Troubleshooting Remedy Single Sign-On integration with Smart IT

When you integrate Remedy Single Sign-On with Smart IT, you might experience issues such as authentication failure or other errors. Use the information in this topic to understand and resolve the problem or to create a BMC Support case.

Issue symptoms

One or more of the following symptoms might occur:

  • Authentication fails when you log in to Smart IT.
  • You see a continuous spinning wheel after entering your login credentials and are unable to log in to Smart IT.
  • When you log in to Smart IT, the following error message appears:
    An error occurred. Please contact your administrator or retry later mm/dd/yyyy hh:mm 
  • The UX log shows the following entry: 
    Caused by: com.bmc.arsys.api.ARException: ERROR (623): Authentication failed; Incorrect username or password.
  • The RSSO log shows the following entry: 
    SEVERE Thread_138 com
  • The network logs show the following message:
    "UnauthorizedException: Missing People Info.","detailedMessage":"HTTP 403 Forbidden"

Related topics

Integrating Remedy SSO with Smart IT(BMC Remedy Single Sign-On documentation)

Troubleshooting BMC Remedy Single Sign-on issues (BMC Remedy Single Sign-On documentation)


Scope

One or more users might experience the problem.

Resolution

Perform the following tasks to troubleshoot the Remedy Single Sign-On integration issues:

Task

Action

Steps

Reference

1

Integrating Remedy Single Sign-On with Action Request System (AR System) 

Using the installer, verify that Remedy Single Sign-On is integrated with AR System. Perform this check before integrating the Remedy Single Sign-On agent with Smart IT.

2

Verify processes and verify that you are able to log in to Remedy Mid Tier or Smart IT.

  • Verify whether the following processes are running. If required, restart the service.  
    • Tomcat
    • Smart IT
    • Remedy AR System
  • To rule out an Active Directory issue, try logging in as a user with an Active Directory account through Remedy Mid Tier.
  • To rule out a Smart IT issue, try logging in with the Remedy Single Sign-On bypass URL by using Remedy user password from the User form.

See the following video for troubleshooting Remedy Single Sign-On:

icon-play.pnghttps://www.youtube.com/embed/wLkFsjp8NfE

3

Confirm Remedy Single Sign-On integration with Remedy AR System and Smart IT.

a. Confirm that Remedy Single Sign-On has been successfully integrated with Remedy AR Server.

b. Confirm that Remedy Single Sign-On has been successfully integrated with Smart IT.
c. By default, Smart IT includes the required JAR files to integrate with Remedy Single Sign-On. However, some files might have been removed, so you must verify that these JAR files are present. For more information, see task 10 in this topic. 

d. Ensure that the SAML_AUTHENTICATION parameter is set to 1 in the Smart IT database. To integrate Remedy Single Sign-On with Smart IT, use the following SQL queries:

i. To enable the SAML_AUTHENTCATION parameter, use the following query:
UPDATE SmartIT.SmartIT_System.TENANT SET SAML_AUTHENTICATION = 1;
Note: Restart Smart IT application services to ensure the change takes effect.  

ii. To Verify the value of the SAML_AUTHENTICATION parameter, use the following query:
select SAML_AUTHENTICATION from SmartIT.SmartIT_System.TENANT;

4

Confirm Remedy Single Sign-On configuration files.

Verify the following files:

  • Remedy Single Sign-On Server configuration: RSSO_Tomcat/webapps/rsso/META-INF/context.xml (database connection)
    Use the following URL in the context.xml file to specify the database connection:
    url="jdbc:sqlserver://<DB_server_name>:1433;databaseName=rsso;instanceName=MSSQL"
  • Remedy Single Sign-On Agent configuration: APPLICATION_HOME/WEB-INF/classes/rsso-agent.properties
  • rsso-agent.properties: MYIT_TOMCAT/external-confg/rsso-agent.properties
    This file must be present in MyIT 3.1 and later versions.
  • Remedy Single Sign-On Area plug-in configuration: AR/Conf/rsso.cfg

RSSO_Tomcat is the home directory of Tomcat on which Remedy Single Sign-On server is deployed.
The configuration in Admin UI is saved in database and shared by all Remedy Single Sign-On server nodes using same database instance.

APPLICATION_HOME is the application path that contains 'WEB-INF' folder.

AR is the home directory where Remedy AR System is installed.

5

Verify the Remedy Single Sign-On Admin Session Report.

