Troubleshooting integration issues

On Linux, when the user runs the BMC Helix SSO installer on a supported BMC application, the integration may fail if the installer does not stop the application's server.

To complete the integration, perform a manual stop of the BMC application's server. Then, rerun the BMC Helix SSO installer on the application. If the integration fails again, perform the manual integration process.

BMC Helix SSO installer's webapp installation fails

Various issues can cause this error. Use the steps in the next column to identify and fix any issues you find. (You might also perform the steps if you do not see the complete application list after logging on.)

1. Check if the BMC Helix SSO server is accessible from the AR System Server.
   1. Check if the BMC Helix SSO service URL is configured correctly in the rsso.cfg file located in ARSystemInstallFolder\Conf (for example, D:\BMCSoftware\BMCARSystem\Conf\rsso.cfg).
   2. Open the BMC Helix SSO service URL in a browser to check whether it is accessible from the AR System Server.
2. Check if the BMC Helix SSO plugin entry is set correctly in the pluginsvr_config.xml file.

   1. Open the pluginsvr_config.xml file located in ARSystemInstallFolder\pluginsvr (for example, D:\BMCSoftware\BMCARSystem\pluginsvr\pluginsvr_config.xml), and check for the following entry:

      <plugin>
          <name>ARSYS.AREA.RSSO</name>
          <classname>com.bmc.rsso.plugin.area.RSSOPlugin</classname>
          <pathelement type="location">D:/BMCSoftware/BMCARSystem/pluginsvr/rsso-area-plugin-all.jar</pathelement>
          <userDefined>
              <configFile>D:/BMCSoftware/BMCARSystem/Conf/rsso.cfg</configFile>
          </userDefined>
      </plugin>

   2. Make sure the file locations are correctly set.

   3. Make sure the rsso-area-plugin-all.jar is present in the pluginsvr folder.
   4. Comment out the ARSYS.ARF.ATSSOCONFIRMPWD and ARSYS.AREA.ATRIUMSSO entries because they are not needed if BMC Helix SSO is integrated with the stack.
3. Make sure the plugin server is running.
   1. Open Task Manager to verify that the plugin server is running.
   2. Make sure the Server-Plugin-Alias is present in ar.cfg, for example:
      Server-Plugin-Alias:AREA AREA onbmc-s:9999
4. Verify authenticated users.
   1. Verify that the users you authenticated are listed in the AR User form.
   2. Make sure the transformations are set correctly on the BMC Helix SSO server. For example, check whether the authenticated user is in uppercase or lowercase. BMC Helix SSO may transform the user to UPPERCASE, and the same user should also be in UPPERCASE in the AR User form.
5. Make sure that the following entries are set correctly on the EA tab of the Server Information page:
   
   • External-Authentication-RPC-Socket: 390695
   • Authentication-Chaining-Mode: 1
   • Use-Password-File: T
   • Crossref-Blank-Password: T
     These entries correspond to the entries in the ar.cfg file.
6. Restart the services of all integrated applications in the following sequence:
   BMC Helix SSO→ AR System → Mid Tier

If these steps do not resolve the issue, enable debug logging for the plugin server and check the arjavaplugin.log file. This file can help identify an issue with the BMC Helix SSO plugin and plugin server as a whole.

A connection between the BMC Helix SSO server and another application fails

Various scenarios can cause this error. For example, a local user is registered in BMC Helix SSO, but the integrated application does not receive any notifications. 

Investigate whether an integrated BMC application or any other application is reachable for the BMC Helix SSO server. To do so, enable the Check TCP connection feature for a tenant and validate the host and port values of the application. Starting with version 23.1.01, administrators can enhance a health check by selecting a Transmission Control Protocol (TCP) type of the connection. For more information, see Setting up tenants.

If you have integrated BMC Helix SSO with Mid Tier and then upgrade Mid Tier to the latest version, the integration fails with the following error message because the web.xml file that contains the BMC Helix SSO filter information is overwritten:

BMC Helix Single Sign-On error
ARERR [9388] Authentication failed: An error occurred in SSO plugin.

To restore the integration, manually remove the BMC Helix SSO integration installation folder that contains the InstalledConfiguration.xml file, and perform the integration steps again.

