4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<html>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<head>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <meta content="text/html; charset=ISO-8859-1"
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster http-equiv="content-type">
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster <title>CA Siteminder Integration</title>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster</head>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<body>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk<h1><small><span style="font-weight: bold;">OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIntegration with CA Siteminder</span></small><br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster</h1>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster=====================================================================<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkThis README explains the OpenAM Server SSO
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIntegration with Computer Associates (CA) SiteMinder. The README must
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkbe read in the context of OpenAM Integration Document
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterwhere the use cases, possible integrations and configurations are
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterdescribed in detail.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterThis README explains the custom codes for e.g. Authentication
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterModules,&nbsp; compilation instructions and the configuration of the
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkauth modules for OpenAM context. The OpenAM custom
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterauthentication enables the SSO integration between legacy Siteminder
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk(SM) access server and OpenAM especially when the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterdeployment contains SM for protecting existing applications.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster1. Pre-requisites :<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster==========<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster1. opensso.zip&nbsp;&nbsp;&nbsp; -&nbsp; This zip file contains all
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe&nbsp; integration souce code, configuration files and ofcourse this
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterREADME file along with regular opensso.war<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster2. Siteminder server 6.0 SP4 or higer version&nbsp; - The siteminder
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterserver must be installed and configured. For more details, check
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenksiteminder documentation. For OpenAM <br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk&nbsp;&nbsp;&nbsp; related configuration, check the OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterintegration
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterdocument. There are no trial versions available for Siteminder
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterlibraries or for other siteminder components. This <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp; document assumes that the user has minimal knowledge
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteron Siteminder components and knows how to get them.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster3. Siteminder SDK 6.0 SP4 or higher version&nbsp; - The siteminder SDK
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostermust be installed and configured. The SDK is required to compile and
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterbuild Federated<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk&nbsp;&nbsp;&nbsp; OpenAM Authentication Modules for
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSiteminder. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster4. Siteminder Agent installed and configured.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster2. Brief Description of Contents:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster======================<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterThe opensso/integrations directory contains source and configurations
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterto compile and build the custom authentication modules and other plugins.&nbsp;
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkCheck the OpenAM integration document for your use case and
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterconfigure accordingly. This document provides instructions on how to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterconfigure authentication modules<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterThe opensso.zip contains "opensso/integrations/siteminder" directory
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterwhere the source code and configurations are in place..<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterReadme.html&nbsp; - This file.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterbuild.xml - This file is a build script for building <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterconfig - This directory contains auth module configuration files.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSMAuthService.xml&nbsp;&nbsp;&nbsp; -&nbsp; This is siteminder auth
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkmodule configuration file that must be imported into OpenAM<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSMAuthModule.xml&nbsp;&nbsp; -&nbsp; This file is used for auth module
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostercall backs and for Siteminder auth module they are empty. However, the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfile must be used.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSMAuth.properties&nbsp;&nbsp;&nbsp;&nbsp; -&nbsp; This file is a
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterproperties file that stores i18n keys for siteminder authentication
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostermodule configuration lables.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterlib - This directory is by default empty . However, this lib directory
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostermust contain all the necessary libraries to compile the source
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterlibraries. They are:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; smjavaagentapi.jar,
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSmJavaApi.jar (Siteminder jar files)<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; openfedlib.jar,
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkamserver.jar, opensso-sharedlib.jar (OpenAM jar files)<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; servlet .jar file (If
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterit's Glassfish, it is javaee.jar)<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostersource - This directory contains all the source files<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostercom/sun/identity/authentication/siteminder/SMAuthModule.java <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostercom/sun/identity/authentication/siteminder/SMPrincipal.java<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; The above java source
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfiles are the custom authentication module classes that would be
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkplugged into OpenAM for generating OpenAM Session by<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; using Siteminder session.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; com
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster/sun/identity/authentication/siteminder/FAMAuthScheme.java&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster-&nbsp; This class provides codes for Siteminder AuthScheme Plugin
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterclass for generating<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Siteminder
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenksession using OpenAM session.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostercom/sun/identity/saml2/plugins/SMAdapter.java&nbsp; - This class is a
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSAML2 Plugin Adapter for SAML service providers to do the remote
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterauthentication to<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp; Siteminder using OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSession.
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkEssentially these java files are used for usecase2 in OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterintegration document.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp; <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster3: How to build:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster===========<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk1.&nbsp; Make sure all the siteminder libraries and OpenAM libraries
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterpresent in lib directory as mentioned above.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster2.&nbsp; Use&nbsp; "ant" script to build the source files. A compatible
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterant must be installed and configured in the PATH.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster3.&nbsp; cd $openssozipdir/integrations/siteminder and type ant. This
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostershould build all the source files and generates fam_sm_integration.jar
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterunder<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster$openssozipdir/integrations/siteminder/dist directory. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk4. OpenAM Installation and Configuration with Siteminder AuthModule:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster=================================================<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster1. Create a temporary directory&nbsp; for e.g. /export/tmp and unwar
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe opensso.war using jar -xvf opensso.war. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp; From now on, /export/tmp is called as a war staging
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterarea and is represented with a marco $WAR_DIR <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster2. Copy
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster$openssozipdir/integrations/siteminder/dist/fam_sm_integration.jar to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster$WAR_DIR/WEB-INF/lib<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster3. Copy Siteminder jar files smjavaagentapi.jar and SmJavaApi.jar to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster$WAR_DIR/WEB-INF/lib<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster4. Copy $openssozipdir/integrations/siteminder/config/SMAuth.properties
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterto $WAR_DIR/WEB-INF/classes <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster5. Copy $openssozipdir/integrations/siteminder/config/SMAuthModule.xml
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterto $WAR_DIR/config/auth/default and also to the directory<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster$WAR_DIR/config/auth/default_en<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster6. Re-war opensso.war using jar cvf opensso.war from $WAR_DIR<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk7. Deploy opensso.war onto OpenAM web container. The deployment is self
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterexplanatory. Please check the web container documentation for war<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterdeployment.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster8. Access the deployed opensso directory <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhttp://&lt;host&gt;:&lt;port&gt;/opensso<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster9. Accessing deployed application redirects to opensso configurator.
