Access Gateway throws 500 error during Auth Hub authentication

Products

• SITEMINDER
• CA Single Sign On Federation (SiteMinder)
• CA Single Sign On Secure Proxy Server (SiteMinder)

Issue/Introduction

Siteminder is integrated with VIP Authentication Hub.  Access Gateway is throwing a 500 error during Auth Hub authentication.  The Access Gateway web agent trace log shows a 400 error occurring at the same time.  Not all users are affected, and the problem seems intermittent, failing most of the time, but occasionally succeeding.  There have been no recent changes to the environment.

Environment

All Supported Environments

Cause

Database replication was failing within Auth Hub, causing ID Token verification from Siteminder to fail if the verification request went to a different Auth Hub node than where the token was generated.  When only one Auth Hub node was active, all users could consistently authenticate.  

Resolution

Assure that database replication within Auth Hub is successful and quick enough to be accommodated by the Auth Hub database retries.