PASOE authentication manager Active Directory throws error "com.progress.auth.ClientPrincipalException ; Cannot find the named PAM domain service"

After changing the URL REST SERVICE fails with: "com.progress.auth.ClientPrincipalException ; Cannot find the named PAM domain service"

Apr 15, 2021
Knowledge

Title

URL Name

after-changing-the-url-rest-service-fails-with-com-progress-auth-clientprincipalexception-cannot-find-the-named-pam-domain-service

Article Number

000196094

Environment

Product: OpenEdge Verion: 12.2 OS: Windows 10

Question/Problem Description

Progress openegde pasoe REST Service protected with SAML is configured and send the token to the REST Service.

But the PASOE REST Service gives the following error:

"http_status": 500, com.progress.auth.ClientPrincipalException ; Cannot find the named PAM domain service.

Has anything been forgotten to be configured to allow the token to be excepted?

How it should be configured so that the domain (e.g. mydomain.com) will be accepted?

Steps to Reproduce

Clarifying Information

A security vulnerability was fixed between 11.7.x and 12.x that resulted in exposing the OE Domain access-codes via the oeablSecuirty.properties files. The offending 'xxxx.key' properties that contained the OE Domain access-code for the default domain property was removed and it enforced the use of the registryFile property, which is a secured store of OE Domain names and their access-codes. The registryFile option was always there, just not often used.

Error Message

"com.progress.auth.ClientPrincipalException ; Cannot find the named PAM domain service"

Defect Number

Enhancement Number

Cause

When the "@" character is present in the username the value passed to the CP, username is considered "fully qualified" the part of the username after the @ is considered to be the domain. This domain is tentatively matched with the list of domains registered in the domain registry, specified in oeablSecurity.properties.
If there's no match, the following exception is returned:
c.p.a.s.security.OERealmAuthProvider - Error creating client principal:com.progress.auth.ClientPrincipalException: Cannot find the named PAM domain service

For example:
In <webapp>/WEB-INF/oeablsecurity.properties there is:
OEClientPrincipalFilter.registryFile=domains.bin

In the the PASOE/conf/ABLDomainRegistry.keystore, there's only one entry:
mydomain.com

oepas1/logs/localhost-access.date.log shows error 500 occurs with user: test@test.xx.

For instance:
test@test.xx [2020-10-23T09:34:20.748+02:00] "GET /flexiline/web/params?type=all HTTP/1.1" 500 - flexiline:w:00000001

Resolution

To prevent ClientPrincipalException the domain (string after the @, from example above test.xx ) must be registered in domains registry file as follows:

1. Generate a binary format of the domains registry file:

#domains.csv#
<domain>,<domainAccessCode>
##

Replace <domain> and <domainAccessCode> with the appropriate values, then run:

gendomreg domains.csv ABLDomainRegistry.keystore

2. Place or replace the ABLDomainRegistry.keystore under the <PASOE_instance>/conf directory.

3. Set the OEClientPrincipalFilter.registryFile property in oeablSecurity.properties as follows:

OEClientPrincipalFilter.registryFile=ABLDomainRegistry.keystore

NOTE: If multiple domains are used, each and every domain has to be registered in the domain registry file. There is currently no wildcard support since this could make the application vulnerable to attacks.

Workaround

Notes

Progress Article(s):
PASOE: What are the changes in oeablSecurity.properties between OE 11.7 and OE 12.x ?

Keyword Phrase

Last Modified Date

7/7/2023 10:50 PM

PASOE authentication manager Active Directory throws error "com.progress.auth.ClientPrincipalException ; Cannot find the named PAM domain service"

Files(0)

Was this article helpful?

Was this article helpful?

PASOE authentication manager Active Directory throws error "com.progress.auth.ClientPrincipalException ; Cannot find the named PAM domain service"

Information

Related Articles