Environment
Novell BorderManager 3.9 Support Pack 1
Novell BorderManager 3.9
Novell BorderManager 3.9
Situation
When attempting to use BorderManager Proxy, the user receives an error message: HTTP 403 access denied - Invalid Authentication configuration.
Resolution
Steps to resolve issue:
The problem was a corrupt SSL Certificate (SSL CertificateIP in this case) that was recreated by pkidiag. Once the SSL Certificate was recreated and selected, the HTTP 403 access denied - Invalid Authentication configuration was no longer a problem.
- In iManager, go to Proxy Services. Select the BoderManager 3.9 server and choose OK.
- Click on HTTP under Authentication Context.
- Verify that the SSL Listening Port is set and does not conflict with the Apache Web server or any other SSL listener (the default port is 444).
- Verify there is a certificate selected in the Key ID. This can be any certificate in the drop down list, but is usually either SSL CertificateIP or SSL SertificateDNS.
- Under the Context Tab, there should be a list of Contexts where the users are located. If there are entries, verify that they are correct.
- Apply the changes and test. If Authentication still fails, continue to the next step.
- Unload BorderManager services.
- Run PKIDIAG, authenticate with a valid admin ID.
- Select option 4, verify it reads "Fix Mode."
- Select option 6, verify it reads "Always Rename and Create."
- Select option 0, run fix.
- Run pkidiag again and choose options 4 then 0.
- Continue running this until the summary returns 0 problems found, 0 problems fixed.
- Restart BorderManager on the server.
- In iManager, go to Proxy Services.
- Select the BM 3.9 server and choose OK.
- Click on HTTP under Authentication Context.
- Select a certificate in the Key ID drop down (the certificate previously selected).
- Click OK after selecting a certificate.
- Apply changes.
- Retest user attempting to go through Proxy.
The problem was a corrupt SSL Certificate (SSL CertificateIP in this case) that was recreated by pkidiag. Once the SSL Certificate was recreated and selected, the HTTP 403 access denied - Invalid Authentication configuration was no longer a problem.