CASiteMinderWebagentModule SetCookiesInResponse failed

Products

• CA Single Sign On Agents (SiteMinder)
• SITEMINDER

Issue/Introduction

SiteMinderAgentModule randomly fails to set cookies in response with info message "OnSendResponse -- SetCookiesInResponse failed."

This is causing HTTP 500 error on browser.

This error was triggered during a SP initiated federation request, however, the federation transaction itself does go though fine.

The error only shows up on IIS web server failedrequesttrace log or windows event viewer, not on web agent logs.

Informational

125. -MODULE_INFORMATION

ModuleName	CASiteMinderWebagentModule
Data1	OnSendResponse -- SetCookiesInResponse failed.
Data2
ErrorCode	The operation completed successfully. (0x0)

 

Warning

126. -MODULE_SET_RESPONSE_ERROR_STATUS

ModuleName	CASiteMinderWebagentModule
Notification	SEND_RESPONSE
HttpStatus	500
HttpReason	500 Server Error
HttpSubStatus	0
ErrorCode	The operation completed successfully. (0x0)
ConfigExceptionInfo

Environment

IIS web agent

Cause

When IIS has ARR enabled, there could be a timing conflict on where the smsession cookies are set. 

Resolution

1.  Setting ACO EarlyCookieCommit=Yes, then recycle the agent.

2.  Verify during the exact time stamp of failed request, if there is any other request coming in, which is NOT part of the protected resource.  e.g. GET /favicon.ico HTTP/1.1

If there is, adjust ACO ignoreext by adding .ico

if it is url, then adding ACO ignoreurl=/example