Node - [error] authentication : Authentication failure:Invalid login credentials

[Former Member]

Hi,

I succesfully started Node, but I can't login into it. My cluster.cfg file looks like this:

#config-type=file

#file=cluster.xml

#The following url points to a default location.

#Set as appropriate for your environment.

jdbc-url=jdbc:sybase:Tds:localhost:19111

jdbc-username=gluch

jdbc-password=\

3Fzgs/A/gum6BsMGrq9E2r/88eefYd7FO7ufRESshhs3JPIK

jdbc-password-is-encrypted=true

jdbc-type=sqla

jdbc-sqla-ha=false

jdbc-sqla-ha-mirror-primary=

jdbc-sqla-ha-mirror-partner-1=

jdbc-sqla-ha-mirror-partner-2=

jdbc-hana-sso-bypass=true

cluster-name=esp1

cluster-password=\

A9jgFPDjgk+61sPAru5E3b/N8ZCf2t40OxCfwkSDhlU3v/gS

cluster-password-is-encrypted=true

cipher-file=C:\\SAP_ESP_5.1\\ESP-5_1\\cluster\\keys\\esp1\\cluster.key

I tried this combination, but it doesn't work:

c:\SAP_ESP_5.1\ESP-5_1\bin>streamingclusteradmin --uri=esps://10.61.0.214:19011

--username=esp1 --password=\

[error] authentication : Authentication failure:Invalid login credentials

SAP Version: 5.1.110.00/20151206.1/SP11/winnt/x86_64/64-bit/OPT/Sun, Dec 06, 2015  5:41:30 PM

Thank you for your help!

Jan

[JWootton · Accepted solution]

What version of ESP are you using?  The ESP cluster configuraiotn for current versions is stored in a SQL Anywhere database, not a config file.  you should be logging in using the cluster admin credentials you set during installation.

In looking at above,  you are trying to connect using password=\  - but the config file has an encrypted password in it - it's not "\".

If you don't know the password that you created at install,  then not sure how you recover it - have to turn to the big guns for that (or you could re-install).

[Former Member · Accepted solution]

Hi Jeff,

I'm using ESP 5.1., SP11.

I think I know password to cluster admin credetenials, so user name: esp1 is correct, or should I use both cluster admin credetenials?

Can I login somewhere to check credetenials if i know password?

Thank you,

Jan

[JWootton · Accepted solution]

Not sure what you mean by question "Should I use both credentials".  If you know the password for the esp1 user, then you shoudl be fine.  What I suggest is to leave out the password when you start streamingclusteradmin,  and then it will prompt you for the password - type it in then

c:\SAP_ESP_5.1\ESP-5_1\streamingclusteradmin --uri=esps://10.61.0.214:19011 --username=esp1

[former_member217348 · Accepted solution]

Hi Jan,

Are you able to execute the streamingclusteradmin command using the SYS_STREAMING user?

Using the SYS_STREAMING user, have you granted permissions to the user "esp1"?

Thanks,

Alice

[Former Member · Accepted solution]

Hi Alice,

it is working, thank you very much! Now I want to create workspace so I should create some User with that privileges, to do that, right?

Is it possible to create user password with streamingclusteradmin?

I also granted permission to SYS_STREAMING user:

     grant all to user SYS_STREAMING

but when I tried to add workspace, I'v got this error:

I tried also:

     grant all all on all to user SYS_STREAMING

but no change.

Thank you,

Jan

[Former Member · Accepted solution]

Hi Jeff,

unfortunately it doesn't work.

Thank you for your help,

Jan

[former_member217348 · Accepted solution]

Hi Jan,

Yes, you can set up a user (or give permissions to the esp1 user) that has privileges to add workspaces. For more information, see the ESP Security Guide / User Authorization Policies / Granting Permissions / Example: Setting up Workspace Permissions.

