6 Replies Latest reply on Feb 25, 2011 11:45 AM by Bill Robinson

NSH Proxy Error SSO Error

Michael NameToUpdate Feb 25, 2011 8:52 AM

Share This:

This is the error I receive from my windows based client after checking the save credentials and running:

secadmin -m default -p 5 -auth_profile default1 -auth_profiles_file "/C/Program Files/BMC Software/BladeLogic/8.0/NSH/br/authenticationProfiles.xml" -appserver_protocol ssoproxy -T encryption_only -e tls ......

It returns:

Entry for host default successfully modified... as it should. When I exit and relaunch NSH I get the error seen in the screenshot:

I can login to the console as RBACAdmin, BLAdmin, and my ldap user just fine.

Any ideas?

I was wondering about the ProxySvcPort setting. There is no value defined and I don't know if it needs to be? I printed the setting before upgrading to SP6 from 8.0.0.359 and nothing was defined for ProxySvcPort before the upgrade either.

I had an issue with LDAP authentication after the upgrade which I was able to resolve by adding the truststore back,

I am now having an issue with the NSH Proxy.

I can login to the console as RBACAdmin, BLAdmin, and my ldap user just fine.

Any ideas? It's like some of these items were overwritten....

Thanks for any help you can offer.

1. NSH Proxy Error SSO Error

Michael NameToUpdate Feb 25, 2011 8:56 AM (in response to Michael NameToUpdate)

Also wanted to add that our app server is running on RHEL. RCP clients are windows based so far.

Our base install was 8.0.0.359 and I upgraded to SP6 on Wednesday this week. I am hoping to go to SP8 soon after we get the NSH Proxy working so we can get the new Sun Patch site to work..

I am wondering if this will happen again when I install SP8???

Thanks
Like Show 0 Likes(0)

Actions
2. NSH Proxy Error SSO Error

Gerardo Bartoccini Feb 25, 2011 9:03 AM (in response to Michael NameToUpdate)

What's the output of blcred cred -list
?
Like Show 0 Likes(0)

Actions
3. NSH Proxy Error SSO Error

Michael NameToUpdate Feb 25, 2011 9:08 AM (in response to Gerardo Bartoccini)

bladmin>dsmdc-admin-blg1# blcred cred -list
THIS SESSION CREDENTIAL HAS EXPIRED
Username:         BLAdmin
Authentication:   SRP
Issuing Service: service:authsvc.bladelogic:blauth://dsmdc-admin-blg1:9840
Expiration Time: Wed May 12 18:41:47 CDT 2010
Maximum Lifetime: Wed May 12 18:41:47 CDT 2010
Client address:   10.4.0.27
Authorized Roles:
    BLAdmins
    GlobalReportAdmins

Destination URLs:
    service:appsvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9841

You have new mail.
dsmdc-admin-blg1#
Like Show 0 Likes(0)

Actions
4. NSH Proxy Error SSO Error

Michael NameToUpdate Feb 25, 2011 9:10 AM (in response to Michael NameToUpdate)

THIS SESSION CREDENTIAL HAS EXPIRED

This does not look good...
Like Show 0 Likes(0)

Actions
5. Re: NSH Proxy Error SSO Error

Adam Bowen Feb 25, 2011 9:19 AM (in response to Michael NameToUpdate)

The problem is that NSH proxy service is not running. Go to "Setting Up a Network Shell Proxy Server" in the BladeLogic Administration PDF. At a minimum, the application server instance you are trying to use as a NSH proxy has to be an ALL or NSH_PROXY instance and the ProxySvcPort has to be set. You will need to restart the appserver instance after the changes. When you try to fire up NSH, the secure file hits the URL and does not find the NSH proxy service running.
Like Show 1 Likes(1)

Actions
6. Re: NSH Proxy Error SSO Error

Adam Bowen Feb 25, 2011 9:20 AM (in response to Adam Bowen)

Also, in your BBSA console, make sre you have "cache session credentials" checked and try to login. Then when you do the blcred list, you should see valid credentials there.
Like Show 0 Likes(0)

Actions
7. Re: NSH Proxy Error SSO Error

Gerardo Bartoccini Feb 25, 2011 9:26 AM (in response to Michael NameToUpdate)

Expiration time refers to May 2010.
Double check time settings on appserver. Is it a VM?
Like Show 0 Likes(0)

Actions
8. Re: NSH Proxy Error SSO Error

Michael NameToUpdate Feb 25, 2011 10:58 AM (in response to Adam Bowen)

Great.. Thanks guys.. It's working after setting the following with blasadmin:

set appserver ProxySvcPort 9842

.........and then restarting the appserver service.
Like Show 0 Likes(0)

Actions
9. Re: NSH Proxy Error SSO Error

Adam Bowen Feb 25, 2011 10:59 AM (in response to Michael NameToUpdate)

No problem. Mark this question as 'answered' and assign points please.
Like Show 0 Likes(0)

