| *** vladdy has quit (Ping timeout: 246 seconds) | 06:18 | |
| *** vladdy (~vladdy@194.242.5.47) has joined #wikid | 07:31 | |
| *** vladdy has quit (Quit: Get MacIrssi - http://www.sysctl.co.uk/projects/macirssi/) | 07:37 | |
| *** vladdy (~vladdy@194.242.5.47) has joined #wikid | 07:48 | |
| *** nowen (~nowen@adsl-98-66-183-205.asm.bellsouth.net) has joined #wikid | 12:26 | |
| *** dystonic (c7ff532e@gateway/web/freenode/ip.199.255.83.46) has joined #wikid | 15:05 | |
| dystonic | ello | 15:05 |
|---|---|---|
| dystonic | Hey nick. let me know when you're around, i has questions. | 15:06 |
| dystonic | not sure how the preregistration works re: if the api version allows adding multiples w/out using the web interface to upload, since that was buggy. | 15:18 |
| dystonic | and i'm not a coder, so i need some help w/ the concepts so I can aks the right person to help me w/ it, or do it myself. | 15:18 |
| dystonic | i found example.jsp | 15:18 |
| nowen | ok - on the phone right now | 15:23 |
| dystonic | kk. | 15:24 |
| nowen | ok | 15:30 |
| nowen | so, pre-reg in the api was designed for one of our customers that wanted to pre-reg a bunch of users | 15:31 |
| nowen | their app generated the random pre-reg codes and allowed their CSR people to add users | 15:35 |
| nowen | so the reps would get a pre-reg code and type in the username, then give the user the pre-reg code | 15:36 |
| dystonic | k. the code snip we're talking about is headed under <add multiple preregistration codes>, yes? | 15:37 |
| nowen | note that pre-reg is working, it's just the listing and feedback that is borked, so when you try to enter an existing user or reg code, you don't know it has failed | 15:37 |
| nowen | yes, but really it is the single one too | 15:38 |
| dystonic | because under the section above, add a pre-registration code it seems to point to uploading the file through the gui. | 15:38 |
| dystonic | please understand that i'm about to ask a bunch of stupid questions, because i don't speak this - so please be forgiving, cus i gotta get this working. | 15:39 |
| nowen | no problem! | 15:39 |
| dystonic | ok. so. 1) do we have to upload the reg codes through the web interface. | 15:39 |
| dystonic | or is it actually doable through the api. | 15:39 |
| nowen | 1. "Pre-registration:" assumes a code exists in the server | 15:39 |
| dystonic | k. so hurdle 1 is getting the files to upload cleanly. | 15:40 |
| dystonic | you sent me some text for getting into the db. | 15:40 |
| nowen | 2. "Add a Pre-Registration Code:" Adds a new code to the server | 15:40 |
| nowen | 3. "Add Multiple Pre-Registration Codes: " add a bunch of new codes to the server | 15:40 |
| dystonic | syntax is the same as the text file that would be uploaded, csv on newline per user | 15:41 |
| dystonic | but you have to when you upload the reg codes provide the username mapping. | 15:41 |
| dystonic | ? | 15:41 |
| nowen | let's back up a bit - what do you want to do? How many users do you want to pre-reg at a time? | 15:41 |
| dystonic | i want to prereg 2-4. it's not that i need to register a lot, i just need to be able to do it. | 15:42 |
| dystonic | i don't have huge batches. | 15:42 |
| nowen | ok | 15:42 |
| dystonic | so. my use case is: i get a new user. or 2-3, or whatever, not a huge batch. | 15:43 |
| dystonic | i need to be able to generate a preregistration code so that when the request comes in, I can completely provision them and push all the data to them. it causes me a lot of overhead when I hae to have them send me ar eg code. | 15:44 |
| dystonic | i've tried it before and gotten weird errors, like a -0 from the wikid token jar when i feed it a code that i've uploaded. the gui doesn't give me good ifno. | 15:44 |
| dystonic | i'm not a coder, at all. | 15:45 |
| dystonic | so i'm not sure what to do with the api; i've been trying to figure it out, but i'm kinda out of my depth. i can't sit around and wait for a bugfix, because its' really kinda blocking me. | 15:45 |
