Troubleshooting XML Validation
Errors
A XML validation error is often ignored because the returning message does not appear to be serious. However, closer inspection of the Linux Access Gateway shows that none of the changes have been applied. When a change is applied by using the UI, the system writes the configuration to the configuration store on the Administration Console, as well as to the /var/novell/cfgdb/ vcdn/config.xml
file on the Linux Access Gateway. If this file passes the schema checks on the Linux Access Gateway, the /var/novell/cfgdb/.current/config.xml
file is updated with the configuration.
This is the file that the Linux Access Gateway reads when it loads or refreshes. If the config.xml file from /var/novell/cfgdb/vcdn/ and /var/novell/cfgdb/.current
are not in sync, then all changes you defined have not been applied to the Linux Access Gateway.
You need to pay attention to XML validation errors and identify the key steps required to solve such problems. There are two main scenarios that are discussed in this section:
Section 44.1, “Modifying a Configuration That References a Removed Object,” on page 603
Section 44.2, “Configuration UI Writes Incorrect Information to the Local Configuration
Store,” on page 605
44.1 Modifying a Configuration That References a Removed Object
One scenario that causes XML validation errors occurs when a configuration references an object that has been removed. For example, a custom authentication contract was created and assigned to a protected resource. The contract was manually deleted from the Identity Server configuration, but the Access Gateway protected resource still references it, even though it is not displayed in the user interface. After you identify the missing link, you can use the Access Manager interface to work around the problem.
Troubleshooting Steps
1 Search the /opt/novell/devman/share/logs/app_sc.0.log
file on the
Administration Console server for #200904025: Error - XML VALIDATION FAILED.
After you find the entry, work backwards to identify the start of the Java exception. Locate the problem strings or entry from the configuration, such as the following string authprocedure_NEIL___Name_Password___Form found in the following entry:
871(D)Wed May 23 15:45:06 BST
2007(L)webui.sc(T)26(C)com.volera.vcdn.webui.sc.dispatcher.ConfigW
orkDispatcher(M)A(E)org.jdom.input.JDOMParseException: Error on line 1120: cvc-id.1: There is no ID/IDREF binding for IDREF
'authprocedure_NEIL___Name_Password___Form'.
at org.jdom.input.SAXBuilder.build(SAXBuilder.java:468)
44
Troubleshooting XML Validation Errors 603
at org.jdom.input.SAXBuilder.build(SAXBuilder.java:770) at com.volera.vcdn.platform.util.XmlUtil.validateXML(y:3304) at com.volera.vcdn.webui.sc.dispatcher.ConfigWorkDispatcher.A(y:793) at com.volera.vcdn.webui.sc.dispatcher.ConfigWorkDispatcher.do_device
Con
:
: fig(y:648)
: at org.apache.coyote.http11.Http11Processor.process(Http11Processor.j
ava :799) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.pr
oce ssConnection(Http11Protocol.java:705) at org.apache.tomcat.util.net.TcpWorkerThread.runIt(PoolTcpEndpoint.j
ava :577) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(Thre adPool.java:683) at java.lang.Thread.run(Thread.java:534)
(Msg)<amLogEntry> 2007-05-23T15:45:06Z ERROR DeviceManager:
AM#200904025: Error
- XML VALIDATION FAILED. PLEASE CHECK APP_SC LOG </amLogEntry>
2 On the Linux Access Gateway, change to the /var/novell/cfgdb/vcdn directory and open the config.xml file. Search for the problem string and the corresponding protected resource.
The example below shows that the problem string is tied to the
ProtectedResourceID_svhttp_mylag_iMon_root resource. This maps to the
HTTP reverse proxy called mylag , the service called iMon and the protected resource called root .
----- snippet from problem area of config.xml ------
<ProtectedResource Name="root" Enable="1" Description=""
LastModified="116973455
5995" LastModifiedBy="cn=admin,o=novell"
UserInterfaceID="ProtectedResourceID_sv http_mylag_iMon_root"
ProtectedResourceID="ProtectedResourceID_svhttp_mylag_iMon
_root">
<URLPathList LastModified="4294967295"
LastModifiedBy="String">
<URLPath URLPath="/*" UserInterfaceID="/*"/>
</URLPathList>
604 Novell Access Manager 3.0 SP1 Administration Guide
<PolicyEnforcementList LastModified="1168947602067" schemaVersion="1.34"
LastModifiedBy="cn=admin,o=novell"
RuleCombiningAlgorithm="DenyOverridesWithPri ority">
<PolicyRef ElementRefType="ExternalWithIDRef"
ExternalDocRef="ou=xpemlPEP,ou=mastercdn,ou=ContentPublisherContai ner,ou=Partition,ou=PartitionsContainer,ou=VCDN_Root,ou=accessMana gerContainer,o=novell:romaContentCollectionXMLDoc"
UserInterfaceID="PolicyID_xpemlPEP_AGFormFill_1168947167634"
ExternalElementRef="PolicyID_xpemlPEP_AGFormFill_1168947167634"/>
</PolicyEnforcementList>
<AuthenticationProcedureRef
AuthProcedureIDRef="authprocedure_NEIL___Name_Password___Form"/>
</ProtectedResource>
----- end of snippet from problem area of config.xml ------
Looking at the AuthenticationProcedureRef variable, which points to the contract assigned to the protected resource, you can see that the authprocedure_NEIL___Name_Password___Form contract is assigned to it.
