test

Sun Identity Manager 8.1 System Administrator's Guide

Troubleshooting and Fixing Common Problems

Use the information provided in the following sections to help diagnose and fix problems you might encounter as you work with Identity Manager:

Note –

For additional troubleshooting information, including the Identity Manager FAQ, go to the following URL:

https://sharespace.sun.com/gm/document-1.26.2296/IdM_FAQ.html?

You must sign up for a Share Space ID to access information provided on this site.

Working with Debugging Tools

You can use several different debugging tools to help identify and fix problems in your Identity Manager deployment. These tools include:

Using the Identity Manager Debug Pages

You can use Identity Manager Debug pages to help identity and fix problems in your deployment. For example, you can enable or disable tracing for various activities and objects, collect statistical information, verify that processes are running, or investigate bottlenecks and memory problems.

The following table describes the most commonly used Debug pages and their actual .jsp file names.

Note –

For a comprehensive list of all Identity Manager Debug pages, open a command window and list the contents of the idm/debugdirectory.

Table 5–5 Identity Manager Debug Pages

Page Name 

Use This Page to 

Control Timings (callTimer.jsp)

Collect and view call timer statistics for different methods. You can use this information to track bottlenecks to specific methods and invoked APIs. You can also use options on the Call Timings page to import or export call timer metrics, such as. 

  • How long to fetch initial User view (with no resources) during a scan

  • How long to refresh initial User view (including resources) during a scan

  • How long to evaluate policy on the User view

  • How long each user scan takes (including User view fetch, policy evaluation, and so forth)

  • How long to fetch a list of users for an access scan

  • How long to evaluate the attestation rule in access review

Note –

Call timing statistics are only collected while trace is enabled.

Edit Trace Configuration (Show_Trace.jsp)

Enable and configure trace settings for the Java classes provided with your Identity Manager installation. You can specify  

  • Which methods, classes, or packages to trace and the level of trace.

  • Whether to send trace information to a file or to standard output and how dates and times are formatted in the trace output file.

  • Maximum number of trace files to store and the maximum size of each file.

  • Specify the maximum number of methods to be cached.

  • Indicate how to write data to the trace file and whether to write data to the trace file as data is generated or to queue and then write the data to a file.

Host Connection Pool (Show_ConnectionPools.jsp )

View connection pool statistics (if you are not using a data source), including pool version, how many connections were created, how many are active, how many connections are in the pool, how many requests were serviced from the pool, and how many connections were corrupted. 

You can also use the Host Connection Pool page to view a summary of the connection pools used to manage connections to the Gateway. You can use this information to investigate low-memory conditions. 

List Cache Cleared (Clear_XMLParser_Cache.jsp)

Clear recently used XML parsers from the cache and investigate low memory conditions. 

Method Timings (Show_Timings.jsp)

Detect and assess hotspots at a method level. Use this page to gather information from Identity Manager methods, including: 

  • Method names

  • How many times the methods were called

  • How many times the methods exited with an error status

  • Average time consumed by the methods

  • Minimum and maximum times consumed by invocations of each method

Object Size Summary (Show_Sizes.jsp)

Detect problematically large objects that can affect your system. This page shows the size of objects (in characters) stored in the repository, including the objects’ total combined size, average size, maximum size, and minimum size. Click entries in the Type column to view the ID, name, and size of the largest configuration objects in the repository. 

Provisioning Threads for Administrator Configurator (Show_Provisioning.jsp)

View a summary of provisioning threads in use by the system (a subset of the information available in Show_Threads.jsp).

System Cache Summary (Show_CacheSummary.jsp)

View the following information to investigate low-memory conditions: 

  • Administrator-associated object caches

  • System object cache

  • User login sessions

  • XML parser cache

System Memory Summary (Show_Memory.jsp )

View how much total and free memory is available (in MB) when you are using memory-intensive functionality, such as reconciliation, to help determine whether there is sufficient memory allocated to the JVM. You can also use this page to launch garbage collection or to clear unused memory in the JVM for investigating heap usage. 

System Properties (SysInfo.jsp)

View information about your environment. 

System Threads (Show_Threads.jsp)

View which processes are running to verify that automated processes are running. Includes information about the process type, process name, priority, if the process is a daemon, and if the process is still alive (running). 

User Session Pool Cleared (Clear_User_Cache.jsp)

Use the Session Pool Clearer page to investigate low memory conditions. 

