SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel App.

Applies to:

Siebel System Software - Version 8.0 [20405] and later
Information in this document applies to any platform.
***Checked for relevance on 27-SEP-2012***

Symptoms

When using the LDAPSecAdpt to authenticate against an Active Directory server with the BaseDN set to the root level, the Siebel application will not come up.  Examination of the Security Adapter logs shows an error pattern similar to the following when trying to search for the UserDN:
SecAdptLog API Trace 4 000000084a7719a0:0 2009-08-03 16:38:07 Ldap Utility: GetUserDn. Username=ANONUSER, Attribute=sAMAccountName, BaseDN=DC=xxxx,DC=xxxx
SecAdptLog 3rdpartyTrace 3 000000084a7719a0:0 2009-08-03 16:38:08 ldap_search_s(1094aa0, DC=thcg,DC=net, LDAP_SCOPE_BASE, (sAMAccountName=ANONUSER), ...) returns 1.
SecAdptLog 3rdpartyTrace 3 000000084a7719a0:0 2009-08-03 16:38:08 ldap_msgfree (10957f8)
SecAdptLog 3rdpartyTrace 3 000000084a7719a0:0 2009-08-03 16:38:08 ldap_unbind(1094aa0) returns 0.
SecAdptLog Memory Mgmt Trace 5 000000084a7719a0:0 2009-08-03 16:38:08 LDAP SecurityFreeErrMessage8, ErrMessage=c822828.
GenericLog GenericError 1 000000084a7719a0:0 2009-08-03 16:38:08 (secmgr.cpp (2486) err=4597538 sys=0) SBL-SEC-10018: Operations error
GenericLog GenericError 1 000000084a7719a0:0 2009-08-03 16:38:08 (secmgr.cpp (2558) err=4597521 sys=0) SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrSessionLog Error 1 000000084a7719a0:0 2009-08-03 16:38:08 (physmod.cpp (9244)) SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrSessionLog Error 1 000000084a7719a0:0 2009-08-03 16:38:08 (model.cpp (5886)) SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrCTLog Error 1 000000084a7719a0:0 2009-08-03 16:38:08 (ctxtmgr.cpp (4493)) SBL-SVC-00208: Please login first.

Cause

This behavior is being caused by how the LDAPSecAdpt, IBM LDAP Client libraries, and the Windows 2003 based Active Directory are interracting when the BaseDN is set to the root level. The fundamental issue is that Windows 2003 introduced stricter authentication/authorization requirements when attempting to access certain parts of the overall schema and resources.

When you do an LDAP search from the root of the Active Directory, you are searching everything under the root. This includes not only things like Organizational Units, Computers, etc.; but also fundamental configuration and schema entities such as:

DC=Configuration,DC=domain,DC=net
DC=DomainDnsZones,DC=domain,DC=net

It is the fact that the application user does not have adequate access to these types of entities that is causing the behavior.

Solution

This behavior is due to the fact that the LDAPSecAdpt is attempting to search hidden/system containers to which it does not have access. Since you are not using PropagateChange=True to make changes to the AD from the Siebel application and the Active Directory in question has Global Catalog functionality enabled, the best workaround at this time is to point the LDAPSecAdpt to the Global Catalog port of 3268.

1. Login to an employee facing, high interactivity Siebel application (e.g. Sales, Call Center, etc.) as an administrator.

