CA SiteMinder. Agent for SharePoint Release Notes

Transcription

1 CA SiteMinder Agent for SharePoint Release Notes SP1 for SharePoint 2010 and 2013

2 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation ) is for your informational purposes only and is subject to change or withdrawal by CA at any time. This Documentation is proprietary information of CA and may not be copied, transferred, reproduced, disclosed, modified or duplicated, in whole or in part, without the prior written consent of CA. If you are a licensed user of the software product(s) addressed in the Documentation, you may print or otherwise make available a reasonable number of copies of the Documentation for internal use by you and your employees in connection with that software, provided that all CA copyright notices and legends are affixed to each reproduced copy. The right to print or otherwise make available copies of the Documentation is limited to the period during which the applicable license for such software remains in full force and effect. Should the license terminate for any reason, it is your responsibility to certify in writing to CA that all copies and partial copies of the Documentation have been returned to CA or destroyed. TO THE EXTENT PERMITTED BY APPLICABLE LAW, CA PROVIDES THIS DOCUMENTATION AS IS WITHOUT WARRANTY OF ANY KIND, INCLUDING WITHOUT LIMITATION, ANY IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NONINFRINGEMENT. IN NO EVENT WILL CA BE LIABLE TO YOU OR ANY THIRD PARTY FOR ANY LOSS OR DAMAGE, DIRECT OR INDIRECT, FROM THE USE OF THIS DOCUMENTATION, INCLUDING WITHOUT LIMITATION, LOST PROFITS, LOST INVESTMENT, BUSINESS INTERRUPTION, GOODWILL, OR LOST DATA, EVEN IF CA IS EXPRESSLY ADVISED IN ADVANCE OF THE POSSIBILITY OF SUCH LOSS OR DAMAGE. The use of any software product referenced in the Documentation is governed by the applicable license agreement and such license agreement is not modified in any way by the terms of this notice. The manufacturer of this Documentation is CA. Provided with Restricted Rights. Use, duplication or disclosure by the United States Government is subject to the restrictions set forth in FAR Sections , , and (c)(1) - (2) and DFARS Section (b)(3), as applicable, or their successors. Copyright 2014 CA. All rights reserved. All trademarks, trade names, service marks, and logos referenced herein belong to their respective companies.

3 CA Technologies Product References This document references the following CA Technologies products: CA SiteMinder CA DLP Content classification service Contact CA Technologies Contact CA Support For your convenience, CA Technologies provides one site where you can access the information that you need for your Home Office, Small Business, and Enterprise CA Technologies products. At you can access the following resources: Online and telephone contact information for technical assistance and customer services Information about user communities and forums Product and documentation downloads CA Support policies and guidelines Other helpful resources appropriate for your product Providing Feedback About Product Documentation If you have comments or questions about CA Technologies product documentation, you can send a message to techpubs@ca.com. To provide feedback about CA Technologies product documentation, complete our short customer survey which is available on the CA Support website at

4

5 Contents Chapter 1: Release Notes for the CA SiteMinder Agent for SharePoint 9 Chapter 2: New Features 11 Support for 2048 Key Support Support for CA Introscope SessionLinker Support Single Log Out Multiple User Directory Connections Supported New Language Settings Introduced Chapter 3: Changes to Existing Features 13 New Procedure for Configuring Log Files Office Client Integration with Microsoft KB and KB Different File Location for Fixing Truncated Attributes in SharePoint Upgrade of OpenSSL Chapter 4: Installation Considerations 15 System Locale Must Match the Language of Installation and Configuration Directories Chapter 5: Operating System Support 17 Policy Server Prerequisites Chapter 6: Defects Fixed in Connection Wizard Not Adding Attributes to Policy Store (159448) Forbidden Message not Issued for WebDAV Requests After Microsoft Hotfixes Installed (159153, ) Chapter 7: Defects Fixed in Error in PowerShell Script for Updating Trusted Identity Provider Certificates In Agent Guide (175584) Openssl Required Upgrade (175119) Agent for Sharepoint 2010 Connection Wizard Failed to Do Basic Input Validation Contents 5

