Sun Access Manager 7.1 - Password Retries Exceeded Issue

I have a customer in Thailand asking me for help with regard to a weird error message when he tries to login after his password retries have exceeded.


He was warned of account lockout prior to his max password retries count. This is what he expected. Good. 

However, "Authentication failed" error message is shown when he really exceeded his max password retries count. He was expecting "Password retry limit exceeded". No Good.

I did a search in amAuthLDAP.properties:

#ExceedRetryLimit=Exceed password retry limit. Please try later.
ExceedRetryLimit=Authentication failed.


That explains why. This is more for security/auditing purpose. These days, auditors advise customers not to reveal too much to end-users when they encounter login failure.

.

OpenSSO - WebtopNaming Error

I was trying to configure a Site for my 2 OpenSSO Enterprise Servers and I hit the famous WebtopNaming error as shown below:

Servlet /opensso threw load() exception
java.lang.StackOverflowError
:
at java.util.concurrent.locks.ReentrantReadWriteLock$ReadLock.lock(ReentrantReadWriteLock.java:594)
at com.iplanet.am.util.SystemProperties.get(SystemProperties.java:252)
at com.iplanet.am.util.SystemProperties.get(SystemProperties.java:329)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:620)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:594)
at com.iplanet.services.naming.WebtopNaming.updatePlatformServerIDs(WebtopNaming.java:1186)
at com.iplanet.services.naming.WebtopNaming.updateNamingTable(WebtopNaming.java:1111)
at com.iplanet.services.naming.WebtopNaming.getNamingProfile(WebtopNaming.java:995)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:658)
at com.iplanet.services.naming.WebtopNaming.getServerID(WebtopNaming.java:594)

There could be many scenarios that can cause this problem. Mine is kind of stupid today.

I was careless in appending an additional "/" to "/opensso". Be careful! 

.

OpenSSO - Manual configuration

I was trying to configure OpenSSO Enterprise Server manually without using the GUI Configurator.

The following error was encountered:

-bash-3.00$ java -jar /dist/osso/tools/config/configurator.jar -f /dist/osso/tools/config/osso1-config

Not Found

Configuration failed!

What an unfriendly error message! What is "Not Found"?

It was only after a while then I realized I have forgotten to deploy the opensso.war into my Glassfish container. How careless I was!

So here we go again:

-bash-3.00$ opt/gf211/bin/asadmin deploy --user admin --port 7878 --secure /dist/osso/opensso.war
Command deploy executed successfully.


-bash-3.00$ java -jar /dist/osso/tools/config/configurator.jar -f /dist/osso/tools/config/osso1-config
Checking configuration directory /sso/var/opensso....Success.
Installing OpenSSO configuration store...Success RSA/ECB/OAEPWithSHA1AndMGF1Padding.
Installing OpenSSO configuration store in /sso/var/opensso/opends...Success.
Creating OpenSSO suffix...Success.
Tag swapping schema files....Success.
Loading Schema am_sm_ds_schema.ldif...Success.
Loading Schema am_remote_opends_schema.ldif...Success.
Loading Schema fam_sds_schema.ldif...Success.
Reinitializing system properties....Done
Registering service amEntrySpecific.xml...Success.
:
:
Configuring system....Done
Configuring server instance....Done
Creating Web Service Security Agents....Done
Setting up registration files....Done
Configuration complete!

Nevertheless, I still think that we can do better with a friendlier error message.

.

How to import SSL certificates into JVM trust store?

I was trying to set up OpenSSO Distributed Authentication UI (DAUI) server on Sun Web Server 7 (aka Oracle iPlanet Server) to communicate with my backend OpenSSO Enterprise Server. The OpenSSO Enterprise Server is SSL-enabled for security reason.

In our development environment, we install self-signed certificate onto the Glassfish Application Server that hosts the OpenSSO Enterprise Server.

In order for DAUI to communicate securely with the OpenSSO Enterprise Server, we need to import the self-signed CA certificate into the Sun Web Server JVM.

The task can be daunting for people who do not play with SSL day-in-day-out.

Luckily, I found a very useful blog. Amazing! Wrote in 2006, still works like a charm in 2010!

Thank you, Andreas!

Alternative SyncML Client

Besides Synchronica and NotifyLink, there is now another SyncML client alternative from Synthesis AG.

Synthesis SyncML Clients for mobile devices (PDA) bring SyncML compatibility to widespread mobile OS platforms like iOS (iPhone, iPad, iPod touch), Android, PalmOS and Windows Mobile.

