The following topics describe general known issues.
CA SiteMinder WSS fails to create an encrypted WS-Security token when a response is configured to use the RSA-OAEP algorithm to encrypt the symmetric encryption key, generating the following error in tmxmltoolkit.log:
008-05-22 14:53:10,531 [INFO] handler.response.WSSecurityUsernameResponseHandler 8A2ADA6E-3D9B-57FB-35E3-9CC05471E849 - Cannot do encryption: unsupported key algorithm provided: rsa_oaep
Workaround
Configure the WS-Security header generating response to use the default rsa-1_5 algorithm to encrypt the symmetric encryption key.
If configured to generate signed SAML Session Tickets in the SOAP envelope, CA SiteMinder WSS produces the SAML Session Ticket and places it in the SOAP envelope as expected, but the message is not signed.
Signing works correctly for SAML Session Tickets placed in HTTP headers or HTTP cookies.
When creating an application policy from a WSDL file, operation-level policy changes in the Define Web Service Protection Policy table are lost if you return to the top level by clicking the All Web Services link and then immediately click the Next button to proceed.
Workaround
After you have specified operation-level policy changes for a particular port, if you click the All Web Services to return to the top level of the Define Web Service Protection Policy table, click any other button or link (for example, the link for that port again) before clicking Next to ensure the operation-level changes are committed.
Clicking the Back button on the Secure Web Services from WSDL: Define Policies pane of the Secure Web Services from WSDL Wizard sometimes results in an "Array Index out of range error -1". This error is non-fatal and can be ignored.
The following topics describe known issues related to product installation and uninstallation.
The option to go back to reenter incorrectly supplied information is not supported during console mode installation on UNIX.
Attempting to uninstall any CA SiteMinder WSS component without the prerequisite level of JVM installed and correctly referenced in the system path causes the uninstaller to fail with one of the following errors:
Workaround
Make sure the JRE is in the PATH variable.
The following topics describe SiteMinder WSS Agent for Web Servers issues.
In CA SiteMinder® 12.51, the WSS Agent Configuration Wizard does not install the WSS agent if the host computer has a JBoss 6 application server.
If configured for failover and the primary Policy Server fails, the SiteMinder WSS Agent for Web Servers can take up to one minute to failover to the secondary Policy Server.
Unattended configuration sometimes fails when attempting to configure the SiteMinder WSS Agent for Web Servers to work with IIS 7.x on Windows Server 2008. In this case, the following message is written to the log:
“Unable to write to applicationHost.conf file. Please Restart the IIS Webserver and redo the configuration.”
This issue occurs when the configuration wizard cannot stop IIS before it attempts to modify the IIS applicationHost.file and therefore cannot edit the file because it is still in use.
Workaround
Stop IIS 7.x before attempting unattended configuration of the SiteMinder WSS Agent.
The following topics describe known issues in the SiteMinder WSS Agent for IBM WebSphere.
The SiteMinder WSS Agent for IBM WebSphere has the following limitations:
The following use case for coexistence of SiteMinder WSS Agent for IBM WebSphere and SiteMinder Agent for IBM WebSphere is not supported:
If you do configure such an environment, the SiteMinder TAI Module will intercept web service requests that should be handled by the SiteMinder WSS Agent.
The SiteMinder WSS Agent for IBM WebSphere does not support generation of WS-Security mustUnderstand attributes.
You should not therefore assign responses that generate mustUnderstand attributes to policies associated with resources protected by the SiteMinder WSS Agent for IBM WebSphere.
For resources protected by the SiteMinder WSS Agent for IBM WebSphere, XML Digital Signature authentication is failing for certain XML payloads.
The SiteMinder WSS Agent Configuration Wizard does not allow you to unconfigure the SiteMinder WSS Agent for WebSphere as it does for the SiteMinder WSS Agent for Web Servers.
Workaround
To unconfigure a SiteMinder WSS Agent for WebSphere (that is, to stop it from protecting web service resources in the WebSphere container), perform the following steps:
The following topics describe known issues in the SiteMinder WSS Agent for Oracle WebLogic.
The SiteMinder WSS Agent for Oracle WebLogic has the following limitations:
The SiteMinder WSS Agent Configuration Wizard does not allow you to unconfigure the SiteMinder WSS Agent for WebLogic as it does for the SiteMinder WSS Agent for Web Servers.
Workaround
To unconfigure s SiteMinder WSS Agent for WebLogic (that is, to stop it from protecting web service resources in the WebLogic container), perform the following steps:
The following topics describe known issues in the CA SiteMinder® Agent for JBoss.
Attempting to uninstall the SiteMinder Agent for JBoss without the prerequisite level of JVM installed and correctly referenced in the system path causes the uninstaller to fail with one of the following errors:
Workaround
Make sure the JVM is in the system PATH variable.
For resources protected by the SiteMinder WSS Agent for JBoss, XML Digital Signature authentication is failing for SOAP requests where the entire document is signed. This failure is because the JBoss container does not preserve whitespace between SOAP message elements.
Workaround
Program the web service client to remove all whitespace between SOAP message elements in the request message to match the space removal that JBoss performs upon receiving the message.
When the SiteMinder Agent for JBoss installer prompts for the JVM location, it displays an "Unable to install the Java Virtual Machine included with this installer" error message even when a valid path is entered.
Workaround
This error message is erroneous; the installer continues with the installation regardless of the error message.
The following topics describe known issues in the CA SiteMinder WSS SDK.
When the signWSDocument method of the XMLDocument class of the Web Service Client API is called with a PEM format X.509 file argument, it fails with an "Uninitialized keystore" error.
When the signWSDocument method of the XMLDocument class of the Web Service Client API is called with a DER format X.509 file argument, it throws an exception indicating it cannot parse the certificate.
When the signDocument method of the XMLDocument class of the Web Service Client API is called to sign a SOAP document with a DER format X.509 file argument, the method produces a signature that cannot be validated by a SiteMinder WSS Agent. The SOAP Body element is identified with the following syntactically correct attribute:
ID="Body"
However, SiteMinder WSS Agents can only resolve references to "Id", not "ID" attributes (note the case: Id as opposed to ID).
When the signDocument method of the XMLDocument class of the Web Service Client API is called to sign a non-SOAP XML document with a null publicKeyFile argument and a valid X.509 file argument, the method throws a NullPointerException.
|
Copyright © 2015 CA Technologies.
All rights reserved.
|
|