Troubleshooting authentication issues

After configuring the BMC Helix SSO agent for using the OpenID scope, the BMC Helix SSO server fails to generate id_token in the following scenarios, and an exception is logged in the BMC Helix SSO agent logs:

• If you do not generate the JSON web key (JWK), the BMC Helix SSO server does not find the private key to sign and cannot generate the issue id_token. 
• You do not provide the URL of the server issuing the id_token.

For more information about the exception, see the BMC Helix SSO agent logs.

After configuring the BMC Helix SSO agent for using the OpenID scope, make sure that you:

• Provide the URL of the server issuing the id_token in the OpenID Issuer URL field on the OAuth2 > Settings tab.
• Generate the JWK from the OAuth2 > OpenID tab.

At the time of registering a client as an OAuth2 client, if you do not select the openid (Scope used for OpenID connect) check box, the client cannot use the OpenID scope. The BMC Helix SSO server logs a message mentioning that the specified OAuth2 client is not allowed to use the OpenID scope.

Synchronize the time on the BMC Helix SSO server and BMC Helix SSO agent machines.

Users are not authenticated. The following records are available in the BMC Helix SSO server logs:

Add the Java properties for the JVM that Tomcat uses.

Microsoft Windows example:

• 
  
  1. Use the tomcatXw.exe GUI.
  2. Create a setenv.bat file with the content similar to the Linux example.

If the LDAP server uses a self-signed certificate, the JVM that Tomcat uses on the BMC Helix SSO server does not trust this certificate.

To use TLS/SSL connection to the LDAP server, import the LDAP server certificates (cacerts) to the truststore (JavaHome \jre\lib\security) of the Apache Tomcat used by the Remedy SSO server. Import the certificates by using third-party utilities such asKeyStore Explorer.

When the BMC Helix SSO server and the integrated application both use self-signed TLS/SSL certificates for the HTTPS connection, the certificate confirmation dialog box breaks the flow, and you cannot log in by using Microsoft Edge and Safari browsers.

LDAP test connection fails

In the BMC Helix SSO Admin Console, when you configure LDAP and click Test, the following message is displayed: Connection to the LDAP server failed or the host name or port number is incorrect.

The test connection failure can be caused by the incorrect attributes in the LDAP authentication window.

First, in the BMC Helix SSO Admin Console, check the following attributes:

• Server Host(s)—The host name of your directory server, for example, ad.bmc.com, ldap.bmc.com, opends.bmc.com.
• Server Port—The port that your directory listens on, for example, 389, 10389, 636 (for example, the SSL port that your directory listens on).
• Use TLS connection—This check box should be selected if the connection to the directory server is an SSL connection. 
  To use this setting, you also need to configure an SSL certificate.
• Bind DN—The distinguished name of the user that the application leverages when connecting to the directory server; for example, cn=administrator,cn=users,dc=ad,dc=bmc,dc=com; cn=user,dc=domain,dc=com; user@domain.com.
  To connect to LDAP, the user must have the "Bind" and "Read" privileges.
• Bind Password—The password of the user specified in the Bind DN field.
  The password cannot be one-way hashed. It must be recoverable in the context of the application.

If the test connection still fails, use LDAP administration tools such as LDAP Admin for Windows or JXplorer for Linux to identify whether the issue is caused by BMC Helix SSO or your LDAP connection.

LDAP Admin example:

1. Click Start > Connect > Create New Connection.
2. In the Connection name field, specify a descriptive connection name.
3. Click Admin, and configure the following attributes:
   

• Host—Specify the name of the LDAP server.
• Port—Specify the default LDAP port is 389.

4. (Optional) If the LDAP server uses an SSL certificate, the port number changes to 636. In this case, you must select the SSL check box.

5. Clear the Anonymous connection check box.

6. In the Username field, specify a username or an LDAP bind user format name.

7. In the Password field, specify the password for the user.

8. Click Test connection.

If the test connection is successful, click Fetch DNs and see a list of DNs on the LDAP server.

If the test connection fails with the following messages, contact the LDAP Administrator:

• Exception Security Context—The username or password is incorrect.
• LDAP Server Down—The hostname is incorrect or you cannot reach the LDAP server from your location.

