[SmSSInLDAPStore.cpp:2120][ERROR][sm_LoginLogout_01001] Fail to create object

Products

• SITEMINDER
• CA Single Sign On Federation (SiteMinder)

Issue/Introduction

Users or administrators see the following error in the SiteMinder Policy Server logs:

[SmSSInLDAPStore.cpp:2120][ERROR][sm_LoginLogout_01001] Fail to create object... (68)

Environment

Policy Server Version : 12.8.x and 12.9

Cause

The error occurs when the Identity Provider (IdP) sends multiple SAML assertions for a single user session that share the same SessionIndex. 

SiteMinder creates a unique lookup key in the session store for SLO by hashing the `SessionIndex`, `IdP Entity ID`, and `NameID`. If a second assertion arrives with the same `SessionIndex`, SiteMinder generates the same hash and attempts to create a duplicate entry in the LDAP store, which fails because the object already exists.

Resolution

1. Verify IdP Behavior: Confirm if the IdP is intentionally sending duplicate `SessionIndex` values. If possible, configure the IdP to provide a unique `SessionIndex` for every assertion.

2. Check SLO Configuration: If SLO is not required for the specific partnership, disabling it will stop SiteMinder from attempting to write these records to the session store.

Additional Information

- SiteMinder acting as Service Provider (SP)
- Federation with Single Logout (SLO) and LDAP Session Store enabled.