Hi All,

Please help.

I have a application using Federated Repository (File based + standalone LDAP). WAS 8.5.5.17

The WAS console login ID has stopped working, the id is in Filebased Repository.

How to find out why its not working and how to resolve/reset its password ?

------------------------------
Nag
------------------------------

https://www.ibm.com/support/pages/disabling-websphere-administrative-security-when-admin-console-not-accessible

------------------------------
Mallikarjuna Reddy K Systems Consultant
Websphere Middleware Administrator
Encora Technologies Pte Ltd
------------------------------

Hello Nag,
What is the error you get? The SystemOut.log usually tells you why a login is rejected.

Are there any problems with the availability/connectivity to any on the federated repositories? For example connection to LDAP server broken, LDAP server is down etc. By default all repositories must be available to allow a login.

Is the checkbox "Allow operations if some of the repositories are down"
in the Admin Console in the federated repositories configuration scree checked?  I know you can't access, but maybe you can remember or you can check <profile_home>/config/cells/<cellname>/wim/config/wimconfig.xml under

    <config:realmConfiguration defaultRealm="defaultWIMFileBasedRealm">
      <config:realms delimiter="/" name="defaultWIMFileBasedRealm" securityUse="active"
          allowOperationIfReposDown="true">
​

Otherwise you can follow the link @Mallikarjuna Reddy posted to disable security (but that affects all servers in the cell once synchronized and restarted).

Hope that helps ... Hermann


​

------------------------------
Hermann Huebler
2innovate IT Consulting GmbH
Vienna
Austria

#ibmchampion
#IBMChampion
------------------------------

Good Day Hermann,

Thank you for the quick reply. This helped me a lot.

The LDAP was working fine (my other applications use the same LDAP and I am able to login to WAS console with the ID/pwd available in the LDAP. Standalone LDAP ).


1. I set the "allowOperationIfReposDown="true" in wimconfig.xml. Now I am able to Login to WAS console with my ID/pwd present in the Filebased Repository. !! So not sure what is the logic. But its working.

2. The users of My Application use the LDAP for authentication. So the Application also wasnt working. This is now fixed after I set the "allowOperationIfReposDown="true"". So this was very helpful.


Regards,
Nag

Hello Nag,
what were the errors in the log file preventing the login? If you say that LDAP was working fine but you could not login and since you've set "allowOperationIfReposDown="true" you can login again there must have been something wrong with the connectivity. Please check your logs for detailed errors to determine the root cause.

Thanks - Hermann

------------------------------
Hermann Huebler
2innovate IT Consulting GmbH
Vienna
Austria

#IBMChampion
------------------------------

Original Message:
Sent: Wed August 05, 2020 10:59 AM
From: Nagabushan M
Subject: WAS console login fails - Federated Repository (File based + standalone LDAP)

Good Day Hermann,

Thank you for the quick reply. This helped me a lot.

The LDAP was working fine (my other applications use the same LDAP and I am able to login to WAS console with the ID/pwd available in the LDAP. Standalone LDAP ).


1. I set the "allowOperationIfReposDown="true" in wimconfig.xml. Now I am able to Login to WAS console with my ID/pwd present in the Filebased Repository. !! So not sure what is the logic. But its working.

2. The users of My Application use the LDAP for authentication. So the Application also wasnt working. This is now fixed after I set the "allowOperationIfReposDown="true"". So this was very helpful.


Regards,
Nag

Hello Mallikarjuna and Christos,

Thanks for the quick reply.

I still dont know how to reset the password of the ID's in a File Based Repository. Could you help ?

Hello Nag,
as you can login again to the WAS Admin Console you can change the password of users in the internal file registry via the WAS Admin Console. Once logged on click "Users and Groups -> Manage Users" then search for the user-id and select the user from the file registry and enter the new password twice.

As a hint you should consider moving the Admin to the LDAP as well so that the user password rules etc. are enforced based on the  LDAP policy set. The Admin User in the file registry should be used for situations when LDAP is not available.

------------------------------
Hermann Huebler
2innovate IT Consulting GmbH
Vienna
Austria

#IBMChampion
------------------------------

Original Message:
Sent: Wed August 05, 2020 05:05 PM
From: Nagabushan M
Subject: WAS console login fails - Federated Repository (File based + standalone LDAP)

Hello Mallikarjuna and Christos,

Thanks for the quick reply.

I still dont know how to reset the password of the ID's in a File Based Repository. Could you help ?

Most probably your problem is the LDAP. For Federated repositories, in case one (LDAP in your case ) is down, by default no other repository is accessible, even the file-based.

You can remove WAS security using wsadmin, then login to WAS and after configuring whatever you want, you can re-enable admin security. A WAS restart is needed after each change.

------------------------------
Christos Chorattides
Datatech

------------------------------

Another one -  we unable to logon to console if after made LDAP settings auth protocol changed to kerberos instead of LTPA. Just change back.

------------------------------
Oleg SAgay
------------------------------