IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Junction State vs Operational State

    Posted 03/15/21 01:09 PM
    Edited by Joao Goncalves 03/15/21 01:10 PM
    Hi:

    I cannot find an appropriate explanation of what these 2 options mean, specially Junction Server State.
    Regarding Server Operational State, I can find in the documentation what it means to be in "Online" vs "Offline" state.
    I can't find anything related to "Server" state. I can see 2 possible values (not sure if there are more):
    • Not running
    • Running

    What does it mean? In my case, I can see the "Localhost" server state is "Not running" and operational Server State is "Online". What does this mean?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------


  • 2.  RE: Junction State vs Operational State

    Posted 03/15/21 02:25 PM

    Hello Joao,

    The "Server State" indicates whether a junctioned server is up and responding to HTTP requests.
    WebSEAL sends periodic "junction ping" requests to test whether junctioned servers are available.

    The server state "Running" means WebSEAL is able to connect to and the junctioned server returns a correct HTTP response to a WebSEAL junction ping.

    The server state "Not running" means WebSEAL is not able to successfully connect to a junctioned server for the junction type (TCP or SSL).  Meaning either the TCP handshake or secure handshake is failing.  I will usually debug this state with an appliance packet trace.  Driving a request for a resource on the junction server with a browser to ensure there is an attempt to connect to the junction server captured in the trace.

    There is also the "running, but does not appear to be an HTTP Server" state which means WebSEAL is able to connect to the junctioned server but the server is not responding correctly to the junction ping's HTTP request.  I will usually debug this state by capturing WebSEAL HTTP traces (pdweb.debug and pdweb.snoop) with a packet trace.

    Regards,



    ------------------------------
    Steven Hughes
    ------------------------------



  • 3.  RE: Junction State vs Operational State

    Posted 03/15/21 02:35 PM
    Edited by Joao Goncalves 03/15/21 02:35 PM
    I know WebSEAL is a cpp application.
    I suppose Junction Server could be a HTTP Server. In this case, the backend server is localhost, which means it is ISAM itself. How can Webseal fail a connection to ISAM? In fact, I have 2 junctions: /mga and /scim!
    In this case localhost, the backend server, is the AAC/Federation Runtime, running on WebSphere Liberty profile.

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 4.  RE: Junction State vs Operational State

    Posted 03/15/21 02:53 PM

    Joao,
    If the junction to the AAC/Federation Runtime is in the "not running" state, you should verify the Runtime Listening Interfaces include a "Local Interface" for the port defined in your junction and, if junction is type "SSL", the signer certificate of the runtime's certificate has been loaded into the WebSEAL certificate keyfile.  There is also a chance of the AAC/Federation runtime application server failed to properly startup or stopped running due to an error condition which would need to be debugged.
    Regards,



    ------------------------------
    Steven Hughes
    ------------------------------

    Original Message


  • 5.  RE: Junction State vs Operational State

    Posted 03/15/21 05:50 PM
    I believe the problem is in fact related to SSL.
    You tell me that I need to have WebSEAL certificate, but it is there in pdsrv, not in rt_profile_keys.

    Where should it go?

    ------------------------------
    Joao Goncalves
    Pyxis, Lda.
    Sintra
    +351 91 721 4994
    ------------------------------

    Original Message


  • 6.  RE: Junction State vs Operational State

    Posted 03/16/21 06:18 AM
    It should be in the WebSEAL Truststore. By default that would indeed be pdsrv.

    Open the pdsrv keystore in LMI and try to add the certificat via the load functionnality (Manage -> Load). Insert "localhost" as "Server" and give it a name, like "runtime".

    ------------------------------
    Laurent LA Asselborn
    ------------------------------

    Original Message


Related Content