Waveset Properties (Show_WSProp.jsp)

View and temporarily edit properties in the Waveset.properties file. Edited property settings remain in effect only until the next server restart.

XML Resource Adapter Caches Flushed and Cleared (Clear_XMLResourceAdapter_Cache.jsp )

Clear test XML resource adapters from the cache and use to investigate low memory conditions. 

Note –

See Working With Identity Manager Debug Pages for more information about these Debug pages.

ProcedureTo Access Individual Identity Manager Debug Pages

Before You Begin

You must have the Debug capability to access and execute operations from the Identity Manager Debug pages. If you do not have the Debug capability, an error message results. Administrators and the Configurator are assigned the Debug capability by default.

  1. Open a browser and log into the Administrator interface.

  2. Type the following URL to open the System Settings page:

    http://host:port/idm/debug

    where:

    • host is the local server on which you are running Identity Manager.

    • port is the number of the TCP port on which the server is listening.

      From this page, you can enable or disable tracing for various Identity Manager activities and objects and use the information displayed on these pages to troubleshoot problems in your deployment.

      Some Debug pages are not linked to the System Settings page, and you must type the page’s .jsp file name to open the page. For example:

      http:// host:port/idm/debug/pageName.jsp

      Where pageName.jsp is the particular Debug page you want to open.

Using Identity Manager IDE

The SunTM Sun Identity Manager Integrated Development Environment (Identity Manager IDE) is Java application that enables you to view, customize, and debug Sun Identity Manager (Identity Manager) objects in your deployment.

Specifically, the Identity Manager IDE provides a graphical Debugger that you can use to debug Identity Manager forms, rules, and workflows. You can use this Debugger to set breakpoints and watches, step through code, examine and modify variables, examine classes and the callstack, follow threads, and run multiple sessions.

Instructions for installing and configuring the Sun Identity Manager Integrated Development Environment (Identity Manager IDE) are now available from the following URL:https://identitymanageride.dev.java.net.

Using Identity Manager System Monitoring

You can configure Identity Manager system monitoring to track system events. System monitoring collects and aggregates statistics at various levels to present a real-time view of system events, based on your specifications.

Viewing this information in dashboard graphs enables you to quickly assess system resources, view abnormalities, understand historical performance trends, and interactively isolate problems before looking at audit logs. Although dashboards do not provide as much detail as audit logs, dashboards can indicate where to look for problems in the logs.

For more information about dashboards and system monitoring, see Chapter 8, Reporting, in Sun Identity Manager 8.1 Business Administrator’s Guide.

Working With Adapter Logs

Adapter logs capture information about the adapter that is currently processing. You can use this information to monitor the adapter’s progress and to diagnose and debug adapter problems.

Note –

You must enable tracing and identify the methods for which tracing is requested before any logging can occur. Also, your customized adapter must include calls that create log entries for new methods.

Nearly every adapter has its own log file, path, and log level. You can specify the level of detail captured by the adapter log, along with these other values in the Logging section of the Synchronization Policy for the appropriate Identity Manager or Service Provider user type.

For more information about using adapter log files as a debugging tool, see Troubleshooting Adapters.

Debugging with DTrace

DTrace is a comprehensive, dynamic tracing framework for the Solaris operating environment. DTrace provides more than 30,000 probes into your production system and integrates user- and kernel-level tracing. You can use DTrace to monitor JVM activity. This facility also allows you to use the D language (similar to C or awk) to trace arbitrary data and expressions.

Debugging with JConsole

The Java Monitoring and Management Console (JConsole) is a Java Management Extension (JMX) technology-compliant graphical management tool bundled with JDK 5 (and later). JConsole connects to a running JVM and gathers information from the JVM MBeans in the connected JMX agent.

For example, you can use JConsole to

Note –

For more information about JConsole, see the article titled, Using JConsole to Monitor Applications. You can view this article from the following URL:

http://java.sun.com/developer/technicalArticles/J2SE/jconsole.html

Debugging Errors Displayed in the Browser

If a red error message displays in the Identity Manager interface after you have performed an action, you might be able to view more complete information and further analyze the error by viewing and saving the page source.

To view the page source

    If you still need help resolving the problem,

  1. View the page source, and then select File -> Save to save the file to your system.

  2. Locate the error in your saved file.

  3. Send the error information, the URL from the page where the problem occurred, and a description of the problem in an email to Sun Support for resolution assistance.

Troubleshooting Adapters

To troubleshoot an adapter, review the adapter’s log file. Almost all adapters write their resource settings to a log file, and you can use this information to confirm that the adapter started and that all setting changes have been saved.

