NetWorker: Unable to log in to NetWorker Web UI (NWUI)

• Users are unable to log in to the NetWorker Web User Interface (NWUI).
• The following error is observed in nwui.log:
  • Linux: /nsr/authc/logs/nwui.log
  • Windows (Default): C:\Program Files\EMC NetWorke\nsr\authc-server\tomcat\logs\nwui.log

ERROR c.e.n.c.n.impl.GlobalApi - Failed to authenticate user <username> with the provided password on Authentication Server <NetWorker server>. javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

This issue appears because of missing or incorrect emcauthtomcat certificate/signature in the NetWorker runtime cacerts file. For example, During certificate import, the following command was previously ran successfully:

C:\Program Files\NRE\java\jdk-17.0.18\bin>keytool.exe -import -alias emcauthtomcat -cacerts -storepass changeit -file "C:\Program Files\EMC NetWorke\nsr\authc-server\conf\emcauthcsaml.cer"

In this scenario, the issue occurs because emcauthcsaml.cer was imported into the Java cacerts truststore using the alias emcauthtomcat.

NWUI expects the Tomcat authentication certificate (emcauthctomcat.cer), not the SAML certificate, to be trusted. Importing the wrong certificate results in an SSL trust chain failure, causing the PKIX path building error.

The process outlined ensures that all the certificates required for NWUI are properly set.

1. Stop the NetWorker and NWUI services:

net stop nwui
net stop nsrexecd /y

systemctl stop nwui
nsr_shutdown

2. Change directory to your NetWorker runtime bin directory and remove the emcauthctomcat, emcnwuimonitoring, and emcnwuiserv certificates from the NetWorker runtime cacerts keystore:

cd "C:\Program Files\NRE\java\jdk-#.#.#\bin" # You must cd to your NRE java bin folder. The jdk/jre version differs depending on the NRE version installed
.\keytool.exe -delete -alias emcauthtomcat -keystore ..\lib\security\cacerts -storepass changeit
.\keytool.exe -delete -alias emcnwuimonitoring -keystore ..\lib\security\cacerts -storepass changeit

cd /opt/nre/java/latest/bin/
./keytool -delete -alias emcauthtomcat -keystore ../lib/security/cacerts -storepass changeit
./keytool -delete -alias emcnwuimonitoring -keystore ../lib/security/cacerts -storepass changeit
./keytool -delete -alias emcnwuiserv -keystore ../lib/security/cacerts -storepass changeit

3. Import the correct certificates into the Java cacerts keystore. When prompted, type `yes` to trust the certificate.

.\keytool.exe -import -alias emcauthtomcat -keystore ..\lib\security\cacerts -storepass changeit -file "C:\Program Files\EMC NetWorke\nsr\authc-server\conf\emcauthctomcat.cer"
.\keytool.exe -import -alias emcnwuimonitoring -keystore ..\lib\security\cacerts -storepass changeit -file "C:\Program Files\EMC NetWorker\nwui\monitoring\app\conf\emcnwuimonitoring.cer"

./keytool -import -alias emcauthtomcat -keystore ../lib/security/cacerts -storepass changeit -file /nsr/authc/conf/emcauthctomcat.cer
./keytool -import -alias emcnwuimonitoring -keystore ../lib/security/cacerts -storepass changeit -file /nsr/nwui/monitoring/app/conf/emcnwuimonitoring.cer
./keytool -import -alias emcnwuiserv -keystore ../lib/security/cacerts -storepass changeit -file /opt/nwui/conf/emcnwuiserv.cer

4. Start the NetWorker and NWUI services:

net start nsrexecd
net start nsrd
net start nwui

systemctl start networker
systemctl start nwui

5. After services have started log in through the NWUI interface

Authentication should complete successfully without SSL or PKIX errors.