| dystonic | plus its' nontrivial to upgrade nonprod and two production environments, we just did it, it's goign to be a while before I can get resoruces to do it. | 15:46 |
| nowen | well, you may not need it. you can still up load the data, validate it via the db commands I gave you and send it out | 15:46 |
| dystonic | i really hate directly touching a db. does the clear functionality actually clear the table? | 15:46 |
| dystonic | i don't mind selecting / looking, but i don't want to modify it directly if i don't have to. | 15:47 |
| nowen | yes, this is just looking. let me test the clear | 15:47 |
| nowen | clear works | 15:48 |
| nowen | upload works | 15:48 |
| nowen | export works too | 15:49 |
| nowen | so actually, you can export to check | 15:49 |
| nowen | no db access needed | 15:49 |
| dystonic | let me test. | 15:49 |
| dystonic | k. got a null -1 error | 15:53 |
| dystonic | when i attempted to use a tokencode. | 15:53 |
| nowen | anything in the logs? | 15:54 |
| dystonic | downloaded hte jsp, which has the rows in it i would expect, tab delimited | 15:54 |
| dystonic | checking clearing and looking for logs | 15:54 |
| nowen | it's tab-delimited | 15:56 |
| nowen | so, did you pre-reg a new token? | 15:56 |
| nowen | I have a lunch meeting today. can we pick up at 1ish? | 15:57 |
| dystonic | sure. | 15:57 |
| nowen | ok - thanks! | 15:57 |
| dystonic | sure. np. :) | 15:57 |
| dystonic | i'm happy w/whatever if we can get it to work. | 15:57 |
| nowen | I think we can get it to work today | 15:58 |
| *** nowen has quit (Quit: Leaving.) | 15:58 | |
| dystonic | 2012-09-27 12:10:05.906ERRORcom.wikidsystems.server.DeviceTransactionExecCould not find configuration for domain referenced by prereg code3249 on this server. 2012-09-27 12:09:18.383ERRORcom.wikidsystems.server.DeviceTransactionExecCould not find configuration for domain referenced by prereg code3249 on this server. | 16:13 |
| *** nowen (~nowen@adsl-98-66-183-205.asm.bellsouth.net) has joined #wikid | 17:06 | |
| dystonic | oh hai. | 17:07 |
| nowen | howdy | 17:08 |
| nowen | ok - where were we? | 17:08 |
| dystonic | 2012-09-27 12:10:05.906 ERROR com.wikidsystems.server.DeviceTransactionExec Could not find configuration for domain referenced by prereg code3249 on this server. 2012-09-27 12:09:18.383 ERROR com.wikidsystems.server.DeviceTransactionExec Could not find configuration for domain referenced by prereg code3249 on this server. | 17:08 |
| dystonic | is what i'm geting. | 17:12 |
| dystonic | i have one domain on that server. | 17:12 |
| nowen | hmm | 17:12 |
| dystonic | i tried a diff reg code that was 5 digits, not sure if there's a minimum that's defined or if there's a setting that isn't selected. | 17:12 |
| nowen | are you using the latest token? 22? | 17:15 |
| nowen | and what do you have in your jw.properties file? | 17:15 |
| dystonic | but the token just hangs at 'continue' when i submit the request and doesn't return a error code. | 17:17 |
| dystonic | token client i'm testing with is 3.1.22 | 17:17 |
| dystonic | and its' stock, i just downloaded it from the site. | 17:17 |
| dystonic | are you talking about a jw.properties file living on the wikid server? | 17:17 |
| dystonic | 2012-09-27 13:12:04.609ERRORcom.wikidsystems.server.DeviceTransactionExecCould not find configuration for domain referenced by prereg code12356 on this server. 2012-09-27 13:11:58.507ERRORcom.wikidsystems.server.DeviceTransactionExecCould not find configuration for domain referenced by prereg code12356 on this server. | 17:18 |
| nowen | the jw.properties file goes in the same dir as the jar token file | 17:18 |
| dystonic | k. do they need a custom jw.props file to do preregistration? | 17:18 |
| dystonic | because this is just a fresh download from your site on a machine thats' never had wikid before. | 17:19 |
| nowen | no, but it makes it easier | 17:20 |
| nowen | It works with a custom jw.properties file | 17:21 |
