CA Siteminder 12.7 installation on windows server failing during data definition

[Deactivated User]

Hi All,

 

I am trying to install CA Siteminder 12.7 on a windows environment where I have installed the policy server and configured the policy store in policy server. When I am trying to run below command to create data definition it is failing with below error

 

C:\Program Files\CA\siteminder\xps\dd>XPSDDInstall SmMaster.xdd
[XPSDDInstall - XPS Version 12.7.0000.1194]
Log output: C:\Program Files\CA\siteminder/log/XPSDDInstall.2018-09-09_220901.log
Initializing database, please wait...
(ERROR) : [sm-xadobj-00010] Object store initialization failed.
(FATAL) : [sm-xpsxps-03570] SiteMinder interface initialization failed.
(WARN) : [Assert] Assert failed: pSmStore
(FATAL) : [sm-xpsxps-04120] Unable to initialize the XPS library.

 

Created the below schema on policy sore and confiured the user in Policy server admin UI which gave success message.

 

 

Below is what we found in the log file.

 

[2796/2288][Sun Sep 09 2018 22:09:01][smdefs.cpp:604][INFO][sm-Server-02460] Cannot open file C:\Program Files\CA\siteminder\admin\smadmindata.txt
[2796/2288][Sun Sep 09 2018 22:09:01][SmObjProvider.cpp:243][INFO][sm-Server-02830] Initializing policy store provider 'LDAP:'
[2796/2288][Sun Sep 09 2018 22:09:01][SmObjProvider.cpp:252][INFO][sm-log-00000] Initializing key store provider 'ODBC:'
[2796/2288][Sun Sep 09 2018 22:09:01][SmObjProvider.cpp:282][INFO][sm-Server-02840] Loading of policy store provider extension DLL: 'smobjldapims' succeeded.
[2796/2288][Sun Sep 09 2018 22:09:01][SmLdapPs.cpp:248][INFO][sm-Ldap-02140] SSL client init will not be attempted - no certificate database defined
[2796/2288][Sun Sep 09 2018 22:09:02][smldaputils.cpp:523][INFO][sm-Ldap-00540] Opening policy store connection to LDAP server: ' host-7:19389 '
[2796/2288][Sun Sep 09 2018 22:09:02][SmLdapBulkSearch.cpp:174][CSmLdapBulkSearchImpl::CreateRoot][INFO][sm-xpsxps-01160] LDAP Provider Info String = CA Directory
[2796/2288][Sun Sep 09 2018 22:09:02][SmLdapBulkSearch.cpp:228][CSmLdapBulkSearchImpl::CreateRoot][INFO][sm-xpsxps-01120] LDAP Provider Version: supportedLdapVersion = 3
[2796/2288][Sun Sep 09 2018 22:09:02][SmLdapBulkSearch.cpp:228][CSmLdapBulkSearchImpl::CreateRoot][INFO][sm-xpsxps-01120] LDAP Provider Version: dxServerVersion = dxserver 12.6.00 (build 14043) Windows_NT 64-Bit
[2796/2288][Sun Sep 09 2018 22:09:02][SmEventTrap.cpp:388][INFO][sm-Server-02500] Loading event handler 'C:\Program Files\CA\siteminder\bin\XPSAudit.dll'
[2796/2288][Sun Sep 09 2018 22:09:02][SmEventTrap.cpp:402][INFO][sm-Server-02510] Initializing event handler 'C:\Program Files\CA\siteminder\bin\XPSAudit.dll'
[2796/2288][Sun Sep 09 2018 22:09:02][CSmDbManager.cpp:559][ERROR][sm-Odbc-00030] Database 'Policy Store' is disabled.
[2796/2288][Sun Sep 09 2018 22:09:02][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'RootConfig' . LDAP Error creating new RootConfig object in policy store
[2796/2288][Sun Sep 09 2018 22:09:02][SmObjCache.cpp:404][INFO][sm-Server-02800] Preloading policy store cache
[2796/2288][Sun Sep 09 2018 22:09:02][SmObjCache.cpp:417][INFO][sm-Server-02860] BulkFetch policy store
[2796/2288][Sun Sep 09 2018 22:09:02][CSmDbManager.cpp:559][ERROR][sm-Odbc-00030] Database 'Policy Store' is disabled.
[2796/2288][Sun Sep 09 2018 22:09:02][CSmDbManager.cpp:559][ERROR][sm-Odbc-00030] Database 'Policy Store' is disabled.
[2796/2288][Sun Sep 09 2018 22:09:02][SmAdapterStore.cpp:366][CSmAdapterStore::Init][ERROR][sm-xadobj-00010] Object store initialization failed.
[2796/2288][Sun Sep 09 2018 22:09:02][Database.cpp:483][InitSmStore][FATAL][sm-xpsxps-03570] SiteMinder interface initialization failed.
[2796/2288][Sun Sep 09 2018 22:09:02][Database.cpp:662][InitDB][WARN][Assert] Assert failed: pSmStore
[2796/2288][Sun Sep 09 2018 22:09:02][XPSTools.cpp:161][CXPSTools::CXPSTools][FATAL][sm-xpsxps-04120] Unable to initialize the XPS library.

