Troubleshooting Remedy Single Sign-On integration with Smart IT
When you integrate Remedy Single Sign-On with Smart IT, you might experience issues such as authentication failure or other errors. Use the information in this topic to understand and resolve the problem or to create a BMC Support case.
Issue symptoms
One or more of the following symptoms might occur:
Authentication fails when you log in to Smart IT.
You see a continuous spinning wheel after entering your login credentials and are unable to log in to Smart IT.
When you log in to Smart IT, the following error message appears: An error occurred. Please contact your administrator or retry later mm/dd/yyyy hh:mm
The UX log shows the following entry: Caused by: com.bmc.arsys.api.ARException: ERROR (623): Authentication failed; Incorrect username or password.
The RSSO log shows the following entry: SEVERE Thread_138 com
The network logs show the following message: "UnauthorizedException: Missing People Info.","detailedMessage":"HTTP 403 Forbidden"
Perform the following tasks to troubleshoot the Remedy Single Sign-On integration issues:
Task
Action
Steps
Reference
1
Integrating Remedy Single Sign-On with Action Request System (AR System)
Using the installer, verify that Remedy Single Sign-On is integrated with AR System. Perform this check before integrating the Remedy Single Sign-On agent with Smart IT.
Confirm Remedy Single Sign-On integration with Remedy AR System and Smart IT.
a. Confirm that Remedy Single Sign-On has been successfully integrated with Remedy AR Server.
b. Confirm that Remedy Single Sign-On has been successfully integrated with Smart IT. c. By default, Smart IT includes the required JAR files to integrate with Remedy Single Sign-On. However, some files might have been removed, so you must verify that these JAR files are present. For more information, see task 10 in this topic.
d. Ensure that the SAML_AUTHENTICATION parameter is set to 1 in the Smart IT database. To integrate Remedy Single Sign-On with Smart IT, use the following SQL queries:
i. To enable the SAML_AUTHENTCATION parameter, use the following query: UPDATE SmartIT.SmartIT_System.TENANT SET SAML_AUTHENTICATION = 1; Note:Restart Smart IT application services to ensure the change takes effect.
ii. To Verify the value of the SAML_AUTHENTICATION parameter, use the following query: select SAML_AUTHENTICATION from SmartIT.SmartIT_System.TENANT;
Confirm Remedy Single Sign-On configuration files.
Verify the following files:
Remedy Single Sign-On Server configuration: RSSO_Tomcat/webapps/rsso/META-INF/context.xml (database connection) Use the following URL in the context.xml file to specify the database connection: url="jdbc:sqlserver://<DB_server_name>:1433;databaseName=rsso;instanceName=MSSQL"
Remedy Single Sign-On Agent configuration: APPLICATION_HOME/WEB-INF/classes/rsso-agent.properties
rsso-agent.properties: MYIT_TOMCAT/external-confg/rsso-agent.properties This file must be present in MyIT 3.1 and later versions.
Remedy Single Sign-On Area plug-in configuration: AR/Conf/rsso.cfg
RSSO_Tomcat is the home directory of Tomcat on which Remedy Single Sign-On server is deployed. The configuration in Admin UI is saved in database and shared by all Remedy Single Sign-On server nodes using same database instance.
APPLICATION_HOME is the application path that contains 'WEB-INF' folder.
AR is the home directory where Remedy AR System is installed.
5
Verify the Remedy Single Sign-On Admin Session Report.
Use the following URL to see if Remedy Single Sign-On users have successfully logged in: http://<RSSO_Server>:<Port>/rsso/admin
Navigate to the Remedy Single Sign-On Admin console and click the Session.
Verify the Remedy Single Sign-On sessions by accessing the RSSO database and then run the following SQL query: select * from IssuedTokens
6
Verify the RSSO integration on the AR server that points to Smart IT
Make sure the AR server connection with Smart IT is working.
If multiple AR servers (AR1, AR2, AR3) exist and the RSSO-AR integration patch is applied on AR2, perform the following steps:
Open the SMT:Administration Console form on Mid Tier.
Select MyIT-ITSM from Applications.
Make sure that AR2 is set in Data Store.
If AR2 is not listed, navigate to the Persistent Data Stores option. Add a new record for hostname = AR2 and save.
Go back to the application and select AR2 in Data Store for MyIT-ITSM and save the changes.
Note: Access the SMT:Administration Console form directly. Do not use the old BMC MyIT Administration Console form from Application Fly-out for configuration changes.
Similarly, Verify the configuration in the SmartIT_System.CONFIGURATION_PARAMETERtable in the Smart IT database for the connect.arsystem.hostName setting. If a different AR server is set, change it to AR2.
