Novell ACCESS MANAGER 3.1 SP1 - ADMINISTRATION User manual

Novell®
www.novell.com
novdocx (en) 13 May 2009
AUTHORIZED DOCUMENTATION
Novell Access Manager 3.1 SP1 Event Codes
Access Manager
3.1 SP1
July 15, 2009
Event Codes

novdocx (en) 13 May 2009
Legal Notices
Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and
specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.
Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,
without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims
any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,
reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to
notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the
trade laws of other countries. You agree to comply with all export control regulations and to obtain any required
licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities on
the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws.
You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. See the
Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information on
exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export
approvals.
Copyright © 2008-2009 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied,
stored on a retrieval system, or transmitted without the express written consent of the publisher.
Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this
document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.
patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or
more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Online Documentation: To access the latest online documentation for this and other Novell products, see
the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 13 May 2009
Novell Trademarks
For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/
trademarks/tmlist.html).
Third-Party Materials
All third-party trademarks are the property of their respective owners.

4Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009

Contents 5
Contents
novdocx (en) 13 May 2009
About This Guide 7
1 Event Code Overview 9
2 Administration Console (009) 11
3 Identity Server (001) 51
4 Linux Access Gateway Appliance(045) 91
5 SSL VPN Server (005) 93
6 J2EE Agents (006) 97
7 Server Communications (JCC) (007) 103
8 Policy Engine (008) 125
9 SOAP Policy Enforcement Point (011) 131
10 Backup and Restore (010) 137
11 Novell Modular Authentication Class (012) 143

6Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009

About This Guide 7
novdocx (en) 13 May 2009
About This Guide
This guide is intended to help you understand and resolve any issues with the event codes that are
displayed on error pages or logged in files.
Chapter 1, “Event Code Overview,” on page 9
Chapter 2, “Administration Console (009),” on page 11
Chapter 3, “Identity Server (001),” on page 51
Chapter 4, “Linux Access Gateway Appliance(045),” on page 91
Chapter 5, “SSL VPN Server (005),” on page 93
Chapter 6, “J2EE Agents (006),” on page 97
Chapter 7, “Server Communications (JCC) (007),” on page 103
Chapter 8, “Policy Engine (008),” on page 125
Chapter 9, “SOAP Policy Enforcement Point (011),” on page 131
Chapter 10, “Backup and Restore (010),” on page 137
Chapter 11, “Novell Modular Authentication Class (012),” on page 143
Audience
This guide is intended for Access Manager administrators. It is assumed that you have knowledge of
evolving Internet protocols, such as:
Extensible Markup Language (XML)
Simple Object Access Protocol (SOAP)
Security Assertion Markup Language (SAML)
Public Key Infrastructure (PKI) digital signature concepts and Internet security
Secure Socket Layer/Transport Layer Security (SSL/TSL)
Hypertext Transfer Protocol (HTTP and HTTPS)
Uniform Resource Identifiers (URIs)
Domain Name System (DNS)
Web Services Description Language (WSDL)
Feedback
We want to hear your comments and suggestions about this manual and the other documentation
included with this product. Please use the User Comments feature at the bottom of each page of the
online documentation, or go to www.novell.com/documentation/feedback.html and enter your
comments there.
Documentation Updates
For the most recent version of the Access Manager Event Codes Guide, visit the Novell Access
Manager Documentation Web site (http://www.novell.com/documentation/novellaccessmanager).

8Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009
Additional Documentation
Novell Access Manager 3.1 SP1 Administration Console Guide
Novell Access Manager 3.1 SP1 Identity Server Guide
Novell Access Manager 3.1 SP1 Access Gateway Guide
Novell Access Manager 3.1 SP1 Policy Management Guide
Novell Access Manager 3.1 SP1 Setup Guide
Novell Access Manager 3.1 SP1 Installation Guide
Novell Access Manager 3.1 SP1 Agent Guide
Documentation Conventions
In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and
items in a cross-reference path.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux or UNIX, should use forward slashes as required by your software.

