How to enable and read the full trace file for IDENTIKEY Authentication Server 3.1, step by step.

Transcription

1 KB How to enable and read the full trace file for IDENTIKEY Authentication Server 3.1, step by step. Creation date: 27/11/2009 Last Review: 10/12/2012 Revision number: 3 Document type: How To Security status: EXTERNAL Summary To be able to troubleshoot an IDENTIKEY Authentication Server installation you have to enable and examine the full trace file. This is a step by step guide how to enable full tracing and where you can find the file. This article also includes some basic information you can find in the trace file. details. How to enable the full tracing? There are two possibilities ways to enable Full tracing in IDENTIKEY: 1. Using the Web Administration tool. Select Server Configuration from the SYSTEM tab, and edit the General tab. Set Tracing Level to full trace: Page 1 of 6

2 Fill in the File name and click on the SAVE button: After pressing the SAVE button the tracing starts, there is no need to restart the IDENTIKEY Service. 2. Using IDENTIKEY Authentication Server configuration. Open the IDENTIKEY Server Configuration from the Windows Start menu. In the general settings, Select Full Tracing, specify the filename and press the OK button: Click YES when you are asked to restart the service: Where can I find the trace file? After restarting the service, or enabling the tracing via Webadmin, you can find the trace file in the log directory of IDENTIKEY Authentication Server (default location is Page 2 of 6

3 c:\program Files\VASCO\Identikey 3.1\Log): Reproduce the error or problem before examining the file or before you send it to a helpdesk. You can also use a tool like tail for Win32 to view what is added in the trace file while testing. What can you see in the trace file: The example below is an authentication with problems (ODBC integrated installation): First you see the fields date, time and type of information. [2009/11/27 11:26:58][01260][DEBUG][SOAPDataAdapter::getXSDTypeFromDatasetField] > Converting to xsd string [2009/11/27 11:26:58][01260][DEBUG][SOAPDataAdapter::getGSOAPAttributeFromVASCO] > Converting dataset attribute 'Domain Name' (attribute ID 27) [2009/11/27 11:26:58][01260][DEBUG][SOAPDataAdapter::getXSDTypeFromDatasetField] > Converting to xsd string [2009/11/27 11:26:58][01260][DEBUG][SOAPContextManager::releaseClientSOAPContext] > Releasing connection from :18692 to back to the connection pool. [2009/11/27 11:26:58][01260][DEBUG][SOAPContextManager::releaseClientSOAPContext] > Placing connection back on socket selector. Here you see a time jump from 11:26:58 to 11:27:54 this is a new event occurring [2009/11/27 11:27:54][01720][DEBUG][SocketManager::getPendingSockets] > Waiting to acquire connection lock [2009/11/27 11:27:54][01720][DEBUG][SocketManager::getPendingSockets] > Acquired connection lock [2009/11/27 11:27:54][01720][DEBUG][SocketManager::getPendingSockets] > Releasing connection lock [2009/11/27 11:27:54][03236][DEBUG][ValidationTask::processPossibleRepeat] > Failed to find entry in request cache. Must be a new request [2009/11/27 11:27:54][03236][DEBUG][ValidationTask::getSharedSecretStore] > Looking for RADIUS Client with Shared Secret [2009/11/27 11:27:54][03236][DEBUG][ComponentLoader::fetchComponent] > Component cache says there is no Component record [RADIUS Client: ] [2009/11/27 11:27:54][03236][MINOR][ComponentSecretStore::fetchSecret] > RADIUS Client Component < > not found [2009/11/27 11:27:54][03236][DEBUG][ComponentLoader::fetchComponent] > Existing Component record [RADIUS Client:default] returned from Component Cache Did not find a client with the IP address, uses the default radius client. [2009/11/27 11:27:54][00764][DEBUG][RADIUSHandlerFactory::getHandler] > Creating PAP handler [2009/11/27 11:27:54][00764][DEBUG][RADIUSAudit::msgRequestReceived] > User name is in UTF-8 format [2009/11/27 11:27:54][00764][INFO ][adt_record] > Audit: {Info} {RADIUS} {I } {A RADIUS Access-Request has been received.} {0x6ABFFC1F90D98419BFD47FB563971CBF} [2009/11/27 11:27:54][00764][INFO ][adt_record] > Audit: {Client Location: :1099, Source Location: , Request ID:2, Password Protocol:PAP, Action:Process} [2009/11/27 11:27:54][00764][VINFO][CommandTask::process] > Executing scenario command, passing command parameters: <Command Key: 'Object:'Credentials', Command:'Authenticate User''> <Command Parameters: 'User ID:testuser100, Password:******, Raw User ID:0x , Password Format:0, Protocol ID:RADIUS, Protocol Specific Data:2044b0a0a0107- e0d4e6dfea89edc9fec7fd380f20467d'> [2009/11/27 11:27:54][00764][DEBUG][CommandFactory::generateCommand] > Request for command: <20:1> Page 3 of 6

