sm.registry configuration without smconsole in Policy Server

Products

• CA Single Sign-On
• SITEMINDER

Issue/Introduction

When running the "Policy Server Management Console" (smconsole) on Linux Policy Server, the tool works very slow.

Is there's a way to modify configuration?

 

Resolution

It's possible to modify the Policy Server service configuration by accessing to the sm.registry file directly, and manually edit it.

The challenge comes when modifying encrypted values.

Some command lines can help to encrypt some of the values:

1. Logon to the Policy Server machine, and open a command prompt;
2. Back-up the following file:

<Siteminder_Install_Dir>/registry/sm.registry

to illustrate:

# cp -p /<Siteminder_Install_Dir>/registry/sm.registry <Siteminder_Install_Dir>/registry/sm.registry.orig


3. Run the following command to encrypt the Admin Password for the Policy Store

# smldapsetup reg -w<Password>

NOTE: This switch will use the Policy Server encryption key to encrypt the password entered in the "-w' switch and populate it in the following location:

HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\LdapPolicyStore
"AdminPW"="{RC2}<value>"

This value can be copied to to the following fields:

LDAP Connection Settings:

HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\LdapPolicyStore\AdminPW
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\LdapKeyStore\AdminPW
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\LdapSessionServer\AdminPW

ODBC Connection Settings:

HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\Database\AdvancedAuth\Password
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\Database\Default\Password
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\Database\Key\Password
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\Database\Log
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\Database\SessionServer\Password
HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\Database\Token\Password

The values in the 'sm.registry' are only overwritten when including that corresponding switch in the 'smldapsetup reg' command.

To overwrite the Server, LDAP Root, or Admin, then don't specify those switches.

The command will overwrite anything in the [HKEY_LOCAL_MACHINE\SOFTWARE\Netegrity\SiteMinder\CurrentVersion\LdapPolicyStore\AdminPW] registry key with the encrypted value from the smldapsetup command, however encrypted value isn't limited to that one connection.

It can be copied to other registry keys, providing the possibility to reset it to the correct password for the LDAP Policy Server at the end (if the other connections are using different accounts).