Event Code Overview
1
9
novdocx (en) 13 May 2009
1
Event Code Overview
Event codes for Access Manager consist of 4 fields that describe the type of code and the module
that produced it:
Severity (1 digit)
1 = severe - Describes problems that needs to be resolved in order for the system to run
correctly.
2 = error - Describes that a failure occurred, but the system is operational.
3 = warn - Describes a situation that may exist that the administrator should be aware of
and may need to address. The system is currently running properly
4 = config - Describes configuration related information.
5 = info - Describes events that occur.
6 = debug - Describes execution points within the software.
9 = internal - Describes an error that is for internal use only. This error code will not be
documented in any public documentation.
Component issuing the error code (3 digits)
Sub-grouping for further classification within a component (2 digits)
Event code (three digits)
The following sections divide the event codes by component, then describe them:
Chapter 1, “Event Code Overview,” on page 9
Chapter 2, “Administration Console (009),” on page 11
Chapter 3, “Identity Server (001),” on page 51
Chapter 4, “Linux Access Gateway Appliance(045),” on page 91
Chapter 5, “SSL VPN Server (005),” on page 93
Chapter 6, “J2EE Agents (006),” on page 97
Chapter 7, “Server Communications (JCC) (007),” on page 103
Chapter 8, “Policy Engine (008),” on page 125
Chapter 9, “SOAP Policy Enforcement Point (011),” on page 131
Chapter 10, “Backup and Restore (010),” on page 137
Chapter 11, “Novell Modular Authentication Class (012),” on page 143
0 000 00 000
Severity Component field Sub-grouping Event Code

10 Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009

Administration Console (009)
2
11
novdocx (en) 13 May 2009
2
Administration Console (009)
Component 009
Subgroup 01: Certificate Manager
Subgroup 02: Application
Subgroup 03: Platform
Subgroup 04: Web UI
Subgroup 05: Roma Application
Subgroup 06: Policy
Event Code Description Remedy
Application
100901001 Error getting web manager. Cause: The Administration Console was not
installed correctly or has become corrupt.
Action: Verify installation.
100901002 Error in initializing the dirCerts APIs. Cause: The Administration Console was not
installed correctly or has become corrupt.
Specifically, the PKI and/or certificate
management jars may be missing or have
mismatched versions.
Action: Verify that the
certmgr.jar file is
contained in the
/var/opt/novell/
tomcat4/webapps/roma/WEB-INF/lib
directory and that PKI has been installed.
Verify that the Java command line contains
the following:
-Djava.library.path=/opt/novell/
lib
Verify that npki.jar is in the classpath.
100901003 Error in init. Cause: The Administration Console was not
installed correctly or has become corrupt.
Action: Verify installation.
100901004 Error in
CertHandler.getMultipartParamValue.
Cause: Servlet error when retrieving data
from a multipart form.
Action: Submit log to Novell Support for
analysis and resolution.

12 Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009
100901008 Could not remove certificate with the given
alias from the keystore.
Cause: The keystore that contains the
certificate might not exist or might have
become corrupt.
Action: View the configuration store and find
the keystore object and check that the
certificate is no longer in the key list. If it is
there, manually remove it.
Also, find the keystore on the file system of
the device and remove the key manually,
using the Java keytool program for JKS
keystores.
100901010 Error In
CertHandler.doGetSigningCertDN.
Cause: Unable to retrieve the DN of the
signing cert.
Cause: The signing cert does not exist.
Cause: The signing keystore does not exist.
Action: View the Identity Server
Configuration's Signing keystore to verify that
it exists and contains a certificate. If the
signing keystore does not exist, there has
been an error during the import of an Identity
Server or during the creation of an Identity
Server Configuration.
Check to make sure that there are no corrupt
Identity Server configurations. If the signing
keystore does exist, add or replace a
certificate.
Event Code Description Remedy

Administration Console (009) 13
novdocx (en) 13 May 2009
100901011 Error in creating or configuring one or
more of the Identity Server Configuration
cluster keystores.
Cause: Test certificates might have been
accidentally deleted from the file system.
Cause: Error communicating with the
Identity Server(s) while pushing down the
test certificates.
Action: Use the exception stack trace to
discover a more detailed description of the
error. Go to the Certificates tab and verify
that the test-connector, test-signing, test-
encryption, test-provider, test-consumer
certificates have not been deleted.
Also verify they still exist on the file system.
Go to the Trusted Roots tab and verify that
the configCA trusted root has not been
deleted and that it exists in the configuration
store. These test certificates are pushed
down to each Identity Server during the
creation of an Identity Server configuration.
You can delete the Identity Server
configuration and create a new one and add
the Identity Servers back into the new
configuration.
100901012 keystore already exists. Cause: You are trying to create a keystore
that already exists on the device.
Action: Use the existing keystore.
100901013 Error in init (using reflection to call a
method has failed in init).
Cause: The java class is unable to locate
another java class through reflection.
Action: Submit log to Novell Support for
analysis and resolution.
700901014 Cannot add non-existent key to keystore. Cause: The certificate you are trying to add
to a keystore does not exist.
Action: Specify a valid key to be added to
the keystore.
700901015 Cannot add key to non-existent keystore. Cause: The keystore does not exist.
Action: Specify a valid keystore or create
the keystore.
700901016 Could not add key to keystore because the
alias was too long.
Cause: Some platforms and keystore
formats only support a limited number of
characters in the alias name.
Action: Use a shorter alias.
Event Code Description Remedy

