topic Re: Single Sign on doesn't work after System Management Homepage update in Server Management - Systems Insight Manager

Single Sign on doesn't work after System Management Homepage update

consolero — Tue, 26 Jun 2012 07:46:41 GMT

Hi all

We use our HP SIM with a certificate from our CA and distribute this certificate to all of our servers, which are running a SMH.

The SMH trusts by certificate and the SIM server is known as the trusted management server with this certificate. With the SMH versions 6.3.1.24 and 7.0.0.24 it was possible to use the SSO from SIM to acces the SMH. After updating to the newest Version 7.1.1.1 it is no longer possible to use the SSO and I found this errors in the SMHlog:

CRITICAL

Trusted certificate used for SSO is either revoked or SMH failed to verifiy it against CRL

MAJOR

Certificate verification message: uanble_to_get_local_issuer_certificate

WARNING

Secure Task Execution User:auto_generated was DENIED acces to System Management Homepage to invoke target URL=/Proxy/STE

Does anyone know this problem?

Thanks a lot

nik

Re: Single Sign on doesn't work after System Management Homepage update

Jens Ey — Tue, 26 Jun 2012 11:20:37 GMT

Hi nik,

I know this problem - but not the solution, sorry.

i tried so far to create a new certificate for SIM and even renewed the CA certificate to get rid of a URL with file://... for the CRL.

As far as I can remember HP changed OpenSSL to a newer version with this release of SMH.

jens

Re: Single Sign on doesn't work after System Management Homepage update

Jens Ey — Thu, 28 Jun 2012 10:02:13 GMT

hello nik.

the next thing I tried was to look closer at the new SIM 7.1. There is an option how the agents should check for revoked certificates (e.g. is the CA available for the agents or has the SIM a copy of the CRL).

I installed a complete new SIM 7.1 and a new server with the current agents but had no luck at all to get this working.

So my conclusion for the moment is once more: HP broke it, HP should fix it.

Jens

Re: Single Sign on doesn't work after System Management Homepage update

consolero — Thu, 28 Jun 2012 12:46:58 GMT

hello jens

Thanks for your informations.

I also upgraded to SIM 7.1 and tried to configure the Certificate Revocation Check but the probles is still the same.

I am agree with you about HP....

nik

Re: Single Sign on doesn't work after System Management Homepage update

referencepoint — Fri, 06 Jul 2012 07:28:04 GMT

I've just come across this issue too, after upgrading to SIM 7.1 and updating my servers with SMH 7.1.1.1.

Hugely annoying to not have SSO working for any system now - this needs fixing ASAP HP!

Re: Single Sign on doesn't work after System Management Homepage update

Bart_Heungens — Fri, 06 Jul 2012 07:42:00 GMT

Hi,

Just to inform you all that I have no such problems... Have 2 independent SIM environments running with the latest SMH and SIM 7.1 and do not have the SSO problem...

Kr,

Bart

Re: Single Sign on doesn't work after System Management Homepage update

Jens Ey — Fri, 06 Jul 2012 08:02:44 GMT

Hi Bart,

are you using a CA in these environments and what kind of CA? Are you copying the CRLs to the SIM servers?

Jens

Re: Single Sign on doesn't work after System Management Homepage update

Bart_Heungens — Fri, 06 Jul 2012 08:25:32 GMT

Hi Jens,

No I am not using a separate CA...

Kr,

Bart

Re: Single Sign on doesn't work after System Management Homepage update

consolero — Mon, 09 Jul 2012 12:10:06 GMT

Hi,

I fixed the problem with the CRL by signing a new SIM Certificate (2048) with my CA.

But the next problem is already here:

The SIM server uses a self-signing certificate (1024) for the SSO and not my new cert from the CA.

Is this a new thing with SIM 7 or why does he take this one?

nik

Re: Single Sign on doesn't work after System Management Homepage update

Jens Ey — Mon, 09 Jul 2012 12:18:37 GMT

Hi,

did you changed to SIM certificate or the SMH certificate of the SIM server?

