Policy Agent Authentication Failed!!!
Hi All,
I configured the Policy Agent based on Apache 2.055, and browsed server, it display 500 error code : Internal Server Error. The followings is the debug log,
Error 900:7f2028 AuthService: AuthService::processLoginStatus() Exception message=[Authentication Failed!!] errorCode='107' templateName=login_failed_template.jsp.
2005-11-15 14:04:38.093 Error 900:7f2028 PolicyEngine: am_policy_evaluate: InternalException in AuthService::processLoginStatus() with error message:Exception message=[Authentication Failed!!] errorCode='107' templateName=login_failed_template.jsp and code:3
2005-11-15 14:04:38.093 Warning 900:7f2028 PolicyAgent: am_web_is_access_allowed()(http://exchange.hzliqun.com:8080/, GET) denying access: status = Identity Server authentication service failure
2005-11-15 14:04:38.093 Debug 900:7f2028 PolicyAgent: am_web_is_access_allowed(): Successfully logged to remote server for GET action by user unknown user to resource http://exchange.hzliqun.com:8080/.
2005-11-15 14:04:38.093 Info 900:7f2028 PolicyAgent: am_web_is_access_allowed()(http://exchange.hzliqun.com:8080/, GET) returning status: Identity Server authentication service failure.
2005-11-15 14:04:38.093 Info 900:7f2028 PolicyAgent: process_request(): Access check for URL http://exchange.hzliqun.com:8080/ returned Identity Server authentication service failure.
2005-11-15 14:04:38.093 Debug 900:7f2028 PolicyAgent: process_request(): returning web result AM_WEB_RESULT_ERROR, data []
2005-11-15 14:04:38.093 Debug 900:7f2028 PolicyAgent: am_web_process_request(): Rendering web result AM_WEB_RESULT_ERROR
2005-11-15 14:04:38.093 Debug 900:7f2028 PolicyAgent: am_web_process_request(): render result function returned AM_SUCCESS.
Please help to sovle it.
Any help will be appreciated.
Thanks,
Peter
Looks like the agent can't authenticate. Check the AM URL and the amldapuser password. Check the amserver amAuthApplication and amComm debug files to see if there are any agent authentication related exceptions. If you have ethereal installed you can do a network trace to see the XML passed between the agent and the server
Similar Messages
-
Policy agent 2.2 amfilter local authentication with session binding failed
Hi All,
I have policy agent 2.2 for weblogic 8.1 sp4 installed on redhat linux. All are working fine in my development box. But I was running all the process under user root, so today I decided to change it to a regular user, joe. I changed all the files' owner for weblogic server and policy agent from root to joe, and restart server as user Joe. After the change, I can not access the application on Weblogic server. I changed file ownership back to root and restart weblogic server as root, still same error.
Here is the error I got:
10.4.4 403 Forbidden
The server understood the request, but is refusing to fulfill it. Authorization will not help and the request SHOULD NOT be repeated. If the request method was not HEAD and the server wishes to make public why the request has not been fulfilled, it SHOULD describe the reason for the refusal in the entity. This status code is commonly used when the server does not wish to reveal exactly why the request has been refused, or when no other response is applicable.
Here is the error I found from agent log file, amFilter:
AmFilter: now processing: SSO Task Handler
05/24/2006 06:27:08:127 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
SSOTaskHandler: caching SSO Token for user uid=amAdmin,ou=People,dc=etouch,dc=net
05/24/2006 06:27:08:127 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmBaseSSOCache: cached the sso token for user principal : uid=amadmin,ou=people,dc=etouch,dc=net sso token: AQIC5wM2LY4Sfcx4XY/x/M7G1Y3ScVjFj8E3oT0BV45mh0Q=@AAJTSQACMDE=#, cache size = 1
05/24/2006 06:27:08:127 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
SSOTaskHandler: SSO Validation successful for uid=amAdmin,ou=People,dc=etouch,dc=net
05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmFilter: now processing: J2EE Local Logout Task Handler
05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmFilter: local logout skipped SSO User => amAdmin, principal =>null
05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmFilter: now processing: J2EE Local Auth Task Handler
05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
LocalAuthTaskHandler: No principal found. Initiating local authentication for amAdmin
05/24/2006 06:27:08:128 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
LocalAuthTaskHandler: doing local authentication with session binding
05/24/2006 06:27:08:129 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
LocalAuthTaskHandler: Local authentication failed, invalidating session.05/24/2006 06:27:08:129 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
WARNING: LocalAuthTaskHandler: Local authentication failed for : /portal/index.jsp, SSO Token: AQIC5wM2LY4Sfcx4XY/x/M7G1Y3ScVjFj8E3oT0BV45mh0Q=@AAJTSQACMDE=#
05/24/2006 06:27:08:129 PM PDT: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmFilter: result =>
FilterResult:
Status : FORBIDDEN
RedirectURL : null
RequestHelper:
null
Data:
null
-----------------------------------------------------------Hi,
I'm having the exact same problem in the Prod environment, but on a Sun App Server. In development all is fine, in prod we now have:
ERROR: AmFilter: Error while delegating to inbound handler: J2EE Local Auth Task Handler, access will be denied
java.lang.IllegalStateException: invalidate: Session already invalidated
at org.apache.catalina.session.StandardSession.invalidate(StandardSession.java:1258)
at org.apache.catalina.session.StandardSessionFacade.invalidate(StandardSessionFacade.java:164)
at com.sun.identity.agents.filter.LocalAuthTaskHandler.doLocalAuthWithSessionBinding(LocalAuthTaskHandler.java:289)
at com.sun.identity.agents.filter.LocalAuthTaskHandler.authenticate(LocalAuthTaskHandler.java:159)
at com.sun.identity.agents.filter.LocalAuthTaskHandler.process(LocalAuthTaskHandler.java:106)
at com.sun.identity.agents.filter.AmFilter.processTaskHandlers(AmFilter.java:185)
at com.sun.identity.agents.filter.AmFilter.isAccessAllowed(AmFilter.java:152)
at com.sun.identity.agents.filter.AmAgentBaseFilter.doFilter(AmAgentBaseFilter.java:38)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:210)
at org.apache.catalina.core.ApplicationFilterChain.access$000(ApplicationFilterChain.java:55)
at org.apache.catalina.core.ApplicationFilterChain$1.run(ApplicationFilterChain.java:161)
at java.security.AccessController.doPrivileged(Native Method)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:157)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:263)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.java:551)
at org.apache.catalina.core.StandardContextValve.invokeInternal(StandardContextValve.java:225)
FilterResult:
Status : FORBIDDEN
RedirectURL : null
RequestHelper:
null
Data:
null
Also, we I debug I see:
LocalAuthTaskHandler: No principal found. Initiating local authentication for ...
