Layer7 Access Management

Tech Tip: Running Web Agents in Dynamically Scaled Environments

By Madhusudhan Yoganath posted 09-04-2018 11:08 AM


Deploying CA Single Sign-On (CA SSO) Web Agents in dynamically scaled and containerized environments, such as OpenShift or other PaaS platforms, has been a hot topic.

The good news is that CA SSO supports registration that allow web agents to run in containerized environments since the release of CA SSO 12.6.


What is a Container After All?

In basic terms, a container is a form of virtualization and a packaging format for a unit of software that ships together. A container image is a form factor that encapsulates a set of software and its dependencies, the minimal set of runtime libraries that the software needs to do its function.

Enterprises running containers will need container orchestration solutions such as Kubernetes and other components for container management, either running in their own or in a public cloud. 


The Role of Docker in Containers

The adoption of Docker in organizations deploying containers has fueled an active ecosystem, with thousands of “Dockerized" applications in the Docker Hub registry. Cloud service providers such as Amazon Web Services (AWS), Google and Azure have embraced Docker and rolled out offerings of their own related to the ecosystem.

Here are some key factors as to why our customers are starting to embrace Docker:


  • Docker gels well with DevOps practices at scale. They are easy to deploy and accelerate application delivery coupled with immutability.
  • Portability is another key benefit of Docker because all required application dependencies can be packaged within the container's layers. Vendors can ensure that the application payload will execute on any node with the same operating system (OS) kernel type (Windows or Linux), that the application was compiled for. This also enables easy migration of workloads to public cloud services and across public cloud services. Therefore, Docker enables cloud-agnostic based practices and can help in avoiding vendor lock-ins.
  • Container orchestration platforms enable auto-scaling of containers and coupled with rapid startup and shutdown times, makes it well-suited for architectures requiring on-demand scale up and down, which improves the total cost of ownership of deployments.
  • Containers result in efficient resource usage, as the packaging model eliminates redundancies with higher application density, also improving TCO. 


CA Single Sign-On Web Agents and Docker

When Web agents are used in Docker containers or other dynamically scaled environments like OpenShift, scenarios can occur where containers with Web Agents are frequently initiated or destroyed, as they are scaling up or down based on the load that is caused by incoming requests. These scenarios require a different approach when registering those Web Agent instances.

To handle the rapid registration and removal of containers that are running web servers with the Web Agents, the instances of the same Web Agent must use the same trusted host. To do this, you must assign a trusted host to each logical application (rather than to each agent instance) and use the shared secret of the trusted host whenever you are initializing a new Web Agent container of that application.

The below documentation link explains in greater detail the approach of running Web Agents in dynamically scaled environments:

The CA SSO product team is also continuing to improve and optimize this approach. Keep watching this space for hearing more about what we are working towards or let us know your thoughts. If there are any topics you’d like additional tech tips on, please let us know!


CA SSO Product Team



11-27-2018 08:12 PM

Is the use of WebAgent supported on other container platforms

such as Kubernetes or other as well as Docker and OpenShift explicitly listed in the document?

Use Web Agent in Dynamically Scaled Environments - CA Single Sign-On - 12.7 - CA Technologies Documentation 

[Using Docker containers and container platforms like OpenShift TM, introduces scenarios where containers with Web Agents can be frequently instantiated, or destroyed, as they are scaling up or down based on the load that is caused by incoming requests. These scenarios require taking a different approach when registering those Web Agent instances.]

09-05-2018 01:23 AM

Hi Seongil,

You can use this approach to register all versions of the Web Agents (6x and later), if you are using policy server with 12.6.01 and above. 


Specifically, if you are looking for Access Gateway and Policy Server docker images, We are in the development phase.

If you are on, you will have access to the preview content and in a few weeks time, we are looking to publish the docker images and kubernetes manifest files and so you can get access to these as well.





09-04-2018 07:43 PM

Is it possible to release in this year? I am planning to run CA SSO on my OpenShift environments in next year.