SIM certificates must be changed in SIM (Options / Security / HP Systems Insight Manager Server Certificate) using the button "Import" where you can create a new request and import it later.

After import the SIM has to be rebooted.

I also tried to generate a new CA signed certificate for the SIM (and even setting up a complete new SIM) but had no luck...

Jens

Re: Single Sign on doesn't work after System Management Homepage update

consolero — Mon, 09 Jul 2012 12:34:48 GMT

I changed the SIM certificate as you described it. And I also imported the new SIM certificate as trusted management server in the SMH.

nik

Re: Single Sign on doesn't work after System Management Homepage update

ICS — Mon, 09 Jul 2012 17:25:46 GMT

There appears to be a compatibility issues as I am having the same issue with hpsmhd 7.1.0.17 and SIM 6.3. I raised the issue with HP..workaround appears to be deleting the certificate and pulling it from the CMS.

Re: Single Sign on doesn't work after System Management Homepage update

consolero — Tue, 10 Jul 2012 06:28:10 GMT

Good morning

What do you mean with deleting the certificate and pulling it from the CMS?

Deleting the Trusted certificate on the SMH? Pulling by Agent repair?

thx

nik

Re: Single Sign on doesn't work after System Management Homepage update

IT_SCAC — Wed, 11 Jul 2012 14:11:46 GMT

I have same problem. After upgrade to SIM 7.1 and SMH v7.1.1.1 can't login via SSO.

SIM have certificate issued by enterprise CA. It include correct CRL URL path.
WIth SMH v6.3.1.24 all work perfect.

What else need options to get SSO work?

Re: Single Sign on doesn't work after System Management Homepage update

ICS — Wed, 11 Jul 2012 14:16:28 GMT

I deleted the certificate from the SMH under security...then used the get server option to pull the trusted mgmt server cert. I was immediately able to SSO from SIM

Re: Single Sign on doesn't work after System Management Homepage update

consolero — Wed, 11 Jul 2012 14:18:58 GMT

Hi IT_SCAC

How long is the key lenght of your SIM certificate?

Have you tried to reimport the SIM certificate to the trusted server on the smh?

greez

Re: Single Sign on doesn't work after System Management Homepage update

IT_SCAC — Wed, 11 Jul 2012 14:28:51 GMT

1024
Yes i try reimport via quick repair.

Re: Single Sign on doesn't work after System Management Homepage update

IT_SCAC — Wed, 11 Jul 2012 14:47:59 GMT

I just create new certificate with 2048 bit and SSO is worked!!!

Re: Single Sign on doesn't work after System Management Homepage update

consolero — Wed, 22 Aug 2012 07:02:28 GMT

hello

This works for me too but when I see the details of the trusted certificate on the smh I see that he takes a self-signed certificate:

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: xxxxxxxxxx (xxxxxxxxxx) (For your security, I have removed the serial number from your post above - that's information you probably don't want to make publicly available - HP Forums Moderator)
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, ST=California, L=Palo Alto, O=Hewlett-Packard Company, OU=Hewlett-Packard Network Management Software, CN=srvname.com
        Validity
            Not Before: Jun 5 11:47:11 2012 GMT
            Not After : Jun 6 11:47:11 2022 GMT
        Subject: C=US, ST=California, L=Palo Alto, O=Hewlett-Packard Company, OU=Hewlett-Packard Network Management Software, CN=srvname.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)

Do you have the same effect or does it takes your CA-signed SIM-certificate?

thx

nik

Re: Single Sign on doesn't work after System Management Homepage update

Jens Ey — Thu, 12 Jul 2012 06:47:36 GMT

@ICS wrote:
I deleted the certificate from the SMH under security...then used the get server option to pull the trusted mgmt server cert. I was immediately able to SSO from SIM

Hi,

deleting the SIM certificate in the SMH of the other servers and reimporting them from the SIM didn't worked for me. It seems that SSO ist working because you are already logged in but if you sign out and restart your web browser SSO is not working. At leat not for me.

Jens