IBM Security Verify

 View Only
  • 1.  ISVG 10 fix 1- The login operation could not be completed for ID admin

    Posted Mon August 23, 2021 04:24 AM
    Hi all,

    we've got issue with our ISVG appliance. After one week inactivity we can not login into appliance admin web interface by default admin user. The only error I found is bellow (OpenID Admin -> trace log).  ID Admin is default admin user so Ive got no idea why "is not found in the back-end repository" and what caused this state. Do you have any suggestions? Thank you

    [8/23/21 9:58:07:809 CEST] 00000028 SystemOut O {javax.sql.DataSource}={properties.0.portNumber=50050, properties.0.deferPrepares=true, service.scope=bundle, service.ranking=0, properties.0.traceLevel=0, jndiName.unique=PM, beginTranForVendorAPIs=true, properties.0.password=*****, connectionManager.target=(service.pid=com.ibm.ws.jca.connectionManager_107), recoveryAuthData.target=(service.pid=${recoveryAuthDataRef}), service.pid=com.ibm.ws.jdbc.dataSource_62, jaasLoginContextEntry.cardinality.minimum=0, service.id=519, config.id=com.ibm.ws.jdbc.dataSource[pm], isolationLevel=TRANSACTION_READ_COMMITTED, beginTranForResultSetScrollingAPIs=false, jaasLoginContextEntry.target=(service.pid=${jaasLoginContextEntryRef}), syncQueryTimeoutWithTransactionTimeout=false, transactional=false, properties.0.user=iga, config.displayId=dataSource[pm], properties.0.serverName=CZSTRISVGDB81, connectionSharing=MatchOriginalRequest, driver.target=(service.pid=com.ibm.ws.jdbc.jdbcDriver_106), connectionManagerRef=[com.ibm.ws.jca.connectionManager_107], properties.0.retrieveMessagesFromServerOnGetMessage=true, component.name=com.ibm.ws.jdbc.dataSource, properties.0.databaseName=IGIDB, osgi.jndi.service.name=PM, com.ibm.wsspi.resource.ResourceFactory=true, config.source=file, id=pm, containerAuthData.target=(service.pid=${containerAuthDataRef}), properties.0.config.referenceType=com.ibm.ws.jdbc.dataSource.properties.db2.jcc, containerAuthData.cardinality.minimum=0, service.bundleid=161, properties.0.driverType=4, jdbcDriverRef=[com.ibm.ws.jdbc.jdbcDriver_106], config.overrides=true, properties.0.sslConnection=false, statementCacheSize=10, component.id=344, recoveryAuthData.cardinality.minimum=0, enableConnectionCasting=false, service.factoryPid=com.ibm.ws.jdbc.dataSource, connectionManager.cardinality.minimum=1}
    [8/23/21 9:58:07:811 CEST] 00000028 ConnectorServ I J2CA8050I: An authentication alias should be used instead of defining a user name and password on dataSource[pm].
    [8/23/21 9:58:08:013 CEST] 00000028 RecoveryDirec I CWRLS0010I: Performing recovery processing for local WebSphere server (openidProviderAdmin).
    [8/23/21 9:58:08:082 CEST] 00000028 RecoveryDirec I CWRLS0012I: All persistent services have been directed to perform recovery processing for this WebSphere server (openidProviderAdmin).
    [8/23/21 9:58:08:082 CEST] 00000049 RecoveryManag I WTRN0135I: Transaction service recovering no transactions.
    [8/23/21 9:58:08:181 CEST] 00000028 DatabaseHelpe I DSRA8203I: Database product name : DB2/NT64
    [8/23/21 9:58:08:181 CEST] 00000028 DatabaseHelpe I DSRA8204I: Database product version : SQL11054
    [8/23/21 9:58:08:182 CEST] 00000028 DatabaseHelpe I DSRA8205I: JDBC driver name : IBM Data Server Driver for JDBC and SQLJ
    [8/23/21 9:58:08:182 CEST] 00000028 DatabaseHelpe I DSRA8206I: JDBC driver version : 3.69.24
    [8/23/21 9:58:08:218 CEST] 00000028 SystemOut O ########## Application ID: 1
    [8/23/21 9:58:08:222 CEST] 00000028 SystemOut O ########## Realm name: Admin
    [8/23/21 9:58:08:222 CEST] 00000028 SystemOut O ########## Realm ID: 1
    [8/23/21 9:58:08:224 CEST] 00000028 SystemOut O ########## Schema name: IGAADM
    [8/23/21 9:58:08:225 CEST] 00000028 SystemOut O ########## Realm name: Ideas
    [8/23/21 9:58:08:225 CEST] 00000028 SystemOut O ########## Realm ID: 2
    [8/23/21 9:58:08:226 CEST] 00000028 SystemOut O ########## Schema name: IGACORE
    [8/23/21 9:58:08:227 CEST] 00000028 SystemOut O ########## Got Instance
    [8/23/21 9:58:08:295 CEST] 00000028 LoginBridge E CWIML4537E: The login operation could not be completed. The specified principal name admin is not found in the back-end repository.
    com.ibm.wsspi.security.wim.exception.PasswordCheckFailedException: CWIML4537E: The login operation could not be completed. The specified principal name admin is not found in the back-end repository.
    at com.ibm.ws.security.wim.ProfileManager.loginImpl(ProfileManager.java:1870)
    at com.ibm.ws.security.wim.ProfileManager.genericProfileManagerMethod(ProfileManager.java:254)
    at com.ibm.ws.security.wim.ProfileManager.login(ProfileManager.java:217)
    at com.ibm.ws.security.wim.VMMService.login(VMMService.java:246)
