ERROR: Invalid Agent: Could not get agent for the realm

Sometimes, when CDSSO is configured, one will encounter HTTP Status 500 after a successful login.

1. Access protected application 

2. Redirect to OpenSSO Login Page

3. Upon successful login, redirect back to protected application

Step 3 is not happening. Instead, user encounters HTTP Status 500.

If you take a look at the amAgent log on the protected application side, there is nothing unusual. All seems good. 

Something is definitely wrong on the OpenSSO server end. 

The problem is "Unknown Host Exception".  Add the FQDN to the /etc/hosts resolves the issue!

.

OpenAM 9.5.2 CLI Configuration

I was trying to install a new install of OpenAM 9.5.2 for a POC using the GUI Configurator. (Read here)

The problem then was the embedded OpenDS 2.3 will always create a Administrator Connector Self-Signed Certificate using the hostname. If this hostname is not defined in /etc/hosts, configuration will bomb.

ERROR: AMSetupServlet.configure: error
org.opends.server.types.InitializationException: The administration connector self-signed certificate cannot be generated because the following error occurred: openam: openam
at org.opends.server.admin.AdministrationConnector.handleCertifExceptions(AdministrationConnector.java:776)
at org.opends.server.admin.AdministrationConnector.createSelfSignedCertifIfNeeded(AdministrationConnector.java:757)
at org.opends.server.admin.AdministrationConnector.initializeAdministrationConnector(AdministrationConnector.java:181)


Today, I tried to find out whether or not this can be workaround by using CLI configuration.


SERVER_URL=http://openam.sg.azlabs:9080
DEPLOYMENT_URI=/openam71
BASE_DIR=/home/openam952/openam71
locale=en_US
PLATFORM_LOCALE=en_US
AM_ENC_KEY=wKO7mExvCqVXETTtsgU4HgtvqBXrFzSW
ADMIN_PWD=password
AMLDAPUSERPASSWD=amldapuser
COOKIE_DOMAIN=.sg.azlabs


DATA_STORE=embedded
DIRECTORY_SSL=SIMPLE
DIRECTORY_SERVER=openam.sg.azlabs
DIRECTORY_PORT=51389
DIRECTORY_ADMIN_PORT=8888
DIRECTORY_JMX_PORT=1689
ROOT_SUFFIX=dc=opensso,dc=java,dc=net
DS_DIRMGRDN=cn=Directory Manager
DS_DIRMGRPASSWD=password


## Leave (blank) will default to embedded DATA_STORE
USERSTORE_TYPE=


No use.

The OpenDS is still trying to create the Administrator Connector Self-Signed Certificate using the hostname.

By the way, in OpenAM 9.5.2, with the upgrade of OpenDS from 1.x to 2.3, the following 2 attribute-value pairs are required:

DIRECTORY_ADMIN_PORT=8888

DIRECTORY_JMX_PORT=1689

Quite a painful experience as the documentation wasn't there. I had to read the source code and trace what was required by the configurator.

For those interested, I was looking at the method runOpenDSSetup (...) in EmbeddedOpenDS.java

setupCmd[2] = (String) map.get(SetupConstants.CONFIG_VAR_DIRECTORY_ADMIN_SERVER_PORT);
setupCmd[4] = (String) map.get(SetupConstants.CONFIG_VAR_ROOT_SUFFIX);
setupCmd[6] = (String) map.get(SetupConstants.CONFIG_VAR_DS_MGR_DN);
setupCmd[8] = (String) map.get(SetupConstants.CONFIG_VAR_DIRECTORY_SERVER_PORT);
setupCmd[13] = (String) map.get(SetupConstants.CONFIG_VAR_DIRECTORY_JMX_SERVER_PORT);


Then I went to SetupConstants.java to find out what attribute names are required:

/**
* Configuration Variable for directory server admin port.
*/
String CONFIG_VAR_DIRECTORY_ADMIN_SERVER_PORT = "DIRECTORY_ADMIN_PORT";


/**
* Configuration Variable for directory server jmx port.
*/
String CONFIG_VAR_DIRECTORY_JMX_SERVER_PORT = "DIRECTORY_JMX_PORT";




.