Apply the RSSO-AR integration patch on all AR servers of a load balancer. The hostname must be set to AR2.
7
Validate configurations in the AR system server.
Confirm that the following messages are present in the Smart IT debug logs:
User login_id - AServerUser is Null in UserSessionInfo
ARSystemServerInstallDir/conf/ar.cfg or ar.conf
Operating-Mode = 0
If Operating-Mode is set to 1, change it to 0 and restart the AR and Smart IT services.
8
Verify the RSSO configurations
Configuration 1:
Navigate to RSSO Admin Console > Realm > Authentication > and select ToUppercase from the User ID Transformation list.
Navigate to RSSO Admin Console > Realm > Authentication > and select RemoveEmailDomainfrom theUser ID Transformationlist.
Add ignore-tenant=true tothe following file:
<SmartITTomcat>\external-conf\sso-sdk.properties
9
Confirm setting if SSL-based URLs are enabled for RSSO or Smart IT
If SSL based URLs are used, ensure that the following parameters are set to true: File: <ARSystemServerInstallDir>/conf/rsso.cfg Parameter: com.bmc.rsso.tls.disable.checks: true
Look for the following errors related to ARSYS.AREA.RSSO plugin at ARSystemServerInstallDir\ARSystem\Arserver\Db\arjavaplugin.log and then follow the steps under Resolution:
<PLUGINSVR> <TrID: nZ9PmtHGS4ifeglHEmAVdw:0000001> <TNAME: Thread-96> <ERROR> <ARPluginContext><ARPluginContext.java:217> <ARSYS.AREA.RSSO>Exception on initialization: Could not register consumer 'ar_plugin' at server 'sub-dmn:http://rssoserver/rsso';. Make sure you are using server >= 18.08.00. Cause: Could not register consumer 'ar_plugin' at server 'sub-dmn:http://rssoserver/rsso';. Make sure you are using server >= 18.08.00. Stacktrace: [com.bmc.rsso.sdk.SSOServiceLib.getService(SSOServiceLib.java:83), com.bmc.rsso.plugin.area.RSSOPlugin.getSsoService(RSSOPlugin.java:86), com.bmc.rsso.plugin.area.RSSOPlugin.initialize(RSSOPlugin.java:165), com.bmc.arsys.pluginsvr.plugins.ARPluginLoaderRouter.initializePlugin(ARPluginLoaderRouter.java:877), com.bmc.arsys.pluginsvr.plugins.ARPluginLoaderRouter.loadPlugin(ARPluginLoaderRouter.java:788), com.bmc.arsys.pluginsvr.plugins.ARPluginLoaderRouter.instantiateAllPlugins(ARPluginLoaderRouter.java:768), com.bmc.arsys.pluginsvr.binding.ARPluginDynamicInstantiateHandler$DynamiclyInstantiateOneJavaPlugin.run(ARPluginDynamicInstantiateHandler.java:75), java.lang.Thread.run(Unknown Source)]
{"error":"MOBILITY_ERROR_LOGIN","errorCode":1006,"defaultMessage":"Login Failed: An authentication error occurred in the data server.","additionalMessage":"Authentication failed","detailMessage":"ERROR (623): Authentication failed; Incorrect username or password","ARConnectionProblem":false}
Confirm that the following error is found in F12 developer tools log file:
ERROR (623): Authentication failed; Incorrect username or password.
Steps to reproduce :
Log in to Smart IT using the correct username and password.
After logging in successfully, click the logout button.
On the login page, enter the correct username and wrong password. An error occurs indicating the incorrect credentials.
On the login page, enter the correct credentials. You are still unable to log in.
Resolution
This issue is a known issue DRSMX-72036 in Smart IT 20.02 and was fixed in Smart IT 20.02 HF12. To fix this issue for 20.02, apply the latest hotfix for Smart IT.
Download the latest hotfix for Smart IT from the following location.
Use the Internet Explorer browser to download the hotfix.
13
Verify Remedy Single Sign-On logs and Smart IT logs. (18.x and later)
Verify the following logs:
Remedy Single Sign-On Server log: RSSO_TOMCAT/logs/rsso.log Remedy Single Sign-On server's log level changes automatically within 15 seconds (default configuration check interval). The level changing is done without restarting Remedy Single Sign-On. All Remedy Single Sign-On server nodes share the same log level setting.
Remedy Single Sign-On Agent log: APPLICATION_TOMCAT/logs/rsso-webagent.log
Remedy Single Sign-On Area plug-in log: AR/Arserver/DB/arjavaplugin.log
Smart IT debug log: SmartITInstallationDir\Smart_IT\Smart_IT\Logs
Comments
Log in or register to comment.