    at com.ibm.ws.security.wim.registry.util.LoginBridge.checkPassword(LoginBridge.java:116)
    at com.ibm.ws.security.wim.registry.WIMUserRegistry.checkPassword(WIMUserRegistry.java:151)
    at com.ibm.ws.security.authentication.jaas.modules.UsernameAndPasswordLoginModule.login(UsernameAndPasswordLoginModule.java:75)
    at com.ibm.ws.kernel.boot.security.LoginModuleProxy.login(LoginModuleProxy.java:51)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:90)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
    at java.lang.reflect.Method.invoke(Method.java:508)
    at javax.security.auth.login.LoginContext.invoke(LoginContext.java:788)
    at javax.security.auth.login.LoginContext.access$000(LoginContext.java:196)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:698)
    at javax.security.auth.login.LoginContext$4.run(LoginContext.java:696)
    at java.security.AccessController.doPrivileged(AccessController.java:734)
    at javax.security.auth.login.LoginContext.invokePriv(LoginContext.java:696)
    at javax.security.auth.login.LoginContext.login(LoginContext.java:597)
    at com.ibm.ws.security.authentication.internal.jaas.JAASServiceImpl.doLoginContext(JAASServiceImpl.java:343)
    at com.ibm.ws.security.authentication.internal.jaas.JAASServiceImpl.performLogin(JAASServiceImpl.java:329)
    at com.ibm.ws.security.authentication.internal.jaas.JAASServiceImpl.performLogin(JAASServiceImpl.java:314)
    at com.ibm.ws.security.authentication.internal.AuthenticationServiceImpl.performJAASLogin(AuthenticationServiceImpl.java:495)
    at com.ibm.ws.security.authentication.internal.AuthenticationServiceImpl.authenticate(AuthenticationServiceImpl.java:209)
    at com.ibm.ws.webcontainer.security.internal.BasicAuthAuthenticator.basicAuthenticate(BasicAuthAuthenticator.java:126)
    at com.ibm.ws.webcontainer.security.internal.FormLoginExtensionProcessor.formLogin(FormLoginExtensionProcessor.java:178)
    at com.ibm.ws.webcontainer.security.internal.FormLoginExtensionProcessor.handleRequest(FormLoginExtensionProcessor.java:113)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain.invokeTarget(WebAppFilterChain.java:182)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:93)
    at com.ibm.identity.filter.StrictTransportSecurityFilter.doFilter(StrictTransportSecurityFilter.java:41)
    at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:201)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
    at com.ibm.identity.filter.SecurityHeadersFilter.doFilter(SecurityHeadersFilter.java:43)
    at com.ibm.ws.webcontainer.filter.FilterInstanceWrapper.doFilter(FilterInstanceWrapper.java:201)
    at com.ibm.ws.webcontainer.filter.WebAppFilterChain.doFilter(WebAppFilterChain.java:90)
    at com.ibm.ws.webcontainer.filter.WebAppFilterManager.doFilter(WebAppFilterManager.java:1001)
    at com.ibm.ws.webcontainer.filter.WebAppFilterManager.invokeFilters(WebAppFilterManager.java:1139)
    at com.ibm.ws.webcontainer.webapp.WebApp.handleRequest(WebApp.java:4922)
    at com.ibm.ws.webcontainer.osgi.DynamicVirtualHost$2.handleRequest(DynamicVirtualHost.java:314)
    at com.ibm.ws.webcontainer.WebContainer.handleRequest(WebContainer.java:1005)
    at com.ibm.ws.webcontainer.osgi.DynamicVirtualHost$2.run(DynamicVirtualHost.java:279)
    at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink$TaskWrapper.run(HttpDispatcherLink.java:1134)
    at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink.wrapHandlerAndExecute(HttpDispatcherLink.java:415)
    at com.ibm.ws.http.dispatcher.internal.channel.HttpDispatcherLink.ready(HttpDispatcherLink.java:374)
    at com.ibm.ws.http.channel.internal.inbound.HttpInboundLink.handleDiscrimination(HttpInboundLink.java:577)
    at com.ibm.ws.http.channel.internal.inbound.HttpInboundLink.handleNewRequest(HttpInboundLink.java:511)
    at com.ibm.ws.http.channel.internal.inbound.HttpInboundLink.processRequest(HttpInboundLink.java:359)
    at com.ibm.ws.http.channel.internal.inbound.HttpICLReadCallback.complete(HttpICLReadCallback.java:70)
    at com.ibm.ws.channel.ssl.internal.SSLReadServiceContext$SSLReadCompletedCallback.complete(SSLReadServiceContext.java:1824)
    at com.ibm.ws.tcpchannel.internal.WorkQueueManager.requestComplete(WorkQueueManager.java:504)
    at com.ibm.ws.tcpchannel.internal.WorkQueueManager.attemptIO(WorkQueueManager.java:574)
    at com.ibm.ws.tcpchannel.internal.WorkQueueManager.workerRun(WorkQueueManager.java:958)
    at com.ibm.ws.tcpchannel.internal.WorkQueueManager$Worker.run(WorkQueueManager.java:1047)
    at com.ibm.ws.threading.internal.ExecutorServiceImpl$RunnableWrapper.run(ExecutorServiceImpl.java:239)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1160)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.lang.Thread.run(Thread.java:822)

