PAM Dashboard error No features are currently available

[Bipin Sharma]

CA PAM login shows dashboard error message 

 Error: PAM-CM-0039: Unable to perform the operation. Please contact System Administrator.

PAM-UI-1702: No features are currently available  

 

and syslog error shows the below for the same - 

Unauthorized access to service controller

we observed this behavior when the particular node is part of the cluster and when we stop the cluster and try to login, it works fine. there was no error on cluster status or cluster logs.

 

Root cause please ?

[Ralf Prigl]

Hello Bipin, this is too generic of an error to comment on. Please open a support case and attach the system logs from the Configuration > Diagnostics page. Assuming this is for PAM 3.X, you would expand Diagnostics in the Configuration menu on the left, select "Diagnostic Logs”, go to the "Download' page and click the DOWNLOAD button to the right of the CHOOSE FILE button.

[warri03]

BipinSh there is an internal thread around this as well and at least one other support ticket.  If you are seeing this on nodes in secondary cluster, the behavior is similar.

[Bipin Sharma]

That's right Richard. we are seeing this issue very frequently now and all secondary cluster nodes are getting affected. we can not stop and start cluster daily as it impacts end users activities. Please suggest.

[warri03]

I would open a support ticket if you have not already, so that your examples can be added to the existing research. 

[Bipin Sharma]

I did opened one ticket (00980452)with CA Support, but the answer was same that whenever this issue occurs we have to bring down the cluster and start again, which is not acceptable by end user. Please suggest if any patch or permanent fix is available for this issue. Daily we are facing this issue.

[Ralf Prigl]

This ticket is still open. Please use the support ticket for communication until the problem is resolved.

[Stefan Sia]

I am currently facing the same issue. 

Both errors (PAM-CM-0039 & PAM-UI-1702) showed when using CA PAM client.

While using the web browser, only PAM-UI-1702 appeared.

 

Is this issue fixed?

[Bipin Sharma]

Yes, this was fix in hotfix 3.1.1.09 version. Go ahead and install it.

[Stefan Sia]

Thank you for your reply.
But I believe this particular hotfix had been removed from the website: CA Privileged Access Manager Solutions & Patches - CA Technologies 

[Bipin Sharma]

Then it may be included in the current version of PAM, what version you are on?

[Stefan Sia]

I am currently running on 3.1.1.03

[Bipin Sharma]

03 version doesn't have this fix. On your support ticket, ask for the hotfix 3.1.1.09, you should be good.

[SungHoon_Kim]

This issue can also occur if your /tmp becomes full.

For example, you were troubleshooting some issues and enabled debugging in many logs.

When you click on "Download System Logs" button, PAM will zip /var/logs, /opt/cloacware/*** and /opt/shibboleth-idp/*** folders and store them in /tmp/logs.tar.gz

Then PAM would encrypt this file and create /tmp/logs.bin file.

 

Let's say your /tmp partition was 2GB and the logs.tar.gz was generated to be 1GB.

Then logs.bin file will be generated which would be slightly larger than the logs.tar.gz file.

So, while creating logs.bin file, the /tmp partition might get full and this can affect running services from operating.

 

When you try to logon to PAM, you should still be able to logon but will see PAM-CM-0039(Unable to perform the operation) and PAM-UI-1702(No features are currently available).

 

If you had Debug SSH service enabled, then support can login via SSH and check if the /tmp partition is indeed full.

This would be one of the causes that can result in these errors.

[Kazuhisa Takazawa]

Please let me ask additionally to old discussion.

I had same problem in Japan and I am having a serious problem by the attached error.

Because I am using Ver.3.4.3, I can not request to support because the version has been expired support.

if I could be advised how I can solve this problem, I will be helped greatly.
Anyone can help?

------------------------------
Kazuhisa Takazawa
MP Support Dept.
IIM Corporation
------------------------------

[Ralf Prigl]

Hello, The screenshot says that this is version 3.3.1, not 3.4.3. The 3.3.1 release reached EOS in May 2021. Is this an old test environment that you are trying to revive and upgrade? Generally one would expect that something so old has not been used for a long time and likely is not worth reviving. From a Support perspective we would not assist in resolving any functional problem in an old release, but we would try to help resolving an issue that prevents upgrade to a supported release, as long as you have an active entitlement to the product.

[Kazuhisa Takazawa]

Dear Ralf-san,

Thank you for your reply.

We are requesting the user to upgrade to supported version strongly.

But because the super account can't operate anything in the current situation, the user can't do anything to upgrade.
If there is any solution to make the super account work, we will be helped greatly.
Thank you for your great help.

IIM Takazawa

------------------------------
Kazuhisa Takazawa
MP Support Dept.
IIM Corporation
------------------------------

[Reatesh Sanghi]

Hello,

You can upgrade the existing version even by doing a login using the config user.

The config user login needs to be performed using the Web browser. https://CA_PAM_SERVER_IP/config

You can check this option.

Thanks,
Reatesh.

[Kazuhisa Takazawa]

Dear Reatesh-san,

Is it no problem to version-up from the current wrong situation?
If there is any way to solve by log-in by the Config I want to solve first the current problem.

I think IIM can not guarantee the updated situation by the version-up at this time..
Or the version-up will solve the current situation?

Thank you for your advise.

IIM Takazawa

------------------------------
Kazuhisa Takazawa
MP Support Dept.
IIM Corporation
------------------------------

[Ralf Prigl]

Hello, As pointed out previously, if you have a current entitlement for PAM, Support will assist you with a problem that blocks the upgrade to a supported release. I assume that you tried a reboot already, but that it doesn't help. Please check if you can access PAM using the https://<PAM address>/config/ page, or possibly the https://<PAM address>/config/?legacy=1 page, and then open a case with PAM Support to follow up.

[Daniel Galvez]

Hi Kazuhisa,

I found this into 3.3.1 documentation.

The image shared by you show that the pam server is 3.3.1 version.

The document with the info is

https://techdocs.broadcom.com/content/dam/broadcom/techdocs/us/en/pdf/ca-enterprise-software/layer7-privileged-access-management/ca-privileged-access-manager-new-source/pam-consolidated-(jan24)/ca-privileged-access-manager-new-source-3-3-1.pdf

Regards,

Daniel

[Kazuhisa Takazawa]

Dear Daniel-san,

Thank you for your good information.

The Super user also has the same error message, this issue may not be related with the LDAP.

If I ma misunderstanding please advise.
Appreciate your kind help.

IIM Takazawa

------------------------------
Kazuhisa Takazawa
MP Support Dept.
IIM Corporation
------------------------------