Policy Store replication is working fine. Any objects created on PS1 is populated in the policy store and replicated to other policy stores.
But when I protect a resource in PS1 AdminUI, it is enforced in PS1 but is not on PS2.
Some created objects do not appear on the AdminUI.
Agents are not picking up the ACO changes or realm changes.
Time synchronization issue.
(In case of CA Directory, modify-on-add is missing in the configuraation)
Release : 12.8.03
Component : SITEMINDER - Policy Server
1) Make sure the policy servers are synced to a time server. In fact, all siteminder and 3rd party components involved must be in time sync.
2) Increase the Policy Server registry setting MaxTimeDeltaBetweenServers. On linux this is in the sm.registry file. It is difficult to make a recommendation because this is entirely dependent on the time sync and network latency which are outside of the control of siteminder, but maybe start with 30 seconds. You need to restart the policy server after making this change. This registry is just adding more tolerance but having time synchronized is more important.
See the links below for an explanation:
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/single-sign-on/12-8/troubleshooting/policy-server-troubleshooting.html#concept.dita_4ef5c74b37b40cf964708a51a4e44a83bb5e4f34_PolicyServersSharingPolicyStoreNotUpdatedConsistently
https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-identity-and-access-management/single-sign-on/12-8/configuring/policy-server-configuration-files/list-of-policy-server-registry-keys.html
https://community.broadcom.com/communities/community-home/digestviewer/viewthread?MID=752962#bme5d60278-1a75-4cb8-abc7-e68314bfbc71
https://community.broadcom.com/enterprisesoftware/communities/community-home/digestviewer/viewthread?MessageKey=050d4298-23db-4607-af6d-e6626917b773&CommunityKey=f9d65308-ca9b-48b7-915c-7e9cb8fc3295&tab=digestviewer#bm050d4298-23db-4607-af6d-e6626917b773
Also, for CA Directory, "set modify-on-add = true" in the directory configuration for both directories.