2. Navigate to Site Map > Administration - Server Configuration > Enterprises > Profile Configuration.

3. Make sure the correct Siebel Enterprise is selected in the top applet.

4. In the middle applet query for LDAPSecAdpt (or whatever name you have given your LDAP Security Adapter).

5. In the bottom applet find the Port parameter and change it to 3268.

6. Step off to save the change and logout of the Siebel application.

7. Stop and restart the Siebel Server service(s) and the Siebel Gateway service.

There are limitations when using the Global Catalog with Siebel. In summary, you have to set the PropagateChange parameter on the LDAPSecAdpt to False. This means you will not be able to update anything in the Active Directory (for example passwords) from the Siebel application. For more in-depth information, please see the following on My Oracle Support:

"ADSI Authentication Using Global Catalog Port 3268 (Doc ID 517259.1)"

"With Windows Integrated Authentication based SSO, can we have users from multiple domains? (Doc ID 834759.1)"

If you require PropagateChange = True in your implementation, then the Global Catalog workaround above will not work.  There are several options in this case:

1. If your Siebel application servers are running on a Windows operating system, you could switch to the ADSISecAdpt.
   
   
2. Drop the BaseDN down one level.  It is important that all the Siebel users (including the anonymous user in eapps.cfg) be in or under the BaseDN your specify.
   
   
3. Make the application user specified in the LDAPSecAdpt's ApplicationUser parameter a Domain Administrator within the Active Directory.

Applies to:

Siebel CRM - Version: 8.1.1 [21112] and later   [Release: V8 and later ]
Information in this document applies to any platform.

Symptoms

Customer is unable to see the login screen and the following errors are found in the OM log:
SecAdptLog API Trace 4 000000034d3520f3:0 2011-01-18 15:11:32 DB SecurityLogin with username=SADMIN, parameters=3ae0e00.
SecAdptLog Debug 5 000000034d3520f3:0 2011-01-18 15:11:32 DB security adapter: Load data source configuration
ObjMgrDBConnLog Create 5 000000034d3520f3:0 2011-01-18 15:11:33 DataBase Connection Object was created at 3cdeb90; DB User: 'SADMIN'
ObjMgrLog Error 1 000000034d3520f3:0 2011-01-18 15:11:33 (oracon.cpp (3122)) SBL-DBC-00107: An Oracle database error has occurred.
Please continue or ask your systems administrator to check your application configuration if the problem persists.
SecAdptLog API Trace 4 000000034d3520f3:0 2011-01-18 15:11:33 Security DB user connect to DB CRM with username=SADMIN returns err 65535 and connection 3cdeb90.
SecAdptLog API Trace 4 000000034d3520f3:0 2011-01-18 15:11:33 Security DB user delete DB connectoin 3cdeb90
ObjMgrDBConnLog Delete 5 000000034d3520f3:0 2011-01-18 15:11:33 DataBase Connection was deleted at 3cdeb90
GenericLog GenericError 1 000000034d3520f3:0 2011-01-18 15:11:33 (secmgr.cpp (2676) err=4597538 sys=0) SBL-SEC-10018: An Oracle database error has occurred.
Please continue or ask your systems administrator to check your application configuration if the problem persists.(SBL-DBC-00107)

SecAdptLog Memory Mgmt Trace 5 000000034d3520f3:0 2011-01-18 15:11:33 DB SecurityFreeErrMessage, message=<?INT?>.
GenericLog GenericError 1 000000034d3520f3:0 2011-01-18 15:11:33 (secmgr.cpp (2750) err=4597521 sys=0) SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrSessionLog Error 1 000000034d3520f3:0 2011-01-18 15:11:33 (physmod.cpp (9330)) SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrSessionLog Error 1 000000034d3520f3:0 2011-01-18 15:11:33 (model.cpp (5890)) SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrSessionLog ObjMgrLogin 3 000000034d3520f3:0 2011-01-18 15:11:33 Login failed for Login name : SADMIN

Cause

During the investigation, the customer confirmed that they are able to connect using sqlplus and odbcsql with the SADMIN credentials. However, the login page does not appear.

Subsequent investigation reveals that customer has installed an Oracle DatavaseInstant Client instead of a full version of the Oracle database client software.

