7 Replies Latest reply: Sep 24, 2013 1:35 PM by Sh!va RSS

    Frequent Invalid Credential login Error to Essbase Server

    MeHyper

      We have noticed frequently invalid credentials error with  Essbase Server login via Smart View or Classic Add-In.

       

      Some interesting facts, on invalid credential error:

      1)  We can login using native Essbase Security as Admin.

      2)  Can login into Shared services via MSAD acct.

      3)  Work-space login is also functional.

      4)  Can pull MSAD user ID and accounts from Shared services.

      5) EPMCSS-00301 from shared services log.

      6) Issue will only be fixed if Essbase only service is recycled.

       

      I am pretty sure MSAD config is not the issue as other components are working upon this error and we have to recycle Essbase  only service.

       

      Any input is appreciated. There is no issue with "user Id" or "PWD"

       

      Nothing prudent from the logs as i scrubbed.

        • 1. Re: Frequent Invalid Credential login Error to Essbase Server
          JohnGoodwin

          Which version, so you can still log into essbase with native accounts when the problem starts, is there anything in the SharedServices_Security_Client.log at the time when access issues occur, do you have a large AD configured, are AD groups enabled and do you use them, have you tried setting the essbase agent logging to debug to see if anything more helpful is written out.

           

          Cheers

           

          John

          http://john-goodwin.blogspot.com/

          • 2. Re: Frequent Invalid Credential login Error to Essbase Server
            MeHyper

            HI John

            Issue occurs in EPM 11.1.2.1.106 Version of  64 Bit Essbase Server.

            Yes we can log in with Native accounts when issue occurs, just MSAD doesn't work with Essbase.

            Workspace, Shared services does work (Smart View & Classic Add-in doesn't work)

            We have to restart Essbase only Service for it to allow login's.

            I have tried setting and using enhanced login via Essbase config.

            LOGINFAILUREMESSAGEDETAILED

            AGENTLOGMESSAGELEVEL DEBUG.

             

            AD groups are set via config filter but we use native groups assigning MSAD users to Native Shared services groups created.

             

            Please review and advice.

             

            Not much Information form logs apart from EPMCSS-00301 which is generic error.  Not sure whats trigerring  Essbase (MASD) security to fail and had to restart service.

            Thu~Aug~08~11:28:53~2013~Local~ESSBASE0~~~13208~Error~(1051440)~

            Essbase user ~[XXX]~ Authentication Fails against the Shared Services Server with Error ~[EPMCSS-00301: Failed to authenticate user. Invalid credentials. Enter valid credentials.]

            Thu~Aug~08~11:28:53~2013~Local~ESSBASE0~~~13208~Warning~(1051003)~

            Error ~1051440 ~processing request ~[Login]~ - disconnecting

            Thu~Aug~08~11:29:39~2013~Local~ESSBASE0~~~10344~Warning~(1051003)~

            Error ~-1 ~processing request ~[Logout]~ - disconnecting

            Thu~Aug~08~11:30:11~2013~Local~ESSBASE0~~~18232~Info~(1051164)~EPMCSS-00301: Failed to authenticate user. Invalid credentials. Enter valid credentials.

              at com.hyperion.css.spi.impl.msad.MSADProvider.authenticate(MSADProvider.java:707)

              at com.hyperion.css.facade.impl.CSSAbstractAuthenticator.authenticateUser(CSSAbstractAuthenticator.java:686)

              at com.hyperion.css.facade.impl.CSSAPIAuthenticationImpl.authenticate(CSSAPIAuthenticationImpl.java:73)

              at com.hyperion.css.facade.impl.CSSAPIImpl.authenticate(CSSAPIImpl.java:103)

              at com.hyperion.css.facade.impl.CSSAPIImpl.login(CSSAPIImpl.java:825)

              at com.hyperion.css.facade.CSSAPIFacade.login(CSSAPIFacade.java:782)

            - Nested Exception:

            javax.naming.NoInitialContextException: Need to specify class name in environment or system property, or as an applet parameter, or in an application resource file:  java.naming.factory.initial

              at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:645)

              at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)

              at javax.naming.InitialContext.getURLOrDefaultInitCtx(InitialContext.java:325)

              at javax.naming.InitialContext.lookup(InitialContext.java:392)

              at com.hyperion.css.spi.util.jndi.pool.CSSJNDIKeyedObjectFactory.makeObject(CSSJNDIKeyedObjectFactory.java:126)

              at org.apache.commons.pool.impl.GenericKeyedObjectPool.borrowObject(GenericKeyedObjectPool.java:797)

              at com.hyperion.css.spi.util.jndi.pool.JNDIConnectionPool.getBorrowObject(JNDIConnectionPool.java:321)

              at com.hyperion.css.spi.util.jndi.pool.JNDIConnectionPool.borrowValidatedConnection(JNDIConnectionPool.java:307)

              at com.hyperion.css.spi.impl.msad.JNDIHelper.getURLContext(JNDIHelper.java:482)

              at com.hyperion.css.spi.impl.msad.JNDIHelper.getURLContext(JNDIHelper.java:453)

              at com.hyperion.css.spi.impl.msad.MSADProvider.authenticate(MSADProvider.java:463)

              at com.hyperion.css.facade.impl.CSSAbstractAuthenticator.authenticateUser(CSSAbstractAuthenticator.java:686)

              at com.hyperion.css.facade.impl.CSSAPIAuthenticationImpl.authenticate(CSSAPIAuthenticationImpl.java:73)

              at com.hyperion.css.facade.impl.CSSAPIImpl.authenticate(CSSAPIImpl.java:103)

              at com.hyperion.css.facade.impl.CSSAPIImpl.login(CSSAPIImpl.java:825)

              at com.hyperion.css.facade.CSSAPIFacade.login(CSSAPIFacade.java:782)

            Thanks

            • 3. Re: Frequent Invalid Credential login Error to Essbase Server
              JohnGoodwin

              I take it you have tried the workaround or applied the PSE in the following Oracle support doc


              Error "EPMCSS-00301: Failed To Authenticate User. Invalid credentials" Intermittently When MSAD User Logs Into Workspace. (Doc ID 1389871.1)


              I know the title says workspace but may be related, I assume you have also logged the issue with Oracle.

               

              Cheers


              John

              http://john-goodwin.blogspot.com/

              • 4. Re: Frequent Invalid Credential login Error to Essbase Server
                MeHyper

                Thanks John, I did file a SR with oracle.   One thing i did notice is "Grow Connections"  was not checked in my environment when compared to listed support doc. So did make that change.Will keep it posted. 

                 

                Regards

                Venkat

                • 5. Re: Frequent Invalid Credential login Error to Essbase Server
                  866532

                  Venkat,

                   

                  Did the changes you made work ?

                   

                  thanks

                  • 6. Re: Frequent Invalid Credential login Error to Essbase Server
                    MeHyper

                    Nope , it was deemed as development bug, will have to upgrade or downgrade latest patch to get this fixed.

                    • 7. Re: Frequent Invalid Credential login Error to Essbase Server
                      Sh!va

                      Venkat,

                       

                      Is shared services and essbase are on different box??

                       

                      Is there difference in timings for box the box...

                       

                      I may be pointing to wrong direction,but check once..

                       

                      Cheers!

                       

                      Sh!va