Re: Can no longer log onto CSPC running v2.7 using my Active Directory credentials

iprestige-ttraan · ‎08-17-2020

Hi,

As of last week, I am no longer able to log onto the collector (HTTPS) using my Active Directory credentials which has been working for many years. Upon entering my credentials, it eventually times out. We have multiple collectors deployed and am able to log onto the other one using the same account. However, the one that is having issues, is the only one running 2.7.

I am able to log on via SSH using collectorlogin, root and admin. However, I am getting the following error when logging in with admin:

********************************************************************************
--------------------------------------------------------------------------------

CSP Collector

Please use below url to access CSP Collector appliance GUI
IPv4 URL : https://10.180.126.172:8001

--------------------------------------------------------------------------------
********************************************************************************
Last login: Mon Aug 17 21:18:10 2020 from 10.188.25.145
#########################################################################
# This system is hardened and for the use of authorized users only. #
# Individuals using this computer system without authority, or in #
# excess of their authority, are subject to having all of their #
# activities on this system monitored and recorded by system #
# personnel. #
# #
# In the course of monitoring individuals improperly using this #
# system, or in the course of system maintenance, the activities #
# of authorized users may also be monitored. #
# #
# Anyone using this system expressly consents to such monitoring #
# and is advised that if such monitoring reveals possible #
# evidence of criminal activity, system personnel may provide the #
# evidence of such monitoring to law enforcement officials. #
#########################################################################
java.net.ConnectException: Connection refused (Connection refused)
at java.net.PlainSocketImpl.socketConnect(Native Method)
at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
at java.net.Socket.connect(Socket.java:589)
at java.net.Socket.connect(Socket.java:538)
at java.net.Socket.<init>(Socket.java:434)
at java.net.Socket.<init>(Socket.java:244)
at com.cisco.ca.ss.lcm.adminshell.client.ShellClient.main(ShellClient.java:51)
Error occured: could not connect to the database server.
Please make sure mysql database server is up and running.

Looking for guidance and checking to see whether other folks are experiencing this same issue.

Thanks,

Toan

Justin Sprake · ‎08-20-2020

So it looks like the Database was unable to initialize for this particular CSPC which would impact the WebUI Services. I would suspect that this particular collector started the upgrade process but for some reason did not complete; it may be worth applying the 2.8 patch for both JEOS and Service Pack. Since you have Collectorlogin and Root access you should be able to complete both patch apply processes. The following documentation outlines these steps:

https://www.cisco.com/c/dam/en/us/support/docs/cloud-systems-management/common-services-platform-collector-cspc/CSPC-Upgrade-Guide.pdf

Since the CSPC runs on top of CentOS, once you land at the collectorlogin/root prompt you've more options available to navigate the system and execute installs and file transfers. If you reapply the latest 2.7 JEOS patch, you may find that the Adminshell and CSPCUI services are restored.

I noticed the URL to the 2.7 patch file is out of date, but the files are still available via Cisco Software download:

https://software.cisco.com/download/home/286312935/type/286312958/release/2.7.4.11

iprestige-ttraan · ‎09-02-2020

Hi Justin,

I've successfully upgraded the CSPC to 2.8.1.4 and I am still unable to log no with my Active Directory credentials. However, I'm now able to access the collector with the admin account via SSH. Any guidance?

Justin Sprake · ‎09-02-2020

Now that the upgrade has been completed, are you able to access the WebUI (username: admin) and update the remote authentication settings? It may be worth setting those details again. If re-initializing these settings does not resolve the issue you can also set up a TCPdump from the root CLI account to ensure bidirectional traffic is established, or confirm with your AD logs what, if anything, the CSPC is able to transmit across.

iprestige-ttraan · ‎09-02-2020

Hi Justin,
Unfortunately, I am unable to access the WebUI due to this Active Directory issue. Is there a way to update this through CLI?