Thanks,

Alice

[former_member217348 · Accepted solution]

Hi Jan,

The SYS_STREAMING user has very specific and limited authorizations, so granting it any additional permissions will not make any difference. See the ESP Security Guide / User Authorization Policies / SYS_STREAMING for more information.

Thanks,

Alice

[Former Member · Accepted solution]

Hi Alice,

thank you for information. I add permission to user "esp" but I can't login. Where can I manage password for this user?

Thank you,

Jan

[former_member217348 · Accepted solution]

Hi Jan,

What type of authentication does "esp" have?

How are you trying to login?

Thanks,

Alice

[Former Member · Accepted solution]

Hi Alice,

I'm trying to log in

     c:\SAP_ESP_5.1\ESP-5_1\bin>streamingclusteradmin --uri=esps://10.61.0.214:19011

     --username=esp

     Password:

     [error] authentication : Authentication failure:Invalid login credentials

but no result. I tried also Studio login, but same error.

I use as a password same as for SYS_STREAMING.

Thank you,

Jan

[former_member217348 · Accepted solution]

Hi Jan,

What type of authentication is set up of for the user?

Thanks,

Alice

[DJSmith · Accepted solution]

Hi

Did you actually select to use SSL authentication when installing? One case when that error appears is when SSL= Y and you use uri=esp://10.61.0.214:19011 or the other way round.

try using the non-ssl version to check, which is:-

c:\SAP_ESP_5.1\ESP-5_1\streamingclusteradmin --uri=esp://10.61.0.214:19011 --username=esp1

omitting the s after esp.

[former_member217348 · Accepted solution]

Hi Jan,

More questions:

In what OS environment is the ESP cluster running?

If Solaris or Linux, have you followed the post-installation step of Configuring a Pluggable Authentication Module?

Thanks,

Alice

[Former Member · Accepted solution]

Hi Alice,

do you mean this part of the code from cluster.cfg?

	<Security>
	<Authenticators>
		<xi:include href="auth_native_nt.xml" parse="xml"/>
	</Authenticators>
	<Authorizer enabled="true"/>
	<KeyStore>
		<Type expand="true">JKS</Type>
		<File expand="true">${STREAMING_CLUSTER_KEYSTORE}</File>
		<Password expand="true" encrypted="true">

r/7g8vCKgki6nsMdroNEK79Y8eCfFd6JOyGf/0RghjM3Z/Ml

</Password>

		<Algorithm expand="true">RSA</Algorithm>
	</KeyStore>

    </Security>

Sorry for quality.

The cluster is running on Windows Server 2008 as same as ESP Studio.

Thank you,

Jan

[Former Member · Accepted solution]

Hi David,

I tried uri=esp://10.61.0.214:19011,

but it says error invalid uri.

Thank you,

Jan

[DJSmith · Accepted solution]

okay, so lets go through all the steps, because you are running a windows remote cluster you should be able to do these steps

in one dos window, start db and cluster

start_db.bat

start_node.bat  node1

then in another dos window start the interactive clusteradmin

%streaming_home%\bin\streamingclusteradmin --uri=esps://localhost:19011 --username=sys_streaming --password=<your password created when installing>

this will give clusteradmin prompt >

If your windows is using OS authentication, then if your windows login is Jan123, then Jan123  must created as a user in the clusteradmin

>get users will display what users exist

The following command will create Jan123 and give it full access

> grant permissions all to Jan123

this will then allow you to use the following example command to start projects

%streaming_home%\bin\streamingclusteradmin --uri=esps://localhost:19011 --username=Jan123 --password=<your windows password> --workspace=p1 --project_name=p1 --ccx=p1.ccx --add_project

NOTE: it can be easier to add and start project by just using interactive mode, e.g.

> add workspace w1

> add project w1/p1 p1.ccx

> start project w1/p1

I think that you are unlikely to be able to use "esp" as the username , unless that is your windows login!

