Latest posts for the topic "Single Sign On occasional problem"

Single Sign On occasional problem

alland — GMT

Hi all,
We try to use SysAID for several month as a pilote and have invested into project, but one annoying issue keeps us launching the application enterprise (Dalkia Estonia) wide.
Have tried to solve that via Sysaid own helpdesk, but no luck neither solution.

Issue: Sometimes SSO does not work. As we use it in limited pilot context I do not know how often it happens to end-users, but occasionally Administrators just cannot get in.

"Cannot get in" means that instead of SSO autologon (user is redirected transparently to their SysAID page) they get authentication window (it is like IE falls from NTLM to Basic authentication scheme). Providing domain credentials ther does not work and they are locked out. Other administrators may get in freely same time. Sometimes seems that restarting SysAid service on server or even the server OS cures the issue but not always.

Does anybody else had issues like that?

If you think you can help us, please read on, as I provide more interesting details.

Some context to our setting:

- Sysaid Sevrer is installed on WMVare virtual environment that hosts Windows 2003 server.
- SysAID version is 5.5.04, the same issue we had also before upgrading to that ver (do not remeber our exact version, but it was available in march 2008).
- Database is MySQL, hosted o the same server.
- SSO is implemented against Windows 2003 AD
- Users and administrators are accessing SysAID with XP machines, IE 6 or 7 installed. Administrators have tried also access using Firefox. If all works, it works with Firefox too. If SSO failure occurs, neither browser work.

Discussions with SysAID helpdesk have covered many possible aspects but without success.
1) They always asked \SysAidServer\root\WEB-INF\logs folder what we have sent too. From discussions seems, that SysAID helpdesk people have sought problems mostly from sysaid.log, but nothing special is written there while SSO failure occurs. One suggestion they made was to increase number of allowed connections for MySQL. Currently max connections = 300. Nothing on MySQL side indicates problem that would be related to SSO issue. We tried to record all queries on SQL and found that if user can log in, then "normal" queries are there and if SSO failure occurs, nothing is queried from DB.
Also (serverConf.xml) were considered and revised and updated. No success.
2) Once they asked us to upgrade Tomcat what we did, current version is Apache Tomcat Version 6.0.16. No luck with our SSO issue.
3) AD security log was under question - what happens there during SSO failure. Our AD security log is recording both sucess and failure attempts. As suggested we tried different scenarios. AD security log indicates expected success records when successful logon occurs and also failure record when deliberately wrong username/password was used. But NOTHING recorded into AS Security log while SSO failures occurs. AD logon excrepts sent to SysAID helpdesk, but no solution.

Now I was trying to get Helpdesk personnel attention to one interesting thing, that might reveal the issue, but SysAID helpdesk never even commented my findings. These are following:

There is wrapper.log file in \SysAidServer\logs folder.
Exactly when SSO failure happens I discovered a record there:

[code]HttpFilter: ASTS\viktorko: 0xC0000022: jcifs.smb.SmbAuthException: Access is denied.[/code]

I just googled the message and got interesting information about jcifs module that seemed to mach my situation quite well. My understanding was that jcifs module was responsible for NTLM authentication against AD that SSO in SysAID implemented.

SysAID helpdesk ignored my questions "Have you considered jcifs module fault (discussed widely http://lists.samba.org/archive/jcifs/)" neither did not answer about the version of [b]jcifs [/b]version used in SysAID libraries.

I have sought on my own to find possible solutions and I am quite sure that my issue is related to jcifs module. Can anybody suggest ideas if you have had similar issue?

Thanks

Alland

Re:Single Sign On occasional problem

Joseph Zargari — GMT

The original message posted is listed below, but if you are using SysAid 7.0 or above the instructions you need to follow are a bit different. Please submit a service request with our helpdesk to get updated instructions.
Please include the SysAid version, Operating System version and architecture (32 or 64 bit).

************************************************************************************************************

Hello Alland,

I think that we could workaround that problem by disabling SSO (with jcifs), integrating SysAid with IIS and then enable Integrated Windows Authentication on IIS.

