PAM Windows Custom Connector test connection fails with "PAM-UI-1437"

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

After using the Deploy the Custom Connector Software documentation page to configure the Privileged Access Manager (PAM) Custom Connector on a Windows server, the test connection fails with the following error.

Error: PAM-UI-1437: The Custom Connector server is inaccessible or its configuration is invalid.

In the Custom Connector's catalina.yyyy-mm-dd.log, the following error is observed at the time of the test connection.

SEVERE [https-jsse-nio-#-exec-#] com.ca.pam.extensions.framework.util.ExtensionAuthenticationFilter.validateAuthToken [###-###-###-###-###] [PAMTargetConnector] Authorization header cannot be decrypted: 
    org.jose4j.lang.InvalidKeyException: The key must not be null.

Environment

• Product: Privileged Access Manager (PAM) 4.2.x and 4.3.x
• Component: Custom Connector
• OS: Windows

Cause

The "key must not be null" will occur when the extension_framework.properties has one or more of the following issues.

• The extension.keystore.file value is incorrectly formatted
• The extension.keystore.file value points to a keystore that is corrupted or in a different location
• The extension.encryption.pwd value contains an incorrect or unencrypted password
• The Tomcat services were started with a user that lacked proper permissions to all Custom Connector files

Resolution

Follow these steps to resolve the issue:

1. Check Directory Formatting: Ensure double backslashes are used when specifying the Windows directory for the extension.keystore.file value.
   • Example: extension.keystore.file=C:\\Program Files\\Apache Software Foundation\\Tomcat\\tcf\\ExampleKeyStore
2. Verify the Keystore Location: Ensure that the extension.keystore.file value points to the correct directory and keystore file name
3. Manually Recreate Keystore: Regenerate the encryption key in the PAM UI and recreate the keystore to ensure file integrity
   1. Open the command prompt as an administrator.
   2. Navigate to the configTCF directory.
   3. Run the configTCF command, specifying the new encryption key.
      • Example: .\configTCF.cmd -Dcommand=createKeyStore -DkeyStoreFile="%CATALINA_HOME%\tcf\ExampleKeyStore" -DkeyStorePWD=ExampleKeystorePassword -Dkey=ex/ampleEncryptionKey=
   4. Update the extension_framework.properties file with the new keystore file and encrypted password from the output.
4. Restart Services: Restart the Tomcat service using a local administrator account to ensure sufficient permissions.