Troubleshooting BMC Atrium Single Sign-On problems

This topic describes the common problems faced in BMC Atrium Single Sign-On and BAO integration. 

Note

BMC Atrium Single Sign-On is not supported for use with BMC Atrium Orchestrator Platform 7.9.01 and later versions.

If you are using Remedy Single Sign-On, see Troubleshooting Remedy Single Sign-On problems.

Re-registering agents in BMC Atrium Single Sign-On after an upgrade

When you upgrade BMC Atrium Single Sign-On to any later version, sometimes the integration fails and you may encounter one of the following scenarios:

  • During a BAO upgrade, you see a message similar to the following example:
    The registering AtriumSSO agent process failed. Please refer to installation guide and register the agent of https://<fqdn for baoComponent>:38080/baoComponent manually.
  • After upgrading BMC Atrium Orchestrator, when attempting to log into BMC Atrium Orchestrator, you see the following message:
    BMCSSG1757E: Integration with Atrium SSO is failing. Please contact the product's support team for help with resolving this integration problem (BMCSSG1766E: Local Atrium SSO certificate does not match remote server certificate. Agent may need to be re-integrated with Atrium SSO server.)

If one of these scenarios occurs, re-register the agents in BMC Atrium Single Sign-On again.

Important

You must shut down the BMC Atrium Orchestrator server before re-registering agents.

If you are registering agents on a new BMC Atrium Single Sign-On server, you must manually edit the context.xml file in the repository directory to point to the new BMC Atrium Single Sign-On server URL. 

The sample commands on this page are intended for use when BAO is configured for HTTPS. If you are using HTTP, adjust your commands following the guidelines in the Registration command parameters table.


The following BMC Communities video (6:41) shows how to re-register web agents in Atrium SSO.

 https://youtu.be/s7lbj_lCjoQ

To re-register agents:

  1. Go to BMC Atrium SSO Admin Console and click Agent Details.  
  2. Select the check boxes against the BAO agents and click Delete.
  3. Remove the ${ao_home}/tomcat/atssoAgents directory for the component for which you are re-registering the agents.
    • For the repository, this is $<REPO_HOME>/tomcat/atssoAgents
    • For the CDP, this is $<CDP_HOME>/tomcat/atssoAgents
  4. Go to the command prompt and run the following command, replacing the variables with your environment information (see the Registration command parameters table below for details):

    <AOComponent Install Folder>\jvm\bin\java" -jar "<AO ComponentInstall Folder>\webagent\deployer\deployer.jar" 
    --install --container-type tomcatv7 
    --atrium-sso-url <https://customers-sso-instance:port/atriumsso>
    --web-app-url <https://url-to-AO-component> or <https://url-to-AO-Load-Balancer>
    --notify-url <https://url-to-AO-component>
    --web-app-logout-uri /logout 
    --container-base-dir "<AO ComponentInstall Folder>\tomcat" 
    --admin-name <amadmin>
    --admin-pwd <ampassword> 
    --jvm-truststore "<AOComponent Install Folder>\jvm\lib\security\cacerts" 
    --jvm-truststore-password changeit 
    --truststore "<AO Component InstallFolder>\tomcat\conf\.keystore" 
    --truststore-password changeit 
    --not-enforced-uri-file "<AO Component Install Folder>\excludedURLs"

    Note

    The command should all be on one line (no new lines inserted) as in shown in this example:

    <AOComponent Install Folder>\jvm\bin\java" -jar "<AO ComponentInstall Folder>\webagent\deployer\deployer.jar" --install --container-type tomcatv7 --atrium-sso-url <https://customers-sso-instance:port/atriumsso> --web-app-url <https://url-to-AO-component> or <https://url-to-AO-Load-Balancer> --notify-url <https://url-to-AO-component> --web-app-logout-uri /logout --container-base-dir "<AO ComponentInstall Folder>\tomcat" --admin-name <amadmin>--admin-pwd <ampassword> --jvm-truststore "<AOComponent Install Folder>\jvm\lib\security\cacerts" --jvm-truststore-password changeit --truststore "<AO Component InstallFolder>\tomcat\conf\.keystore" --truststore-password changeit --not-enforced-uri-file "<AO Component Install Folder>\excludedURLs"


