Unable to use SSL between Access Manager and Directory Server

I am trying to set up Access Manager to use SSL when communicating with Directory Server. Access Manager 7 is running under Sun Web Server 6.1. I have configured Directory Server to use SSL using a Self-Signed CA and have imported the CA certificate into the certificate database for Web Server. When I change the Access Manager configuration as specified in the Admin Guide to use SSL and restart the Web Server, Access Manager fails with the message
(among many others)
netscape.ldap.LDAPException: SSL connection to
eauth1.arc.nasa.gov:636, SSL_ForceHandshake failed: (-8157) Certificate extension not found. (91); Cannot
connect to the LDAP server
I am able to connect to the Directory Server instanc with JXplorer using SSL (with a complaint about an unknown CA). Can someone explain the error message so that I can fix the problem or work around it?
Thanks

in the initial part of AMConfig.properties, you'll find an entry similar to trustSSLCerts . This, by default, is set to false. Trying setting it to true (AM web server instance will need a restart). This lets AM continue with SSL handshaking inspite of errors. Am not sure if this affects AM to DS connectivity as well. It sure affects AM to AM communication (in a multiple server configuration).
Naturally, it is not recommended that you use this feature when you are ready for production, but atleast it'll let you be sure that apart from the cert issue, everything else is okay.
Hope this helps.

Similar Messages

Setting up Access Manager and Directory Server for Failover.

I'm setting up 2 Access Managers AM1,AM2 and 2 Directory Servers DS1 and DS2 for failover. I've connected AM1 and AM2 to DS1. Suffixes of DS1 is replicated to DS2. Any change made to AM1 is replicated to AM2 as expected. I just patched AM1 with Access Manager patch 1 and the version information for AM1 shows 7.1 126359-01. I followed the same procedure to patch AM2 but AM2 still shows ver 7.1.
How do I make sure both Access Managers are patched to the same version?
I'm able to authenticate to one IIS6 site and authentication is passed on to Outlook Web Access on AM1 but when I shut down AM1 to test failover to AM2 OWA prompts me again for password. How do I resolve this?
On AM1 http://host.domain/amserver/UI/Login?realm=sso successfully logs in but the same on AM2 gives Warning that "You have already logged in. Do you want to log out and then login to a different organization?"
Please help !!!

I'll answer what bits I can:
Q: AM showing the same version?
A: No idea on this one. I would have expected the operation you described to have produced the right answer. Check that neither your application server nor your web browser are caching old pages (ctrl-F5 in my browser)
Q: How do I resolve re-authentication on failover?
A: The AM documentation includes a deployment example that covers pretty closely what it is you are trying to achieve:
http://docs.sun.com/app/docs/doc/820-2278
Specifically, the problem you are describing is related to session failover. The sessions are stored in a local DB so when you failover the backup server does not store the same information and hence requires a reauthentication. The section of the above doc that deals with this is here:
http://docs.sun.com/app/docs/doc/820-2278/gdsre?l=en&a=view
Q: "You have already logged in" warning
A: No idea. Sorry.
R

Installing Access Manager and Directory Server

Can I install the Access Manager 2005Q4 without installing the directory server?
The products selected for installation have dependency requirements or installation options as indicated below.
Sun Java(TM) System Directory Server 5 2005Q4
------------------------------------------------------------------------

Everytime I click the Access Manager in the JES 2005Q4installer the directory server would click itself. Unchecking this prompted me for a remote repository which worked.
I wasn't able to get the install to complete with the state file, it stopped before configuring access manager.

Lost connection between ovm-manager and ovm-server (ovm 3.1)

Hi,
I have a manager as a VM on my laptop and a physical server as an ovm-server. Everything is fine when i boot the server but after some time, the manager stop to show the information from the server. in the ovs-agent log file the following messages are repeated regulary
[2013-08-29 13:06:19 6160] DEBUG (notification:289) Trying to connect to manager.
[2013-08-29 13:06:20 6160] DEBUG (notification:291) Connected to manager.
[2013-08-29 13:06:20 6160] ERROR (notification:316) No manager Core API server object for 10:60:4b:88:bc:24:10:60:4b:88:bc:25:fe:ff:ff:ff.
[2013-08-29 13:06:34 6171] ERROR (notification:64) Unable to send notification: (111, 'Connection refused')
I did not reboot neither the server nor the manager. No IP change. Rebooting the manager has no effect.
The only way to restore communication is to restart the ovs-agent on the server, but this restart disable the network card. I must be physical on the server to restart the network.
any help will be very helpful
best regards
Jean-Marc

