[Date Prev] [Date Next] [Prev in Thread] [Next in Thread] [Date Index] [Thread Index]

Re: What is locking my account?

Thank you Keith, good to know.

1. We’re not windows.

2. We don’t have more than one server defined in the mid-tier

I rather thing that it’s related to a ARS bug which attacks when we use our ARF Plugin.


Thomas

On Mar 20, 2018, at 5:05 PM, spearmint.lane@gmail.com wrote:

I haven't followed this whole thread, so not sure if this was mentioned. We had a problem in the past where if you had more than one AR server defined in the mid-tier, then anytime you try to login it attempts to log into each AR server defined. So if you have three AR servers defined, and your Windows system is set to lock after three bad attempts, then just one incorrect password when trying to log in will lock you out. 

Regards,
Keith

On Tue, Mar 20, 2018 at 6:14 AM Thomas Miskiewicz <tmiskiew@gmail.com> wrote:
Unfortunately it’s still locking.

I enabled all kinds of debugs and see this:

Di Mär 20 10:41:19.086 2018 Preparing context to be sent to pluginserver -  User : NULL, sessionId : 0, authGuid : NULL, cacheId : 9279, threadId : 366
360393 Di Mär 20 10:41:19.099 2018 Preparing context to be sent to pluginserver -  User : NULL, sessionId : 0, authGuid : NULL, cacheId : 9280, threadId : 366
360394 Di Mär 20 10:41:19.109 2018 Preparing context to be sent to pluginserver -  User : NULL, sessionId : 0, authGuid : NULL, cacheId : 9281, threadId : 366
360395 Di Mär 20 10:41:19.118 2018 Preparing context to be sent to pluginserver -  User : NULL, sessionId : 0, authGuid : NULL, cacheId : 9282, threadId : 366
360396 Di Mär 20 10:41:33.252 2018 <ESCL> <TID: 0000000320> <RPC ID: 0000447731> <Queue: Fast      > <Client-RPC: 390620   > <USER: Remedy Application Service (Pool 1)                 > <Overlay-Group: 1         > /* Di Mär 20 2018 10:41:33.2520 */ Escalation Trace Log -- ON (AR Server 9.1.04 201711272256)
360397 Di Mär 20 10:41:33.418 2018 <ESCL> <TID: 0000000320> <RPC ID: 0000447731> <Queue: Fast      > <Client-RPC: 390620   > <USER: Remedy Application Service (Pool 1)                 > <Overlay-Group: 1         > /* Di Mär 20 2018 10:41:33.4180 */ Escalation Trace Log -- ON (AR Server 9.1.04 201711272256)
360398 Di Mär 20 10:41:33.650 2018 Preparing context to be sent to pluginserver -  User : NULL, sessionId : 0, authGuid : NULL, cacheId : 9292, threadId : 366
360399 Di Mär 20 10:41:33.660 2018 Preparing context to be sent to pluginserver -  User : NULL, sessionId : 0, authGuid : NULL, cacheId : 9293, threadId : 366
360400 Di Mär 20 10:41:33.667 2018 Preparing context to be sent to pluginserver -  User : NULL, sessionId : 0, authGuid : NULL, cacheId : 9294, threadId : 366
360401 Di Mär 20 10:41:35.095 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 0, authGuid : NULL, cacheId : 8439, threadId : 403
360402 Di Mär 20 10:41:35.962 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 0, authGuid : NULL, cacheId : 8439, threadId : 401

@Doug - what does User: NULL mean? How is that possible?


Thomas



On Mar 15, 2018, at 9:41 AM, Thomas Miskiewicz <tmiskiew@gmail.com> wrote:

Thank you, Rajesh! I will delete my account completely and try again. 

Thomas

On 15. Mar 2018, at 09:37, Rajesh Nair <rajesh.nair.ext@gmail.com> wrote:

Not sure if this is going to help,
i remember facing such issue but not in ARS but frequently on my machine which i am using it

Issue turned out to be problem in user's cache where the password has been stored. My account used to get locked automatically, even though i was using the correct password.
I had to delete the old entries and the issue got fixed.