6 Chapter 8: Defects Fixed in SP1 23 CSmProxy60FilterCtxt and CSmSPPlugin Did Not Log TransactionID in Trace Messages (165202) Removed Space in Content-Type Header (179758) Chapter 9: Known Issues 25 SSL Stops Working After an Upgrade (162487) SharePoint Agent Cannot Access DLP-protected Document (169890) People Picker Displays Duplicate Values for Resolved User in Google Chrome (169879) People Picker Window is Blank in FireFox Browser (169882) SharePoint Installation Fails Specifying Custom Object Classes in LDAP not Supported (CQ139697) SharePoint Credential Collector Dialog Appears (CQ140429) SharePoint FedAuth Cookies and Office Client Integration Behavior Duplicate Ports not Detected by Configuration Wizard Close Browser After Logging Off with X.509 Authentication Scheme (CQ ) Inconsistency between runtime Access Policy and People Picker Behavior (CQ ) Cannot Access Protected SharePoint Resource using the Impersonation Authentication Scheme (CQ ) Cannot Access Protected SharePoint Resource using the Anonymous Authentication Scheme (CQ ) Traditional Web Agents As Cookie Providers not Supported (CQ137292) Incorrect SAML 2.0 Auto-post Message Appears During Log On (CQ ) HTTP 500 Error is Displayed when SharePoint Issues a 302 as FedAuth Cookie Expires (CQ ) Search for Claims works with IdentifierClaim at certain places in SharePoint ProxyTrust agent configuration parameter not necessary (CQ ) Default Location of FCC forms in Administrative UI does not Work SharePoint Component in Profiler is for SharePoint 2007 Agent (CQ ) Incorrect Trace.conf Path in LoggerConfig.properties File (CQ ) SharePoint People Picker Stops Responding (CQ139284) Backup your Existing Proxy Rules before Running Configuration Wizard (CQ142050, CQ140787) No Assertion Consumer URL found for RP Message in Log Files (CQ141783) Chapter 10: Documentation 39 Guide Names Known Issues CA SiteMinder Agent for SharePoint Bookshelf Agent for SharePoint Release Notes

7 Appendix A: Third Party Software Acknowledgements 41 Index 43 Contents 7

8

9 Chapter 1: Release Notes for the CA SiteMinder Agent for SharePoint These Release Notes contain product installation notes, operating system support, known issues, and information about contacting CA Technologies Technical Support. Chapter 1: Release Notes for the CA SiteMinder Agent for SharePoint 9

10

11 Chapter 2: New Features This section contains the following topics: Support for 2048 Key Support (see page 11) Support for CA Introscope (see page 11) SessionLinker Support (see page 11) Single Log Out (see page 11) Multiple User Directory Connections Supported (see page 12) New Language Settings Introduced (see page 12) Support for 2048 Key Support The Agent for SharePoint supports the 2048-bit and 4096-bit asymmetric keys in encryption. Support for CA Introscope The Agent for SharePoint supports integration with CA Introscope that lets you monitor the data performance of the Agent for SharePoint. SessionLinker Support The Agent for SharePoint supports the SessionLiker component, which improves security by associating CA SiteMinder sessions with those of third-party applications. Single Log Out A single logout feature is supported. When users log out from one SharePoint web application, they are automatically logged out from any other SharePoint web applications. Chapter 2: New Features 11

12 Multiple User Directory Connections Supported Multiple User Directory Connections Supported Connections to multiple user directories are supported by configuring aliases for the attribute mappings to each directory. Important! Multiple directory connections are supported with Policy Server version 12.5 and above only. New Language Settings Introduced Release SP1 of this product introduces the ability to set the following items to other languages: Log files. Command-line help. The following languages are supported: Brazilian Portuguese French German Italian Japanese Korean Simplified Chinese Spanish 12 Agent for SharePoint Release Notes

13 Chapter 3: Changes to Existing Features New Procedure for Configuring Log Files I upgraded from a previous version. How do I enable logging on this new version? For more information, see the CA SiteMinder Agent for SharePoint Guide. Office Client Integration with Microsoft KB and KB My Office Client Integration (WebDAV) broke after I installed the following Microsoft hot fixes: KB KB A work-around is available. For more information, see the CA SiteMinder Agent for SharePoint Guide. More information: 403 Forbidden Message not Issued for WebDAV Requests After Microsoft Hotfixes Installed (159153, ) (see page 20) Chapter 3: Changes to Existing Features 13

