Node secret mismatch: agent and server using different node secrets when authenticating from Citrix Web Interface 5.4 with the RSA Authentication Agent for Windows to RSA Authentication Manager
Originally Published: 2014-03-31
Article Number
Applies To
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x, 7.1
Platform: Authentication Agent for Windows
RSA Version/Condition: 7.2.1
Issue
- Unable to log on to the Web Interface using RSA Authentication Agent 7.2.1 for Windows local authentication client for two-factor authentication.
- The event log might contain one of following messages:
There was a problem with the RSA SecurID ACE/Agent. Check that the ACE/Agent is installed correctly.
- The following ASP.NET warning:
An exception named System.BadImageFormatException or System.Web.HttpUnhandledException was unhandled.
- When authenticating from the Citrix Web Interface, the following error messages appear on the RSA Real Time Authentication Activity Monitor:
- Node secret mismatch: agent and server using different node secrets.
- Verifying node secret for agent <agent_name> with IP address <IP_address_of_agent>. in security domain SystemDomain."
Cause
There are three possible causes for this issue:
- On 64-bit operating systems, the default Web Interface application pool is configured for 32-bit applications, preventing the Web Interface from using 64-bit RSA Authentication Agent for Web for Internet Information Services files.
- The Web Interface is unable to locate the RSA Authentication Agent on the Web server.
- The node secret used to ensure secure communication between the Web Interface and the RSA Authentication Manager is no longer in synch.
Resolution
To enable 64-bit applications in the Web Interface application pool
- On the Web server, open the MMC Internet Information Services (IIS) Manager snap-in.
- Select your Web server in the left pane and, in the Action pane, click View Application Pools.
- Select the Web Interface application pool and, in the Action pane, click Advanced Settings.
- On the General tab, set Enable 32-Bit Applications to False and click OK.
On 64-bit operating systems only, copy the sdconf.rec, nodesecret.rec, and securid files to the following three locations:
- C:\Windows\System32
- C:\Windows\SysWOW64
- C:\Program Files\Common Files\RSA Shared\Auth Data
To enable the Web Interface to locate the RSA Authentication Agent,
- Add the path to the file aceclnt.dll file that is typically located in the C:\Program Files\Common Files\RSA Shared directory, to the PATH environment variable in Windows.
- Reboot the server.
- Try to authenticate from the Citrix Web Interface
Related Articles
Run as Different User option generated a node secret mismatch with RSA Authentication Agent 7.2.1 Number of Views Node secret mismatch when testing authentication of RSA Authentication Agent for Web: IIS with RSA Authentication Manager Number of Views Node secret mismatch error when authenticating with an RSA Authentication Agent for Windows when NetMotion is installed Number of Views Managing the configuration files of an RSA Authentication Agent for Windows Number of Views Unable to authenticate on AD FS servers that are using different language than the default English-US when RSA Authenticat… Number of Views
Trending Articles
Troubleshooting RSA SecurID Access Identity Router to RSA Authentication Manager test connection failures RSA SecurID Software Token 5.0.2 Downloads for Microsoft Windows RSA Authentication Manager 8.9 Release Notes (January 2026) Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Active Directory RSA Authentication Manager 8.8 Setup and Configuration Guide
Don't see what you're looking for?
