Can't manually login after logout the SSO URL
Article ID: 381320
Updated On:
Products
Issue/Introduction
When Service Desk is configured SSO via IIS and Service Desk access type is configured as allow external authentication and validation type is EEM
users can SSO to Service Desk web interface no problem. However, when they click on logout button and try to log back in manually they get error "AHD04042: Login failed for userid(the-user-id); login timed out
Environment
CA Service Desk Manager 17.3 and higher
Resolution
Please check the NX.env file for EIAM settings like
@NX_EIAM_HOSTNAME=<server-name>
@NX_USE_EIAM_AUTHENTICATION=Yes
@NX_EIAM_CERT_PASSWORD=dUJBssjrYZc3hFRYHe0xrzHtrgGvtAFzP23NKCniYMrmOMHbDqOIiQCOSAq/Xv5Q
@NX_EIAM_APPINST_LABEL=
@NX_USE_EIAM_ARTIFACT=Yes
If the <server-name> is empty, or the wrong EIAM server name, you will see this issue. In that case, please login to Service Desk web interface as an administrator and (re)install this option in Administration-->Options Manager-->Security and then restart Service Desk service and test.
If it still does not work, another thing to check is ability to login to the EEM UI directly. If you try this and see errors like this:
EE_AUTHFAILED Eche d'authentification
ISE_BACKENDDOWN Serveur d'arrière-plan arrëté
Translation:
EE_AUTHFAILED Authentication failed
ISE_BACKENDDOWN Backend server stopped
You should check to see if the EEM certificates might have expired. To do this, locate your "rootcert.cer" file in the C:\Program Files\CA\SC\iTechnology folder. Double click on this file and you will see a window with the certificate details:
If the expiration date you see there is alerady passed, for example:
then the certificate is expired and must be regenerated. To regenerate the certificates, followed the instructions here
(It is very important before trying this that you make a backup of your EEM folders and in particular the certificate (*.cer) and key (*key) files before generating the new certificates. If you back up folders C:\Program Files\CA\SC\iTechnology, and C:\Program Files\CA\SC\EmbeddedEntitlementsManager, that should be sufficient.)
After generating the new certificates, a complete restart of EEM, Service Desk, and Service Catalog will be required.
Additional Information
Feedback
