Symantec Access Management

I recently upgraded both SiteMinder and the AdminIU from 12.52 CR01 to 12.52 SP1 and am having issues with the Admin UI.  I am missing links to objects (Domains shows realms only.  no domains, responses or policies.  Some link throw a null pointer exception.  Wondering if anyone else is having simlar issue.

This is installed on WIN 2008 R2 server.

Thanks,

John

Please verify license file application under Siteminder_Home\license

sometimes it might be License.dat and you may need to rename to license.dat or vice-versa. Please do a restart if that is the case.

it is my understanding that SiteMinder is technically no longer requires a license (which I do have).  This also works fine for CR01 but not SP1.

If there was an issue with the license, it should show in the logs.  My question was is anyone having trouble with SP1?

So, can I assume you are not having issues with SP1?

Thanks,

John

John,

I opened a case as we seemed to ender the old demonstration mode when we upgraded and it went away when we sett he License.dat to license.dat

CA Claims they cannot reproduce but now i know they have two clients that obviously have license file related issues. obviously they must have a check somewhere that wasnt removed.

-Josh

Josh, I tried both License.dat and license.dat and no difference.  I am not getting a license error or any messages that would lead me to believe it is a trail or demo version.

I have many missing links and the links that are there give a null pointer exception.

For instance when clicking on "Manage user accounts" I get a null pointer exception.

other than the null pointer exception the server log shows the below message several times and is all I have to go on.

2014-09-19 10:32:22,700 ERROR [ims.rules] (http-va10n70095.us.ad.somdomain.com%2F30.135.160.106-8443-6) A number format exception was encounter transforming the values to longs for comparison. The values were [] and [1]. Returning false on evaluation.

Since cr01 works with the same policy store and Sp1 and I had a clean install (no errors) I am not sure what is going on.

One thing I noticed that was different when going to SP1 was Java was all the sudden complaining about an invalid cert when launching the FSS UI (same java version as cr1.

I got around this by updaying java to trust the site.

I am wondering if there is a specific java version this works with.

I have tried both 1.7 update 60 and update 67

The admin UI comes bundled with its own java  (6 something) and so not sure how it plays into this.

For anyone that does have it working, can you let me know the exact java version you are using?

Thanks,

John

John,

1.6 update 23.

my company uses an old version for compatibility with some older systems we're trying to update.

interesting. i would say from the issues reported they [ca] have not completely vetted the admin ui.

yours is likely diffferent than mine for the cause.

-Josh

thanks. I will try that version to see if it make a difference.

i installed 1.6 update 23 and did not correct my problem.  I did not run the install again but rather updated the NETE JAVA paths and restarted the policy server as well as the adminui.  let me know if you think that is enough.  also if you know if there was any schema update (any reason to update my policy store) from cr01 to SP1.

thanks,

John,

My upgrade was from 12.50 to 12.52 sp1, so I ran the schema update. I am not sure if there is a need from 12.52 cr1 to 12.52 sp1.

Sincerely,

Josh Perlmutter

looks like running xpsddinstall SmMaster.xdd did the trick but still testing. I do not remember seeing that in the release notes to unr unless I missed it. Will need to go back and check.

Hi John,

Recently I upgrade from R12.52CR1 to R12.52SP1 and everything looks good for me. It sound strange that you have missing links objects. Normally, I will suspect some policy store issue instead of WAMUI.

To isolate the issue, if you have R12.52CR1 WAMUI point to R12.52SP1 policy server, are you seeing the problem (ignore the WAMUI error saying version mismatch as that was expected)?

If you didn't see the problem, then yes, seems WAMUI issue. However, if they show the same issue (missing link objects) then it sounds like policy store issue during upgrade. This can help to determine the next action plan.

Thanks.

Kar Meng

Hi,

I'm using java version "1.7.0_51". Yes, upgrade need to re-run the data definition files (SmMaster.xdd) and smpolicy.xml. Check following upgrade guide.

CA SiteMinder® Integrated Documents 12.52 SP1

Although it mentioned 12.x but 12.5x series applied.

The documentation should be more clear.  Lesson learned.  I will just always update the DD's regardless.

Thanks,

John

John

Nice to hear you were able to reach closure.

We should be able to update the documentation if something is unclear. If we read through the upgrade guide it does state to upgrade the PStore (i.e. SmMaster.xdd) and import default object (smpolicy.xml). Failing to do so would mean the Store would be not updated with new additions which may have been added for that release features.