  • Use the following URL to see if Remedy Single Sign-On users have successfully logged in:
    http://<RSSO_Server>:<Port>/rsso/admin
  • Navigate to the Remedy Single Sign-On Admin console and click the Session.
    rsso_admin_console.png
  • Verify the Remedy Single Sign-On sessions by accessing the RSSO database and then run the following SQL query:
    select * from IssuedTokens


6

Verify the RSSO integration on the AR server that points to Smart IT

  • Make sure the AR server connection with Smart IT is working.
  • If multiple AR servers (AR1, AR2, AR3) exist and the RSSO-AR integration patch is applied on AR2, perform the following steps:
    • Open the SMT:Administration Console form on Mid Tier.
    • Select MyIT-ITSM from Applications.
    • Make sure that AR2 is set in Data Store.
    • If AR2 is not listed, navigate to the Persistent Data Stores option. Add a new record for hostname = AR2 and save.
    • Go back to the application and select AR2 in Data Store for MyIT-ITSM and save the changes.

Note: Access the SMT:Administration Console form directly. Do not use the old BMC MyIT Administration Console form from Application Fly-out for configuration changes.

6.1.png

  • Similarly, Verify the configuration in the SmartIT_System.CONFIGURATION_PARAMETER table in the Smart IT database for the connect.arsystem.hostName setting.
    If a different AR server is set, change it to AR2.
  • Apply the RSSO-AR integration patch on all AR servers of a load balancer. The hostname must be set to AR2.
    6.2.png


7

Validate configurations in the AR system server.

Confirm that the following messages are present in the Smart IT debug logs:

  • User login_id - AServerUser is Null in UserSessionInfo
  • ARSystemServerInstallDir/conf/ar.cfg or ar.conf
  • Operating-Mode = 0

If Operating-Mode is set to 1, change it to 0 and restart the AR and Smart IT services. 

7.1.png


8

Verify the RSSO configurations

Configuration 1:

  1. Navigate to RSSO Admin Console > Realm > Authentication > and select ToUppercase from the User ID Transformation list.
    8.1.png
  2. Add ignore-tenant=true to the following files:  
    • <SmartITTomcat\external-conf\sso-sdk.properties
    • <SmartITInstallDir>\Smart_IT\Smart_IT\smartit\WEB-INF\classes\sso-sdk.properties
      8.2.png

Configuration 2:

  1. Navigate to RSSO Admin Console > Realm > Authentication > and select RemoveEmailDomain from the User ID Transformation list. 
    8.3.png
  1. Add ignore-tenant=true to the following file:  
    • <SmartITTomcat>\external-conf\sso-sdk.properties8.4.png


9

Confirm setting if SSL-based URLs are enabled for RSSO or Smart IT 

If SSL based URLs are used, ensure that the following parameters are set to true:

File: <ARSystemServerInstallDir>/conf/rsso.cfg
Parameter: com.bmc.rsso.tls.disable.checks: true
9.1.png


File: <SmartITTomcat>/external-conf/rsso-agent.properties
Parameter: com.bmc.rsso.tls.disable.checks= true
9.2.png

10

Verify RSSO related libraries in the Smart IT Tomcat folder

To install the new Remedy SSO features in an upgraded environment, perform the following steps:

  1. To clear the old Remedy SSO jar files.
  2. Stop Smart IT.
  3. Copy the following jar files from the Remedy SSO machine <Installer Path \Disk1\files\lib>, and paste the files at <SmartITTomcat>/external-conf/lib>:
    • caffeine-x.x.x.jar
    • gson-x.x.x.jar
    • jackson-annotations-x.x.x.jar
    • jackson-core-x.x.x.jar
    • jackson-databind-x.x.x.x.jar
    • jjwt-api-x.xx.x.jar
    • jjwt-impl-x.xx.x.jar
    • jjwt-jackson-x.xx.x.jar
    • json-20180813.jar
    • org.apache.oltu.oauth2.client-x.x.x.jar
    • slf4j-api-x.x.xx.jar
  4. Copy the following files from the <Disk1/files/rsso-agent> folder to <SmartITTomcat>\external-conf\lib>: 
    • rsso-client-impl.jar
    • rsso-sdk-atsso.jar
    • rsso-agent-all.jar

11

Verify  arjavaplugin.log in AR Server

Look for the following errors related to ARSYS.AREA.RSSO plugin at ARSystemServerInstallDir\ARSystem\Arserver\Db\arjavaplugin.log and then follow the steps under Resolution:

