Installing Janssen on AWS multi-tenant

[BainMcKay]

Following the installation procedure that worked on DigitalOcean, with adjustments for AWS EC2 tenant config, I get the error on setup.py. below is after I rebooted and ran setup.py again, I already responded to the installation questions. It failed on OpenDJ. So I tried various approaches, including installing ldap3. although I am trying anything at this point. Maybe I should manually instal openDJ?. What am I missing?

python3 /opt/jans/jans-setup/setup.py
Please wait while collecting properties...
Traceback (most recent call last):
File "/opt/jans/jans-setup/setup.py", line 240, in <module>
collectProperties.collect()
File "/opt/jans/jans-setup/setup_app/utils/collect_properties.py", line 120, in collect dbUtils.bind()
' File "/opt/jans/jans-setup/setup_app/utils/db_utils.py", line 87, in bind self.ldap_conn.bind() File "/usr/lib/python3/dist-packages/ldap3/core/connection.py", line 582, in bind self.open(read_server_info=False) File "/usr/lib/python3/dist-packages/ldap3/strategy/sync.py", line 56, in open BaseStrategy.open(self, reset_usage, read_server_info) File "/usr/lib/python3/dist-packages/ldap3/strategy/base.py", line 145, in open raise exception_history[0][0] ldap3.core.exceptions.LDAPSocketOpenError: socket connection error while opening: [Errno 111] Connection refused`

Is there a special port I need to use for Janssen on Amazon AWS EC2 for Tenant UI?

I have other apps installed on EC2 without issue

SSL Checker is valid for the domain

[BainMcKay]

I added port 1636 to the Tenant UI (security group), but get the same error: The LDAP (OpenDJ) installation/config is trimming out a socket error.

Any guidance?

[nynymike]

In this deployment, you are using LDAP as the database? If so, do you see any errors in the OpenDJ logs, /opt/opendj/logs ? Do you see it running on port 1636 when you do a netstat -antlp | grep LISTEN or ps -ef | grep ldap ?

[BainMcKay]

I just did [lsof] and it shows openldap on port 389. Im not sure if this is AWS default? Should I manually install OpenDJ in 1636?

[BainMcKay]

Yes. I am using OpenDJ.

Here;s the4 openJ error log

and here's the LSOF

Tenant UI - Security Group

[nynymike]

FQDN = localhost is not support. It says that in the docs.

[BainMcKay]

Am I missing a config. Where do you see FQDN = localhost?

I think I see what happened . I use the ElasticIP for web facing iP. It can be reassigned. It may Havel Either that or I didn't put the Elastic IP address into the installer which would default a private address .

I am testing that now,

[BainMcKay]

