Error of Importing the Policy Store Data Definitions

[Tiger Zhang]

We are installing a policy server and use AD LDS as policy store.

We meet a fatal error when perform command "XPSDDInstall SmMaster.xdd".

The detail of this error as below:

[93747/139836747052864][Thu Nov 28 2019 10:43:47][SmObjProvider.cpp:188][ERROR][sm-Server-03090] Policy store failed operation 'Save'  for object type 'Realm' . LDAP E
rror creating new Realm object
[93747/139836747052864][Thu Nov 28 2019 10:43:47][SmAdapterStore.cpp:630][Init][ERROR][sm-xadobj-00110] Create failed. (06-0dc8052d-c84e-47b3-9f5c-98ecd0c46192, Unknow
n Failure)
[93747/139836747052864][Thu Nov 28 2019 10:43:47][Database.cpp:483][InitSmStore][FATAL][sm-xpsxps-03570] SiteMinder interface initialization failed.
[93747/139836747052864][Thu Nov 28 2019 10:43:47][Database.cpp:662][InitDB][WARN][Assert] Assert failed: pSmStore
[93747/139836747052864][Thu Nov 28 2019 10:43:47][XPSTools.cpp:161][CXPSTools][FATAL][sm-xpsxps-04120] Unable to initialize the XPS library.

The full content of XPSDDInstall log as below:
[93747/139836747052864][Thu Nov 28 2019 10:43:44][SmObjProvider.cpp:244][INFO][sm-Server-02830] Initializing policy store provider 'LDAP:'
[93747/139836747052864][Thu Nov 28 2019 10:43:44][SmObjProvider.cpp:283][INFO][sm-Server-02840] Loading of policy store provider extension DLL: 'smobjldapims' succeede
d.
[93747/139836747052864][Thu Nov 28 2019 10:43:44][SmLdapPs.cpp:254][INFO][sm-Ldap-02140] SSL client init will not be attempted - no certificate database defined
[93747/139836747052864][Thu Nov 28 2019 10:43:44][smldaputils.cpp:476][WARNING][sm-Ldap-02910] SSLv3 client protocol is disabled. If connection fails configure LDAP se
rver to support TLS protocols.
[93747/139836747052864][Thu Nov 28 2019 10:43:45][smldaputils.cpp:525][INFO][sm-Ldap-00540] Opening policy store connection to LDAP server: ' 10.164.29.71:3396 '
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmLdapBulkSearch.cpp:174][CreateRoot][INFO][sm-xpsxps-01160] LDAP Provider Info String = Active Directory Application
 Mode
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmLdapBulkSearch.cpp:228][CreateRoot][INFO][sm-xpsxps-01120] LDAP Provider Version: supportedLDAPVersion = 3
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmLdapBulkSearch.cpp:228][CreateRoot][INFO][sm-xpsxps-01120] LDAP Provider Version: supportedLDAPVersion = 2
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmEventTrap.cpp:388][INFO][sm-Server-02500] Loading event handler '/opt/netegrity/siteminder/lib/libXPSAudit.so'
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmEventTrap.cpp:402][INFO][sm-Server-02510] Initializing event handler '/opt/netegrity/siteminder/lib/libXPSAudit.so'
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmObjCache.cpp:404][INFO][sm-Server-02800] Preloading policy store cache
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmObjCache.cpp:417][INFO][sm-Server-02860] BulkFetch policy store
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmObjCache.cpp:420][INFO][sm-Server-02810] Precaching system configuration objects
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmObjCache.cpp:489][INFO][sm-Server-02820] Precaching each Policy Domain
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmObjCache.cpp:493][INFO][sm-Server-02870] BulkRelease policy store
[93747/139836747052864][Thu Nov 28 2019 10:43:46][PolicyCache.cpp:1318][INFO][sm-Server-02880] Building policy cache ...
[93747/139836747052864][Thu Nov 28 2019 10:43:46][PolicyCache.cpp:1423][INFO][sm-Server-02890] Building policy cache done
[93747/139836747052864][Thu Nov 28 2019 10:43:46][SmObjStore.cpp:1602][INFO][sm-Server-00050] Object store initialized
[93747/139836261750528][Thu Nov 28 2019 10:43:46][SmObjStore.cpp:1208][INFO][sm-Server-00110] Starting object store journal thread
[93747/139836253357824][Thu Nov 28 2019 10:43:46][SmObjStore.cpp:1034][INFO][sm-Server-00070] Object store journal thread started
[93747/139836253357824][Thu Nov 28 2019 10:43:46][SmObjStore.cpp:1035][INFO][sm-Server-00080] Journal commands refresh interval is 60 second(s)
[93747/139836253357824][Thu Nov 28 2019 10:43:46][SmObjStore.cpp:1036][INFO][sm-Server-00090] Server command synchronization delta is 51 second(s)
[93747/139836253357824][Thu Nov 28 2019 10:43:46][SmObjStore.cpp:1037][INFO][sm-Server-05250] Secondary cache failure timeout is 0 second(s)
[93747/139836747052864][Thu Nov 28 2019 10:43:47][SmObjProvider.cpp:188][ERROR][sm-Server-03090] Policy store failed operation 'Save'  for object type 'Realm' . LDAP E
rror creating new Realm object
[93747/139836747052864][Thu Nov 28 2019 10:43:47][SmAdapterStore.cpp:630][Init][ERROR][sm-xadobj-00110] Create failed. (06-0dc8052d-c84e-47b3-9f5c-98ecd0c46192, Unknow
n Failure)
[93747/139836747052864][Thu Nov 28 2019 10:43:47][Database.cpp:483][InitSmStore][FATAL][sm-xpsxps-03570] SiteMinder interface initialization failed.
[93747/139836747052864][Thu Nov 28 2019 10:43:47][Database.cpp:662][InitDB][WARN][Assert] Assert failed: pSmStore
[93747/139836747052864][Thu Nov 28 2019 10:43:47][XPSTools.cpp:161][CXPSTools][FATAL][sm-xpsxps-04120] Unable to initialize the XPS library.

All above steps of this command have been performed successfully.

How can we resolve this error?

The version of siteminder is 12.8.03 and version of AD LDS is windows 2016.

[Patrick Dussault]

Hi Tiger,

I understand that running XPSDDInstall SmMaster.xdd, then the command
fails and reports error :

[93747/139836747052864][Thu Nov 28 2019
10:43:47][SmObjProvider.cpp:188][ERROR][sm-Server-03090] Policy
store failed operation 'Save' for object type 'Realm' . LDAP Error
creating new Realm object

This issue can occurs when you configure the Policy Store at one LDAP
instance, and the Key Store at another LDAP Instance.

In the smconsole, set the Key Store to be inside the Policy Store
(there's a checkbox for that sake), and try to reproduce the issue.

If it works, then after the Policy Store is fully configured, you can
configure the Key Store to another LDAP Instance.

Best Regards,
Patrick

[Tiger Zhang]

Hi Patrick,

     We just configured the policy store and key store be set to inside the policy store and we met the problem.

     This screenshot is our set for the key store.

[Tiger Zhang]

Hi Patrick,

     We re-created the application partition in AD LDS and re-installed the policy server.

    Then we can perform XPSDDInstall SmMaster.xdd successfully.

     But we met the similar problem when we performed the XPSImport smpolicy.xml -npass.
  
     The attachment is XPSImport log.

      We set key store using policy store.


     

Attachment(s)

XPSImport.2019-11-28_181319.log.txt   7 KB 1 version