<PLUGINSVR> <TrID: nZ9PmtHGS4ifeglHEmAVdw:0000001> <TNAME: Thread-96> <ERROR> <ARPluginContext><ARPluginContext.java:217>   <ARSYS.AREA.RSSO>Exception on initialization: Could not register consumer 'ar_plugin' at server 'sub-dmn:http://rssoserver/rsso';. Make sure you are using server >= 18.08.00. Cause: Could not register consumer 'ar_plugin' at server 'sub-dmn:http://rssoserver/rsso';. Make sure you are using server >= 18.08.00. Stacktrace: [com.bmc.rsso.sdk.SSOServiceLib.getService(SSOServiceLib.java:83), com.bmc.rsso.plugin.area.RSSOPlugin.getSsoService(RSSOPlugin.java:86), com.bmc.rsso.plugin.area.RSSOPlugin.initialize(RSSOPlugin.java:165), com.bmc.arsys.pluginsvr.plugins.ARPluginLoaderRouter.initializePlugin(ARPluginLoaderRouter.java:877), com.bmc.arsys.pluginsvr.plugins.ARPluginLoaderRouter.loadPlugin(ARPluginLoaderRouter.java:788), com.bmc.arsys.pluginsvr.plugins.ARPluginLoaderRouter.instantiateAllPlugins(ARPluginLoaderRouter.java:768), com.bmc.arsys.pluginsvr.binding.ARPluginDynamicInstantiateHandler$DynamiclyInstantiateOneJavaPlugin.run(ARPluginDynamicInstantiateHandler.java:75), java.lang.Thread.run(Unknown Source)]

<PLUGINSVR> <TrID: nZ9PmtHGS4ifeglHEmAVdw:0000001> <TNAME: Thread-96> <ERROR> <ARPluginLoaderRouter>

<ARPluginLoaderRouter.java:835>Thread 249 failed to create an instance of ARSYS.AREA.RSSO>

Resolution

  1. Depending on the version of Smart IT that you are using, download the applicable fix:
  2. Stop the AR System server.
  3. Create a backup of the ARSystemServerInstallDir/pluginsvr/rsso-area-plugin-all.jar file.
  4. Replace it with rsso-area-plugin-all.jar file. This file is available in the fix mentioned in step 1. 
  5. Restart the AR System server.


12

Verify the REST API status



Request URL POST:

http://<smart-it url>:9000/smartit/rest/users/sessions/username

Response from server:

{"error":"MOBILITY_ERROR_LOGIN","errorCode":1006,"defaultMessage":"Login Failed: An authentication error occurred in the data server.","additionalMessage":"Authentication failed","detailMessage":"ERROR (623): Authentication failed; Incorrect username or password","ARConnectionProblem":false}

Confirm that the following error is found in F12 developer tools log file:

ERROR (623): Authentication failed; Incorrect username or password.

Steps to reproduce :

  1. Log in to Smart IT using the correct username and password.
  2. After logging in successfully, click the logout button.
  3. On the login page, enter the correct username and wrong password. An error occurs indicating the incorrect credentials.
  4. On the login page, enter the correct credentials. You are still unable to log in.

Resolution

This issue is a known issue DRSMX-72036 in Smart IT 20.02 and was fixed in Smart IT 20.02 HF12. To fix this issue for 20.02, apply the latest hotfix for Smart IT.

Download the latest hotfix for Smart IT from the following location. 

ftp://ftp.bmc.com/pub/ARRecommendedFixes/SmartIT/20.02/

Use the Internet Explorer browser to download the hotfix.

13

Verify Remedy Single Sign-On logs and Smart IT logs. (18.x and later)

Verify the following logs:

  • Remedy Single Sign-On Server log: RSSO_TOMCAT/logs/rsso.log
    Remedy Single Sign-On server's log level changes automatically within 15 seconds (default configuration check interval). The level changing is done without restarting Remedy Single Sign-On. All Remedy Single Sign-On server nodes share the same log level setting.
  • Remedy Single Sign-On Agent log: APPLICATION_TOMCAT/logs/rsso-webagent.log
  • Remedy Single Sign-On Area plug-in log: AR/Arserver/DB/arjavaplugin.log
  • Smart IT debug log: SmartITInstallationDir\Smart_IT\Smart_IT\Logs

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*