CLI could not contact EJBCA instance

[rso61]

I need help on this topic.
I have read all the related threads but I can not derive from one of them.

I have setup Wildfly according to https://docs.keyfactor.com/ejbca/8.3.2/wildfly-26 including

• Elyton Credential Store
• DB Driver
• Data Source
• Secured https with a cert
• Remoting
• Firewall

I have no error deploying the EAR file with ant deployear

[wildfly@deployments]$ ls -l
total 45688
-rw-------. 1 wildfly wildfly 46134433 Nov 20 16:51 ejbca.ear
-rw-r--r--. 1 wildfly wildfly        9 Nov 20 16:51 ejbca.ear.deployed
-rw-r--r--. 1 wildfly wildfly   624101 Nov 20 10:25 mariadb-java-client.jar
-rw-r--r--. 1 wildfly wildfly       23 Nov 20 10:25 mariadb-java-client.jar.deployed

I can connect to port 8443 via Browser from other host (getting an Exceptions has occured, but connects)
I tested the DS from the Wildfly Condole => works
No errors in the Wildfly server.log
I can connect to ports 9990, 8443 on localhost using curl.

But still ant runinstall fails with:

ejbca:initCA:
     [echo] Initializing CA with 'ManagementCA' 'CN=ManagementCA,O=Everyware AG,C=CH' 'soft' '<ca.tokenpassword hidden>' '4096' 'RSA' '3650' '2.5.29.32.0' 'SHA256WithRSA'   -superadmincn 'SuperAdmin'...
     [java] 11:59:20.298 [main] ERROR org.ejbca.ui.cli.infrastructure.library.CommandLibrary - Error: CLI could not contact EJBCA instance. Either your application server is not up and running, EJBCA has not been deployed successfully, or some firewall rule is blocking the CLI from the application server.
     [java]
     [java] Please be aware that most commands will not work without the application server available.
     [java]
     [java] Exception in thread "main" javax.ejb.NoSuchEJBException: EJBCLIENT000079: Unable to discover destination for request for EJB StatelessEJBLocator for "ejbca/cesecore-ejb/GlobalConfigurationSessionBean", view is interface org.cesecore.configuration.GlobalConfigurationSessionRemote, affinity is None
     [java]     at org.jboss.ejb.client.EJBClientInvocationContext.getResult(EJBClientInvocationContext.java:620)

thanks for your help!

[primetomas]

there are two things:

1. check the server.log of wildfly
2. if you configured remoting correctly, you'll see that remoting uses a different port, a number that was part of the remoting setup commands. That has to work.

[rso61]

ant runinstall should connect to which port?
using: tcpdump -i any port XXXX I can not see any traffic (where XXXX is any of 8080 8443 9090 3306 or 4447)
what am I doing wrong?

[mike-agrenius-kushner]

Hi,

ANT uses the CLI to create the initial Management CA, which in turn uses Remote EJB, which by default runs via port 4447. You can verify in jboss-ejb-client.properties to check the port used.

Cheers,
Mike

[rso61]

I installed everything from scratch. somewhere was an setup/config error.
Now I am getting a response from port 4447 using http.

But also now I am getting an authentication error

     [java]     Suppressed: javax.security.sasl.SaslException: Authentication failed: all available authentication mechanisms failed:
     [java]    JBOSS-LOCAL-USER: javax.security.sasl.SaslException: ELY05128: Failed to read challenge file [Caused by java.io.FileNotFoundException: /opt/wildfly/standalone/tmp/auth/local10433943249297720963.challenge (Permission denied)]

what credentials is the CLI expecting?
in which property file are the defined?
do the need to be configured using /opt/wildfly/bin/add-user.sh?

[mike-agrenius-kushner]

Shouldn't be, but go over how you set up Elysium in Wildfly...or could it just be a rights issue in the Wildfly directory?

[rso61]

ant runinstall needs a lot of permissions to read and write in the wildfly directory structure, This may be mentioned in the installation procedure.

[primetomas]

Does it? Like what? runinstrall does not change any wildfly configuration or copy files.
"ant deployear" copies ejbca.ear to the deployment directory, but otherwise?