Common Key Store Single Sign

If you are deploying a common key store, do the following or single sign–on fails:

Be sure that the r12.1 policy and key store are configured separately.
Note: For more information about configuring a key store, see the Policy Server Administration Guide.
Leave the key store version at r12.1. r12.1 SP3 Policy Servers can communicate with an r12.1 key store, but r12.1 Policy Servers cannot communicate with an r12.1 SP3 key store.
Configure all Policy Servers to use the common r12.1 key store.
Be sure that all Policy Servers use the same encryption key. If you do not know the value of the encryption key, you can reset the r12.1 value in the policy store. Use the new value when installing an r12.1 SP3 Policy Server.
Note: For more information about resetting the policy store encryption key, see the Policy Server Administration Guide.
Nominate a single Policy Server to generate dynamic Agent keys. Disable Agent key generation for the remaining Policy Servers.
Note: For more information about dynamically generating Agent keys, see the Policy Server Administration Guide.

More information: