Archive for category: Articles

After making updates to your LDAPS-enabled Lawson environment, you may encounter errors when trying to start the Lawson service.  Check the lase server logs for a message similar to this:

 

20-12-03 14:07:57:455 1 default.SEVERE api.LawsonSecurity.initialize(): Failed to initialize Ldap

20-12-03 14:07:57:467 1 default.SEVERE api.LawsonSecurity.getConfig(): com.lawson.lawsec.authen.LSFSecurityAuthenException:Failed to initialize LDAP. Detailed Message is javax.naming.CommunicationException: simple bind failed: 111.111.111.111:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

Stack Trace : javax.naming.CommunicationException: simple bind failed: 111.111.111.111:636 [Root exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]

                at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:219)

                at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2895)

 

This message means that you need to add/update the ADLDS certificate for your OS Java.  Follow these steps to update the certs:

 

1. Set environment variables (<APPINSTALLDIR>\enter)
2. Run command “where java” to determine where LAW_JAVA_HOME is located
   1. NOTE: You may have multiple instances of Java, and you need to make sure you apply the cert to all of them!
3. Back up file LAW_JAVA_HOME\jre\lib\security\cacerts
4. Run the ikeyman utility at WAS_HOME/bin
5. Open the LAW_JAVA_HOME/jre/lib/cacerts file and select the Key database type of JKS
   
6. Type password “changeit”
   1. This is the default password for the Java certs files
      
7. Select “Signer Certificates” in the dropdown
8. Click “add” and navigate to the ldap certificate exported earlier
   
9. Give it a meaningful name
   

LDAPS requires multiple certificates, and all must be valid and current for authentication to work in Lawson.  If you are trying to log into Lawson after implementing LDAPS and Lawson is behaving like the user doesn’t exist or the password is invalid, check the LAWDIR/system/security_authen.log.  A certificate issue will be noted by verbiage such as:

Tue Nov 10 16:45:55.359 PST 2020 – default–844051996: Error encountered while getting users DN. Please see logs for details[858vk9nl1gd6d40vdn8r41qhl3]Could Not Bind With privileged identity. User [lawson]simple bind failed: dc.company.com:3269
Stack Trace :
javax.naming.CommunicationException: simple bind failed: dc.company.com:3269 [Root exception is javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: PKIX path validation failed: java.security.cert.CertPathValidatorException: The certificate expired at Fri Nov 06 11:33:36 PST 2020; internal cause is:
java.security.cert.CertificateExpiredException: NotAfter: Fri Nov 06 11:33:36 PST 2020]
at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:231)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2753)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:329)

This message could indicate that your AD LDS certificate is expired, so you need to check that cert on the server, as well as in WebSphere.  However, it could also mean that the certificate on the domain controller is expired, so you’ll need to check that as well.

If you are using AD FS to authenticate against Lawson, and having trouble connecting to either Lawson or Landmark, one thing you need to verify is the IdP certificate.  This certificate should be the Token Signing Certificate that is exported from the AD FS manager.

To make sure the certificate is valid in Lawson, use an LDAP browser to connect to your Lawson AD LDS instance.  Navigate to lwsnSecData > svcprop > [your ADFS service name].  Open the properties of the IdPSigningCertificate and validate the lwsnSvcPropValueBinary value.  If it is blank, you need to delete and reinstall the IdPSigningCertificate.  If it is not blank, but you are still having trouble with connecting to Lawson, and you’ve tried everything else, it doesn’t hurt to delete and recreate the certificate.

To delete and reimport the certificate in Lawson, log into ssoconfig.  Select Manage WS Federation Settings > Manage Certificates.  Select “Delete IdP Certificate” and type in the service name for which you are deleting the cert.  Then select “Import IdP Certificate”.  Provide the service name and full file path.

To validate the Landmark certificate, in Rich Client GEN navigate to Service > [the service that is used with AD FS].  In Service Properties, check the IdPSigningCertificateThumbrint.  Make sure it matches the thumbprint on your Token Signing certificate that was exported from AD FS.  If it doesn’t match, then follow the steps to delete and reimport the certificate.

To delete the certificate, in a Landmark command window, type the command secadm -m.  Choose option 30 (Manage WS Federation Settings).  Choose option 1 (Manage WS Federation Certificate).  Select 6 to delete the certificate (provide the service name).  Then, select 5 to import the certificate (provide the service name and file path).