CF update fails and the first locator (locator/0) fails when trying to set up WAN replication across foundations.

Products

• VMware Tanzu Gemfire

Issue/Introduction

The update service fails as soon as "cf update" starts updating the first VM in the service instance with the exception below:

Exception in thread "main" org.apache.geode.security.AuthenticationFailedException: SecurityManager: gateway_sender_Z2oXZqqfFTdI2ORw6Gge5g has no valid roles
	at io.pivotal.gemfire.security.model.SecurityModel.validateAllUsersHaveRoles(SecurityModel.java:47)
	at io.pivotal.gemfire.security.SecurityModelFactory.createModelFromFile(SecurityModelFactory.java:32)
	at io.pivotal.gemfire.security.SecurityManager.init(SecurityManager.java:33)
	at org.apache.geode.internal.security.CallbackInstantiator.getSecurityManager(CallbackInstantiator.java:67)
	at org.apache.geode.internal.security.SecurityServiceFactory.create(SecurityServiceFactory.java:60)
	at org.apache.geode.distributed.internal.InternalDistributedSystem.initialize(InternalDistributedSystem.java:652)
	at org.apache.geode.distributed.internal.InternalDistributedSystem.access$200(InternalDistributedSystem.java:135)
	at org.apache.geode.distributed.internal.InternalDistributedSystem$Builder.build(InternalDistributedSystem.java:3000)
	at org.apache.geode.distributed.internal.InternalDistributedSystem.connectInternal(InternalDistributedSystem.java:251)
	at org.apache.geode.distributed.DistributedSystem.connect(DistributedSystem.java:158)
	at org.apache.geode.distributed.internal.InternalLocator.startDistributedSystem(InternalLocator.java:700)
	at org.apache.geode.distributed.internal.InternalLocator.startLocator(InternalLocator.java:374)
	at org.apache.geode.distributed.LocatorLauncher.start(LocatorLauncher.java:679)
	at org.apache.geode.distributed.LocatorLauncher.run(LocatorLauncher.java:587)

This occurs when following the procedure below:

• LDAP is setup (which requires updates in both the Tanzu Application Service Tile and the Tanzu-GemFire Tile) as described in https://docs.pivotal.io/p-cloud-cache/1-9/UAA-config.html
• WAN setup is done following this document: https://docs.pivotal.io/p-cloud-cache/1-10/WAN-bi-TLS-setup.html

Environment

Product Version: 1.10

Resolution

This issue is resolved in versions 1.10.2, 1.11.1, and newer.