This allows mobile over-the-air (OTA) synchronisation with any compliant SyncML server (such as GooSync.com, SyncWise, Oracle Calendar and Beehive, eGroupware, Horde, WinFonie, SyncEvolution, MDaemon, OpenXchange, DeskNow, ScheduleWorld.com, O-Sync and many many more)


It offers free evaluation copy. I have not personally tried it yet, but will do so when I have the bandwidth.
Anyone has any review on this product? I would like to hear from you.


.

Gmail Priority Inbox

When Gmail launched Priority Inbox, I was initially not interested. That's why I did not enable the feature until today.

To know more about how Priority Inbox works, read here.

I just enabled it while having a lengthly meeting in a customer's site. I'm just impressed!

With Priority Inbox, there is this little section right at the top of your inbox (highlighted in RED). To me, it looks like a simple Executive Summary. So simple, so convenient. 

.

Blackberry Email & Calendar Sync with Sun Communications Suite

I just finished installing Sun Calendar Server to a customer's existing Sun Messaging Server infrastructure over the weekend in the Philippines.

Some of their directors use Blackberry. With the newly installed Calendar Server, they hope to sync their Blackberry devices.

I told them there are 2 approaches.


Approach 1: Blackberry sync with Outlook via USB

a. Install Sun Java System Connector for Microsoft Outlook
b. Sync Mail & Calendar from Sun Comms Suite 6u2 (Mail & Calendar) with Outlook
c. Sync Blackberry with Outlook via USB

Supported OS
Runs on Microsoft Windows 2000 (SP3 or higher), Windows XP (SP1 or higher), Windows 2003 Terminal Server, and Windows Vista

Supported Outlook
Supports Microsoft Outlook 2003 and 2007

Read here.



Approach 2: Blackberry sync over-the-air

a. Purchase NotifyLink Enterprise Server
b. Install and Configure to connect to Sun Comms Suite 6u2 (Mail & Calendar)
c. Blackberry sync with NotifyLink over-the-air

Read here.


Note: If users only want to "sync" email with Sun Messaging Server with Outlook, no connector is required. It works out-of-the-box via POP or IMAP protocol.

.

OpenSSO Identity Services

Besides Policy Agent that performs authentication and authorization, OpenSSO offers Identity Services to helps authenticate users who access protected applications.

The Identity Services are accessible via SOAP/WSDL and REST.

Basically, no difference from those offered by Policy Agent:

• Authentication and Single Sign-on — Verification of user credentials
• Authorization — Permission for authenticated users to access secured resources
• Provisioning — Creation, deletion, search, and editing
• Log — Ability to audit and record operations

The only difference is developers have to code by themselves to achieve the above 4 functionalities.
More flexibility if you look at it positively. Of course, more effort required.

.

OpenSSO Data Stores

There are a few data stores which we need to configure in OpenSSO.

1. Authentication Data Store assists in users' authentication

2. Identity Data Store holds the users' profiles

• Usually, there is a 1-to-1 mapping between a user in the authentication data store and a user in the identity data store
• Authentication data can also be stored together with Identity Data Store
• i.e. The Sun LDAP is used for both Authentication and Identity
• The reserve is also true: Active Directory can be configured for both purposes

3. Configuration Data Store is used for storing service configuration data and other information pertinent to the server's operation. Policies are also stored here. 

• We used to store Configuration data in Sun LDAP as well
• However, since version Access Manager 8.x (aka OpenSSO 8.x), these data is now stored in the embedded OpenDS.  
• This embedded OpenDS makes configuration for high-availability easier - less work to do

.

Difference between Web and J2EE Policy Agents

In OpenSSO, there are 2 types of Policy Agent to choose. Customers always get confused on which type and on which tier to deploy in their environment. 

The following diagrams illustrates clearly. Based on the Selection Criteria, Web Policy Agent will be deployed on the Web tier. 

J2EE Policy Agent will be deployed on the Application tier.

PS: If J2EE Policy Agent is deployed on the Application tier, there is no need for Web Policy Agent to be deployed on the Web tier. Simply allow the pass-through on the web server and let the Policy Evaluation be carried out on the Application tier.



.

OpenSSO and Enterprise SSO Selection Criteria

I have been busy involving in the design of a Single Sign-On (SSO) and Enterprise Single Sign-On (ESSO) solution for a local ministry.

They have a few hundreds applications (web-based and non web-based). Thus we need to have a concise selection criteria for them.