| nowen | like this: http://pastebin.com/yxbPigie | 17:21 |
| nowen | also works for me without it | 17:23 |
| dystonic | right. | 17:23 |
| dystonic | because in the default token that file only exists in the src dir | 17:23 |
| nowen | double check your domain id | 17:23 |
| nowen | maybe there's a trailing space that's not getting parsed correctly> | 17:23 |
| nowen | ? | 17:23 |
| dystonic | checking. | 17:24 |
| dystonic | in terms of when i attempt to register from the java token? | 17:26 |
| dystonic | because there isn't - i'm certain. | 17:27 |
| dystonic | is there something you want me to check w/in the console? | 17:27 |
| dystonic | it works just fine for when people give me codes. it's something weird w/ the relationships when the prereg checks in. | 17:27 |
| dystonic | 2012-09-27 13:12:04.609ERRORcom.wikidsystems.server.DeviceTransactionExecCould not find configuration for domain referenced by prereg code12356 on this server. 2012-09-27 13:11:58.507ERRORcom.wikidsystems.server.DeviceTransactionExecCould not find configuration for domain referenced by prereg code12356 on this server. | 17:28 |
| dystonic | i mean theoretically it couldn't even hit the wikid server w/out the right servercode, because that's the padded ip. | 17:28 |
| dystonic | and i'm seeing logs that its' connecting to the server but then it's not mapping. | 17:28 |
| nowen | I see that error now. let me see if I can figure out why | 17:28 |
| dystonic | kk. | 17:29 |
| dystonic | the only thing not configured under the domain screen is Registered URL: | 17:29 |
| dystonic | because we don't tie dns to this host. | 17:29 |
| nowen | restart the token client and try again | 17:33 |
| nowen | nevermind | 17:35 |
| nowen | oh, here's my issue - openoffice is dropping the leading zero | 17:36 |
| nowen | so 01234 in the db is 1234 in openoffice | 17:37 |
| dystonic | i'm not using a leading 0 in my reg codes | 17:39 |
| dystonic | omg! | 17:40 |
| dystonic | i think it worked | 17:40 |
| dystonic | gimmie a few. | 17:41 |
| nowen | kk | 17:41 |
| dystonic | this is promising. | 18:06 |
| dystonic | looks like i'd cleared the table and not reloaded it so user error. | 18:06 |
| dystonic | let me try a few test cases and see what i can get done. | 18:07 |
| nowen | ok | 18:07 |
| dystonic | so far i'm digging this. :) | 18:07 |
| nowen | good stuff | 18:07 |
| dystonic | yes. | 18:14 |
| dystonic | w00t. | 18:14 |
| nowen | ;) | 18:14 |
| dystonic | alright. i'm going to rewrite my instructions and see if i can get some $users to test it out. | 18:14 |
| dystonic | thanks. i get what its' doing now. | 18:14 |
| nowen | awesome! | 18:15 |
| dystonic | like. it updates the prereg table once i register the token so it's not reusable. | 18:15 |
| dystonic | so i can export and see if it's been used. | 18:15 |
| dystonic | it insists on at least 6 dig for my pin. | 18:15 |
| dystonic | the file syntax is easy to do w/ excel + saving a tab delimited file. | 18:15 |
| dystonic | didn't seem to have a opinion about the reg code, but avoid leading 0s. | 18:15 |
| nowen | yep | 18:15 |
| dystonic | cool. alright. thanks. i'll let you know if there are more issues. :) glad this was largely pebcak. | 18:16 |
| nowen | my pleasure! | 18:16 |
| joevano | ready to got back to my issue nowen? | 18:16 |
| joevano | get* | 18:16 |
| nowen | hehe, yes! | 18:16 |
| joevano | ok... interesting thing | 18:17 |
| joevano | you know how that security file that you can use to skip entering your key | 18:17 |
| nowen | yes | 18:17 |
| joevano | it doesn't work either ... but if I copy the passphrase out of there and paste it in at the prompt it works | 18:18 |
| nowen | wah? | 18:18 |
| nowen | do you have it in quotes? | 18:18 |
| joevano | yep... I think it in the examlpe.jsp , yes | 18:19 |
| nowen | single or double? | 18:19 |
| nowen | and in the /etc/WiKID/security file? | 18:19 |
| joevano | tried it every which way but Sunday in the security file | 18:19 |
| joevano | double, but I tried single and without as well | 18:19 |
