Node secret mismatch: agent and server using different node secrets when authenticating from Citrix Web Interface 5.4 with the RSA Authentication Agent for Windows to RSA Authentication Manager

[#1]

Article Number

000017238

Applies To

RSA Product Set:  SecurID
RSA Product/Service Type:   Authentication Manager
RSA Version/Condition: 8.x, 7.1
Platform:  Authentication Agent for Windows 
RSA Version/Condition: 7.2.1

Issue

• Unable to log on to the Web Interface using RSA Authentication Agent 7.2.1 for Windows local authentication client for two-factor authentication. 
• The event log might contain one of following messages:

There was a problem with the RSA SecurID ACE/Agent. Check that the ACE/Agent is installed correctly.

• The following ASP.NET warning:

An exception named System.BadImageFormatException or System.Web.HttpUnhandledException was unhandled.

• When authenticating from the Citrix Web Interface, the following error messages appear on the RSA Real Time Authentication Activity Monitor:
  • Node secret mismatch: agent and server using different node secrets.
  • Verifying node secret for agent <agent_name> with IP address <IP_address_of_agent>. in security domain SystemDomain."

Cause

There are three possible causes for this issue:

• On 64-bit operating systems, the default Web Interface application pool is configured for 32-bit applications, preventing the Web Interface from using 64-bit RSA Authentication Agent for Web for Internet Information Services files.
• The Web Interface is unable to locate the RSA Authentication Agent on the Web server.
• The node secret used to ensure secure communication between the Web Interface and the RSA Authentication Manager is no longer in synch.

Resolution

To enable 64-bit applications in the Web Interface application pool

1. On the Web server, open the MMC Internet Information Services (IIS) Manager snap-in.
2. Select your Web server in the left pane and, in the Action pane, click View Application Pools.
3. Select the Web Interface application pool and, in the Action pane, click Advanced Settings.
4. On the General tab, set Enable 32-Bit Applications to False and click OK.

On 64-bit operating systems only, copy the sdconf.rec, nodesecret.rec, and securid files to the following three locations:

• C:\Windows\System32
• C:\Windows\SysWOW64
• C:\Program Files\Common Files\RSA Shared\Auth Data

 

To enable the Web Interface to locate the RSA Authentication Agent,

1. Add the path to the file aceclnt.dll  file that is typically located in the C:\Program Files\Common Files\RSA Shared directory, to the PATH environment variable in Windows.
2. Reboot the server.
3. Try to authenticate from the Citrix Web Interface