Solution

1. Request customer to download the 'Oracle Database 11g Release 2 Client (11.2.0.1.0) for HP-UX Itanium
hpia64_11gR2_client32.zip (32-bit)' from http://www.oracle.com/technetwork/database/enterprise-edition/downloads/112010-hpisoft-097214.html

2. Install the Oracle client package and set the SHLIB_PATH before restarting the Siebel Services

References

NOTE:476703.1 - What Are the Steps To Troubleshoot the Error Message: The Server You Are Accessing is Either Busy or Experiencing Difficulties...in a Siebel Web Client User Browser?
NOTE:1085793.1 - Servers won't start; gateway throws error: "Fatal error (2555922): Could not open connection to Siebel Gateway configuration store

Applies to:

Siebel Communications CRM Call Center, SPE - Version: 8.1.1 SIA [21111] and later   [Release: V8 and later ]
Information in this document applies to any platform.

Symptoms

After installing SIA 8.1.1 on Oracle 10.2.0.4 database, customer found that they are unable to connect using web client. In the OM logs, we found the following errors:
SecAdptLog API Trace 4 0000000449be4182:0 2009-03-16 17:36:01 DB SecurityLogin with username=sadmin, parameters=3ab1210.
SecAdptLog Debug 5 0000000449be4182:0 2009-03-16 17:36:01 DB security adapter: Load data source configuration
SecAdptLog Debug 5 0000000449be4182:0 2009-03-16 17:36:01 DB security adapter: Could not load or initialize data source ServerDataSrc, err=65535.
SecAdptLog API Trace 4 0000000449be4182:0 2009-03-16 17:36:01 Security DB user delete DB connectoin 0
GenericLog GenericError 1 0000000449be4182:0 2009-03-16 17:36:01 (secmgr.cpp (2676) err=4597538 sys=0) SBL-SEC-10018: Can't load sscdo90(SBL-GEN-02500)
..
GenericLog GenericError 1 0000000449be4182:0 2009-03-16 17:36:01 (secmgr.cpp (2750) err=4597521 sys=0) SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrSessionLog Error 1 0000000449be4182:0 2009-03-16 17:36:01 (physmod.cpp (9330)) SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
ObjMgrSessionLog ObjMgrLogin 3 0000000449be4182:0 2009-03-16 17:36:01 Login failed for Login name : sadmin

Cause

It was found that the customer was using Oracle 10g client, which is not supported with Siebel 8.1.1 - please check Siebel System Requirements and Supported Platforms Documentation for details.

Solution

The customer was advised to install a supported Oracle 11g client, however after installing Oracle 11.1.0.6 client, the lib32 (32-bit libraries) directory was not present. This is a known issue for this client version on HP-UX Itanium:
see Document 471476.1 for more details.
To workaround the behavior, customer installed Oracle 11.1.0.7 database client.

Applies to:

Siebel CRM - Version 8.1.1 SIA [21111] and later
Information in this document applies to any platform.

Symptoms

1) Gateway Server is running on Node A and the Siebel Server  is running on Node A. No Problems.
2) Take offline the Siebel Server on Node A
3) Take offline the Gateway Server on Node A
4) Move the Gateway Server to Node B, and have it online
5) Bring online the Siebel Server on Node A, it fails
6) Move the Gateway Server back to Node A
7) Bring online the Siebel Server on Node A, it works

Cause

All Siebel Servers installed into an Enterprise Server use the same ODBC data source, including the Gateway Server service since the Siebel version 8.1.x. The name for the ODBC data source is <enterprise_name>_DSN; this is the format used since the Siebel version 8.0.x.

In the customer environment, the Gateway Server was installed on g:\ drive, and the Siebel Server installed on the h:\ drive. Both installations were done while in the same Node A.

The ODBC data source which was last created was the one produced by the Siebel Server installation, which overwrote the initial ODBC data source produced by the Gateway Server installation.

Under this condition, the ODBC data source driver which driver is located under the Siebel Server installation directory will not available when the two resources are not running on the same node as the ODBC driver used by the Gateway Server is pointing to the driver located under the Siebel Server installation.

In the nameserver_audit.log that there was an error message saying that authentication was failing, and there was another error saying that driver could not be loaded.