[Former Member · Accepted solution]

Hi David,

thank you. Sorry, I haven't realized that settings. I'm finally log in, but when I set from SYS_STREAMING user privileges:

     > grant perm all to user jan.bednar

And I log in as jan.bednar and try:

     > add workspace w1

I got still the same error:

     [error] server returned : [FAILURE:No authorization for requested permission: privilege=add, privilege-type=workspace, resource-type=workspace, resource=w1][CODE:710005]

I also tried to set privilege:

     > grant perm add workspace to user jan.bednar

But same error.

Thank you,

Jan

[DJSmith · Accepted solution]

Jan

Does your organisation allow you to share your desktop with SAP?

[Former Member · Accepted solution]

Hi David,

it is not a problem. Do you mean like call with TeamViewer?

Thank you,

Jan

[former_member217348 · Accepted solution]

Hi Jan,

The user you are trying to use, jan.bednar, is a native OS user for the Windows machine where the ESP cluster is running. You must append a domain to the user name omitting top-level domain extensions such as .com or .net—for example, fred@sap, not fred@sap.com.

Added: If you do not include the domain, the defaultDomain option must be specified in the authenticator section of cluster configuration.

Also: If you use a Windows account to log in, you must also grant permissions to the user name in the format username@domain.

For example: grant perm all on all to user jan.bednar@sap

You will need to use that complete userid whenever logging into any ESP components when the ESP cluster is running on windows, since all security and authentication is centralized for the whole cluster.

(See Granting Permissions - SAP Event Stream Processor: Installation Guide for Windows - SAP Library.)

So, now let's go back to what you described originally in this post - I'm guessing that for the original user id you were referring to of "esp1", you had wanted to create that using preconfigured username/password authentication.

Here are the steps for setting up a Pre-Configured ESP user account, using the SYS_STREAMING user:

1. Generate an encrypted password string using the streamingclusteradmin utility as follows:

1. Execute the utility:  %STREAMING_HOME%/bin/streamingclusteradmin --encode_text
2. Respond to the prompts:
   1. Please enter text to be encoded:
   2. Please re-enter text to be encoded:
   3. The encrypted password is returned:{SHA-256:31EApshv/zQ=}VNkrYJ7URNpxVkv4k3QlIt4UE8PNh0UiT+IHHkUV3vU=
      
      

2. Add a username/password authenticator for the new user account:

1. Log in to the cockpit using the SYS_STREAMING user account.
2. Navigate to configure Authenticators:
3. Click "EXPLORE."
4. In the Browse tab, click "ESP Nodes."
5. Click the upside-down triangle and choose "Configure Cluster."
6. Expand the Security folder.
7. If you already have an authenticator, the “Authenticators” folder will be displayed.
8. If the “Authenticators” folder appears, expand the folder, and click on one of the listed authenticators.
9. If the “Authenticators” folder does not appear, but instead, shows up as a file, then click on “Authenticators”:
   1. Click on "Add Authenticator..."
   2. From the "Authenticator Type" dropdown, choose Pre-Configured User.
   3. Click "Done."
   4. Click OK on the Info pop-up that says "The authenticator has been saved to the configuration."
10. Click in the Value field for the username to enter the desired username.
11. Click in the Value field for the password to enter the encoded text string that you generated in Step 1.
12. Click "Apply."
    
    

3. IMPORTANT: You MUST RESTART the node for these changes to go into effect:

1. Stop the node - see Stopping a Node or Cluster - SAP Event Stream Processor: Configuration and Administration Guide - SA....
2. Start the node - see Starting a Node or Cluster - SAP Event Stream Processor: Configuration and Administration Guide - SA....

[Former Member · Accepted solution]

Hi Alice,

thank you for your advice. Nowadays I'm working on different project so I don't have a time to try it. I will let you know here, when I try

Thanks,

Jan

[Former Member · Accepted solution]

Hi Alice,

thank you for your advice. I used jan.bednar@<domain> and it works

Unfortunatelly I can't find the server at Cockpit. There is just blank list.

Thank you,

Jan