If you are receiving login failures in IPA work units due to connection timeouts, or connection refused, it is possible that you need to take some steps to improve the performance of your IPA-S3 connections. To do that, you can update the recommended S3 Connection Pool Settings.
First, open the Landmark Grid and click the “gears” to get to the configuration manager. Select Applications > (your Landmark application) > Edit Properties. Type Ctrl+F and search for “S3”.
Open each of the S3 configuration properties, and select the “All” radio button. Make your changes on the “LPA” node for Any Host. Set the S3 configuration properties to the following recommended values:
- UsePooledConnections = True
- MaxActiveConnections = 10
- MaxIdleConnections = 2
- MaxConnectionWaitSec = 30
- TimeBetweenEvictionRunsSec = 30
- ValidationTimeSec = 240
- EnableConnectionValidation = True only set this value if you are on Landmark Technology 10.1.1.58 or higher
Save each change in the dialog window, and then click the main “Save” button at the top of the Properties window. After you have made these changes, restart the LPA node in the Grid.
After logging into Lawson, if you see the below error “Cannot retrieve user file. Bookmark IDs cannot be read”, there is a good chance that the iosconfig.xml file has some invalid values. The error messages might point you directly to this file. It can be found at LAWDIR/system. Make sure that the ioswebrootdir attribute points to the correct location. This location should be LAWDIR/persistdata. Make sure there are no extra spaces or directory names in this value.
After updating the value, reboot the server or restart the WebSphere services.
If you receive a 401 or 404 error when accessing ESS pages, you need to make sure that the server users have read/write access on the ESS directories. The directories that need this access are WEBDIR/lawson/xbnnet, WEBDIR/lawson/xhrnet, and WEBDIR/lawson/webappjs.
It is important to note that the permsmaint command does not set this security, and it must be set manually by a server administrator.
Before doing any work on your WebSphere Application Server, it is a good idea to back up the profiles. To do this, navigate to <WAS_HOME>/bin. Run the command “manageprofiles.bat -listProfiles” to get a list of all the profiles that need to be backed up. Then run the command:
-manageprofiles.bat -backupProfile -profileName <profile name> -backupFile <full path to back up the file>
Make sure the full file path already exists.
Troubleshooting:
One common issue is if you already have a backup file in the backup directory with the same name. You also might get an error message if one or more of your servers is running. To see which servers are running, run the serverStatus.bat -all command. The deployment manager status can be reviewed from WAS_HOME/bin. Other servers can be viewed by navigating to the WAS_HOME/profiles/<profile you are checking>/bin. Sometimes you might also need to stop the web server(s) in IIS.
While configuring LDAPS, if you try logging into Lawson, and it behaves as if your user doesn’t exist, check the LAWDIR/system/security_authen.log. You may encounter an error similar to this:
Could Not Bind With privileged identity.
Thu Dec 3 14:27:49.397 PST 2020 – default–1104671165 – L(2) : Failed to get DN for user: lawson
Thu Dec 3 14:27:49.428 PST 2020 – default–1104671165 – L(4) : Set Content-Security-Policy : script-src ‘self’ ‘unsafe-inline’ ‘unsafe-eval’
Thu Dec 3 14:27:56.977 PST 2020 – default–1104671165: Error encountered while getting users DN. Please see logs for details[peckb73unhe1fga2c54hqghqlj]Could Not Bind With privileged identity. User [lawson]simple bind failed: 111.111.111.11:3269
Stack Trace :
javax.naming.CommunicationException: simple bind failed: 111.111.111.11:3269 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names matching IP address 111.111.111.11 found]
This means that the certificate on your Domain Controller to which Lawson is bound, has a Subject Alternative Name that does not match the DC IP address. You need to make sure the server name you are using for the bind matches the SAN on the Domain Controller’s certificate.
So, bind to this:
Instead of this:
After making updates to your LDAPS-enabled Lawson environment, you may encounter errors when trying to start the Lawson service. Check the lase server logs for a message similar to this:
20-12-03 14:07:57:455 1 default.SEVERE api.LawsonSecurity.initialize(): Failed to initialize Ldap
20-12-03 14:07:57:467 1 default.SEVERE api.LawsonSecurity.getConfig(): com.lawson.lawsec.authen.LSFSecurityAuthenException:Failed to initialize LDAP. Detailed Message is javax.naming.CommunicationException: simple bind failed: 111.111.111.111:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
Stack Trace : javax.naming.CommunicationException: simple bind failed: 111.111.111.111:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:219)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2895)
This message means that you need to add/update the ADLDS certificate for your OS Java. Follow these steps to update the certs:
- Set environment variables (<APPINSTALLDIR>\enter)
- Run command “where java” to determine where LAW_JAVA_HOME is located
- NOTE: You may have multiple instances of Java, and you need to make sure you apply the cert to all of them!
- Back up file LAW_JAVA_HOME\jre\lib\security\cacerts
- Run the ikeyman utility at WAS_HOME/bin
- Open the LAW_JAVA_HOME/jre/lib/cacerts file and select the Key database type of JKS
- Type password “changeit”
- This is the default password for the Java certs files
- This is the default password for the Java certs files
- Select “Signer Certificates” in the dropdown
- Click “add” and navigate to the ldap certificate exported earlier
- Give it a meaningful name
