Node secret mismatch: agent and server using different node secrets when authenticating from Citrix Web Interface 5.4 with the RSA Authentication Agent for Windows to RSA Authentication Manager
Originally Published: 2014-03-31
Article Number
Applies To
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x, 7.1
Platform: Authentication Agent for Windows
RSA Version/Condition: 7.2.1
Issue
- Unable to log on to the Web Interface using RSA Authentication Agent 7.2.1 for Windows local authentication client for two-factor authentication.
- The event log might contain one of following messages:
There was a problem with the RSA SecurID ACE/Agent. Check that the ACE/Agent is installed correctly.
- The following ASP.NET warning:
An exception named System.BadImageFormatException or System.Web.HttpUnhandledException was unhandled.
- When authenticating from the Citrix Web Interface, the following error messages appear on the RSA Real Time Authentication Activity Monitor:
- Node secret mismatch: agent and server using different node secrets.
- Verifying node secret for agent <agent_name> with IP address <IP_address_of_agent>. in security domain SystemDomain."
Cause
There are three possible causes for this issue:
- On 64-bit operating systems, the default Web Interface application pool is configured for 32-bit applications, preventing the Web Interface from using 64-bit RSA Authentication Agent for Web for Internet Information Services files.
- The Web Interface is unable to locate the RSA Authentication Agent on the Web server.
- The node secret used to ensure secure communication between the Web Interface and the RSA Authentication Manager is no longer in synch.
Resolution
To enable 64-bit applications in the Web Interface application pool
- On the Web server, open the MMC Internet Information Services (IIS) Manager snap-in.
- Select your Web server in the left pane and, in the Action pane, click View Application Pools.
- Select the Web Interface application pool and, in the Action pane, click Advanced Settings.
- On the General tab, set Enable 32-Bit Applications to False and click OK.
On 64-bit operating systems only, copy the sdconf.rec, nodesecret.rec, and securid files to the following three locations:
- C:\Windows\System32
- C:\Windows\SysWOW64
- C:\Program Files\Common Files\RSA Shared\Auth Data
To enable the Web Interface to locate the RSA Authentication Agent,
- Add the path to the file aceclnt.dll file that is typically located in the C:\Program Files\Common Files\RSA Shared directory, to the PATH environment variable in Windows.
- Reboot the server.
- Try to authenticate from the Citrix Web Interface
Related Articles
Run as Different User option generated a node secret mismatch with RSA Authentication Agent 7.2.1 Number of Views Manually generate a node secret for RSA Authentication Agent for PAM Number of Views How to recreate the node secret for RADIUS Server in RSA Authentication Manager 8.x Number of Views Node secret mismatch when testing authentication of RSA Authentication Agent for Web: IIS with RSA Authentication Manager Number of Views Manage the Node Secret Number of Views
Trending Articles
RSA Release Notes for RSA Authentication Manager 8.8 RSA MFA Agent 2.3.6 for Microsoft Windows Installation and Administration Guide RSA MFA Agent 2.4 for Microsoft Windows Installation and Administration Guide Downloading RSA Authentication Manager license files or RSA Software token seed records RSA MFA Agent 2.4.3 for Microsoft Windows Group Policy Object Template Guide
Don't see what you're looking for?