 

Please let me know if any one faced similar issue during installation.

 

Thanks,

Rajesh

[Legacy User]

rajeuppa

 

It seems like in smconsole, in data tab, we selected LDAP for PStore and ODBC for KStore.

 

Could you recheck what is your PStore and KStore. 

 

In smconsole, data tab, select from the drop down PStore / KStore. Check what is opted between PStore / KStore. By default when we are configuring manually, the default option on PStore / KStore is ODBC. We often only do the needful on PStore. But we never flip to KStore, thus KStore stays configured to ODBC. We have to also manually flip KStore to use LDAP or use same as PStore.

 

Regards

Hubert.

[Deactivated User]

Hi Hubert Dennis,

 

Changed the KStore to LDAP in SMConsole and then tried to run the data definition cammed which failed again with different errors. Below is the complete error log from the server.

 

[3260/3880][Tue Sep 11 2018 22:22:58][smdefs.cpp:604][INFO][sm-Server-02460] Cannot open file C:\Program Files\CA\siteminder\admin\smadmindata.txt
[3260/3880][Tue Sep 11 2018 22:22:58][SmObjProvider.cpp:243][INFO][sm-Server-02830] Initializing policy store provider 'LDAP:'
[3260/3880][Tue Sep 11 2018 22:22:58][SmObjProvider.cpp:282][INFO][sm-Server-02840] Loading of policy store provider extension DLL: 'smobjldapims' succeeded.
[3260/3880][Tue Sep 11 2018 22:22:58][SmLdapPs.cpp:248][INFO][sm-Ldap-02140] SSL client init will not be attempted - no certificate database defined
[3260/3880][Tue Sep 11 2018 22:22:59][smldaputils.cpp:523][INFO][sm-Ldap-00540] Opening policy store connection to LDAP server: ' host-7:19389 '
[3260/3880][Tue Sep 11 2018 22:22:59][SmLdapBulkSearch.cpp:174][CSmLdapBulkSearchImpl::CreateRoot][INFO][sm-xpsxps-01160] LDAP Provider Info String = CA Directory
[3260/3880][Tue Sep 11 2018 22:22:59][SmLdapBulkSearch.cpp:228][CSmLdapBulkSearchImpl::CreateRoot][INFO][sm-xpsxps-01120] LDAP Provider Version: supportedLdapVersion = 3
[3260/3880][Tue Sep 11 2018 22:22:59][SmLdapBulkSearch.cpp:228][CSmLdapBulkSearchImpl::CreateRoot][INFO][sm-xpsxps-01120] LDAP Provider Version: dxServerVersion = dxserver 12.6.00 (build 14043) Windows_NT 64-Bit
[3260/3880][Tue Sep 11 2018 22:22:59][SmEventTrap.cpp:388][INFO][sm-Server-02500] Loading event handler 'C:\Program Files\CA\siteminder\bin\XPSAudit.dll'
[3260/3880][Tue Sep 11 2018 22:22:59][SmEventTrap.cpp:402][INFO][sm-Server-02510] Initializing event handler 'C:\Program Files\CA\siteminder\bin\XPSAudit.dll'
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'RootConfig' . LDAP Error creating new RootConfig object in policy store
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjCache.cpp:404][INFO][sm-Server-02800] Preloading policy store cache
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjCache.cpp:417][INFO][sm-Server-02860] BulkFetch policy store
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjCache.cpp:420][INFO][sm-Server-02810] Precaching system configuration objects
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjCache.cpp:489][INFO][sm-Server-02820] Precaching each Policy Domain
