Troubleshooting BMC Atrium Single Sign-On problems
This topic describes the common problems faced in BMC Atrium Single Sign-On (SSO) and BMC Atrium Orchestrator (BAO) integration.
- Re-registering agents in Atrium SSO after an upgrade
- Registering agents on a new Atrium SSO server
- Checking that the CDP can communicate with Atrium SSO
- Problem starting BAO when BAO and Atrium SSO are installed on the same server
- BMC Atrium Orchestrator peer does not start after installation or BMC Atrium Orchestrator does not run properly
Re-registering agents in Atrium SSO after an upgrade
When you upgrade Atrium SSO to any later version, sometimes the integration fails and you may encounter one of the following scenarios:
- During a BAO upgrade, you see a message similar to the following example:
The registering AtriumSSO agent process failed. Please refer to installation guide and register the agent of https://<fqdn for baoComponent>:38080/baoComponent manually. - After upgrading BAO, when attempting to log into BAO, you see the following message:
BMCSSG1757E: Integration with Atrium SSO is failing. Please contact the product's support team for help with resolving this integration problem (BMCSSG1766E: Local Atrium SSO certificate does not match remote server certificate. Agent may need to be re-integrated with Atrium SSO server.)
If one of these scenarios occurs, re-register the agents in Atrium SSO again.
The following BMC Communities video (6:41) shows how to re-register web agents in Atrium SSO.
To re-register agents:
- Go to the Atrium SSO Admin Console and click Agent Details.
- Select the check boxes against the BAO agents and click Delete.
- Remove the ${ao_home}/tomcat/atssoAgents directory for the component for which you are re-registering the agents.
- For the repository, this is $<REPO_HOME>/tomcat/atssoAgents
- For the CDP, this is $<CDP_HOME>/tomcat/atssoAgents
Go to the command prompt and run the following command, replacing the variables with your environment information (see the Registration command parameters table below for details):
<AOComponent Install Folder>\jvm\bin\java" -jar "<AO ComponentInstall Folder>\webagent\deployer\deployer.jar"
--install --container-type tomcatv7
--atrium-sso-url <https://customers-sso-instance:port/atriumsso>
--web-app-url <https://url-to-AO-component> or <https://url-to-AO-Load-Balancer>
--notify-url <https://url-to-AO-component>
--web-app-logout-uri /logout
--container-base-dir "<AO ComponentInstall Folder>\tomcat"
--admin-name <amadmin>
--admin-pwd <ampassword>
--jvm-truststore "<AOComponent Install Folder>\jvm\lib\security\cacerts"
--jvm-truststore-password changeit
--truststore "<AO Component InstallFolder>\tomcat\conf\.keystore"
--truststore-password changeit
--not-enforced-uri-file "<AO Component Install Folder>\excludedURLs"Sample command for the repository:
C:\Program Files\BMC Software\BAO\repo\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\repo\webagent\deployer\deployer.jar"
--install --container-type tomcatv7
--atrium-sso-url https://<fqdn for sso server>:8443/atriumsso
--web-app-url https://<fqdn for your component>:28080/baorepo or <https://url-to-AO-Load-Balancer>
--notify-url <https://<fqdn for your component>:28080/baorepo
--web-app-logout-uri "/logout"
--container-base-dir "C:\Program Files\BMC Software\BAO\repo\tomcat"
--admin-name amadmin --admin-pwd <sso admin password>
--jvm-truststore "C:\Program Files\BMC Software\BAO\repo\jvm\lib\security\cacerts"
--jvm-truststore-password changeit
--truststore "C:\Program Files\BMC Software\BAO\repo\tomcat\conf\.keystore"
--truststore-password changeit
--not-enforced-uri-file "C:\Program Files\BMC Software\BAO\repo\excludedURLs"Sample command for the CDP:
C:\Program Files\BMC Software\BAO\CDP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\CDP\webagent\deployer\deployer.jar"
--install --container-type tomcatv7
--atrium-sso-url https://<fqdn for sso server>:8443/atriumsso
--web-app-url https://<fqdn for your component>:38080/baocdp or <https://url-to-AO-Load-Balancer>
--notify-url <https://<fqdn for your component>:38080/baocdp
--web-app-logout-uri "/logout"
--container-base-dir "C:\Program Files\BMC Software\BAO\CDP\tomcat"
--admin-name amadmin --admin-pwd <sso admin password>
--jvm-truststore "C:\Program Files\BMC Software\BAO\CDP\jvm\lib\security\cacerts"
--jvm-truststore-password changeit
--truststore "C:\Program Files\BMC Software\BAO\CDP\tomcat\conf\.keystore"
--truststore-password changeit
--not-enforced-uri-file "C:\Program Files\BMC Software\BAO\CDP\config\excludedURLs"Sample command for the graphing server:
C:\Program Files\BMC Software\BAO\CDP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\CDP\webagent\deployer\deployer.jar"
--install --container-type tomcatv7
--atrium-sso-url https://<fqdn for sso server>:8443/atriumsso
--web-app-url https://<fqdn for your component>:38080/baograph or <https://url-to-AO-Load-Balancer>
--notify-url <https://<fqdn for your component>:38080/baograph
--web-app-logout-uri "/logout"
--container-base-dir "C:\Program Files\BMC Software\BAO\CDP\tomcat"
--admin-name amadmin --admin-pwd <sso admin password>
--jvm-truststore "C:\Program Files\BMC Software\BAO\CDP\jvm\lib\security\cacerts"
--jvm-truststore-password changeit
--truststore "C:\Program Files\BMC Software\BAO\CDP\tomcat\conf\.keystore"
--truststore-password changeit
--not-enforced-uri-file "C:\Program Files\BMC Software\BAO\CDP\config\excludedURLs"Sample command for the OCP (installed with the CDP):
C:\Program Files\BMC Software\BAO\CDP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\CDP\webagent\deployer\deployer.jar"
