Access Gateway Fails to Initialize During Simultaneous Datacenter Reboot
search cancel

Access Gateway Fails to Initialize During Simultaneous Datacenter Reboot

book

Article ID: 450314

calendar_today

Updated On:

Products

SITEMINDER CA Single Sign On Secure Proxy Server (SiteMinder) CA Single Sign On Agents (SiteMinder) CA Single Sign On Federation (SiteMinder)

Issue/Introduction

  • Access Gateway (SPS) fails to start after an OS patch or global reboot.
  • server.log shows: [ERROR] - Agent for virtual host : default did not initialized properly (retcode = -1).
  • affwebserv.log shows: Agent API No Connection or Failed to create agent configuration.
  • java.lang.RuntimeException: Deployment of CHS failed due to incorrect configuration: SmHost.conf does not exist.
  • Configured AgentWaitTime in WebAgent.conf appears to be ignored.

Environment

Access Gateway 12.8 or higher, all platforms

Cause

This issue is caused by a race condition during the bootstrap phase. Access Gateway agent must establish a handshake with at least one Policy Server listed in SmHost.conf to download its Host Configuration Object (HCO).

The Limitation: The AgentWaitTime parameter only applies after an initial connection to a Policy Server is successful. It does not trigger retries if no bootstrap servers are reachable during the very first handshake attempt.

The CHS Error: The SmHost.conf does not exist error in the chs application often results from a missing absolute path for SmHostConfPath in /Tomcat/webapps/chs/WEB-INF/classes/config/chsConfig.properties.







Resolution

  1. Implement Startup Retries: Modify the Access Gateway startup scripts or systemd service file to include a retry loop. For systemd, add the following to the [Service] section:
    ini
     
    Restart=on-failureRestartSec=30sStartLimitIntervalSec=300StartLimitBurst=10
  2. Add Pre-Start Delay: Stagger the startup of Access Gateways relative to Policy Servers by adding ExecStartPre=/usr/bin/sleep 60 to the service file.
  3. Fix Absolute Paths: Ensure chsConfig.properties uses an absolute path for the SmHost.conf location (e.g., SmHostConfPath=/opt/CA/secure-proxy/proxy-engine/conf/SmHost.conf).
  4. Verify Topology: Ensure at least one Policy Server in a different data center is reachable if local servers are rebooting.
Powered by Wolken Software