14 Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009
700901017 Could not add key to keystore because the
maximum number of keys has been
reached.
Cause: Many keystores allow only one key
to be contained in it because the keystore
has a specific purpose in Access Manager.
Action: Remove unused keys from the
keystore and try again.
700901020 Cannot remove non-existent key from
keystore.
Cause: The key no longer exists in Access
Manager.
Action: View the configuration store and
find the keystore object and manually
remove the key from the key list.
700901021 Cannot remove key from non-existent
keystore.
Cause: The keystore does not exist.
Action: Specify a valid keystore.
100901023 CertHandler.doGetCertFromServer: Could
not connect to server IP and port.
Cause: The server IP or DNS name and port
combination is not reachable.
Action: Verify that the IP address or DNS
name exists and that the port is correct. You
can try connecting to it with a web browser or
other utility.
100901024 CertHandler.doGetCertFromServer:
certificate was not obtained from server IP
and port.
Cause: The server IP or DNS name and port
combination had no certificate to be
presented.
Action: Verify that the IP address or DNS
name exists and that the port is correct.
Verify that the server you are attempting to
import the certificate from has a certificate.
You can try connecting to it with a web
browser or other utility.
100901025 Error in handleException. Cause: The exception reported has no
details associated with it.
Action: Scroll up in the log to see if there is a
stack trace immediately above this error,
determine what steps you had taken to
create this error condition, and submit the log
and steps to Novell Support.
100901026 The node keystore does not exist. Cannot
add cluster keys to a non-existent
keystore.
Cause: The grouping of Identity Servers
(Identity Server Configuration) or Access
Gateways is trying to locate a keystore on
one of the Identity Server or Access Gateway
devices but the keystore cannot be found.
Action: Verify that the Identity Servers and
Access Gateway devices had no errors
during import to the Administration Console.
Try to re-import the devices.
Event Code Description Remedy

Administration Console (009) 15
novdocx (en) 13 May 2009
100901027 Error in
CertHandler.getNIDPDeviceKeystoreNam
e (The name of the device's keystore was
not found).
Cause: The cluster keystore representation
object was not found.
Cause: The cluster keystore representation
did not have a device type specified.
Action: Delete and recreate the Identity
Server Configuration or Access Gateway
Group that is causing the problem and then
re-add the members.
100901028 Error in CertHandler.isTomcatCert (Unable
to determine if the specified certificate is
the one being used by Tomcat).
Cause: The certificate representation has
missing or invalid attributes.
Action: Delete this certificate and re-import
it.
100901030 Error in
CertHandler.getNodeKeystoreNames
(The cluster object was not found in the
configuration store, or the cluster server
list was empty).
Cause: The cluster object was not found in
the configuration store, the type of the cluster
could not be determined, or the cluster
server list was empty.
Action: No action needed unless your
devices are unable to communicate. If you
are having problems with communication,
delete and recreate the Identity Server
configuration or Access Gateway cluster that
is causing the problem.
100901031 Error in
CertHandler.getClusterDisplayName (The
cluster object was not found in the
configuration store).
Action: Delete and recreate the Identity
Server configuration or Access Gateway
cluster that is causing the problem and then
re-add the members.
100901032 The device does not exist but the
certificate is in a keystore assigned to that
device.
Cause: It's possible the device is in a
partially-imported state.
Action: Delete the keystore, if possible, and
re-import the device.
100901033 The device does not exist but the keystore
is assigned to that device.
Cause: It's possible the device is in a
partially-imported state.
Action: Delete the keystore, if possible, and
re-import the device.
100901034 Unable to retrieve the primary member of
the group.
Cause: The group is corrupt.
Action: Delete the group, re-create it, and
re-add the members.
100901035 Unable to remove the node keystore
setting off the Access Gateway group
device.
Cause: Could not locate the keystore object
in the configuration store.
Action: No action required.
700901036 Unable to set the Update Servers status. Cause: Communication error.
Action: Manually restart or update the
device.
Event Code Description Remedy