In this case it looks like we went from Step-3/5 to Step-7, skipping Step-6. So it does feel that even though the documentation stated, something got you thinking otherwise OR may be it was still not evident.

Complete the following procedures to migrate from r12.x to 12.52 SP1:

1. (Optional) If your environment includes multiple instances of smkeydatabase, synchronize all instances.
2. Part of the Policy Server upgrade includes migrating all content in the smkeydatabase to the certificate data store.
3. Upgrade an r12.x Policy Server to 12.52 SP1.
4. Upgrade an r12.x Web Agent to 12.52 SP1.
5. Upgrade the remaining r12.x Policy Servers and Web Agents to 12.52 SP1, respectively.
6. Upgrade the r12.x policy and key stores to 12.52 SP1.
7. Upgrade the r12.x Administrative UI.
8. If required, use the Administrative UI to save existing reports locally and remove the r12.x Report Server and report database from the environment. The simplest path to an 12.52 SP1 reporting environment is to install and configure a new Report Server and report database.

https://wiki.ca.com/display/sm1252sp1/How+to+Migrate+from+r12.x

This is the new WiKi for CA SiteMinder documentation. If we are unclear OR some words causes confusion OR as a lay user we feel gaps; we have now included the capability to provide valuable comment directly on the WiKi content. Hence this would help us, build effective words based on user's perception / views after due consideration.

We hope this endeavor helps us help you / all better.

With Best Regards

Hubert

TO me 12.x could be 12.0 or whatever.  I think it should be more clear.  In case it was missed – I already upgraded to 12.52 CR01 and imported the policies and everything work as expected.

I was now simply trying to upgrade 1 SP (from CR01 to SP1) and did not think there was an extension to the schema as it was not called out.

In previous releases with the old smdif files it was clear – like : (12.0SP2 – 12.0 SP3 policy.smdif or whatever)

I will just have to not make the assumption that something might have changed and just do it anyway since it just take a minute and there is no harm.  Just wasted a couple days of my time this time around.

Thanks,

John Schwartz

Information Security Sr Advisor

Wellpoint Inc.

21555 Oxnard St.

Woodland Hills, Ca. 91367

Mail Drop: CAAC05-05A

Office: 818.234.6763

Email: John.Schwartz@wellpoint.com<mailto:John.Schwartz@wellpoint.com>

Group email: DL-WebAccessManagement or

DL-WebAccessManagement@wellpoint.com<mailto:DL-WebAccessManagement@wellpoint.com>

Hello HubertDennis,

In your notes, you have:

(Optional) If your environment includes multiple instances of smkeydatabase, synchronize all instances.

2.Part of the Policy Server upgrade includes migrating all content in the smkeydatabase to the certificate data store

Can you explain to me how do you sync all instances?  I have not be able to find that answer at all from documentation.  It is mentioned but did not tell how.

Thank you,

-June

Thank You June wanju09

Ideally it is good to start a new thread with a new discussion even though it references may be some aspect in an existing thread. Just want to avoid information being lost in long threads of discussion. Nevertheless, it is good you asked.

There are 2 ways you can sync SMKEYDATABASE across all instances of Policy Server participating in an SSO.

A. SMKEYDATABASE is folder with flatfiles within it. When Policy Server or WAOP starts up, these components read the data stored within the files present in SMKEYDATABASE. The files are nothing but certificates which are stored in some proprietary form. Therefore one way is you could simply copy the best known SMKEYDATABASE folder which has all the updated certificates across all Policy Server instances.

B. If you do not wish to copy the SMKEYDATABASE folder across all Policy Server instances, the other alternative is to list the certificates in all SMKEYDATABASE and see the differences. Then work through the differences in each certificates OR missing certificates, and populate them manually by importing the certificates. You should use the SMKEYTOOL utility in Policy Server bin directory to list and import certificates.

Check the following links below.

_Synchronize Key Database Instances_1804081 - CA SiteMinder® - 12.52 SP1 - CA Wiki

CA SiteMinder Integrated Documents r12.0 SP3

NOTE :

• Always backup existing SMKEYDATABASE folder to a different nomenclature, to preserve rollback.
• Remember before R12.5 smkeytool speak to SMKEYDATABASE, from R12.5 onwards SMKEYTOOL speak directly to CDS (within PStore). Hence know what version binaries you are using as a word of caution.

Let us know if this helps.

Regards

Hubert