    Sample command for the repository:

    C:\Program Files\BMC Software\BAO\repo\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\repo\webagent\deployer\deployer.jar" 
    --install --container-type tomcatv7 
    --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso 
    --web-app-url https://<fqdn for your component>:28080/baorepo or <https://url-to-AO-Load-Balancer>
    --notify-url <https://<fqdn for your component>:28080/baorepo
    --web-app-logout-uri "/logout" 
    --container-base-dir "C:\Program Files\BMC Software\BAO\repo\tomcat" 
    --admin-name amadmin --admin-pwd <sso admin password>
    --jvm-truststore "C:\Program Files\BMC Software\BAO\repo\jvm\lib\security\cacerts" 
    --jvm-truststore-password changeit 
    --truststore "C:\Program Files\BMC Software\BAO\repo\tomcat\conf\.keystore" 
    --truststore-password changeit 
    --not-enforced-uri-file "C:\Program Files\BMC Software\BAO\repo\excludedURLs"

    Note

    The command should all be on one line (no new lines inserted) in shown in this sample command:

    C:\Program Files\BMC Software\BAO\repo\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\repo\webagent\deployer\deployer.jar" --install --container-type tomcatv7 --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso --web-app-url https://<fqdn for your component>:28080/baorepo or <https://url-to-AO-Load-Balancer> --notify-url <https://<fqdn for your component>:28080/baorepo --web-app-logout-uri "/logout" --container-base-dir "C:\Program Files\BMC Software\BAO\repo\tomcat" --admin-name amadmin --admin-pwd <sso admin password> --jvm-truststore "C:\Program Files\BMC Software\BAO\repo\jvm\lib\security\cacerts" --jvm-truststore-password changeit --truststore "C:\Program Files\BMC Software\BAO\repo\tomcat\conf\.keystore" --truststore-password changeit --not-enforced-uri-file "C:\Program Files\BMC Software\BAO\repo\excludedURLs"

    Note

    If you have manually deleted the CDP agent from BMC Atrium Single Sign-On, you need to manually create the excludeURLs file with the following values:

    /baocdp/orca*
    /baocdp/ws*
    /baocdp/atsso*
    /baocdp/rest* 

    While re-registering the CDP agent, specify the excludedURLs file path in the command.

    Sample command for the CDP:

    C:\Program Files\BMC Software\BAO\CDP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\CDP\webagent\deployer\deployer.jar" 
    --install --container-type tomcatv7 
    --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso 
    --web-app-url https://<fqdn for your component>:38080/baocdp or <https://url-to-AO-Load-Balancer>
    --notify-url <https://<fqdn for your component>:38080/baocdp
    --web-app-logout-uri "/logout" 
    --container-base-dir "C:\Program Files\BMC Software\BAO\CDP\tomcat" 
    --admin-name amadmin --admin-pwd <sso admin password>
    --jvm-truststore "C:\Program Files\BMC Software\BAO\CDP\jvm\lib\security\cacerts" 
    --jvm-truststore-password changeit 
    --truststore "C:\Program Files\BMC Software\BAO\CDP\tomcat\conf\.keystore" 
    --truststore-password changeit
    --not-enforced-uri-file "C:\Program Files\BMC Software\BAO\CDP\config\excludedURLs"

    Note

    The command should all be on one line (no new lines inserted) as in shown in this sample command:

    C:\Program Files\BMC Software\BAO\CDP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\CDP\webagent\deployer\deployer.jar" --install --container-type tomcatv7 --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso --web-app-url https://<fqdn for your component>:38080/baocdp or <https://url-to-AO-Load-Balancer> --notify-url <https://<fqdn for your component>:38080/baocdp --web-app-logout-uri "/logout" --container-base-dir "C:\Program Files\BMC Software\BAO\CDP\tomcat" --admin-name amadmin --admin-pwd <sso admin password> --jvm-truststore "C:\Program Files\BMC Software\BAO\CDP\jvm\lib\security\cacerts" --jvm-truststore-password changeit --truststore "C:\Program Files\BMC Software\BAO\CDP\tomcat\conf\.keystore" --truststore-password changeit --not-enforced-uri-file "C:\Program Files\BMC Software\BAO\CDP\config\excludedURLs"