Note –

You must enable tracing and identify the methods for which tracing is requested before any logging can occur. Also, your custom adapter must include calls that create log entries for new methods.

If necessary, review Tracing the Identity Manager Server for instructions about how to enable tracing.

Most adapter log files are located in the $WSHOME/config directory and they are named WSTrace1.log.

Active Sync-enabled adapters that make log calls to the ActiveSyncUtil instance create a log file or set of log files in a directory specified by the Log File Path resource attribute. Be sure to check these log files for additional Active Sync-related log entries.

The information in this section is organized as follows:

To Debug an Adapter

    Follow these general steps to debug your custom adapter.

  1. Create a test program for your adapter, and be sure this Java file performs the following basic functions:

    1. Create a new resource

    2. Create a user

    3. Get a user

    4. Update a user

    5. Delete a user

    6. Perform create, get, update and delete operations on multiple users

      Note –

      A sample test file (SkeletonResourceTests.java) is provided in the /REF directory on your installation CD.

  2. Set an appropriate logging level for debugging.

    For example, for the first debugging pass, increase the logging level to 4 (maximum debugging output), set the log file path, and specify a maximum file size.

    When you start the adapter, all of the resource settings are written to the log file. You can use this information to validate that the adapter started and that all setting changes were saved.

  3. Compile and test your adapter.

    • To compile the test program, open a command window and enter the javac -d . test/filename.java command. This command creates the class file in the appropriate com/waveset/adapter/test directory.

    • To test your new adapter using this class file, be sure that your compiled adapter is in the com/waveset/adapter directory and use the following command to run the adapter:


      java– D waveset.home=path com.waveset.adapter.test.
MyResourceAdapter

  4. Create an HTML help file for your resource.

    Note –

    • Example help files are supplied in the idm.jar file located in the com/waveset/msgcat/help/resources directory.

    • See Sun Identity Manager Deployment Reference for information about how to include online help with the application.

  5. (For Active Sync-enabled adapters only) To reset synchronization on the last resource, delete the XmlData SYNC_resourceName object.

  6. Read the error log and modify the adapter.

  7. Reset the logging level.

    For example, specifying Level 2 debugging yields information about the adapter settings and any errors, but limits the amount of log detail to a manageable level.

  8. Before starting Identity Manager, you must identify the new adapter in the $WSHOME/config/Waveset.properties file by placing the adapter name under the resource.adapters entry or Identity Manager cannot recognize the adapter.

  9. Install your adapter and its associated help file into Identity Manager.

    Note –

    Before Identity Manager can recognize an instance of a new adapter in the display, you must create a new resource of that type from the List Resource page.

    From this page, select New -> new adapter and use the Resource Wizard to create the new adapter.

  10. Use Identity Manager to create a resource and a user on that resource.

    Tip –

    When troubleshooting an Active Sync-enabled adapter, if you edit the XmlData SYNC_resourceName object to remove the MapEntry for the Active Sync synchronization process from the Debug page, the adapter starts over from the first detected change.

    If you used the IAPI event, you must set the Property() method to store synchronization state for the resource, such as a last change processed value. Setting this method is very useful for troubleshooting adapters. You can set the adapter to run and ignore past changes. Subsequently, you can modify the adapter and see your change results in the adapter log file.

    If your resource is an Active Sync resource, you might see additional information if you enable logging on the resource edit page. Set the logging level (0-4) and the file path where the log file will be written (as resource_name.log).

  11. (For Active Sync-enabled adapters only) Restart synchronization for the last resource.

To Debug LoginConfig Changes

To debug LoginConfig-related changes to your adapter, you must

  1. Enable trace for the selected files and trace the following classes at Method/Class Level 1 trace:

    • com.waveset.security.authn.WSResourceLoginModule

    • com.waveset.session.LocalSession

    • com.waveset.session.SessionFactory

    • com.waveset.ui.LoginHelper

    • com.waveset.ui.web.common.ContinueLoginForm

    • com.waveset.ui.web.common.LoginForm

  2. Test Single Sign-On (SSO) pass-through authentication login through Telnet as follows:

    1. After correctly configuring the SSO login module, telnet directly to the HTTP port and send an HTTP request to login.jsp.

