Enabling Debug Logging - Novell ACCESS MANAGER 3.1 SP2 - IDENTITY SERVER GUIDE 2010 Manual

2b Click the name of the Embedded Service Provider certificate of the Access Gateway, note
the name of the Issuer, then click Close.
2c (Conditional) If you do not know the names of these certificates, see
"Certificate Names," on page
3 To verify the trusted root for the Identity Server, click Devices > Identity Servers > Edit >
Security > NIDP Trust Store.
4 In the Trusted Roots section, scan for a certificate subject that matches the issuer of the
Embedded Service Provider certificate, then click its name.
If the Issuer has the same name as the Subject name, then this certificate is the root

certificate.
If the Issuer has a different name than the Subject name, the certificate is an intermediate

certificate in the chain. Click Close, and make sure another certificate in the trust store is
the root certificate. If it isn't there, you need to import it and any other intermediate
certificates between the one you have and the root certificate.
5 To verify the trusted root for the Embedded Service Provider, click Devices > Access Gateways
> Edit > > Service Provider Certificates > Trusted Roots.
6 In the Trusted Roots section, scan for a certificate subject that matches the issuer of the Identity
Server certificate, then click its name.
If the Issuer has the same name as the Subject name, then this certificate is the root

certificate.
 If the Issuer has a different name than the Subject name, the certificate is an intermediate
certificate in the chain. Click Close, and make sure another certificate in the trust store is
the root certificate. If it isn't there, you need to import it and any other intermediate
certificates between the one you have and the root certificate.
7 (Optional) If you have clustered your Identity Servers and Access Gateways and you are
concerned that not all members of the cluster are using the correct trusted root certificates, you
can re-push the certificates to the cluster members.
7a Click Auditing > Troubleshooting > Certificates.
7b Select the Trust Store of your Identity Servers and Access Gateways, then click Re-push
certificates.
7c Update the Identity Severs and Access Gateways.
7d Check the command status of each device to ensure that the certificate was pushed to the
device. From the Identity Servers page or the Access Gateways page, click the Commands
link.
To view sample log entries that are logged to the
is missing, see
page 356.

15.2.5 Enabling Debug Logging

You can enable Identity Server logging to dump more verbose Liberty information to the
catalina.out
Gateway.
1 In the Administration Console, click Devices > Identity Servers > Edit > Logging.
354 Novell Access Manager 3.1 SP2 Identity Server Guide
"Trusted Roots Are Not Imported into the Appropriate Trusted Root Containers" on
file on both the Identity Server and the Embedded Service Provider of the Access
352.
catalina.out
Section 15.2.3,
file when a trusted root certificate