Troubleshooting
Problem
After installing or upgrading to IBM Z Anomaly Analytics FP 5.1.1.20 or FP 5.1.1.21, when using an LDAP provider in the IzoaKeycloak security realm of Keycloak and trying to connect to keycloak via https://zoa_host:gateway_port/secadmin
logon fails with error KC-SERVICES0055.
logon fails with error KC-SERVICES0055.
Symptom
The following error is displayed in auth.stdout:
2025-05-13 12:23:17,112 ERROR [org.keycloak.services] (executor-thread-2) KC-SERVICES0055: Error when connecting to LDAP: ldaps.xxxxx.zzzzzz.co.us:636: javax.naming.CommunicationException: ldaps.xxxxx.zzzzzz.co.us:636 [Root exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
Cause
Environment variable is not setup "KC_TRUSTSTORE_PATHS"
Environment
IBM Z Anomaly Analytics FixPack 5.1.1.20 and FixPack 5.1.1.21
Diagnosing The Problem
Check the auth.stdout log for the following message:
ERROR [org.keycloak.services] (executor-thread-46) KC-SERVICES0055: Error when connecting to LDAP: ldaps.xxxxx.zzzzzz.co.us:636: javax.naming.CommunicationException: ldaps.xxxxx.zzzzzz.co.us:636 [Root exception is javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target]
Resolving The Problem
If using Podman
1. Edit bin/podmanManageZoa.sh script file.
2. Add the following line to function authUp()
-e KC_TRUSTSTORE_PATHS=/ssl/zoasvc_all.pem \
3. Restart auth container using command.
./bin/podmanManageZoa.sh restart auth
1. Edit bin/podmanManageZoa.sh script file.
2. Add the following line to function authUp()
-e KC_TRUSTSTORE_PATHS=/ssl/zoasvc_all.pem \
3. Restart auth container using command.
./bin/podmanManageZoa.sh restart auth
If using Docker
1. Edit zoacore-docker-compose.yml
2. Under auth, add the following line to the environment section:
- KC_TRUSTSTORE_PATHS=/ssl/zoasvc_all.pem
3. Restart auth container using command.
./bin/dockerManageZoa.sh restart auth
1. Edit zoacore-docker-compose.yml
2. Under auth, add the following line to the environment section:
- KC_TRUSTSTORE_PATHS=/ssl/zoasvc_all.pem
3. Restart auth container using command.
./bin/dockerManageZoa.sh restart auth
Document Location
Worldwide
[{"Type":"MASTER","Line of Business":{"code":"LOB70","label":"Z TPS"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSAJYF","label":"IBM Z Anomaly Analytics"},"ARM Category":[{"code":"a8m3p000000hBMEAA2","label":"ZAA-\u003ECERTIFICATES - SSL ENCRYPTION"},{"code":"a8m3p000000hBMWAA2","label":"ZAA-\u003ESECURITY"}],"ARM Case Number":"TS019625775","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"5.1.0"}]
Product Synonym
zAA
Was this topic helpful?
Document Information
Modified date:
25 July 2025
UID
ibm17239481