    2. Paste the following request, which contains an SSO login module that looks for the sm_user HTTP header, into your telnet session:


      HEAD /idm/login.jsp HTTP/1.0
Accept: text/plain,text/html,*/*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0
Host: LOCALHOST
sm_user: Configurator

      A trace displays to indicate that your user has logged in correctly. For example:


      2003.07.08 14:14:16.837 Thread-7 
WSResourceLoginModule#checkForAuthenticatedResourceInfo()
Found authenticated resource accountId, ’Configurator@Netegrity 
SiteMinder’on Identity Manager user ’Configurator’. 
null null 2003.07.08 14:14:16.837 
Thread-7 WSResourceLoginModule#checkForAuthenticatedResourceInfo()
Exit null null 2003.07.08 14:14:16.837 Thread-7 WSResourceLoginModule#login()
Exit, return code = true null null 2003.07.08 14:14:16.847
Thread-7 LocalSession#login() Login succeeded via Netegrity SiteMinder 
null null 2003.07.08 14:14:16.847 Thread-7 LocalSession#login() 
Overall authentication succeeded null null 2003.07.08 14:14:16.897 Thread-7 
LocalSession#checkIfUserDisabled() 
Entry null null 2003.07.08 14:14:16.897 Thread-7 
LocalSession#checkIfUserDisabled() Exit 
null null 2003.07.08 14:14:16.927 Thread-7 LocalSession#login() 
Exit null null

To Debug Adapter Connection Problems

This section describes methods for debugging some common adapter connection problems.

The topics in this section are organized as follows:

Note –

Generally, you can identify adapter connection issues by tracing the adapter class com.waveset.adapter.adapter_classname. For example:

com.waveset.adapter.ADSIResourceAdapter

If necessary, review instructions for enabling trace in Tracing the Identity Manager Server.

Adapter Authentication Problems

Some common authentication problems include

Active Sync Adapter Problems

The most common problems with custom Active Sync adapters are form-related. These errors generally occur because you have not provided necessary information, such as password or email information, in a required field.

Identity Manager prints form validation errors to the adapter log after the final XML of the view. For example:


20030414 17:23:57.469: result from submit (blank means no errors):
 20030414 17:23:57.509: Validation error: missing required field password

Identity Manager also prints all messages to the adapter log. These messages include account creation and update times, adapter errors, and a summary of the schema map data.

Active Sync resource adapters store information about the last change processed in the SYNC.resourceName XMLData object.

Domino Gateway Adapter Problems

Following are some common Domino gateway and adapter configuration errors and instructions for fixing these problems:

Mainframe Host Adapter Problems

When RACF, ACF2, or TopSecret host adapters fail to reuse or cache connections, users are forced to log in frequently, which negatively impacts performance. Generally, the cache timeout setting causes this problem.

    To check the cache timeout setting, trace Identity Manager’s adapter connection pool as follows:

  1. From Identity Manager’s Edit Configuration Object page, trace the com.waveset.adapter.HostConnPool#reapConnections method at level 4.

    If necessary, review instructions for enabling trace in Tracing the Identity Manager Server.

  2. Capture trace for a sufficiently long period of time (at least 30-60 minutes), while the adapter performs operations.

  3. Review the trace output in the application server stdout or trace file and look for Info reaping connection entries.

    If this entry occurs more than once every 30 minutes, you have a good indication that connections are being timed out unnecessarily.

    To resolve this problem, increase the Idle Timeout resource attribute value to prevent connections from being reaped too frequently. The Idle Timeout attribute controls how long a connection remains idle before the connection is logged out. The default value is 90 seconds, which causes new logins to occur frequently.

    Ideally, specify a value that is greater than the average idle time for your deployment environment. For example, adjust the Idle Timeout attribute to 30 minutes (1800000 milliseconds) or more.

PeopleSoft Adapter Problems

This section describes methods for troubleshooting the following PeopleSoft adapter problems:

SAP Adapter Problems

If an error results when you try to test the connection from an SAP or SAP HR Active Sync adapter to the SAP system, open a command window and run this command from your installation directory WEB-INF/lib:

java -jar sapjco.jar

The sapjco.jar command shows which version of the SAP Java Connector (JCO) is installed and whether the adapter is installed correctly. The command also returns the JavaTM Native Interface (JNITM) platform-dependent and the RFC libraries that communicate with the SAP system.

If these platform-dependent libraries are not found, consult the SAP documentation to find out how to correctly install the SAP Java Connector.

UNIX Adapter Problems

This section contains information about debugging some common problems with UNIX adapters.

