Integrating PAM 4.4 CP04 with CA EEM in Failover Cluster Configuration

Products

• CA Process Automation Base

Issue/Introduction

When converting a single CA EEM instance to a cluster/failover configuration, the existing CA Process Automation (PAM) integration may fail.

Common symptoms include:

• PAM login resulting in a blank screen.
• Errors in PAM\wildfly\standalone\log\c2o.log indicating authentication failures with EEM.
• Error message: com.ca.eiam.SafeException: EE_AUTHFAILED Authentication Failed.

Environment

Process Automation (PAM) 4.4 CP04 and later

EEM 12.6.x and later in failover/cluster

Cause

When EEM is converted from a single instance to a cluster, the existing application certificates (e.g., PAM.p12) on the PAM side become invalid due to the certificate changes on the EEM side. Currently, there is no manual utility to re-generate these certificates at the CP04 level without a reinstall/repair action.

Resolution

Prerequisite

Ensure the CA EEM cluster (secondary node) is already configured and functional.

Note: Take backup of <Install_Directory>/PAM/wildfly/standalone/.config/OasisConfig.properties prior the following steps: 

1. Re-run the PAM 4.4 CP04 Installer:
   - Launch the CP04 installer. It will detect the existing installation and present the EEM configuration wizard.
   - In the **EEM Server** setting, enter both EEM nodes separated by a **semicolon** (e.g., eem-node1;eem-node2).
   - Select the option to **Register Application with CA EEM**.
   - Complete the installation/wizard process.
   - **Do not start the PAM services yet.**

2. Manual Configuration Update:
   - Navigate to the OasisConfig.properties file.
   - Locate the property oasis.eem.backend.server.location.
   - Manually add the second EEM server to this line, ensuring they are separated by a semicolon.
   - Example: oasis.eem.backend.server.location=eem-node1;eem-node2
   - Save the changes to the file.

3. Finalize:
   - Start the CA Process Automation services.
   - Verify that you can log in and that all contacts/identities are correctly listed.

 

Additional Information

Process Automation: Configuring to use with EEM Failover /replication