Web services instance SDK Agent not able to connect to Policy Server

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• SITEMINDER

Issue/Introduction

When running an SDK Custom Agent and when the Custom Agent tries to connect to the Policy Server, the Policy Server reports the error:

[1321870/140395184142080][Mon Aug 10 2020 17:02:51][CServer.cpp:2121][ERROR][sm-Tunnel-00010] Bad security handshake attempt. Handshake error: 3154
[1321870/140395184142080][Mon Aug 10 2020 17:02:51][CServer.cpp:2132][ERROR][sm-Tunnel-00050] Handshake error: Shared secret incorrect for this client
[1321870/140395184142080][Mon Aug 10 2020 17:02:51][CServer.cpp:2293][ERROR][sm-Server-01070] Failed handshake with 127.0.0.1:39769

 

Environment

 

  Policy Server 12.8SP0 on RedHat 7;
  SDK 12.8SP0 on RedHat 7;

 

Cause

The Custom Agent seems to have a problem handling data from the smhost.conf:

SystemOut.log

2020-08-10 17:21:38,200 34 [TRACE] - - 1ms SiteMinderAdapter SiteMinderAdapter[578].getSmHostConfig(): smhost_config = '/{home_sdk}/conf/SmHost.conf'
2020-08-10 17:21:38,200 34 [TRACE] - - 1ms SiteMinderAdapter SiteMinderAdapter[580].getSmHostConfig(): EXIT = /{home_sdk}/conf/SmHost.conf
2020-08-10 17:21:38,203 34 [ERROR] - - 125ms SiteMinderAdapter SiteMinderAdapter[218].createAgentApi(): GetConfig failed for '/{home_sdk}/conf/SmHost.conf': FAILURE [-1]
2020-08-10 17:21:38,204 34 [TRACE] - - 0ms SiteMinderAdapter SiteMinderAdapter[587].cleanup(): ENTER: ()
2020-08-10 17:21:38,208 34 [TRACE] - - 5ms SiteMinderAdapter SiteMinderAdapter[596].cleanup(): EXIT = [void]
2020-08-10 17:21:38,209 34 [TRACE] - - 133ms SiteMinderAdapter SiteMinderAdapter[220].createAgentApi(): EXCEPTION: IOException(nullGetConfig failed for '/{home_sdk}/conf/SmHost.conf': FAILURE [-1])

There is a known issue in SDK 12.8 which is fixed in 12.8SP2 about missing class used for shared secret and FIPS handling:

DE383871 smagentapi.jar from SDK does not include the com.ca.siteminder.sdk.agentapi.Util (1).

 

Resolution

Upgrade the SDK to 12.8SP4 and higher to fix this issue.

 

Additional Information

 

1. Defects Fixed in 12.8.02