To enable LDAPS:

1. If the LDAP team does not have such a certificate, install a certificate that meets the documented requirements; see the Requirements for an LDAPS certificate paragraph in How to enable LDAP over SSL with a third-party certification authority.

2. Import the LDAP certificate into the Java keystore file of the BMC Helix SSO server by running the following command: keytool -importcert -v -keystore "<path-to-jre>\lib\security\cacerts" -file "<path-to-ldap-cert-file>"
   
3. Enter the password.
   This Java keystore file should be the one that runs the Tomcat service for BMC Helix SSO. To find out which Java keystore file serves the BMC Helix SSO Tomcat on Windows, run tomcat.exe depending on which Tomcat version you use, and under the Java tab, see the path. For Linux, run ps ef | grep tomcat.

4. (Windows) In the Java Options field, specify the Java truststore parameters, for example:

-Djavax.net.ssl.trustStore=<path to jre cacerts> 
-Djavax.net.ssl.trustStorePassword=changeit 

5. (Linux) Go to the sh Tomcat startup file and specify the Java truststore parameters, for example:

set JAVA_OPTS="-Djavax.net.ssl.trustStore=<path to jre_keystore" "-Djavax.net.ssl.trustStorePassword=changeit"  

6. Save the configuration.

7. Restart the Tomcat service.

8. In the BMC Helix SSO Admin Console, test the LDAP connection by using the server port 686 and selecting the Use TLS connection check box.

Login to BMC Mid Tier, BMC Helix ITSM: Smart IT and BMC Helix Digital Workplace fails.

Users cannot log in to BMC Mid Tier, BMC Helix ITSM: Smart IT and BMC Helix Digital Workplace.

There are multiple factors that can cause this problem. On the BMC Helix SSO side, you can use the two paths:

• Check whether the LDAP users are already present in the CTM:People form.
  In the BMC Helix SSO logs, you can see the following message:
  ERROR: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C09042F, comment: AcceptSecurityContext error, data 52e, v2580
  This error indicates an issue with the user account that is used to connect to the LDAP server. The account can be locked out, requires a password change, or the password is incorrect.
• Check one of the BMC Helix SSO server logs: "rsso.log" or "rsso.0.log". The UserID must not be "None" and LDAP must send the correct user name (the same as the Login name in the CTM:People form of AR user forms).

If you log in to one of these BMC products and see the error "You are not authorized to use this system", the user does not belong to any group that has correct login permissions.

To check it on the BMC Helix SSO side, in the BMC Helix SSO Admin Console, click the Session tab.

If the userID is listed, but disappears in 10 seconds. BMC Helix SSO has successfully authenticated the user with LDAP, but BMC TrueSight Operations Management has not given the user a group permission.

You must check whether the users and groups belong to the Authorization Profile in BMC TrueSight Presentation Server:

1. Log in to BMC TrueSight Presentation Server as a default admin user.
2. Go to Administration > Authorization Profiles.
3. Create a new authorization profile by clicking the vertical ellipsis next to the Authorization Profiles field.
4. In the Authorization Profile Name field, specify the authorization profile name.
5. Click User Groups > Add.

BMC Helix SSO connects to LDAP to fetch the groups from the LDAP server and the local BMC Helix SSO User Management Groups (Roles).

After the group has been added to the profile, you must assign roles to this group:

1. Click Roles > Add.
2. In the Search for Roles window, select the roles that you want to add for the profile.
3. Click OK.
   Depending on the roles you have given to the authorization profiles, you might also need to add objects.

If you log in to BMC TrueSight Operations Management as an LDAP user, BMC Helix SSO authenticates you and then BMC TrueSight Operations Management authorizes you. Any other LDAP users that belong to this group can also log in to BMC TrueSight Operations Management.

In the BMC Helix SSO Admin Console, check that the attributes in the LDAP authentication window are correct and the Enable Group Retrieval check box is selected.

The external LDAP attributes are mapped to the BMC Helix SSO fields:

• User Attributes are mapped to the User Authentication tab in BMC Helix SSO.
• Group Attributes are mapped to the Group Support tab in BMC Helix SSO.
• Connection Settings are mapped to the LDAP connection settings in the BMC Helix SSO Admin Console (Host, Port, Bind DN, Bind Password, Users Base DN, Identity Attribute).