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjCache.cpp:493][INFO][sm-Server-02870] BulkRelease policy store
[3260/3880][Tue Sep 11 2018 22:22:59][PolicyCache.cpp:1307][INFO][sm-Server-02880] Building policy cache ...
[3260/3880][Tue Sep 11 2018 22:22:59][PolicyCache.cpp:1406][INFO][sm-Server-02890] Building policy cache done
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjStore.cpp:1573][INFO][sm-Server-00050] Object store initialized
[3260/2472][Tue Sep 11 2018 22:22:59][SmObjStore.cpp:1194][INFO][sm-Server-00110] Starting object store journal thread
[3260/3856][Tue Sep 11 2018 22:22:59][SmObjStore.cpp:1020][INFO][sm-Server-00070] Object store journal thread started
[3260/3856][Tue Sep 11 2018 22:22:59][SmObjStore.cpp:1021][INFO][sm-Server-00080] Journal commands refresh interval is 60 second(s)
[3260/3856][Tue Sep 11 2018 22:22:59][SmObjStore.cpp:1022][INFO][sm-Server-00090] Server command synchronization delta is 51 second(s)
[3260/3856][Tue Sep 11 2018 22:22:59][SmObjStore.cpp:1023][INFO][sm-Server-05250] Secondary cache failure timeout is 0 second(s)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for scheme of type SAML1, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for scheme of type SAML2, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for scheme of type WSFED, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (All SAML Affiliations, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (HostTemplates, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (AgentTemplates, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (WS-Security Metadata, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (AuthValidateMap, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (AgentTemplates, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (All SAML Affiliations, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for scheme of type SAML1, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for scheme of type WSFED, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for scheme of type SAML2, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for AuthMethodGroup, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (WS-Security Metadata, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata collection for scheme of type OAuthIdP, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (metadata section for AuthMethod, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (HostTemplates, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object
[3260/3880][Tue Sep 11 2018 22:22:59][SmAdapterStore.cpp:271][CSmAdapterStore::FindPropertyCollection][ERROR][sm-xadobj-00110] Create failed. (AuthValidateMap, Unknown Failure)
[3260/3880][Tue Sep 11 2018 22:22:59][Database.cpp:483][InitSmStore][FATAL][sm-xpsxps-03570] SiteMinder interface initialization failed.
[3260/3880][Tue Sep 11 2018 22:22:59][Database.cpp:662][InitDB][WARN][Assert] Assert failed: pSmStore
[3260/3880][Tue Sep 11 2018 22:22:59][XPSTools.cpp:161][CXPSTools::CXPSTools][FATAL][sm-xpsxps-04120] Unable to initialize the XPS library.