Troubleshooting Auditor

You can trace the following methods to troubleshoot issues with Identity Auditor:

In addition, you can set the following hidden flags by modifying Forms or TaskDefinitions:

In addition, the Show Timings page (/debug/callTimer.jsp) provides the following information:

Troubleshooting ClassNotFound Exceptions

In the event of a ClassNotFound exception error, verify that the missing class is included in the server's classpath. If the classpath is configured properly, try configuring your application server such that the application class loader loads before the parent class loader. Sometimes loading the application classpath before the server classpath can resolve this issue. Consult your application server documentation for instructions.

Troubleshooting Form Problems

This section describes some common form problems and how to fix these problems.

Troubleshooting the Gateway

When troubleshooting the Sun Identity Manager Gateway, it is often useful to run the Gateway from the command line. Using command line options allows you to input a wider range of start-up options, which includes starting the Gateway as a normal application instead of a service and running the Gateway on a different port.

Note –

You must kill the Identity Manager Gateway as a service before running it from the command line. For example, type

gateway.exe -k

The following table describes the Gateway command line arguments.

Argument 

Description 

-i 

Install this program as an NT service, with specified startup 

-r 

Remove this program from the Service Manager 

-s 

Start the service 

-k 

Kill the service 

-t 

Set start-up for an existing service 

-d 

Debug, and run as a regular application 

-p 

Specify a TCP/IP port number (Default is 9278) 

-f 

Specify the path to the trace file 

-l 

Specify the level of tracing (Default is 0, no information) 

-m 

Specify the maximum trace file size in kilobytes 

-v 

Display the version 

Usage: gateway -i n -r -s -k -t n -d -p n -f name -l n -m n -v.

Note –

You can also use the Identity Manager Gateway Debug page (debug/Gateway.jsp ) to troubleshoot the Gateway. See How to Configure Tracing from the Gateway Debug Page for more information.

Troubleshooting Java Code Problems

If you have the basic Java programming skills required to work with Identity Manager, you should be able to diagnose and resolve most Java code problems.

However, a fairly common problem occurs where someone opens a connection to the database but does not close the connection properly. If you do not close the connection properly, performance issues result.

Troubleshooting Low Memory Conditions

This section describes tools that you can use to investigate low memory conditions, including:

From the Identity Manager Debug Pages

Note –

You must have the Debug capability to access and execute operations from the Identity Manager Debug pages. Administrators and the Configurator are assigned this capability by default.

If you do not have the Debug capability, an error message results.

You can open the following Identity Manager Debug pages from the Administrator interface to monitor how much memory is being used by your system:

From JConsole

Use the Java Monitoring and Management Console (JConsole) to detect low memory and deadlocks. JConsole is a Java Management Extension (JMXTM) technology-compliant graphical management tool that is co-packaged with JDK 5 (and later).

JConsole accesses the memory system, memory pools, and MBeans garbage collector to provide information about memory use such as memory consumption, memory pools, and garbage collection statistics. In addition, You can use JConsole to monitor MBeans for information about current heap memory use and non-heap memory use.

Note –

For information about using JConsole to monitor applications that run on the Java platform, see Using JConsole to Monitor Applications. This document is available from the following URL:

http://java.sun.com/developer/technicalArticles/J2SE/jconsole.html

Troubleshooting PasswordSync Problems

When you are trying to troubleshoot problems with PasswordSync, review the following logs for information:

Some common PasswordSync problems and solutions include

Troubleshooting Reconciliation Problems

When you are trying to troubleshoot problems with a reconciliation task, review the Reconciliation Status Debug page ( debug/Show_Reconciler.jsp) to see what the resource threads are working on.

Some common reconciliation problems include

Troubleshooting Repository Connection Problems

Identity Manager’s lh commands are very useful when you are troubleshooting connection problems. These commands use Identity Manager’s web application installation, but remove the application server from the equation.

This section describes the following

Using lh Commands to Debug Problems

This section describes how to use the lh commands; starting with using the more basic commands and progressing to using commands that exercise most of Identity Manager.

After becoming familiar with these debugging tools, you can develop your own variations for using these lh commands.

Using lh setRepo -c -n

Use the lh setRepo -c -n command to perform the most basic connection test, which allows you to examine the current repository location without connecting. You can use this command to verify that parameters, such as URL and JDBC driver, are correct.

Using lh setRepo -c -v

Use the lh setRepo -c -v command to connect to and examine the current repository location. (The -v provides verbose output.) You can use this command to exercise almost all of the Repository code without requiring the Identity Manager server.

Note –

For more information, see Testing DataSource Connections.

