Issue with using isapi_redirect and siteminder

server administration XI Server Discussion
1

We have been having a problem for quite some time now. It only affects about 10 users out of hundreds accessing BOE content. This doesn’t happen in DEV because siteminder is only used in staging & production where this issue happens.

Our current setup in staging:
2 BOE Application Servers
1 BOE Webserver - IIS with siteminder, isapi_redirect, & tomcat.

Siteminder authenticates a user & sends them through the redirect to the tomcat server which resides on the same web server. The trusted authentication parameter that is passed is “smuser”.

All users access the system the same way. However, 10 users once passed through siteminder crash the iis app pool with the redirect plugin.

The only thing siteminder agent logs tell us is:
[CSmHttpPlugin.cpp:1417][WARNING] Unable to process SMSESSION cookie.

The redirect logs just show us that the isapi_redirect.dll restarted due to the application pool crashing.

Testing that we have done:
-Turning off siteminder fixes this issue. The 10 users can get through & manually login to infoview.
-Creating them a new Active Directory account placing them into the same groups they were in fixes the issue.
-Simply turning siteminder back on causes the app pool to crash when they hit the redirect.

Sometimes they can actually get through the redirect long enough to hit tomcat & receive some of the page back but then it finally crashes the app pool.

We have run a dump analyzer for IIS and found that during the process the last reference before the crash is for the isapi_redirect.dll. No other information can be seen as to the cause of this issue.

We have had Microsoft, SAP, Siteminder, & Our AD people looking at this at one point or another. The only thing that has taken place is a bunch of “finger pointing”.

Some of the information I’ve received from siteminder server logs sent to me from their team has shown a user with their sessionid sort of looping when they come through. Compared to a working user which only has 1 or 2 entries an affected person will have 10-15 entries looking like it’s just resetting & getting sent over & over until it crashes.

Has anyone ever had or seen this issue? Maybe even something similar? We are trying to find the cause of this problem and fix it because we’ve been told “what if it happens to more users?”.

We have done tons of network traces, http traces, & logs traces only to find that everything with their sessions look ok but then see it crash with no other info than the plugin restarted.

paboe961 (BOB member since 2010-06-11)

2

[Moderator Note: Moving from General Discussion to XI Server Discussion]

Marek Chladny :slovakia: (BOB member since 2003-11-27)

3

Does it happens when the users in question log in through on the other computer rather then own machine? If this is happens only on their machine rebuild users profile.

icotler :us: (BOB member since 2002-08-19)

4

Well I finally found the new release of isapi_redirect.dll 1.2.30. We were running 1.2.28. We loaded the new version and it seems to be fine now. We have had a few of the 10 affected users test with no issues so far. The new version was released at the end of February this year. I had been off this project for quite some time before getting pulled back in for this LOL :stuck_out_tongue:

The users would experience this issue no matter where they were. We had tested with one particular user on several different machines. We also disabled her roaming profile so it wouldn’t copy.

I’m currently reviewing the release notes since 1.2.28 but haven’t found any fixes specific to what we were experiencing. I have found one issue that comes close.

It’s weird how I just post this then find that the new version fixes the issue. Maybe someone else that has the issue will see this and help them out.

paboe961 (BOB member since 2010-06-11)