| joevano | in the security file without, but also tried with quotes | 18:20 |
| nowen | and the start-up script doesn't pick it up? | 18:20 |
| joevano | the only thing I could figure is that it is tripping over the ! is our passphrasex | 18:21 |
| joevano | in* | 18:21 |
| nowen | possibly, but it should all be handled | 18:21 |
| nowen | is it the first char? | 18:21 |
| joevano | it is not.. it is the last | 18:22 |
| nowen | give me a few to set up a new test | 18:22 |
| joevano | k | 18:22 |
| nowen | ok - created a new cert. passphrase! | 18:45 |
| nowen | put it in /etc/WiKID/security without quotes and it worked | 18:47 |
| nowen | tested via example.jsp too | 18:47 |
| nowen | single quotes works too | 18:51 |
| nowen | looks just like 'WAUTH_PASSPHRASE='passphrase!' | 18:52 |
| nowen | you checked using the keytool, right | 18:53 |
| nowen | ? | 18:53 |
| nowen | joevano: ? | 19:18 |
| *** dystonic has quit (Quit: Page closed) | 19:18 | |
| joevano | nowen: sry... was out looking for Jimmy Hoffa | 19:50 |
| nowen | hehe | 19:50 |
| nowen | bring your shovel over to my place | 19:50 |
| joevano | yes I used keytool on both the localhost and intca | 19:50 |
| nowen | and their dates are ok? | 19:50 |
| joevano | hmm... let me look again but I think so | 19:51 |
| joevano | yes both are still valid | 19:53 |
| joevano | going to check the security file again | 19:53 |
| joevano | wth... it wored today stopping and starting wikidctl | 19:56 |
| joevano | let me try the example.jsp page | 19:57 |
| joevano | nope.. doesn't work. How can I verify the port WiKI | 20:12 |
| joevano | WiKID is configured to listen on | 20:12 |
| nowen | same error in the logs? | 20:12 |
| nowen | wauth is on port 8388 | 20:13 |
| joevano | Couldn't validate the client certificate. Verify the validity and dates of the client cert. | 20:13 |
| nowen | is this a test system? | 20:13 |
| joevano | let me check the date and time the server thinks it is | 20:14 |
| joevano | nope... this is our main system | 20:14 |
| joevano | NTP for the win... time is exact | 20:14 |
| nowen | hmm | 20:14 |
| nowen | so, the server starts if entered manually | 20:15 |
| nowen | but not using the security file and example.jsp fails | 20:15 |
| joevano | no, the server now starts without doing it manually... but example .jsp gives me the error | 20:15 |
| nowen | ahh - ok | 20:15 |
| nowen | and you're restarting WiKID after editing the example.jsp? | 20:16 |
| joevano | love the fact that we won't have to back door in to get the auth back up when/if we lose power over the weekend | 20:16 |
| joevano | oh... i think i did but let me do it again | 20:17 |
| joevano | https://dl.dropbox.com/u/502439/09-27-2012%204-22-49%20PM.png | 20:24 |
| joevano | here is an image of the log.. this is before trying example.jsp and right after restarting the service | 20:25 |
| joevano | so it does seem to be some sort of certificate error | 20:25 |
| nowen | is there a little bomb icon on the right? | 20:25 |
| nowen | click it for the full trace | 20:25 |
| joevano | i do not see one | 20:26 |
| nowen | here's what mine looks like: http://pastebin.com/bNsRwmPc | 20:26 |
| joevano | in the log screen right? | 20:26 |
| nowen | yes, the log screen | 20:27 |
| joevano | yep exactly | 20:27 |
| nowen | hmm | 20:27 |
| nowen | and do you get the same error when you hit example.jsp? | 20:27 |
| joevano | other than the servercode and passphrase of course | 20:27 |
| joevano | when I go to the example.jsp page I get two lines in the logs that match the ones in my log screenie about wAuth and wClient | 20:30 |
| joevano | 2012-09-27 16:37:45.754ERRORcom.wikidsystems.client.wClientERROR: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate | 20:30 |
| joevano | 2012-09-27 16:37:45.738ERRORcom.wikidsystems.server.wAuthCouldn't validate the client certificate. Verify the validity and dates of the client cert. | 20:30 |
| nowen | what version of WiKID is this? and what java? | 20:31 |