You are manually integrating BMC Helix SSO with Mid Tier and see the following error while accessing Mid Tier:

 type Exception report 
    message java.lang.NullPointerException
 
    description The server encountered an internal error that prevented it from fulfilling this request.
 
    exception
 
    java.lang.RuntimeException: java.lang.NullPointerException
 
            com.remedy.arsys.stubs.GoatServlet.postInternal(GoatServlet.java:165)
 
            com.remedy.arsys.stubs.GoatHttpServlet.doGet(GoatHttpServlet.java:57)
 
            javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
 
            javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
 
            org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
 
            com.remedy.arsys.stubs.TenancyFilter.doFilter(TenancyFilter.java:49)
 
            com.bmc.rsso.agent.RSSOFilter.doFilter(RSSOFilter.java:135)

root cause 
java.lang.NullPointerException
        com.remedy.arsys.session.Login.establishSession(Login.java:281)
        com.remedy.arsys.stubs.GoatServlet.postInternal(GoatServlet.java:104)
        com.remedy.arsys.stubs.GoatHttpServlet.doGet(GoatHttpServlet.java:57)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:624)
        javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
        org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
        com.remedy.arsys.stubs.TenancyFilter.doFilter(TenancyFilter.java:49)
        com.bmc.rsso.agent.RSSOFilter.doFilter(RSSOFilter.java:135)
note The full stack trace of the root cause is available in the Apache Tomcat/7.0.64 logs.

While integrating BMC Helix SSO with Mid Tier, the integration may fail and display the following errors:

 Throwable=[com.bmc.install.product.remedysso.processing.
 RemedySSOPostInstallIntegrationArTask$IntegrationException:
 Couldn't deploy and configure agent
...
Throwable=[com.bmc.install.product.remedysso.installationtools.xml.Xml$XmlException:
 Couldn't add agent filter into C:\Program Files\BMC 
Software\ARSystem\midtier\WEB-INF\web.xml

These errors might appear because during integration, the BMC Helix SSO installer parses web.xml and looks for the DTD at http://java.sun.com/dtd/web-app_2_3.dtd and may not be able to access it due to a firewall policy.

Modifying the web.xml file is the last step when integrating BMC Helix SSO with Mid Tier. If you encounter this issue, complete the workaround outlined in the next column.

1. Add the following BMC Helix SSO <filter> and <filter-mapping> entries in MidTierInstallFolder/WEB-INF/web.xml.

   <filter>
       <filter-name>RSSOFilter</filter-name>
       <filter-class>com.bmc.rsso.agent.RSSOFilter</filter-class>
   </filter>
   <filter-mapping>
       <filter-name>RSSOFilter</filter-name>
       <url-pattern>/*</url-pattern>
   </filter-mapping>

   Important

   When you add <filter-mapping>, make sure to add it as the first <filter-mapping> element in web.xml.

2. Restart the Mid Tier Tomcat server.

Integration fails because the BMC Helix SSO URL is inaccessible

While integrating BMC Helix SSO with AR System or Mid Tier, you need to provide the BMC Helix SSO URL. If the URL is not accessible, an error is displayed, and the integration process does not continue.

Specify any accessible URL temporarily as the BMC Helix SSO service URL during integration. After the integration is complete, perform the steps below.

For AR System integration:

1. Change the sso-service-url config value to the correct BMC Helix SSO service URL in the ARSystemInstallationFolder/Conf/rsso.cfg file.
2. Restart the AR System server.

For Mid Tier integration:

1. Change sso-service-url property value to the correct BMC Helix SSO service URL in MidTierInstallationFolder/WEB-INF/classes/rsso-agent.properties.
2. Restart the Mid Tier Tomcat.

After integrating BMC Helix SSO with Mid Tier, the Tomcat server on which Mid Tier is installed hangs.

1. Stop the Tomcat server on which Mid Tier is installed.
2. Add the following parameters for JVM in the JAVA_OPTS (or CATALINA_OPTS) variable (for example, in the Tomcat catalina.sh file):
   
   • -XX:MaxPermSize
   • -XX:-UseCompressedOops
   • -XX:+UseConcMarkSweepGC

3. Set the number of HTTP sessions to 600 if BMC Helix SSO and Mid Tier are running on independent Tomcat servers. If they are running on the same Tomcat server, set the number of HTTP sessions to 1800.

   The sessions are set in the conf/server.xml file on the Tomcat server. See the maxThreads property on the Connector configuration, for example:

    < Connector port="18080" 
    protocol="HTTP/1.1"
    connectionTimeout="20000"
    redirectPort="18443"
    maxThreads="1800"/>

4. Restart the Tomcat server on which Mid Tier is installed.