limit access at a public level, access to cache users, and exposure.

I installed IRIS with the Lockdown method, and have configured my web applications, services, resources, etc.

When I go into my namespace, I am constantly presented with the following error when I try to start or stop an Object...

Cannot login as IRIS manager.

We currently have a couple of Shell scripts we have written to EnableConfigItem from a Unix (Red Hat) command line, so we can control when a Service/Operation is running via the cron in Unix. We do this by calling

:>iris session xxxxx

using _system user.

During our Security audit it was mentioned that we need to lock down some of the cache users. 

• So, has others written scripts to make IRIS calls via command line?
  • If so, what is the consensus of using a Cache user vs using say a LDAP service account?

• Or what have you used in the past to ensure that the password is not hardcoded anywhere?

We are noticing some issues with the communication between our Arbiter and our servers. Looking at the following documentation to limit connections, and logging...https://docs.intersystems.com/irislatest/csp/docbook/DocBook.UI.Page.cls?KEY=GHA_mirror_set_config#GHA_mirror_set_agent_port

if I am configuring the ISCAgent on the arbiter, would we set 

application_server.interface_address=<ip_address>

to each IRIS server? Or does this mean to give it a specific NIC IP Address to use for communication?

Currently we are using Delegated Authentication using ZAUTHENTICATE to look at the groups that are associated with a user and if it matches a role within IRIS, to assign the user to that role within IRIS. 

Instead of using ZAUTHENTICATE as custom code, I am looking to use the built-in LDAP Authentication instead. Since I already have two AD Groups called (Access.Ensemble.Developer.User and Access.Ensemble.DataLookup.User) is it possible to config the built in LDAP functionality to look for these groups and assign the users to the correct roles within IRIS without the custom ZAUTHENTICATE?

My original ZAUTHENTICATE.mac to use Delegated sign on did not include GetCredentials(), however I am being told it probably should have it so I am eliminate an error I am seeing when trying to troubleshoot the ZAUTHENTICATION. I am trying to add the GetCredentials() from the documentation to the existing ZAUTHENTICATE.mac  but I am getting an error

GetCredentials(ServiceName,Namespace,Username,Password,Credentials) Public {

  // For console sessions, authenticate as _SYSTEM.
  If ServiceName="%Service_Console" {
    Set Username="_SYSTEM"
    Set Password="SYS"
    Quit $SYSTEMStatus.

Still working on my first External REST API call, and I am struggling to find the exact answer I am looking for... I get a JSON response from my API call but I am not quite sure how to dynamically get the JSON response into the Ens.Response Object with its lists of Arrays that I have defined.

  set tSC = ..Adapter.SendFormDataArray(.tHTTPResposne,"POST",tHTTPRequest,,,tURL)

  set pResponse = ##class(User.REST.Epic.Msg.GetPatientLocationResponse).%New()

  set dynObject = {}.%FromJSON(tHTTPResposne.Data)

  set iter = dynObject.%GetIterator()

  while iter.%GetNext(.

I am working on my first REST operation to send a API Request to an internal server within our Network. I have finally got past the point of being able to connect using a SSL/TLS Configuration, but I am getting a ERROR <Ens>ErrHTTPStatus: Received non-OK status 403 from remote HTTP server: 'HTTP/1.1 403 Forbidden'.

I have tried using $$$TRACE within my operation to capture the different elements that are being sent to verify the Server, URL, SSL Configuration, and payload.

Recently I started moving some of our JDBC Gateway configurations over to using the Microsoft JDBC Gateway driver instead of using the jTDS open source driver. I have noticed since then that those Objects that are using Microsoft JDBC Driver are throwing a lot more errors than the jTDS driver ever did, which I can understand however I am puzzled that I keep running into an issue with the Java Gateway Service within the Interoperability engine.

Every so often I will start seeing "Gateway Server failure timeout on 127.0.0.1:55550" followed by "Gateway Server did not respond to PING request.

Is there a way problematically to see what Operations/Services are attached to a EnsLib.JavaGateway.Service and if there are issues with the EnsLib.JavaGateway.Service to stop/start those Services/Operations that might be attached to it?