    Sample command for the OCP (installed with the CDP):

    C:\Program Files\BMC Software\BAO\CDP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\CDP\webagent\deployer\deployer.jar" 
    --install --container-type tomcatv7 
    --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso 
    --web-app-url https://<fqdn for your component>:38080/baoocp or <https://url-to-AO-Load-Balancer>
    --notify-url <https://<fqdn for your component>:38080/baocdp
    --web-app-logout-uri "/logout" 
    --container-base-dir "C:\Program Files\BMC Software\BAO\CDP\tomcat" 
    --admin-name amadmin --admin-pwd <sso admin password>
    --jvm-truststore "C:\Program Files\BMC Software\BAO\CDP\jvm\lib\security\cacerts" 
    --jvm-truststore-password changeit 
    --truststore "C:\Program Files\BMC Software\BAO\CDP\tomcat\conf\.keystore" 
    --truststore-password changeit
    --not-enforced-uri-file "C:\Program Files\BMC Software\BAO\CDP\config\excludedURLs"

    Note

    The command should all be on one line (no new lines inserted) as in shown in this sample command:

    C:\Program Files\BMC Software\BAO\CDP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\CDP\webagent\deployer\deployer.jar" --install --container-type tomcatv7 --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso --web-app-url https://<fqdn for your component>:38080/baoocp or <https://url-to-AO-Load-Balancer> --notify-url <https://<fqdn for your component>:38080/baoocp --web-app-logout-uri "/logout" --container-base-dir "C:\Program Files\BMC Software\BAO\CDP\tomcat" --admin-name amadmin --admin-pwd <sso admin password> --jvm-truststore "C:\Program Files\BMC Software\BAO\CDP\jvm\lib\security\cacerts" --jvm-truststore-password changeit --truststore "C:\Program Files\BMC Software\BAO\CDP\tomcat\conf\.keystore" --truststore-password changeit --not-enforced-uri-file "C:\Program Files\BMC Software\BAO\CDP\config\excludedURLs"

    Sample command for the OCP (standalone installation):

    C:\Program Files\BMC Software\BAO\OCP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\OCP\webagent\deployer\deployer.jar" --install --container-type tomcatv7
    --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso
    --web-app-url https://<fqdn for your component>:38080/baoocp or <https://url-to-AO-Load-Balancer>
    --notify-url <https://<fqdn for your component>:38080/baoocp
    --web-app-logout-uri "/logout"
    --container-base-dir "C:\Program Files\BMC Software\BAO\OCP\tomcat"
    --admin-name amadmin --admin-pwd <sso admin password>
    --jvm-truststore "C:\Program Files\BMC Software\BAO\OCP\jvm\lib\security\cacerts"
    --jvm-truststore-password changeit
    --truststore "C:\Program Files\BMC Software\BAO\OCP\tomcat\conf\.keystore"
    --truststore-password changeit 

    Note

    The command should all be on one line (no new lines inserted) as shown in this sample command: 

    C:\Program Files\BMC Software\BAO\OCP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\OCP\webagent\deployer\deployer.jar" --install --container-type tomcatv7 --atrium-sso-url https://<fqdn for sso server>:8443/atriumsso --web-app-url https://<fqdn for your component>:38080/baoocp or <https://url-to-AO-Load-Balancer> --notify-url <https://<fqdn for your component>:38080/baoocp --web-app-logout-uri "/logout" --container-base-dir "C:\Program Files\BMC Software\BAO\OCP\tomcat" --admin-name amadmin --admin-pwd <sso admin password> --jvm-truststore "C:\Program Files\BMC Software\BAO\OCP\jvm\lib\security\cacerts" --jvm-truststore-password changeit --truststore "C:\Program Files\BMC Software\BAO\OCP\tomcat\conf\.keystore" --truststore-password changeit 
  5. Restart BMC Atrium Orchestrator peers. 