Policy Configuration in OpenSSO 8.0 U2 Patch 1 still not working

This is a follow up to my post in Feb. I was trying to configure my authentication sources in a failover/load-balanced manner. It was not successful in OpenSSO 8.0 U2, but that was fine since I wrote my own authentication module. Thus was able to fix the bug within my own module.

However, there is another section in OpenSSO which we need to configure the same way - Policy Configuration. We have since upgraded to OpenSSO 8.0 U2 Patch 1. However, the same bug exist.

As long as the format is "local server name|host name:port", the OpenSSO server will get confused and will not parse the string properly.

What's the workaround?

The best we can do is to configure OpenSSO in a load-balanced manner (point to localhost). Failover is not possible in this configuration.


.

OpenSSO 8.0 U2 Patch 2 available

OpenSSO 8.0 U2 Patch 2 has just been released on 12th March 2011. That's a pretty fast release since the last patch release (U2 Patch 1) was just in Jan 2011.

(from 141655-06) U2 Patch 2
Problem Description:
7002787 OpenSSO 8.0 u2 & u2p1 not working with Active Directory DataStore
6987837 OpenSSO8U1P3 - SystemTimerPool - Throws ArrayIndexOutOfBoundsException message regularily
7006491 ERROR: "Not a supported type: FILTEREDROLE" following opensso upgrade when assigning privileges
6994715 OpenSSO update 1 patch 3 oracle db logging error: ORA-01704: String Literal Too Long
7000981 Upgrading Am 7.1 patch3 deployment as a site to OpenSSO 8 U1 patch3 Servers and sites tab dissapear
7005627 Opensso8.0U1P3-sfo enabled attribute in the Secondary instance was missing
6993122 SPNameQualifier element should be removed from NameIDPolicy in SAML AuthnRequest
6935201 OpenSSO U1P3: DAUI sends errors after user reloads DAUI login url thrice
6677966 HttpServletRequest/HttpServletResponse not available in AMLoginModule when using Dist AuthUI
6982882 Browser goes into loop condition for an OpenSSO login when a policy requires realm authentication
6982149 OpenSSO - Null Pointer Exception during session upgrade
6979889 8.0u2 patch 1: Update version of jss4.jar in opensso
6996134 OpenSSO Authentication allows access to users to a Realm to which Users who do not belong to
6986916 problem with AM 7.1 patch 4 DAUI
6992299 problem with AM 7.1 patch 4
6982233 Migrate AM7.0p11 to OpenSSO 8.0u2: legacy agent profiles are still not shown on the console properly
7003167 CDCClientServlet regression with bugfix 6896456 using distauth
7007659 ssopreupgrade.bat stop in initialize with Can't find bundle for name ssoUpgrade
7012182 URI is considered as URL in the goto parameter when it is URL-encoded
7018596 AM 7.1 patch3 to OpenSSO 8.0 update2 upgrade displays configuration page post upgrade
7019578 After Upgrade from AM7.1p3 to OpenSSO 8.0:"Server error" while hitting "platform" button on admin console
7016248 problem with Accessmanager


The Jan release (U2 Patch 1) was a major for us in the project I am currently in for the local Education ministry.

There was a bug in the SJSWS 7 Policy Agent which happily redirecting a POST request as a GET request. This broke our single sign-on integration with Sun IdM. In this particular case, the Forget Password Wizard broke.

We tested U2 Patch 1 and the bug was resolved. What was fixed? I do not know since it's a closed source now.


.

The administration connector self-signed certificate cannot be generated

I was trying to setup OpenAM on a new VM for POC. 

In customer environment, the trend these days is to move away from Solaris OS (which I am very familiar with for the past 7 years) and to adopt Linux as much as possible. Nothing wrong with the OS, just that the physical boxes have got more and more expensive. 

So for this new VM, I have CentOS 5.5 installed (since most customers will be installing RHEL). 

It shouldn't be too difficult to install, I thought. I was wrong! I kept getting the following error:

The administration connector self-signed certificate cannot be generated because the following error occurred: openam: openam. 

I checked the Network Configuration and found that I have a matching Hostname: openam.

In the end, I found out that I need a matching entry in /etc/hosts.

The last entry "openam" is required.

Very strange! How come in "Configuration Store Details", the Host Name is "localhost" and is non-editable? How does that "localhost" get mapped to "openam"? Kind of confused and distracted during debugging.


.

