IBM Content Navigator

The jadice web viewer can replace the Daeja ViewONE viewer inside IBM Content Navigator (ICN). ICN opens documents in the viewer through the webtoolkit-icn-plugin, which embeds the viewer in an iframe. For FileNet P8 repositories the viewer reads and writes the P8 annotations itself.

How it works

The plugin has two modes, selected by the option Load and save P8 annotations via jadice in its configuration:

	With P8 annotations (token mode)	Display only (upload mode)
Repositories	FileNet P8	any ICN repository
Document transfer	none: the plugin signs a short-lived token with the P8 object store and document id; the viewer reads content and annotations from P8 with its own technical user	the plugin downloads the document from ICN and uploads it to the viewer (/upload)
Annotations	read from P8, written back to P8	not available
Load balancer	any viewer instance can serve the token	upload and viewer request must reach the same instance
Viewer URI	icn://<token>	upload://<id>

In token mode the plugin fetches the document through ICN in the user's own security context before signing, so a user can only obtain tokens for documents they may read. The token carries the user's annotation edit right (ICN privilege and the FileNet "Link/Annotate" right on the document) and the ICN user id, which the viewer writes into its log.

Prerequisites

• IBM Content Navigator 3.0.x (tested with 3.0.7) and jadice web viewer 2.0 or later.
• The viewer is reachable from the users' browsers over HTTPS. ICN's Content Security Policy (frame-src 'self' https:) blocks an HTTP viewer on another origin inside the plugin's iframe. A reverse proxy or a deployment on the ICN application server is not required.
• Token mode: IBM's FileNet Java client Jace.jar on the viewer's classpath (see below) and a technical P8 user that may read documents and create, change and delete annotations.
• Display only: the viewer's /upload endpoint is reachable from the ICN server.

Viewer configuration

Jace.jar

The FileNet client is licensed by IBM and not part of the viewer. Take it from your FileNet or ICN installation and put it on the classpath:

• Container or runnable JAR: copy Jace.jar into the /config directory (the directory given to -Dloader.path, see Customization).
• WebSphere Liberty: register it as a shared library in server.xml:

<library id="jace">
  <fileset dir="/opt/jadice/lib" includes="Jace.jar"/>
</library>
<webApplication id="jwv" location="jwv.war" contextRoot="/">
  <classloader commonLibraryRef="jace"/>
</webApplication>

Without Jace.jar the viewer still starts, but without P8 features: no P8 save handler is offered and icn:// documents fail with FileNet P8 client (Jace.jar) is not on the classpath. Display only mode does not need it.

application.yml

server:
  ssl:                                  # HTTPS, see Prerequisites
    enabled: true
    key-store: /opt/jadice/jwv.p12
    key-store-password: ${KEYSTORE_PASSWORD}
    key-store-type: PKCS12

webtoolkit:
  icn:
    p8:                                 # technical user for reading and writing annotations
      uri: https://p8.example.com:9443/wsi/FNCEWS40MTOM
      user: jadice-p8
      password: ${P8_PASSWORD}
      # domain: P8Domain                # optional, default domain of the connection
      # annotationProfile: FileNet P8   # registered profile for FNP8 annotations (default)
    token:
      secret: ${ICN_TOKEN_SECRET}       # same value as "Token secret" in the plugin, at least 32 characters
      # previousSecret: ${ICN_TOKEN_SECRET_OLD}   # keeps the old secret valid during a rotation
      # clockSkewSeconds: 60
      # recoverGraceSeconds: 86400      # how long an already opened document may be re-read after expiry
    # staging:                          # copies of P8 content, defaults are fine
    #   tempFolderPath: /var/tmp/jwv-icn
    #   tempFileMaxAge: 30              # minutes
    #   tempFileCleanupInterval: 30     # minutes

logging:
  pattern:
    console: "%d %-5level [%thread] [clientId:%X{jwt.clientId}] [user:%X{jwt.userId}] [docId:%X{jwt.docIdentifier}] %logger: %msg%n"

Property	Default	Description
webtoolkit.icn.p8.uri		FileNet Content Engine web service endpoint.
webtoolkit.icn.p8.user, .password		Technical user. All P8 access uses this user; P8's audit trail shows it, the ICN user appears in the viewer log.
webtoolkit.icn.p8.domain	default domain	P8 domain name. The object store always comes with the document.
webtoolkit.icn.p8.annotationProfile	FileNet P8	Annotation profile the FNP8 annotations are read with. The viewer ships and registers FileNet P8; a custom profile must define the same Base* type names.
webtoolkit.icn.token.secret		Shared secret of the signed tokens, at least 32 characters. Shorter secrets are rejected.
webtoolkit.icn.token.previousSecret		Second valid secret during a rotation.
webtoolkit.icn.token.clockSkewSeconds	60	Tolerated clock drift when checking the token expiry.
webtoolkit.icn.token.recoverGraceSeconds	86400	How long a document that is already open may be re-read from P8 after its token expired.
webtoolkit.icn.staging.*	temp dir, 30 min	Where and how long copies of P8 content are kept.

Display only mode uses the upload settings instead (spring.servlet.multipart.max-file-size, webtoolkit.upload.*); restrict /upload to the ICN server at network level, it has no authentication of its own. Token-only installations can set webtoolkit.upload.enabled: false.

Plugin configuration

Install the plugin JAR through the ICN administration desktop, create a viewer mapping for it and assign the mapping to the desired desktops. The plugin configuration has these fields:

Field	Token mode	Display only
jadice web viewer URL	required, https://	required, https://
Load and save P8 annotations via jadice	on	off
Token secret	required, same value as webtoolkit.icn.token.secret	not used
Token lifetime (minutes)	optional, default 480	not used
Content Navigator server URL	not used	required: base URL the ICN server uses to download the document, without context path

The plugin opens the viewer with ?connection=longpoll&theme=icn&u={"uri":"icn://<token>"}; the icn theme is only applied through this URL parameter and does not appear in the viewer's theme menu.

Annotations

In token mode the viewer reads the FileNet annotations of the document, shows them with the FileNet P8 annotation profile and switches the annotation toolbar to that profile. Annotations of other users are read-only. The save button appears automatically because the P8 save handler is the only registered one (see Annotations); saving writes the changed annotations back to P8 with the technical user. A token without edit right makes the document read-only for annotations.

Security notes

• The token is the access credential: whoever has the viewer URL can read the document (and annotate it, if the token grants the right) until the token expires plus the recover grace period. Use HTTPS end to end, keep the secret out of logs and configuration exports, and rotate it with previousSecret.
• The viewer never prints tokens into its log; the ICN user id is logged (jwt.userId) and is personal data, so apply your log retention rules.
• The plugin holds no P8 credentials; ICN users never see the technical user.

Troubleshooting

Message	Cause
jadice web viewer URL must use https://	The plugin refuses HTTP viewer URLs; see Prerequisites.
Token secret (at least 32 characters) is required when P8 annotations are enabled	Fill in the plugin's token secret, or switch the option off for display only mode.
Framing 'http://…' violates the following Content Security Policy directive (browser console)	The viewer URL is not HTTPS.
FileNet P8 client (Jace.jar) is not on the classpath	Put Jace.jar on the viewer's classpath, see above.
Not authorized to open this document	ICN did not deliver the document in the user's context; the user may not read it.
Annotation profile 'X' (webtoolkit.icn.p8.annotationProfile) is not registered (viewer log)	The configured profile name is unknown; the viewer falls back to its default profile and P8 annotations will not load.