In the nameserver.log the following error messages were found:

GenericLog GenericError 1 0000000c4b1f1808:0 2009-12-09 11:35:01 (secmgr.cpp (2679) err=4597538 sys=0) SBL-SEC-10018: data source connect string or table owner is empty.

GenericLog GenericError 1 0000000c4b1f1808:0 2009-12-09 11:35:01 (secmgr.cpp (2751) err=4597521 sys=0) SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.

Solution

In order to resolve the issue it is necessary to re-run the Siebel Enterprise Configuration wizard to recreate the ODBC DSN for the Gateway Server service. However, this can be only executed once during the initial installation.

Follow the steps below to recreate the ODBC DSN used by the Gateway Server service, and make the necessary changes to have two independent ODBC DSNs:

1) Have the Gateway Server service and Siebel Server service moved to the same node where both services can run without issues
2) Make sure both services are stopped
3) Rename the siebns.dat to siebns.old, and take a backup copy for safety reasons
4) Download the empty siebns.dat <<emptysiebns>> attached to this document, rename it to siebns.dat, and place it in the Gateway Server installation
5) Start the Gateway Server service
6) Execute the Siebel Enterprise Configuration wizard, and choose Configure Product in Live Mode
    6.1) Choose Create New Configuration and click Next
    6.2) Choose Configure a New Enterprise in a Gateway Name Server
    6.3) Provide the parameters as initially informed when the Enterprise was first configured, but inform a different Enterprise name, for example, dummy. If you provide the same Enterprise name, the already existing ODBC DSN for the Siebel Server will be overwritten.
7) Go to Administrative Tools > Data Sources (ODBC), click on System DSN tab, and choose the ODBC DSN which was created by the wizard on step 6. Following the example, if you entered dummy as the Enterprise name, you should find dummy_DSN in the System DSN tab.
8) Click on Configure button, rename the ODBC DSN to <enterprise name>_GTWY_DSN, for example: SBA_81_GTWY_DSN
9) Stop the Gateway Server service
10) Delete the siebns.dat created on step 6 above.
11) Rename the siebns.old (see step 3) to siebns.dat
12) Open the gateway.cfg file located under the gtwysrvr/bin directory with a text editor, and modify the ConnectString in the [ServerDataSrc] section to match the ODBC DSN name defined by you on step 8
13) Export the following registry keys and import them into the other cluster nodes:

HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBCINST.INI\Siebel Oracle90 <gateway server installation root directory>

HKEY_LOCAL_MACHINE\SOFTWARE\ODBC\ODBC.INI\<ODBC DSN Name as set on step 8>

--

The Bug 10643382 has been logged to have the ODBC DSN creation in the cluster_gtwy.bat

Please note, you can rename the ODBC DSN as described above after the Gateway Server creation and before the Siebel Server configuration. These are the two points where the ODBC DSN are created; the latter Siebel Server configuration will overwrite the ODBC DSN created for the Gateway Server.

Applies to:

Siebel System Software - Version: 8.1.1.1 SIA [21211] and later   [Release: V8 and later ]
Information in this document applies to any platform.

Symptoms

In Siebel 8.1, customer was attempting to authenticate with external security adapter authentication (LDAPSecAdpt or ADSISecAdpt). The process was failing in the bind stage with the following error pattern:

Ldap Utility: BindAsAppUser failed due to invalid password, please check the value of ApplicationPassword parameter,

SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.
Login failed for Login name : XXXXXX

Cause

There are two common causes of this error.

1.  The password specified in the ApplicationPassword parameter in your security adapter profile does not match the password for the application user (specified in the ApplicationUserDN parameter) in the LDAP or Active Directory server.

2.  The value specified for the ApplicationUserDN parameter does not match a valid user in your LDAP or Active Directory server.

Solution

If the cause is a password mismatch, the solution is to simply update the ApplicationPassword parameter with the correct password.  In most cases you will not even need to restart the services.  You will just need to create a new clean connection with a new session.

