Shared Secret generation and is its specific machine dependencies with Web Agent

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign-On
• SITEMINDER
• CA Single Sign On Agents (SiteMinder)

Issue/Introduction

How is Shared Secret generated and is it specific to a machine?

Environment

Web Agent on Linux

Resolution

Shared secret value is used for communication between the web agent and the Policy Server.

The shared secret value is generated by the WebAgent, and then stored in the SmHost.conf file on the Web Agent side, and in the trusted host object on the Policy Server side.

If the WebAgent is on Linux, then the host of the machine is used in the hash of the shared secret.

This means that for a Linux platform, any time a Web Agent is moved from the machine, it has to be registered again.

So, SmHost.conf files cannot be moved from one Linux machine to another.

The Shared Secret that gets written in SmHost.conf is generated randomly using the Encryption key stored in <SiteMinder policy server installation>\bin\EncryptionKey.txt and Session key, which is encoded with unique hash bits derived from the MAC address of the machine.

Thus, if Shared Secret is ported to a different machine, it would not work.