CA Access Gateway (SPS) reports "MultiFactor Authscheme transaction state is invalid" at the first-factor authentication due to unconfigured Session Store

Products

• SITEMINDER
• CA Single Sign-On
• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On Agents (SiteMinder)

Issue/Introduction

While running CA Access Gateway (SPS), at the first-factor authentication, CA Access Gateway (SPS) cannot fully handle the request and reports the following error:

[07/02/2026][14:35:46][7916][14840][][StateRedirectServlet.java][processRequest][url decoded  azRedirectUrlQueryOnly?client_id=<client-id>=openid&response_type=code&redirect_uri=https://server.example.com/affwebservices/public/bctokencontroller&acr_values=urn%3Aiam%3Aacr%3Aaal1]
[07/02/2026][14:35:46][7916][14840][][StateRedirectServlet.java][processRequest][Authentication scheme parameters cached in FWSCache for realmoid: <realmoid>]
[07/02/2026][14:35:46][7916][14840][][FWSBase.java][setACOCascadedFromVH][Using Cascaded ACO Cookie Parameters from virtualhost default {PersistentCookies=false, accepttpcookie=false, UseHTTPOnlyCookies=false, ssozonename=, cookiedomainscope=0, SameSite=, cookiedomain=.example.com, UseSecureCookies=false}]
[07/02/2026][14:35:46][7916][14840][][StateRedirectServlet.java][processRequest][MultiFactor Authscheme transaction state is invalid, retriggering primary authentication]

Environment

• CA Access Gateway (SPS) 12.9 on Windows Server 2022;
• Policy Server 12.9 on Windows Server 2022
• JDK 17.0.15

Cause

The message "MultiFactor Authscheme transaction state is invalid" appears because the user cannot be authenticated on the first authentication factor, which is HTML Form.

The user is not correctly authenticated:

[07/07/2026][10:30:21.564][7916][7212][][CSmLowLevelAgent.cpp:1596][AuthenticateUser][User '<user>' is not authenticated by Policy Server.]

The Policy Server traces show that authentication fails because the Policy Server attempts to insert the session data into the Session Store, which is not fully configured.

Resolution

Fully configure the Session Store, or set the Realm to non-persistent, to resolve this issue.