Chapter 8. Troubleshooting

A:

The Java platform includes certificates from many Certificate Authorities (CAs). If however you run your own CA, or you use self-signed certificates for HTTPS on the container where you run OpenAM, then the agentadmin command cannot trust the certificate presented during connection to OpenAM, and so cannot complete installation correctly.

After setting up the container where you run OpenAM to use HTTPS, get the certificate to trust in a certificate file. The certificate you want is the that of the CA who signed the container certificate, or the certificate itself if the container certificate is self-signed.

Copy the certificate file to the system where you plan to install the policy agent. Import the certificate into a trust store that you will use during policy agent installation. If you import the certificate into the default trust store for the Java platform, then the agentadmin command can recognize it without additional configuration.

Export and import of self-signed certificates is demonstrated in the Administration Guide chapter on Managing Certificates.

A:

SELinux must be properly configured to connect the web policy agent and OpenAM nodes. Either re-configure SELinux or disable it, then reinstall the policy agent.

A:

You probably set ServerName in Apache HTTPD's configuration to the host name, but did not specify the port number.

Instead you must set both the host name and port number for ServerName in Apache HTTPD's configuration. For example, if you have Apache HTTPD configured to listen on port 8080, then set ServerName appropriately as in the following excerpt.

<VirtualHost *:8080>
ServerName www.localhost.example:8080

A:

First, avoid installing the web server (and therefore also the web policy agent) as root, but instead create a web server user and install as that user.

If however you cannot avoid installing the web server and policy agent as root, the you must give all users read and write permissions to the logs/ and logs/debug directories under the agent instance directory ( /path/to/web_agents/type/Agent_number/logs/). Otherwise the web policy agent fails to rotate log files with the error you observed.

A:

Once both web policy agents are installed, navigate to the /path/to/Agent_00x directory, and then open the OpenSSOAgentBootstrap.properties file. Near the end of the file, you should see the following attribute:

com.forgerock.agents.instance.id=

Set that attribute to an appropriate unique value such as 1 or 2. Restart the web service that is being protected by the agent. If successful, you should see related shared memory files, with time stamps updated for the restarted web services. On a Linux system, you may see these files in the /dev/shm directory. On a Solaris system, you may see these files in the /tmp directory.