 

Regards,

Rajesh

[Legacy User]

Hi Rajesh,

 

It seems the account you are using to update the records on the DSA has not enough privileges, or the DSA server has a problem writing the data:

[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'RootConfig' . LDAP Error creating new RootConfig object in policy store
[3260/3880][Tue Sep 11 2018 22:22:59][SmObjProvider.cpp:187][ERROR][sm-Server-03090] Policy store failed operation 'Save' for object type 'PropertyCollection' . LDAP Error creating new PropertyCollection object

 

You could check both things and see on the DSA logs what is happening when the data is being saved. Maybe, creating a new DSA from scratch may help if you did some operations already with an incorrect configuration on the smconsole (LDAP/ODBC mismatch).

 

I hope it helps!

[Legacy User]

Rajesh rajeuppa

 

Kindly confirm if we are following the steps defined in 'CA SSO' documentation for setting up CA Directory as PStore. CA SSO Documentation does not speak in detail about Directory access controls. However if we have just setup a DSA instance and created the necessary PStore structure / admin user as per CA SSO documentation, then there would be no access control applied to the admin user, OOB CA Directory runs on anonymous mode, even when using admin credentials from PS to connect with PStore. There is a far more deeper learning curve with regards to disabling anonymous mode in CA Directory and enabling access control in CA Directory; which is detailed in CA Directory documentation.

 

We *MUST* complete all steps from [1] to [9] before attempting [10] to [12]. Failure to follow / miss any steps from [1] to [9] will give us errors in creation of the 'root' config object when running XPSDDInstall in step [10].

 

Configure a CA Directory Policy Store - CA Single Sign-On - 12.8 - CA Technologies Documentation

This content describes how to configure a single CA Directory server instance to store policy data and encryption keys. If your implementation requires, you can configure a separate key store. Using a single directory server simplifies administration tasks.   Gather Directory Server Information Create a DSA for the Policy Store Create the Policy Store Schema Open the DSA Create the Base Tree Structure for Policy Store Data Create a Superuser Administrator for the DSA Point the Policy Server to the Policy Store Set the CA Single Sign-On Super User Password Verify the CA Directory Cache Configuration Import the Policy Store Data Definitions Import the Default Policy Store Objects Prepare for the Administrative UI Registration

 

Regards

Hubert

[justin_leong]

rajeuppa

Hi Rajesh,

just curious, I noticed the screenshot that you did not expand the OU=PolicySvr4.  Can you confirm that you also have OU=XPS under it?

 

The structure should look like below:

OU=XPS, OU=PolicySvr4, OU=SiteMinder, OU=Netegrity

 

thanks,

Justin

[Vijay Masurkar]

Hi Rajesh, Is this issue still open? If yes, what's the status based on the last recommendations from Hubert and Justin? Did those help?  If not, please consider opening a ticket with CA Spt.

Thanks, Vijay

[Stephen Lavoie]

"Policy store failed operation 'Save' for object type 'RootConfig' . LDAP Error creating new RootConfig object in policy store"

 

The initial problem and the later problem reported are being caused by the same root.  The Policy Store schema is not being loaded properly.

 

1) Make sure that the "netegrity.dxc" and the "etrust.dxc" schema files are copied from the policy server to:

C:\Program Files\CA\Directory\dxserver\config\schema

 

2) Make sure the "<DSA>dxg" file is sourcing both schema files

C:\Program Files\CA\Directory\dxserver\config\schema\<DSA>.dxg

#SSO Policy Store Schema
source "netegrity.dxc";
source "etrust.dxc";

 

3) Make sure the "<DSA>.dxi" is pointing to the correct DSA config. files:

C:\Program Files\CA\Directory\dxserver\config\servers\<DSA>.dxi

 

example: DSA = "policystore1"

 

# logging and tracing
source "../logging/policystore1.dxc";

# schema
source "../schema/policystore1.dxg";

# knowledge
clear dsas;
source "../knowledge/policystore1.dxc";

# operational settings
source "../settings/default.dxc";

# service limits
source "../limits/PolicyStore1.dxc";

 

4) Stop and Start the DSA

dxserver stop <DSA>

dxserver start <DSA>

 

This issue is occurring somewhere in the sourcing of the schema files int he DSA configuration.