To do that, please edit the serverConf.xml file and remove all lines between and and then restart the SysAid Server service. This will disable SSO (jcifs).

Then, to integrate SysAid with IIS please read the instructions carefully. If something does not happen as it's supposed to, please contact me and I'll try to assist you during the process.
An additional resource for assistance on IIS integration can be found at: http://www.unlimitedftp.ca/support/resources/tomcat-iis.html

For IIS 5.0 you should skip steps 11 and 12.
Note: step 11 might not be required in some cases.

1. We assume the following:
a. SysAid is installed into the C:\Program Files\SysAidServer directory.
b. SysAid uses port 8080.

2. Download and extract http://www.ilient.com/down/IIS.zip into the C:\Program Files\SysAidServer. Extract using the "Use folder names" option.

3. Double click on the file C:\Program Files\SysAidServer\IIS.reg

4. Restart the Sys Aid Server service, then check that SysAid is accessible using the following URL : http://:8080/Login.jsp
This is just to test that tomcat still hosts SysAid appropriately.

5. Open the Internet Services Manager from Administrative Tools.

6. In the tree, right click Websites -> New Website -> Next -> Description: SysAid -> Next.
On this step, select the port you prefer for IIS to listen on for SysAid. You can also bind it to a specific IP address or a specific hostname (optional). Click Next when done. Set the path to C:\Program Files\SysAidServer\tomcat\bin -> Next -> Clear all permissions -> Next -> Finish.
Right click the newly created website and choose Properties.

7. Go to ISAPI Filters and click Add.

8. In the filter name, enter "jakarta". In the executable, click
browse and select C:\Program Files\SysAidServer\tomcat\bin\isapi_redirect.dll

9. Click OK on both dialogs and go back to the main screen.

10. Right click on the newly created website (SysAid), and select New -> Virtual Directory. In the alias write "jakarta", in the Directory
select C:\Program Files\SysAidServer\tomcat\bin. In the access permissions select only Execute.

11. ** Only applies to older versions of SysAid **
Put IIS 6.0 Into "IIS 5.0 Isolation Mode" - In the management console go to: Web Site Properties -> Service -> Isolation Mode

12.Allow Tomcat's Redirector DLL in Web Service Extensions* *
In IIS 6.0 Microsoft has added to IIS's security by adding "Web Service Extensions." The redirector DLL we added as an ISAPI Filter above needs to be added to this area of IIS and be set to be "allowed." To do this, go to the management console. Click on "Web Services Extensions." Choose "Add a new Web service extension." Enter an extension name along the lines of "Jakarta-Tomcat." Then check the checkbox for "Set extension status to Allowed." Then click the "Add" button, enter the path to isapi_redirect.dll and press "OK".

13. Check the following URL: http://HOSTNAME:port/Login.jsp (use the port you selected when created the new website). It should open SysAid from IIS.

Finally, you need to enable Integrated Windows Authentication.
1. Edit serverConf.xml located at: c:\Program Files\SysAidServer\root\WEB-INF\conf\
2. In ServerConf.xml edit the tag . Put the value "true" instead of false.
3. Go to: IIS Manager.
4. Go to Properties of the SysAid Web Site (usually installed as the default web site).
5. In Properties go to Directory Security->Edit.
6. Uncheck the checkbox "Enable Anonymous Access"
7. Check the "Integrated Windows Authenitcation" box. Any other checkboxes may be checked considering your security considerations.
8. Apply these settings, close these windows.
9. Restart SysAid Server service.

Let me know how it goes.

Joseph.

Re:Single Sign On occasional problem

alland — GMT

Thanks, I will choose time to try that migration and tell how it works.

Re:Single Sign On occasional problem

alland — GMT

I tried to goo IIS as suggested but failed in following:

Problem 1:
Assumptions did not match - Our SysAid is installed at path E:\SysAidServer and http port is 80.

Tried solutions: Downloaded suggested IIS.zip file and
- made path corrections in IIS.reg file and this was quite straightforward.
- made path correction in server.xml tag and port change in tag.
SysAid Service restart failed (no response browsing Helpdesk page). Seems that problems are related to new server.xml file (that was in IIS.zip file)
Sysaid.log says nothing, Wrapper.log recorded issue (I cannot unfortunately interpret to decide what exactly went wrong) see below the post.
My opinion is that wrapper.log does not report any problems related to my "corrections" (server path and port), but something else.