Sun IdM reconciliation of Sun OpenSSO accounts

In the project that I am currently onboard, besides Single Sign-On, we have Identity Management in place.
Sun OpenSSO + Sun Identity Manager (aka Oracle OpenSSO + Oracle Waveset)

As OpenSSO is one of the Identity resources, we need to reconcile large number of accounts ( >40,000 in development ) into OpenSSO, but the reconciliation process always fail.

It took us pretty long to discover what is causing  - do remember to turn off debugging in OpenSSO.

The debug log IdRepo was too verbose (I turned to message logging in development) and was spending too much time logging, than trying to help in reconciliation.


.

amtune Issue

The Single Sign-On infrastructure which I helped to architect for the local ministry is about to go LIVE. I'm trying to tune the OpenSSO server before it's launched - amtune comes to mind. It's a built-in tool.

However, when I run the utility, I kept hanging at the following stage:

"Checking Application Server JVM mode (32-bit or 64-bit) for AS 9/Glassfish v2"

It's not moving. I waited for as long as 15 minutes. This can't be normal as I have used amtune in previous version of Sun Access Manager.


So I debugged the error log file. Nothing unusual. I realized the error shown on my shell prompt mapped to the following line in the error log file:

# /sso/opt/gf211/bin/asadmin generate-jvm-report --user admin --passwordfile /tmp/asadminpass --host localhost --port 8888 --secure --interactive=false


Being curious, I copied the line and tried to execute it manually. Found it!

The OpenSSO servers are SSL-enabled and the keystore in the system's JVM has not trusted the certificate yet. I answered "y" to the above.

Re-executed amtune again. Everything goes smoothly after that!

.

Sun DS with OpenSSO schema - High Available Connections

In a highly-available setup, each OpenSSO server is recommended to connect to a dedicated Sun Directory Server for its Data Store. The other Directory Server will be configured as the secondary server (dotted lines). This ideal setup will yield better performance.

How to do achieve that in OpenSSO/OpenAM via the AM Console?

The above setup is wrong. It means both OpenSSO servers will connect to LDAP1 always. And only when LDAP1 is down, will both of them redirect to LDAP2.

This is not what we want to achieve. We want the setup to be highly available and efficient. (aka good performance)


So, we need to play with Format: LDAP server host name:port | server_ID | site_ID.


Problem is how do we know what is the value for server_ID and what is the value for site_ID?

As usual, I whack the OpenDS directly. The configuration data for the above screen is stored in ou=iPlanetAMPlatformService.

The configuration for Site is stored in ou=com-sun-identity-sites.

The configuration for Servers is stored in ou=com-sun-identity-servers.

So, the configuration should be as follows:

Nice!

.

Backing up configuration data -- Part II

The configuration data which is stored in the embedded OpenDS/OpenDJ can be dumped out into a XML file.

This little script can do the job:

/sso/bin/tools/ossotools/opensso/bin/ssoadm export-svc-cfg -u amadmin -f /tmp/.admin.pwd -e secretkeytoencryptpassword -o /tmp/svc-config-bkup.xml
echo "Configuration dumped to /tmp/svc-config-bkup.xml"

.

Backing up configuration data

Before a project goes LIVE, what do we usually do? Make sure backup is in place in case disaster kicks in.

So, this is what I am doing this week. I need to have a backup mechanism for the Single Sign-On infrastructure which I have set up for the local education ministry.

This book comes in handy - OpenAM by Indira. There's this chapter on Backup, Recovery and Logging.

The safest way to backup OpenSSO/OpenAM configuration data is non other than filesystem backup. (not mentioned in Sun's documentation)

The critical files and directories that need to be backed up are as follows:
• bootstrap
• OpenDS (whole directory)
• .version
• .configParam
• certificate stores
• config/xml (whole directory; if there is customized service schema)


ssoadmin@node01 $ /usr/sfw/bin/gtar -cvf opensso-bak.tar --exclude "opensso/opends/logs" opensso/bootstrap opensso/opends opensso/.configParam opensso/.version opensso/.configParam opensso/opensso/.keypass opensso/opensso/.storepass opensso/opensso/keystore.jks


If you are lazy, backup the whole configuration directory. But I would suggest discarding the debug and log directories. 


That can take up a huge amount of space if the log is verbose.




.

Unexpected LDAP error - ssoadm

The project I am currently on requires High Availability for Single Sign-On in the production environment. A site is configured for this purpose having 2 nodes.

