Access Manager Administration

1) Patches and Updates

Attempt to login as amAdmin to module LDAP denied due to internal users restriction

Introduction

This is a side effect of AM 7.1 patch 2 and seems only happen in legacy mode.

patch 2 :

126356-02 Sun Java System Access Manager 7.1 Solaris Readme

Version

observed on AM 7.1 patch 2 on Solaris 10.

Symptoms

The AM administrator cannot log in anymore ! The AM administrator cannot use the console anymore !

Error(s)

Returned to the console and found into the debug of Access Manager server side.

amAuth : WARNING: LoginState.isValidAuthForInternalUser():

Attempt to login as:amAdmin, to module:LDAP, at realm:dc=iam,dc=finbel,dc=intra, denied due to internal users restriction

Solution

2 ldapmodify to be executed into Directory Server(5.2 in our env).
module=DataStore has to be used to enter AM.

docs.sun.com

ldapmodify -D "cn=Directory Manager" -w dm-password -h ds-host -p ds-port
dn: ds-rootdn
changetype: modify
add: sunRegisteredServiceName
sunRegisteredServiceName: sunAMAuthDataStoreService

ldapmodify -D "cn=Directory Manager" -w dm-password -h ds-host -p ds-port
dn: ou=default,ou=

OrganizationConfig,ou=1.0,ou=sunAMAuthDataStoreService,ou=services, ds-rootdn
changetype: modify
add: sunkeyvalue
sunkeyvalue: sunAMAuthDataStoreAuthLevel=0

Notice that it was not to necessary to execute the second ldapmodify. It was already into Directory Server.

Restart AM.

Now the log in to AM as amadmin is done entering :
https://yourdomain/amserver/UI/Login?module=DataStore

References

some explanations on the authentication module "DataStore"

more here
https://opensso.dev.java.net/issues/show_bug.cgi?id=3924
and here
https://opensso.dev.java.net/issues/show_bug.cgi?id=3961

...Hope this helps...

-rudy-

Cannot find entries for (uid=amadmin) - amAuthLDAP

Error : Cannot find entries for (uid=amadmin)

12/18/2008 04:31:50:746 PM CET: Thread[service-j2ee-7,5,main]
Connecting to dev-ds.iam.finbel.intra:389
Searching dc=iam,dc=finbel,dc=intra for (uid=amadmin)
scope = 2
12/18/2008 04:31:50:746 PM CET: Thread[service-j2ee-7,5,main]
userAttrSize is : 2
12/18/2008 04:31:50:749 PM CET: Thread[service-j2ee-7,5,main]
Cannot find entries for (uid=amadmin)

If you do not configure the debug level of AM server in mode message the message does not show up !
/etc/opt/SUNWam/config/AMConfig.properties
...
com.iplanet.services.debug.level=message
...
BTW it is a good practice to put the server in "message" to investigate a problem and to put back the mode in "error" or "warning" later. Ton of messages if you don't !

Symptoms : The administrator(amadmin) cannot log into the AM console.

Environment : AM : 7.1 patch 1; Solaris 10 on Sparc

Comments : It is very weird because amadmin cannot log in. We have experienced this just after an installation from state files(I did not do myself).

As amldapuser(cn=amldapuser,ou=DSAME Users,dc=iam,dc=finbel,dc=intra) and using ldapsearch you can retriveve amadmin in the DS.

vegan:rudy ~ $ ldapsearch -b "dc=iam,dc=finbel,dc=intra" -h dps-t-prod-z1.iam.finbel.intra -D "cn=amldapuser,ou=DSAME Users,dc=iam,dc=finbel,dc=intra" -w XXX "uid=amadmin" dn
version: 1
dn: uid=amAdmin,ou=People,dc=iam,dc=finbel,dc=intra

Solution :

1. Enter the AM console using the full name.
   Example : uid=amAdmin,ou=People,dc=iam,dc=finbel,dc=intra
   
2. "Access Control"->"Realms"->Authentication->"Modules Instances"->"LDAP"
   Check the data. In my case "Password for Root User Bind:" was empty ! Save and restart the server because the LDAP intialisation does only occur one time.

-rudy-