There are 2 types of policy agents available from OpenSSO:

1. Web Policy Agent

2. J2EE Policy Agent

In order to integrate applications for Single Sign-On with OpenSSO, they must be:

1. web-based

2. authenticate with a common authentication repository

3. supported by available policy agents from OpenSSO

If applications are customizable, Web Policy Agent will be chosen. Otherwise, if applications are pure J2EE-based that utilize the Java Authentication and Authorization Service (JAAS), then J2EE Policy Agent will be chosen.

If the above 2 criteria cannot be met, then ESSO will be chosen.

.

Automatic spam detection for comments

Salute to Blogger! There is now a feature to automatically detect spam for comments ...

I love this feature since I have been spending time manually removing spammed comments for the past months.

.

Oracle Directory Services Directory Server Enterprise Edition 11gR1

Sun Directory Server Enterprise Edition (DSEE 7.0) has now been rebranded as Oracle Directory Services Directory Server Enterprise Edition 11gR1. It is now part under the Oracle Fusion Middleware umbrella.

Read here.

.

OpenSSO Distributed UI Server & Windows Desktop SSO

For security reason, OpenSSO Distributed Authentication UI Server is recommended to "front" the OpenSSO Server that sits behind the firewall. For better performance, you can deploy multiple DAUI Servers with multiple OpenSSO Servers.

However, do note that if you deploy a Distributed Authentication UI Server in front of your protected OpenSSO Server, then Windows Desktop SSO is not supported.

Read here.

.

How to disable SSL on Sun Directory Server?

I got a call from my customer asking how to manually disable the SSL on his faulty Directory Server.

Edit dse.ldif. Locate dn: cn=config:

nsslapd-security: on
nsslapd-secureport: 636

Solution:

1. Stop Directory Server

2. Remove the above 2 lines

3. Add the following line:

nsslapd-security: off

4. Start Directory Server

Done!

.

Why a Directory Consumer is not read-only? - Part II

Continue from my previous post ...

Master: ds-master.singapore.sun.com:389
Consumer: ds-slave.singapore.sun.com:1389


Let's perform a modification operation on the Consumer. I modified the entry for CLow2.

Below is what you'll observe in the access log of the Consumer:


[20/Jul/2010:02:26:28 +0800] conn=0 op=99 msgId=2098 - MOD dn="uid=CLow2,ou=People,dc=singapore,dc=sun,dc=com"
[20/Jul/2010:02:26:28 +0800] conn=0 op=99 msgId=2098 - RESULT err=10 tag=103 nentries=0 etime=0

The consumer rejects modification operation (err=10). It kicks started the referral process to redirect the MOD request to the master.

Below is what you'll observe in the access log of the Master:

[20/Jul/2010:02:26:28 +0800] conn=63 op=1 msgId=2100 - MOD dn="uid=CLow2,ou=People,dc=singapore,dc=sun,dc=com"

[20/Jul/2010:02:26:28 +0800] conn=63 op=1 msgId=2100 - RESULT err=0 tag=103 nentries=0 etime=0

The master process the modification request successfully (err=0).

Below is the dse.ldif file on the Consumer:

dn: cn="dc=singapore,dc=sun,dc=com",cn=mapping tree,cn=config

objectClass: top

objectClass: extensibleObject

objectClass: nsMappingTree

cn: "dc=singapore,dc=sun,dc=com"

nsslapd-backend: userRoot

nsslapd-referral: ldap://ds-master.singapore.sun.com:389/dc%3Dsingapore,dc%3Dsun,dc%3Dcom

nsslapd-state: referral on update

modifiersName: cn=server,cn=plugins,cn=config

modifyTimestamp: 20090923115909Z

numSubordinates: 1

Below is the dse.ldif file on the Master:

dn: cn="dc=singapore,dc=sun,dc=com",cn=mapping tree,cn=config

objectClass: top

objectClass: extensibleObject

objectClass: nsMappingTree

cn: "dc=singapore,dc=sun,dc=com"

nsslapd-state: backend

nsslapd-backend: userRoot

.

Why a Directory Consumer is not read-only?

This is an interesting question.

In my customer's environment, he has a pair of Sun Directory Servers acting as Masters. The data in the pair is kept in-sync via Multi-Master Replication (MMR).

There are 4 Sun Directory Servers acting as consumers. The data are replicated from the 2 Masters.

Recently, he found out that when he modifies entries on any of the Consumers, the modified entries are updated to the Masters!

This violates the concept of a Consumer, according to what he understands of the term.


Well, let's take a close look at the following diagram:

The diagram illustrates a Master-Consumer deployment architecture. 