    [8/23/21 9:58:08:299 CEST] 00000028 UsernameAndPa A CWWKS1100A: Authentication did not succeed for user ID admin. An invalid user ID or password was specified.
    [8/23/21 9:58:08:306 CEST] 00000036 Translator 1 com.ibm.identity.auth.Translator getLocale Using the locale : en_US
    [8/23/21 9:58:08:324 CEST] 00000034 srt W com.ibm.ws.webcontainer.srt.SRTServletResponse setStatus SRVE8115W: WARNING: Cannot set status. Response already committed.


    ------------------------------
    Jakub Nejdl
    ------------------------------


  • 2.  RE: ISVG 10 fix 1- The login operation could not be completed for ID admin

    Posted Mon August 23, 2021 04:35 AM
    I would recommend you to create a case with IBM Support. This kind of problems is exactly what they should be able to help you with quickly.
    Debugging the VA is not easy - so the best advice is to ensure that all servers (DB2 and ldap if you have one) is checked and confirmed working...
    But again - IBM Support has tools/methods that probably can resolve this much faster than discussing it here :-)

    ------------------------------
    Franz Wolfhagen
    IAM Technical Architect for Europe - Certified Consulting IT Specialist
    IBM Security Expert Labs
    ------------------------------



  • 3.  RE: ISVG 10 fix 1- The login operation could not be completed for ID admin

    Posted Mon August 23, 2021 07:29 AM
    Hi Franz,

    thank you for your response. I will follow your recommendation. Have a nice day

    ------------------------------
    Jakub Nejdl
    ------------------------------



  • 4.  RE: ISVG 10 fix 1- The login operation could not be completed for ID admin

    Posted Tue August 24, 2021 10:09 AM
    Hi Jakub,

    This may be a long shot, but have you tried using admin@local as the username when login in instead of just admin? If you're using an external LDAP for the admin interface this will tell the appliance to look for this user locally.

    ------------------------------
    Enio Padilla
    ------------------------------



  • 5.  RE: ISVG 10 fix 1- The login operation could not be completed for ID admin

    Posted Tue August 24, 2021 11:07 AM
    Hi Enio,

    thank you for your suggestion. I finally found solution by my own. Still dont know what happend there but I had to use sysadmin account to recreate admin account. We dont use external repository of system accounts. Appliance was locked for administrative tasks. Now we have functional ISVG again. This task can be marked as solved.

    Thank you again for your replies.

    Have a nice day

    ------------------------------
    Jakub Nejdl
    ------------------------------