Did you receive any solution for this?
Many, many thanks,
Philip -
Urgent :Authentication fails for Policy Agent on weblogic 8 SP3
Hi
I am using policy agent for perimeter authentication for an application deployed on weblogic.When i try and access the application using any user which exists on Identity server i get the following exception in the amRealm log.
09/20/2005 06:17:07:378 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmMappingRealm: authenticateAndFetchAllRoles amAdmin, ...) = []
09/20/2005 06:17:07:378 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
WARNING: AmLoginModule.login() : Empty list of principals for user = amAdmin
09/20/2005 06:17:07:379 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmLoginModule.abort()
09/20/2005 06:17:12:505 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmLoginModule.authenticate() Initialized callback handler for Subject:
09/20/2005 06:17:12:506 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmLoginModule.login()
09/20/2005 06:17:12:506 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmLoginModule.login() : User name from Callback amAdmin
09/20/2005 06:17:12:506 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
WARNING: SSOTokenValidator failed with exception
[AgentException Stack]
com.sun.identity.agents.arch.AgentException: Invalid transport string version
at com.sun.identity.agents.util.TransportToken.initializeFromString(Unknown Source)
at com.sun.identity.agents.util.TransportToken.<init>(Unknown Source)
at com.sun.identity.agents.common.SSOTokenValidator.validate(Unknown Source)
at com.sun.identity.agents.realm.AmMappingRealm.authenticateAndFetchAllRoles(Unknown Source)
at com.sun.identity.agents.weblogic.AmLoginModule.login(Unknown Source)
at weblogic.security.service.DelegateLoginModuleImpl.login(DelegateLoginModuleImpl.java:71)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:324)
at javax.security.auth.login.LoginContext.invoke(LoginContext.java:675)
at javax.security.auth.login.LoginContext.access$000(LoginContext.java:129)
at javax.security.auth.login.LoginContext$4.run(LoginContext.java:610)
at java.security.AccessController.doPrivileged(Native Method)
at javax.security.auth.login.LoginContext.invokeModule(LoginContext.java:607)
at javax.security.auth.login.LoginContext.login(LoginContext.java:534)
at weblogic.security.service.PrincipalAuthenticator.authInternal(PrincipalAuthenticator.java:326)
at weblogic.security.service.PrincipalAuthenticator.authenticate(PrincipalAuthenticator.java:279)
at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:389)
at weblogic.servlet.security.internal.SecurityModule.checkAuthenticate(SecurityModule.java:296)
at weblogic.servlet.security.internal.BasicSecurityModule.checkUserPerm(BasicSecurityModule.java:125)
at weblogic.servlet.security.internal.SecurityModule.beginCheck(SecurityModule.java:199)
at weblogic.servlet.security.internal.BasicSecurityModule.checkA(BasicSecurityModule.java:47)
at weblogic.servlet.security.internal.ServletSecurityManager.checkAccess(ServletSecurityManager.java:145)
at weblogic.servlet.internal.WebAppServletContext.invokeServlet(WebAppServletContext.java:3568)
at weblogic.servlet.internal.ServletRequestImpl.execute(ServletRequestImpl.java:2630)
at weblogic.kernel.ExecuteThread.execute(ExecuteThread.java:219)
at weblogic.kernel.ExecuteThread.run(ExecuteThread.java:178)
09/20/2005 06:17:12:507 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmMappingRealm: authenticateAndFetchAllRoles amAdmin, ...) = []
09/20/2005 06:17:12:507 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
WARNING: AmLoginModule.login() : Empty list of principals for user = amAdmin
09/20/2005 06:17:12:507 PM IST: Thread[ExecuteThread: '14' for queue: 'weblogic.kernel.Default',5,Thread Group for Queue: 'weblogic.kernel.Default']
AmLoginModule.abort()Hi,
I have not set it up as a window service but can try to help. for one thing, this step is not permanent and if it does not work then you can undo this step by re-editting the script to remove the line you added. This step has you change the bea startup script for that domain to call the agent script setAgentEnv_AdminServer(it ws copied into bea domain directory during installation of agent) which just sets some agent resources in the classpath. If you start bea and those things are not in the classpath etc then agent wont work. So no permanent damage, you can change it if it doesnt work.
I suggest you try it out and start the bea server as a service and see if it works - if not try again.
I am not sure what the windows service would use to start the app server, but somehow it must specify some environment properties and things in its classpath, so if this script doesnt work then you can just do the things in the setAgentEnv_AdminServer script like setting those things in classpath.
Please let us know if it works and if any extra steps required? Would be helpful to others to know how to configure as a windows service.
hth,
Sean -
Custom Authentication Issue with Policy Agent
Hi,
I have a custom authentication module which is hosted on the BEA application server and I am trying to access through the policy agent on apache.
I have set the following property in AMAgent.properties file
com.sun.am.policy.am.loginURL= http://host:port/amserver/UI/Login
So When the user requests a protected resource, the policy agent forwards the user to Identity Server with the module as CustomLoginModule. However, after this, authentication is succeed, user sesion is being created and I get the following error message in the agent log file.
2004-10-19 16:20:26.908 Error 27620:e1140 PolicyEngine: am_policy_evaluate: InternalException in Service::construct_auth_svc with error message:Application authentication failed during service creation. and code:3
2004-10-19 16:20:26.908 128 27620:e1140 RemoteLog: User unknown was denied access to http://hostname:port/weblogic/protapp/protected/a.html.
