IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Junction not working when Backend was down and comes back online

    Posted Mon January 20, 2025 10:57 AM

    Hi Team,

    quite some weeks ago we started facing an issue that a junction keeps being down even if the backend is online again. I suspect this happens after a longer period being down. Probably several hours. Our dev team uses junctions to there local dev environments for developing their portal apps against AAC info maps. For this junctions we are facing the problems. Open the Jct and save ist solves the issue but causes a lot of support. It may be in conjunction with the 10.0.8 update, but not sure it is.

    Any hint welcome :D



    ------------------------------
    Jens Petersen
    ------------------------------


  • 2.  RE: Junction not working when Backend was down and comes back online

    Posted Mon January 20, 2025 03:41 PM

    Jens,

     

    Generally a junction is marked down when a health check fails.  A health check fails if the server cannot be reached, or if certain responses are received from the junctioned server (controlled by the 'ping-XXX' configuration entries and the 'rsp-code-rules' configuration entry within the junction stanza).  I would double check your configuration here.

     

    I would also check the WebSEAL log file for any hints as to what is happening.  If you have a machine which is in this bad state you could also switch on pdweb.snoop.jct tracing to see exactly what is being sent to, and received from, the junction.

     

    I hope that this helps.

     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access

    IBM Master Inventor

    cid4122760825*<a href=image002.png@01D85F83.85516C50">

    Phone: 61-7-5552-4008
    E-mail: scotte@au1.ibm.com

    1 Corporate Court
    Bundall, QLD 4217
    Australia

     

     

     






  • 3.  RE: Junction not working when Backend was down and comes back online

    Posted Mon January 20, 2025 03:59 PM

    Hello Scott,

    thanks for the hints. I'm aware of this points, just the question is why doesn't the junction comes back. I'd working perfect for servers not going down for several hours or even once it's opened and saved again. Guess that just recreates the Jct as I'd do with pdamin. And this behavior is occurs for a few weeks while the issue - server down for a longer period - is  same since about 4 years. 



    ------------------------------
    Jens Petersen
    ------------------------------



  • 4.  RE: Junction not working when Backend was down and comes back online

    Posted Mon January 20, 2025 04:16 PM

    Jens,

     

    I can't explain why the junction would never come back.  My best suggestion is the next time that you have a server which is in this state, to switch on pdweb.snoop.jct tracing. 

     

    Thanks.

     

     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access

    IBM Master Inventor

    cid4122760825*<a href=image002.png@01D85F83.85516C50">

     

     

     






  • 5.  RE: Junction not working when Backend was down and comes back online

    Posted Tue January 21, 2025 02:57 AM

    Hi Scott,

    thanks, good point, going to try that and see whats coming out. But my feeling is that there is any internal problem, not an external. The snoop gives you what is coming to and going from the port, right? Is there any option disabling the ping on backend?



    ------------------------------
    Jens Petersen
    ------------------------------



  • 6.  RE: Junction not working when Backend was down and comes back online

    Posted Tue January 21, 2025 04:01 PM

    Jens,

     

    I agree that it is possibly an internal problem.  The snoop trace will tell us if WebSEAL is attempting to connect to the server, and whether the connection is successful. 

     

    If you want to disable the ping you just need to set the 'ping-time' configuration entry to 0.

     

     

    Scott A. Exton
    Senior Software Engineer
    Chief Programmer - IBM Security Verify Access

    IBM Master Inventor

    cid4122760825*<a href=image002.png@01D85F83.85516C50">