So basically I was already failed at p.4 (could not get SysAID running with new server.xml file.

But since I was able to run "old instance" of SysAid (with old server.xml file), I still tried next steps tp see does IIS redirector works (perhaps it should not work with old server.xml file anyway…)

Doing all requested steps IIS eventually said me (wehre it should be able open SysAid page)
HTTP Error 403.2 - Forbidden: Read access is denied.

As I suspected that it should not work with old server.xml file, I quit here.

What next?

Wrapper.log complaints when starting SysAid Server with new server.xml file:

STATUS | wrapper | 2008/08/12 13:35:42 | --> Wrapper Started as Service
DEBUG | wrapperp | 2008/08/12 13:35:43 | server listening on port 1777.
STATUS | wrapper | 2008/08/12 13:35:44 | Launching a JVM...
DEBUG | wrapper | 2008/08/12 13:35:44 | command: "E:\SysAidServer\jre\bin\java.exe" -Dcatalina.home=./tomcat -Djava.io.tmpdir=./tomcat/temp -Dsysaid.home="E:\SysAidServer" -Xms16m -Xmx256m -Djava.library.path="./lib" -classpath "./lib/wrapper.jar;./tomcat/bin/bootstrap.jar" -Dwrapper.key="erQI5PFCpC57PkCe" -Dwrapper.port=1777 -Dwrapper.debug="TRUE" -Dwrapper.service="TRUE" -Dwrapper.cpu.timeout="10" -Dwrapper.jvmid=1 com.silveregg.wrapper.WrapperStartStopApp org.apache.catalina.startup.Bootstrap 1 start org.apache.catalina.startup.Bootstrap true 1 stop
DEBUG | wrapper | 2008/08/12 13:35:44 | Java Virtual Machine started (PID=2996)
INFO | jvm 1 | 2008/08/12 13:35:44 | Wrapper Manager: JVM #1
INFO | jvm 1 | 2008/08/12 13:35:44 | Wrapper Manager: Registering shutdown hook
INFO | jvm 1 | 2008/08/12 13:35:44 | Wrapper Manager: Using wrapper
INFO | jvm 1 | 2008/08/12 13:35:44 | Calling native initialization method.
INFO | jvm 1 | 2008/08/12 13:35:44 | Initializing WrapperManager native library.
INFO | jvm 1 | 2008/08/12 13:35:44 | Java Executable: E:\SysAidServer\jre\bin\java.exe
INFO | jvm 1 | 2008/08/12 13:35:44 | Java Version : 1.6.0-b105 Java HotSpot(TM) Client VM
INFO | jvm 1 | 2008/08/12 13:35:44 | Java VM Vendor : Sun Microsystems Inc.
INFO | jvm 1 | 2008/08/12 13:35:44 |
INFO | jvm 1 | 2008/08/12 13:35:44 | Wrapper (Version 2.2.9)
INFO | jvm 1 | 2008/08/12 13:35:44 |
INFO | jvm 1 | 2008/08/12 13:35:44 | Open socket to wrapper...
INFO | jvm 1 | 2008/08/12 13:35:44 | Opened Socket
INFO | jvm 1 | 2008/08/12 13:35:44 | Send a packet 110 : erQI5PFCpC57PkCe
INFO | jvm 1 | 2008/08/12 13:35:44 | handleSocket(Socket[addr=/127.0.0.1,port=1777,localport=1328])
INFO | jvm 1 | 2008/08/12 13:35:44 | Received a packet 112 : 1
INFO | jvm 1 | 2008/08/12 13:35:44 | Wrapper Manager: LowLogLevel from Wrapper is 1
INFO | jvm 1 | 2008/08/12 13:35:44 | Received a packet 100 : start
INFO | jvm 1 | 2008/08/12 13:35:44 | calling listener.start()
INFO | jvm 1 | 2008/08/12 13:35:44 | WrapperStartStopApp: start(args)
INFO | jvm 1 | 2008/08/12 13:35:44 | WrapperStartStopApp: invoking start main method
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.SetPropertiesRule begin
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: [SetPropertiesRule]{Server} Setting property 'debug' to '0' did not find a matching property.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.SetPropertiesRule begin
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: [SetPropertiesRule]{Server/Listener} Setting property 'debug' to '0' did not find a matching property.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.SetPropertiesRule begin