2004-10-19 16:20:26.908 Error 27620:e1140 LogService: LogService::logMessage() loggedBy SSOTokenID is invalid.
2004-10-19 16:20:26.909 Error 27620:e1140 all: am_log_vlog() failed with status AM_REMOTE_LOG_FAILURE.
2004-10-19 16:20:26.909 -1 27620:e1140 PolicyAgent: URL Access Agent: access denied to unknown user
The necessary policy object is already created in Identity Server. Please send your suggestions to fix this problem.
Thanks
NeerajHi Neeraj,
I still have not been able to resolve that issue. Let me know If you find a solution for the same.
Thanks,
Srinivas -
Policy web agent configuration failed: NSPR error Configuration Failed!!!!
I am having troubles to install agent Apache 2.2!!!!!
The libamapc22.so uses libstdc++.so.5....
so i have this error:
root@ped-02 bin# service httpd start
Starting httpd: httpd: Syntax error on line 995 of /etc/httpd/conf/httpd.conf: Syntax error on line 1 of /opt/web_agents/apache22_agent/Agent_006/config/dsame.conf: Cannot load n/opt/web_agents/apache22_agent/lib/libamapc22.so into server: libstdc++.so.5: cannot open shared object file: No such file or directory
In my OS is Installed the libstdc++.so.6
if I Install the libstdc++.so.5
I have this error:
[Wed Aug 20 15:50:35 2008] [notice] Digest: generating secret for digest authentication ...
[Wed Aug 20 15:50:35 2008] [notice] Digest: done
[Wed Aug 20 15:50:35 2008] [alert] Policy web agent configuration failed: NSPR error Configuration Failed
So I have installed NSPR and NSS but this error persists.
In log /opt/web_agents/apache22_agent/Agent_006/logs/debug/amAgent
===========
2008-08-20 16:16:36.152 Error 18271:b949c3d0 all: Connection::initialize() unable to initialize SSL libraries: NSS_Initialize returned -8128
2008-08-20 16:16:36.156 Error 18271:b949c3d0 all: initialization error: am_properties_load(com.sun.am.policy.agents.config.stopInInit) failed, error = NSPR error (12): exiting...
2008-08-20 16:16:36.156 Error 18271:b949c3d0 all: Process initialization failure:NSPR error
My configuration: ---- AMAgent.properties
com.sun.am.cookie.name = iPlanetDirectoryPro
com.sun.am.cookie.secure = false
com.sun.am.naming.url = http://accessmanager.coreo.network.ctbc:8080/opensso/namingservice
com.sun.am.policy.am.login.url = http://accessmanager.coreo.network.ctbc:8080/opensso/UI/Login
com.sun.am.policy.agents.config.local.log.file =/opt/web_agents/apache22_agent/Agent_006/logs/debug/amAgent
com.sun.am.policy.agents.config.local.log.rotate = false
com.sun.am.policy.agents.config.remote.log = amAuthLog.accessmanager.coreo.network.ctbc.80
com.sun.am.log.level =
com.sun.am.policy.am.username = amadmin
com.sun.am.policy.am.password = fhfeUCQselvAndSuo17Pww==
com.sun.am.sslcert.dir =
com.sun.am.certdb.prefix =
com.sun.am.trust_server_certs = true
com.sun.am.notification.enable = false
com.sun.am.notification.url=http://accessmaager.coreo.network.ctbc:80/UpdateAgentCacheServlet?shortcircuit=false
com.sun.am.policy.am.url_comparison.case_ignore = true
com.sun.am.policy.am.polling.interval=3
com.sun.am.sso.polling.period=3
com.sun.am.policy.am.userid.param=UserToken
com.sun.am.policy.agents.config.profile.attribute.fetch.mode=NONE
com.sun.am.policy.agents.config.profile.attribute.map=cn|common-name,ou|organizational-unit,o|organization,mail|email,employeenumber|employee-number,c|country
com.sun.am.policy.agents.config.session.attribute.fetch.mode=NONE
com.sun.am.policy.agents.config.session.attribute.map=
com.sun.am.policy.agents.config.response.attribute.fetch.mode=NONE
com.sun.am.policy.agents.config.response.attribute.map=
com.sun.am.load_balancer.enable = false
com.sun.am.policy.agents.config.version=2.2
com.sun.am.policy.agents.config.audit.accesstype = LOG_DENY
com.sun.am.policy.agents.config.agenturi.prefix = http://accessmanager.coreo.network.ctbc:80/amagent
com.sun.am.policy.agents.config.locale = en_US
com.sun.am.policy.agents.config.instance.name = unused
com.sun.am.policy.agents.config.do_sso_only = false
com.sun.am.policy.agents.config.accessdenied.url =
com.sun.am.policy.agents.config.fqdn.check.enable = true
com.sun.am.policy.agents.config.fqdn.default = accessmanager.coreo.network.ctbc
com.sun.am.policy.agents.config.fqdn.map =
com.sun.am.policy.agents.config.cookie.reset.enable=false
com.sun.am.policy.agents.config.cookie.reset.list=
com.sun.am.policy.agents.config.cookie.domain.list=
com.sun.am.policy.agents.config.anonymous_user=anonymous
com.sun.am.policy.agents.config.anonymous_user.enable=false
com.sun.am.policy.agents.config.notenforced_list = SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/UI/* SERVER_PROTO://SERVER_HOST:SERVER_PORTCONSOLE_DEPLOY_URI/* SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/login_images/* SERVER_PROTO://SERVER_HOST:SERVER_PORT/docs* SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/namingservice SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/sessionservice SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/loggingservice SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/profileservice SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/policyservice SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/config* SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/js/* SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/css/* SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/authservice SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/SAMLAwareServlet SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/SAMLSOAPReceiver SERVER_PROTO://SERVER_HOST:SERVER_PORTSERVER_DEPLOY_URI/SAMLPOSTProfileServlet
com.sun.am.policy.agents.config.notenforced_list.invert = false
com.sun.am.policy.agents.config.notenforced_client_ip_list =
com.sun.am.policy.agents.config.postdata.preserve.enable = false
com.sun.am.policy.agents.config.postcache.entry.lifetime = 10
com.sun.am.policy.agents.config.client_ip_validation.enable = false
com.sun.am.policy.agents.config.profile.attribute.cookie.prefix = HTTP_
com.sun.am.policy.agents.config.profile.attribute.cookie.maxage = 300
com.sun.am.policy.agents.config.logout.url=
com.sun.am.policy.agents.config.logout.cookie.reset.list =
com.sun.am.policy.am.fetch_from_root_resource = true
com.sun.am.policy.agents.config.get_client_host_name = true
com.sun.am.policy.agents.config.convert_mbyte.enable = false
com.sun.am.policy.agents.config.ignore_path_info = false
com.sun.am.policy.agents.config.override_protocol =
com.sun.am.policy.agents.config.override_host =
com.sun.am.policy.agents.config.override_port =
com.sun.am.policy.agents.config.override_notification.url =
com.sun.am.policy.agents.config.connection_timeout =
com.sun.am.receive_timeout = 0
com.sun.am.connect_timeout = 0
com.sun.am.poll_primary_server = 5
com.sun.am.tcp_nodelay.enable = false
com.sun.am.policy.agents.config.encode_url_special_chars.enable = false
com.sun.am.policy.agents.config.iis.filter_priority = HIGH
com.sun.am.policy.agents.config.cdsso.enable=false
com.sun.am.policy.agents.config.cdcservlet.url = http://accessmanager.coreo.network.ctbc:8080/opensso/cdcservlet
Jonathan Costa Muniz.Hi joncmuniz,
Are you managed to resolve this problem? I have the same.
