4.5.3 PA A2A Client is not registering with 4.1.2 PAM Version

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

We've recently upgraded our lower environment with 4.1.2 PAM, so after that, we did try to register 4.5.3 A2A request server. But it is not registering.

May 16, 2023 3:48:32 PM org.mortbay.http.HttpServer doStart
INFO: Version Jetty/5.1.2
FINE: Tue May 16 15:48:32.396 SGT 2023 XMLJDomParserForConfig::parseXML. Sizeof server array: 1
INFO: Tue May 16 15:48:32.401 SGT 2023 XMLJDomParserForConfig::parseXML. Configuration file is loaded
FINE: Tue May 16 15:48:32.413 SGT 2023 XMLJDomParserForConfig::parseXML. Sizeof server array: 1
INFO: Tue May 16 15:48:32.413 SGT 2023 XMLJDomParserForConfig::parseXML. Configuration file is loaded
WARNING: Tue May 16 15:48:32.414 SGT 2023 ApplicationCSPM::initAppConfig. CPA Client is in FIPS mode
May 16, 2023 3:48:32 PM org.mortbay.util.Container start
INFO: Started org.mortbay.jetty.servlet.ServletHandler@6262937c
Client Daemon Event Log:
May 16, 2023 3:48:32 PM org.mortbay.util.Container start
INFO: Started HttpContext[/RequestServer,/RequestServer]
May 16, 2023 3:48:32 PM org.mortbay.http.SocketListener start
INFO: Started SocketListener on 127.0.0.1:28088
May 16, 2023 3:48:32 PM org.mortbay.util.Container start
INFO: Started org.mortbay.http.HttpServer@182d9c06
May 16, 2023 3:48:32 PM org.mortbay.http.HttpServer doStart
INFO: Version Jetty/5.1.2
May 16, 2023 3:48:32 PM org.mortbay.util.Container start
INFO: Started org.mortbay.jetty.servlet.ServletHandler@46e45076
May 16, 2023 3:48:32 PM org.mortbay.util.Container start
INFO: Started HttpContext[/RequestServer,/RequestServer]
May 16, 2023 3:48:32 PM org.mortbay.http.SocketListener start
INFO: Started SocketListener on 0.0.0.0:28888
May 16, 2023 3:48:32 PM org.mortbay.util.Container start
INFO: Started org.mortbay.http.HttpServer@7a148bd3
ClientService::loginToCSPMServer. Failed to perform CSPM Server login, exiting...

Environment

Release : 4.1.2+

Cause

This problem is caused by an incompatibility between the new Crypto provider in 4.1.2, see section Updated Cryptographic Providers on documentation page New Features and Enhancements in 4.1.2, and the old 4.5.3 A2A clients running a 1.6 JRE.

Resolution

The 4.5.3 clients are very old and should be upgraded to the current 4.12.3 version ASAP. Temporarily we can work around the problem by configuring PAM to use OpenSSL as cryptographic provider. This can be done by PAM Support using SSH access to each node right after the upgrade to 4.1.2. If you need a transition period to upgrade your old A2A clients, please open a case with PAM Support to implement the workaround.