Hi,
The are many steps to verify:
Verify with your firewall on the Oracle VM Manager system (service iptables stop).
Verify with a ping between OVM Manager and OVM Server using the IP Address and using the hostname for each one (from OVM Manager : ping ovm-server ; and from OVM Server: ping ovm-manager).
I hope this can help you
Best Regards

Differ between import manager and import server

Hi to all,
Can any one explain difference between import server and import manager and how the data will be imported to the same.
Regards
MM

Hi reddy,
Can any one explain difference between import server and import manager and how the data will be imported to the same
Please follow the text below, which has been taken from the help.sap.com
Both MDIS and the MDM Import Manager can import data from a source file into an MDM repository. However, each has unique capabilities that distinguish it from the other. When each is used to its advantage, the result is an import strategy which provides the most efficient importing of data possible.
The strength of the Import Manager is its connection to the source data, which enables its interactive map-making capabilities. When the Import Manager connects to a source it preloads the entire source file, giving it knowledge of every field and every value in the source data. This u201Ctotal awarenessu201D is crucial for preparing a complete import map. To help ensure a map is complete, the Import Manageru2019s Import Status tab alerts users to any discrepancies between source data values and the current map. The user can fix these problems interactively within the Import Manager and save the corrected map before any data is imported.
Preloading an entire source file comes at a price, however. It consumes memory on the computer running the Import Manager and very large source files may exhaust the computeru2019s available memory.
By contrast, MDISu2019s strengths are its scalability and automation.
For scalability, instead of preloading the entire source file into the host machineu2019s memory as the Import Manager does, MDIS processes records in a stream by loading a record at a time into memory.
This streaming technique enables MDIS to process much larger source files than the Import Manager, as the demand for memory on the host machine is not affected by the size of the import file.
In addition to file size, file quantity poses a second scalability challenge. For example, a real-time transactional environment may produce a staggering number of files, each containing only one or two records. To import these files individually through Import Manager would be extremely inefficient. MDIS tackles this problem with a file aggregation feature that processes files systematically in batches rather than as individual files, resulting in faster, more efficient import of data.
As it relates to automation, MDIS requires no user intervention to import files to an MDM repository. Instead, it relies on maps created previously within the Import Manager. Once an import file is placed in the appropriate folder, its data is imported automatically into the MDM repository using the rules of the pre-defined import map. Once a file is processed, MDIS scans the repository for the next file to import. This process continues 24 hours a day, seven days a week, until either MDIS or MDM Server are stopped.
The trade-off for this scalability and automation is that if discrepancies between the source data and the import map arise, MDIS cannot u201Cfixu201D these problems by itself. Instead, the u201Cproblem casesu201D can be fixed manually at a later time using the interactive capabilities of the Import Manager. Unlike the Import Manager, however, MDIS can set aside problem records or files and continue importing.
These conceptual and operational differences between the Import Manager and MDIS are summarized in the table below.
Item
Import Manager
MDIS
Source file location
Anywhere
Automatic inbound port
Import process
Interactive
Automatic
Import map state
Editable
Read-only
Object loaded in memory
Entire import file
Individual records
Streaming import support
No
Yes
File aggregation support
No
Yes
Maximum import file size
Limited (50,000 records)
Unlimited
Status location
Import Status Tab
MDM Console/Report file
Error correction prior to import
Yes
No
Exception handling during import
No
Yes
For additional info, kindly refer the link below:
http://help.sap.com/saphelp_mdm550/helpdata/en/43/12036df94c3e92e10000000a1553f6/frameset.htm
GO to-> MDM import Server
Hope it helps.
Thanks and Regards
Nitin Jain

I am unable to use airdrop between my 6 plus and MacBook Pro (13-inch, Late 2011) running yosemite.any solutions? thank you

i am unable to use airdrop between my 6 plus and MacBook Pro (13-inch, Late 2011) running yosemite.any solutions? thank you

There aren’t any. AirDrop between the platforms requires that the Mac support Bluetooth 4.0, which wasn’t introduced to them until the 2012 models.
(118296)

I recently converted from my Blackberry Torch to the Z10. I travel a lot and use the VZ Access manager through my Torch. Can I do the same thing through my new Z10? I don't see that as an option on the software sight.