In logs i have such information:
2008-10-08 16:48:02.471 Debug 23153:84d5368 all: Connection::initialize() calling NSS_Initialize() with directory = "" and prefix = ""
2008-10-08 16:48:02.471 Debug 23153:84d5368 all: Connection::initialize() Connection timeout wen receiving data = 0 milliseconds
2008-10-08 16:48:02.472 Error 23153:84d5368 all: Connection::initialize() unable to initialize SSL libraries: NSS_Initialize returned -8128
2008-10-08 16:48:02.475 Error 23153:84d5368 all: initialization error: am_properties_load(com.sun.am.policy.agents.config.stopInInit) failed, error = NSPRerror (12): exiting...
2008-10-08 16:48:02.475 Error 23153:84d5368 all: Process initialization failure:NSPR errorI think the problem is with certificates, but i can't point where.
Can you help? -
Policy Agent 2.2, IIS 6.0, CDSSO and redirects after authentication
Hi
I've got a problem where a HTTP/1.1 200 and 302 are returned by the Policy Agent / Application, after the Javascripted POST by the CDCServlet content is performed.
The expected functionality is that the user is authenticated with the AM, the CDC Servlet serves the JavaScript page that will do a POST to the Policy Agent. The Policy Agent should then do what it needs to do with the POST, and forward request to the Application. The Application then does what it needs to do, and in this case, serves a HTTP/1.1 302 for redirection back to the browser.
However, it seems that the Policy Agent might be returning a HTTP/1.1 200, and setting the iPlanetDirectoryPro cookie, quickly followed by the HTTP/1.1 302 and the setting of whatever cookies it wants to set.
The Policy Agent should be respecting the return code of the Application. This problem does not appear when run against the Policy Agent for the Sun ONE Web Server.
Wondering if anyone has seen this before?
Here is sanitized output from a trace on the POST and resulting response.
POST /oslp/?sunwMethod=GET HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Accept-Language: en-au
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)
Host: sco88342744.corp.qed.qld.gov.au
Content-Length: 3496
Connection: Keep-Alive
Cache-Control: no-cache
X-ProcessAndThread: IEXPLORE.EXE [904; 2908]
LARES=<snip>
HTTP/1.1 200 OK
Date: Wed, 16 May 2007 22:25:42 GMT
Server: Microsoft-IIS/6.0
Set-Cookie: iPlanetDirectoryPro=AQIC5wM2LY4Sfcz8tCfJ96AXxjIgRzuZJDgE7gMeTO0iIS4%3D%40AAJTSQACMDQ%3D%23;Path=/
HTTP/1.1 302 Found
Date: Wed, 16 May 2007 22:25:42 GMT
Server: Microsoft-IIS/6.0
X-AspNet-Version: 1.1.4322
Location: /oslp/user/signon.aspx
Set-Cookie: ASP.NET_SessionId=lh4sus55y1iy2r5514onnjuj; path=/
Cache-Control: no-cache
Pragma: no-cache
Expires: -1
Content-Type: text/html; charset=utf-8
Content-Length: 139
<html><head><title>Object moved</title></head><body>
<h2>Object moved to <a href='/oslp/user/signon.aspx'>here</a>.</h2>
</body></html>Hi,
we had the same problem, but we got support
from readme.txt
Bug#: 6789020
Agent type: All Agents
Description: In CDSSO mode non enforced POST requests cannot be accessed
Bug#: 6736820
Agent type: IIS 6 Agent
Description: IIS 6 agent doesn't work properly with ASP pages in CDSSO mode
Both bugs should be fixed in this version:
Sun Java System Web Agents 2.2-02 hotpatch2 -
Policy agent using https redirect to AM for authentication
We are using Access Manager 6 2005Q1.
Access Manager is running on box A & box B using the Sun Web Server as its front end web server. Box A & B both have a complete install of Sun Web Server, Access Manager, and Directory Server. The Directory servers are set up to replicate changes between each other. Our Policy Agents are running on box C & box D under the Apache web servers.
Users will access applications on box C/D via https. The policy agents on box C/D should redirect the user to box A/B (via a load balancer VIP)for authentication. The redirect will be https. Once authenticated the user should be redirected back to box C/D.
All subsequent communications between the Agents on box C/D to AM on box A/B (via load balancer VIP) are http.
Our load balancer is currently setup as active/failover because it does not support ssl with cookies.
