Currently, installing and configuring Communications Express is not trouble-free. This seems especially true for a two-tiered deployment, with Communications Express on a front-end host separate from a back-end Access Manager host.
The following problem topics will aid you in troubleshooting your deployment:
Solution: Check that DNS is running and configured properly.
Make sure that the /etc/resolv.conf file has name server entries with the IP addresses of valid name servers. For example:
nameserver 192.168.100.22 nameserver 192.168.100.23 nameserver 192.168.100.24 nameserver 192.168.100.25
Make sure that the /etc/hosts file has an entry for the fully qualified host name of the server. This fully qualified host name should be listed before the non fully qualified host name. For example:
10.1.82.52 host1.red.example.com host1 loghost
SolarisTM 10 Operating System (OS) hosts: Make sure the /etc/inet/ipnodes file also has an entry for the fully qualified host name of the server.
Make sure that the /etc/nsswitch.conf file is configured to use files first to resolve host names. The hosts line in the nsswitch.conf file should list files first in its entry:
hosts: files dns nis [NOTFOUND=return] # OR (if NIS is not used) hosts: files dns
Verify that you can resolve a host name to an IP address.
# nslookup host1.red.example.com Server: 192.168.100.161 Address: 192.168.100.161#53 Name: host1.red.example.com Address: 10.1.82.52
Solaris 10 hosts: Add this additional line to the /etc/nsswitch.conf file:
ipnodes: files dns nisplus [NOTFOUND=return]
Solution: Verify the Web Server and Access Manager SDK configuration.
When configuring Communications Express in a two-tiered deployment, the following steps are involved:
Configuring the Communications Express web container’s (Sun Java System Web Server 6.1 2005Q4 SP5) server.xml file with all required jar file settings
Pointing the Communications Express Identity SSO to the external Access Manager from the uwcauth.properties file
Installing the Access Manger SDK on the same Web Server instance where the Communications Express application is running (that is, on the front-end host)
If you see errors such as the following for Web Server, then use the troubleshooting steps that follow.
[30/Jun/2005:11:05:33] failure (13862): WebModule[/uwc]: WEB2680: Exception starting filter IdentitySSOAuthFilter
Check if the Web Server runtime owner is root:other. That is, the runtime owner should be the same for Access Manager, Access Manager SDK, and Communications Express. It is preferred that the runtime owner be root:other.
If the runtime owner for Web Server is not root (but webservd), then do the following:
Check the Access Manager SDK by running the following command from the front-end AM SDK location (host).
./amadmin -u amadmin -w password -m http://host:80
You should see output similar to the following:
Get Sessions: Server Name = http://host1.red.siroe.com:80 [Current Session] User Id: amAdmin Time Remain: 120 Max Session Time: 120 Idle Time: 0 Max Idle Time: 30 To invalidate sessions, enter the index numbers [CR without a number to exit]: Success 0: Successfully completed
If Step 2 does not work as expected, then check that the Access Manager SDK classpath is correct in the Web Server on the Communications Express host (that is, the front end).
Make sure that /opt/SUNWam/lib/am_services.jar, /opt/SUNWam/lib/am_sdk.jar, and /opt/SUNWam/lib/am_sso_provider.jar are in the classpath suffix of the /opt/SUNWwbsvr/https-host.domainconfig/server.xml file.
Manually editing the server.xml file is generally not recommended. The correct way is to use the /opt/SUNWam/bin/amconfig command. See Problem: Web Server Exceptions.
Create a new state file similar to the following for the Access Manager SDK configuration.
Change to the directory that contains the amconfig input file template, amsamplesilent.
# cd /opt/SUNWam/bin
Copy the input template file to a new file.
# cp amsamplesilent amconfigcommx
Edit the amconfigcommx file to set the Access Manager SDK configuration parameters as follows (non-default values are shown in bold):
DEPLOY_LEVEL=4 SERVER_PROTOCOL=http #### (If you need secure access, change to https) SERVER_NAME=AM_SERVER_HOSTNAME #### (Access Manager hostname) SERVER_HOST=AM_SERVER_HOSTNAME_FQDN #### (Access Manager fully qualified domain name) SERVER_PORT=AM_SERVER_WEB_CONTAINER_PORT ADMIN_PORT=AM_SERVER_WEB_ADMIN_PORT DS_HOST=DS_HOSTNAME_FQDN #### (Directory Server fully qualified domain name) DS_DIRMGRPASSWD=DM_PASSWORD ROOT_SUFFIX=UG_SUFFIX ADMINPASSWD=AMADMIN_PASSWORD AMLDAPUSERPASSWD=AMLDAPUSERPASSWORD COOKIE_DOMAIN=.example.com #### (Modify to reflect default domain) AM_ENC_PWD="myQDWqCBhvI0bfp/BF/1b7+k/BiEpVcY" #### Get from AMConfig.properties file of fully installed Access Manager host NEW_OWNER=root NEW_GROUP=other WEB_CONTAINER=WS6 SSL_PASSWORD="ssl_password" #### (If SSL used) BASEDIR=/opt/SUNWam CONSOLE_HOST=$SERVER_HOST CONSOLE_PORT=$SERVER_PORT CONSOLE_PROTOCOL=$SERVER_PROTOCOL CONSOLE_REMOTE=true SERVER_DEPLOY_URI=/amserver if [ $DEPLOY_LEVEL -eq 2 -o $DEPLOY_LEVEL -eq 12 ]; then