KB 130016
IDENTIKEY Authentication Server Webadmin with
Websphere 8.5.5.0
Creation date: 30/09/2015 Last Review: 19/10/2015 Revision number: 3
Document type: How To Security status: EXTERNAL
Summary
An Error occurs when using IDENTIKEY Authentication Server Webadmin with
Websphere 8.5.5.0.
Problem symptoms / details.
When performing the java -jar admintool_3.8.0.jar the webadmin doesn't display the servers in the dropdown box.
When using the java from the websphere itself we get following error:
[administrator@websphere bin]$ ./java -jar
/home/administrator/webadmin/admintool_3.8.0.jar autoadd test https://192.168.21.0:8888 Identikey Webadmin 3.8 Configuration Tool
Copyright (c) 2015 VASCO Data Security, Inc.
An error occurred: SSL handshake failed, if you have client verification enabled on the server then ensure that the correct client certificate and private key is loaded in the keystore.
Specify '--help' for syntax details.
Applies to : IDENTIKEY Authentication Server 3.8
KB 130016– 19/10/2015
2015 VASCO Data Security. All rights reserved.
Page 1 of 4
Problem Solution.
Please use the following steps to deploy VASCO Webadmin:
Procedure 24: Manually deploying the Administration Web Interface using IBM
Websphere 8.5
1. Copy the files webadmin_3.8.0.war and admintool_3.8.0.jar from IAS CD to the WebSphere host machine.
2.
Verifying SDK 7.0 on WebSphere Application Server 8.5 https://docs.oracle.com/cd/E24902_01/doc.91/e23436/inst_config_was85_ibm.htm#EOHII22
8
Enable java 7 on IBM WebSphere using the following commands:
[administrator@localhost WebSphere]$ ./AppServer/bin/managesdk.sh – listEnabledProfileAll
[administrator@localhost WebSphere]$ ./AppServer/bin/managesdk.sh enableProfileAll -sdkname 1.7_64 –enableServers
[administrator@localhost WebSphere]$ ./AppServer/bin/managesdk.sh setNewProfileDefault -sdkname 1.7_64
[administrator@localhost WebSphere]$ ./AppServer/bin/managesdk.sh setCommandDefault -sdkname 1.7_64
3. Change the IAS Soap Communicator settings using ikconfigutilgui on IAS-Server. SOAP communicator security level must be medium.
4. Add the IP Adress of WebSphere Server as Administrative Client Component in IAS.
5. Try the URL https://<IAS-IP>:8888 on WebSphere Server if it is responding.
• if not, check whether IAS is running.
• or check the firewall or disable firewall or add rules into the firewall.
6. Add the IAS Server to the webadmin by admintool.jar using the jre7 of IBM WebSphere
[administrator@localhost WebSphere]$
./AppServer/java_1.7_64/jre/bin/java -jar
~/webadmin/admintool_3.8.0.jar server add <IAS-NAME> https://<IAS-
IP>:8888
7. Goto WebSphere admin console ( http://localhost:9060/ibm/console ) and there open Servers then goto:
Application servers > server1 > Process definition > Java Virtual Machine
In Generic JVM arguments add the following:
-Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -
Djava.net.preferIPv6Addresses=false
8. Then click on OK and Save.
9. When using Expression Language (EL) using certain values as variable identifiers causes JSP parse exceptions e.g. popup jsps in webadmin. In order to fix this issue,
