SecureAuth IdP FileSync Service Troubleshooting

A new realm (e.g. SecureAuth30) must be created on all nodes in the cluster since the FileSync Service will not create new directories – it can only sync what is already present on the appliance.

In SecureAuth IdP versions 7.5.0 - 8.0.0, an issue exists for theCreate new realm functionality, affecting the FileSync Service. When a new realm is created, its companion file share is created with an extraneous character prepended to the realm name. Since this name differs from what the FileSync Service expects, the realm is ignored.

To work around this issue, run the Reset File Permissions and Shares Tool. See the support document Using the Reset File Permissions and Shares Tool.

A permanent fix for this issue is included in SecureAuth IdP 8.0.1. To upgrade the SecureAuth IdP Appliance, contact SecureAuth Support for assistance.

In SecureAuth IdP versions through 8.1.1, an issue exists for theCreate new realm functionality in which file system privileges of the template realm are not preserved. This issue prevents the new realm from having privileges necessary for modern FileSync Service installations to function – FileSync Service installations which use v3.0.0 or later of the installer are affected.

To resolve this issue, run the Reset File Permissions and Shares Tool. See the support document Using the Reset File Permissions and Shares Tool.

By default, the FileSync Service is configured to synchronize every 10 minutes (600000 milliseconds). While a 10-minute interval covers most customer use cases, there may be situations in which a higher value is needed; this may occur due to a high latency network connection between nodes or a large amount of realms.

A common sign that a longer synchronization interval might be needed is when the FileSync Service uses an excessive amount of CPU time on an Appliance. If this occurs in the environment, SecureAuth suggests increasing the interval time by updating the valueInterval in theFileSyncService.exe.config file. The FileSyncService.exe.config file is located atD:\MFCApp_Bin\Appliance_Sync\FileSyncService

As a general rule, SecureAuth suggests doubling the existing value for testing. Once the changes have been made, restart the SecureAuth IdP FileSync Service so the revised configuration takes effect.

On domain joined SecureAuth IdP Appliances, when the installer is creating a local account, a delay may occur where the script pauses. Support Engineers have noted it can takeup to 15 minutesfor the account to be created.This may occur because the installer is using the Microsoft NET Usecommand to create the local account.

If a delay occurs, SecureAuth advises to give the function time to complete.

The SecureAuth IdP FileSync Service has a digital signature that allows .NET to validate the authenticity of the binary at run time; this feature is known as Code Access Security (CAS).

If CAS is unable to contact the GoDaddy\Starfield CRL-OCSP URLs to check for revocation, then the .NET thread can hang and prevent the service from starting.

If the customer IT Security policies preclude opening access to those URLs, disable CAS by editing the FileSync Service configuration file located atD:\MFCApp_Bin\Appliance_Sync\FileSyncService\FileSyncService.exe.config. Change the setting <generatePublisherEvidence enabled="true"/> to <generatePublisherEvidence enabled="false"/>.

For more information about these URLs, see the Prerequisite tab or the GoDaddy support document Verifying a Certificate's Validity On Your Computer.

If the paths.list file ( D:\SecureAuth\SecureAuth0) is updated and it is not syncing all items in the directory, ensure all sub-folders are included as well.

For example, to sync the 2013 theme, make the following entries