If the cause is an invalid user, first check for typographical errors done when entering the ApplicationUserDN parameter value.  If present, correct the errors and test the behavior again.

If the issue is not a typographical error, you will need to confirm the actual fully qualified designated name (DN) of the application user in the external directory.  This is the unique value that identifies a given entry in the external directory server and its format can vary depending on external directory used and the configuration of the directory.  To determine the actual DN for an entry, check with your directory administrator or view the entry using a third party LDAP browsing tool.

The most common format for DNs on Active Directory looks similar to:

cn=Any User,ou=Siebel,dc=Fake,dc=Oracle,dc=com

With LDAP directories, there is often more flexibility as to what the fields are names and to which field forms the "key" field for determining the DN.  Some examples:

uid=Any User,cn=Siebel,o=Fake,o=Oracle.com
cn=Any User,ou=Siebel,dc=Fake,dc=Oracle,dc=com
sn=AUSER,cn=Siebel,o=Fake.Oracle.com

As you can see, the only real way to determine the correct DN is to verify the value in the Directory Server.  Normally your Active Directory or LDAP administrator can assist you with this, but if further assistance is necessary please open a service request through My Oracle Support.

Applies to:

Siebel CRM Call Center - Version: 7.8 [19021] to 7.8 [19021] - Release: V7 to V7
IBM AIX on POWER Systems (64-bit)
Product Release: V7 (Professional)
Version: 7.8.2.2 [19219]
Database: IBM DB2 8.2
Application Server OS: IBM AIX 5L 5.2
Database Server OS: IBM AIX 5L 5.2

This document was previously published as Siebel SR 38-3070043331.

Symptoms

SBL-SEC-10018 I'm unable to access the system through the dedicated client. When I attempt to login I get an 'Invalid username/password error'.

I've checked the siebel.log produced when I get the error and this gives the following:

2021 2006-06-20 09:10:10 0000-00-00 00:00:00 +0100 00000000 001 003f 0001 09 siebel 912 1168 C:\Program Files\Siebel\7.8\web client\log\siebel.log 7.8.2 [19213] ENU

GenericLog    GenericError    1    0    2006-06-20 09:10:10    (secmgr.cpp (2357) err=7010018 sys=1717) SBL-SEC-10018: Can't load sscddcli.dll(SBL-GEN-02500)


GenericLog    GenericError    1    0    2006-06-20 09:10:10    (secmgr.cpp (2429) err=7010001 sys=0) SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.

Cause

The Siebel error messages were caused by a compatibility issue between the Datawatch QSM software and the IBM DB2 Client software.

Solution

For the benefit of other users, the customer installed Visual|QSM Service Management software from Datawatch Corporation (www.datawatch.com) and began receiving the following error messages when attempting to logon to the Server datasource through either the Siebel Client or Siebel Tools:

SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.

SBL-SEC-10018: Can't load sscddcli.dll(SBL-GEN-02500)

Summary:

Further research found logging in to the Local or Sample datasources through either the Siebel Client or Siebel Tools worked, implying the error messages being returned were caused by database connectivity issues.

We attempted to configure the Server ODBC source through the Windows ODBC Data Source Administrator utility and the window that appeared was similar to the Add ^ Create a New Data Source ^ IBM DB2 Driver window.

The default IBM DB2 datasource configuration window that should appear contains two tabs titled ‘Data Source’ and ‘Advanced Settings’.

The expected IBM DB2 driver configuration window re-appeared after re-installing the IBM DB2 Client Software.

Therefore, the Siebel error messages were caused by a compatibility issue between the QSM software and the IBM DB2 Client software which adversely affected Siebel when attempting to make a database connection.

Applies to:

Siebel System Software - Version: 8.0 [20405] and later   [Release: V8 and later ]
Information in this document applies to any platform.