14 Different File Location for Fixing Truncated Attributes in SharePoint Different File Location for Fixing Truncated Attributes in SharePoint The CA SiteMinder Agent for SharePoint uses the MaxUserAttributeLength setting to control the length of the attributes displayed in SharePoint. For and , this setting was in the following file: policy_server_home\config\properties\wsfed.properties For SP1, the MaxUserAttributeLength is located in a different file: policy_server_home\config\properties\entitlementgenerator.properties Update the MaxUserAttributeLength setting in the EntitlementGenerator.properties file so that it matches the one that you used in the older version of the CA SiteMinder Agent for SharePoint. Upgrade of OpenSSL CA SiteMinder Agent for SharePoint uses OpenSSL 0.9.8za to fix the following vulnerabilities: CVE : An SSL/TLS MITM vulnerability exists in OpenSSL 0.9.8y and earlier. An attacker using a carefully crafted handshake can force the use of weak keying material in OpenSSL SSL/TLS clients and servers. This can be exploited by a Man-in-the-middle (MITM) attack where the attacker can decrypt and modify traffic from the attacked client and server. CVE : DTLS recursion flaw exists in OpenSSL 0.9.8y and earlier. By sending an invalid DTLS handshake to an OpenSSL DTLS client, the code can be made to recurse, eventually crashing in a DoS attack. CVE : Anonymous ECDH denial of service flaw exists in OpenSSL 0.9.8y and earlier. OpenSSL TLS clients enabling anonymous ECDH ciphersuites are subject to a denial of service attack. CVE : Fix for the attack described in the paper "Recovering OpenSSL ECDSA Nonces Using the FLUSH+RELOAD Cache Side-channel Attack". For more information about the vulnerabilities, see the OpenSSL documentation set. 14 Agent for SharePoint Release Notes

15 Chapter 4: Installation Considerations System Locale Must Match the Language of Installation and Configuration Directories To install and configure a CA SiteMinder component to a non-english directory, set the system to the same locale as the directory. Also, make sure that you installed the required language packages so the system can display and users can type localized characters in the installer screens. For the details on how to set locale and required language packages, refer to respective operating system documents. Chapter 4: Installation Considerations 15

16

17 Chapter 5: Operating System Support CA SiteMinder Agent for SharePoint supports the following operating systems: Windows Server 2008 Windows Server 2008 R2 Solaris 9 Solaris 10 RH Linux 4 RH Linux 5 Note: The platform support for the Claims Provider is Windows Server bit and Windows Server 2008 R2. Policy Server Prerequisites The CA SiteMinder Policy Server requires the following prerequisites to operate with the CA SiteMinder Agent for SharePoint: CA SiteMinder Policy Server 12.5, 12.0 SP3 CR05 NIN Build 443 and above. Important! Multiple directory connections are supported with Policy Server version 12.5 and above only. CA SiteMinder Administrative UI 12.5 (any CR), 12.0 SP3 CR05 NIN Build 443 and above. (For Office Client Integration) HTTP methods for WebDAV defined in the CA SiteMinder Agent type An SSL Certificate The following open ports: Ports for accounting, authentication, and authorization requests (44441, 44442, respectively) Port for Connection Wizard (44444) Ports for directory server connections. Chapter 5: Operating System Support 17

18

19 Chapter 6: Defects Fixed in This section contains the following topics: Connection Wizard Not Adding Attributes to Policy Store (159448) (see page 19) 403 Forbidden Message not Issued for WebDAV Requests After Microsoft Hotfixes Installed (159153, ) (see page 20) Connection Wizard Not Adding Attributes to Policy Store (159448) The connection wizard fails with the following error: Error occured while configuring the SharePoint connection details. The connection wizard log shows the following errors: Custom Action: com.netegrity.brlib.customcode.encryptiawrapper Status: ERROR Additional Notes: ERROR - class com.netegrity.brlib.customcode.encryptiawrapper.install() Unexpected Fatal Error: Install Action: InstallAnywhere Variables Status: SUCCESSFUL Custom Action: com.netegrity.brlib.customcode.encryptiawrapper Status: ERROR Additional Notes: ERROR - class com.netegrity.brlib.customcode.encryptiawrapper.install() Unexpected Fatal Error: This issue is fixed. STAR Issues :01 and :01 Chapter 6: Defects Fixed in

20 403 Forbidden Message not Issued for WebDAV Requests After Microsoft Hotfixes Installed (159153, ) 403 Forbidden Message not Issued for WebDAV Requests After Microsoft Hotfixes Installed (159153, ) Customers receive error messages when trying to open Office 2007 documents after certain Microsoft hot fixes are installed. This issue is fixed. STAR Issues: :01, :01 More information: Office Client Integration with Microsoft KB and KB (see page 13) 20 Agent for SharePoint Release Notes

