Common issues for the SPE client include network restrictions such as load balancers, proxy servers and Certificate Authorities. If the SPE is restricted by any of these then the Password Manager server cannot be contacted and the user will receive an error.
Overview
Licensing
Using a license from a previous version
Telephone verification license
Starling 2FA license
RADIUS Two-Factor Authentication
How to obtain a new license key
Upgrading
Upgrade considerations
Secure Password Extension
Password Policy Manager
Configuration
Reinitialization
Reports
Starling 2FA
Customizations
Troubleshooting
Is it possible to upgrade the Password Manager servers first and then the SPE (Secure Password Extension) at a later time?
Is it possible to roll back after the upgrade?
Does Password Policy Manager have to be upgraded on the Domain Controllers?
Upgrading from Password Manager 5.5.3 or later versions
Upgrading the Secure Password Extension
To remove the existing and assign a latest-version package
To remove an assigned MSI package
To deploy and configure Secure Password Extension
Upgrading Offline Password Reset
How to enable logging
To enable logging for Password Manager service
To enable logging for a stand-alone server
To enable logging for the Secure Password Extension (SPE)
To enable Password Policy Manager (PPM) logging:
How to move the Password Manager database
Changing the Password Manager service account
Workflow design considerations
Common Issues
New GPO options for Proxy Settings
Secure Password Extension > Secure Password Extension communication > Common Issues > New GPO options for Proxy Settings
GPO options for Proxy Settings
The following Proxy options can be set using the included ADM template found in the installation media under Password Manager\Setup\Administrative Template:
Workarounds
As previously noted, common issues include conflicts with proxy servers, load balancers and firewalls.
If the SPE cannot communicate with the Self-Service site, try the following:
- Logon to the workstation and confirm that the Self-Service URL that is published on the desktop (shortcut) works
- Make note of the URL that is set in the browser address bar
- Logon to the Password Manager Admin site and under General Settings | Realm Instances ensure the URL is the same.
If the URL is incorrect in the Admin site:
- Update the setting on the Realm Instances page to the correct desired URL
If the URL is correct in the Admin site:
Any stale or invalid Service Connections Points available, must be deleted.
In order to determine whether or not the Service Connection Points are valid, you will have to right-click and select Properties on the object and click Attribute Editor. Look for keywords and then click Edit. Look for the entries called CONFIGURATION.SERVER_URLS, CONFIGURATION.TIME_STAMP and also VERSION.ProductVersion.
Example:
Figure 2:
- If the URLs and Service Connection Point objects are correct, check proxy settings.
Check with your internal team that is responsible for the proxy server configuration to confirm whether or not anonymous access is allowed.
If it is not allowed, try setting the following options in a GPO using the Password Manager Administrative template:
Proxy server: i.e. http://proxy.dc.domain.com:8080
Or
Proxy server configuration script: http://proxy.dc.domain.com/proxy.pac
- Confirm the Network Load Balancer has the correct server IP addresses configured.
Check with your internal team that is responsible for the Network Load Balancer to ensure it has the correct IP addresses for all Password Manager servers using the Self-Service URL.