If you continue to experience issues, there are two sides to check to see where the disconnect is occuring. First, we need to make sure PAM is dropping the right message inside the ActiveMQ.
On the PAMSC endpoint, shutdown the CAPAMSC endpoint and ensure all AgentManager services are killed. If they are not after running 'secons -S' then a 'kill -9 PID' would suffice too:
# /opt/CA/AccessControl/bin/secons -S
Ensure all daemons are down:
# /opt/CA/AccessControl/bin/issec
Reproduce the issue inside the CA PAM console. You should expect the terminal to hang. Once that is done, go to your ActiveMQ server (i.e., https://ActiveMQ_server_here:8161/) and login with your credentials used you set during the PAMSC Management Server or ActiveMQ installation. The communication key is what is needed for the password. Once you login to the ActiveMQ, you want to click "Manage ActiveMQ broker" -> "Queues" -> "ac_server_to_endpoint" -> "View Consumers" and you should see a message like this:
So we can confirm that CA PAM is dropping a message inside the ActiveMQ for the AgentManager service. Now we need to check the PAMSC endpoint to ensure we are reading the right data inside that specific queue.
# vi /opt/CA/AccessControl/data/PUPMAgent/PUPMAgent_Trace.log:
23-Mar-2018 12:40:38: _ProcessPreLogonNotification> Received prelogon integration message. ACID="PAM_ENDP_INTEGR"
23-Mar-2018 12:40:38: _ProcessPreLogonNotification> Integration message correlation ID = "LINGO:5"
23-Mar-2018 12:40:38: _ProcessPreLogonNotification> ACCOUNT_NAME --> "Bob" was received.
23-Mar-2018 12:40:38: _ProcessPreLogonNotification> ORIG_ACCOUNT_NAME --> "super" was received.
23-Mar-2018 12:40:38: _ProcessPreLogonNotification> CHECKOUT_HOST_NAME --> "XX.XX.XX.XX" was received.
23-Mar-2018 12:40:38: _ProcessPreLogonNotification> ORIG_ACCOUNT_REPOSITORY --> "RDB" was received.
23-Mar-2018 12:40:38: _ProcessPreLogonNotification> IS_ORIG_ACCOUNT_NATIVE_USER --> "YES" was received.
You should be able to see a PreLoginNotification event inside the PUPMAgent_Trace.log.
If you don't see this, then perform a seosd.trace and we need to see if there are any PAMLOGIN events happening. PAM needs to be setup correctly in order for this integration to be successful.
# /opt/CA/AccessControl/bin/secons -tc -t+
(clears and then starts the trace)
2. Reproduce the warning or denial message.
# /opt/CA/AccessControl/bin/secons -t-
(stops the trace)
# cat /opt/CA/AccessControl/log/seosd.trace | grep -i pamlogin
You should see 'PAMLOGIN' events here. If you do not, then PAMSC is not setup for using the PAM stack module. The Login Integration relies solely on PAM for authentication and authorization.