Manager user not able to log into application (Manager.sh) to update policies

Products

• CA API Gateway

Issue/Introduction

We are unable to log into the Manager.sh application to import policies.

When we present the username (manager) and password, we get a username or password is incorrect error. We have tried to update the password using the gateway.sh script, but it fails to connect to the database. We installed the application using the embedded database (derby) so we are not using the MySQL database. Not sure what else we can try and really need to get the schema updated

Environment

CA API Gateway 11.1.x , Software Form Factor

Apache Derby Database, derby-10.15.2.0

Resolution

Step 1 — Stop the gateway
Login to the Gateway as ‘root’ user and stop the gateway process like following:

/opt/SecureSpan/Gateway/runtime/bin/gateway.sh stop

 

Step 2 — Generate a SHA-512 hash of your new password

openssl passwd -6 'YourNewPassword'
# output: $6$<salt>$<hash>   ← this string will be used on step 4.

 

Step 3 — Open Derby with ij and run the UPDATE
To get to the ‘ij’ terminal, run the following (all together) on to your shell session with gateway

DERBY_HOME=/opt/SecureSpan/Gateway/node/default/var/db
DERBY_JARS=/opt/SecureSpan/Gateway/runtime/lib/derby-10.15.2.0.jar:/opt/SecureSpan/Gateway/runtime/lib/derbytools-10.15.2.0.jar:/opt/SecureSpan/Gateway/runtime/lib/derbyshared-10.15.2.0.jar

$(grep -m1 '^node\.java\.path' /opt/SecureSpan/Gateway/node/default/etc/conf/node.properties | sed 's/^[^=]*=//' | tr -d ' ')/bin/java -Dderby.system.home=$DERBY_HOME -cp $DERBY_JARS org.apache.derby.tools.ij

 

Note: Confirm if your JAVA_HOME is set like /bin/java , or else change as your env requirements (ie: /usr/local/jdk-17/bin/java)

Step 4 — Updating the Policy Manager Password
Run the following commands inside the ‘ij>’ prompt:

connect 'jdbc:derby:/opt/SecureSpan/Gateway/node/default/var/db/ssgdb;user=gateway';

Before executing, replace the hash with your value from step 2:

UPDATE gateway.internal_user
   SET password='$6$<salt>$<hash>',
       password_expiry=BIGINT({fn TIMESTAMPDIFF(SQL_TSI_SECOND, TIMESTAMP('1970-01-01 00:00:00'), {fn TIMESTAMPADD(SQL_TSI_DAY, 90, CURRENT_TIMESTAMP)})}) * 1000,
       change_password=0,
       version=version+1
   WHERE goid=X'00000000000000000000000000000003';

exit;

Step 5 — Restart the gateway

/opt/SecureSpan/Gateway/runtime/bin/gateway.sh start