Adding second Policy Server pointing to the same Policy and Key Store

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On
• SITEMINDER

Issue/Introduction

 

After adding a second Policy Server (PS2) that is pointing to the same Policy and Key Store of Policy Server 1 (PS1) to the HCO, the below errors in the Policy Server smtracedefault.log start to show up:

  [02/15/2019][10:21:55.503][10:21:55][3136][6008][CServer.cpp:2132][][][][][][][][][][][][][][][][][][][][][]
  [LogMessage:ERROR:[sm-Tunnel-00050] Handshake error: Shared secret incorrect for this client]
  [][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]

  [02/15/2019][10:21:55.503][10:21:55][3136][6008][CServer.cpp:2078][GetSecretFunc][][][][][][][][][][][][][][][][][][][][]
  [Error while fetching previous secret for the Agent abc][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]

Cause

 

The encryption is not the same on both Policy Servers. Comparing the content of the EncryptionKey.txt on both Policy Server shows that they aren't the same.

 

Environment

 

Siteminder 12.8 SP1 on Windows 2012 R2

 

Resolution

 

1. Ensure that the Enable Agent Key Generation is disabled on the second policy server 2(PS2);
2. Stop Policy Server 2(PS2) and then take a backup of the the EncryptionKey.txt from the below directory from Policy Server and rename the EncryptionKey.txt to EncryptionKey.txt_backup (<Policy_server_install_path>)/bin folder);
3. Copy the EncryptionKey.txt from the below directory from policy server 1 (PS1) to Policy Server 2 (PS2) (<Policy_server_install_path>)/bin folder);
4. Restart the Policy Server;
5. Re-enter the password for the DSNs for all the configured stores via the smconsole and test all connections to confirm the connection is successful;
6. Confirm that there are no more errors in the smps.log;
   
   

   Note:

   This solution is only valid for Policy Servers on Windows platforms. For Policy Servers on Linux platforms, please follow the instructions in the documentation to rest the encryption key (1).

Additional Information

 

(1)

    Reset the r12.x Policy Store Encryption Key