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: [SetPropertiesRule]{Server/Listener} Setting property 'debug' to '0' did not find a matching property.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/GlobalNamingResources/ResourceParams/parameter/name'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/GlobalNamingResources/ResourceParams/parameter/value'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/GlobalNamingResources/ResourceParams/parameter'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/GlobalNamingResources/ResourceParams/parameter/name'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/GlobalNamingResources/ResourceParams/parameter/value'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/GlobalNamingResources/ResourceParams/parameter'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/GlobalNamingResources/ResourceParams'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.SetPropertiesRule begin
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: [SetPropertiesRule]{Server/Service/Engine} Setting property 'debug' to '0' did not find a matching property.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/Service/Engine/Logger'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.SetPropertiesRule begin
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: [SetPropertiesRule]{Server/Service/Engine/Realm} Setting property 'debug' to '0' did not find a matching property.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.SetPropertiesRule begin
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: [SetPropertiesRule]{Server/Service/Engine/Host} Setting property 'debug' to '0' did not find a matching property.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.Digester endElement
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: No rules found matching 'Server/Service/Engine/Host/Logger'.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.tomcat.util.digester.SetPropertiesRule begin
INFO | jvm 1 | 2008/08/12 13:35:44 | WARNING: [SetPropertiesRule]{Server/Service/Engine/Host/Context} Setting property 'debug' to '0' did not find a matching property.
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.coyote.http11.Http11Protocol init
INFO | jvm 1 | 2008/08/12 13:35:44 | INFO: Initializing Coyote HTTP/1.1 on http-8080
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.coyote.http11.Http11Protocol init
INFO | jvm 1 | 2008/08/12 13:35:44 | INFO: Initializing Coyote HTTP/1.1 on http-8009
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.catalina.startup.Catalina load
INFO | jvm 1 | 2008/08/12 13:35:44 | INFO: Initialization processed in 415 ms
INFO | jvm 1 | 2008/08/12 13:35:44 | 12.08.2008 13:35:44 org.apache.catalina.mbeans.GlobalResourcesLifecycleListener createMBeans
INFO | jvm 1 | 2008/08/12 13:35:44 | SEVERE: Exception processing Global JNDI Resources
INFO | jvm 1 | 2008/08/12 13:35:44 | javax.naming.NamingException: Cannot create resource instance
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.naming.factory.ResourceFactory.getObjectInstance(ResourceFactory.java:143)
INFO | jvm 1 | 2008/08/12 13:35:44 | at javax.naming.spi.NamingManager.getObjectInstance(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.naming.NamingContext.lookup(NamingContext.java:793)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.naming.NamingContext.lookup(NamingContext.java:140)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.naming.NamingContextBindingsEnumeration.nextElementInternal(NamingContextBindingsEnumeration.java:113)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.naming.NamingContextBindingsEnumeration.next(NamingContextBindingsEnumeration.java:71)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.catalina.mbeans.GlobalResourcesLifecycleListener.createMBeans(GlobalResourcesLifecycleListener.java:137)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.catalina.mbeans.GlobalResourcesLifecycleListener.createMBeans(GlobalResourcesLifecycleListener.java:109)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.catalina.mbeans.GlobalResourcesLifecycleListener.lifecycleEvent(GlobalResourcesLifecycleListener.java:81)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.catalina.core.StandardServer.start(StandardServer.java:703)
