SecurID: How to create node secret for clustered web server in RSA Authentication Manager
3 months ago
Originally Published: 2005-09-23
Article Number
000058210
Applies To
RSA Authentication Manager
Microsoft Windows Server 2003
THIS SOLUTION IS FOR INTERNAL USE ONLY - DO NOT DISTRIBUTE
Microsoft Clustering Services
Microsoft Network Load Balancing
Issue
How to create node secret for clustered web server in RSA Authentication Manager
Resolution

-On the Authentication Manager side perform the following steps.

1- Login to the security console with an admin role user. 
2- Add an authentication agent with the hostname of the cluster and the virtual IP as the agent host's IP using below steps.
--Access > Authentication Agents > Add New
--Add two secondary nodes to that Agent Host entry, and add the two physical IP addresses of the two clustered server. 

 

- On the first agent host perform the following steps.

1-override it's IP address with the address of the cluster.
2-Do a test authentication to create the node secret.
3-Now export the node secret to a file using below steps.

--Run "Start->Run...->regedt32".
--Go to HKEY_LOCAL_MACHINE\SOFTWARE\SDTI\ACECLIENT
--Click on File->Export, enter NodeSecret.reg as the file name, ensure the file is saved in a location you can readily access.
-Locate that file using Windows Explorer, right-click on it and select Edit. Edit the file and remove all the keys except "NodeSecret", so that the file looks like this :

-----------------------------------------------
Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\SDTI\ACECLIENT]
"NodeSecret"=hex:ac,6b,db,32,26,91,ed,ad,e5,03,c8,d1,9a,c1,33,d9,e5,fd,72,8d,\
  ba,e4,c4,b9,09,bc,30,df,9e,2f,81,29,46,e6,90,a1,33,5a,c1,a4,a1,e7,d0,94,ba,\
...
  df,88,f1,f6,dc,3b,18,03,71,87,52,3f,3e,dd,59,4c,ec
@=""
-----------------------------------------------

4-Save the file and copy it to the second clustered server.

 

-On the secondary agent host perform the following steps.
1-Install the agent and override it's IP address with the address of the cluster. DO NOT DO A TEST AUTHENTICATION.  2
2-Double-click on the file, and click "Yes" to add the information to the registry. 
3-Now do a test authentication, you should be able to authenticate.