Catalog fails to communicate with SDM to view Categories after SSO enabled

Products

• CA Service Management - Service Desk Manager
• CA Service Catalog

Issue/Introduction

SDM uses SSO for authentication (works as expected) Service Catalog, if we enable NTLM authentication for SSO, will log in as expected. However after that, communication to SDM from SC fails whenever SC is recycled.  It will not retrieve info for the request categories in a form.  One must first run a test connection for SDM from Catalog before attempting to access Category content

Environment

Release : 17.2 and higher

Component : SDM - Catalog

Cause

In the view.log, one may find:

20XX/XX/XX XX.XX.XX.XXX ERROR [https-jsse-nio-8443-exec-20] [FetchSDMIncidentAreasPlugin] Error occurred while getting incident areas; nested exception is: 
 javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

20XX/XX/XX XX.XX.XX.XXX ERROR [https-jsse-nio-8443-exec-20] [CatalogHostService] Unexpected exception while calling plugin:com.sun.proxy.$Proxy131

The cause is the certificates used by the OpenJDK specification for Catalog need to be updated with the SDM SSL certificate.  Telltale sign is the " unable to find valid certification path to requested target" message in the view.log against "FetchSDMIncidentAreasPlugin"

Resolution

Access SDM Server URL and export the browser certificate as a DER encoded binary X.509 cert file.  File "sdmcert.cer".

On the catalog server, locate the "cacerts" keystore file located in the Catalog install folder's embedded/jdk/lib/security directory and used the keytool utility to import the above sdmcert file into the "cacerts" keystore.

keytool -import -trustcacerts -keystore cacerts - storepass changeit -noprompt -alias sdmcert -file c:\sdmcert.cer

viewService.conf needs to be edited (Catalog install dir/view/conf and the following two lines were changed:

wrapper.java.additional.10=-Djavax.net.ssl.trustStore="C:\Program Files\CA\Catalog\embedded\jdk\lib\security\cacert"
wrapper.java.additional.10=-Djavax.net.ssl.trustPass=changeit

With the above changes, recycling Catalog no longer requires a "test connection" for SDM from Catalog.  One can go right into Catalog and access SDM categories in the offering, correcting the issue.