Actions
10. Re: NSH Proxy Error SSO Error

Michael NameToUpdate Feb 25, 2011 11:08 AM (in response to Gerardo Bartoccini)

gbartoccini:

I am not sure why it is showing the old date and EXPIRED Credential on the appserver:

dsmdc-admin-blg1# blcred cred -list
THIS SESSION CREDENTIAL HAS EXPIRED
Username:         BLAdmin
Authentication:   SRP
Issuing Service: service:authsvc.bladelogic:blauth://dsmdc-admin-blg1:9840
Expiration Time: Wed May 12 18:41:47 CDT 2010
Maximum Lifetime: Wed May 12 18:41:47 CDT 2010
Client address:   10.4.0.27
Authorized Roles:
    BLAdmins
    GlobalReportAdmins

Destination URLs:
    service:appsvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9841

You have new mail.
dsmdc-admin-blg1# date
Fri Feb 25 11:01:36 CST 2011
You have new mail.
dsmdc-admin-blg1#
You have new mail.
dsmdc-admin-blg1#

It is still showing that even though blcred is now showing good from my Client now:

Pick Role:
1. BLAdmins
2. dsm_sysadmins
3. BladeLogic_Admin
1
nc-dm-dc237% blcred cred -list
Username:         uid=meller,ou=people,dc=mcdc,dc=com
Authentication:   LDAP
Issuing Service: service:authsvc.bladelogic:blauth://10.4.0.27:9840
Expiration Time: Fri Feb 25 20:22:08 CST 2011
Maximum Lifetime: Fri Feb 25 20:22:08 CST 2011
Client address:   10.25.53.3
Authorized Roles:
    BladeLogic_Admin
    BLAdmins
    dsm_sysadmins

Destination URLs:
    service:appsvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9841
    service:proxysvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9842

nc-dm-dc237%

Pick Role:
1. BLAdmins
2. dsm_sysadmins
3. BladeLogic_Admin
1
nc-dm-dc237% cd //dallas
dallas% agentinfo
dallas:
Agent Release   : 8.0.8.814
Hostname        : dallas
Operating System: SunOS 5.10
User Permissions: 0/0 (root/root)
Security        : Protocol=5, Encryption=TLS1
Host ID         : 83091A3F
# of Processors : 1
License Status : Licensed for NSH/CM
dallas% blcred cred -list
Username:         uid=meller,ou=people,dc=mcdc,dc=com
Authentication:   LDAP
Issuing Service: service:authsvc.bladelogic:blauth://10.4.0.27:9840
Expiration Time: Fri Feb 25 20:22:08 CST 2011
Maximum Lifetime: Fri Feb 25 20:22:08 CST 2011
Client address:   10.25.53.3
Authorized Roles:
    BladeLogic_Admin
    BLAdmins
    dsm_sysadmins

Destination URLs:
    service:appsvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9841
    service:proxysvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9842

dallas% cd //
nc-dm-dc237% agentinfo
Can't access host "(null)": No error
nc-dm-dc237% blcred cred -list
Username:         uid=meller,ou=people,dc=mcdc,dc=com
Authentication:   LDAP
Issuing Service: service:authsvc.bladelogic:blauth://10.4.0.27:9840
Expiration Time: Fri Feb 25 20:22:08 CST 2011
Maximum Lifetime: Fri Feb 25 20:22:08 CST 2011
Client address:   10.25.53.3
Authorized Roles:
    BladeLogic_Admin
    BLAdmins
    dsm_sysadmins

Destination URLs:
    service:appsvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9841
    service:proxysvc.bladelogic:blsess://dsmdc-admin-blg1.mcomdc.com:9842

nc-dm-dc237%
Like Show 0 Likes(0)

Actions
11. Re: NSH Proxy Error SSO Error

Adam Bowen Feb 25, 2011 11:15 AM (in response to Michael NameToUpdate)

Just use the destroy option to remove the expired credential.
Like Show 0 Likes(0)

Actions
12. Re: NSH Proxy Error SSO Error

Michael NameToUpdate Feb 25, 2011 11:21 AM (in response to Adam Bowen)

Can you give me an example of the command line etc...

like blcred cred -destroy what????

So this will not affect anything since that expired credential is on the app server itself?

Obviously I am still learning so I am trying to get a proper understanding..

Thanks
Like Show 0 Likes(0)

Actions
13. Re: NSH Proxy Error SSO Error

Adam Bowen Feb 25, 2011 11:29 AM (in response to Michael NameToUpdate)

Just do destroy. It will get rid of all of them. Then just grab new credentials.
Like Show 0 Likes(0)

Actions
14. Re: NSH Proxy Error SSO Error

Bill Robinson Feb 25, 2011 11:45 AM (in response to Adam Bowen)

blcred -destroy.

also if you get a new credential it should overrite the expired one - eg blcred cred -acquire <options> or use the 'save cached credential for this session' option in the gui login.
Like Show 0 Likes(0)

Actions