However, when you look at the Linux Access Gateway configuration in the Administration
Console, you can see that the assigned contract is [None] , which is not the contract shown in the example. Changing it to another contract name, then applying the change, then setting the contract back to [None] clears the problem entry. This gets the setup going again with no XML validation errors.
In this example, these was a custom contract assigned to the protected resource. This custom contract had been removed from the Identity Server’s list of contracts, and the cleanup was never done properly on the Linux Access Gateway.
44.2 Configuration UI Writes Incorrect
Information to the Local Configuration Store
In this scenario, you apply the same change twice in quick succession, and the information written to the configuration store is invalid. Subsequent schema checks detect this invalid configuration and return an XML validation error. This scenario is more complex because it involves changing the configuration store on the Administration Console.
Troubleshooting Steps
1 On the Administration Console, search the /opt/novell/devman/share/logs/ app_sc.0.log
file for #200904025: Error - XML VALIDATION FAILED .
After you find the entry, work backwards to identify the start of the Java exception. From this, locate the problem strings or entry from the configuration, such as
ProtectedResourceID_svhttp_sjh_portal_sjh_portal_1179933619340 .
This message also indicates that a defined protected resource might not be unique. The
Troubleshooting XML Validation Errors 605
configuration shows that before the Java exception, there is not enough information to narrow down the problem, so more troubleshooting is required.
The following is a snippet from the problem area of app_sc.0.log
file that indicates that there are multiple occurrences of a protected resource.
Caused by: org.xml.sax.SAXParseException: cvc-id.2: There are multiple occurrences of ID value
'ProtectedResourceID_svhttp_sjh_portal_sjh_portal_1179933619340'.
at org.apache.xerces.util.ErrorHandlerWrapper.createSAXParseException
(Unknown Source) at org.apache.xerces.util.ErrorHandlerWrapper.error(Unknown
Source) at org.apache.xerces.parsers.XML11Configuration.parse(Unknown
Source) at org.apache.xerces.parsers.XMLParser.parse(Unknown Source) at org.apache.xerces.parsers.AbstractSAXParser.parse(Unknown
Source) at org.jdom.input.SAXBuilder.build(SAXBuilder.java:453) at org.jdom.input.SAXBuilder.build(SAXBuilder.java:770) at com.volera.vcdn.platform.util.XmlUtil.validateXML(y:3304) at com.volera.vcdn.webui.sc.dispatcher.ConfigWorkDispatcher.A(y:793) at com.volera.vcdn.webui.sc.dispatcher.ConfigWorkDispatcher.do_device
config(y:648) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorIm pl.java:39) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAc cessorImpl.java:25) at java.lang.reflect.Method.invoke(Method.java:324) at com.volera.vcdn.webui.sc.dispatcher.DefaultDispatcher.invoke(y:469
) at com.volera.vcdn.webui.sc.dispatcher.DefaultDispatcher.processReque
st(y:1732) at com.volera.roma.app.handler.DispatcherHandler.processRequest(y:316
8) at com.volera.roma.servlet.GenericController.doPost(y:53) at javax.servlet.http.HttpServlet.service(HttpServlet.java:716) at javax.servlet.http.HttpServlet.service(HttpServlet.java:809) at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(A pplicationFilterChain.java:200) at org.apache.catalina.core.ApplicationFilterChain.doFilter(Applicati onFilterChain.java:146) at
606 Novell Access Manager 3.0 SP1 Administration Guide
org.apache.catalina.core.StandardPipeline$StandardPipelineValveCon text.invokeNext(StandardPipeline.java:594) at com.novell.accessmanager.tomcat.SynchronizationValve.invoke(y:297) at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.
java:433) at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:9
48) at org.apache.coyote.tomcat4.CoyoteAdapter.service(CoyoteAdapter.java
:152) at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.pr
ocessConnection(Http11Protocol.java:705) at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(Thre adPool.java:683) at java.lang.Thread.run(Thread.java:534)
(Msg)<amLogEntry> 2007-05-23T13:22:15Z ERROR DeviceManager:
AM#200904025: Error - XML VALIDATION FAILED. PLEASE CHECK APP_SC
LOG </amLogEntry>
2 Confirm that the change has not been applied at the Linux Access Gateway. To do this, use the following steps:
2a Enable the most verbose level of logging in the /etc/laglogs.conf
file: log_level=LOG_DEBUG
. See “Configuring Log Levels” on page 590
.
2b Restart the vmc services by the following command:
/etc/init.d/novell-vmc restart
2c Search for in-memory errors in the ics_dyn log file. When these errors are displayed, the working Linux Access Gateway configuration has not been updated with the latest changes.
