Policy Server 12.9 Backward Compatibility with Older Web Agent Versions

Products

• CA Single Sign On Agents (SiteMinder)
• SITEMINDER
• CA Single Sign-On

Issue/Introduction

Planning an upgrade to Policy Server 12.9 and needs to verify compatibility with their existing infrastructure. Over 400 Web Agents in production with mixed versions, including:

• WebAgent 12.0 (e.g., 12.0.313.950)
• WebAgent 12.52 (various CRs from CR00 to CR11)
• WebAgent 12.80
• Need to confirm the minimum supported Web Agent version for Policy Server 12.9 and understand the operational impact or limitations of maintaining these older versions.

Environment

• Policy Server: 12.9
• Web Agents: 12.0, 12.52, 12.8x

Resolution

According to the SiteMinder 12.9 Platform Support Matrix, Policy Server 12.9 provides backward compatibility for Web Agents back to SiteMinder r12 SP3 CR9 (1).

While your existing Web Agents (12.0, 12.52, and 12.80) are technically compatible and will continue to perform basic authentication and authorization, there are significant functional and supportability limitations to consider:

• Functional Limitations

  
  Older Agent versions (12.0 and 12.52) cannot utilize new features introduced in later Policy Server releases, including but not limited to:
  
  - Multi-Factor Authentication (MFA) Chaining
  - Authentication Chaining Schemes
  - Web Authentication (WebAuthn) support
  
  

• Supportability Status

  
  - Version 12.0: All Service Packs (SP) and Cumulative Releases (CR) are officially retired (End of Service).
  - Version 12.52: The final release for this branch is 12.52 SP1 CR11. No further Cumulative Releases, security patches, or certifications for newer Operating Systems/Web Servers will be provided for the 12.52 series (2)(3).

Note: If vulnerabilities or defects are discovered in these retired/legacy versions, Broadcom Support will require an upgrade to a supported version (12.8 or 12.9) to receive a fix.

Recommendations

To ensure full support, security compliance, and access to modern features, it is recommended to:

1. Upgrade Web Agents to 12.8: This ensures the agents are on a supported code path.
2. Transition to Access Gateway (SPS) 12.9: Replace traditional Web Agents with the CA Access Gateway, which includes an embedded agent and simplifies the upgrade lifecycle.

Additional Information

1. 1.7 Policy Server and Agents Compatibility
   
   
2. Symantec SiteMinder 12.52 & 12.52 SP01
   
   
3. SCA SiteMinder 12.0 9, 14, Includes updates for base release and all later CRs/SPs for this release Platform Support Matrix