In our AMAgent.properties file if I set 'com.sun.am.policy.am.loginURL = http://<lb-vip>:80/amserver/UI/Login' and access box C/D as https://<webserver>/<url> I am redirected to AM on box A/B for authentication. Once authenticated I am redirected back to box C/D and allowed access to <url>.
However, if I set 'com.sun.am.policy.am.loginURL = https://<lb-vip>:443/amserver/UI/Login' and access box C/D as https://<webserver>/<url> I am NOT redirected to AM and receive 'Forbidden You don't have permission to access /<url> on this server. Also in the agent log file I see:
2006-01-30 12:42:30.792 Debug 28126:203470 PolicyAgent: in_not_enforced_list():enforcing access control for https://<webserver>:443/<url>
2006-01-30 12:42:30.792 Debug 28126:203470 PolicyAgent: am_web_is_access_allowed https://<webserver>:443/<url>S, GET) no sso token, setting status to invalid session.
2006-01-30 12:42:30.792 Debug 28126:203470 PolicyAgent: Policy Agent: am_web_is_access_allowed returned status=invalid session
2006-01-30 12:42:32.800 Warning 28126:203470 PolicyAgent: am_web_get_redirect_url() unable to find active Identity Server Auth server.
2006-01-30 12:42:32.800 Info 28126:203470 PolicyAgent: do_redirect(): Status Code= invalid session.
Interestingly if I set 'com.sun.am.policy.am.loginURL = https://<am-server>:443/amserver/UI/Login' and access box C/D as https://<webserver>/<url> I am redirected to AM on box A/B for authentication. Once authenticated I am redirected back to box C/D and allowed access to <url>. In this scenario the only difference is I am bypassing the load balancer.
Our networking people have monitored the load balancer in front of our AM boxes A/B and see the traffic going to AM in all cases.
From my standpoint it appears the agent is not able to successfully connect to AM via https when going through the load balancer.
Any help with this configuration issue is appreciated.Bernhard,
From our AMAgent.properties... com.sun.am.policy.agents.version=2.1. Is there a way for me to tell if this is truely only 2.1 or 2.1-xx?
Because our LB does not support SSL with cookies we are currently configured as active/failover so all requests are going to the same AM server until it goes down, at which time I know users have to re-authenticate. Also we have set "com.sun.am.loadBalancer_enable = true" in AMAgent.properties.
We understand your point about loginURL. Infact there are two properties dealing with loginURL, com.sun.am.policy.am.loginURL and com.sun.am.policy.am.library.loginURL. Based on the comments in AMAgent.properties my understanding is that com.sun.am.policy.am.loginURL is where the user is redirected for login when no valid SSO token is found and com.sun.am.policy.am.library.loginURL is what the agent uses to authenticate itself "If the previously specified login URL must be exclusively used for redirecting users..." The interesting part is that if we set com.sun.am.policy.am.loginURL to use http everything works just fine, however if we set it to use https the user never gets redirected. Its almost like the agent is trying to connect there first before doing the redirect and can not.
Craig -
Weblogic fails to start after Configuring Agent Authenticator Provider
Hi
I have installed the Sun One Policy Agent for Weblogic.After making changes to the Security Realm, the weblogic server does not start.Following is the stack trace seen on the console.
The WebLogic Server did not start up properly.
java.lang.ExceptionInInitializerError
at com.sun.identity.agents.weblogic.AmAuthProvider.getRealmInstance(Unknown Source)
at com.sun.identity.agents.weblogic.AmAuthProvider.initialize(Unknown Source)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.createSecurityProvider(SecurityServiceManagerDelegateImpl.java:242)
at weblogic.security.service.SecurityServiceManager.createSecurityProvider(SecurityServiceManager.java:939)
at weblogic.security.service.PrincipalAuthenticator.initialize(PrincipalAuthenticator.java:151)
at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuthenticator.java:257)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.doATN(SecurityServiceManagerDelegateImpl.java:581)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.initializeRealm(SecurityServiceManagerDelegateImpl.java:420)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.loadRealm(SecurityServiceManagerDelegateImpl.java:698)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.initializeRealms(SecurityServiceManagerDelegateImpl.java:731)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.initialize(SecurityServiceManagerDelegateImpl.java:874)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityServiceManager.java:717)
at weblogic.t3.srvr.T3Srvr.initializeHere(T3Srvr.java:822)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:670)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:344)
at weblogic.Server.main(Server.java:32)
Caused by: java.lang.RuntimeException: Exception caught in AmRealmManager initializer: AmRealm: Unable to create store connection
at com.sun.identity.agents.realm.AmRealmManager.<clinit>(Unknown Source)
Can anyone help regarding this.Its UrgentHi all
I am also getting the same error
CLASSPATH=C:\bea\JDK141~1\lib\tools.jar;C:\bea\WEBLOG~1\server\lib\weblogic_sp.j
ar;C:\bea\WEBLOG~1\server\lib\weblogic.jar;C:\bea\WEBLOG~1\server\lib\ojdbc14.ja
r;C:\bea\WEBLOG~1\common\eval\pointbase\lib\pbserver44.jar;C:\bea\WEBLOG~1\commo
n\eval\pointbase\lib\pbclient44.jar;C:\bea\JDK141~1\jre\lib\rt.jar;C:\bea\WEBLOG
~1\server\lib\webservices.jar;C:\Agent\IdentityServer\j2ee_agents\lib\agent_tool
s_2_1.jar;C:\Agent\IdentityServer\j2ee_agents\config\C__bea_user_projects_domain
