Troubleshooting: Adaptive Authentication Settings Not Saving

Version Affected: 9.2 and later
 
 

Overview

After upgrading, Adaptive Authentication settings do not save for a realm.

 

Cause

The Admin Api and Analyze Api realms are running with a different AnalyzeApiAppId and AnalyzeApiAppKey than the realm whose settings won’t save.

 

Resolution:

First, confirm both of the following exist. If either is missing, stop and contact SecureAuth Support — the Updater needs to be run on this IdP to add them:

• D:\SecureAuth\AnalyzeApi\web.config
• D:\SecureAuth\Api\web.config

Next, check whether the problem affects one realm or every realm.

If it is one realm: match that realm’s AnalyzeApiAppId, AnalyzeApiAppKey, and ServerCertSN to a working realm’s values.

If every realm is affected: update the Admin Api and Analyze Api realms with the correct AppId, AppKey, and servercertcn.

To make either change:

1. In the Admin Console, click the SecureAuth logo, then Tools → Decrypt Web Config.
2. Select Admin Api, Analyze Api, and the realm being updated, then click Decrypt.
3. Back up D:\SecureAuth\AnalyzeApi\web.config and D:\SecureAuth\Api\web.config.
4. Open D:\SecureAuth\SecureAuth<X>\web.config for a working realm and note its AnalyzeApiAppId, AnalyzeApiAppKey, and ServerCertSN values.
5. In D:\SecureAuth\AnalyzeApi\web.config, set Api.AppId to that AnalyzeApiAppId value, and Api.AppKey to that AnalyzeApiAppKey value. Set ServerCertSN to match as well.
6. In D:\SecureAuth\Api\web.config, set AnalyzeApiAppId and AnalyzeApiAppKey to the same values noted in step 4, and set ServerCertSN to match as well.

Special Considerations:

If Adaptive Authentication settings still won’t save after the above, compare SecureAuth0\web.config against Api\web.config and confirm the machineKey element is an exact match between the two, as shown below.

A mismatch here — including in the Forms Name element — can also cause the AdminApiLogs to show Adaptive Authentication Threat Services as missing, as shown below, even when the steps above have already been completed.

Also confirm the Api web.config contains the following setting alongside ServerCertSN:

<add key="WCFClientCertSN" value="servercertsn" />

To list the current AnalyzeApi settings across every realm at once, first decrypt all realms, then run:

gci D:\SecureAuth\SecureAuth*\web.config,D:\SecureAuth\Api\web.config | %{$name = $_.fullname; get-content $_ | ?{$_ -match "AnalyzeApiApp|ServerCertSN|validationKey|decryptionKey"} | %{"$name $_"}}

To list the current Api.AppId and Api.AppKey settings for the AnalyzeApi realm specifically, run:

gci D:\SecureAuth\AnalyzeApi\web.config | %{$name = $_.fullname; get-content $_ | ?{$_ -match "Api.App|ServerCertSN|validationKey|decryptionKey"} | %{"$name $_"}}

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.