The server uses alarms and alerts to notify administrators of situations that might require intervention.
Policy Decision Service unavailable
- API Security Gateway
- Sideband API
- SCIM 2
- Authorization Policy Decision APIs
The alarm message typically indicates the cause for the Policy Decision Service's
UNAVAILABLE state. The administrator should check the Policy Decision Service
trust-framework-version properties to ensure that they are set
correctly and that configured deployment package stores are reachable.
Trust framework update needed
trust-framework-versionvalue. When this alarm is present, PingAuthorize does continue to accept requests. However, the administrator is strongly encouraged to take the following actions:
- Update policies to use a new Trust Framework version. See Upgrading the Trust Framework and policies.
- Export a new deployment package (if using embedded PDP mode).
- Load the updated policies and set
trust-framework-versionin the Policy Decision Service to the current version.
dsconfig set-policy-decision-service-prop \ --set trust-framework-version:v2
LDAP External Server Health Reclassified from AVAILABLE to UNAVAILABLE
The server raises this alarm if an LDAP health check determines that an LDAP external server used by the SCIM subsystem is unavailable. This can occur for a number of reasons; the most typical cause is a network or SSL connectivity problem.
External server initialization failed
You see this alarm at server startup if an LDAP health check determines that an LDAP external server used by the SCIM subsystem is unavailable. This can occur for a number of reasons; the most typical cause is a network or SSL connectivity problem.
User Store Availability
The server raises this alarm if the SCIM subsystem's UserStoreAdapter is unavailable. When this alarm is present, PingAuthorize Server cannot process SCIM API requests or SCIM token resource lookup method operations. This alarm generally occurs if the underlying data stores are unavailable. To resolve this alarm, determine why the data stores are unavailable and resolve the problem.
User Store Availabilitygauge using the following command.
dsconfig set-gauge-prop \ --gauge-name "User Store Availability" \ --set enabled:false
No Enabled Alert Handlers
By default, an administrator can check for server alerts through the error log, the status tool, and the administrative console. This alarm warns the administrator that they should also configure an alert handler to ensure that the server can actively notify them of current or impending problems. The server provides alert handlers for this purpose. The handlers can deliver alerts by email or through a monitoring application using JMX or SNMP.
dsconfig create-external-server \ --server-name "SMTP Server" \ --type smtp \ --set server-host-name:<smtp.example.com> dsconfig set-global-configuration-prop \ --add "smtp-server:SMTP Server" dsconfig create-alert-handler \ --handler-name "SMTP Alert Handler" \ --type smtp \ --set enabled:true \ --set 'sender-address:email@example.com' \ --set 'recipient-address:firstname.lastname@example.org'
If you are running a nonproduction environment, you can disable this alarm by running the following dsconfig command.
dsconfig set-alarm-manager-prop \ --set suppressed-alarm:no-enabled-alert-handlers
Insecure access token validator enabled
This alarm warns the administrator that a mock access token validator is enabled. Mock access token validators can be very useful in test environments because they allow PingAuthorize Server to accept HTTP API requests without the overhead of setting up an OAuth 2 authorization server. However, because they do not actually authenticate access tokens, they are insecure and should never be used in a production environment.
The following example shows how to disable an access token validator called "Mock Token Validator."
dsconfig set-access-token-validator-prop \ --validator-name "Mock Token Validator" \ --set enabled: false
Sensitive data may be logged
This alarm warns the administrator that a trace log publisher has been configured to record debug messages. Debug log messages are not guaranteed to exclude potentially sensitive data, so their use is strongly discouraged in a production environment. You should not use them with anything but test data.
To disable a trace log publisher called "Debug Trace Logger," run this command.
dsconfig set-log-publisher-prop \ --publisher-name "Debug Trace Logger" \ --set enabled:false