Web Agent :: HLA : Unable to Determine Appropriate Challenge

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

Description:

Explanation of Following Error Message in Web agent Logs:-

=================
[CSmHighLevelAgent.cpp:911][ERROR] HLA: Challenge Manager unable to determine appropriate challenge; exiting with error.

What this message means?

Solution:

The Challenge Manager Component of Web agent is responsible for determining how to challenge the originator of a request (a user at a web browser for example), for valid credentials, required by SiteMinder for authorization of a given resource. This is achieved by calling registered Plug-ins/ challenge analyzers to form a valid challenge for new credentials. Depending upon the kind of authentication scheme (i.e. form based FCC, CertOrForms Performing challenge through alternate FCC, CertOrBasic Performing challenge through alternate SCC, NTLM, Kerberos (if supported)) used by application, appropriate challenge is formed by the plug-in.

When Challenge Manager is not able to determine which Authentication Scheme to use to get credential for a given resource; it logs this Error Message.

This could have many reasons as configuration error by realm, rule, policies, etc. . Or bad parameter is sent by request, No plug-in loaded, none of the registered/loaded plug-ins knows how to challenge for the credentials required for a particular authentication scheme (may be a custom authentication scheme), web agent writes error log message saying that it unable to determine the appropriate challenge and so on.

The unique way to understand what is causing the Web Agent to be unable to retrieve the Authentication Scheme for that resource is to enable the Web Agent traces and to localize the resource.

Environment

Release:
Component: SMAPC