Agents not available

[Claus Jambrich]

Dear Experts,

We have a problem on our ARA installation. Our client has some agents assigned:

But when I want to add an agent to a deployment target (Button "Assign Agent/Group"), the list is empty:

What can be wrong here?

------------------------------
Thanks and regards,
Claus
___________________________________________
Claus Jambrich
Software Engineer
Erste Group IT
Vienna Austria.
------------------------------

[Michael Dolinek]

Hi @Claus Jambrich

I have several questions:

• did you check the log-file of the CDA-server?​
• did you see in AE's CP-log-files that CDA-server is querying Agents using REST?
  e.g.
  

  YYYYMMDD/hhmmss.hhh - 45     U00045098 Method 'GET', URL: 'http://AEserver.local:8088/ae/api/v1/100/system/agents', received from IP: 'X:X:X:X:X:X:X:X'
  YYYYMMDD/hhmmss.hhh - 45     U00045105 Log on of 'SERVICE_USER/SERVICE' successful.
  YYYYMMDD/hhmmss.hhh - 45     U00045099 The server replied with following status: '200'
  

• is the REST-endpoint for the AE configured at CDA-server's customer.config?
  e.g.
  

  <connection name="AUTOMIC" system="AUTOMIC">
     <system client="100" password="xxx" user="100/SERVICE_USER/SERVICE"> 
     <queuetrigger agent="AGENT-WIN01" login="AGENT-WIN01.LOGIN" />
     <connectionStrings>
        <add connectionString="Data Source=tcp:DBserver.local,1433;Initial Catalog=cda;User ID=cda_user;Password=xxx" name="MainDatabase" />
        <add name="ReportDatabase" connectionString="Data Source=##DB SERVER##;Initial Catalog=##DB NAME##;User ID=##DB USER##;Password=##DB PASSWORD##" />
     </connectionStrings>
     </system>
     <cp ip="AEserver.local" port="2217" />
     <restApi uri="http://AEserver.local:8088" />
  </connection>
  ​

• does the configured user hold proper permissions to get the Agents from AE?
• can the CDA-server connect to the AE-server via REST?
• if HTTPS for the REST-endpoint is in place, are the required certificates available at the IIS-server?

------------------------------
Engineering Program Manager
Broadcom
------------------------------

[Claus Jambrich]

Sorry for the delayed answer. It was the CDA configuration. It was simply forgotten.

------------------------------
Thanks and regards,
Claus
___________________________________________
Claus Jambrich
Software Engineer
Erste Group IT
Vienna Austria.
------------------------------

[Robin Gupta]

Hi Michael,

I am facing a similar problem with one of our customer and it is because of HTTPS nature of REST-endpoint. I wanted to understand below point:

• if HTTPS for the REST-endpoint is in place, are the required certificates available at the IIS-server?

When we say certificate is available at IIS-server - what exactly we need to do here? I have a self-signed certificate and have tried below options to import certificate but none worked in my case:

• Tried directly importing the certificate by "double-click" certificate file and importing into "Trusted Root Certificate Authorities" folder
• Tried importing using windows MMC, by importing certificate into Local Machine account under "Trusted Root Certificate Authorities" folder
• Tried importing certificate into IIS "server certificates" option

I searched the knowledge base and found this article - https://knowledge.broadcom.com/external/article?articleId=195030. I am exactly getting the same error in logs but I could not understand the Resolution mentioned in the article. It says "From CDA 12.3.3 (RM 10.0.3), a trusted certificate folder can be defined in customer.config (section <trustedCertFolder>)", my questions are:

Where in customer.config should I insert this "trustedCertFolder" section?
What would be the syntax of this section?
Any samples available?
Also in that mentioned folder what type of certificate should I keep? Keystore with private key or just public certificate will work?

I would appreciate if you can provide some information around it.

My System Info:
We are using CDA v12.3.3 - all components are newly installed and it's a fresh installation with brand new DB instances.
I have already tested the REST-endpoint with the configured user(customer.config) and it is working fine
Both CDA and AE are on the same machine -single box installation - manually installed - no issue of connectivity.
I have checked REST-endpoint is correct and in fact I could see in CDA logs that it queried REST endpoint from AE and received the same URL which I configured.




------------------------------
Robin Gupta
Consultant
HCL Enterprise Studio
------------------------------

[Michael Dolinek]

Hi all,

be informed that the configuration parameter named trustedCertFolder which is mentioned in the knowledge base article (https://knowledge.broadcom.com/external/article?articleId=195030) is available in Release Manager version 10.0.4 that is part of the Offering CDA 12.3.4 which is scheduled for end of October 2020.

------------------------------
Engineering Program Manager
Broadcom
------------------------------

[Michael Dolinek]

Hi all,

please be informed that might be that CDA-server selects not the correct TLS version when calling AE-REST-endpoint,

AE REST endpoint is supposed to be used with TLS 1.2 protocol, and .NET framework on the server does not use TLS 1.2 protocol by default.

This can be solved by 2 ways:

1. Add this line

<add key="AppContext.SetSwitch:Switch.System.Net.DontEnableSchUseStrongCrypto" value="false" />

into web.config of Release Automation, within appSettings.

2. Make the TLS 1.2 become the default of .NET framework by setting following key in the registry (via regedit command, see attached reg-file but I have to rename it before attaching it)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto" = dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\.NETFramework\v4.0.30319]
"SchUseStrongCrypto" = dword:00000001

Then restart the computer.

Reference: https://docs.microsoft.com/en-us/mem/configmgr/core/plan-design/security/enable-tls-1-2-client

------------------------------
Engineering Program Manager
Broadcom
------------------------------

Attachment(s)

NetFramework-EnableStrongCryptography.reg.txt   522 B 1 version

[Robin Gupta]

Thank You. It's working as expected after this change.

------------------------------
Robin Gupta
Consultant
HCL Enterprise Studio
------------------------------

[Walter Schimpelsberger]

Dear Claus Jambrich, we upgraded from CDA (ARA) 12.1 to 12.3. two weeks ago and ran into the same problem. The solution in our case was that in ucsrv.ini of AE in the [REST] section the port was defined to 8090 (maybe that was the default for the older versions) and in the new CDA customer.config the default port for access to AE Restapi seems to be 8088 now. We changed the ports to corresponding values for ae restapi access in ucsrv.ini of AE and customer.config of ARA and the agents where visible again in the selection list.

Kind regards,
Walter Schimpelsberger


------------------------------
IT-Organisator
Pensionsversicherungsanstalt
------------------------------