IBM Verify

IBM Verify

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  WebSEAL not starting

    Posted 04/16/19 10:28 AM
    WebSEAL reverse proxy not starting, looks like pd-user-pwd is missing from the config file, I tried to manually update the file but didn't work. Can someone please advise?

    msg__webseald-ICAP00.log

    1692 -- IBM Security Access Manager WebSEAL Version 9.0.5.0 (Build 180531) -- -- Copyright (C) IBM Corporation 1994-2018. All Rights Reserved. -- 
    1693 2019-04-16-04:58:05.971-04:00I----- 0x1354A09C webseald ERROR ivc general cfgfile.cpp 432 0x7ff69e731840 -- HPDCO0156E Configuration item missing (aznapi-configuration, pd-user-pwd).

    ------------------------------
    Venkat
    ------------------------------


  • 2.  RE: WebSEAL not starting

    Posted 04/16/19 11:52 AM

    Hello Venkat,

    As per the error message, you are missing the 'pd-user-pwd' entry in the '[aznapi-configuration]' stanza.

    That needs to be set to the LDAP password of the user specified in the 'bind-dn' in the '[ldap]' stanza.
    This also correlates to the 'bind-pwd' which is obfuscated.

    To retrieve values from an OBF file you'll need the pdadmin command line.
    For Distributed Systems it can be retrieved from here :
    IBM Download IBM Security Access Manager for Web 8.0

    This application developer kit is no longer supported but the ISAM Policy Servers are backwards compatible, so this should work as expected.

    It does require GSKit 8.0.50.67 as a highest version and at least 8.0.50.45.

    Here are the steps to getting details out of the obfuscated files (.obf) :

    Example Given :
    1) Navigate to 'Secure Web Settings -> Manage -> Reverse Proxy'
    2) Select your Reverse Proxy and select 'Manage -> Configuration -> Export Configuration File'
    3) Uncompress the archive and load the 'etc/webseald-<instance>.conf' into a text editor
    4) Change into the uncompressed directory using your desired command line processor
    5) Open a 'pdadmin' command line :

    pdadmin -l

    pdadmin> config show webseald-<instance>.conf ldap bind-pwd

    Here is an example from my lab :

    AzureAD+JACKYARBOROUGH@LAPTOP-E9LVJEDT /cygdrive/c/Users/JACKYARBOROUGH/Downloads/webseal_config/etc                                                                                      
$ pdadmin -l                                                                                                                                                                              
pdadmin local> config show webseald-default.conf ldap bind-pwd                                                                                                                            
VWt46xOtqHDsrw                                                                                                                                                                            
pdadmin local>

    You would then set the 'pd-user-pwd' value to be the result of that command.

    If you need any further questions or concerns please open a case.

    ------------------------------
    JACK YARBOROUGH
    IBM Security Access Manager and IBM Tivoli Federation Identity Manager L2 Support
    ------------------------------



Related Content