21 Chapter 7: Defects Fixed in This section contains the following topics: Error in PowerShell Script for Updating Trusted Identity Provider Certificates In Agent Guide (175584) (see page 21) Openssl Required Upgrade (175119) (see page 21) Agent for Sharepoint 2010 Connection Wizard Failed to Do Basic Input Validation (see page 22) Error in PowerShell Script for Updating Trusted Identity Provider Certificates In Agent Guide (175584) The text of the PowerShell script in the topic "Create a PowerShell Script to Update the Certificates" in the CA SiteMinder Agent for SharePoint Guide was incorrect. Specifically, "$cert" at the end of the following line should be "rootcert": New-SPTrustedRootAuthority -Name "CASigningRootCert" -Certificate $cert This issue has been fixed. The line now correctly reads as follows: New-SPTrustedRootAuthority -Name "CASigningRootCert" -Certificate $rootcert STAR issue: Openssl Required Upgrade (175119) Openssl shipped with the CA SiteMinder Agent for SharePoint had security vulnerabilities Openssl upgraded to version 0.9.8y. Star issue Chapter 7: Defects Fixed in

22 Agent for Sharepoint 2010 Connection Wizard Failed to Do Basic Input Validation Agent for Sharepoint 2010 Connection Wizard Failed to Do Basic Input Validation The Share point 2010 Connection Wizard did not check for blank spaces embedded in realm and sign alias names. Consequently, the installer was not able to install Sharepoint 2010 Connection Wizard service. This wizard has been updated to address this problem. Star issue: Agent for SharePoint Release Notes

23 Chapter 8: Defects Fixed in SP1 This section contains the following topics: CSmProxy60FilterCtxt and CSmSPPlugin Did Not Log TransactionID in Trace Messages (165202) (see page 23) Removed Space in Content-Type Header (179758) (see page 23) CSmProxy60FilterCtxt and CSmSPPlugin Did Not Log TransactionID in Trace Messages (165202) CSmProxy60FilterCtxt and CSmSPPlugin were not writing out the TransactionID in the Trace File, which made troubleshooting issues difficult. This problem has been corrected. Star issue ;2 Removed Space in Content-Type Header (179758) The Agent for SharePoint 2010 is removing the space in the "Content-Type" header when the dharset is "utf-8". This problem has been corrected. Star issue ;1 Chapter 8: Defects Fixed in SP1 23

24

25 Chapter 9: Known Issues This section contains the following topics: SSL Stops Working After an Upgrade (162487) (see page 26) SharePoint Agent Cannot Access DLP-protected Document (169890) (see page 27) People Picker Displays Duplicate Values for Resolved User in Google Chrome (169879) (see page 27) People Picker Window is Blank in FireFox Browser (169882) (see page 27) SharePoint Installation Fails (see page 28) Specifying Custom Object Classes in LDAP not Supported (CQ139697) (see page 28) SharePoint Credential Collector Dialog Appears (CQ140429) (see page 28) SharePoint FedAuth Cookies and Office Client Integration Behavior (see page 29) Duplicate Ports not Detected by Configuration Wizard (see page 30) Close Browser After Logging Off with X.509 Authentication Scheme (CQ ) (see page 31) Inconsistency between runtime Access Policy and People Picker Behavior (CQ ) (see page 31) Cannot Access Protected SharePoint Resource using the Impersonation Authentication Scheme (CQ ) (see page 32) Cannot Access Protected SharePoint Resource using the Anonymous Authentication Scheme (CQ ) (see page 32) Traditional Web Agents As Cookie Providers not Supported (CQ137292) (see page 32) Incorrect SAML 2.0 Auto-post Message Appears During Log On (CQ ) (see page 33) HTTP 500 Error is Displayed when SharePoint Issues a 302 as FedAuth Cookie Expires (CQ ) (see page 33) Search for Claims works with IdentifierClaim at certain places in SharePoint (see page 34) ProxyTrust agent configuration parameter not necessary (CQ ) (see page 34) Default Location of FCC forms in Administrative UI does not Work (see page 35) SharePoint Component in Profiler is for SharePoint 2007 Agent (CQ ) (see page 35) Incorrect Trace.conf Path in LoggerConfig.properties File (CQ ) (see page 36) SharePoint People Picker Stops Responding (CQ139284) (see page 36) Backup your Existing Proxy Rules before Running Configuration Wizard (CQ142050, CQ140787) (see page 36) No Assertion Consumer URL found for RP Message in Log Files (CQ141783) (see page 37) Chapter 9: Known Issues 25