4 [2009/11/27 11:27:54][00764][DEBUG][CommandFactory::generateCommand] > Found factory - creating command [2009/11/27 11:27:54][00764][DEBUG][ComponentLoader::fetchComponent] > Existing Component record [Identikey Server: ] returned from Component Cache [2009/11/27 11:27:54][00764][DEBUG][ComponentCheckUtils::checkServerComponent] > Protocol field <RADIUS> was successfully located in license. [2009/11/27 11:27:54][00764][DEBUG][ComponentCheckUtils::checkServerComponent] > Scenario field <Authentication> was successfully located in license. [2009/11/27 11:27:54][00764][VINFO][ComponentCheckUtils::checkServerComponent] > Server component and license check succeeded [2009/11/27 11:27:54][00764][DEBUG][ComponentLoader::fetchComponent] > Component cache says there is no Component record [RADIUS Client: ] [2009/11/27 11:27:54][00764][DEBUG][ComponentLoader::fetchComponent] > Existing Component record [RADIUS Client:default] returned from Component Cache [2009/11/27 11:27:54][00764][VINFO][ComponentCheckUtils::checkClientComponent] > Client component check succeeded [2009/11/27 11:27:54][00764][VINFO][ComponentCheckUtils::checkClientComponent] > Client license check skipped [2009/11/27 11:27:54][00764][INFO ][AuthenticateRequest::execute] > Processing user authentication request... [2009/11/27 11:27:54][00764][VINFO][AuthenticateRequest::execute] > Password format is [Cleartext combined] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > *** Effective Policy Settings *** Here you can see the policy settings used for the client found. [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Policy ID : [mypolicy] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Parent Policy ID : [Identikey Local Authentication] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > DUR [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Autolearn [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Stored Pwd Proxy [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Assignment Mode : [Neither] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Assign Search Up OU Path [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Grace Period : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Application Names : [] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Application Type : [No Restriction] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Digipass Types : [] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Local Authentication : [Digipass Only] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > BackEnd Authentication : [None] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > BackEnd Protocol ID : [Windows] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Default Domain : [ik31.local] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Group List : [] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Group Check Mode : [No Check] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > User Lock Threshold : [10] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > One-Step Chall/Response [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > One-Step CR Chall Length : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > One-Step CR Check Digit : [1] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Backup VDP Enabled [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Backup VDP Maximum Days : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Backup VDP Max Uses : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Pin Change Allowed : [Yes] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Self-Assign