s_NewFuelPricingDomain;C:\Agent\IdentityServer\j2ee_agents\locale;C:\Agent\Ident
ityServer\j2ee_agents\lib\am_agent_sdk_2_1.jar;C:\Agent\IdentityServer\j2ee_agen
ts\lib\am_agent_filter_2_1.jar;C:\Agent\IdentityServer\j2ee_agents\lib\am_sdk.ja
r;C:\Agent\IdentityServer\j2ee_agents\lib\am_services.jar;C:\Agent\IdentityServe
r\j2ee_agents\lib\am_sso_provider.jar;C:\Agent\IdentityServer\j2ee_agents\lib\am
logging.jar;C:\Agent\IdentityServer\j2eeagents\lib\am_wl70_agent_2_1.jar;extli
b\log4j-1.2.8.jar;C:\bea\appsettings;C:\projects\resources\terajdbc4.jar;C:\proj
ects\resources\tdgssjava.jar;.\log4j.xml
PATH=C:\bea\WEBLOG~1\server\bin;C:\bea\JDK141~1\jre\bin;C:\bea\JDK141~1\bin;C:\P
rogram Files\NCR\Teradata Client\Bin;C:\Program Files\CA\Dcs\DMScripting\;C:\Pro
gram Files\CA\DCS\CAWIN\;c:\reskit;c:\winnt;c:\winnt\system32;c:\winnt\system32\
wbem;C:\Program Files\Common Files\OpSession\Shared;C:\Program Files\Common File
s\OpSession\Viewer Shared;N:\;c:\orant\bin;C:\Program Files\CA\Unicenter Softwar
e Delivery\BIN;C:\orant\bin;C:\Program Files\Hewlett-Packard\OpenView\service de
sk 4.5\client\bin;C:\ant\bin;.;C:\j2sdk1.4.2_16\bin;C:\Documents and Settings\dp
sdazk;C:\java\javasoft\java1.42\bin;C:\java\apache\jakarta-ant-1.5.1\bin;C:\Prog
ram Files\NCR\TeraJDBC\bin;;C:\bea\WEBLOG~1\server\bin\oci920_8
* To start WebLogic Server, use a username and *
* password assigned to an admin-level user. For *
* server administration, use the WebLogic Server *
* console at http:\\[hostname]:[port]\console *
Bad level value for property: com.iplanet.services.debug.level
Bad level value for property: com.sun.identity.agents.logging.level
Bad level value for property: com.sun.am.policy.amFilter.audit.level
<Feb 13, 2008 1:34:09 PM EST> <Info> <WebLogicServer> <BEA-000377> <Starting Web
Logic Server with Java HotSpot(TM) Client VM Version 1.4.1_05-b01 from Sun Micro
systems Inc.>
<Feb 13, 2008 1:34:09 PM EST> <Info> <Configuration Management> <BEA-150016> <Th
is server is being started as the administration server.>
<Feb 13, 2008 1:34:09 PM EST> <Info> <Management> <BEA-141107> <Version: WebLogi
c Server 8.1 SP2 Fri Dec 5 15:01:51 PST 2003 316284
WebLogic XMLX Module 8.1 SP2 Fri Dec 5 15:01:51 PST 2003 316284 >
<Feb 13, 2008 1:34:09 PM EST> <Notice> <Management> <BEA-140005> <Loading domain
configuration from configuration repository at C:\bea\user_projects\domains\New
FuelPricingDomain\.\config.xml.>
<Feb 13, 2008 1:34:12 PM EST> <Notice> <Log Management> <BEA-170019> <The server
log file C:\bea\user_projects\domains\NewFuelPricingDomain\myserver\myserver.lo
g is opened. All server side log events will be written to this file.>
The WebLogic Server did not start up properly.
java.lang.ExceptionInInitializerError
at com.sun.identity.agents.weblogic.AmAuthProvider.getRealmInstance(Unkn
own Source)
at com.sun.identity.agents.weblogic.AmAuthProvider.initialize(Unknown So
urce)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.createSe
curityProvider(SecurityServiceManagerDelegateImpl.java:241)
at weblogic.security.service.SecurityServiceManager.createSecurityProvid
er(SecurityServiceManager.java:929)
at weblogic.security.service.PrincipalAuthenticator.initialize(Principal
Authenticator.java:151)
at weblogic.security.service.PrincipalAuthenticator.<init>(PrincipalAuth
enticator.java:257)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.doATN(Se
curityServiceManagerDelegateImpl.java:580)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.initiali
zeRealm(SecurityServiceManagerDelegateImpl.java:419)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.loadReal
m(SecurityServiceManagerDelegateImpl.java:697)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.initiali
zeRealms(SecurityServiceManagerDelegateImpl.java:730)
at weblogic.security.service.SecurityServiceManagerDelegateImpl.initiali
ze(SecurityServiceManagerDelegateImpl.java:873)
at weblogic.security.service.SecurityServiceManager.initialize(SecurityS
erviceManager.java:719)
at weblogic.t3.srvr.T3Srvr.initializeHere(T3Srvr.java:820)
at weblogic.t3.srvr.T3Srvr.initialize(T3Srvr.java:664)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:342)
at weblogic.Server.main(Server.java:32)
Caused by: java.lang.RuntimeException: Exception caught in AmRealmManager initia
lizer: AmRealm: Unable to create store connection
at com.sun.identity.agents.realm.AmRealmManager.<clinit>(Unknown Source)
... 16 more
Please help me to resolve this problem.
Any help will be highly appreciated. -
Authentication to agent workstation failed when trying to run a test in Oracle Test Manager
I have the complete version of OATS installed on my local machine. I have the OracleATSHelper, OracleATSServer and OracleATSAgent services running.
In OTM when I go to run an openscript test I select the system, type the version number and hit run and get a "Authentication to agent workstation failed" error in the summary field.
It worked before but I cant figure out why it isnt working anymore.
Can anyone help?ATS Version: 12.3.0.1.0 build 376
I am getting the same error when trying to execute a script from OTM - "Authentication to agent workstation failed".
I have the OTM server on a remote (server) machine and the Oracle Agent is running on my laptop / workstation. I've tried all I have seen on this thread, but no progress. The manager is now in manual mode and the console only provides the following output:
D:\OracleATS\agentmanager\bin>d:\OracleATS\agentmanager\bin\AgentManagerService.exe -c AgentManagerService.conf
wrapper | --> Wrapper Started as Console
wrapper | Launching a JVM...
jvm 1 | Wrapper (Version 3.0.3)
jvm 1 |
One different thing, maybe, I see is that the agentmanager_auth.log is empty always.
