How to troubleshoot authentication problems.

Most common problem related to authentication is BrightStor User is not able to log on to BrightStor EB/AB. Some of the reasons and solutions are given below. In other cases, to pin out the problem, the user is advised to do as given below under the heading ôDebugging Authenticationö and send the related logs and information (if applicable) back to support for further investigation.


1) I installed BrightStor just now and I couldnÆt login to BrightStor GUI Manager.

Reason: It could be possible that the services that are responsible for authenticating the user are not running. Go to the service panel from control panel and check if BrightStor services are running specifically ôBrightStor EB Domain Serverö, ôBrightStor EB Service Controllerö, ôCA Remote Procedure Call Serverö. You can also check by going into the ôTask Managerö for application ôcaauthdö. If you donÆt find the instance of this application in Task Manager then you should stop and start the ôBrightStor EB Domain Serverö service from services panel and then try again to login into the BrightStor GUI Manager.
If the problem still exists, then open the command window and change the directory to $BXB_HOME (EB home directory) And run following commandsà

>Ca_auth ûuser getall

The output on the screen should be close to as given belowà

>User names:
> caroot

If you donÆt see at least one user ôcarootö or there is some other error while running the command then you should go to ôDebugging Authenticationö section of this document and send the appropriate logs to BrightStor support for investigation.

2) I changed my password to caroot. When I give the new password while logging in to BrightStor it gives me invalid password.

Reason 1: Your password didnÆt change at the time of setup itself. This is because one of our processes failed to change the same. There have been various reasons for it. One of them could be that your machine name has extended characters or you have a machine name in language other than English. If this is the case then you should go to Debugging Authentication section from here.

Reason 2: You may have MicrosoftÆs Service for UNIX (3.0) installed. If that were the case then you would have to indicate the support to provide you with the fix/workaround for it. You would be given a batch file that you should put in your startup folder so that it would run every time when your computer starts. Also you have to make your ôCA Remote Procedure Call Serverö as manual so that it doesnÆt start automatically as a service anymore. This problem occurs primarily because SFU has a port-mapper of its own and which conflicts with the BrightStorÆs own port-mapper.

3) I just installed the BrightStor and made it part of a Domain but I canÆt login in into BrightStor for once.
Reason: This could be possible because your discovery.cfg file under $BXB_HOME\config doesnÆt match with the one on the primary server. You have to be very particular about the case sensitivity of the names you supply. Actually you can copy should have the same discovery.cfg file on every member server.

4) I canÆt execute BrightStor commands on console. It says I donÆt have access do the same although I am the Administrator of the machine.
Reason: You donÆt have equivalence to the Primary User of the BrightStor i.e. caroot. You can easily find this out by running the following commands.

> Ca_auth ûequiv getequiv Administrator (username on machine1) machine1 (server name)
Ex. Output if you already have equivalence
C:\EB>ca_auth -equiv add nelth02 nelth02-tom caroot caroot ""
Equivalency is already there

If the output returns that you have no equivalence then you should run following commands to create equivalenceà.
>Ca_auth ûequiv whoami
>Administrator@machine1@141.202.123.121
>
>Ca_auth ûequiv add Administrator machine1 caroot caroot ôxyz (password for caroot)ö

If this command runs fine without any error condition then you have created equivalence successfully and now you can run commandÆs like ca_backup.exe, ca_restore.exe etc without any problems. One thing you should be aware off is that you have to again case-aware and use exactly the same case for <user name> and <machine name> as returned by the -whoami command.

To find out who has eqivalence to caroot
C:\EB>ca_auth -equiv getequiv
Equivalent BrightStorEB user for nelth02@nelth02-tom : caroot

Note:
If you are trying to give equivalence to a user account that is logged, then you should logout and log back in as this user.

Ca_auth usage
C:\EB>ca_auth

Usage :
ca_auth [-cahost host] -user add username passwd
ca_auth [-cahost host] -user delete username
ca_auth [-cahost host] -user chgpasswd username passwd
ca_auth [-cahost host] -user validate username passwd
ca_auth [-cahost host] -user group username
ca_auth [-cahost host] -user getall

Adding users
C:\EB>ca_auth -user add nelth02 (user) tom(password for the new user)

To find out the list of users after adding a new user
C:\EB>ca_auth -user getall

User names:

caroot
nelth02

Who has same rights as caroot?
C:\EB>ca_auth -equiv getequiv
Equivalent BrightStorEB user for nelth02@nelth02-tom : caroot

To delete a user
C:\EB>ca_auth -equiv delete nelth02 nelth02-tom

Msg when you donÆt have equivalance to caroot
C:\EB>ca_auth -equiv getequiv
Get equiv for nelth02@nelth02-tom failed ... reason : No equivalence exists for
this user/host pair
Debugging Authentication:

Run the following commandsà

ò ipconfig /all > ipconfig.log
ò netstat -na >netstat.log (This would let us know if the portmapper is running on his machine or not.)
ò rpcinfo.exe -p localhost >rpcinfo.log (This would let us know which BEB services have registered with the rpc server running on client machine)

Contacting portmapper for IP address=141.202.145.172

program vers proto port servicename
100000 3 udp 111 sunrpc
100000 2 udp 111 sunrpc
100000 3 tcp 111 sunrpc
100000 2 tcp 111 sunrpc
395650 1 tcp 1040 caloggerd
395644 1 tcp 1050 caservd
395649 1 tcp 1070 cadiscovd
395645 1 tcp 1087 caqd/LQServer
395647 1 tcp 1088 cadbd/LDbserver
395648 1 tcp 1106 caauthd àIf you donÆt see this you have a problem
395646 1 tcp 4869 camediad/MediaSvr

ò rpcinfo.exe -t localhost 395648 1" > caauthd.txt

program 395648 version 1 ready and waiting àIf you donÆt see this then caauthd is not working properly

Note : '>' to a file will not show the results on the screen.

Setup the following registry keysà
ò HKEY_LOCAL_MACHINE\SOFTWARE\ComputerAssociates\Cheetah\Base\LogBrightStorEB\[DWORD]DebugLogs ==1. This would create rpc.log file under $BXB_HOME\logs
You should send these files to support.

Other CA_AUTH examples:
ca_auth -equiv whoami (Show how does BrightStor sees the current logged in user. Note ûcahost option is not valid for æwhoamiÆ)

For local EB domain,
ca_auth -equiv getequiv (Show the status of equivlance of the current user to caroot)
ca_auth -equiv add Administrator machine1 caroot <caroot> <password> (To create equivalence)

If we are setting up equivalences for remote EB domain, then run the local EB domain command along with ûcahost switch.
-ca_auth -cahost remoteEBMachinename -equiv getequiv
-ca_auth -cahost remoteEBMachinename -equiv add Administrator machine1 caroot <caroot> <password>