Thanks

First time setting up a SSL/TLS connection, and I am running into issues when I call it from within a Business Operation. I used openssl to generate a RSA 4096  SHA512 key/csr request for our Active Directory Certificate Service to generate a Certificate Chain for me to use within RedHat. I was 
able to connect to our Web Service server using a generic request from terminal, however when I try it from our Business Operation I am running into issues.

I tested the SSL/TLS connection using the following commands from the terminal.

DEVCLIN>set request=##class(%Net.

I am trying to setup our first SSL/TLS configuration so we can possibly connect to the EMR FHIR server to pull data into the Interoperability engine.

I am running on Red Hat, and created and submitted a openssl CSR request to our Windows ADCS system.

I used the following command to generate the key and CSR request to submit to Windows ADCS

openssl req -new -sha512 -nodes -newkey rsa:4096 -keyout xxxxxxx.key -out xxxxxxxx.csr

When the certificate was generated I was able to download the individual certificate (cer) and the certificate chain (p7b) in  DER or Base64.

Trying my first REST call operation to our internal EMR (Epic) server, and I am receiving "ERROR #6097: Error '<READ>Read+28^%Net.HttpRequest.1' while using TCP/IP device '9999'" when I attempt to test my operation. When I look up the General Error Messages for 6097 I am seeing...Error '%1' while using TCP/IP device $zu(189,1)='%2'. What does this mean? 

I am trying to connect to the server over port 443 which is HTTPS but I am not using an SSL Configuration. Could that be the issue? 

Is there a way to debug HTTP like their is with the ISCSOAP log?

I am playing around with trying to make an Epic REST API call from an operation, and from what I understood because the request has to be sent as POST, I need to send the request as JSON. However when I try taking the request and running %ToJSON against it for the payload to be created I am getting an error...

ERROR <Ens>ErrException: <METHOD NOT SUPPORTED>zgetPatientLocationByVisit+6^User.SCOTT.REST.APIOperation.1 *%ToJSON,osuwmc.Epic.Access.Request.

I had attempted to create a REST Operation before but did not have success. As I am going through the Tutorials and Documentation everything references REST services, but I have a case where I want to create a REST Operation that makes Epic API calls against Interconnect. I have done SOAP operations before and we currently have one in our Production Namespace, but from what I understand SOAP has the wsdl which defines al the structures and etc, where REST does not. 

So how does one go about creating a REST Operation if Learning Tutorials and Documentation always talks about REST services?

Had an issue on Friday where a vendor added an additional field in the middle of a row of one of our record maps. This threw the mapping off when I take the record and try to map it into HL7 and caused massive amounts of errors in our EMR because the data was wrong.

Is there a way that I can add validation on the Business Service to say if the fields are off to fail, stop, and alert on the Business Service?

I am trying to add Web Terminal as a feature for my team to use. 

I installed webterminal via zpm "install webterminal" ran on %SYS on our Development box.

%SYS>zpm "install webterminal"

[%SYS|webterminal]      Reload START (/ensemble/DEV/mgr/.modules/%SYS/webterminal/4.9.6/)
[%SYS|webterminal]      Reload SUCCESS
[webterminal]   Module object refreshed.
[%SYS|webterminal]      Validate START
[%SYS|webterminal]      Validate SUCCESS
[%SYS|webterminal]      Compile START
Recompiling WebTerminal, skipping the deletion...
Installing WebTerminal application to %SYS

Forgive me but our System Administrator who knows how the networking works is OOO...

How does IRIS know which local adapters are available to populate in an Inbound or Outbound TCP Adapter Object? We recently moved from HealthShare Health Connect 2018.1.3 to IRIS HealthShare Health Connect  2022.1. When we migrated we moved the VIP over to the new box and set it at the hardware level.

Ran into an issue with our upgrade from HealthShare Health Connect 2018.1.3 to IRIS HealthShare Health Connect 2022.1, that I thought I would reach out about, I already have a ticket open with WRC and started a chat on Discord. We have a couple of MS SQL tables that I have setup as Linked Tables within Cache to query NPI, Patient Account Information, Visit information, etc.

I am running into an error trying to send an Alert Email to test the functionality of IRIS HealthShare Health Connect  2022.1 compared to Cache HealthShare Health Connect 2018.1.3. I was trying to send an Alert email, when I am getting the following error on my EMailAlert operation which is using EnsLib.EMail.OutboundAdpater.

I verified the message to the EMailAlert was populated, so what could be throwing this error...