Also, on the server, I've added this SYSTEM successfully, i.e.the Testing of the SYSTEM added in OTM always gives the success message "The system specified can be successfully accessed by the Oracle Test Manager server." . In fact it does this even when I provide an incorrect password! -
Policy agent error code 21 after authenticating
Hi,
I get the following error in my amAgent logs after successfully authenticating to Sun Policy Manager 7.1:
PolicyEngine: am_policy_evaluate: InternalException in AuthService::submitRequirements() with error message:Error sending client submitted requirements to server. and code:21
A 500 Internal Server Error page is returned with the message: This server has encountered an internal error which prevents it from fulfilling your request. The most likely cause is a misconfiguration. Please ask the administrator to look for messages in the server's error log.
The Policy Manager auth access log shows: "Login Success" for the login attempt.
My configuration:
Solaris 10
Apache 2.0.54
Sun Java System Access Manager Policy Agent 2.2
Has anyone seen or experienced this error before?
Thanks
Edited by: tutro on Aug 7, 2008 7:31 AMA control character was being read from the password (even though both the encrypted and unencrypted password did not contain any control characters). A password reset resolved the issue.
-
Reverse Proxy + Policy Agent generates unwanted Basic Authentication
We have a policy agent installed on the SJWS 7.0u1. It's configured as a reverse proxy to a server running on another port on the same machine as the web server. The policy agent catches the request and redirects to the access manager, which authenticates fine. The access manager then redirects back to the web server, which then issues presents the basic authentication dialog. (We did not configure it for basic authentication).
In a previous post I was directed to check my DNS entries. Both servers can resolve each other without problem. I can type nslookup server.practicegreenhealth.org, nslookup server (these are the web server addresses) and they both resolve to the correct ip. I can type nslookup access.practicegreenhealth.org and nslookup access and they both resolve to the correct IP.
I had the application deployed as a JRuby application within the SJWS's servlet container and the setup worked fine. I switched back to using SJWS as a reverse proxy to application running as its own instance and am now presented with the basic auth dialog. I can hit the application fine both from the box it's running on and if I disable the policy agent. It's just the combination of the reverse proxy configuration + the policy agent that doesn't seem to work.
Edited by: phoehne on Jun 23, 2008 12:40 PMwhat does the server error log say ? you might want to increase the log level to finest (config/server.xml change info to finest) and restart and look at the server error logs. this could provide us some insight on what is happening. most likely some config parameters in obj.conf need to be fine tuned.
-
Policy Agent + Distributed Authentication UI?
Can I deploy the distAuth application inside a policy agent protected container, or does it have to be deployed in a non-protected container?
Thanks,
Michael.Thanks, that's exactly the answer I was looking for. I was trying to deploy on a J2EE container, and while I'm interested in the workarounds, it's probably simpler for me to just deploy another container instance.
-
Event ID 32014, source:LS Application Server
The application threw an exception while starting.
The application urn:application:testbot threw the following exception when starting: Exception: Microsoft.Rtc.Collaboration.ProvisioningFailureException
> FailureReason: ApplicationNotFound
> DetectionStackTrace: at System.Environment.GetStackTrace(Exception e, Boolean needFileInfo)
at System.Environment.get_StackTrace()
at Microsoft.Rtc.Collaboration.ProvisioningFailureException..ctor(String message, Exception innerException, ProvisioningFailureReason failureReason)
at Microsoft.Rtc.Collaboration.PlatformDataImpl.CreateInstance(String requiredCertificateUsage, UCSettings ucSettings, String applicationId, Boolean enableCMSLoadBalancing, Boolean useLocalRegistrar)
at Microsoft.Rtc.Collaboration.ProvisioningSourceImpl.GetInitialPlatformData()
at Microsoft.Rtc.Collaboration.ProvisioningSourceGetInitialPlatformDataAsyncResult.ProcessCoreHelper()
at Microsoft.Rtc.Collaboration.SipCollaborationAsyncResult.ProcessCore()
at Microsoft.Rtc.Signaling.AsyncWorkitemQueue.ProcessItems()
at Microsoft.Rtc.Signaling.SerializationQueue`1.ResumeProcessing()
at Microsoft.Rtc.Signaling.SerializationQueue`1.ResumeProcessingCallback(Object state)
at Microsoft.Rtc.Signaling.QueueWorkItemState.ExecuteWrappedMethod(WaitCallback method, Object state)
at System.Threading.ExecutionContext.RunInternal(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.ExecutionContext.Run(ExecutionContext executionContext, ContextCallback callback, Object state, Boolean preserveSyncCtx)
at System.Threading.QueueUserWorkItemCallback.System.Threading.IThreadPoolWorkItem.ExecuteWorkItem()
at System.Threading.ThreadPoolWorkQueue.Dispatch()
> Message: Application with id(urn:application:testbot) not found or a default port has not been configured for it.
> TargetSite: Exception: Exception has been thrown by the target of an invocation.
> StackTrace: at Microsoft.Rtc.Internal.ServerSharedComponents.MachApplication.StartUp()
at Microsoft.Rtc.Internal.ServerSharedComponents.ServiceManager.Startup()
at Microsoft.Rtc.Internal.ServerSharedComponents.UCAS.MachUcasService.StartAsync()
at Microsoft.Rtc.ApplicationServerCore.ApplicationLoader.CallStartAsync()
> Source: Microsoft.Rtc.Collaboration
> HResult: -2146233088
Cause: Startup errors.
Resolution:
Check the events prior to this to resolve the service startup issue.Event ID: 29004 Source: LS Bandwidth Policy Service (Authentication)
Error while trying to access local Settings. The LS Bandwidth Policy Service (Authentication) will stop.
Exception: System.Exception: MRAS port is not configured!
at Microsoft.Rtc.MRAS.Configuration..ctor(ConfigChangedHandler ConfigChangedEventHandler, RoleName roleName)
Cause: The current account may not have the necessary permissions to access these settings, or the LS Bandwidth Policy Service may not be installed correctly, or the settings are wrong.
Resolution:
Rerun LS Bandwidth Policy Service (Authentication) installation and activation.
Event ID: 29005 Source: LS Bandwidth Policy Service (Authentication)
LS Bandwidth Policy Service (Authentication) could not be started.
