Loading...
Loading...
The NetWorker VMware Protection integration is configured with the vProxy Appliance. The emcauthctomcat may be removed when the Java Runtime Environment (JRE) installation is upgraded on the NetWorker server. The vSphere Web Client plug-in fails to connect to the NetWorker server with the following error: The localhost_access_log.YYYY-MM-DD.txt shows HTTP 500 errors for the REST API requests: Linux: /nsr/authc/logs/localhost_access_log.YYYY-MM-DD.txt Windows: C:\Program Files\EMC NetWorker\nsr\authc-server\tomcat\logs\localhost_access_log.YYYY-MM-DD.txt xxx.xxx.xxx.xxx - - [DD/MM/YYYY:HH:MM:SS -0500] "GET /nwrestapi/v2/ HTTP/1.1" 500 690 xxx.xxx.xxx.xxx - - [DD/MM/YYYY:HH:MM:SS -0500] " GET /nwrestapi/v2/internal/users/administrator HTTP/1.1" 500 718 xxx.xxx.xxx.xxx - - [DD/MM/YYYY:HH:MM:SS -0500] "POST /ebr-server/auth/login HTTP/1.1" 204 - The ebr-server.log shows the authentication request: Linux: /nsr/authc/logs/ebr-server.log Windows: C:\Program Files\EMC NetWorker\authc-server\tomcat\logs\ebr-server.log YYYY-MM-DD HH:MM:SS INFO Logging into appliance with type: networker YYYY-MM-DD HH:MM:SS INFO Attempting connection in NwConnectService YYYY-MM-DD HH:MM:SS INFO Testing provided credentials for nw calls YYYY-MM-DD HH:MM:SS INFO Call NW: [https://xxx.xxx.xxx.xxx:9090/nwrestapi/v2/] YYYY-MM-DD HH:MM:SS INFO Testing provided credentials for nw calls YYYY-MM-DD HH:MM:SS INFO Call NW: [https://xxx.xxx.xxx.xxx:9090/nwrestapi/v2/internal/users/administrator] YYYY-MM-DD HH:MM:SS ERROR NetWorker login failed with given credentials - not admin YYYY-MM-DD HH:MM:SS ERROR Failed to authentciate nw credentials for Administrator org.apache.http.auth.AuthenticationException: Authentication Invalid at com.emc.nw.business.NwConnectBusiness.assertValidNetWorkerLogin(NwConnectBusiness.java:86) ... YYYY-MM-DD HH:MM:SS ERROR Failed To Get VDR Info org.apache.http.auth.AuthenticationException: Authentication with nw was unsuccessfull. at com.emc.nw.business.NwConnectBusiness.sessionConnect(NwConnectBusiness.java:44) .... YYYY-MM-DD HH:MM:SS FATAL normally fatal, but seeing what happens when coming from vCenter for goldfish. The restapi.log shows an exception: Linux: /nsr/logs/restapi/restapi.log Windows: C:\Program Files\EMC NetWorker\nsr\logs\restapi.log YYYY-MM-DD HH:MM:SS DEBUG [http-nio-9090-exec-1] c.e.n.w.a.AuthcClient - Auth request: tenant 'null', domain 'null', userId 'administrator'. YYYY-MM-DD HH:MM:SS WARN [http-nio-9090-exec-1] o.a.c.p.PhaseInterceptorChain - Interceptor for {https://localhost:9090/auth-server/api/v1/sec/authenticate}WebClient has thrown exception, unwinding now org.apache.cxf.interceptor.Fault: Could not send Message. at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:64) ~[cxf-core-3.1.0.jar:3.1.0] .... Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://localhost:9090/auth-server/api/v1/sec/authenticate: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.8.0_121] .... Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.ssl.Alerts.getSSLException(Unknown Source) ~[na:1.8.0_121] .... YYYY-MM-DD HH:MM:SS ERROR [http-nio-9090-exec-1] c.e.n.w.WebApiExceptionMapper - Status 'Internal Server Error', msg: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://localhost:9090/auth-server/api/v1/sec/authenticate: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://localhost:9090/auth-server/api/v1/sec/authenticate: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at org.apache.cxf.jaxrs.client.AbstractClient.checkClientException(AbstractClient.java:557) ~[cxf-rt-rs-client-3.1.0.jar:3.1.0] ....
The Java Runtime Environment (JRE) on the NetWorker server was upgraded and it replaced the cacerts keystore. The emcauthctomcat certificate was removed during the replacement. The vSphere Web Client plug-in requires this certificate to authenticate to the NetWorker REST API. Without the certificate, the REST API SSL handshake fails with PKIX path building errors.
The emcauthctomcat certificate must be imported into the Java JRE keystore configuration. Here is an overview to check if the certificate exists and to import the certificate. Open a Windows command prompt or Linux terminal session on the NetWorker server. Change to the Java JRE installation directory. The directory changes depending on the installed Java JRE version. Example installation paths for JRE 1.8.0_151 Windows: C:\Program Files\Java\jre1.8.0_151\bin> Linux: /usr/java/jre1.8.0_151/bin Example of NetWorker Runtime Environment (NRE) install: Windows: C:\Program Files\NRE\java\jre#.#.#_###\bin Linux: /opt/nre/java/latest/bin Use the keytool command-line utility to validate if the certificate does not exist in the Java JRE cacerts keystore: Windows: keytool -list -storepass changeit -keystore ..\lib\security\cacerts | findstr emc Linux: keytool -storepass changeit -list keystore ../lib/security/cacerts | grep emc Use the keytool command-line utility to import the emcauthctomcat certificate: Windows: keytool -importcert -storepass changeit -trustcacerts -alias emcauthctomcat -file "C:\Program Files\EMC NetWorker\nsr\authc-server\tomcat\conf\emcauthctomcat.cer" -keystore ..\lib\security\cacerts Linux: keytool -importcert -storepass changeit -trustcacerts -alias emcauthctomcat -file /nsr/authc/conf/emcauthctomcat.cer -keystore ../lib/security/cacerts Use the keytool command-line utility to validate if the certificate now exists in the Java JRE cacerts keystore: Windows: keytool -list -storepass changeit -keystore ..\lib\security\cacerts | findstr emc Linux: keytool -storepass changeit -list keystore ../lib/security/cacerts | grep emc
Click on a version to see all relevant bugs