Applies to : IDENTIKEY Authentication Server 3.8
KB 130016– 19/10/2015
2015 VASCO Data Security. All rights reserved.
Page 2 of 4
com.ibm.wsspi.jsp.evalQuotedAndEscapedExpression should be added to webcontainer custom properties in IBM WAS. The following should be done:
•
In the administrative console, click "Servers" and under Servers click "Server Types" and under Server Types click "WebSphere application servers"
•
Click on the server to which the custom property is to be applied
•
Under "Configuration" and "Container settings" click "Web Container Settings" and under Web Container Settings click "Web container"
•
Under "Configuration" and "Additional Properties" click "Custom Properties"
•
In the Custom Properties page, click "New" (Note that some properties are case sensitive. )
•
Name: com.ibm.wsspi.jsp.evalQuotedAndEscapedExpression
•
Value: true
•
Click "Apply" or "OK"
•
Click "Save" in the "Messages" box that appears
For reference see https://www.ibm.com/support/knowledgecenter/SSEQTP_8.5.5/com.ibm.websphere.nd.doc/ae/ rweb_jsp_custom_props.html#functionsandexpressions
10. Expand the Security entry in the side menu. Then goto:
Security / SSL certificate and key management > Key stores and certificates >
NodeDefaultTrustStore > Signer certificates > Retrieve from port
Enter the IP address and secure SOAP port for the IDENTIKEY Authentication Server.
Enter an alias.
Click on Retrieve signer information.
Click on OK.
Click on Save.
11. Open the file <WebSphere_Install_Dir>/AppServer/java_1.7_64/jre/lib/security/java.security
12. Find the following lines and be sure it is as follows (it means use the com.ibm.jsse2 as
SSLSocketFactory):
# Default JSSE socket factories ssl.SocketFactory.provider=com.ibm.jsse2.SSLSocketFactoryImpl ssl.ServerSocketFactory.provider=com.ibm.jsse2.SSLServerSocketFactoryImpl
# WebSphere socket factories (in cryptosf.jar)
#ssl.SocketFactory.provider=com.ibm.websphere.ssl.protocol.SSLSocketFactory
#ssl.ServerSocketFactory.provider=com.ibm.websphere.ssl.protocol.SSLServerSocketFactory
13. Restart the WAS:
[administrator@localhost IBM]$ ./WebSphere/AppServer/bin/stopServer.sh server1
[administrator@localhost IBM]$ ./WebSphere/AppServer/bin/startServer.sh server1
14. Open the webadmin_3.8.0.war using Archive Manager Application or with 7zip:
Remove the following jars from WEB-INF/lib.
• geronimo*.jar
• istack*.jar
• jaxb-api*.jar
• jaxb-core*.jar
• jaxb-impl*.jar
• jaxen*.jar
Applies to : IDENTIKEY Authentication Server 3.8
KB 130016– 19/10/2015
2015 VASCO Data Security. All rights reserved.
Page 3 of 4
• jsr*.jar
• woden*.jar
• wstx-asl*.jar
15. Open WEB-INF/classes/logback.xml. Change the log file location as follows:
<File>logs/webadmin.log</File>
16. Save the webadmin_3.8.0.war.
17. Open the WebSphere administrative console and login as an administrator.
18. Expand the Applications entry in the side menu.
19. Click on New Application.
20. Click on New Enterprise Application.
21. Select Local file system and click in the Full path field to browse to the webadmin_3.8.0.war file on the local machine.
22. Click Next.
23. Only default values are required in the following pages:
• Preparing for the application installation
•
Select installation options
•
Map modules to servers
•
Map virtual hosts for Web modules pages
24. Click Next to accept default values until the Map context roots for Web modules page is displayed.
25. Enter /webadmin in the Context Root field and click on Next.
26. Click on Finish.
27. Click on Save.
28. Expand the Application Types entry in the side menu.
29. Click on WebSphere enterprise applications.
30. Click on webadmin_3_8_0_war
31. Click on Manage Modules.
32. Click on Identikey Web Administrator.
33. Select Classes loaded with local class loader first (parent last) from the Class loader order drop-down list.
34. Click on OK.
35. Click on Save.
36. (Re)Start the webadmin application.
37. Stop and start the webadmin.war application from the WebSphere administrative console.
38. Access the Administration Web Interface via browser at the following address http://localhost:9080/webadmin/login.action
Applies to : IDENTIKEY Authentication Server 3.8
KB 130016– 19/10/2015
2015 VASCO Data Security. All rights reserved.
Page 4 of 4
