VCA will not authenticate in workgroup mode

[Michael F. Pacheco]

Insight 5.0 SP2 installed on Win2003 SP1, the repository is installed on the same server, the server is in workgroup mode.

The local server VCA agent works fine - reports software inventory and required upgrades etc... as advertised.

When trying to connect another servers VCA to the repository by changing its setting I get a can not authenticate error.

Have created a specific user account on the repository server (vcadmin) with administrator group privs, have filled out the remote server VCA agent settings for the respository server username as:

vcadmin and have tried servername\vcadmin, both fail. Have reset the password numerous times, tried a simple password etc... no luck.

The authentication mode for all my servers will always be workgroup - will this work? or is this another case of needing an AD domain to do anything?

Any ideas?

Thanks in advance.

[Rob Buxton]

It shouldn't be as the easiest approach is to use a local account on the Server. That's exactly what we use. The VCA Login details are just Username. No "\" anything before it.

So the other issue is connectivity. Maybe try with just the IP Address in the VCA settings.

[Michael F. Pacheco]

Thanks for the reply, already did the ip address as well as the host name - neither worked as stated in the problem description.

Have tried:

Short name of Repository server
FQDN Name of Rep server
IP address of rep server.

Each client VC server can resolve the Rep server both short version and FQDN.

Tried creating a vcadmin account (on the client VC server) with same password as the vcadmin account on the rep server (I know - thats kind of out there for a fix, but I've seen worse :) )

Thats it - thanks again for the reply.

M

[Rob Buxton]

Just to add, login attempts to the VCRM are picked up in the smh.log file in c:\hp\hpsmh\logs directory of the VCRM Server.

[Michael F. Pacheco]

Thanks again,

Reset the password for the 10th time and no go, looked at the log file and each time I get:

"WARNING LOG (severity=1) Tue Feb 21 15:08:03 2006
User:vcadmin from 10.112.4.20 was DENIED access to System Management Homepage"

Checked the System management Homepage on the Repository server and it has nothing in either its include or exclude IP address listing on the Security tab.

So - the log tells me its getting the request OK, but somewhere in the Resp server its saying no... will keep digging around.

Thanks.

M

[Albert Austin]

Hi Michael,

Just finished setting up SIM in a workgroup mode so just wanted to mention that AD is not neccessary for the environment to work. Could be a firewall thats preventing VCA from connecting to VCRM? How many nics do you have on your cms?

[Michael F. Pacheco]

Hi

No firewall, this is an internal network install, typical vlan setup, and SIM itself is running fine, discovering servers, adding servers across vlans, authenticating to local server "System Homepages" etc...

All the normal first install SIM stuff that usually happens, just seems to be the VC agents that don't want to talk. Even have 3 servers in the same subnet as the CMS server, the VCA agent will not authenticate from the server agent to the CMS repository server.

Thanks for the reply.

M

[Michael F. Pacheco]

Sorry - forgot - 2 NICs in the CMS server, but only one is active - the other one has no cable and is disabled in the OS - so its not a routing\binding issue.

M

[Rich Purvis · Accepted solution]

Based on this error message:
"WARNING LOG (severity=1) Tue Feb 21 15:08:03 2006
User:vcadmin from 10.112.4.20 was DENIED access to System Management Homepage"

It looks like the VCA is "trying" to connect to the VCRM. If you have vcadmin placed in the Administrator group for the VCRM server then it should attempt authentication. Are you using any odd or special characters in the password? I am not aware of any limitations off the top of my head but that doesn't mean there aren't any.

Can you browse from a system to the system running the VCRM and sign into the SMH through port 2381 using the vcadmin ID?

Another possible thing to try is create a new OS group call SMHAdmins or something like it and add the ID into that group. Then go ionto the SMH security settings for the VCRM server and give that group name Administrator authority for SMH. It may or may not make a difference (shouldn't but you never know).

-Rich

[Michael F. Pacheco]

We have a winner!! - Well sort of... only thing I can figure out is a corrupt windows account sid or something along those lines.

Deleted vcadmin, created a new account with a different name in the Repository servers admin group and it worked first time, added 4 more servers to the Rep server with no issues. Only PIA was having to redo the 2 servers I already had, but small peanuts compared to getting it running reliably.

Thanks a bunch for the push in the right directions!

M