How to troubleshoot CA PAM Access Page problems
Article ID: 13314
Updated On:
Products
Issue/Introduction
A common problem when using CA PAM is that the Access Page does not load properly. This document will help you troubleshoot this issue.
What do I do when the Access Page does not load, or no access links appear?
Environment
Release: All PAM releases
Component: CAPAMX
Resolution
It is not uncommon when using CA PAM to encounter problems on the Access page. To start with, you must understand that the environment on which CA PAM depends. CA PAM uses Java throughout its code. The Access page is one place and the LDAP browser is another. If Java is not installed, or cannot be loaded then the Access page will not load. You will recognize this as the problem by seeing something like in the picture below.
Please note that this document requires an update, as the GUI has been updated, and OpenJDK is now used. The general procedure still applies.
In order to load the access policies CA PAM needs to run a Java applet. In the picture above you can see that it is attempting to load the necessary applet. The icon will continue to spin for a while and will eventually time out, and no policies will load as a result. This means that the user will not be able to perform their job, as they have no way to connect to the required devices. The picture below shows the message seen after the timeout.
The first thing to ask is "Is Java installed?" This is easy to check. On a Windows system you can go to the Control Panel and search for Java. If it is installed you will find the Java Configuration program. You can also go to Uninstall or Change Program and search for it in the list. You can see in the picture below that it is not installed.
It is also easy to check for the presence of Java on a MAC. Just go to Mac > More Info > System Report > Software and check the list of installed Software.
Once it is determined that Java is not installed you must go to java.com to install it. Only Java from Oracle is supported, so you must use this site as your source. Other Javas, such as from IBM, are not supported. Follow the instructions on this site to install the latest version of Java.
Installing Java does not guarantee that the Access page will appear. The next thing to check is the browser. What browser are you using. At the time of this writing, CA PAM supports IE 9, IE 11 and Firefox(version 45 or later) on Windows. CA PAM also supports MACS(OS X 10.9 or later), with Safari(version 7 or later and Firefox(version 45 or later). The same version of Firefox is also supported for Linux clients, specifically Debian-based distributions (such as Ubuntu, Mint, or Pearl).
Even if you are using a supported browser you may encounter problems if you are using an older version of Java. From time to time the browsers may change their requirements, and problems with Java may be encountered. This has particularly been a problem with IE, which will not load Java if it determines the version to be too old. This is a browser issue and not a CA PAM issue.
There could be other reasons for Java not to load. A great tool for this is java.com/verify. If Java won't load for their verify page then it won't load for CA PAM. Below is a typical message seen when the latest version of Java is installed, and able to load.
You might see messages indicating your version is too old, as per Java, or that it isn't enabled in the browser. You will have to address such issues before CA PAM will be able to function.
Another useful tool when troubleshooting Java issues is the Java Control Panel, which is also the Java Configuration program. Click the About button to view the version.
You can also click the View button on the Java tab. This may show multiple versions, if you installed them. CA PAM may have problems if multiple versions are installed, even if they are not all checked as Enabled. In such circumstances you may have to delete all of the installed Java versions, including any folders that were created on the disk. This last step will have to be done manually. Once all the old versions are gone you may install the version you wish to use.
In some cases it may be necessary to get additional information. The Advanced tab contains many options. Two are Show Console and Enable Tracing. Show Console will cause the Java Console Log to be opened when Java is loaded. You can interact with this console, even changing the Logging Level. Support may ask to see this log at times, which would merely required copying out of the console and pasting into the ticket. The Enable Tracing can be used to turn on Java tracing, which will be useful if the console does not stay open long enough to capture or if you can't predict when the problem may occur. The file name that is created starts with "plugin", followed by a long string of numbers which is a timestamp and ends with ".trace".
The CA PAM client was created to address the issues above.
Feedback