26 SSL Stops Working After an Upgrade (162487) SSL Stops Working After an Upgrade (162487) I upgraded my CA SiteMinder Agent for SharePoint, but my SSL connections stopped working. Generate a new SSLConfig properties file by performing the following steps: Run the GenerateSSLConfig script installed with the Agent for SharePoint to generate an SSLConfig.properties file for the keystore. SSLConfig.properties is required to protect the Claims WS service. GenerateSSLConfig uses the following syntax: GenerateSSLConfig -keystorepass password_to_your_keystore Follow these steps: 1. Open a command-line window with Administrative privileges. 2. Navigate to the following directory: Agent-for-SharePoint_home\proxy-engine\bin 3. Run one of the following script files: (Windows) GenerateSSLConfig.Bat (UNIX or Linux) GenerateSSLConfig.sh You specify the following parameters when you run the script: -keystorepass Specifies the password for the keystore. If an SSLConfig.properties file exists, an overwrite warning appears. A confirmation message confirms the keystore was configured and displays the directory of the keystore you created. The SSLConfig.properties file is generated. 26 Agent for SharePoint Release Notes

27 SharePoint Agent Cannot Access DLP-protected Document (169890) SharePoint Agent Cannot Access DLP-protected Document (169890) Unable to access the DLP-protected document because the DLP application cannot retrieve the content identifier from the SharePoint Agent. When you use the SharePoint Agent with the DLP integration, follow these steps: 1. Navigate to the catalina.properties file in the directory SharePoint_agent_install_dir\Tomcat\conf 2. Uncomment the following line in the catalina.properties file: org.apache.tomcat.util.http.servercookie. ALLOW_HTTP_SEPARATORS_IN_V0=true 3. Save the file. People Picker Displays Duplicate Values for Resolved User in Google Chrome (169879) When you add a user to the site permissions, the user details are populated twice in the grant permission window. This occurs when using Google Chrome to view the site. There is no work around for this issue. People Picker Window is Blank in FireFox Browser (169882) In the People Picker grant permission window, click the user/group button. The Select People and Groups window is blank when it displays in a Firefox browser. The window does not display any objects against which to search. Resize the People Picker window and it displays the objects. Chapter 9: Known Issues 27

28 SharePoint Installation Fails SharePoint Installation Fails If you try to install SharePoint 2010 or later on a machine with CA SiteMinder SPS or the CA SiteMinder Agent for SharePoint, the installer detects that SharePoint already exists. The installation of SharePoint on a machine with CA SiteMinder SPS or the CA SiteMinder Agent for SharePoint is not supported. Specifying Custom Object Classes in LDAP not Supported (CQ139697) I use custom object classes in my LDAP directory, and I set the registry setting correctly in the Policy Server. Can I list the names of my custom object classes instead of using an asterisk, as the CA SiteMinder Agent for SharePoint documentation indicates? No. This version requires an asterisk if custom object classes are used. SharePoint Credential Collector Dialog Appears (CQ140429) Some users see a SharePoint credential collector dialog when they try to access a protected resource. This dialog appears when users access a SharePoint web application that has more than one claims provider type configured on a zone. The dialog contains a drop-down list of each provider. Multiple providers exist for different reasons. If this dialog appears, select the SiteMinder provider to proceed. 28 Agent for SharePoint Release Notes

29 SharePoint FedAuth Cookies and Office Client Integration Behavior SharePoint FedAuth Cookies and Office Client Integration Behavior SharePoint stores a persistent FedAuth cookie on the hard drives of authenticated users. I do not want the SharePoint server to use these persistent cookies. You can configure SharePoint so a persistent FedAuth cookie is not stored. However, disabling the persistent FedAuth cookie also disables the single-sign on function of Office Client Integration. Users who try to open files on the SharePoint server are challenged for their credentials. Note: For more information about how to disable FedAuth cookies in SharePoint 2010, go to the technet blogs website, and then search for the following phrase: "Setting the Login Token Expiration Correctly for SharePoint 2010 SAML Claims Users" Chapter 9: Known Issues 29

