Symantec Privileged Access Management

 View Only
  • 1.  We don't know our JCS password! How can we reset it?

    Broadcom Employee
    Posted Jun 22, 2015 10:13 PM

    This is a follow on from my post here where I explained how to change the JCS password. This, however, required you to know the current JCS password. This method does not.

     

    The only apparent way of doing this, short of a complete re-install of the ENTM, is to reinstall the Java Connector Server (JCS). This is fairly straight forward, a lot more so than reinstalling the entire Enterprise Manager as you do not have to worry about data.

     

    Please bear in mind that this is not a fully tested method, just something a support engineer worked out due to near necessity. It is far better to remember passwords than rely on this.

     

    This is based upon 12.8 on windows. This method should work with other versions. You might not have to do step 1 though. There should be enough here to get the idea of what to do for other versions.

     

    I have assumed that the ENTM is installed to the default location (C:\Program Files\CA\AccessControlServer). You may need to adjust this for your site.

     

     

    1. Assemble the JCS installer

     

    On the 12.8 Enterprise Manager install media the JCS installer is split across two zip files so we need to assemble it before we do anything else. To do this I will be using the cat command from the open source GNUWin32 CoreUtils for Windows (http://gnuwin32.sourceforge.net/packages/coreutils.htm) and as such will assume that the cat command is installed and in the PATH. However, any binary file joiner should work.

     

    We need a temporary directory. I will use c:\t in this example.

     

    Go to the following folder in the 12.8 ENTM install media:

     

    EnterpriseMgmt\Disk1\InstData\

     

    From Resource1.zip extract the following file to c:\t:

     

    W_\webgui\Setup\Java Connector Server\JavaConnectorServer_Build_Output\Web_Installers\InstData\Windows\NoVM\install_JavaConnectorServer.exe

     

    Rename it C:\t\install_JavaConnectorServer.exe.1

     

    From Resource1-part2.zip extract the following file to c:\t:

     

    W_\webgui\Setup\Java Connector Server\JavaConnectorServer_Build_Output\Web_Installers\InstData\Windows\NoVM\install_JavaConnectorServer.exe

     

    Rename it C:\t\install_JavaConnectorServer.exe.2

     

    You should now have two files, install_JavaConnectorServer.exe.1 and install_JavaConnectorServer.exe.2

     

    To join the two files using cat, open a command terminal, navigate to c:\t and run:

     

    cat install_JavaConnectorServer.exe.1 install_JavaConnectorServer.exe.2 > install_JavaConnectorServer.exe

     

     

    2. Stop ControlMinder

     

    Stop the following services:

     

    JBoss Application Server 4.2.3

    CA ControlMinder Connector Server (Java)

    CA ControlMinder Web Service

     

    Stop the ControlMinder agent:

     

    secons -s

     

     

    3. Uninstall JCS

     

    Double click on C:\Program Files\CA\AccessControlServer\Connector Server\_uninst\Uninstaller.exe,  and follow the prompts. The wizard is very straight forward. You may get the following error:

     

    Errors occurred during the uninstallation. An error occurred and product uninstallation failed. Look at the log file C:\Users\ADMINI~1\AppData\Local\Temp\2/im_connector_server_uninstall.log for details.

     

    This can (probably) be ignored. In my testing it was due just to being unable to immediately delete the Connector Server folder.

     

    You may also be prompted to reboot. Do this if requested. If not requested to reboot, reboot anyway.

     

    The CA ControlMinder Connector Server (Java) service might not have been removed from Services. This is not a problem.

     

     

    4. Install JCS

     

    Stop ControlMinder again as part 2 above.

     

    Just clicking on the installer does not allow the location to be changed (as far as I could see) and it does not install it to "C:\Program Files\CA\AccessControlServer\Connector Server" so we need to use silent install. To do this we will create a text file c:\t\JCS_installer.properties, like the below, replacing <jcs password> with the password you wish to use. It would appear that <jcs password> needs to be the same as the tibco password (I am not 100% sure on why this should be the case, but I did have problems when I did not use the tibco password):

     

    JCS_INSTALL_DIR=C:\\Program Files\\CA\\AccessControlServer\\Connector Server LOGIN_PWD=<jcs password> JAVA_EXE_PATH=C:\\jdk1.7.0\\bin\\java.exe PARENT_TEMP_DIR=C:\\t

     

    The other parameters should be self-explanatory and may need to be modified for your system. Remember to use double backslashes (\\), not single backslashes.

     

    To do the actual install, in a command prompt:

     

    c:\t\install_JavaConnectorServer.exe -i silent -f C:\t\JCS_installer.properties

     

    You can determine when the install has finished by opening Windows Task Manager, going to the Processes tab and waiting for install_JavaConnectorServer.exe to stop running.

     

    Reboot.

     

     

    5. Set the JCS password in the ENTM

     

    In the ENTM, System -> Connection Management -> Connector Server -> Modify Connector Server, Search for and select the JCS, enter the password in the Password field and submit.

     

    Now test that it is working by checking in and checking out, and creating privileged accounts.



  • 2.  Re: We don't know our JCS password! How can we reset it?

    Posted Jun 23, 2015 01:04 AM

    Simon,

     

    Great content once Again!!

     

    --

    Vinay Reddy



  • 3.  Re: We don't know our JCS password! How can we reset it?

    Broadcom Employee
    Posted Jun 23, 2015 08:04 PM

    Just a note on "It would appear that <jcs password> needs to be the same as the tibco password (I am not 100% sure on why this should be the case, but I did have problems when I did not use the tibco password)"

     

    This does not appear to be the case. The first checkin after reinstalling JCS seems to take ages as if it is going to time out (this could be my test system). I guess I was impatient so made the assumption that this had something to do with tibco. However, this morning I just waited and eventually it checked in. After that everything was working as normal. This could just be the lab server I am testing this on though.



  • 4.  Re: We don't know our JCS password! How can we reset it?

    Broadcom Employee
    Posted Jun 23, 2015 08:10 PM

    And one more thing... You need to test with an endpoint type other than Windows Agentless as this type does not use JCS.