How to use name locking with RSA ACE/Agent 5.0 API
2 years ago
Originally Published: 2001-09-24
Article Number
000055104
Applies To
RSA ACE/Agent 5.0 API
UNIX (AIX, HP-UX, Solaris)
Microsoft Windows NT 4.0
Microsoft Windows 2000
SD_LOCK
Issue
How to use name locking with RSA ACE/Agent 5.0 API
The sync2.c example code provided with RSA ACE/Agent 5.0 API is used to demonstrate name locking and Server fail over. The example is put into a continuous loop broken only by an error condition, which then results in SD_Close being called. When a name lock is established the user gets ACCESS DENIED even though there are available ACE/Server Replicas to authenticate against. The next authentication works correctly.
Cause
When the SD_Lock function is called from the API, the Agent will use a status file to see which servers are available for authentication. Once it has chosen a server from this list it sends out a name lock to prevent any other server in the ACE/Server domain from authenticating this user. However, if the chosen server is down SD_Lock will return a status of ACM_ACCESS_DENIED.
Resolution
The server status information used by RSA ACE/Agent 5.0 is not updated until the API handle is closed. For the API to perform a successful name lock on a live server, an SD_Close and SD_Init need to be performed to allow SD_Lock to find a new server.

The status file created is %SystemRoot%\System32\sdstatus.12 on Windows NT/2000 systems and $VAR_ACE/sdstatus.12 on UNIX systems. The following is an example of how a name lock can be establish to a valid server using the sync2.c example program:

        int acmRet = 0;  // ACM return status
        
        //...

         acmRet = SD_Lock(SdiHandle, username);
              if (acmRet != ACM_OK)
               {
                // The name lock failed. The chosen Server must be down.
                // Now to update this information to status.12 file
                // and continue with the authentication.

                // First close the API handle.
                SD_Close(SdiHandle);
                
                // Now re-open the handle for a new session.
                acmRet = SD_Init(&SdiHandle);
                   if (acmRet != ACM_OK)
                   {
                               printf("Cannot communicate with the ACE/Server.\n");
                               return 1;
                   }

                // As this is a new session the SD_Lock function will do a new search
                // for available servers, updating the status file and ensuring no other
                // down'ed servers are chosen.
                // If this SD_Lock fails then there are no available ACE/Servers!

                   acmRet = SD_Lock(SdiHandle, username);
                       if (acmRet != ACM_OK)
                       {
                           printf("Access denied. Unable to locate a valid ACE/Server.\n");
                           return 1;
                       }

       }  

Related Articles

Trending Articles

Don't see what you're looking for?