12.8 WAOP Affwebservices failing with 403/500 errors

Products

• CA Single Sign On Agents (SiteMinder)

Issue/Introduction

At random, FWStrace log suddenly shows many error like "AgentAPI login call: -1", or [Tunnel result code: -1.].

All are due to affwebservices can not reach policy server.  The policy server could have been rebooted for maintenance for a short period, but UP and running at the time of incident.

When it happens, all federation flow fails.  However other regular agents are still connected to the same set of policy servers.

An odd observation at the incident time is that, /affwebservices/assertionretriever still responds 200 from monitor probe.

There are non-stopping error in affwebserv.log

[2880/6920][Thu MM dd yyyy hh:mm:ss.914][agentcommon][INFO][sm-FedClient-00010] SM_WSB_00049 - The doManagement Thread failed as the Policy Server could not be reached. Reason: Agent API Failure
[2880/6920][Thu MM dd yyyy hh:mm:ss.914][agentcommon][INFO][sm-FedClient-00010] SM_WSB_00049 - The doManagement Thread failed as the Policy Server could not be reached. Reason: Agent API Failure

The only way to recover is restarting Tomcat.

Environment

OS: Windows
Application server version :Tomcat 11
WAOP: 12.8

Resolution

A patch is required in order to recover the failed connections between WAOP and policy server.

Please contact Broadcom support for the WAOP patch.

Or wait for the next official web agent option pack GA release.