Adding A Second Policy Server Pointing To The Same Policy Store and Key Store

book

Article ID: 127169

calendar_today

Updated On:

Products

CA Single Sign On Secure Proxy Server (SiteMinder) CA Single Sign On SOA Security Manager (SiteMinder) CA Single Sign-On

Issue/Introduction

After adding a second Policy server(PS2) that is pointing to the same policy store and keystore of policy server 1(PS1)to the HCO, we started observing  below errors in the siteminder policy server smtracedefault.log:

[02/15/2019][10:21:55.503][10:21:55][3136][6008][CServer.cpp:2132][][][][][][][][][][][][][][][][][][][][][][LogMessage:ERROR:[sm-Tunnel-00050] Handshake error: Shared secret incorrect for this client][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]

[02/15/2019][10:21:55.503][10:21:55][3136][6008][CServer.cpp:2078][GetSecretFunc][][][][][][][][][][][][][][][][][][][][][Error while fetching previous secret for the Agent abc][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]
 

Cause

The encryption is not the same on both Policy Servers. You can confirm this by comparing the content of the EncryptionKey.txt on both Policy Server to check if they are the same.

Environment

Siteminder 12.8 SP1 on Windows 2012 R2

Resolution

1) Ensure that the Enable Agent Key Generation is disabled on the second policy server 2(PS2)

2) Stop Policy Server 2(PS2) and then take a backup of the the EncryptionKey.txt from the below directory from policy server and rename the EncryptionKey.txt to EncryptionKey.txt_backup
(<Policy_server_install_path>)/bin folder) 

3) Copy the EncryptionKey.txt from the below directory from policy server 1(PS1) to policy server 2(PS2)
(<Policy_server_install_path>)/bin folder) 

4) Restart the Policy Server

5) Re-enter the password for the DSNs for all the configured stores via the smconsole and test test all connection to confirm the connection is successful.

6) Confirm that there are no more errors in the smps.log

Note:

This solution is only valid for Policy servers on Windows platforms. For Policy Servers on Linux platforms, please follow instructions in the documentation to rest the encryption key:

Reset the r12.x Policy Store Encryption Key
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/single-sign-on/12-8/administrating/manage-encryption-keys/reset-the-r12-x-policy-store-encryption-key.html