Slowness and massive loopback hits identified in SPS logs.

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• SITEMINDER

Issue/Introduction

When running a CA Access Gateway (SPS), this one stop responding to the requests. A restart is needed to get the service available again.

The access.log from the embedded Apache service, shows a lot of redirect between /index.html and / request from 127.0.0.1 and 10.0.0.1.

  127.0.0.1 - - [26/Apr/2024:00:13:10 +0200] "GET /index.html HTTP/1.1" 302 -
  10.0.0.1 - - [26/Apr/2024:00:13:10 +0200] "GET / HTTP/1.1" 302 -

 

Cause

The proxyrules.xml show 2 problems.

The default forward and redirect don't specify a destination server:

proxyrules.xml:

  <nete:default><nete:forward>$0</nete:forward>
  </nete:default>

  [...omitted for brevity...]
  
  <nete:default><nete:redirect>$0</nete:redirect>
  </nete:default>

As per documentation, a destination server should be specified (1):

Access Gateway forwards a request to a destination, or sends a redirect response to a user that specifies a destination. A set of proxy rules must contain destinations that can be reached according to the conditions and cases defined in the proxy rules.

Define a backend server to make the CA Access Gateway (SPS) handling correctly those default request.

Resolution

 

• For both nodes, determine a destination server in both proxyrules.xml for the default;
• Restart both the CA Access Gateway (SPS).

 

Additional Information

 

1. Proxy Rules Terminology