How does PAM determine device name and address when a new A2A client registers?

Products

• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager (PAM)

Issue/Introduction

When we install an A2A client on a device that is not configured in PAM yet, a Device will be created when the A2A client starts up for the first time and connects to the PAM server. We need to know how exactly PAM determines the device name so we can understand possible problems with a new client matching an existing device in PAM when it shouldn't, or why a new device has an address different from what we would have expected.

How are the Device Name and Address determined for a new device?

Environment

Release:
Component: CAPAMX

Resolution

This is the process for registering a new request server and device:
1. The agent sends a login request to the PAM server on startup.

2. The PAM server receives the request and determines the agent's host name and IP address as follows:
 (a) Get the originating IP from the HTTP request, specifically the X-Forwarded-For header. If there is no X-Forwarded-For header found in the incoming request, the front end web service will create one using the source IP of the incoming socket connection. Therefore PAM requires any load balancer or other network device along the route to either let the connection pass through, or set the X-Forwarded-For header to the IP address PAM should be using to connect to the agent.
 (b) Get the initial host name <host name> from the originating IP using Java method InetAddress.getHostName().
 (c) Use InetAddress.getByName(<host name>) to get an Inetaddress object <address>.
 (d) Set the final IP address to <address>.getHostAddress().
 (e) Set the final host name to <address>.getCanonicalHostName(), i.e. the FQDN, if DNS can resolve the IP.

3. If not found in PAM, create the request server entry with the IP from (d) and host name from (e).
4. If not found in PAM, create the device with Device name and Device address set to the host name from (e).

In summary, Device name and address will be the FQDN if the IP derived from the HTTP request can be resolved. If it cannot be resolved, it will be the IP.
The device name in PAM is just a label and could be changed later on. At the time of registration all PAM can do is set it to the same value as the device address.

Additional Information

Note: HTTP request header information is logged in the tomcat log (catalina.out) at log level FINER. The log level can be set, and the log file downloaded for review, on the Configuration > Diagnostics > Diagnostic Logs page. Log level FINER is recommended for short time intervals only. Do not leave the log level long term at that setting.