Unified Access Gateway Admin Portal [SOLVED]

[Jesse73127]

I am trying to demo VMware Horizon vs Citrix and I am not able to get the VMW Unified Gateway to display the admin login.

I am able to verify that it is listening on the IP and port 9443 with netstat command but when I open https://INSIDE-IP-ADDRESS:9443/admin it does not display a page. I get ERR_CONNECTION_TIMED_OUT

I chose a two nic deployment during set up.

 Also, UGH, I had to use Firefox to get logged into communities.... I get a 401 error in Chrome.

- Jesse.

[vBritinUSA]

Hi Jesse, Did you assign a password on the setup?

I have the same issue with a UAG install at the moment and I am using 2111.2. But I missed this before in the past that caused the same issue.

[Jesse73127]

I did assign a password during set up for both root shell and admin portal. I am not getting a page to even log into.

[Jesse73127]

I have redeployed five times and gotten three results.

 Now I am able to get a portal page and cannot log in.

If I try to run adminpwd in cli I get the following:

WARNING: An illegal reflective access operation has occurred
WARNING: Illegal reflective access by org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom (file:/opt/vmware/gateway/lib/esmanagerlib/bc-fips-1.0.2.1.jar) to method sun.security.jca.Providers.getSunProvider()
WARNING: Please consider reporting this to the maintainers of org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider$CoreSecureRandom
WARNING: Use --illegal-access=warn to enable warnings of further illegal reflective access operations
WARNING: All illegal access operations will be denied in a future release
adminpwd: User admin does not exist

 Awesome.... I didn't want to get rid of Citrix anyway...

[sjesse]

Take a look at this if you haven't to compare what you've been doing, I know my first few installs went bad when I switched to UAGs from the older security server models

Deploying VMware Unified Access Gateway: Workspace ONE Operational Tutorial | VMware

[Jesse73127]

Thanks for the suggestion but I have read that and it doesn't give me any new information. I have been deploying along those guidelines. That also would not explain why the default admin credential is "not found" by the system.

Maybe I'll try to download an older version of the OVA.

[vBritinUSA]

I'm doing the same thing and going back a version.

[Jesse73127]

Bummer for me, I am trying to demo and the only version available for download after registering is 22.03.0.0-19550089. 

I have contacted VMware to see if they will allow me an older copy. We'll see but I am not going to just keep tryin to deploy hoping something magically changes and it goes through...

[Jesse73127]

Just for the record; I am poking around and looking in the logs I find 

/opt/vmware/gateway/logs/admin.log

And it has the following, where it tries to create the admin account. Not sure what it means except that it appears it couldn't reach some external source?

04/26 14:06:13,175+0000[main]INFO initializer.SystemSettingsInitializer[afterPropertiesSet: 47]: System set tings already created. No need to initialize
04/26 14:06:13,186+0000[main]INFO service.AdminUserService[addAdminUser: 123]: Attempting to create the adm in user: admin
04/26 14:06:13,190+0000[main]INFO utils.JCAUtil[getBouncyCastleProviderName: 41]: Getting provider name. Is Fips? true, pName BCFIPS
04/26 14:06:13,254+0000[main]INFO utils.KeystoreUtilities[<init>: 81]: Failed to load non-fips bc provider, keystore conversions will not be available.
04/26 14:06:13,719+0000[main]INFO service.AdminUserService[isValidSAMLConfigurationForAdmin: 460]: isValidS amlConfig = false
04/26 14:06:15,724+0000[main]WARN internal.Errors[logErrors: 191]: The following warnings have been detecte d: WARNING: Parameter 1 of type org.springframework.security.authentication.AuthenticationDetailsSource<java x.servlet.http.HttpServletRequest, ?> from public void org.springframework.security.web.authentication.www.B asicAuthenticationFilter.setAuthenticationDetailsSource(org.springframework.security.authentication.Authenti cationDetailsSource<javax.servlet.http.HttpServletRequest, ?>) is not resolvable to a concrete type.

04/26 14:06:15,760+0000[main]INFO Evaluators.AbstractFeatureEvaluator[handleContextRefresh: 49]: Feature evaluator: com.vmware.euc.gateway.admin.config.FeatureEvaluators.Evaluators.ProductionEvaluator@dae5e0
04/26 14:06:15,765+0000[main]INFO gateway.ServerLauncher[logStarted: 61]: Started ServerLauncher in 46.843 seconds (JVM running for 62.788)

[Jesse73127]

Hello vBrit,

 Are you by chance using a vCenter lower than version 7 in your deployment? I am wondering if that is an undisclosed pre-req?

Regards.

[vBritinUSA]

I am using vCenter 7. Not started yet as I got distracted...stay tuned.

[sjesse]

I have 2111.1 working fine on 7 update 1 just fine, I'll mess with .2 later today when I have time, I know alot of people are using that version as it further secures the log4j fixes. 

[Jesse73127]

Hello @sjesse 

Any idea on why it will not or cannot create the admin account?

I think it is absurd that they didn't just have it already created with a default that you changed at first login.

[sjesse]

It should be creating it by default, I've never seen it not, but I haven't tried 2111.2 yet I need to find time. I do know account creation problems in the past where by using supported characters in the password, though this was awhile ago.

[Jesse73127]

Hello @sjesse 

 For the record, I tried redeploy one more time and only used alpha-numeric characters. It still failed.

[vBritinUSA]

I resolved my issue. The client gave me an IP that was already in use. I was able to ping the IP but wasn't able to get to 9443, because its not the right IP...

Moving that to the front of my checklist 😕

[Jesse73127]

Okay, working with VMware support it appears that despite what it says in the deployment it requires a 16 character password.

Once deployed, everything the same except longer password, the deployment went fine.

 Here is hoping no other undisclosed gottchas.

Thanks for your attention.

[znil]

Thank you for pointing out that the password should be at least 16 characters long. In addition, at least one of the following special characters must also occur: !@$%^&+() And the usual like upper case letters, lower case letters and numbers