Web Agents use agent keys to encrypt and decrypt CA SiteMinder® cookies so the data they contain can be read. The Agent uses the key to encrypt cookies before sending them to a user’s browser and to decrypt cookies received from other Web Agents.
All Web Agents need to be aware of the same keys, and the keys must be set to the same value for all Agents communicating with a Policy Server. This rule is particularly important for Agents in a single sign-on environment. To ensure that the keys remain secure, the Policy Server performs a key rollover. A key rollover is the process of generating new keys, encrypting them, and distributing them to all Web Agents within a CA SiteMinder® environment.
When a Web Agent starts up and makes a management call request, the Policy Server supplies the current set of keys. Each time the Web Agent polls the Policy Server, the agent again makes the management call. The Web Agent receives the updated keys.
The Policy Server provides the following types of keys:
Refers to a key that is generated by a Policy Server algorithm and distributed to other connected Policy Servers and their associated Web Agents. Dynamic keys can be rolled over automatically at a regular interval, or they can be changed manually by using the Administrative UI.
Refers to a key that remains the same indefinitely, and can be generated by a Policy Server algorithm or configured manually. CA SiteMinder® uses this type of key for a subset of features that requires information to be stored in cookies over extended periods.
Automated key changes ease the process of managing agent keys for large CA SiteMinder® installations that share a single key store. A key store is a storage location for all key information. Policy Servers access the key store to obtain the current keys, which are then passed on to the Web Agents. For Agents that are configured for single sign-on, the key store must be replicated and shared across all Policy Servers in the single sign-on environment. Automating key changes also ensures the integrity of the keys.
Note: For more information, see the Policy Server documentation.
You can use the Administrative UI to configure dynamic Agent key rollover. Web Agents poll the Policy Server for key updates at regular intervals. If keys have been updated, Web Agents pick up the changes during polling. The default polling time is 30 seconds, but you can customize it by changing the value of the PSPollInterval parameter for a Web Agent.
When a Web Agent detects that a key rollover has occurred, the Agent retrieves new values for the following Agent keys:
Contains the last value used for the dynamic Agent key before the current value.
Contains the value of the current dynamic Agent key.
Contains the next value that will be used as the current key in a dynamic Agent key rollover.
Contains a long-term key that the Agent can use for CA SiteMinder® features that need to identify a user and maintain this information for long periods. Static keys also support cookie encryption for single sign-on when dynamic keys are not enabled.
Web Agents require multiple keys to preserve cookie data and ensure a smooth transition between old keys and new keys.
When the Policy Server generates dynamic keys, it saves and maintains these keys in the key store. The key store is a repository from which all Policy Servers retrieve the most current keys. Web Agents obtain the current keys from the Policy Servers. The key store may be part of a CA SiteMinder® policy store or maintained as a stand-alone key store.
Note: If an administrator issues multiple agent key rollovers in rapid succession, this action may invalidate all cookies issued for single sign-on and may disrupt single sign-on for all users currently logged in. After these users re-authenticate, single sign-on will operate normally.
|
Copyright © 2015 CA Technologies.
All rights reserved.
|
|