Separator : [] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Challenge Request Method : [Keyword] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Challenge Request Keyword : [] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Primary VDP Rqst Method : [Password] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Primary VDP Rqst Keyword : [] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Backup VDP Rqst Method : [KeywordPassword] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Backup VDP Rqst Keyword : [otp] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > ITimeWindow : [20] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > STimeWindow : [20] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > EventWindow : [20] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > SyncWindow : [6] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > IThreshold : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > SThreshold : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Check Challenge : [1] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > OnlineSG : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Check Inactive Days : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Offline Auth Enabled [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Offline Time Interval : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Offline Max Events : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > DCR [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Chg Win Pwd Enabled [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Chg Win Pwd Length : [0] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Client Group List : [] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > Client Group Mode : [No Check] [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > 2OTP Sync Enabled [2009/11/27 11:27:54][00764][DATA ][Policy::traceDetails] > ********************************* Next he will look for the user. [2009/11/27 11:27:54][00764][DATA ][UserChecks::resolveUserAndGroupCheck] > userid is [testuser100] [2009/11/27 11:27:54][00764][DATA ][UserChecks::resolveUserAndGroupCheck] > domain is [] [2009/11/27 11:27:54][00764][INFO ][ODBCStorageConnector::connect] > Trying to connect to the ODBC data source [2009/11/27 11:27:54][00764][INFO ][ODBCSource::Connect] > Already connected [2009/11/27 11:27:54][00764][DATA ][ODBCRequestContext::doUserNameTranslation] > Using default domain from policy '<ik31.local>' Page 4 of 6

5 [2009/11/27 11:27:54][00764][DATA ][ODBCStatement::PrepareSQL] > Prepared SQL statement "SELECT vdsdomain, vdsuserid, vdsorgunit, vdsmobile, vdsstaticpwd, vdslinkuserdomain, vdslinkuserid, vdslocalauth, vdsbackendauth, vdslockcount, vdslocked, vdsdisabled, vdscreatetime FROM vdsuser WHERE (vdsdomain =?) AND (vdsuserid =?) ORDER BY vdsdomain, vdsuserid, vdsorgunit" [2009/11/27 11:27:54][00764][DATA ][ODBCStatement::BindString] > Bound parameter 1 to string [2009/11/27 11:27:54][00764][DATA ][ODBCStatement::BindString] > Bound parameter 2 to string "testuser100" [2009/11/27 11:27:54][00764][DATA ][ODBCResultSet::GetRowCount] > Returned row-count 1 [2009/11/27 11:27:54][00764][INFO ][UserChecks::userChecks] > Digipass User account found [2009/11/27 11:27:54][00764][INFO ][UserChecks::userChecks] > Setting m_userchecksstate to [User Exists] [2009/11/27 11:27:54][00764][DATA ][User::traceDetails] > *** User Details *** Here you can see the user settings [2009/11/27 11:27:54][00764][DATA ][User::traceDetails] > User ID : [testuser100] [2009/11/27 11:27:54][00764][DATA ][User::traceDetails] > Mobile no. : [] [2009/11/27 11:27:54][00764][DATA ][User::traceDetails] > Domain : [ik31.local] [2009/11/27 11:27:54][00764][DATA ][User::traceDetails] > Org Unit : [test2] [2009/11/27 11:27:54][00764][DATA ][User::traceDetails] > LDAP DN : [] [2009/11/27 11:27:54][00764][DATA ][User::traceDetails] > Local Auth : [Digipass Only] [2009/11/27 11:27:55][00764][DATA ][User::traceDetails] > Back End Auth : [None] [2009/11/27 11:27:55][00764][DATA ][User::traceDetails] > Use DP from UserID : [] [2009/11/27 11:27:55][00764][DATA ][User::traceDetails] > Use DP from domain : [] [2009/11/27 11:27:55][00764][DATA ][User::traceDetails] > Use DP from LDAP DN: [] [2009/11/27 11:27:55][00764][DATA ][User::traceDetails] > ******************** Now he will look for the DIGIPASS [2009/11/27 11:27:55][00764][VINFO][LocalAuthenticationChecks::localVerification] > Length of password entered is [6] bytes [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::PrepareSQL] > Prepared SQL statement "SELECT vdsdomain, vdsserialno, vdsorgunit, vdsdptype, vdsgpexpires, vdsbvdpenabled, vdsbvdpexpires, vdsbvdpusesleft, vdsuserid, vdsdpsoftparamsid, vdsactivlocs, vdsactivcount, vdslastactivtime FROM vdsdigipass WHERE (vdsdomain =?) AND (vdsorgunit =?) AND (vdsuserid =?) ORDER BY vdsdomain, vdsserialno, vdsdpdescription" [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 1 to string [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 2 to string "test2" [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 3 to string "testuser100" [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::PrepareSQL] > Prepared SQL statement "SELECT vdsdpapplication.vdsserialno, vdsdpapplication.vdsapplname, vdsdpapplication.vdsapplno, vdsdpapplication.vdsappltype, vdsdpapplication.vdsactive, vdsdpapplication.vdsblob, vdsdigipass.vdsdomain, vdsdigipass.vdsorgunit, vdsdpapplication.vdscreatetime, vdsdpapplication.vdsmodifytime FROM (vdsdpapplication LEFT JOIN vdsdigipass ON (vdsdpapplication.vdsserialno = vdsdigipass.vdsserialno)) WHERE (vdsdpapplication.vdsserialno =?) ORDER BY vdsdpapplication.vdsserialno, vdsdpapplication.vdsapplname" [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 1 to string " " [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > *** Digipass Details *** DIGIPASS found for user [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > Serial No. : [ ] [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > Domin : [ik31.local] [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > Org Unit : [test2] [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > LDAP DN : [] [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > Backup VDP Enabled [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > Grace Period Expiry : [2009/11/19] [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > Backup VDP Expiry : [] [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > Backup VDP Uses Left: [] [2009/11/27 11:27:55][00764][DATA ][Digipass::traceDetails] > ************************ [2009/11/27 11:27:55][00764][INFO ][Digipass::verifyResponse] > Serial Application APPLI 1 OTP Incorrect - Response Too Small We get a respose too small error because we did not give the PIN.. [2009/11/27 11:27:55][00764][INFO ][Digipass::verifyResponse] > Failed to verify response for serial number application APPLI 1 [2009/11/27 11:27:55][00764][INFO ][DigipassList::verifyResponse] > Response verification has failed for digipass [2009/11/27 11:27:55][00764][DEBUG][LocalAuthenticationChecks::doResponseChecking] > There was no definite One Time Password in the credentials [2009/11/27 11:27:55][00764][DEBUG][LocalAuthenticationChecks::doResponseChecking] > One or more digipass are outside of grace period [2009/11/27 11:27:55][00764][VINFO][LocalAuthenticationChecks::isAnyTriggerPassword] > A challenge request method is 'password', but no digipass of the correct type was found [2009/11/27 11:27:55][00764][VINFO][LocalAuthenticationChecks::doResponseChecking] > Set localauthstate to [Definite Fail] [2009/11/27 11:27:55][00764][INFO ][DigipassList::update] > Updating 1 digipasses. [2009/11/27 11:27:55][00764][VINFO][AuthenticateRequest::dbUpdate] > User's lock count is now [5] The User Lock Threshold is set to 10 in the policy, therefore the user is not locked yet. [2009/11/27 11:27:55][00764][DEBUG][ODBCConnection::TransactionStart] > Starting transaction [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::PrepareSQL] > Prepared SQL statement "UPDATE vdsuser SET vdslockcount =?, vdsmodifytime =? WHERE (vdsdomain =?) AND (vdsuserid =?)" [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindInteger] > Bound parameter 1 to integer 5 [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindTimeStamp] > Bound parameter 2 to timestamp Fri Nov 27 10:27: [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 3 to string [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 4 to string Page 5 of 6

