Jazz Authorization Server does not recognize user password after a change
We are awaiting an AD to tie jazz authorization server to. In the meantime, we are using the basic user registry.
I have 4 accounts specified - all of which are admins
By way of example I added my self SteeleK - assigned myself a cleartext password
I was able to login without error with this iinformation
When the time came for the 90 day reminder from other system, I proceeded to do the following :
1. went to the JAS server
2. Stopped the server
3. Edited the localuserregistry.xml
4. updated my password against the SteeleK entity
5. restarted the JAS server
Login at the RTC instance no longer recognizes my account and claims invalid password ...
I have the same issue when I adjust other users .. am I missing something here ? It shoudl be pretty straight forward
... log files say "specified principal name SteeleK is not found in the back-end repository" ... when all I did was change the cleartext password
showing 5 of 8
show 3 more comments
|
Accepted answer
|
so its been a bit of a trial and error - the only way I could get it to work effectively is by removing the "account" restarting the server and then adding them back with the new password - a little tedious but if that's the way I have to do it till I get the AD then so be it.
Ralph Schoon selected this answer as the correct answer
|
Your answer
Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.
Comments
Cleartext password e.g.
and where exactly is that tag - I'm merely looking at the localuserregistry.xml file ... there is no such tag in that file.
This is how the file usually looks like. I highlighted the tag.
AFAIK there's no need to encode the password, Liberty will notice a cleartext password and write it back to the user registry XML hashed and with {aes} prefixed, just like it did when you put your original cleartext password in. If you need to update the password remove the {aes} and put the new cleartet password in. After Liberty has startred it should update the file with the hashed value.
Some comments from me: I am aware that some of the customer use Basic User Registry together with LDAP, to be able to manage the "user password expiration" enforced by IT on LDAP.
I have recently seen that the file was corrupted on an image by whatever means, so a backup is suggested.