INFO | jvm 1 | 2008/08/12 13:35:44 | at org.apache.catalina.startup.Catalina.start(Catalina.java:57
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.reflect.Method.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:28
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.reflect.Method.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at com.silveregg.wrapper.WrapperStartStopApp.run(WrapperStartStopApp.java:100)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | 12.08.2008 13:35:44 org.apache.catalina.core.StandardService start
INFO | jvm 1 | 2008/08/12 13:35:45 | INFO: Starting service Tomcat-Standalone
INFO | jvm 1 | 2008/08/12 13:35:45 | 12.08.2008 13:35:44 org.apache.catalina.core.StandardEngine start
INFO | jvm 1 | 2008/08/12 13:35:45 | INFO: Starting Servlet Engine: Apache Tomcat/6.0.16
INFO | jvm 1 | 2008/08/12 13:35:45 | 12.08.2008 13:35:44 org.apache.catalina.realm.UserDatabaseRealm start
INFO | jvm 1 | 2008/08/12 13:35:45 | SEVERE: Exception looking up UserDatabase under key UserDatabase
INFO | jvm 1 | 2008/08/12 13:35:45 | javax.naming.NamingException: Cannot create resource instance
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.naming.factory.ResourceFactory.getObjectInstance(ResourceFactory.java:143)
INFO | jvm 1 | 2008/08/12 13:35:45 | at javax.naming.spi.NamingManager.getObjectInstance(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.naming.NamingContext.lookup(NamingContext.java:793)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.naming.NamingContext.lookup(NamingContext.java:153)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.realm.UserDatabaseRealm.start(UserDatabaseRealm.java:253)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1037)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.StandardService.start(StandardService.java:516)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Catalina.start(Catalina.java:57
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.reflect.Method.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:28
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.reflect.Method.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at com.silveregg.wrapper.WrapperStartStopApp.run(WrapperStartStopApp.java:100)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | 12.08.2008 13:35:44 org.apache.catalina.startup.Catalina start
INFO | jvm 1 | 2008/08/12 13:35:45 | SEVERE: Catalina.start:
INFO | jvm 1 | 2008/08/12 13:35:45 | LifecycleException: No UserDatabase component found under key UserDatabase
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.realm.UserDatabaseRealm.start(UserDatabaseRealm.java:261)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1037)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:443)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.StandardService.start(StandardService.java:516)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Catalina.start(Catalina.java:57
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.reflect.Method.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:28
INFO | jvm 1 | 2008/08/12 13:35:45 | at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.reflect.Method.invoke(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | at com.silveregg.wrapper.WrapperStartStopApp.run(WrapperStartStopApp.java:100)
INFO | jvm 1 | 2008/08/12 13:35:45 | at java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2008/08/12 13:35:45 | 12.08.2008 13:35:44 org.apache.catalina.startup.Catalina start
INFO | jvm 1 | 2008/08/12 13:35:45 | INFO: Server startup in 179 ms
INFO | jvm 1 | 2008/08/12 13:35:46 | WrapperStartStopApp: start(args) end. Main Completed=false, exitCode=null
INFO | jvm 1 | 2008/08/12 13:35:46 | returned from listener.start()