Exception: System.Exception: MRAS port is not configured!
at Microsoft.Rtc.MRAS.Configuration..ctor(ConfigChangedHandler ConfigChangedEventHandler, RoleName roleName)
at Microsoft.Rtc.MRAS.Core..ctor(ServiceStopHandler serviceStop, RoleName roleName)
at Microsoft.Rtc.MRAS.Server.OnStart(RoleName roleName)
Cause: Internal error.
Resolution:
Examine the details in the associated event log entry to determine the potential cause and report to Product Support Services. -
Problem Installing Policy Agent 2.2 on Apache 2.2.3
Hi all,
I'm trying to configure policy agent 2.2 on apache 2.2.3 on linux platform CentOS (red hat 5.1).
The configuration and the installation seem to work properly, in effect in the log file install.log you can find :
[06/10/2008 16:38:49:865 CEST] Creating directory layout and configuring Agent file for Agent_001 instance ...SUCCESSFUL.
[06/10/2008 16:38:49:936 CEST] Reading data from file /opt/web_agents/apache22_agent/passwordFile and encrypting it ...SUCCESSFUL.
[06/10/2008 16:38:49:937 CEST] Generating audit log file name ...SUCCESSFUL.
[06/10/2008 16:38:50:022 CEST] Creating tag swapped AMAgent.properties file for instance Agent_001 ...SUCCESSFUL.
[06/10/2008 16:38:50:026 CEST] Creating a backup for file /etc/httpd/conf/httpd.conf ...SUCCESSFUL.
[06/10/2008 16:38:50:031 CEST] Adding Agent parameters to /opt/web_agents/apache22_agent/Agent_001/config/dsame.conf file ...SUCCESSFUL.
[06/10/2008 16:38:50:032 CEST] Adding Agent parameters to /etc/httpd/conf/httpd.conf file ...SUCCESSFUL.
But, when I try to restart Apache it gives me an error and in the error.log file in Apache you can read:
[Tue Jun 10 16:57:33 2008] [notice] suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Tue Jun 10 16:57:34 2008] [notice] Digest: generating secret for digest authentication ...
[Tue Jun 10 16:57:34 2008] [notice] Digest: done
[Tue Jun 10 16:57:34 2008] [alert] Policy web agent configuration failed: NSPR error
Configuration Failed
Well, I found in the Sun documentation a well known bug about the NSPR and NSS library :
Error message issued during installation of Policy Agent 2.2 on Linux systems
When the Linux operating system is installed, specific components can be selected. Occasionally the specific components of the operating system selected lack the libraries necessary for Policy Agent 2.2 to function. When the complete Linux operating system is installed, all the required libraries are available. The libraries that are required for the agent to function are as follows: NSPR, NSS, and libxml2.
Workaround: If the Linux operating system you are using is not complete, install the latest versions of these libraries as described in the steps that follow:
At the time this note was added, the latest version of the NSPR library packages was NSPR 4.6.x , while the latest version of the NSS library package was NSS 3.11.x.
To Install Missing Libraries for Policy Agent 2.2 on Linux Systems
*+
Install the NSS, and libxml2 libraries. These libraries are usually available as part of Linux installation media. NSPR and NSS are available as part of Mozilla binaries/development packages. You can also check the following sites:
o
NSPR: http://www.mozilla.org/projects/nspr/
o
NSS: http://www.mozilla.org/projects/security/pki/nss/
So, I checked my libraries but they are upgraded to the latest version.
If I comment the line that includes the libamapc22.so in the apache configuration file
LoadModule dsame_module /opt/web_agents/apache22_agent/lib/libamapc22.so
Apache can restart but the agent is misconfigurated!
Any Idea?thank you Subhodeep for your reply,
I didn't try to change the library file and I didn't find in licterature any information about library file changing in the Policy agent installation. Please, could you suggest me something more about which library to use instead of libamapc22.so?
ps. I am using red hat 5.1, and from the release note of the policy agent seems that the latest platform version supported is red hat enterprise linux 4.0 versions.....
this one could definitely be the reason of the misconfiguration. -
Version:
Solaris: 8
IS 6.0
Policy Agent 2.0
Webserver: iWS 6.0
I installed the agent, configured a policy protecting the resources on the webserver. When I access any resource, it throws me a login page (as it should). Once I submit the credentials, I get a 403 error on the page. The agent logs show the following:
2003-01-30 13:38:23.168 Error 4355:42b508 PolicyEngine: am_policy_evaluate: InternalException in Service::construct_auth_svc with error message:Application authentication failed during service creation. and code:20
2003-01-30 13:38:23.168 Warning 4355:42b508 PolicyAgent: am_web_is_access_allowed(http://server.sub.com:8081/index.html, GET) denying access: status = access denied (20)
2003-01-30 13:38:23.169 -1 4355:42b508 PolicyAgent: validate_session_policy() access denied to unknown user
At the same time I can see the user session active under the IS console.
Can somebody help me here?
Thanksahhh, what shared secret did you use to install. You should of used the amldapuser account password rather than amadmin
Use the cryptutil to hash that password and stick it in the AMAgent file. Restart and all will be well.
Steve
Maybe you are looking for
-
Can I stream visual to my TV using apple TV and sound to wifi speakers at the same time. This is easy for itunes, but for browser stuff like iplayer can this be done?
-
Unable to install Tiger on a Mini
I bought a refurbished Mac Mini from Apple last week, and it came with OS X 10.3.7 installed. It also came with a 2 CD set that has Tiger on it. When I boot from the Tiger CD, I get an error that says that this software cannot be installed on this co
-
Hi experts, We are looking to synchronize projects and wbs (PS) from a specific environment to another one. We thought that using IDOC would be a good idea ; We found a message type called PROJECT and associated BAPI WorkBreakdownStruct. After custo
-
I want to zoom in on my home page, and keep it zoomed in when I reopen Firefox. What do I need to do?
-
can anybody solve this as i uninstalled 9.0 installed 7.0 but windows 7 wont support that old version. and no im not going back to xp