Registration command parameters 

Parameter Definition Required
container-type Type of Web server used to host BMC Atrium Orchestrator. Yes
atrium-sso-url Address of the Atrium SSO instance. Yes
web-app-url Address of BMC Atrium Orchestrator or of the load balancer. Yes
web-app-logout-uri The URL where the application is directed upon user logout. Yes
container-base-dir The Web server home directory. Yes
admin-name The SSO admin user name. Yes
admin-pwd The SSO admin password. Yes
jvm-truststore The truststore location. Include the path and file name of JVM’s truststore file (cacerts). Yes
jvm-truststore-password The cacerts truststore file password. Yes
truststore The truststore location. Include the path and file name of SSL certificate keystore. Required if BAO is configured for HTTPS.
truststore-password The SSL certificate truststore file password. Required if BAO is configured for HTTPS.
not-enforced-uri-file The file that Atrium SSO uses to store the data that goes in its NotEnforcedURI table.

Yes

This is not required if you installed the Operator Control Panel separately from the CDP.

notify-url The BMC Atrium Orchestrator address if web-app-url specifies a load balancer. Required if web-app-url specifies a load balancer.

Note

You can verify that agents were re-registered by logging into Atrium Single Sign-On, clicking Agent Details, and checking that the agents are listed.

Verify your Not Enforced URIs list and load balancer domain

After completing the previous steps, check that your Not Enforced URIs and load balancer domain setups are correct. (See KA000029966 How can I re-register a BAO instance with Atrium SSO).

From the Atrium SSO Admin Console verify your Not Enforced URIs lists by clicking Agent Details, checking that the appropriate agent from the list is displayed and editing it. In the agent details Not Enforced URIs list, verify the following values for your setup:

  • For the CDP, the following values must be present:
    /baocdp/orca*
    /baocdp/ws* 
    /baocdp/atsso*
  • For the repository the following values must be present:
    /baorepo/http/resource*
    /baorepo/http/configuration*
    /baorepo/resource
    /baorepo/http/mediaMetadataField*

Also, verify that the domain of the load balancer matches the domain of your BAO peer.

Registering agents on a new BMC Atrium Single Sign-On server

If you are registering agents on a new BMC Atrium Single Sign-On server, you must manually edit the context.xml file in the repository directory to point to the new BMC Atrium Single Sign-On server URL. 

To change the BMC Atrium Single Sign-On URL:

  1. Go to <AO_HOME>/tomcat/conf/context.xml.
  2. Look for the com.bmc.ao.sso.ATRIUM_SSO_SERVER_URL property and provide the URL to the BMC Atrium Single Sign-On server, which you want to connect to the repository. 

For more information, see Knowledge Base article KA000029966.

Checking that the CDP can communicate with BMC Atrium Single Sign-On

The CDP should be able to communicate with BMC Atrium Single Sign-On if the SSO port is accessible. You can use telenet to check the port connection. 

The telenet command format is similar to the following:

telnet <SSOserver> <SSOportnumber> 

For more information about using telenet, see  Using telnet to check port access

Problem starting BAO when BAO and Atrium SSO are installed on the same server

If BAO and Atrium SSO are installed on the same server and BAO fails to start, ensure that the Atrium SSO service is running before starting the BAO service.

  1. Start the Atrium SSO service (see Starting and stopping product components and services).
  2. Log into the Atrium SSO console to ensure that it is running.
  3. Start the BAO service (see Starting and stopping product components and services).
  4. Log into BAO (see Logging into Grid Manager and Repository Manager).

BMC Atrium Orchestrator peer does not start after installation or BMC Atrium Orchestrator does not run properly

The symptoms may be that BAO fails to register with BMC Atrium Single Sign-On or that peers take several hours to start. This may be due to inadequate system entropy.
See the BMC Atrium Single Sign-On System requirements page for more information. You can also find information in Knowledge Article Actions fail in Atrium Orchestrator due to low system entropy KA000066336.

Related topic

Troubleshooting provides more details on troubleshooting Atrium SSO.

Was this page helpful? Yes No Submitting... Thank you

Comments