6 "testuser100" [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::PrepareSQL] > Prepared SQL statement "SELECT vdsdomain, vdsuserid, vdsorgunit, vdsusername, vdsdescription, vdsphone, vdsmobile, vds , vdsstaticpwd, vdslinkuserdomain, vdslinkuserid, vdslocalauth, vdsbackendauth, vdslockcount, vdslocked, vdsdisabled, vdsadminprivileges, vdsofflineauthenabled, vdscreatetime, vdsmodifytime FROM vdsuser WHERE (vdsdomain =?) AND (vdsuserid =?) ORDER BY vdsdomain, vdsuserid, vdsorgunit" [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 1 to string [2009/11/27 11:27:55][00764][DATA ][ODBCStatement::BindString] > Bound parameter 2 to string "testuser100" [2009/11/27 11:27:55][00764][DEBUG][ODBCConnection::TransactionCommit] > Committed transaction [2009/11/27 11:27:55][00764][INFO ][AuthenticateRequest::generateResponse] > Set status code [1012], message [The One Time Password failed validation] [2009/11/27 11:27:55][00764][INFO ][adt_record] > Audit: {Failure} {Authentication} {F } {User authentication failed.} {0x04563FAFDAD8C51B25FB5C E08} [2009/11/27 11:27:55][00764][INFO ][adt_record] > Audit: {Source Location: , Policy ID:mypolicy, User ID:testuser100, Domain:ik31.local, Input Details:User ID:testuser100, Password:******, Raw User ID:0x , Password Format:0, Protocol ID:RADIUS, Protocol Specific Data:2044b0a0a0107-e0d4e6dfea89edc9fec7fd380f20467d, Output Details:Status Message:The One Time Password failed validation, Auxiliary Message:Error Code: <-202> Error Message: Serial Application APPLI 1 OTP Incorrect - Response Too Small, Local Authentication:yes, Back-End Authentication:None, Reason:The One Time Password failed validation, Client Location: , Client Type:RADIUS Client} [2009/11/27 11:27:55][00764][INFO ][AuthenticateRequest::execute] > User authentication request - exit state [Denied] [2009/11/27 11:27:55][00764][MAJOR][AuthenticateUserCommand::execute] > === Error Stack ========================= [2009/11/27 11:27:55][00764][MAJOR][AuthenticateUserCommand::execute] > Error code: <-202> Error message: <Serial Application APPLI 1 OTP Incorrect - Response Too Small> [2009/11/27 11:27:55][00764][MAJOR][AuthenticateUserCommand::execute] > === End of Error Stack ================== [2009/11/27 11:27:55][00764][VINFO][CommandTask::process] > Finished executing scenario command, results are: <Result Codes: '<Status Code: '1012'> <Return Code: '-2'>'> <Results: 'Status Message:The One Time Password failed validation, Auxiliary Message:Error Code: <- 202> Error Message: Serial Application APPLI 1 OTP Incorrect - Response Too Small'> <Error stack: 'Error Code: <-202> Error Message: Serial Application APPLI 1 OTP Incorrect - Response Too Small'> [2009/11/27 11:27:55][00764][INFO ][adt_record] > Audit: {Info} {RADIUS} {I } {A RADIUS Access-Reject has been issued.} {0x7B3F57958F2BFDFBF18C36AE5DA437A9} [2009/11/27 11:27:56][00764][INFO ][adt_record] > Audit: {Client Location: :1099, Source Location: , Request ID:2, Password Protocol:PAP, Output Details:, Reason:Authentication processing error} [2009/11/27 11:28:51][01720][DEBUG][SocketManager::getPendingSockets] > Waiting to acquire connection lock [2009/11/27 11:28:51][01720][DEBUG][SocketManager::getPendingSockets] > Acquired connection lock [2009/11/27 11:28:51][01720][DEBUG][SocketManager::getPendingSockets] > Releasing connection lock [2009/11/27 11:28:51][02372][DEBUG][ValidationTask::processPossibleRepeat] > Failed to find entry in request cache. Must be a new request As you can see from the log file, the OTP verification did not succeed. The problem here is the response too small (because we forgot to enter the pin). We also see that the user is not locked. When you have error messages in your full trace file it is always advised to search the KB articles. Problems that are recurrent are often addressed in a KB article. Page 6 of 6