Adding A Second Policy Server Pointing To The Same Policy Store and Key Store

Document ID : KB000127169
Last Modified Date : 15/02/2019
Show Technical Document Details
Issue:
After adding a second Policy server(PS2) that is pointing to the same policy store and keystore of policy server 1(PS1)to the HCO, we started observing  below errors in the siteminder policy server smtracedefault.log:

[02/15/2019][10:21:55.503][10:21:55][3136][6008][CServer.cpp:2132][][][][][][][][][][][][][][][][][][][][][][LogMessage:ERROR:[sm-Tunnel-00050] Handshake error: Shared secret incorrect for this client][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]

[02/15/2019][10:21:55.503][10:21:55][3136][6008][CServer.cpp:2078][GetSecretFunc][][][][][][][][][][][][][][][][][][][][][Error while fetching previous secret for the Agent abc][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][]
 
Environment:
Siteminder 12.8 SP1 on Windows 2012 R2
Cause:
The encryption is not the same on both Policy Servers. You can confirm this by comparing the content of the EncryptionKey.txt on both Policy Server to check if they are the same.
Resolution:
1) Ensure that the Enable Agent Key Generation is disabled on the second policy server 2(PS2)

2) Stop Policy Server 2(PS2) and then take a backup of the the EncryptionKey.txt from the below directory from policy server and rename the EncryptionKey.txt to EncryptionKey.txt_backup
(<Policy_server_install_path>)/bin folder) 

3) Copy the EncryptionKey.txt from the below directory from policy server 1(PS1) to policy server 2(PS2)
(<Policy_server_install_path>)/bin folder) 

4) Restart the Policy Server

5) Re-enter the password for the DSNs for all the configured stores via the smconsole and test test all connection to confirm the connection is successful.

6) Confirm that there are no more errors in the smps.log

Note:

This solution is only valid for Policy servers on Windows platforms. For Policy Servers on Linux platforms, please follow instructions in the documentation to rest the encryption key:

Reset the r12.x Policy Store Encryption Key
https://docops.ca.com/ca-single-sign-on/12-8/en/administrating/manage-encryption-keys/reset-the-r12-x-policy-store-encryption-key