Today, I was debugging something and shut down Node 2 and used ssoadm.jsp to update a service (update-svc) which I previously created.

When I tried to save, I get Unexpected LDAP error on the UI.

I found out why when I saw the following in Configuration log file:

ERROR: SMSLdapObject.modify(): Error in modifying entry: ou=1.0,ou=sunAMAuthXXXAuthService,ou=services,o=XXX,c=sg
By Principal: id=amadmin,ou=user,o=XXX,c=sg
com.sun.identity.shared.ldap.LDAPException: error result (53); The Replication is configured for suffix  o=Ministry of Education,c=SG but was not able to connect to any Replication Server
        at com.sun.identity.shared.ldap.LDAPConnection.checkMsg(LDAPConnection.java:4875)
        at com.sun.identity.shared.ldap.LDAPConnection.modify(LDAPConnection.java:3163)
        at com.sun.identity.shared.ldap.LDAPConnection.modify(LDAPConnection.java:3102)
        at com.sun.identity.shared.ldap.LDAPConnection.modify(LDAPConnection.java:3111)
        at com.sun.identity.shared.ldap.LDAPConnection.modify(LDAPConnection.java:3077)
        at com.sun.identity.sm.ldap.SMSLdapObject.modify(SMSLdapObject.java:435)

Hmm... any configuration change requires both nodes in the site to be up! Is this built by design? I need to find out more ...


.

Model must not be null in CCPropertySheet()

The project I am currently on requires High Availability for Single Sign-On in the production environment. (we have 2 nodes) The Authentication module is customized as we have special business logic to handle during users' login process.

So to plug in a new Authentication module is easy.
1. Deploy the jar
2. Dump the properties file in classes directory
3. Add in the XML file in config/auth/default directory
4. Create the new service
5. Register the authentication module

All went well with Node 1. However, I kept getting Model must not be null in CCPropertySheet() error on Node 2. I have restarted Node 2 more than once. Strange!

So what really happened?

I have forgotten to apply Step 1 - 3 on node 2. Ha!

(Note: Step 4 - 5 are only done once via the ssoadm.jsp UI)

.

Problems Solved By OpenSSO

I was reading the newly released OpenAM book by Indira Thangasamy and came across this diagram in the overview section.

Great stuff! I always salute those who can illustrate the capability of their products in a diagram. 

This diagram is able to show the 4 types of problems that OpenSSO/OpenAM is built for:

1. Access management
2. Federation
3. Securing web services
4. Entitlements

.

How to decode CSR?

After generating CSR (Certificate Signing Request) and before submitting to a CA to generate a Server certificate, it would be good if we can double check what has been generated.

If OpenSSL is installed, the following command can be used:

openssl req -in mycsr.csr -noout -text

I'm lazy. :) Thanks to SSLShopper. Here's the link.


.

Failed to establish chain from reply

If your server certificate (end-entity certificate) is signed by a Intermediate CA, then it is important to take note to import both Root CA and Intermediate CA certificates into your keystore (certificate store) before importing the server certificate.

Importing only Root CA certificate into the keystore is not sufficient. Otherwise, you'll get the following error when you import the Server certificate without the Intermediate CA certificate - "Failed to establish chain from reply".

.

Active Directory Primary Server Configuration for Multiple OpenSSO Servers

In a large scale IAMS infrastructure setup, it would be better if each OpenSSO server is configured to authenticate against a dedicated authentication source (in my case, Microsoft Active Directory).

Is this feature available in OpenSSO 8.0 U2? Yes, as far as the OpenSSO Admin Console is concerned. (see digram below)

However, you need to first figure out what does "local server name" means?

I had a hard time figuring out what this really mean. In the end, I had to read the source codes from OpenAM 9.5 (forgerock.com) to figure out. The code refers "local server name" to AM_SERVER_HOST.

private static final String localDsameServer = SystemPropertiesManager.get(

        Constants.AM_SERVER_HOST); 

OK, AM_SERVER_HOST should then be FQDN of the OpenSSO server.

