000017238 - Node secret mismatch: agent and server using different node secrets when authenticating from Citrix Web Interface 5.4 with the RSA Authentication Agent for Windows to RSA Authentication Manager

Document created by RSA Customer Support Employee on Jun 16, 2016•Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 4Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000017238
Applies ToRSA Product Set:  SecurID
RSA Product/Service Type:   Authentication Manager
RSA Version/Condition: 8.x, 7.1
Platform:  Authentication Agent for Windows 
RSA Version/Condition: 7.2.1
Issue
  • Unable to log on to the Web Interface using RSA Authentication Agent 7.2.1 for Windows local authentication client for two-factor authentication. 
  • The event log might contain one of following messages:
There was a problem with the RSA SecurID ACE/Agent. Check that the ACE/Agent is installed correctly.

  • The following ASP.NET warning:
An exception named System.BadImageFormatException or System.Web.HttpUnhandledException was unhandled.

  • When authenticating from the Citrix Web Interface, the following error messages appear on the RSA Real Time Authentication Activity Monitor:
    • Node secret mismatch: agent and server using different node secrets.
    • Verifying node secret for agent <agent_name> with IP address <IP_address_of_agent>. in security domain SystemDomain."
Cause
There are three possible causes for this issue:

  • On 64-bit operating systems, the default Web Interface application pool is configured for 32-bit applications, preventing the Web Interface from using 64-bit RSA Authentication Agent for Web for Internet Information Services files.
  • The Web Interface is unable to locate the RSA Authentication Agent on the Web server.
  • The node secret used to ensure secure communication between the Web Interface and the RSA Authentication Manager is no longer in synch.
Resolution
To enable 64-bit applications in the Web Interface application pool

  1. On the Web server, open the MMC Internet Information Services (IIS) Manager snap-in.
  2. Select your Web server in the left pane and, in the Action pane, click View Application Pools.
  3. Select the Web Interface application pool and, in the Action pane, click Advanced Settings.
  4. On the General tab, set Enable 32-Bit Applications to False and click OK.
 

On 64-bit operating systems only, copy the sdconf.rec, nodesecret.rec, and securid files to the following three locations:

  • C:\Windows\System32
  • C:\Windows\SysWOW64
  • C:\Program Files\Common Files\RSA Shared\Auth Data
 
To enable the Web Interface to locate the RSA Authentication Agent,

  1. Add the path to the file aceclnt.dll  file that is typically located in the C:\Program Files\Common Files\RSA Shared directory, to the PATH environment variable in Windows.
  2. Reboot the server.
  3. Try to authenticate from the Citrix Web Interface
Legacy Article IDa64818

Attachments

    Outcomes