Node secret issues after setting up RSA SecurID Authentication Agent 8.0 for Web for Internet Information Services (IIS)

[#1]

Article Number

000033179

Applies To

RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent 8.0 Web for IIS
RSA Version/Condition: 8.0

Issue

The agent is having the following issues completing a successful authentication:

1. The node secret is not bring created.
2. Test authentication fails after setting up the agent.
3. After protecting the website/OWA through the agent, the test authentication fails from the website/OWA .
4. On the RSA Authentication Manager, the Authentication Activity Monitor shows the following error:

Node secret mismatch: Cleared on the agent but not on the server

Cause

The items above are due to a permissions issue on the Windows server where the web agent is installed.

Resolution

1. Login to the Windows Server as a local administrator where the web agent is installed.
2. Disable User Account Control (UAC) settings.
   1. On the taskbar click Start.
   2. In the search field, type Change User Account Control settings.
   3. Click Open Change User Account Control settings.
   4. Pull the bar down to the bottom so the options for Never notify me when is set to Programs try to install software or make changes to my computer.
   5. Click OK.

Image description

3. Disable the Windows firewall.
4. Disable antivirus software, if enabled with IPS/IDS or Enabled with Enhanced Security.
5. On the Control Panel, select and right click on the RSA Authentication Agent icon andchoose  run as administrator.
6. On the Advanced tab, set the IP Address Override. Change the default IP of 255.255.255.255 to the IP address of the Windows server where the RSA web agent is installed.

Image description

7. Go back to the Main tab and do the test authentication from the RSA web agent by clicking Test Authentication with RSA Authentication Manager.

Image description

8. The node secret will be sent from the RSA Authentication Manager to the web agent on the first successful authentication. 

Image description

Look for the file named securid (with no file extension) in C:\Program Files\RSA Security\RSAWebAgent.

Image description

9. While the node secret file is sent to the agent on the first authentication attempt, it is not used until subsequent authentications.  To make sure the node secret is working correctly, repeat the test authentication four or five more times.
10. Open a command prompt and run an iisreset.
11. Do the test authentication from the protected website/OWA. 
    1.  If the test authentication from the protected website/OWA fails with the message below, check the node secret location on the IIS which the agent is protecting.  This error happens because the protected website/OWA is looking for the node secret file in an incorrect location or where the file does not exist.

Node secret mismatch: Cleared on the agent but not on the server

2.  Copy the sdconf.rec, sdstatus.12 and securid files from C:\Program Files\RSA Security\RSAWebAgent to C:\Program Files (x86)\RSA Security\RSAWebAgent.

Image description 
 

Image description

12. Launch a command prompt and run iisreset.
13. Now the test authentication will be successful from the protected website/OWA.