Previous Topic: Set Log Files, and Command-line Help to Another LanguageNext Topic: Worksheets

Web Services Security Guides › CA SiteMinder® Web Services Security Agent Guide for IIS Web Servers › Troubleshooting

Troubleshooting

This section contains the following topics:

I need to execute another IIS 7.x Module Before the CA SiteMinder® Web Agent for IIS

Changing Document Root Folder after Agent Configuration Leaves Resources Unprotected

Diagnose Agent Start-Up/Shutdown Issues (Framework Agents Only)

Incorrect Error Code Returned Returned on XML-DCC Authentication Failure

I need to execute another IIS 7.x Module Before the CA SiteMinder® Web Agent for IIS

When you install and configure the CA SiteMinder® Agent for IIS on an IIS web server, the Agent for IIS executes before any other modules. If your IIS environment requires another module to execute first, you can change the number set the following location in the Windows Registry:

HKLM\SOFTWARE\Wow6432Node\Netegrity\SiteMinder Web Agent\Microsoft IIS\RequestPriority

For example, suppose another module in your IIS 7.x web server (like UrlScan) is assigned the same execution priority as the CA SiteMinder® Agent for IIS. Use this setting to control when the CA SiteMinder® module executes.

Follow these steps:

  1. Open the Windows Registry Editor on your IIS web server.
  2. Expand the following keys: 
    HKLM\SOFTWARE\Wow6432Node\Netegrity\SiteMinder Web Agent\Microsoft IIS
  3. Locate the following value: 
    RequestPriority
  4. Change the value of RequestPriority to the number which corresponds to the following value you want:
    PRIORITY_ALIAS_FIRST

    Executes the CA SiteMinder® Agent for IIS before any other modules on your IIS web server. This setting is the default.

    Example: 0 (First)

    Default: 0

    PRIORITY_ALIAS_HIGH

    Executes the CA SiteMinder® Agent for IIS module after any modules set to execute first, but before any modules set to execute with medium, low or last priority.

    Example: 1 (High)

    PRIORITY_ALIAS_MEDIUM

    Executes the CA SiteMinder® Agent for IIS module after modules set to execute first and high, but before modules set to execute with low or last priority.

    Example: 2 (Medium)

    PRIORITY_ALIAS_LOW

    Executes the CA SiteMinder® Agent for IIS module after modules set to execute first, high, and medium, but before modules set to execute with last priority.

    Example: 3 (Low)

    PRIORITY_ALIAS_LAST

    Executes the module for the CA SiteMinder® Agent for IIS after all other modules.

    Example: 4 (Last)

  5. Save your changes and close the registry editor.
  6. Test your settings and verify that the module you want executes before the Agent for IIS module executes.

Changing Document Root Folder after Agent Configuration Leaves Resources Unprotected

Symptom:

I changed the location of the document root folder on my web server after I configured my CA SiteMinder® agent. Now the resources in the new document root folder are unprotected.

Solution:

If you change the location of the document root folder on your web server, run the agent configuration program again.

Diagnose Agent Start-Up/Shutdown Issues (Framework Agents Only)

Symptom:

The CA SiteMinder® Agent does not start or shut down.

Solution:

Do the following tasks:

Incorrect Error Code Returned Returned on XML-DCC Authentication Failure

Valid on Oracle Directory Enterprise Edition (formerly Oracle iPlanet Directory Server Enterprise Edition)

Symptom:

Authentication against the XML Document Credential Collector authentication scheme fails, but the web server returns a 500 Internal Server Error instead of a 403 Forbidden error.

Solution:

Perform the following steps:

  1. Open the obj.conf file on your web server.
  2. Locate the following line: 
    AuthTrans fn="SiteMinderAgent"
  3. Add UseOutputStreamSize="0"to the end of the previous line, as shown in the following example: 
    AuthTrans fn="SiteMinderAgent" UseOutputStreamSize="0"
  4. Save the file, and then restart the web server.