Did you notice there is a dotted arrow pointing from the Consumer back to the Master? This is the Referral that is causing the "side-effect". 

Ok, it's not "side-effect". It's a product feature of Sun Directory Server. 

Whenever there is a modification request on the Consumer, the Referral will redirect the request back to the Master. The Master will be the one that actually updates the entries. The Consumer can never process a modification request, it can only perform a search request. 

.

OpenSSO Multi-Servers Mode

There are at least 2 data stores in OpenSSO - Configuration and User data stores.

The older version of OpenSSO, which is Sun Java System Access Manager, does not utilize an embedded Configuration Data Store. As such, we usually utilize the same Sun Java System Directory Server to store both the configuration and users information. (unless, the users information are stored in Active Directory)

In OpenSSO, OpenDS is embedded to store Configuration information. It comes pre-installed with every OpenSSO bundle.

In fact, the recommended deployment approach is not to change this embedded data store.

Using the OpenSSO Enterprise embedded configuration data store can lower response time and ensure service availability when machine failure occurs.

What I like about this embedded data store is: if you scale by adding another node, there is nothing you need to do to ensure the configuration information are replicated and always in-sync. Replication is taken care of, transparently.

Nice!

.

OpenSSO Authentication and Authorization Interactions

While refreshing myself with OpenSSO, I came across this diagram that illustrates very clearly how OpenSSO and Policy Agent operates in a Access Control environment.

I love diagram that is simply, yet tells a complete story of a product's capability.

.

How to reset DSCC Directory Service Manager password?

I was with a customer the other day. He has another Sun Directory Server setup by another vendor long time ago. He attempted to login to DSCC, but he was not able to remember the "admin" (Directory Service Manager) password.

Some forums I searched talked about resetting the Service Manager password via the DSCC console. What a joke! :) I can't even login, how am I able to reset password via DSCC console?

Changing password via DSCC console

There are 2 ways to resolve this issue:


1. To dismantle and initialize DSCC again

bash-3.00# ./dsccsetup dismantle
:
bash-3.00# ./dsccsetup initialize
:
Registration is on-going. Please wait...
DSCC is registered in Sun Java(TM) Web Console
:
DSCC agent has been successfully registered in Cacao.
***
Choose password for Directory Service Manager:
Confirm password for Directory Service Manager:
Creating DSCC registry...
DSCC Registry has been created successfully
***

Simple. But of course, previous configuration of registered servers are gone. You need to register again.



2. Change password via CLI

Some basic concepts first.

bash-3.00# ./dsccsetup status

***

:

DSCC Registry has been created

Path of DSCC registry is /var/opt/SUNWdsee/dscc6/dcc/ads

Port of DSCC registry is 3998

***

• DSCC configuration are stored in a LDAP database at port 3998
• Service Manager is known as cn=admin,cn=Administrators,cn=dscc in this LDAP database (see screenshot above)
• "cn=Directory Manager" credential is required to modify the Service Manager password 
• The funny thing is the default password for "cn=Directory Manager" is the same as Directory Service Manager. (see dsccsetup initialize above. the steps are so simple. it assumes both to have the same password) 

So we need to perform 2 steps:


Step 1 - Change the Directory Manager password


bash-3.00# /opt/SUNWdsee/ds6/bin/pwdhash -D /var/opt/SUNWdsee/dscc6/dcc/ads -s SHA password2
{SSHA}qFcXDQCKZ4u4GyrM8Uw4uGOHdsnVPP9MaC0WeQ==


bash-3.00# cd /var/opt/SUNWdsee/dscc6/dcc/ads/
bash-3.00# ./stop-slapd
bash-3.00# cd /var/opt/SUNWdsee/dscc6/dcc/ads/config
bash-3.00# cp dse.ldif dse.ldif.OLD
bash-3.00# vi dse.ldif
At dn: cn=config
Replace:
nsslapd-rootpw: {SSHA}guaZfnFtTHeT8EpWpBhuRlBCMLWpdgt0tBvfBw==
with:
nsslapd-rootpw: {SSHA}qFcXDQCKZ4u4GyrM8Uw4uGOHdsnVPP9MaC0WeQ==


bash-3.00# ./start-slapd



Step 2 - Change the Service Manager password

bash-3.00# ldapmodify -p 3998 -D "cn=Directory Manager"
Enter bind password:
dn: cn=admin,cn=Administrators,cn=dscc
changetype: modify
replace: userPassword
userPassword: password2 <-- Rest assured. This password will be hashed during modification.


modifying entry cn=admin,cn=Administrators,cn=dscc


Done!

.