Configuring A2A agent in poll mode

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Product documentation indicates that the A2A agent may be configured in polling mode. 

If done so, the A2A agent will not be waiting for notifications from the CA PAM server and it will instead poll the server for events on a configurable time basis

However, the documentation requests deleting preconfigured agents to enable them in poll mode, and there is also the doubt whether the agent will be able to manage secrets if so configured

This article clarifies some of the concepts

 

Resolution

The agent may be safely removed from the PAM server to be reconfigured in polling mode: next time it starts, it will be recreated at the PAM server, much like any other agent. Some of the funcionalities, such as getting the logs or the connection status will disappear from the GUI for an agent in polling mode, but from the point of view of configuration that's pretty much all.

Now it must be understood that PAM will not be pushing any change to the agent and that, instead, it will be it that will pull the data from PAM. In this case, let's assume the polling period is 2 minutes, and on minute 1 the Alias changes the password. In this case, if cache is enabled and used, the A2A agent will continue to report the old password until 2 minutes have gone by, so a further minute will pass until A2A is not aware of the password change. Of course if no cache is used that will not be the case. So care must be exercised with this when an A2A agent is configured in polling  mode.

Other that that functionality is the same as for a regular A2A agent and elements such as managing secret authorizations should be the same