Installation and Upgrade Guides › Agent for IIS Installation Guide › Troubleshooting

Troubleshooting

This section contains the following topics:

I need to execute another IIS 7.x Module Before the CA SiteMinder® Web Agent for IIS

Changing Document Root Folder after Agent Configuration Leaves Resources Unprotected

Diagnose Agent Start-Up/Shutdown Issues (Framework Agents Only)

Event Viewer Message Describes lack of Permissions on Host Configuration File

I need to execute another IIS 7.x Module Before the CA SiteMinder® Web Agent for IIS

When you install and configure the CA SiteMinder® Agent for IIS on an IIS web server, the Agent for IIS executes before any other modules. If your IIS environment requires another module to execute first, you can change the number set the following location in the Windows Registry:

HKLM\SOFTWARE\Wow6432Node\Netegrity\SiteMinder Web Agent\Microsoft IIS\RequestPriority

For example, suppose another module in your IIS 7.x web server (like UrlScan) is assigned the same execution priority as the CA SiteMinder® Agent for IIS. Use this setting to control when the CA SiteMinder® module executes.

Follow these steps:

1. Open the Windows Registry Editor on your IIS web server.
2. Expand the following keys:

   HKLM\SOFTWARE\Wow6432Node\Netegrity\SiteMinder Web Agent\Microsoft IIS
   

3. Locate the following value:

   RequestPriority
   

4. Change the value of RequestPriority to the number which corresponds to the following value you want:

   PRIORITY_ALIAS_FIRST

   Executes the CA SiteMinder® Agent for IIS before any other modules on your IIS web server. This setting is the default.

   Example: 0 (First)

   Default: 0

   PRIORITY_ALIAS_HIGH

   Executes the CA SiteMinder® Agent for IIS module after any modules set to execute first, but before any modules set to execute with medium, low or last priority.

   Example: 1 (High)

   PRIORITY_ALIAS_MEDIUM

   Executes the CA SiteMinder® Agent for IIS module after modules set to execute first and high, but before modules set to execute with low or last priority.

   Example: 2 (Medium)

   PRIORITY_ALIAS_LOW

   Executes the CA SiteMinder® Agent for IIS module after modules set to execute first, high, and medium, but before modules set to execute with last priority.

   Example: 3 (Low)

   PRIORITY_ALIAS_LAST

   Executes the module for the CA SiteMinder® Agent for IIS after all other modules.

   Example: 4 (Last)

5. Save your changes and close the registry editor.
6. Test your settings and verify that the module you want executes before the Agent for IIS module executes.

Changing Document Root Folder after Agent Configuration Leaves Resources Unprotected

Symptom:

I changed the location of the document root folder on my web server after I configured my CA SiteMinder® agent. Now the resources in the new document root folder are unprotected.

Solution:

If you change the location of the document root folder on your web server, run the agent configuration program again.

Diagnose Agent Start-Up/Shutdown Issues (Framework Agents Only)

Symptom:

The CA SiteMinder® Agent does not start or shut down.

Solution:

Do the following tasks:

• Run the Low Level Agent Worker Process (LLAWP) separately to isolate the problem.
• For the Windows operating environment Windows, see the Application Log in the Event Viewer.

Event Viewer Message Describes lack of Permissions on Host Configuration File

Valid on IIS

Symptom:

I see the following messages in my event viewer:

• Siteminder Web Agent not having read permissions on host configuration file. Permission denied. Please assign read privileges to the user DefaultAppPool for the file C:\Program Files\CA\webagent\config\SmHost.conf.
• Siteminder Web Agent not having read permissions on host configuration file. Permission denied. Please assign read privileges to the user DefaultAppPool for the file C:\Program Files\CA\webagent\config\SmHost.conf.

Solution:

All the application pool identities on IIS web servers need permissions for the following CA SiteMinder® items on the computer hosting the IIS web server:

• The SmHost.conf file

Follow these steps:

1. Navigate to (but do not open) the following file:

   web_agent_home\config\SmHost.conf
   

2. Right-click the previous file, and then select Properties.

   The SmHost.conf Properties dialog appears.

3. Click the Security tab.
4. In the Group or User Names pane, verify that SYSTEM is selected, and then click Edit.

   Note: If the User Account Control dialog appears, click Continue.

   The Permissions for SmHost.conf dialog appears.

5. Click Add.

   The Select Users, Computers, or Groups dialog appears.

6. Do the following steps:
   1. Click Locations.

      The Locations dialog appears.

   2. Click the name of your computer (in the top of the list), and then click OK.

      The Locations dialog closes and the name of your computer appears in the From this location: field.

   3. In the Enter the Object names to select field, enter the name of your application pool using the following format:

      IIS AppPool\Application_Pool_Name
      

      For example, to add the default application pool, enter the following text:

      IIS AppPool\DefaultAppPool
      

   4. Click Check Names, and then click OK.

      The Select Users, Computers, or Groups dialog closes. The Permissions for SmHost.conf appears with the Application Pool selected.

7. Under the Allow list, select the following check boxes:
   • Read
   • Read and Execute
   • Write
8. Click OK.

   The Permissions for SmHost.conf dialog closes.

9. Click OK.

   The SmHost.conf Properties dialog closes. The application pool identities are granted permission for the CA SiteMinder® SmHost.conf file.