Resolving RoleDefGenerator JSAFE_InvalidUseException - Identity Manager

Products

• CA Identity Manager
• CA Identity Suite

Issue/Introduction

This article addresses the com.ca.iam.model.IAMCommunicationException and associated java.lang.NoClassDefFoundError: com/rsa/jsafe/crypto/JSAFE_InvalidUseException errors encountered when executing the RoleDefGenerator.bat or RoleDefGenerator.sh tools in CA Identity Manager. These errors typically indicate a failure in TLS communication between the tool and the server, often caused by certificate mismatches when "localhost" is used in the connection command.

Environment

Identity Manager 14.x

Cause

The JSAFE_InvalidUseException occurs because the RoleDefGenerator tool attempts to establish a TLS-secured connection.

If the command utilizes "localhost" instead of the fully qualified hostname defined in the server's SSL/TLS certificate, the security handshake fails, triggering the NoClassDefFoundError during the initialization of the JSAFE cryptographic library.

Resolution

To resolve this communication error, use one of the following methods to correctly authenticate the connection:

1. Use the Actual Hostname: Instead of using "localhost" in your command, use the fully qualified domain name (FQDN) that matches the server's SSL certificate. Example:

   RoleDefGenerator.bat -d im -h myhostname.here.com -u imuser -l

2. Disable TLS Communication: If you do not require TLS communication for this operation, use the -n flag to bypass the secure connection requirement. Example:

   RoleDefGenerator.bat -d im -h myhostname.here.com -u imuser -l -n

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.