Environment
NetIQ Access Manager 3.2
Problems occur after upgrade from NetIQ Access Manager 3.1
Problem only exists administering Access Gateway configuration
Problems occur after upgrade from NetIQ Access Manager 3.1
Problem only exists administering Access Gateway configuration
Situation
Access Manager 3.1 Support Pack 4 setup and working fine. After migrating all components (Admin Console, Identity Server and Linux Access Gateways) to Access Manager 3.2, the system continued to work fine ie. all Access Gateway protected resources were accessible after the user authentication at the Identity Server. However, it was noted that as the admin clicked through the Access Gateway configuration, the following message would randonly be reported at the browser:
“Error connecting to the data store”
“Error connecting to the data store”
Resolution
Modify the /opt/novell/nam/adminconsole/conf/tomcat7.conf file on the Admin Console server to include the following JAVA option
JAVA_OPTS="${JAVA_OPTS} -Djsse.enableCBCProtection=false"
The snippet of the bottom of this file with this workaround looks like:
JAVA_OPTS="${JAVA_OPTS} -Dsun.net.http.allowRestrictedHeaders=true"
JAVA_OPTS="${JAVA_OPTS} -Dsun.security.ssl.allowUnsafeRenegotiation=true"
JAVA_OPTS="${JAVA_OPTS} -Djsse.enableCBCProtection=false"
#JAVA_OPTS="${JAVA_OPTS} -Djava.endorsed.dirs=${CATALINA_BASE}/endorsed"
JAVA_ENDORSED_DIRS=${CATALINA_BASE}/endorsed
JAVA_OPTS="${JAVA_OPTS} -Djsse.enableCBCProtection=false"
The snippet of the bottom of this file with this workaround looks like:
JAVA_OPTS="${JAVA_OPTS} -Dsun.net.http.allowRestrictedHeaders=true"
JAVA_OPTS="${JAVA_OPTS} -Dsun.security.ssl.allowUnsafeRenegotiation=true"
JAVA_OPTS="${JAVA_OPTS} -Djsse.enableCBCProtection=false"
#JAVA_OPTS="${JAVA_OPTS} -Djava.endorsed.dirs=${CATALINA_BASE}/endorsed"
JAVA_ENDORSED_DIRS=${CATALINA_BASE}/endorsed
Cause
There is an issue with the jsse module from the latest JDK that seems to have triggered this performance issue.To We can also workaround the issue by replacing the jsse.jar from the latest JDK with the one from the previous
JDK 1.6.0_26 64 bit JDK ie. copy the jdk1.6.0_26/jre/lib/jsse.jar to jdk1.6.0_30/jre/lib.