| joevano | 3.4 build 87-b1216 | 20:33 |
| joevano | java version "1.6.0_20" | 20:33 |
| joevano | OpenJDK Runtime Environment (IcedTea6 1.9.13) (6b20-1.9.13-0ubuntu1~10.04.1) | 20:33 |
| joevano | OpenJDK 64-Bit Server VM (build 19.0-b09, mixed mode) | 20:33 |
| nowen | is radius working? can you login? | 20:35 |
| joevano | yes, we are using it and it fails if you use the wrong OTP | 20:39 |
| nowen | man | 20:44 |
| nowen | hmm | 20:44 |
| nowen | can you set your loggers for wauth to debug and hit the example.jsp page again? | 20:45 |
| nowen | no restart just want to see if we get anything better | 20:45 |
| joevano | sorry... got a call.. | 20:59 |
| nowen | np | 20:59 |
| joevano | nothing better on debug | 20:59 |
| joevano | just those 2 lines | 21:00 |
| nowen | let's change Config.getValue("BASEPATH") + "private/localhost.p12", | 21:00 |
| nowen | to "/opt/WIKID/private/localhost.p12", | 21:00 |
| nowen | and see if it's just not finding the cert | 21:00 |
| joevano | k... | 21:00 |
| nowen | also, I bet you could copy the file to a new name if you don't want to restart all the time | 21:01 |
| joevano | does wAuth initialization usually take quite some time | 21:05 |
| nowen | not usually | 21:07 |
| nowen | how long does it take? | 21:09 |
| joevano | it takes a good minute to minute and a half here (or maybe it is faster but seems like forever) | 21:09 |
| nowen | how much memory ? | 21:09 |
| joevano | looks like 1GB | 21:10 |
| nowen | are you in replication? | 21:11 |
| joevano | no | 21:11 |
| nowen | hmm | 21:11 |
| joevano | here is the wAuth start up line to give you an idea | 21:11 |
| joevano | Waiting for wAuth initialization to complete...............................................................................................................................................................Success! | 21:12 |
| joevano | yep confirmed 1GB | 21:14 |
| joevano | single cpu | 21:14 |
| nowen | most of my vms have 1 gid | 21:15 |
| nowen | gig | 21:15 |
| joevano | this is a VM as well average mem usage is at 175Mb | 21:16 |
| joevano | max was 370Mb | 21:16 |
| joevano | oh... and U never told you that the absolute path did not work either... I am stumped | 21:17 |
| joevano | I* | 21:18 |
| nowen | yeah | 21:18 |
| nowen | is there a listener on 8388? | 21:19 |
| nowen | 'netstat -anp | grep 8388' | 21:20 |
| nowen | just in case ;) | 21:20 |
| joevano | hmm... only on IP6 it looks lke...You are a genius (maybe) | 21:21 |
| joevano | tcp6 0 0 [::]:8388 [::]:* LISTEN | 21:22 |
| nowen | a slow, slow genius | 21:22 |
| nowen | but still, that | 21:22 |
| joevano | ok... I gotta get out of here... but I will follow that path over the weekend | 21:22 |
| nowen | is probably a result of whatever | 21:22 |
| nowen | is selinux off? | 21:22 |
| nowen | 'getenforce' will say | 21:23 |
| joevano | i believe so.. let me check | 21:23 |
| joevano | not even instaled | 21:23 |
| nowen | maybe re-run setup and go through the networking again | 21:23 |
| nowen | maybe localhost isn't set for ipv6? | 21:24 |
| nowen | in /etc/hosts, eg | 21:24 |
| joevano | k, I'll make sure to snapshot it before I start messing with it | 21:24 |
| nowen | ok - i'll let you got | 21:24 |
| nowen | go | 21:24 |
| joevano | have a good weekend | 21:24 |
| nowen | twitter or email me over the weekend | 21:24 |
| nowen | I'll be in tomrrow too | 21:24 |
| joevano | will do | 21:24 |
| nowen | The most likely cause is that the key that signed the intca cert isn't in the CACerts file on the client side | 21:25 |
| nowen | says someone smarter than i | 21:25 |
| nowen | so, you might want to extract cacerts from the rpm again or something | 21:26 |
| joevano | k... I will look at that as well | 21:26 |
| nowen | k | 21:26 |
| joevano | thanks for the help today | 21:26 |
| nowen | sorry for the problems! | 21:26 |
| *** nowen has quit (Quit: Leaving.) | 22:13 | |
Generated by irclog2html.py 2.11.0 by Marius Gedminas - find it at mg.pov.lt!