On Wed, Mar 14, 2018 at 6:22 PM, Thomas Miskiewicz <tmiskiew@gmail.com> wrote:
Hi Doug,

I got an AR Filter Plugin which uses the context of the current user which in this case even happens to be an Admin User.

public List<Value> filterAPICall(ARPluginContext context, List<Value> inValues) 
{
    if (context!=null) {
        String sPort=context.getARConfigEntry("TCD-Specific-Port");
        Integer port=new Integer(sPort);

        

        ARServerUser arCtx = new ARServerUser(context, "de_DE", "localhost");
        arCtx.setPort(serverPort);
    }
}

Everything works well until it doesn’t. At some point I see in the plugin log that authGuid ist empty…

Mi Mär 14 12:36:27.527 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 118, authGuid : PAGAAFGYFE3BUAPFKWINPEO0LWMIJ1, cacheId : 118, threadId : 323
Mi Mär 14 12:36:27.541 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 118, authGuid : PAGAAFGYFE3BUAPFKWINPEO0LWMIJ1, cacheId : 118, threadId : 323
Mi Mär 14 12:36:27.563 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 118, authGuid : PAGAAFGYFE3BUAPFKWINPEO0LWMIJ1, cacheId : 118, threadId : 323
Mi Mär 14 12:36:27.584 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 118, authGuid : PAGAAFGYFE3BUAPFKWINPEO0LWMIJ1, cacheId : 118, threadId : 323
Mi Mär 14 12:36:27.688 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 0, authGuid : NULL, cacheId : 118, threadId : 323
Mi Mär 14 12:36:27.704 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 0, authGuid : NULL, cacheId : 118, threadId : 323
Mi Mär 14 12:36:27.722 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 0, authGuid : NULL, cacheId : 118, threadId : 323
Mi Mär 14 12:36:27.739 2018 Preparing context to be sent to pluginserver -  User : ize0578, sessionId : 0, authGuid : NULL, cacheId : 118, threadId : 323

At this point my account gets locked.


Is this a bug?

Thomas

On Mar 14, 2018, at 5:33 AM, Mueller, Doug <doug_mueller@bmc.com> wrote:

Trying again with SQL log removed so it will let me post…..
 
From: Mueller, Doug 
Sent: Tuesday, March 13, 2018 9:28 PM
To: 'Thomas Miskiewicz' <tmiskiew@gmail.com>; ARSList <arslist@ARSLIST.ORG>
Subject: RE: What is locking my account?
 
Thomas,
 
If your plugin is trying to login and gets a bad password attempt and that happens more than X times in a row, the account would then get locked if you have configured the system to lock a user after X bad password attempts.
 
So, I am guessing that you have configured the system to lock users out after a set number of bad password attempts.  This is what is locking out the account.
 
Then, you have to find out what the plugin is using for the password and why it is not correct.  Has whatever user is involved changed their password?  If so, how do you get the new one to the plugin for use?  If not, what has changed from where the plugin was getting the password to where it is now?  Has the configuration of the password for the plugin changed?
 
I don’t know what the session issue is other than maybe a side effect of the login problem and getting locked out of the system.  First, I would resolve the password problem and then see if the other remains.

Doug Mueller
 
From: Thomas Miskiewicz [mailto:tmiskiew@gmail.com] 
Sent: Tuesday, March 13, 2018 2:57 PM
To: ARSList <arslist@ARSLIST.ORG>
Cc: Mueller, Doug <doug_mueller@bmc.com>
Subject: What is locking my account?
 
Hello Listers,
 
we got a Filter Plugin we’ve been using for years. Out of sudden is seems to be locking my account when I call it a number of times from a Filter.
 
The Log says stuff like: local provided session id 1684 not found. Or it claims that I’m using the wrong password which is first being tolerated a number of times but the it locks me out.


--
ARSList mailing list
ARSList@arslist.org
https://mailman.rrr.se/cgi/listinfo/arslist



--
ARSList mailing list
ARSList@arslist.org
https://mailman.rrr.se/cgi/listinfo/arslist
--
ARSList mailing list
ARSList@arslist.org
https://mailman.rrr.se/cgi/listinfo/arslist