Difference between revisions of "Common Security Troubleshooting"

Revision as of 10:41, 20 May 2009

This page contains exceptions that commonly occurs in security configurations for gCube services. Exception should be clearly reported in sections using keywords as the Axis fault obtained, the error code returned by commands and so on (see already existing exceptions). For any exception a list of reasons can be reported as separate subsections. For each reason a solution should be also provided (if already discovered). To properly configure security for gCube services please follows the How To Enable Security page.

GSI Secure Conversation authentication required for "{http://www...." operation

This exception tells the clients that the GSISecureConversation mechanism is required to acces the service client-config.wsdd must be correctly placed in your Apache Tomcat container. If you want to force axis to pick up your client-config.wsdd, you will have to place the client-config.wsdd in the tomcat-home/common/classes directory.

GSISecureConveration not set in service stubs

To access the service operation the GSISecureconversation must be set on client, please be sure to follows this documentation to set it correctly.

org.globus.wsrf.security.SecurityException: [SEC]Operation name could not be determined

This exception is thrown when operations in the WSDL interface does not match with methods in the service implementation class.

voms-proxy-init error stream:Error: VERR_NOSOCKET

Exception related to authentication of clients to the VOMS server (ie. voms.research-infrastructures.eu in this case) Contacting voms.research-infrastructures.eu:15001 [/C=IT/O=INFN/OU=Host/L=NMIS-ISTI/CN=voms.research-infrastructures.eu] "gCube" Failed to contact servers for gCube.

Please doublecheck these settings:

• the glite-security-voms-* rpms installed in your machine should be at least 1.7.xy
• The clock on your computer could be not in sync with VOMS server. Use with ntp server Configure DHN security
• The CRLs has to be updated using /usr/sbin/fetch-crl -o /etc/grid-security/certificates
• Some CA certificates in /etc/grid-security/certificates could be expired, please update them.
• Your firewall or VOMS Server firewall blocks the client

When voms-proxy-init runs as root it will try to use host credentials: in this situation some globus toolkit library has hardcoded usage of /etc/grid-security/hostcert.pem and /etc/grid-security/hostkey.pem. Please remove them from that path or rename them.

Operation unauthorized (Mechanism level: Authorization failed. Expected "/CN=host/your_ip_number" target but received "/O=Grid/CN=host/your_hostname")

It is thrown when the hostname cannot be resolved in the IP asking the DNS server. Usually this problem disappear as soon as the DNS is updated.

Operation unauthorized (Mechanism level: Authorization failed. Expected "/CN=host/hostname" target but received "/O=Grid/CN=your_personal_certificate")

It could be thrown for a misconfiguration of the host certificates. Please doublecheck Install host credentials.

Caused by COM.claymoresystems.ptls.SSLThrewAlertException: Decrypt error

This Exception is thrown when certificate and private key used to perform a secure communication do not match.

org.apache.axis.types.URI$MalformedURIException: Cannot initialize URI with empty parameters.

You could get this exception during a VOMSServlet installation: it is thrown when the tomcat container that hosts vomsSservlet has inside his CLASSPATH env. var. the GLOBUS_LOCATION. This makes use to tomcat the wrong axis version causing the exception. Please clean the CLASSPATH.