30 Duplicate Ports not Detected by Configuration Wizard Duplicate Ports not Detected by Configuration Wizard I received an error message regarding a duplicate port after running the Configuration Wizard for the Agent for SharePoint. Do the following: 1. To change an HTTP port, do the following steps: a. Open the following file: Agent-for-SharePoint_home\httpd\conf\httpd.conf b. Locate the following directive: Listen port c. Change the port number to the one you want to use for HTTP. d. Locate the following directive: ServerName url:port e. Change the port number at the end of the URL to the same one you changed in Step c. f. Save your changes to the file. 2. To change an HTTPS port, do the following steps: a. Open the following file: Agent-for-SharePoint_home\httpd\conf\extra\httpd-ssl.conf b. Locate the following directive: Listen port c. Change the port number to the one you want to use for HTTPS. d. Locate the following directive: ServerName url:port e. Change the port number at the end of the URL to the same one you changed in Step c. f. Locate the following directive: <VirtualHost url:port> g. Change the port number at the end of the URL to the same one you changed in Step c. h. Save your changes to the file. 3. Restart the CA SiteMinder Agent for SharePoint. 30 Agent for SharePoint Release Notes

31 Close Browser After Logging Off with X.509 Authentication Scheme (CQ ) Close Browser After Logging Off with X.509 Authentication Scheme (CQ ) I can access a protected SharePoint resource with the SiteMinder X.509 authentication scheme after logging out by clicking the back button in the browser. If I click the Sign In as different user button on a SharePoint site protected with the CA SiteMinder X.509 Authentication scheme, the home page appears. This behavior is a known issue. The problem occurs when the client certificate remains in the browser cache. Close the browser after logging out. Inconsistency between runtime Access Policy and People Picker Behavior (CQ ) An inconsistency occurs between an access policy and the people picker when CA SiteMinder Forms protection is configured for a SharePoint web application or zone. User access to a SharePoint site is governed first by the CA SiteMinder user policy and then by the SharePoint permissions. The behavior changes when SharePoint permissions are configured through the People and Groups dialog (people picker) and the CA SiteMinder protection is configured using ASP.NET Forms authentication. The CA SiteMinder user directory connection object governs the list of users and groups returned. The CA SiteMinder user access policy does not affect the results. This behavior means that while a SharePoint site administrator can select users using People and Groups dialog (people picker) and grant them access to a SharePoint resource, CA SiteMinder denies them access to the resource at runtime. As a workaround, do the following steps: 1. Create CA SiteMinder user directory connection objects that are restricted to the set of users contained in the CA SiteMinder user policy associated with the SharePoint sites. 2. Include the directory object in the policy and select all users from this directory object in the user policy. Chapter 9: Known Issues 31

32 Cannot Access Protected SharePoint Resource using the Impersonation Authentication Scheme (CQ ) Cannot Access Protected SharePoint Resource using the Impersonation Authentication Scheme (CQ ) I cannot access a protected SharePoint web application using the CA SiteMinder Impersonation Authentication scheme, and a page cannot be displayed error appears. The CA SiteMinder Agent for SharePoint does not currently support the Impersonation Authentication scheme. Cannot Access Protected SharePoint Resource using the Anonymous Authentication Scheme (CQ ) I cannot access a protected SharePoint web application using the CA SiteMinder Anonymous Authentication scheme, and a page cannot be displayed error appears. This error message appears because the SMIDENTITY cookie is created with the anonymous login instead of the SMSESSION cookie. The CA SiteMinder Agent for SharePoint does not currently support the Anonymous Authentication scheme. Traditional Web Agents As Cookie Providers not Supported (CQ137292) If I set up a traditional web agent as a cookie provider, the traditional web agent does not operate well with the CA SiteMinder Agent for SharePoint. This scenario is not supported. Use a framework-based web agent as a cookie provider in this situation. 32 Agent for SharePoint Release Notes

33 Incorrect SAML 2.0 Auto-post Message Appears During Log On (CQ ) Incorrect SAML 2.0 Auto-post Message Appears During Log On (CQ ) I see a SAML 2.0 Auto-post on the browser tab while logging on to the CA SiteMinder Agent for SharePoint. This behavior is a known issue. SiteMinder CA SiteMinder Agent for SharePoint does not consume SAML 2.0 but uses WS-Federation 1.1 Token protocol. The message which appears in the tab is defined in the FWS constants class as SAML2_AUTO_POST_FORM_TITLE. This class is the base class for all federation protocols. HTTP 500 Error is Displayed when SharePoint Issues a 302 as FedAuth Cookie Expires (CQ ) The SharePoint redirect fails and a 500 error appears in my browser when the following occurs: I perform a POST action on a page in SharePoint, and the SharePoint Fed-Auth cookie expires. This behavior is a known issue with the SharePoint Claims-based authentication model. SharePoint Claims Authentication fires a 302 redirect to the account partner to re issue a WS-FED Token instead of allowing SharePoint to acknowledge the POST. Using the WS-FED Token SharePoint re-creates a new Fed-Auth Cookie. SharePoint then tries to redo the same POST action and the HTTP 500 error is displayed. Chapter 9: Known Issues 33