I recently converted from my Blackberry Torch to the Z10. I travel a lot and use the VZ Access manager through my Torch. Can I do the same thing through my new Z10? I don't see that as an option on the software sight.

Hi Atepastt,
Congrats on your new Z10! I know having the right features is important. The Z10 uses Blackberry link software. The device uses the mobile hotspot feature to non-cord tether the device. The mobile hotspot feature is an additional cost. You can add this feature online http://vz.to/1di2TlT .
Thanks,
PamelaF_VZW
Tweet us @vzwsupport

Difference between Identity Manager and Access Manager

hi,
Can any body tell me the difference between Identity manager and Access Manager.
thanks in advance
regards
dhawanmayur

Access Manager is for access control (web authentication, authorization), Identity Manager is for identity (userid,profile,role, password etc) provision/management across multi resources (such as unix, active directory, peoplesoft, SAP) etc.

Plse...help me on the communicating between CLEAN ACCESS MANAGER and Switch 3560E-24Ps by snmp

Dear All,
I try to configure in both Clean Access Manager and Switch 3560E-24Ps on SNMP Version 2 protocol but I can't make it working together (For CAM and Switch 3560G-48Ps I can do that). Plse give me any suggestion to solve that problem. All configuration is as below:

http://www.cisco.com/en/US/docs/security/nac/appliance/configuration_guide/412/cam/412_cam_book.html

Integration between Soluiotn Manager and HP Quality Center

Hi Folks,
I am currently configuring the integration between Solution Manager and HP Quality Center, and during the set up of communication user, I get the following error:
User hpqc_comm is not authorized to access projects
Message no. QC_INTEGRATION016
Diagnosis
You want to access projects in the Quality Center with the communication user hpqc_comm. This causes an error because the user either does not exist in the Quality Center or is not assigned to any project.
Procedure
Check whether the user hpqc_comm is in the Quality Center, and whether it is assigned to at least one project. Ask the Quality Center administrator to create the user and assign it to projects, if necessary.
You can use another user for the communication
Well, I have created that user in HPQC and assigned it to projects.
Thanks for your help
Marco

the error is in Solution Manager. I am defining the communication parameters in SOLAR_PROJECT_ADMIN / <selected project> / edit / Connection to HP Quality Center. I choose the corresponding project in Quality Center, but when I validate the screen, I get the error I mentioned before, even though the communication user exists in HPQC and is assigned to that specific project.
Thanks for your reply.
Marco

Network Access Manager and WiFi

I have a computer that is a member of a domain. The computer has Network Access Manager and Cisco Secure Mobility Client VPN modules loaded. I have the computer setup to authenticate to the network before it connects to the domain. This is working fine.
When a user brings their computer home, they are unable to connect to their wireless network. I tried adding some wifi authentication in Network Access Manager, but that did not fix the issue. I am still going to do some reading up on this issue, but I was hoping that somebody could give me some input if they have any experience?
I need for people to be able to authenticate to the network when they are at work, and VPN when they are at home.
Thanks,
Alex Pfeil

You mean you have start before feature (SBL) enabled and its working fine as long as you're at work. I guess I have seen this before.
What I read in an internal enhancement request that Cisco AnyConnect 3.0 Start Before Logon (SBL) does not work with user created personal networks. NAM establishes connections with user created network profiles only after user logon, and consequently there will be no network connectivity at the time Start Before Logon executes.
What version of NAM are you using?
Jatin Katyal
- Do rate helpful posts -

