000037409 - Remote collection agents fail after installing JRE/JDK 1.7.0_191+ or 1.8.0_181+ in RSA Identity Governance & Lifecycle

Document created by RSA Customer Support Employee on Apr 30, 2019•Last modified by RSA Customer Support Employee on Apr 18, 2020
Version 26Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000037409
Applies ToRSA Product Set: RSA Identity Governance & Lifecycle
RSA Version/Condition:  7.1.0, 7.1.1
 
IssueRemote collection agents fail with the latest Java Runtime Environments (JREs) and/or Java Development  Kits (JDKs) starting with versions 1.7.0_191 (or above) or 1.8.0_181 (or above). 

The  aveksaAgent.log file (/home/{remoteagentuser}/AveksaAgent/logs/aveksaAgent.log) contains the following errors:

com.aveksa.common.ConfigException: java.lang.NullPointerException
   at com.aveksa.client.datacollector.framework.DataCollectorManager.initCollector(DataCollectorManager.java:627)
   at com.aveksa.client.datacollector.framework.DataCollectorManager.performQuery(DataCollectorManager.java:562)
   at com.aveksa.client.component.collector.DefaultCollectorManager.actUpon(DefaultCollectorManager.java:480)
   at com.aveksa.client.component.collector.DefaultCollectorManager.handle(DefaultCollectorManager.java:120)
   at com.aveksa.client.component.event.DefaultEventManager.handle(DefaultEventManager.java:60)
   at com.aveksa.client.datacollector.framework.SimpleEventSource.notifyListeners(SimpleEventSource.java:67)
   at com.aveksa.client.component.communication.DefaultCommunicationManager.notifyEvent(DefaultCommunicationManager.java:377)
   at com.aveksa.client.component.communication.ChangeListHandler.applyChanges(ChangeListHandler.java:364)
   at com.aveksa.client.component.communication.ChangeListHandler.access$300(ChangeListHandler.java:58)
   at com.aveksa.client.component.communication.ChangeListHandler$ChangeApplyingRunnable.run(ChangeListHandler.java:275)
   at java.lang.Thread.run(Unknown Source)
Caused by: java.lang.NullPointerException
   at com.aveksa.client.datacollector.collectors.accountdatacollectors.AccountDataCollector.getReaderClassName(AccountDataCollector.java:226)
   at com.aveksa.client.datacollector.collectors.accountdatacollectors.AccountDataCollector.configureReader(AccountDataCollector.java:183)
   at com.aveksa.client.datacollector.collectors.accountdatacollectors.AccountDataCollector.init(AccountDataCollector.java:159)
   at com.aveksa.client.datacollector.framework.DataCollectorManager.initCollector(DataCollectorManager.java:621)
   ... 10 more


Other errors that have been seen in the aveksaAgent.log file (/home/{remoteagentuser}/AveksaAgent/logs/aveksaAgent.log) associated with this issue are:




java.lang.NoClassDefFoundError: com/aveksa/collector/accountdata/LdapAccountDataReaderConfig


and/or




java.lang.NoClassDefFoundError: com/aveksa/collector/db/util/DBPerformQueryCallbacks

 
CauseLater versions of Java have added more validations when verifying certificates.This problem occurs when validating the RSA Identity Governance & Lifecycle internal server and client certificates that do not meet the new criteria.

This change can also affect collections where certificate validation of the end point certificates is done. Please see RSA Knowledge Base Article 000036712 - LDAP Collector reports "No subject alternative names matching IP address n.n.n.n found" in RSA Identity Governance & Lifecycle  for more information.
 
ResolutionThe following RSA Identity Governance & Lifecycle versions and patches generate certificates that meet the new critiera for JRE and JDK environments.
  • RSA Identity Governance & Lifecycle 7.1.0 P07
  • RSA Identity Governance & Lifecycle 7.1.1 P01
  • RSA Identity Governance & Lifecycle 7.2
 After installing one of the above patches, the next step is to generate and download new RSA Identity Governance & Lifecycle server and client internal certificates. Because of the patch, these newly generated certificates will be of the correct format expected by the latest JRE and JDK versions.

Steps:



  1. Download and apply patch 7.1.0 P07 or 7.1.1 P01 depending on your product version.
  2. Regenerate the server and client certificates. The server certificate resides on the RSA Identity Governance & Lifecycle server. The client certificate resides on the remote agent server. The client certificate needs to be copied to each remote agent system.

IMPORTANT: If you use AFX, the AFX Server client keystore will also need to be updated.



  1. In the RSA Identity Governance & Lifecycle user interface, go to Admin > System > Security.
  2. Click on Change Certificate Store to generate a new server certificate (server.keystore) in the new format.

User-added image


  1. Next to Server Certificate Store for Agent SSL Connections, click Download. This will download the newly generated server.keystore.
  2. Copy the new server.keystore to /home/oracle/keystore.
  3. Restart RSA Identity Governance & Lifecycle as the oracle user:


acm restart


  1. In the RSA Identity Governance & Lifecycle  user interface, go to Collectors > Agents and click Remote Agent.

This needs to be done for each Remote Agent.



  1. Click Change Certificate to generate a new client certificate in the updated format (and to work with the new server certificate.)

User-added image


  1. Click Download Agent, which downloads a file called AveksaAgent.zip.
  2. Unzip the AveksaAgent.zip and copy the new client.keystore to /home/{remoteagentuser}/AveksaAgent/conf (where the remote agent(s) are installed)
  3. Restart the remote agent(s) as the remote agent user.

If you use AFX: 


  1. In the RSA Identity Governance & Lifecycle user interface, go to AFX > Servers and click on the AFX Server. (Note: this needs to be done for each AFX Server.)
  2. Click Change Certificate to generate a new client certificate in the updated format (and to work with the new server certificate.)
  3. Click on Download Keystore which downloads the client.keystore.
  4. Copy the new client.keystore to $/home/{afxuser}/AFX/esb/conf.
  5. Restart AFX as the afx user:



afx restart

WorkaroundUse a 1.7 Java Runtime Environment (JRE) and/or 1.7 Java Development Kit (JDK) prior to 1.7.0_191. Do not use version 1.8.
 

Attachments

    Outcomes