ACCESS DENIED in AWI of AE 24.3 after Upgrade.

[Cristian Suciu]

We upgraded AE to version 24.3 and we are getting access denied in our AWI when trying to log in. 

[Leon Carroll]

check your uc4config.xml file under the awi config folder, more info should be in the logs under WebInterface\osgi-tmp\0.  You can also check if a login attempt was made to the engine logs. 

Also, if you upgraded Java, make sure you have the trusted root in the Java cacerts for the JCP.

[Cristian Suciu]

uc4config.xml file is basically the same as the one for ae21. 
We can see the login attempts in both PWP log and JCP log.

In the JWP log we see issue:

20250306/093319.321 - 50     U00045033 Log on to LDAP server 'censored' with user 'censored'.
20250306/093319.397 - 50     U00045014 Exception 'javax.naming.CommunicationException: "censored"' at 'com.sun.jndi.ldap.Connection.<init>():252'.
20250306/093319.398 - 50     U00045015 The previous error was caused by 'java.net.SocketException: "Connection reset"' at 'java.net.SocketInputStream.read():186'.
20250306/093319.399 - 50     U00045040 LDAP check with logon user 'censored' failed.
20250306/093410.186 - 50     U00029407 Public key mismatch in CSR request from Agent: 'ORACLE'
20250306/093418.863 - 50     U00029407 Public key mismatch in CSR request from Agent: 'DB_SERVICE'
20250306/093428.790 - 50     U00029407 Public key mismatch in CSR request from Agent: 'ORACLE'
20250306/093438.964 - 50     U00029407 Public key mismatch in CSR request from Agent: 'DB_SERVICE'
20250306/100230.822 - U00011800 Disconnect User: Cannot find user '*CP005#00000017' in the table AKT-USER.
20250306/100537.616 - U00003234 Logon error: Access denied. (Connection='*CP005#00000018', host = 'censored', client = '')

[Leon Carroll]

Try copying the ae engine certs from your v21 installation over to the v24 engine and restart the engine.  make sure the keys added in to the jdk11 cacerts are in the jdk17 cacerts, otherwise try using the previous jdk11 installation to get it started. Did the agents start up - SQL_Agent / DB_Service?  Have a look at the log for those and see if you find an untrusted connection error.  

Is the servicemanager service running as the correct user if you are using Windows? 

[Cristian Suciu]

We were able to start DB_SERVICE and SQL_AGENT but the Linux agent is still going down with the following error:

U02000313 Communication error with partner 'censored:8448', error: 'PKIX path building failed: unable to find valid certification path to requested target'.

I managed to log int client 0 with UC user but with our LDAP users I am unable to log in.

[Cristian Suciu]

We have completed the Upgrade for both Engine and remote agents successfully. The certificates for the agents need to be tweaked due to increased security checks. 

Also, once you log into client 0 with the local user you need to change TLS parameter from Y to N in the LDAP VARA object in order to be able to log in with LDAP users.

[Wendy Copeland]

Hi Christian,

We had access denied Errors for LDAP Users when we upgraded to 24.3.  For us it was that we were missing the TLS entry in our UC_LDAP_Domain Variable in Client 0.  Valid Values are either N (Don't use TLS) or Y (Use TLS).  *Note:  If using TLS not sure if any other entries are required.

[Jim Griffith]

For some reason they decided to stop returning the actual reason the connection failed.

In V21, if the JCPs aren't available or you have the wrong port numbers, it says... 

Connection to the AE system not possible.

No connection to the following CPs could be established

In v24 it just says "access denied".  Same with certificate issues, bad passwords, and wrong system name. Just Access denied.