The Question about stock transfer between HU-Management and WM-Management

Hi,
There is a scenario about stock transfer between HU-Management and WM-Management storage location. I use transaction MB1B , movement type 313 , 315. After Good issue from WM-management storage location, outbound delivery will genarated, then Pack, Create/Confirm TO, at last post goods issue for the outboud delivery. But when i do movement type 315, there is a warning message "Data of preceding document was not transmitted", and from the F1 help i find this system reponse "You can maintain an indicator that makes information about preceding documents in this delivery available under delivery type in Customizing. For some characteristics of this indicator, the type of preceding document and the related document and item numbers must be transmitted to delivery creation. At least one of these parameters is missing.".
So, My questions are:
1. Generallily, Outbound delivery is created by SO, inbound delivery is created referenc PO, but how the stock transfer for 2 steps generate the outbould delivery and inbound delivery? Could you pls tell me the where i can config this in the IMG?
2. What's "Data of preceding document was not transmitted" mean ? how to fix this issue ?
Best Regards
Boxer Du
I am the SAP fans, focus on MM and WM. I am interesting TRM Yard Management and Cross Docking now.Very Gladly to talk you about these areas. I want to exchange the knowledge with you, and want to be a good friend of you. Pls contact me. You can find My MSN in the profile. Thanks.

Hi,
Sure, The inbound delivery type is set up in the IMG->Logistics General -> HU management -> Basics ->Delivery type -> Delivery type determination.
For Inbound delivery type 'HID' is maintained in this view.
Best Regards.
Some One want to discuss the details , can contact me. Thanks.

Difference between remote management and vnc

Difference between remote management and vnc

By VNC I will presume you mean 'Screen Sharing'.
Screen Sharing in System Preferences - Sharing is purely for remote control and is based on the VNC protocol with a few extra features added by Apple.
Remote Management in System Preferences does everything Screen Sharing does and is fully compatible with another Mac doing just Screen Sharing, i.e. it allows remote control. However it can also do additional things. It is intended for use with Apple's Remote Desktop Administration software which can use this to send files to a Mac, send (Unix) commands to a Mac and ask for a report from the Mac (e.g. how much RAM it has).
If you don't have Apple Remote Desktop there is no real point enabling Remote Management instead of Screen Sharing.
Both Screen Sharing and Remote Management can also be configured to allow 100% standard VNC connectivity from say a PC, as standard they only accept connections from Macs.

Difference between Time Management and Time Evaluation

Hello
Is there any Difference between Time Management and Time Evaluation? if yes, then what is it? I guess there's no diff, time evaluation is a report..
please advice
Thanks

Hi Charlene,
Time management can be divided into 3 steps
1.Time Recording
2.Time Evaluation
3. Planning
Time Evaluation :
The recorded time data is grouped and converted to wage types which can be used by payroll for compensation.SAP provides a time evaluation program RPTIME00 for this purpose.
Standard schemas TM00 and TM04 are used for evaluation of time data got from positive and negative time recording approaches.
time evaluation program RPTIME00 also calculates accrual and entitlement for employees.
Regards,
Swapnil

Using IBM Tivoli Access Manager to Secure Tuxedo Services

Wondering if anybody has any experience using 'IBM Tivoli Access Manager for e-business' to perform tuxedo service authorization ?
Is there an out-of-the-box integrated solution available or does one have to basically build a security service that use the Tivoli Access Manager APIs to determine if the user is authorized to invoke service?
Thanks,

Hi,
I followed the steps of establishing SSO using TAM for OBIEE application.
Below is the piece of code that i had inserted in the "instanceconfig.xml" to enable SSO:
<Listener>

</Listener>
<CredentialStore>
<CredentialStorage type="file" path="<OracleBIData>/web/config/credentialstore.xml" passphrase="another"/> </CredentialStore>

<Auth>
<SSO enabled="true">
<ParamList>

<Param name="IMPERSONATE"
source="httpHeader" nameInSource="iv-user"/>
</ParamList> 
<LogonUrl>http://pkmslogin</LogonUrl>
<LogoffUrl>http://pkmslogout</LogoffUrl>
</SSO>
</Auth>
My credential store file look Like on below
<sawcs:credential type="usernamePassword" alias="impersonation">
<sawcs:username>USER</sawcs:username>
<sawcs:password>password</sawcs:password>
</sawcs:credential>
In the above code i am trying to get the userID of a User through the header of the application's URL, who has been already been authenticated by Windows desktop Authentication mechanism .
but then i try creating a junction using TAM and access the application through the junction i still get the logon page of OBIEE application...
Can any one help me out in this issue..
Thanks in Advance...

Unable to use SSL between Access Manager and Directory Server

Similar Messages

Maybe you are looking for