34 Search for Claims works with IdentifierClaim at certain places in SharePoint Search for Claims works with IdentifierClaim at certain places in SharePoint When multiple claims are configured for a Trusted Identity Provider, I can search for claims at certain key areas in SharePoint only with the claim that is designated as the IdentifierClaim. This behavior is a known limitation with SharePoint. At certain areas, search works only with the IdentifierClaims and not the other claims. Some of the areas where configured claims cannot be searched include the following: Site Collection Administration People Picker Window Check Permission in the People Picker Window ProxyTrust agent configuration parameter not necessary (CQ ) In the previous SiteMinder Agent for SharePoint version, I had to set the ProxyTrust parameter when the agent operated behind a proxy server. How do I set it for this release? This version of the Agent for SharePoint is implemented as part of a proxy-based authentication solution. Setting the ProxyTrust parameter in your agent configuration is no longer necessary. 34 Agent for SharePoint Release Notes

35 Default Location of FCC forms in Administrative UI does not Work Default Location of FCC forms in Administrative UI does not Work I tried to configure CA SiteMinder forms-based authentication (FCC), but when I use the following default value shown in the Administrative UI, it does not work: /siteminderagent/forms/login.fcc The Agent for SharePoint uses a different directory for forms-based authentication. Do the following: 1. Create the siteminderagent directory in the following location: Agent-for-SharePoint_home/proxy-engine/examples/siteminderagent 2. Copy the forms folder from the following directory: Agent-for-SharePoint_home/proxy-engine/examples To the following directory: Agent-for-SharePoint_home/proxy-engine/examples/siteminderagent The forms are copied to Agent-for-SharePoint_home/proxy-engine/examples/siteminderagent/forms. SharePoint Component in Profiler is for SharePoint 2007 Agent (CQ ) The Policy Server Profiler contains a SharePoint component which is included in the trace file. The SharePoint component in the Profiler is for the CA SiteMinder Agent for SharePoint 2007 solution. Because the CA SiteMinder Agent for SharePoint 2010 solution is based on SAML federation, this component does not function as designed. To trace internal Policy Server diagnostics and the communication with the CA SiteMinder Agent for SharePoint, use the profiler settings based on SAML IDP profiler trace template (samlidp_trace.template). Chapter 9: Known Issues 35

36 Incorrect Trace.conf Path in LoggerConfig.properties File (CQ ) Incorrect Trace.conf Path in LoggerConfig.properties File (CQ ) The LoggerConfig.properties file shows the Trace.conf configuration file location as TraceConfig=/CA/Agent-for-SharePoint/conf/defaultagent/FederationTrace.conf The location of the Trace.conf file is incorrect in the LoggerConfig.properties file. The proxy-engine subdirectory is missing. Set the correct path to /CA/Agent-for-SharePoint/proxy-engine/conf/defaultagent/FederationTrace.conf. SharePoint People Picker Stops Responding (CQ139284) The SharePoint people picker stops responding during searches. This behavior is normal. This condition occurs when the FedAuth cookie expires. As a workaround, close the SharePoint people picker. Wait a moment and open the SharePoint people picker again. Backup your Existing Proxy Rules before Running Configuration Wizard (CQ142050, CQ140787) I want to run the configuration wizard for the CA SiteMinder Agent for SharePoint again. What happens to my configuration settings? Back up your existing proxy rules file in the following location before running the configuration wizard again: Agent-for-SharePoint_home\proxy-engine\conf\proxyrules.xml After you run the wizard, delete the new proxyrules.xml file and rename your backup copy accordingly. 36 Agent for SharePoint Release Notes

37 No Assertion Consumer URL found for RP Message in Log Files (CQ141783) No Assertion Consumer URL found for RP Message in Log Files (CQ141783) The following message appears in my federationtrace.log file: No Assertion Consumer URL found for RP What does it mean? This message is informational only. No problem exists. Chapter 9: Known Issues 37

