Cannot access any metrics when WebLogic domain administration port is configured

[serafeimk]

Steps to reproduce:

• setup a WebLogic domain with Administration port configured
• deploy wls-exporter.war into one managed server with embedded yaml file. Its head section contains only the metricsNameSnakeCase: true directive which is followed by the queries section.
• access /wls-exporter/metrics page via a GET request. HTTP 403 error code is returned along with the text response "Not authorized". There is no prompt for basic authentication.

[russgold]

That version of the exporter are you using? Older versions did not support https

[serafeimk]

We are using the 1.3.0 version of exporter under WebLogic 12.2.1.3. Even by invoking the URL /wls-exporter/metrics page using HTTP/s returns 403 and still no prompt for authentication.

[russgold]

What do you see at /wls-exporter/messages after you get the 403?

[serafeimk]

Just the "Not authorized" message. Are there are debugging options that we can leverage to increase logging ?

[lennyphan]

can you try setting the wls-exporter application in 'admin' state and then see if you can access it on the admin port? Is there a reason you want to access the exporter metrics via admin port and not through the http/https ports?

[serafeimk]

Lenny,

many thanks for the response. After placing the app into admin state and accessing the URL /wls-exporter/metrics via the administration channel, we are constantly requested for providing the basic authentication credentials. Even though we submit correct credentials for the WLS domain administrator account, we are prompted again and again.

[lennyphan]

That's very strange. Lets try and enable security debugging for authentication to see if it provides any information on why it's not accepting the credentials. You can either use system property on the managed server:

-Dweblogic.debug.DebugSecurityAtn=true

or

in the admin server console:

1. Go to Servers > server_Instance.
2. Select WebLogic > Security > atn > DebugSecurityAtn
3. Click the Enable button.

[serafeimk]

The server log is attached after enabling the debugging flag. Still not sure what is going wrong. The user authenticated is 'jenkins' granted the WLS 'Administrators' group.
debugatn.log

[lennyphan]

Is user 'jenkins' (with password) the credentials used when submitting when prompted? The log doesn't show anything that helps pinpoint what is going wrong. Are you able to access the Admin Server console and login through the administration port?

[serafeimk]

That's correct. We use account 'jenkins' for accessing Admin Server console (in administration port) Additionally, we tried to access the /wls-exporter/metrics URL using the 'weblogic' account but no effect: the basic authentication window keeps popping up.

[russgold]

So you have two ports open now? The admin port and the SSL port? And you are querying the exporter on the SSL port?

If so, please try this. Add restPort to your configuration and have it point to the admin port. Then try to access the exporter on the SSL port.

This appears to be a gap in our documentation.

[serafeimk]

After setting the 'restPort' pointing to the managed server administration port and accessing the metrics URL in the SSL port, we still cannot access the metrics, as the basic authentication popup repeatively shows up, after submitting correct credentials.

[lmpampaletakis]

Same issue here

[russgold]

Same issue here

Impampaletakis, which issue are you having? I'm hearing two different ones, now.

[lmpampaletakis]

When the admin port is enabled to the weblogic domain, trying to access /metrics is not feasible, using the SSL port of the managed server, The error I get is HTTP 403 Forbidden.