CONSOLE_DEPLOY_URI=$SERVER_DEPLOY_URI else CONSOLE_DEPLOY_URI=/amconsole fi PASSWORD_DEPLOY_URI=/ampassword COMMON_DEPLOY_URI=/amcommon DIRECTORY_MODE=4 #### DS_PORT=389 DS_DIRMGRDN="cn=Directory Manager" USER_NAMING_ATTR=uid ORG_NAMING_ATTR=o ORG_OBJECT_CLASS=sunismanagedorganization USER_OBJECT_CLASS=inetorgperson DEFAULT_ORGANIZATION= JAVA_HOME=/usr/jdk/entsys-j2se AM_REALM=disabled #### (For legacy use) PLATFORM_LOCALE=en_US XML_ENCODING=ISO-8859-1 NEW_INSTANCE=false ############### Required for Web Server ############################### WS61_INSTANCE=https-COMMS_EX_HOSTNAME_FQDN ####Modify to reflect front-end hostname WS61_HOME=/opt/SUNWwbsvr WS61_PROTOCOL=$SERVER_PROTOCOL WS61_HOST=COMMS_EX_HOST ####NOT $SERVER_HOST in an AM SDK remote AM Server configuration WS61_PORT=COMMS_EX_PORT ####NOT $SERVER_PORT in an AM SDK remote AM Server configuration WS61_ADMINPORT=$ADMIN_PORT WS61_ADMIN="admin" WS61_IS_SECURE=false DIRECTORY_MODE=4 DS_PORT=389 DS_DIRMGRDN="cn=Directory Manager" USER_NAMING_ATTR=uid ORG_NAMING_ATTR=o ORG_OBJECT_CLASS=sunismanagedorganization USER_OBJECT_CLASS=inetorgperson DEFAULT_ORGANIZATION= JAVA_HOME=/usr/jdk/entsys-j2se AM_REALM=disabled
Make a backup copy of the /etc/opt/SUNWam/config/AMConfig.properties file. Check the content of the following lines in that file:
com.iplanet.am.directory.host=DS_SERVER_HOSTNAME_FQDN com.iplanet.am.server.host=AM_SERVER_HOSTNAME_FQDN com.iplanet.am.console.host=AM_SERVER_HOSTNAME_FQDN com.iplanet.am.profile.host=AM_SERVER_HOSTNAME_FQDN com.iplanet.am.naming.url=http://AM_SERVER_HOSTNAME_FQDN:WEBCONTAINER_PORT/amserver/namingservice com.iplanet.am.notification.url=http://COMMS_EX_HOSTNAME_FQDN:WEBCONTAINER_PORT/notificationservice
Run the following command:
/opt/SUNWam/bin/amconfig -s Newly_Created_AMSAMPLESILENT
Make sure the default domain contains the Core and LDAP services, which you can find in the Access Manager console under the Services tab.
Make sure that the uwcauth.properties reads the complete dn for the variable uwcauth.identity.binddn as shown below:
!Bind DN of AdmAdmin uwcauth.identity.binddn=uid=amadmin,ou=people,o=usergroup
Solution: Verify operation of Directory Server, availability of user, baseDN, and LDAP service property values.
Verify that the Directory Server is running.
# /usr/bin/ps -ef | grep slapd ./ns-slapd -D /var/opt/mps/serverroot/slapd-host1 -i /var/opt/mps/serverroot/slapd-host1
If necessary, start Directory Server using one of the following commands:
For example, if Directory Server 5.2 is the default version:
On Solaris: /usr/sbin/directoryserver start
On Linux: /opt/sun/sbin/directoryserver start
Check that the user ID in question exists in the directory.
ldapsearch -h host -p port -D dn -w password -s sub -b basedn "uid=uid"
This will return the user entry, if it exists, or ’No such object’ if the entry does not exist.
Check the uwcauth.properties file is using the correct baseDN and credentials.
See the following for more information:
In an Access Manager deployment, check that the LDAP service property values are valid.
Log in to the Access Manager console as amAdmin.
Under Identity Management, click the appropriate organization.
Choose Services from the View menu.
The services list should have at a minimum Authentication Configuration, and Authentication Modules Core and LDAP. Click the LDAP Properties arrow and verify the information that appears in the Data pane.
If the service is not added, continue with the steps that follow.
Click Add in the Navigation pane.
A list of available services is displayed in the Data pane.
Select the checkbox for Authentication Configuration and click OK.
The Authentication Configuration service will appear in the Navigation pane assuring you that it has been added.
Click the Authentication Configuration Properties arrow.
The Service Instance List is displayed in the in the Data pane.
Click New to add the service instance.
Type the name and click Submit.
Solution: Most likely there is a misconfiguration. Verify the SSO settings. See the following for more information:
Solution: Verify that Calendar Server is running, and that the ics.conf file is properly configured.
Verify that the Calendar Server processes are running.
# /usr/bin/ps -ef | grep cal /opt/SUNWics5/cal/lib/cshttpd -d 3 /opt/SUNWics5/cal/lib/enpd -p 57997 -c config/ics.conf /opt/SUNWics5/cal/lib/csadmind /opt/SUNWics5/cal/lib/csnotifyd
If necessary, start Calendar Server.
Change to the /etc/opt/SUNWics5/cal/config directory.
In the ics.conf file, verify that the service.http.allowadminproxy parameter is set to "yes".
Check if the virtual domain is either set to "yes" or "no" in both the ics.conf and uwcauth.properties files. It cannot be "yes" in one file and "no" in the other file.
If you make edits to either the ics.conf or the uwcauth.properties files, restart Calendar Server.
Solution: Enable logging. See the following for more information:
Refer to Chapter 1, Access Manager 7 2005Q4 Configuration Scripts, in Sun Java System Access Manager 7 2005Q4 Administration Guide, for more information on Access Manager SDK-only configuration installation notes.