DocTeger

OpenSSO Technical Information

And a Spoonful of Music

To Make the Medicine Go Down

Stopping and Starting an External Configuration Data Store is Björn Again

Thanks to OpenSSO members Christopher and Michel for this information.

OpenSSO uses an LDAP server for persistence of its configuration data so the LDAP server that contains this configuration data must be available when OpenSSO is running. After a default installation OpenDS, which is embedded with OpenSSO, will stop and start as OpenSSO does. If OpenSSO is installed pointing to an instance of Directory Server for its configuration data, Directory Server needs to be stopped and started on its own. The best way to do this is to stop the underlying OpenSSO web container first and Directory Server second - reversing the order for the imminent restart. This insures that the configuration data is always available for the OpenSSO web application.

That said, I've noticed a few people (externally and internally) asking about an Invalid Domain - No such Organization found error that is displayed when attempting to log in to the console using the default URL (http://web-server-host:port/opensso/UI/Login) after restarting an instance of Directory Server 5.2 configured as the OpenSSO configuration data store. If you see this error message, do the following:

1. Login to the OpenSSO console at http://web-server-host:port/opensso/UI/Login?org=LDAP-DN-root.
2. Under the Access Control tab, click the / (Top-level Realm).
3. Add another host name to the Realm/DNS Alias property of the / (Top-level Realm) and click Save.
The information will be removed so MacGuffin text is fine.
4. Restart the deployment as previously detailed.
5. Login to the OpenSSO console using the default URL and remove the host name you just added.

This workaround forces OpenSSO to export the Realm/DNS Alias values to the external Directory Server. The following search returns zero results before the workaround and should return one result after it.

SRCH base="ou=services,DN" scope=2 filter="(|(&(objectClass=sunRealmService)(&(|(sunxmlkeyvalue=sunidentityrepositoryservice-sunOrganizationAliases=hostname.site.com)(sunxmlkeyvalue=sunOrganizationAliases=hostname.site.com))))(&(objectClass=sunServiceComponent)(&(|(sunxmlkeyvalue=sunidentityrepositoryservice-sunOrganizationAliases=hostname.site.com)(sunxmlkeyvalue=sunOrganizationAliases=hostname.site.com)))))" attrs="o"

While you're waiting for the restart, enjoy Stop, the ABBA-esque version of the Erasure song by Björn Again.

Posted at 10:30AM Dec 01, 2008 by Michael Teger in Sun  |  Comments[2]