Re:Single Sign On occasional problem

sarah — GMT

Hi,

Please contact us at helpdesk@ilient.com

Thanks

Sarah

Re:Single Sign On occasional problem

harvey — GMT

Hi All,
We have exactly the same problem with almost the same environment
Our settings are:
- SysAid Server is installed on WMVare virtual environment that hosts Windows 2003 server.
- SysAid version is v6.5.08
- Database is Derby hosted on the same server
- SSO is enabled and implemented against AD
- Users and administrators are accessing SysAID with XP machines, IE 6 or 7 installed. Administrators have tried also access using Firefox. If all works, it works with Firefox too. If SSO failure occurs, neither browser works.

As with user [b]alland[/b] SysAid helpdesk has helped us cover all the obvious problems to the extent that one of the SysAid Helpdek support personnel has remotely connected to the server and did a clean reinstall of SysAid with no result on solving our problem.

Every morning we have to stop the service disable SSO, start the service, stop the service again and enable the SSO and again start the service.

Next step we did (as suggested by SysAid Helpdesk) we implemented SysAid with IIS 6.0. This hasn’t resolved the issue just made my job a little easier, now I have to restart the service only once per day to make it work properly.

This issue is procrastinating for about a month now and no resolution is nearing. If anybody has any new information or ideas on what to check and where to check it?
Is the problem in running SysAid in virual environment? Is the problem in Derby database? Help please!!

Re:Single Sign On occasional problem

alland — GMT

When sysaid support last said (see in thread upwards) "I think that we could workaround that problem by disabling SSO (with jcifs), integrating SysAid with IIS and then enable Integrated Windows Authentication on IIS." then I also tried their solution (using Windows integrated authentication via IIS) but messing with all kinds of conf files it did not work out.

Then Sysaid support did remote session to our server, didn't reinstall anything but got my IIS redirection and Tomcat properly working together.

I use also Windows 2003 on VMWare virtual server (VSphere 4 infrastructure) , IIS 6, but with MySQL (on the same machine). Since last "intervention" by Sysaid person SSO works fine.

It just tries to be a kind of encuragement, that Sysaid people should be able to cure your problem too... when they are back from Vegas or so

Re:Single Sign On occasional problem

wbeers — GMT

A tip I've found useful is to force the computer to send LM & NTLM responses via Group Policy...

Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network security: LAN Manager authentication level set to "Send LM & NTLM responses".

This fixed my issue with SSO not working correctly on Windows 7 Professional 32-bit / Internet Explorer 8 and SysAid 7.0.04 with tomcat, Microsoft SQL Server and the jcifs single sign-on module.

Re:Single Sign On occasional problem

argentieri — GMT

Has anyone found a solution?
I have the same probela some time and I do not know how to fix it.
Only for a period (when I had version 6.5) did not give me problems.
For several days I installed version 7 and the problem has returned.
Waiting for news

Re:Single Sign On occasional problem

Joseph Zargari — GMT

I wanted to jump in and say that SSO issue could be caused by several different things and a problem one environment would not necessarily be similar to a problem on another environment (eventhough same symptoms occur).
I really think that the best way to handle each of these issues individually within our helpdesk. Please submit a service request with our helpdesk and we'll look into your issue.

Thanks,
Joseph.

Re:Single Sign On occasional problem

AMTomaz — GMT

Hi!

Our company recently bought sysaid.
We implemented it, SSO did not work, it worked in trial mode!

I filed support ticket, got some help to integrate it with IIS, and that did not resolve my issues, now i am emailing you for 3 days and i do not get any response back!
Come on guys, i need to resolve this issue ASAP!

Re:Single Sign On occasional problem

argentieri — GMT

I have the same problem with Windows XP and Internet Explorer 8.
With IE7 and the solution (Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network security: LAN Manager authentication level set to "Send LM & NTLM responses") worked ... but now updating IE8 is back on the problem!

Re:Single Sign On occasional problem

SPOC — GMT

[quote]
argentieri 12/07/2010 12:13:07 Subject: Re:Single Sign On occasional problem

--------------------------------------------------------------------------------

I have the same problem with Windows XP and Internet Explorer 8.
With IE7 and the solution (Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network security: LAN Manager authentication level set to "Send LM & NTLM responses") worked ... but now updating IE8 is back on the problem!
[/quote]

Hi Argentieri
do you have tried to use IIS ? if no, install IIS, I know that similar issue have been resolve installing IIS.

Stefano

Re:Single Sign On occasional problem

nicks81 — GMT

I have SSO working fine on XP Pro SP3 / IE8

But on Windows 7 Professional 32bit with IE8, users are prompted to authenticate & no matter what you enter in their account ends up locking out & never letting them in

I will post back if I work out what the problem is

Single Sign On occasional problem

SillyGroupIT — GMT

Exactly the same issue as reported above, running a mixture of Win Vista (32bit) and Win 7 (64bit), with the helpdesk running on a VM install of Windows XP.

Very frustrating as other than this issue, we'd be ready to go live with the system and roll it out to our end users.

Single Sign On occasional problem

NWG-IT — GMT

[quote=SillyGroupIT]Exactly the same issue as reported above, running a mixture of Win Vista (32bit) and Win 7 (64bit), with the helpdesk running on a VM install of Windows XP.

