IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Problem authenticating IGI 5.2.5

    Posted 05/03/19 07:52 AM
    Hi all!

    I've just finished installing a dev enviroment on VMWare Fusion 11.03 for the second time and I run in to a strange issue.
    Installing and initial configuration goes fine, but after letting the machine sleep for like 24 hours I am unable to log in.
    The problem is consistent over all channels and accounts - ssh with admin, administration and self service console using admin accounts or newly created identities.

    As long as I'm logged on to the VA I can see logs and perform configuration through that interface, but if I log out, reboot or whatever I'm permanently locked out.

    This is not an issue with stating wrong password, and the admin:admin default password does not work either... 

    The logfiles are ripe with SSL errors, but not sure if this has an impact...
    Configuration is done using the internal PostgresDB.

    ------------------------------
    Mats Hulten
    ------------------------------


  • 2.  RE: Problem authenticating IGI 5.2.5

    Posted 05/06/19 02:33 AM

    Hi Mats. With 5.2.5 (and 5.2.4) OIDC authentication is used, and it's baked into the VA. I expect you've got a time difference between your DB server and VA, OR between your desktop/laptop time (where the browser is running) and the VA. I'm not sure what the threshold is, but if the time is out by a certain amount the OIDC authentication won't work.

    You can enable OpenVM tools in your VA to allow it to sync with your host (your data server is probably already doing it). Have a look at the vmtoolsd.*** settings in https://www.ibm.com/support/knowledgecenter/SSGHJR_5.2.5/com.ibm.igi.doc/installing/ref/r_adv_tuning.html. You need to enable both to get time syncing.



    ------------------------------
    David Edwards,
    WW Tech Enablement SME for Identity Products
    IBM Security
    ------------------------------



  • 3.  RE: Problem authenticating IGI 5.2.5

    Posted 05/06/19 03:33 AM
    I actually considered that and configured the VA to use a Ubuntu VM as NTP server. Highly unsure if I got the config correct though... As I recall the local time in the IGI VM didn't change.

    I got an error message once stating that the OIDC timestamp were off and that login was denied due to that. All the other times (including now) I get a simple "Login failed" error. Is this the expected behaviour when the time difference is to great?

    Currently I only have access to the VA through the CLI. Haven't seen any option to change the internal time through that interface. Any options besides yet another reinstall?


    ------------------------------
    Mats Hulten
    ------------------------------

    Original Message


  • 4.  RE: Problem authenticating IGI 5.2.5

    Posted 05/06/19 04:17 AM
    You can get into the LMI using https://<VA host or IP>:9443/fallback. This gives you the old LMI login page.

    ------------------------------
    David Edwards,
    WW Tech Enablement SME for Identity Products
    IBM Security
    ------------------------------

    Original Message


  • 5.  RE: Problem authenticating IGI 5.2.5

    Posted 05/06/19 07:14 AM
    Great - that seems to work! Thanks a bunch for the help.
    Perhaps add this step to the install instructions?

    ------------------------------
    Mats Hulten
    ------------------------------

    Original Message


  • 6.  RE: Problem authenticating IGI 5.2.5

    Posted 05/07/19 09:33 AM
    If your VM/VA local time is off too much (disparity too great) compared to the NTP, the NTP sync will "fail" (in that it will not happen).

    Also, having gone through time sync provided by the OpenVM tools on the ISIM VA, which should be similar in the IGI VA, here's some text on what we found:

    "in regards to vmtoolsd.enabled vs vmtoolsd.timesync.enable, per the following VMWare KB https://kb.vmware.com/s/article/1318,

    vmtoolsd.enabled=true means that there is a time sync between Host/ESX and Guest during:

    • tools startup (i.e. ISIM VA reboot/power on), [so IGI VA reboot/power on]
    • taking a snapshot,
    • resuming from a snapshot,
    • resuming from suspend, or
    • vMotion.

    These events synchronize time in the guest operating system with time in the host operating system even if VMware Tools periodic time sync is disabled.

    So vmtoolsd.timesync.enable=false only disables the periodic time sync with the ESX host through VMTools."

    With NTP set, the periodic time sync will be with the NTP server and not the ESX host with vmtoolsd.enabled=true

    ------------------------------
    Neil Rampersad
    ------------------------------

    Original Message


  • 7.  RE: Problem authenticating IGI 5.2.5

    Posted 05/07/19 10:25 AM
    That fallback URL (and another one from 5.2.4 that should have been removed) is in the documentation - you just need to know where to look.

    ------------------------------
    David Edwards,
    WW Tech Enablement SME for Identity Products
    IBM Security
    ------------------------------

    Original Message


  • 8.  RE: Problem authenticating IGI 5.2.5

    Posted 05/07/19 10:51 AM
    I was referring to the install documentation.
    IMO considering that this issue effectively kills the install, a timesync is (at least) equally necessary as the SMTP server config.
    At the very least this or NTP configuration should be added as optional steps in the end.

    ------------------------------
    Mats Hulten
    ------------------------------

    Original Message


  • 9.  RE: Problem authenticating IGI 5.2.5

    Posted 05/07/19 11:01 AM
    Fair point.

    ------------------------------
    David Edwards,
    WW Tech Enablement SME for Identity Products
    IBM Security
    ------------------------------

    Original Message


Related Content