SPS configuration issue

[Legacy User]

Hello All,

 

I am installing a new instance of SPS and the installation went fine, but while configuring i.e. ca-sps-config.sh i get an error.

 

Creation of proxy UI Protection Policy has failed (attached a screenshot of the error)

I have verified that the Agent name i am giving is present in the Admin GUI, but still i get the same error.

 

Any pointers what could be the issue here?

 

Thank You

Ankur Taneja

[emmle02]

Hi Ankur,

 

Could you please check the Name of the default agent or an agentname defined in the ACO.

 

https://docops.ca.com/ca-single-sign-on/12-6/EN/configuring/ca-access-gateway-configuration

 

Regards,
Leo Joseph.

[Legacy User]

Hello Leo,

 

Yes, i have checked and giving the same agent name as mentioned in default agent for the defined ACO.

 

Thanks

[emmle02]

Hi Ankur,

 

Kindly check the below

 

Is the Proxy UI already protected within some-other domain and has used same agent name ?.
Have you protected Proxy UI manually in different domain and trying to use the same agent to protect the Proxy UI again ?

 

Regards,
Leo Joseph.

[Karmeng]

Hi,

Did you find SPS configuration log (SPS_install_path/install_config_info folder) generate? Need to check what error reported. Instead of using console mode, have you try with UI mode for the configuration. Just want to compare if that return different result.

 

Regards,

Kar Meng

[Miquel Gilibert i Sunye]

Hi Ankur

 

In addition to the question by Karmeng, SPS will use the defaultagent configuration for protecting the GUI. So if you look at /opt/CA/secure-proxy/proxy-engine/conf/defaultagent doet it contain a WebAgent.conf and SmHost.conf where you can verify the objects it is trying to use, and machinenames, etc.

If I am not wrong it will use by default

 

AgentConfigObject="CAM-AgentObj"

 

So can you verify in your policy server that it exists and also that the user directories and domains as specified in https://docops.ca.com/ca-single-sign-on/12-6/EN/configuring/ca-access-gateway-configuration ?

[Legacy User]

Hello All,

 

Thank you for the responses.

 

I have checked the WebAgent.conf and SmHost.conf and they seem to be referring to the correct ACO, HCO, trusted host. Also ,couldn't find anything in the logs as well i.e.  ca-sps-details.log .

 

But i bypassed the Proxy UI configuration part by continue and was able to successfully install a new SPS instance (as we use it for federation service and will not required Proxy UI anyway) .

 

Now we have 2 SPS instances and i have update all the relevant files for this new SPS instance created lile:- server.conf , proxyrules.xml , httpd.conf, proxyserver.sh etc accordingly. But somehow i am not able to get this new instance working and getting the below error: -

 

I checked the the port conflict as well which is not there as we are using different ports for 2 difference SPS configurations. 

 

Any pointers here? Anything in specific that i should check or i am missing?

 

Thank You

Ankur Taneja

[Sharanabasava Kariyappa]

Hi Ankur,

 

It seems like tomcat is not stopping here properly.

Please do the following.

1. stop proxy engine ./sps-ctl stop

2. go to SPS_HOME/proxy-engine/tmp

3. check sps.pid is still exist or not. if it is present, please remove it (rm sps.pid).

4. start proxy engine

 

Thanks,

Sharan

[Legacy User]

Hello Sharana,

 

Checked, nothing there in /proxy-engine/tmp for the new SPS instance.

[Karmeng]

Hi Ankur,

 

I guess some applicaiton occipied the default port (ie: port 80) that you configured in httpd.conf.

Check if any application occupied the port.

ie:

[root@lodbl509vm046 /]# sudo netstat -ltnp | grep ':80'

 

If it return result, then it suggest the application occupied the port

ie:

tcp        0      0 :::80                     :::*                        LISTEN      18255/java

 

kill the process

ie:

sudo kill -9 18255

 

and check if SPS can startup.

 

If above is not relevant, modify sps-ctl to add -x in order to give us more hints what's the problem.

 

Regards,

Kar Meng

[Miquel Gilibert i Sunye]

Hi Ankur

I guess you probably have done it yet, but just in case shut down sps and do a netstat -an | grep 502 à This will tell you if someone is listening on that port

The main point here is the message is a bit misleading. You should look at the apache hhtpd logs for hints, but just to give you a few examples of what this may be:

 

http://askubuntu.com/questions/525647/apache2-wont-start-no-listening-sockets-available-ubuntu-14-04

http://serverfault.com/questions/461300/apache-wont-start-httpd-service-start-centos-6-3

 

Second one gives some better hints, IMHO

 

If worse comes to worse, youc an edit sps-ctl and put in the second line a set -x, which will tell you what the script is doing line by line, so we may be able to know when it complains about the problem

Hope to have helped

[Legacy User]

Another reason for the error you may get with protection policy creation is when you are using an account for config Access Gateway which doesnot has rights to create Domain objects. Just verify what account you are using for the configuration.

[shaku08]

I had that issue. I was using admin username that was specifically used for registering trustedhosts and did not have rights to create policy objects. When I used superuser admin "siteminder" it worked. It successfully created policies for SPS agent.

[shaku08]

You will have this error if the admin you are using for registering trustedhost does not have privileges to create policy objects. Use admin user that has full privileges to register trustedhost and subsequent configuration and you will not have this issue. I have experienced the same and that's how I resolved.