If the issue persists, use the filters in the LDAP administration tool such as LDAP Admin to see how many results you have. If the list is lengthy, narrow down the search to see the groups.

The LDAP server returns more than one entry for one user with an error in the BMC Helix SSO logs:

04-03-20 10:23:57.069 [3-exec-249] WARN  com.bmc.rsso.data.idps.IdPLDAP.getUserGroups()  : LDAP error: 'LDAP server returned more than one entry for user: userxxxx'
com.bmc.rsso.core.ldap.LDAPConfigurationException: LDAP server returned more than one entry for user: userxxxx
    at com.bmc.rsso.core.ldap.LDAPHelper.searchUserEntry(LDAPHelper.java:103)
    at com.bmc.rsso.core.ldap.LDAPHelper.getGroupsByUser(LDAPHelper.java:173)
    at com.bmc.rsso.data.idps.IdPLDAP.getUserGroups(IdPLDAP.java:298)
    at com.bmc.rsso.servlet.rest.admin.GroupsForUserResource$1.doWithNode(GroupsForUserResource.java:63)
    at com.bmc.rsso.servlet.rest.admin.IdpsToJson.convert(IdpsToJson.java:35)
    at com.bmc.rsso.servlet.rest.admin.GroupsForUserResource.getUserGroupsForUser(GroupsForUserResource.java:65)
    at sun.reflect.GeneratedMethodAccessor123.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
    at java.lang.reflect.Method.invoke(Unknown Source)

It is a LDAP configuration issue. In the BMC Helix SSO Admin Console, in the User Authentication tab for LDAP, compare the default filter parameters against their values and correct any that do not match. The (sAMAccountName=$USER$) parameter must be specified.

An exception is generated in the logs when the keytab file is generated with a key version number (KVNO) different from the one specified in the ticket.

The log file might look something like this:

Regenerate the keytab file. You must specify the /kvno 0 option to ensure that the KVNO value is compatible.

The token that the BMC Helix SSO server receives from the client is a Microsoft Windows NT LAN Manager (NTLM) token and not the Kerberos token.

If this issue happens, the following entry is recorded in the log file:

The entry Authentication token is NTLM but not SPNEGO.

Ensure that the BMC Helix SSO server host name or domain is added to the list of websites for Kerberos authentication.

The failure could happen due to the following reasons:

• A browser is not correctly configured to use Kerberos authentication.
  For information about how to configure the browser correctly, see Configuring-Kerberos-authentication.

• A service token for the BMC Helix SSO server was not obtained. Make sure that a Kerberos service ticket is obtained when it tries to access theBMC Helix SSO server on a client's machine.

  Click here to view more details

  Check that customer's computer asked for the BMC Helix SSO server from the key distribution center (KDC), and then issued a service ticket:

  c:\Windows\system32\klist.exe
  ...
  #1> Client: dev_adei @ QA2R.LOCAL
     Server: HTTP/access.bmc.com @ QA2R.LOCAL
     KerbTicket Encryption Type: AES-256-CTS-HMAC-SHA1-96
     Ticket Flags 0x40a10000 -> forwardable renewable pre_authent name_canonicalize
     Start Time: 11/3/2016 9:00:43 (local)
     End Time:   11/3/2016 19:00:43 (local)
     Renew Time: 11/10/2016 9:00:43 (local)
     Session Key Type: AES-256-CTS-HMAC-SHA1-96
  ...
  

The keytab file does not contain an entry to decrypt a service ticket. The logs might look something like this:

Examine items and make sure that the service principal names (SPNs) are valid. If an SPN password is used in the BMC Helix SSO Admin Console, ensure that the Service Principal Name is specified as HTTP/access.bmc.com@RSSO.COM.

To see content of the existing keytab file, run the ktab command.

Install JCE Unlimited Strength Jurisdiction Policy Files for JDK/JRE to support AES128 and AES256 encryption types. You can find the policy files at the following links:

• Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for JRE 8

• Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files for JRE 7

Also, install these policy files in the JRE that is used by the Tomcat server on which the BMC Helix SSO runs.