Server Name is protocol://FQDN:port/opensso-uri

So, I'm up and running. I have the following in my Active Directory Primary Server:
osso1.xxx.xxx.xxx.sg|ad1.xxx.xxx.sg:636
osso2.xxx.xxx.xxx.sg|ad2.xxx.xxx.sg:636

I configured the reverse for my Active Directory Secondary Server:

osso1.xxx.xxx.xxx.sg|ad2.xxx.xxx.sg:636

osso2.xxx.xxx.xxx.sg|ad1.xxx.xxx.sg:636

Theoretically, this will definitely work. I was wrong! There is a bug in OpenSSO 8.0 U2.

The method getServerMapAttr() in CollectionHelper class is not able to detect that there are multiple entries. What's worse is it is not able to parse the String with the "|" to return the appropriate Active Directory server.

The code simply gets the first entry without any parsing and tries to connect. And of course, "Unknown host" is thrown.

Luckily, the code for this method in OpenAM 9.5 looks good. I copied and finally fixed the issue. 

Thank you, OpenAM!

.

An internal authentication error has occurred

I am near the final milestone of this IAMS project - deploying the Production environment.

We have a custom Authentication Module for this enterprise Single Sign-On infrastructure. I have done it many times in the development and staging environment and they worked!

However, I keep getting "An internal authentication error has occurred" when this custom Authentication module is turned on.

No choice. I need to turn on the verbose logging and this is what is been captured in Authentication debug log - "unable to find LoginModule class"

Ok, I must have made a mistake during the registration of the auth module via ssoadm.jsp. I think I must have key in only the Java class name without the full package path.

So I went ahead with ssoadm.jsp again to register with a full package Java class name.

Restarted OpenSSO server just to play safe. No luck!

Hmmm.... I recalled that in the days of Sun Access Manager 6.x and 7.x, there was no such thing as registering an authentication module via ssoadm.jsp. We did it manually and one of the steps was to add in the Pluggable Authentication Module Classes in Configuration > Core.

So I went ahead to verify the entries. Jackpot! 

Removing the last entry resolved the issue.


.

GlassFish + PostgreSQL server bundles

I'm pretty curious about the Take-Up Rate of GlassFish with PostgreSQL database bundle. Download here.

It has been a long while since I last worked on PostgreSQL database. Ever since I grabbed a copy MySQL, I have never turned back. Ha!



.

Pain upgrading to Oracle iPlanet Web Server 7.0.10

As part of the security/hardening measures of my current project, we are required to update every software component to the latest with patches. 

It's time to say bye-bye to Sun Java System Web Server branding. 

However, the upgrade experience wasn't pleasant... *Sigh*

Very strange - "Cannot upgrade the product from version 7.0U8 to 7.0.10" 


How can it be? This is not how Sun product works ... Every release should have a proper upgrade path. It has always been so.


What's the hack then?

Step 1: Go to /appl/opt/webserver7/setup
Step 2: Edit WebServer.inf

Step 3: Remove 8 from PRODUCT_SP_VERSION

Step 4: Remove U8 from PRODUCT_FULL_VERSION

Step 5: Done

Welcome to Oracle iPlanet Web Server 7.0.10!

.

ESSO product from PasswordBank

I have been involved with numerous SSO (Single Sign-On) projects - some of which are complemented by ESSO (Enterprise Single Sign-On) product.

Passlogix v-GO SSO was pretty popular. So popular that it's now being bought over by Oracle. So far, I have participated in 2 projects using Passlogix v-GO SSO. Pretty easy to configure if the user source is Microsoft Active Directory. A lot harder if Sun Directory Server is used as the user source. It's basically a Microsoft-centric product (my personal opinion).

Today, I came across a ESSO product from PasswordBank. Started in 2008, still a pretty young company.

This product differentiates itself by being able to support Desktop Platforms like Windows, Linux and Mac OS. This is something great! ESSO product has always been very Windows driven.

OpenSSO - Agents and Policies Entries in OpenDS

For this on-going project which I have been in-charge of since last August, I have been playing around with Agents and Policies more often than my previous projects.

Ever wonder where the configuration for the Agents is in OpenDS?

Answer is ou=AgentService, ou=services, ... :

How about the Policies? Where are they stored?

 Answer is ou=iPlanetAMPolicyService, ou=services, ... :

I find the latter most useful for me. Instead of creating policies via the OpenSSO Admin Console (which to me is pretty tedious), I'll go direct to OpenDS and edit the sunKeyValue for the xmlpolicy.

I'm lazy, maybe. :)

.