I installed on a new server. I used the public ElasticIP address. Same issue

Here is the openDJ log

/opt/opendj/logs# cat errors
[28/Dec/2023:23:57:57 +0000] category=JVM severity=NOTICE msgID=21 msg=Installation Directory: /opt/opendj
[28/Dec/2023:23:57:57 +0000] category=JVM severity=NOTICE msgID=23 msg=Instance Directory: /opt/opendj
[28/Dec/2023:23:57:57 +0000] category=JVM severity=NOTICE msgID=17 msg=JVM Information: 17.0.9+8-LTS by Amazon.com Inc., 64-bit architecture, 2080374784 bytes heap size
[28/Dec/2023:23:57:57 +0000] category=JVM severity=NOTICE msgID=18 msg=JVM Host: awsgluu.kayviumdev.com, running Linux 6.2.0-1017-aws amd64, 8315715584 bytes physical memory size, number of processors available 2
[28/Dec/2023:23:57:57 +0000] category=JVM severity=NOTICE msgID=19 msg=JVM Arguments: "--add-exports=java.base/sun.security.x509=ALL-UNNAMED", "--add-exports=java.base/sun.security.tools.keytool=ALL-UNNAMED", "-Dorg.opends.server.scriptName=start-ds"
[28/Dec/2023:23:57:58 +0000] category=BACKEND severity=NOTICE msgID=513 msg=The database backend userRoot containing 0 entries has started
[28/Dec/2023:23:57:58 +0000] category=EXTENSIONS severity=NOTICE msgID=221 msg=DIGEST-MD5 SASL mechanism using a server fully qualified domain name of: localhost
[29/Dec/2023:00:04:30 +0000] category=CORE severity=NOTICE msgID=135 msg=The Directory Server has started successfully
[29/Dec/2023:00:04:30 +0000] category=CORE severity=NOTICE msgID=139 msg=The Directory Server has sent an alert notification generated by class org.opends.server.core.DirectoryServer (alert type org.opends.server.DirectoryServerStarted, alert ID org.opends.messages.core-135): The Directory Server has started successfully
[29/Dec/2023:00:04:30 +0000] category=PROTOCOL severity=NOTICE msgID=276 msg=Started listening for new connections on LDAPS Connection Handler 0.0.0.0 port 1636
[29/Dec/2023:00:04:30 +0000] category=PROTOCOL severity=NOTICE msgID=276 msg=Started listening for new connections on Administration Connector 0.0.0.0 port 4444
[29/Dec/2023:00:04:30 +0000] category=PROTOCOL severity=NOTICE msgID=276 msg=Started listening for new connections on LDAP Connection Handler 0.0.0.0 port 1389
[29/Dec/2023:00:04:33 +0000] category=CORE severity=NOTICE msgID=139 msg=The Directory Server has sent an alert notification generated by class org.opends.server.core.DirectoryServer (alert type org.opends.server.DirectoryServerShutdown, alert ID org.opends.messages.core-141): The Directory Server has started the shutdown process. The shutdown was initiated by an instance of class org.opends.server.core.DirectoryServerShutdownHook and the reason provided for the shutdown was The Directory Server shutdown hook detected that the JVM is shutting down. This generally indicates that JVM received an external request to stop (e.g., through a kill signal)
[29/Dec/2023:00:04:33 +0000] category=PROTOCOL severity=NOTICE msgID=277 msg=Stopped listening for new connections on LDAP Connection Handler 0.0.0.0 port 1389
[29/Dec/2023:00:04:33 +0000] category=PROTOCOL severity=NOTICE msgID=277 msg=Stopped listening for new connections on LDAPS Connection Handler 0.0.0.0 port 1636
[29/Dec/2023:00:04:33 +0000] category=PROTOCOL severity=NOTICE msgID=277 msg=Stopped listening for new connections on Administration Connector 0.0.0.0 port 4444
[29/Dec/2023:00:04:35 +0000] category=BACKEND severity=NOTICE msgID=370 msg=The backend userRoot is now taken offline
[29/Dec/2023:00:04:35 +0000] category=CORE severity=NOTICE msgID=203 msg=The Directory Server is now stopped
[29/Dec/2023:00:04:41 +0000] category=JVM severity=NOTICE msgID=21 msg=Installation Directory: /opt/opendj
[29/Dec/2023:00:04:41 +0000] category=JVM severity=NOTICE msgID=23 msg=Instance Directory: /opt/opendj
[29/Dec/2023:00:04:41 +0000] category=JVM severity=NOTICE msgID=17 msg=JVM Information: 17.0.9+8-LTS by Amazon.com Inc., 64-bit architecture, 1373634560 bytes heap size
[29/Dec/2023:00:04:41 +0000] category=JVM severity=NOTICE msgID=18 msg=JVM Host: awsgluu.kayviumdev.com, running Linux 6.2.0-1017-aws amd64, 8315715584 bytes physical memory size, number of processors available 2
[29/Dec/2023:00:04:41 +0000] category=JVM severity=NOTICE msgID=19 msg=JVM Arguments: "-Xms1309m", "-Xmx1309m", "--add-exports=java.base/sun.security.x509=ALL-UNNAMED", "--add-exports=java.base/sun.security.tools.keytool=ALL-UNNAMED", "-Dorg.opends.server.scriptName=start-ds"
[29/Dec/2023:00:04:42 +0000] category=BACKEND severity=NOTICE msgID=513 msg=The database backend userRoot containing 0 entries has started
[29/Dec/2023:00:04:42 +0000] category=EXTENSIONS severity=NOTICE msgID=221 msg=DIGEST-MD5 SASL mechanism using a server fully qualified domain name of: localhost

======
HERE's the SETUP log

root@ip-172-31-9-76:/opt/jans/jans-setup/logs# cat setup_error.log
23:57:26 12/28/23 Configuring system
23:57:33 12/28/23 Generating 256 bit EC (secp256r1) key pair and self-signed certificate (SHA256withECDSA) with a validity of 3,650 days
for: CN=SMTP CA Certificate

23:57:33 12/28/23 Error rendering encode script
23:57:34 12/28/23 update-rc.d: error: unable to read /etc/init.d/rsyslog

23:57:34 12/28/23 update-rc.d: error: cannot find a LSB script for rsyslog

00:09:29 12/29/23 FATAL
00:09:29 12/29/23 Traceback (most recent call last):
File "/opt/jans/jans-setup/setup.py", line 413, in do_installation
openDjInstaller.start_installation()
File "/opt/jans/jans-setup/setup_app/installers/base.py", line 38, in start_installation
self.install()
File "/opt/jans/jans-setup/setup_app/installers/opendj.py", line 61, in install
self.dbUtils.bind()
File "/opt/jans/jans-setup/setup_app/utils/db_utils.py", line 87, in bind
self.ldap_conn.bind()
File "/usr/lib/python3/dist-packages/ldap3/core/connection.py", line 582, in bind
self.open(read_server_info=False)
File "/usr/lib/python3/dist-packages/ldap3/strategy/sync.py", line 56, in open
BaseStrategy.open(self, reset_usage, read_server_info)
File "/usr/lib/python3/dist-packages/ldap3/strategy/base.py", line 145, in open
raise exception_history[0][0]
ldap3.core.exceptions.LDAPSocketOpenError: socket connection error while opening: [Errno 111] Connection refused