Symptoms

Customer reported the following:

It is not possible to log on to the Siebel CRM application using a Siebel Dedicated Web Client on one of the Application Servers in his Siebel environment. He changed all the parameters in the Siebel dedicated client CFG file found in WebClient\BIN\ENU folder.
There is no encryption software used.

From the log, the following errors were found:
GenericLog GenericError 1 000000024a6f0a10:0 2009-07-29 15:23:31 (secmgr.cpp (2486) err=4597538 sys=127) SBL-SEC-10018: Can't load sscddcli.dll(SBL-GEN-02500)

GenericLog GenericError 1 000000024a6f0a10:0 2009-07-29 15:23:31 (secmgr.cpp (2558) err=4597521 sys=0) SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.

ObjMgrSessionLog Error 1 000000024a6f0a10:0 2009-07-29 15:23:31 (physmod.cpp (9244)) SBL-DAT-00565: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.

Cause

The cause must could be related to the incorrect setting in the application .cfg file:
[ServerDataSrc]
DLL = sscddcli.dll

This is not correct for Oracle RDBMS, it should be sscdo90.dll


[ServerDataSrc]
DLL = sscdo90.dll

incorrect dll settings in the Siebel dedicated client CFG file will cause failures to connect to the Siebel database.

Solution

For the benefit of other readers:

After changing the application CFG:
[ServerDataSrc]
DLL = sscddcli.dll

to

[ServerDataSrc]
DLL = sscdo90.dll

Customer was able to connect using the Siebel dedicated web client.

Applies to:

Siebel System Software - Version: 7.7.2 [18325] and later   [Release: V7 and later ]
Information in this document applies to any platform.
Product Release: V7 (Enterprise)
Version: 7.7.2 [18325]
Database: Oracle 9.2.0.0
Application Server OS: Microsoft Windows 2003 Server SP2
Database Server OS: Microsoft Windows 2003 Server SP2

This document was previously published as Siebel SR 38-3330680661.

Symptoms

SBL-SEC-10001We just installed 77 base software and we are noticing the attached errors on the object managers. There were no errors during the installation. When the thin client was not coming up, we tried to login through the dedicated web client and through tools and were getting the following error.
SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.

We are able to connect through the oracle sql plus client and also validate the db connectivity using tnsping without any errors. We are having this issue only when connecting through Siebel and none of the object managers are coming up.

Any help ASAP would help us a lot since we are on a very tight schedule and this needs to be resolved at the earliest.

Thank you

Cause

Configuration/ Setup

Solution

Message 1

                                                                                                   *** For the benefit of others ***

After installing Siebel Server 7.7 base and then trying to logon via the dedicated client, the following error was encountered:
SBL-SEC-10001: An internal error has occurred within the authentication subsystem for the Siebel application. Please contact your system administrator for assistance.

Siebel.log also contained these errors:
SecAdptLog    API Trace    4    0    2007-04-22 21:54:49    DB SecurityLogin with username=sadmin, parameters=581b7d0.
SecAdptLog    Debug    5    0    2007-04-22 21:54:49    DB security adapter: Load data source configuration
ObjMgrDBConnLog    Create    5    0    2007-04-22 21:54:49    DataBase Connection Object was created at 57ca160; DB User: 'sadmin'
DBCLog    DBCLogError    1    0    2007-04-22 21:54:49    OCIStmtExecute: ALTER SESSION SET "_optimizer_sortmerge_join_enabled" = false
ObjMgrLog    Error    1    0    2007-04-22 21:54:49    (oracon.cpp (3018)) SBL-DBC-00111: An error has occurred writing to a record.
Please continue or ask your systems administrator to check your application configuration if the problem persists.
SQLParseAndExecute    Execute    5    0    2007-04-22 21:54:49    ORA-02248: invalid option for ALTER SESSION

Based on research here, it was found an unsupported Database platform had been installed.
Please note that Oracle 9.2.0.0 certified for use with Siebel Server7.7.x; at the very least upgrade the Database Server to Oracle 9.2.0.4.