Adding second Policy Server pointing to the same Policy and Key Store

Products

• CA Single Sign-On
• SITEMINDER

Issue/Introduction

 

After adding a second Policy Server 2 (PS#2) that is pointing to the same Policy and Key Store of Policy Server 1 (PS#1) to the HCO, the below errors in the Policy Server smtracedefault.log start to show up:

  ... [CServer.cpp:2132][][][][][][][][][][][][][][][][][][][][][]
  [LogMessage:ERROR:[sm-Tunnel-00050] Handshake error: Shared secret incorrect for this client]
  [][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]

  ... [CServer.cpp:2078][GetSecretFunc][][][][][][][][][][][][][][][][][][][][]
  [Error while fetching previous secret for the Agent abc][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]

Environment

 

Siteminder 12.8 SP1 on Windows 2012 R2

 

Cause

 

The encryption is not the same on both Policy Servers. Comparing the content of the EncryptionKey.txt on both Policy Server shows that they aren't the same.

 

Resolution

 

1. Ensure that the Enable Agent Key Generation is disabled on the second policy server 2 (PS#2).
2. Stop Policy Server 2 (PS#2), and then take a backup of the the EncryptionKey.txt from the below directory from Policy Server, and rename the EncryptionKey.txt to EncryptionKey.txt_backup.
   Directory Location: <Policy_server_install_path>)/bin
3. Copy the EncryptionKey.txt from the directory from policy server 1 (PS#1) to Policy Server 2 (PS#2).
4. Restart the Policy Server 2 (PS#2).
5. Re-enter the password for the DSNs for all the configured stores via the smconsole and test all connections to confirm the connection is successful.
6. Confirm that there are no more errors in the smps.log.
   
   

   Note:

   This solution is only valid for Policy Servers on Windows platforms. For Policy Servers on Linux platforms, please follow the instructions in the documentation to rest the encryption key (1).

Additional Information

 

(1)

    Reset the r12.x Policy Store Encryption Key