--install --container-type tomcatv7
--atrium-sso-url https://<fqdn for sso server>:8443/atriumsso
--web-app-url https://<fqdn for your component>:38080/baoocp or <https://url-to-AO-Load-Balancer>
--notify-url <https://<fqdn for your component>:38080/baocdp
--web-app-logout-uri "/logout"
--container-base-dir "C:\Program Files\BMC Software\BAO\CDP\tomcat"
--admin-name amadmin --admin-pwd <sso admin password>
--jvm-truststore "C:\Program Files\BMC Software\BAO\CDP\jvm\lib\security\cacerts"
--jvm-truststore-password changeit
--truststore "C:\Program Files\BMC Software\BAO\CDP\tomcat\conf\.keystore"
--truststore-password changeit
--not-enforced-uri-file "C:\Program Files\BMC Software\BAO\CDP\config\excludedURLs"Sample command for the OCP (standalone installation):
C:\Program Files\BMC Software\BAO\OCP\jvm\bin\java" -jar "C:\Program Files\BMC Software\BAO\OCP\webagent\deployer\deployer.jar" --install --container-type tomcatv7
--atrium-sso-url https://<fqdn for sso server>:8443/atriumsso
--web-app-url https://<fqdn for your component>:38080/baoocp or <https://url-to-AO-Load-Balancer>
--notify-url <https://<fqdn for your component>:38080/baoocp
--web-app-logout-uri "/logout"
--container-base-dir "C:\Program Files\BMC Software\BAO\OCP\tomcat"
--admin-name amadmin --admin-pwd <sso admin password>
--jvm-truststore "C:\Program Files\BMC Software\BAO\OCP\jvm\lib\security\cacerts"
--jvm-truststore-password changeit
--truststore "C:\Program Files\BMC Software\BAO\OCP\tomcat\conf\.keystore"
--truststore-password changeit- Restart BAO peers.
Registration command parameters
Parameter | Definition | Required |
|---|---|---|
container-type | Type of Web server used to host BAO. | Yes |
atrium-sso-url | Address of the Atrium SSO instance. | Yes |
web-app-url | Address of BAO or of the load balancer. | Yes |
web-app-logout-uri | The URL where the application is directed upon user logout. | Yes |
container-base-dir | The Web server home directory. | Yes |
admin-name | The Atrium SSO admin user name. | Yes |
admin-pwd | The Atrium SSO admin password. | Yes |
jvm-truststore | The truststore location. Include the path and file name of JVM’s truststore file (cacerts). | Yes |
jvm-truststore-password | The cacerts truststore file password. | Yes |
truststore | The truststore location. Include the path and file name of SSL certificate keystore. | Required if BAO is configured for HTTPS. |
truststore-password | The SSL certificate truststore file password. | Required if BAO is configured for HTTPS. |
not-enforced-uri-file | The file that Atrium SSO uses to store the data that goes in its NotEnforcedURI table. | Yes This is not required if you installed the Operator Control Panel separately from the CDP. |
notify-url | The BAO address if web-app-url specifies a load balancer. | Required if web-app-url specifies a load balancer. |
Verify your Not Enforced URIs list and load balancer domain
After completing the previous steps, check that your Not Enforced URIs and load balancer domain setups are correct. (See KA000029966 How can I re-register a BAO instance with Atrium SSO).
From the Atrium SSO Admin Console verify your Not Enforced URIs lists by clicking Agent Details, checking that the appropriate agent from the list is displayed and editing it. In the agent details Not Enforced URIs list, verify the following values for your setup:
- For the CDP, the following values must be present:
/baocdp/orca*
/baocdp/ws*
/baocdp/atsso* - For the repository the following values must be present:
/baorepo/http/resource*
/baorepo/http/configuration*
/baorepo/resource
/baorepo/http/mediaMetadataField*
Also, verify that the domain of the load balancer matches the domain of your BAO peer.
Registering agents on a new Atrium SSO server
If you are registering agents on a new Atrium SSO server, you must manually edit the context.xml file in the repository directory to point to the new Atrium SSO server URL.
To change the Atrium SSO URL:
- Go to <AO_HOME>/tomcat/conf/context.xml.
- Look for the com.bmc.ao.sso.ATRIUM_SSO_SERVER_URL property and provide the URL to the Atrium SSO server, which you want to connect to the repository.
For more information, see Knowledge Base article KA000029966.
Checking that the CDP can communicate with Atrium SSO
The CDP should be able to communicate with Atrium SSO if the SSO port is accessible. You can use telenet to check the port connection.
The telenet command format is similar to the following:
For more information about using telenet, see Using telnet to check port access
Problem starting BAO when BAO and Atrium SSO are installed on the same server
If BAO and Atrium SSO are installed on the same server and BAO fails to start, ensure that the Atrium SSO service is running before starting the BAO service.
- Start the Atrium SSO service (see Starting-and-stopping-product-components-and-services).
- Log into the Atrium SSO console to ensure that it is running.
- Start the BAO service (see Starting-and-stopping-product-components-and-services).
- Log into BAO (see Logging-into-Grid-Manager-and-Repository-Manager).
BMC Atrium Orchestrator peer does not start after installation or BMC Atrium Orchestrator does not run properly
The symptoms may be that BAO fails to register with BMC Atrium Single Sign-On or that peers take several hours to start. This may be due to inadequate system entropy.
See the BMC Atrium Single Sign-On System requirements page for more information. You can also find information in Knowledge Article Actions fail in Atrium Orchestrator due to low system entropy KA000066336.