Very frustrating as other than this issue, we'd be ready to go live with the system and roll it out to our end users.[/quote]

[b]Did you try the following?[/b]
-------------------------------------

In order to enable SSO on windows 7 systems, please follow the below instructions:
Go to Local Security policy > Security settings > local policies > security options Select Network security > Lan manager Authentication level and change it to "Send LM & NTLM responses

To configure single sign-on using the built-in Tomcat web-server, please edit the serverConf.xml file located at ...\SysAidServer\root\WEB-INF\conf. Add the following lines after the line none:

jcifs.smb.client.domain
ACME

jcifs.http.domainController
DC1.acme.com

jcifs.smb.client.username
username_on_AD

jcifs.smb.client.password
password_of_the_above_username

jcifs.smb.lmCompatibility
3

Make sure to replace:
1. ACME with the NetBIOS domain name (pre-Windows 2000) 2. DC1.acme.com with the hostname or IP address of your domain controller.
3. username_on_AD with a user-name on Active Directory (Any domain user should be fine; no administrative permissions are necessary. Make sure to set “password never expires” so that the integration will not break whenever the password expires.) 4. password_of_the_above_username with the password of the mentioned user account.

After saving these changes, please restart the SysAid Server service to apply the new integration.

If all of the above does not help, there is an additional change that has to be made in the Domain Controller Security Settings. Find Local Policies\Security Options and then set the Network Security -> LAN Manger Authentication Level to LM and NTLM responses. Other values may apply as well. [b]This is the one that worked for us[/b].

Re:Single Sign On occasional problem

SillyGroupIT — GMT

Hi NWG-IT,

Yup, all of those have been setup, including the local policy settings. Its just bizarre how one moment I can be logged in (as a Sysaid admin), make a few changes, the suddenly, one mouseclick later, find myself unable to log in.
Other colleauges arent able to log in at all using SSO, whereas others can get in right away.

Re:Single Sign On occasional problem

Joseph Zargari — GMT

Hey SillyGroupIT,

I highly recommend that you submit a service request with us. We can remote into you computer and troubleshoot this with you.

Thanks,
Jospeh.

Re:Single Sign On occasional problem

Theo van Asperen — GMT

We also used to have SSO problems, until we integrated SSO with IIS. Works as a charm, also with W7 clients.

Single Sign On occasional problem

SillyGroupIT — GMT

Just an update, we've managed to get it working (with the help of Erez @ Sysaid). Whilst all our settings for IIS and so on seemed to be fine, it turned out to be a DNS issue.

He noticed that using our servername in the browser would connect and authenticate fine, but when we came to use "Helpdesk" (which was pointing to the servers IP via DNS), we had no joy.

We were able to fix this by changing the DNS from an A Record to a C Record and pointing "helpdesk" to the server name.

Thanks for everyones help and suggestions.

Re:Single Sign On occasional problem

erez.shin — GMT

Thank you very much for the positive feedback.

I am very happy to hear that you have manage to solve the DNS issue.

Always happy to assist

Best Regards,

Erez Shindelman

Re:Single Sign On occasional problem

dime — GMT

Has sysaid 7.5 fixed this so the "Send NTLM and LM" responses policy is no longer needed? We didn't want to set this policy as it downgrades security for our entire network... but we wanted single sign-on to sysaid so we are running a mix of IIS and tomcat at the current moment, which is a real pain.

Re:Single Sign On occasional problem

Joseph Zargari — GMT

Hey dime,

SysAid 7.5 still doesn't support the NTLMv2 authentication protocol. We're still working on implementing this.

Thanks,
Joseph.

Re:Single Sign On occasional problem

dime — GMT

I just tested a separate install of SysAid Enterprise and it seems to work? Would be interested if anybody else would test and validate?

Our LAN Manager authentication level is set to "Send NTLMv2 response only/refuse LM" for all domain controllers and PCs.

At this level, it seems as long as you provide the jcifs.smb.lmCompatibility = 3 value as below in serverConf.xml, SSO via tomcat using NTLMv2 authentication works.

jcifs.smb.lmCompatibility
3