16 Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009
700901037 Unable to remove all keys from keystore. Cause: The keystore doesn't exist.
Cause: There is a corrupt key in the
keystore.
Action: Manually remove each certificate
from the keystore.
700901038 Unable to reinitialize keystore contents for
a particular device in a group or
configuration.
Cause: One of the device keystores does
not exist.
Action: Re-create the keystore or delete and
recreate the group or configuration and then
re-add the devices to it.
Cause: There was an error either removing
all certificates from a keystore.
Action: Manually remove all certificates from
the keystore and then remove and re-add
that device to the group/configuration.
Cause: There was an error adding the test
certificates to a keystore.
Action: Verify that the test certificates exist
(see error 1.009.01.011 for more detail).
Manually add the test certificates to the
keystore. Or remove the device from the
group/configuration and re-add it.
700901039 Unable to assess whether the keystore
contains a tomcat connector certificate.
Cause: The cluster keystore representation
does not exist or is corrupt.
Cause: Unable to locate the devices in the
group/configuration.
Action: Delete and recreate the group/
configuration and re-add the devices to it.
700901040 Error adding a key to keystore during the
renew certificate process.
Cause: The original certIficate information
could not be located.
Action: Manually create a new certificate
and place it into all the keystores which
previously held the certificate being renewed.
100901041 Unable to extract the public key from a key
during the auto-import public certificate
process.
Cause: The source keystore does not exist.
Action: Select a valid keystore.
Cause: The specified source key does not
exist.
Action: Verify that the key you have
specified to export the public certificate from
exists.
Event Code Description Remedy

Administration Console (009) 17
novdocx (en) 13 May 2009
100901042 Unable to set up the initial keys for the
cluster.
Cause: When trying to locate the cluster
keystores so that their contents can be
initialized, one or more of those keystore
representations could not be found.
Action: Delete and recreate the Identity
Server configuration or Access Gateway
cluster.
100901043 The source keystore does not exist.
Cannot push keys from a non-existent
keystore.
Cause: The source keystore does not exist.
Action: Usually the source keystore is a
cluster keystore representation. Try deleting
and recreating the Identity Server
configuration or Access Gateway cluster to
ensure those cluster keystore
representations get created.
Application
100902001 Error - Exception thrown in eventOccurred
of
vcdn.application.sc.alert.AlertEventListene
r
Cause: Cannot post alert to internal
subsystem.
Action: Non-fatal error. No action required.
100902002 Error - Exception thrown in eventOccurred
of
vcdn.application.sc.alert.AlertEventListene
r.
Cause: Cannot post alert to internal
subsystem.
Action: Submit the
app_sc.0.log file for
resolution.
100902003 Error - Exception thrown in logAlert of
vcdn.application.sc.alert.AlertLogger.
Cause: Problem occurred update the
Identity Server Alert count.
Action: Non-fatal error. May be a symptom
of a more serious condition. Submit the
app_sc.0.log file for resolution.
100902004 Error - Exception thrown in the execute
method of
vcdn.application.sc.alert.CertUpdateWork.
Cause: Could not update or read the list of
trusted server certificates.
Action: Be sure the
/var/opt/novell/
novlwww/devman.cacerts
file exists, is a
valid Java keystore, and is not corrupted. To
check its status, enter the following
command:
/opt/novell/java/bin/keytool -v -
list -keystore devman.cacerts
Otherwise, be sure the config store is
running and functioning properly.
Event Code Description Remedy

18 Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009
100902005 Error - (The specified device) has not been
imported. Failed to start device.
Cause: The Identity Server was not properly
imported.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import.
functionality works for any server type.)
Otherwise, submit the
app_sc.0.log file
for resolution.
100902006 Error importing device (with the specified
ID).
Cause: The Server was not properly
imported.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import.
functionality works for any server type.) If this
fails, reinstall the server component.
100902007 Error - Import failed. Retrying. Cause: Unable to communicate with the
Server being imported.
Action: Be sure the firewall is allowing port
1443 traffic. Otherwise allow the system to
retry for several minutes. If the server does
not appear in the Server List, click Repair
Import to resolve the issue. Otherwise,
submit the
app_sc.0.log file for resolution.
100902008 Error auto importing. Retry. Cause: Unable to communicate with the
Server being imported.
Action: Be sure the firewall is allowing port
1443 traffic. Otherwise allow the system to
retry for several minutes. If the server does
not appear in the Server List, click Repair
Import. to resolve the issue. Otherwise,
submit the
app_sc.0.log file for
resolution.
100902009 Error - Could not create subcontext:
cn=(The specified Context)
Cause: Error creating Server object in config
store during import.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import
functionality works for any server type.)
Otherwise, submit the
app_sc.0.log file
for resolution.
100902010 Error - (The given ESP) does not exist! Cause: There was a error during the
Administration Console installation.
Action: Reinstall the Administration
Console.
100902011 Error - Exception reading (the given ESP) Cause: The file required during the import
process could not be read.
Action: Be sure the indicated file can be
read by the novlwww user.
Event Code Description Remedy