38

39 Chapter 10: Documentation This section contains the following topics: Guide Names (see page 39) Known Issues (see page 39) CA SiteMinder Agent for SharePoint Bookshelf (see page 39) Guide Names The names of the CA SiteMinder Agent for SharePoint guides are as follows: Guide CA SiteMinder Agent for SharePoint Guide CA SiteMinder Agent for SharePoint Release Notes To view PDF files, download and install Adobe Reader from the Adobe website if it is not already installed on your computer. Known Issues The known issues are confidential and they are no longer included in Release Notes. To view the known issues, perform the following steps: 1. Click Release Notes in the bookshelf main page. 2. Click Confidential Content against Known Issues and log in to CA Support Online. CA SiteMinder Agent for SharePoint Bookshelf The CA SiteMinder Agent for SharePoint bookshelf lets you do the following: Use a single browser window to view all documents published for the CA SiteMinder Agent for SharePoint. Use a single alphabetical index to find a topic in any document. Search all documents for one or more words. Chapter 10: Documentation 39

40

41 Appendix A: Third Party Software Acknowledgements The CA SiteMinder Agent for SharePoint incorporates software from third party companies. For more information about the third party software acknowledgements, see the main page of the CA SiteMinder Agent for SharePoint Bookshelf. Appendix A: Third Party Software Acknowledgements 41

42

43 Index Forbidden Message not Issued for WebDAV Requests After Microsoft Hotfixes Installed (159153, ) 20 A Agent for Sharepoint 2010 Connection Wizard Failed to Do Basic Input Validation 22 B Backup your Existing Proxy Rules before Running Configuration Wizard (CQ142050, CQ140787) 36 C CA SiteMinder Agent for SharePoint Bookshelf 39 CA Technologies Product References 3 Cannot Access Protected SharePoint Resource using the Anonymous Authentication Scheme (CQ ) 32 Cannot Access Protected SharePoint Resource using the Impersonation Authentication Scheme (CQ ) 32 Changes to Existing Features 13 Close Browser After Logging Off with X.509 Authentication Scheme (CQ ) 31 Connection Wizard Not Adding Attributes to Policy Store (159448) 19 Contact CA Technologies 3 CSmProxy60FilterCtxt and CSmSPPlugin Did Not Log TransactionID in Trace Messages (165202) 23 D Default Location of FCC forms in Administrative UI does not Work 35 Defects Fixed in Defects Fixed in Defects Fixed in SP1 23 Different File Location for Fixing Truncated Attributes in SharePoint 14 Documentation 39 Duplicate Ports not Detected by Configuration Wizard 30 E Error in PowerShell Script for Updating Trusted Identity Provider Certificates In Agent Guide (175584) 21 G Guide Names 39 H HTTP 500 Error is Displayed when SharePoint Issues a 302 as FedAuth Cookie Expires (CQ ) 33 I Inconsistency between runtime Access Policy and People Picker Behavior (CQ ) 31 Incorrect SAML 2.0 Auto-post Message Appears During Log On (CQ ) 33 Incorrect Trace.conf Path in LoggerConfig.properties File (CQ ) 36 Installation Considerations 15 K Known Issues 25, 39 M Multiple User Directory Connections Supported 12 N New Features 11 New Language Settings Introduced 12 New Procedure for Configuring Log Files 13 No Assertion Consumer URL found for RP Message in Log Files (CQ141783) 37 O Office Client Integration with Microsoft KB and KB Openssl Required Upgrade (175119) 21 Operating System Support 17 Index 43

44 P People Picker Displays Duplicate Values for Resolved User in Google Chrome (169879) 27 People Picker Window is Blank in FireFox Browser (169882) 27 Policy Server Prerequisites 17 ProxyTrust agent configuration parameter not necessary (CQ ) 34 R Release Notes for the CA SiteMinder Agent for SharePoint 9 Removed Space in Content-Type Header (179758) 23 S Search for Claims works with IdentifierClaim at certain places in SharePoint 34 SessionLinker Support 11 SharePoint Agent Cannot Access DLP-protected Document (169890) 27 SharePoint Component in Profiler is for SharePoint 2007 Agent (CQ ) 35 SharePoint Credential Collector Dialog Appears (CQ140429) 28 SharePoint FedAuth Cookies and Office Client Integration Behavior 29 SharePoint Installation Fails 28 SharePoint People Picker Stops Responding (CQ139284) 36 Single Log Out 11 Specifying Custom Object Classes in LDAP not Supported (CQ139697) 28 SSL Stops Working After an Upgrade (162487) 26 Support for 2048 Key Support 11 Support for CA Introscope 11 System Locale Must Match the Language of Installation and Configuration Directories 15 T Third Party Software Acknowledgements 41 Traditional Web Agents As Cookie Providers not Supported (CQ137292) 32 U Upgrade of OpenSSL Agent for SharePoint Release Notes