CA IDM Server start up Stuck at Step 2.

[Rashmeet]

Hi ,

 

While installing CA IDM 14.2 we are seeing the following error in ca iam suite log.

 

installAgent : 2018-05-29 01:55:39
installAgent returned error code 1.

STDOUT:
Buildfile: C:\Users\rkourkhanuja_admin\AppData\Local\Temp\869285.tmp\installFragments\build.xml
[echo] WAS VERSION=8

installAgent:

checkPSStatus:
[echo] Checking if PS is running 'WDONEWKFL02.one.or.gov'...
[PSStatus] Trying to connect to WDONEWKFL02.one.or.gov
[PSStatus] Connecting to SM using FIPS MODE on the agentAPI
[echo] PS Running

createAgent:
[echo] Creating the SiteMinder agent 'idmadmin'...
[createAgent] Connecting to SM using FIPS MODE on the agentAPI
[createAgent] Checking if : 'idmadmin' exists

STDERR:

BUILD FAILED
C:\Users\rkourkhanuja_admin\AppData\Local\Temp\869285.tmp\installFragments\build.xml:609: The following error occurred while executing this line:
C:\Users\rkourkhanuja_admin\AppData\Local\Temp\869285.tmp\installFragments\agent.xml:6: [facility=4 severity=3 reason=0 status=8 message=No session]

Total time: 3 seconds

 

On starting the server It is stuck in Step 2.

and giving this error  in System Out Log :

O 12:49:12,554 INFO [ims.Main] * Startup Step 2 : Attempting to start PolicyServerService
[5/28/18 12:49:13:444 PDT] 00000070 SystemOut O 12:49:13,444 ERROR [ims] Unable to connect to the policy server: Failed to init Agent API: -1. Please verify the tunnel agent name, shared secret and other configurations as specified in ra.xml file in iam_im.ear, verify that the Java JDK has been updated with Java Cryptographic Extension Unlimited Strength Jurisdiction Policy Files (JCE).
[5/28/18 12:49:13:507 PDT] 00000070 SystemOut O 12:49:13,507 ERROR [ims.default] Connection to Policy Server failed.
[5/28/18 12:49:13:507 PDT] 00000070 SystemOut O 12:49:13,507 ERROR [ims.Main] The IAM FW Startup was not successful

Any leads for the solution would be helpful.

Regards,

Rashmeet

[william.k.lee]

IM is trying to connect to the policy server on WDONEWKFL02.one.or.gov and failing.

 

Please check the smps.log on that policy server, as this will give us a better idea of why this step failed.

[Ashok kumar Muthu]

Rashmeet,

I believe you followed the below steps:

 

Integrate CA Single Sign-on with CA Identity Manager - CA Identity Manager - 14.2 - CA Technologies Documentation 

 

However, below are my recommendations based on the error message:

 

Unable to connect to the policy server: Failed to init Agent API: -1. Please verify the tunnel agent name, shared secret and other configurations as specified in ra.xml file in iam_im.ear, verify that the Java JDK has been updated with Java Cryptographic Extension Unlimited Strength Jurisdiction Policy Files (JCE).

 

1. Is IDM server able to communicate to Siteminder on ports 44441, 44442, 44443 ?

2. Has the IDM extension installed on Siteminder servers and extended Siteminder schema with IDM objects ?

3. Apply JCE library patches on IDM/app server's Java ?

4. Is the 4.x agent existing on Siteminder ?

5. Verify 4.x agent name,  AgentSecret, AdminSecret in ra.xml ?

 

Regards

Ashok

[Praveen Jain]

Ashok is spot on. It’s usually one of these when it fails at Step 2 i.e. connecting to policy server.

Check ra.xml under iam_im.ear/policyserver.rar/META-INF. You will find agent and policy server details over there.