Can`t Login to WAS/NWA (always redirected to login screen)

Question

Dear Gurus,
                   We tried to implement SSO logon Tickets following [steps|https://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/a0042af5-5406-2c10-f689-fcc3b2d13d2f], and now we can`t login to any netweaber tool (NWA, User Admin, etc).
The user/password validation is OK but always we are redirected to login screen.
We didn't find any errors on trace files (dev_icm, dev_wX).
We found this message on ../j2ee/cluster/server0/log/system/security.0.log after trying to login:
User: J2EE_ADMIN
Authentication Stack: ticket
Login Module                                                               Flag        Initialize  Login      Commit     Abort      Details
1. com.sap.security.core.server.jaas.EvaluateTicketLoginModule             SUFFICIENT  ok          true       true                 
2. com.sap.engine.services.security.server.jaas.BasicPasswordLoginModule   REQUISITE   ok                     true                 
3. com.sap.security.core.server.jaas.CreateTicketLoginModule               OPTIONAL    ok                     false                
Central Checks                                                                                true                  #
<snip>
And this message on HTTP log at ICM Monitor:
<snip>
I hope you can help us!!
Thanks in advance.
Federico.
Edited by: Julius Bussche on Jun 4, 2009 10:57 PM
Edited by: Julius Bussche on Jun 4, 2009 11:05 PM
Edited by: Julius Bussche on Jun 5, 2009 2:44 PM

Answer 1

If you are presented repeatedly with the logon page without a message such  'user authentication failed' or similiar, despite the fact that the entered
credentials were correct (you can check this by logging onto the ABAP stack with the same credentials), then the problem possibly lies in the ticket creation or evaluation and/or misconfiguration of the ticket login module stack.
The attached log shows successful authentication by J2EE_ADMIN with an already existing logon ticket, not an authentication attempt with userID and password so this is not the most relevant trace entry for your problem with logging on wiith userID and password. It does show however at the time this trace entry was written that the 'ticket' login module stack was configured correctly and evaluation of tickets was working without problem at that time
Are you sure these trace entries are from the time of the last logon attempt?
Instead of looking in the security log, look in the servers defaultTrace file for traces written during the failed logon by userid and password. If you are comfortable with adjusting trace severities, follow note 701205 section "Logging and Tracing" and set the trace locations mentioned there to ALL before reproducing the failed logon for more debug info. Remember to set them back to default levels afterwards
You can check in the Visual Administrator, that the ticket login module stack includes the following modules in this order, with these flags, and at least these options.
EvaluateTicketLoginModule  SUFFICIENT   {ume.configuration.active=true, *}
BasicPasswordLoginModule   REQUISITE
CreateTicketLoginModule    OPTIONAL     {ume.configuration.active=true}
list of additional ACL parameters such as trusteddn etc
Sorry about the format of this reply, not sure how to correct it, in preview the formatting is fine
Edited by: Patrick Whitty on Jun 5, 2009 12:05 PM