WebUI admin login after new installation

[istrate]

Background: This only happen on Rhel 8, Alma 8, Centos 8 that uses
openldap-2.4.59-1.el8.x86_64
openldap-servers-2.4.59-1.el8.x86_64
openldap-clients-2.4.46-18.el8.x86_64

WebUI login fail with missing bindPassword="" parameter.

Failure in logs is:

[5/27/22 17:11:23:929 EEST] 00000011 LogService-148-com.ibm.ws.security.wim.adapter.ldap E CWWKE0701E: bundle com.ibm.ws.security.wim.adapter.ldap:1.0.57.cl211020210920-1900 (148)[com.ibm.ws.security.wim.adapter.ldap.LdapAdapter(352)] : The activated method has thrown an exception com.ibm.wsspi.security.wim.exception.MissingInitPropertyException: CWIML0004E: An error occurred during the user registry initialization. The initialization property bindPassword is missing from the server.xml file. Specify an initialization property in the server.xml file.

Looking in /var/lib/amlen-webui/wlp/usr/servers/ISMWebUI/ldap.xml bindPassword has an empty value:

<server description="${IMA_PRODUCTNAME_FULL} Web UI">
    <ldapRegistry id="ldap" host="127.0.0.1" port="9389" ignoreCase="true"
         reuseConnection="false"
         baseDN="ou=webui,dc=ism.ibm,dc=com" 
         bindDN="cn=Directory Manager,dc=ism.ibm,dc=com"
         bindPassword=""
                 userFilter="(&amp;(uid=%v)(objectclass=inetOrgPerson))" 
                 groupFilter="(&amp;(cn=%v)(objectclass=groupOfNames))"
         userIdMap="inetOrgPerson:uid"
         groupIdMap="*:cn"
                 ldapType="Custom">
        </ldapRegistry>
</server>

in /usr/share/amlen-webui/wlp/usr.org/servers/ISMWebUI/ldap.xml it is:

<server description="${IMA_PRODUCTNAME_FULL} Web UI">
    <ldapRegistry id="ldap" host="127.0.0.1" port="9389" ignoreCase="true"
         reuseConnection="false"
         baseDN="ou=webui,dc=ism.ibm,dc=com" 
         bindDN="cn=Directory Manager,dc=ism.ibm,dc=com"
         bindPassword="secret"
                 userFilter="(&amp;(uid=%v)(objectclass=inetOrgPerson))" 
                 groupFilter="(&amp;(cn=%v)(objectclass=groupOfNames))"
         userIdMap="inetOrgPerson:uid"
         groupIdMap="*:cn"
                 ldapType="Custom">
        </ldapRegistry>
</server>

If the empty value is filled up with secret, the 1) error goes away but once you try and login with admin/admin invalid credentials pop up.

[5/27/22 17:03:27:489 EEST] 00000022 com.ibm.ws.security.wim.registry.util.LoginBridge            E com.ibm.wsspi.security.wim.exception.WIMSystemException: CWIML4520E: The LDAP operation could not be completed. The LDAP naming exception javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]; resolved object com.sun.jndi.ldap.LdapCtx@7e7514b4 occurred during processing. 
com.ibm.wsspi.security.wim.exception.WIMSystemException: CWIML4520E: The LDAP operation could not be completed. The LDAP naming exception javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]; resolved object com.sun.jndi.ldap.LdapCtx@7e7514b4 occurred during processing.
com.ibm.ws.security.authentication.jaas.modules.UsernameAndPasswordLoginModule.login(UsernameAndPasswordLoginModule.java:76)
Caused by: com.ibm.wsspi.security.wim.exception.WIMSystemException: CWIML4520E: The LDAP operation could not be completed. The LDAP naming exception javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]; resolved object com.sun.jndi.ldap.LdapCtx@7e7514b4 occurred during processing.	
Caused by: javax.naming.AuthenticationException: [LDAP: error code 49 - Invalid Credentials]
	[5/27/22 17:03:30:330 EEST] 00000022 y.authentication.jaas.modules.UsernameAndPasswordLoginModule A CWWKS1100A: Authentication did not succeed for user ID admin. An invalid user ID or password was specified.

[jonquark]

This seems to be caused because the 'which' command is no longer installed - I'm not sure whether it was required by one of our dependencies until recently or was installed by default, but now when I build images it's no longer there.

I'll do some testing (of this and a few other reported issues) and issue an updated build - but in the mean time just add:
RUN yum -y install which
to the Dockerfile before the line that installs the imawebui.rpm

[jonquark]

Hmm. Sometimes when I build the container on almalinux 8, if java and the WebUI rpm are installed in the same transaction, when the WebUI %post install script runs, java is not in the path (which seems like an OS bug as the webui rpm depends on java).

The workaround is to add:
RUN yum -y install java-1.8.0-openjdk-headless
In your Dockerfile above the line that installs the imawebui.rpm

[jonquark]

This issue is fixed in 1.0.0.1 (reopen or file a new bug if you see similar issues)