Using setRepo

Use the setRepo command throughout the debugging process, to specify a new repository location or to set the repository to the same location.

You can use this command to confirm that all of the necessary components, such as the JAR files, are in place. The setRepo command also lets you vary connection information, such as userid and password, to debug table ownership or privilege problems.

Using lh console

Use this command to actually start an Identity Manager Server using the JAR files in the WEB-INF/lib and the classes in WEB-INF/classes under WSHOME. The lh console command uses your Identity Manager installation environment and actually starts the Identity Manager application, but removes the application server from the equation.

Testing DataSource Connections

If you are testing a DataSource connection, the lh setRepo -c command might fail.

This failure is especially likely if you configured Identity Manager to use the application server’s database connectivity service or the application server’s directory service. These services often work only in the environment that a running application server provides to a web application.

Initially, approach the DataSource configuration you want in a step-by-step manner. Once you are comfortable with these steps, you can adapt your approach to suit your needs.

  1. Try using a direct JDBC DriverManager connection, such as a non-DataSource connection, that bypasses the application server’s database connectivity service.

  2. Use a DataSource, but store the DataSource object in a directory service other than application server’s directory service.

    Note –

    If you have no other directory service available, you can download a free directory service, including the reference implementation of JNDI that uses only the local file system.

    If these steps work, you have localized the problem to the application server.

    Then, if useful, you can add the application server’s database connectivity service or the application server’s directory service, whichever service works outside of the environment that the application server provides to web applications.

Troubleshooting Server-Related Problems

You can analyze your application server logs for fatal errors and other server-related problems.

To troubleshoot server problems, use the application server’s Administrative Console to increase the logging level for each module. For more information, see the product documentation supplied with your server.

Most application servers have a standard location for standard out files (stdout) and standard error files (stderr) for the JVM running the application server. To analyze your application server logs, locate the logs directory or the log files specified for your Identity Manager application server.

Note –

You will see Identity Manager start up and shut down the messages in this trace output.

Beginning with Identity Manager Version 7.1, a sealing violation exception occurs in the application server log when you use Identity Manager with Oracle 10g on Sun Application Server Enterprise Edition 8.2.

This exception generally occurs if you are using more than one Java Archive file (JAR file) containing Oracle JDBC drivers.

To prevent this problem, be sure the CLASSPATH contains only one JDBC driver JAR file, and that you use the ojdbc14_g.jar provided with Oracle 10g. In addition, you must use the ojdbc14_g.jar provided by the Oracle 10g installation to ensure correct operation.

Troubleshooting Service Provider Problems

If you are using the Sun Identity Manager Service Provider End User Login page in WebSphere, and a javax.servlet.UnavailableException occurs with a 404 error displayed in your browser, you must reset some properties in the IBM 1.5 JDK.

    Use the following steps:

  1. In the was-install/java/jre/lib directory, rename the jaxb.properties.sample to jax.properties and uncomment these two lines:


    javax.xml.parsers.SAXParserFactory=
         org.apache.xerces.jaxp.SAXParserFactoryImpl 
javax.xml.parsers.DocumentBuilderFactory=
         org.apache.xerces.jaxp.DocumentBuilderFactoryImpl

  2. Save the file and restart the application server.

Troubleshooting an SPML Configuration

    To test an SPML configuration:

  1. Open the Connect page and click Test.

    A dialog indicating that the connection was successful pops up.

  2. Open the Schema page and click Submit.

    The system displays a hierarchical view of the schemas supported by the Identity Manager server.

    If you cannot establish a successful connection

    • Double-check the URL you entered.

    • If the error you receive contains phrases such as no response or connection refused, then the problem is most likely the host or port used in the connection URL.

    • If the error suggests that a connection was made, but the web application or servlet could not be located, the problem is most likely in the WEB-INF/web.xml file.

Troubleshooting Upgrades

If you encounter problems during the upgrade, check the upgrade log files located in the $WSHOME/patches/logs directory. The file names for the logs are based on a timestamp and the stage of the upgrade.

If, following an upgrade, Identity Manager fails to start with the following exception, your JDK/JRE may be the problem:


java.lang.IllegalStateException: Error attempting to decrypt: 
Given final block not properly padded

Verify that you are using a JDK/JRE supplied by the same vendor that you were using previously. For example, you cannot upgrade to a Sun JDK if previously you were using a JDK from IBM. To fix this problem, uninstall the JDK/JRE and install the JDK or JRE from your previous vendor.