"Application" does not get displayed when creating VIP Auth Hub authentication scheme

Products

• SITEMINDER
• CA BCS Premier for CA Single Sign-On
• CA Single Sign On Agents (SiteMinder)
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

When setting up the necessary configuration for the integration between SiteMinder and VIP SaaS, system admin 

has got outbound firewall rules opened,

has configured an app and the required OIDC configuration within VIP SaaS,

has created a "VIP Authentication Hub provider" in SiteMinder admin ui.

After above steps, when trying to create an auth scheme in SiteMinder based on VIP Hub Authentication template,  it does not display any value in the drop down of “Application”.

Environment

Release : 12.8.07 SiteMinder and VIP SaaS Integration.

Cause

When looking at "VIP Authentication Hub provider" property on SiteMinder side, its "authentication policy management" within VIP auth hub provider object is empty, that is consistent with auth scheme not showing application name.  If this is working, the app name and policy ID should be populated.

Resolution

Essentially the admin ui indicates there is a communication problem to obtain the application information from VIP Saas service. 

In order to see the application on SiteMinder UI, token exchange must happen first. That's where the failure is.

There is misconfiguration in VIP.

Login VIP Saas management UI, Under VIP policy Configuration, OIDC tab:
Verify "Redirect url" should be: https://accessgateway.example.com/affwebservices/public/bctokencontroller,  not /oauthtokenconsumer

Additional Information

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/configuring/policy-server-configuration/authentication-schemes/vip-authentication-hub-authentication-scheme/manage-vip-authentication-hub-authentication-scheme-using-rest-apis.html