Unable to resolve fully qualified host name. Exiting with HTTP 500 server error '00-0016'

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• CA Single Sign On SOA Security Manager (SiteMinder)
• CA Single Sign-On

Issue/Introduction

Seeing errors in the webagent.log:

[CSmHttpPlugin.cpp:406][ERROR][sm-HTTPAgent-00030] Unable to resolve fully qualified host name. Exiting with HTTP 500 server error '00-0016'.
[CSmResourceManager.cpp:158][WARNING][sm-AgentFramework-00480] HLA: Missing resource data. 

 

Also seeing following in the webagenttrace.log:

[CSmHttpPlugin.cpp:399][CSmHttpPlugin::ProcessResource][][][][][][][Resolved HTTP_HOST: '10.0.0.1'.]
[CSmHttpPlugin.cpp:5518][Entered CSmHttpPlugin::ResolveFQServerName sHost: ][][][][][][][10.0.0.1]
[CSmHttpPlugin.cpp:5600][CSmHttpPlugin::ResolveFQServerName: isIP][][][][][][][10.0.0.1]
[CSmHttpPlugin.cpp:10195][CSmHttpPlugin::DoDNSLookup ][][][][][][][Entered Function server: 10.0.0.1, port: ]
[CSmHttpPlugin.cpp:10264][CSmHttpPlugin::DoDNSLookup Error: ][][][][][][][Name or service not known]
[CSmHttpPlugin.cpp:10280][CSmHttpPlugin::DoDNSLookup ][][][][][][][Leaving Function]
[CSmResourceManager.cpp:94][CSmResourceManager::ProcessResource][][][][][][][SM_WAF_HTTP_PLUGIN->ProcessResource returned SmExit.]
[CSmResourceManager.cpp:160][CSmResourceManager::ProcessResource][][][][][][][Plugins did not collect required resource data.] 

 

Environment

Web Agent 12.x SPx

Cause

The 00-0016 error is being reported because a request is being made using  IP Address instead of the FQDN, and the Agent is unable to resolve the IP to a FQDN.

 

Resolution

Please use FQHN instead of an IP address.

SiteMinder uses cookie (SMSESSION) to manage user sessions and for single sign-on purpose this need to be set with a domain.

 

If the initial request must be made with IP address, then you can set "ForceFQHost=Yes" in the Web Agent ACO.

Set ForceFQHost = yes (default: no)

The ForceFQHost parameter uses Reverse DNS Lookup to resolve a FQHN and redirect to that resolved address.

This would work only if the reverse DNS lookup is configured correctly.

- Document reference:

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/configuring/web-agent-configuration/user-protection/siteminder-browser-cookies.html#concept.dita_022751ec9fbc5d4a6d84c04ef067f541301301a1_ForcetheCookieDomain

 

In case if you have a loadbalancer/proxy as frontend, please ensure you work with its vendor to ensure FQHN is passed on in the HTTP Host header to the backend webserver integrated with web agent.