Administration Console (009) 19
novdocx (en) 13 May 2009
100902012 Error - Could not import LDIF. Cause: The error occurred while creating the
configuration for the Embedded Service
Provider.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import
functionality works for any server type.)
Otherwise, submit the
app_sc.0.log file
for resolution.
100902013 Error - Could not find (the specified DN) Cause: Error connecting to the config store
while importing the Embedded Service
Provider.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import
functionality works for any server type.)
Otherwise, submit the
app_sc.0.log file
for resolution. You might need to restart the
Administration Console.
100902014 Error - ESP Configuration was not found,
so auto-import failed.
Cause: Could not find the configuration for
the imported Embedded Service Provider.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import
functionality works for any server type.)
Otherwise, submit the app_sc.0.log file
for resolution.
100902015 Error - Exception thrown in importDevice
of
vcdn.application.sc.alert.RegisterComman
d.
Cause: Error during import of server
component.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import
functionality works for any server type.)
Otherwise, submit the
app_sc.0.log file
for resolution.
100902016 Error - ImportThread null member vars. Cause: Internal error occurred during import.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import
functionality works for any server type.)
Otherwise, submit the
app_sc.0.log file
for resolution.
100902017 Error - Could not connect to eDir for certs. Cause: Either the primary Administration
Console is down (if this is a secondary
console), or the config store is down.
Action: Be sure the config store is operating
properly and that port 554 is not blocked by a
firewall.
Event Code Description Remedy

20 Novell Access Manager 3.1 SP1 Event Codes
novdocx (en) 13 May 2009
100902018 Error during execution. Cause: Error executing an external program
during import process.
Action: Go to Access Gateway Server List
and click Repair Import. (The repair import
functionality works for any server type.)
Otherwise, submit the
app_sc.0.log file
for resolution.
100902019 Error - Could not get (the given number of)
bytes of payload data.
Cause: An error occurred while trying to
read data for a command.
Action: Ensure the server component is
operating properly. Otherwise, submit the
app_sc.0.log file for resolution.
100902020 Error - VException thrown while executing
command in
vcdn.application.sc.alert.AlertCommandH
andler.
Cause: Problem executing a command from
a server component.
Action: Ensure the server component is
operating properly. Otherwise, submit the
app_sc.0.log file for resolution.
100902021 Error - VCDNException thrown in
performConfiguration of
vcdn.application.sc.config.AGApplyWork
Cause: Problem occurred while sending
configuration to Access Gateway server.
Action: Ensure the server component is
operating properly. Otherwise, submit the
app_sc.0.log file for resolution.
100902022 Error - VCDNException thrown in
responseReceived method of
vcdn.application.sc.config.AGApplyWork
Cause: Error occurred in processing the
response from an Access Gateway server.
Action: Ensure the server component is
operating properly. Otherwise, submit the
app_sc.0.log file for resolution.
100902023 Error - VCDNException thrown in
performConfiguration method of
vcdn.application.sc.config.AGConfigWork
Cause: Error occurred while sending
configuration to Access Gateway server.
Action: Ensure the server component is
operating properly. Otherwise, submit the
app_sc.0.log file for resolution.
100902024 Error - VCDNException thrown in
responseReceived method of
vcdn.application.sc.config.AGConfigWork
Cause: Error occurred in processing the
response from an Access Gateway server.
Action: Ensure the server component is
operating properly. Otherwise, submit the
app_sc.0.log file for resolution.
100902025 Error - Exception thrown in
processAGResponse method of
vcdn.application.sc.config.AGConfigWork
Cause: Error occurred in processing the
response from an Access Gateway server.
Action: Ensure the server component is
operating properly. Otherwise, submit the
app_sc.0.log file for resolution.
Event Code Description Remedy