2d Identify the protected resource with these issues. In the following case, the protected resource is the same, so you must look at the config.xml
file and search for this specific protected resource. For example:
May 23 13:22:14 chw-amtlag1-176 : 404502 0: 7168: 0: 0:
VcpConfiguration::reconfigure starting AafLog
May 23 13:22:14 chw-amtlag1-176 : 404502 0: 7168: 0: 0:
VcpConfiguration::reconfigure finished
Error at file "in-memory", line 328, column 306
Message: Datatype error: Type:InvalidDatatypeValueException,
Message:ID
'ProtectedResourceID_svhttp_sjh_portal_sjh_portal_1179933619340
' is not unique.
ERROR: Error retrieving config.xml: No data available
3 Search for the preceding string in the /var/novell/cfgdb/vcdn/config.xml
file.
Doing this, you should see the following type of information:
<ProtectedResourceList>
Troubleshooting XML Validation Errors 607
<ProtectedResource Name="sjh_redirect" Enable="1"
Description="" LastModified="1179934022767"
LastModifiedBy="cn=admin,o=novell"UserInterfaceID="ProtectedResour ceID_svhttp_sjh_portal_sjh_portal_1179933619340"
ProtectedResourceID="ProtectedResourceID_svhttp_sjh_portal_sjh_por tal_1179933619340">
<URLPathList LastModified="4294967295"
LastModifiedBy="String">
<URLPath URLPath="/*" UserInterfaceID="/*"/>
</URLPathList>
<PolicyEnforcementList LastModified="1179934011081" schemaVersion="0.1" LastModifiedBy="cn=admin,o=novell"
RuleCombiningAlgorithm="DenyOverridesWithPriority"
IncludedPolicyCategories=""/>
<AuthenticationProcedureRef
AuthProcedureIDRef="authprocedure_Name_Password___Form"/>
</ProtectedResource>
</ProtectedResourceList> and
<ProtectedResourceList LastModified="1179949051828"
LastModifiedBy="cn=admin,o=novell">
<ProtectedResource Name="sjh_redirect" Enable="1"
Description="" LastModified="1179949051828"
LastModifiedBy="cn=admin,o=novell"
UserInterfaceID="ProtectedResourceID_svhttp_sjh_portal_sjh_portal_
1179933619340"
ProtectedResourceID="ProtectedResourceID_svhttp_sjh_portal_sjh_por tal_1179933619340">
<URLPathList LastModified="4294967295"
LastModifiedBy="String">
<URLPath URLPath="/*" UserInterfaceID="/*"/>
</URLPathList>
<PolicyEnforcementList LastModified="1179949047445" schemaVersion="0.1" LastModifiedBy="cn=admin,o=novell"
RuleCombiningAlgorithm="DenyOverridesWithPriority"
IncludedPolicyCategories="">
<PolicyRef ElementRefType="ExternalWithIDRef"
ExternalDocRef="ou=xpemlPEP,ou=mastercdn,ou=ContentPublisherContai ner,ou=Partition,ou=PartitionsContainer,ou=VCDN_Root,ou=accessMana gerContainer,o=novell:romaContentCollectionXMLDoc"
UserInterfaceID="PolicyID_xpemlPEP_AGAuthorization_1176770874051"
ExternalElementRef="PolicyID_xpemlPEP_AGAuthorization_117677087405
1"/>
</PolicyEnforcementList>
<AuthenticationProcedureRef
AuthProcedureIDRef="authprocedure_Name_Password___Form"/>
</ProtectedResource>
</ProtectedResourceList>
608 Novell Access Manager 3.0 SP1 Administration Guide
This is the duplicate entry that is causing the problem. You need to clear one of the entries from the configuration. If you clear it from the /var/novell/cfgdb/vcdn/config.xml
file, then any change applied in the UI rewrites the information to the config.xml
file.
4 Remove the duplicate entry from the Administration Console server’s configuration store. To do this, you need an LDAP browser.
You can download a free Java-based tool from the Internet, for example the LDAP Browser/
Editor (http://www-unix.mcs.anl.gov/~gawor/ldap/) .
4a Start the LDAP browser, then locate the ag-xxxx that matches the Linux Access Gateway you are having problems with.
The easiest way is to go to the Auditing > General Logging tab of the Access Manager
Administration Console and identify your Linux Access Gateway ID. This ID corresponds to the first four digits of the ag-xxxx in the LDAP browser.
4b Click the ag-xxxx container. You should see CurrentConfig and WorkingConfig containers within this Access Gateway container.
4c Select the CurrentConfig , then the RomaAGConfigurationXMLDoc attribute. Copy and paste the attribute value into any editor. This is the configuration from the LAG.
4d Search for the RomaAGConfigurationXMLDoc attribute string and remove the entire section on one of the hits starting with <ProtectedResourceList> and ending with
</ProtectedResourceList> .
4e Select and save the modified text.
4f Paste the saved text into the RomaAGConfigurationXMLDoc attribute value.
4g Repeat these steps for the RomaAGConfigurationXMLDoc attribute in
WorkingConfig , and remove the duplicate entry that is causing the XML validation errors.
5 Restart tomcat on the Administration Console.
6 Log in to the Administration Console again. Make a small change to the setup and apply that change, and verify that the XML validation error has disappeared.
Troubleshooting XML Validation Errors 609
610 Novell Access Manager 3.0 SP1 Administration Guide
