CA workload Control Center returns internal server error 500

Products

• CA Workload Automation AE

Issue/Introduction

When logging into WCC we get an HTTP 500 internal server error message.

Following error message are find back in CA-wcc.log after starting CA-wcc service.

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | @tomcat-resource <WrapperStartStopAppMain> [] ERROR #EmbIAMAccessProvider # EmbIAMAccessProvider - SafeContextFactory.getSafeContext failed for config: AccessConfig[HostName=autosys01.company.com, Locale=en_US, ServerEnabled=true, AppName=WCC0004, AppCertPath=/app/CA/WorkloadCC/data/config/wcc.pem, ServerAdminID=EiamAdmin, EventLogPath=null, PersistentCachePath=null, RetryConnectInterval=30, RetryPingInterval=30, FullCacheUpdateEnabled=false, CacheUpdateInterval=30], SafeException.getMessage = EE_AUTHFAILED Authentication Failed 

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | [Authenticate Error: Authentication Failed, Identity Attempted: null] 

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | com.ca.eiam.SafeException: EE_AUTHFAILED Authentication Failed 

.... 

.... 

.... 

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | Oct 04, 2016 9:58:00 AM com.ca.wcc.access.resources.BaseAccessProviderFactory getObjectInstance 

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | SEVERE: Access Configuration = AccessConfig[HostName=autosys01.company.com, Locale=en_US, ServerEnabled=true, AppName=WCC0004, AppCertPath=/app/CA/WorkloadCC/data/config/wcc.pem, ServerAdminID=EiamAdmin, EventLogPath=null, PersistentCachePath=null, RetryConnectInterval=30, RetryPingInterval=30, FullCacheUpdateEnabled=false, CacheUpdateInterval=30] 

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | Oct 04, 2016 9:58:00 AM com.ca.wcc.access.resources.BaseAccessProviderFactory getObjectInstance 

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | SEVERE: Error creating EEM access provider. 

 

INFO | jvm 1 | 2016/10/04 09:58:00 | 16 | java.lang.RuntimeException: could not establish the context 

 

Environment

CA Workload Control Center 11.3+

CA Workload Control Center 11.4+

Cause

The problem could be due to multiple reasons. Some of them are - 

• The EEM certificates on the WCC are corrupted. 
• Changes made to the EEM certificates on the server-side. However, the new certificates are not imported into the CA WCC.
• EiamAdmin password changed on the EEM server but not updated in the WCC Configuration

Resolution

REGENERATE EEM CERTIFICATES FOR WCC

Navigate to $CA_WCC_INSTALL_LOCATION/safex directory.

Rename/move the wcc.pem and wcc.key files if exist.

The following command will generate the new wcc.pem and wcc.key files:

./safex –h eem_hostname(s) –u EiamAdmin –p password –f IssueCertificate.xml

Note: Specify all EEM cluster nodes as comma separated values, in case of EEM Multi-Write configuration(eemserver1,eemserver2).

The password (-p) is for EiamAdmin.

For example:

#./safex –h eem_server_hostname(s) –u EiamAdmin –p <EiamAdmin_user_password> –f IssueCertificate.xml

 

Setting Translation file:./safex.tr

Setting back end to "localhost"

 

Setting locale to "en_us"

 

OK:Successfully Authenticated

OK: action[Attach] with ApplicationInstance label[WCC0004]

OK: action[IssueCertificate] for ApplicationInstance label[WCC0004] user[]

OK: action[Detach] from ApplicationInstance label[WCC0004]

OK:Total objects Added 0

OK:Total objects Modified 0

OK:Total objects Removed 0

OK:Total objects Skipped 0

OK:Total objects Exported 0

Navigate to the directory $CA_WCC_INSTALL_LOCATION/data/config 

Rename/move the existing wcc.pem and wcc.key certificates.

Move the newly generated certificate wcc.pem and the key wcc.key files from $CA_WCC_INSTALL_LOCATION/safex to the current location ($CA_WCC_INSTALL_LOCATION/data/config)

Set the file ownership permissions to same as the previous files.

Register the CA WCC to use newly certificates

# ./wcc_config.sh -u ejmcommander -p ejmcommander --eemhostname eem_hostname(s) --eemappid WCC0004 --eemcertname wcc.pem --eemcertkey wcc.key -eemadmin EiamAdmin --eempassword EiamAdmin_user_password

 

Logging in as 'ejmcommander' - SUCCESS

 

EEM server has been changed successfully.

 - FINISHED

The changes will be applied only after restart.

Execute the following command to restart the services.

-----------------------------------------------------------------------

unisrvcntr restart CA-wcc-services

-----------------------------------------------------------------------

As indicated in the command output, Restart the WCC services using the command 'unisrvcntr restart CA-wcc-services'

Additional Information

Update the EiamAdmin Password

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/intelligent-automation/workload-automation-ae-and-workload-control-center/11-3-6-SP8/securing/ca-eem-and-security/update-the-eiamadmin-password.html