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkChoose custom configuration. By default OpenAM uses embedded directory<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterserver for configuration, however, you could choose to use existing or
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostera new directory server instance for configuration. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkNote: The OpenAM can be configured to use various
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteruser repository for validating the user existance, however, you could
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteralso choose to ignore profile. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster10. After successful configuration, the configuration redirects to a
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteruser login and verify your administrator credentials. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster5. Siteminder Auth module configuration:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster===========================<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterNow we have to load the Siteminder authentication module service
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterinto&nbsp; Open SSO and configure for the SSO integration. The auth
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostermodule service<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkis loaded from a OpenAM command line utility called as "ssoadm". For OpenAM,
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthe ssoadm utitily is exposed in both console mode and browser based<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkinterfaces. Here we will use use browser based ssoadm for OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterconfiguration changes.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk1. Login into OpenAM using amadmin<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster2. Now access the following URL<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhttp://&lt;host&gt;:&lt;port&gt;/opensso/ssoadm.jsp<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster3. Choose create-service option. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster4. Copy and paste the xml file from
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster$openssozipdir/integrations/siteminder/config/SMAuthService.xml and
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSubmit<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkThis will load the auth module service into OpenAM configuration.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster5. Register the auth module into the authentication core framework. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhttp://&lt;host&gt;:&lt;port&gt;/opensso/ssoadm.jsp<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterChoose register-auth-module option.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterEnter "com.sun.identity.authentication.siteminder.SMAuthModule" as the
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterauth module class name.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster6. Now verify that the auth module is registered to the default realm.
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhttp://&lt;host&gt;:&lt;port&gt;/opensso, click on default realm, and
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterclick on<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster"authentication" tab, create new AuthModule as "SMAuth" and choose
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterSMAuthModule<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster7. Click on SMAuth auth module<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster8. Most of the SM Auth params are self explanatory and does not need to
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterbe changed. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterShared Secret: is a secret password between siteminder SDK and
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostersiteminder policy server. For more information, check the siteminder<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterdocumentation. If you have agent installed, you can use agent's shared
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostersecret here which is available from SmHost.Conf<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterPolicy Server IP Address: IP Address of Site minder policy server<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterTrusted host name: Agent/SDK host name<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterHTTPHeaders: If you have configured SMPolicyServer/SMAgent to send
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterHTTPHeaders to the applications, enter the same<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkHTTP Header names here so that they could be uploaded to the OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostersession. Also, the same could be sent to SAML Assertion<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterby using SAML Attribute configuration mapper. For details on SAML
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkAttribute mapping, check the OpenAM&nbsp; integration documentation.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterConfigure as appropriate and save the configuration. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterIf you have configured to&nbsp; use HTTP headers, go to step 9.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster9. Configure POST Authentication SPI plugin.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp; Go to Configuration-&gt;Authentication-&gt;Core-&gt;Ream
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterAttributes and under Authentication Post Processing classes add<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster&nbsp;&nbsp;&nbsp;
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster"com.sun.identity.authentication.siteminder.SMPostAuthPlugin".<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster6. Siteminder Auth Module Testing:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster=======================<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterThe testing of site minder assumes that siteminder SDK is already
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterinstalled and configured. Please check the siteminder documentation<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterfor siteminder SDK installation.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster1. Set the LD_LIBRARY_PATH for loading siteminder SDK libraries.They
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterare located under $SM_SDK_INSTALL/sdk/bin <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk2. Restart the OpenAM web container with LD_LIBRARY_PATH set and make
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostersure that container is loaded with these site minder SDK shared libs.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster3. Now access the siteminder protected application and login with
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostersiteminder configured user to establish SMSESSION. The configuration<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterof siteminder policy and authentication schemes are outside scope of
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterthis documentation and please check siteminder documentation for more <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterinformation. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenk4. After successful authentication at siteminder server, access the OpenAM
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterauth module url as follows:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterhttp://&lt;host&gt;:&lt;port&gt;/opensso/UI/Login?module=SMAuth<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkThis should provide a valid OpenAM session.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkNote: Assumption here is that siteminder and OpenAM are in the same
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterphysical domain. <br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkBy default OpenAM authentication framework looks for user profile
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterexistance in it's known data repositories. However, you could use
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterignoreProfile<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosteroption if your integration does not require a user to be searched from
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenksiteminder's user repository. Check the OpenAM documentation for more info<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterabout ignoreProfile option.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster7. Installation of FAMAuthScheme into Siteminder:<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster==================================<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan FosterThis section is for a use case where the siteminder session needs to be
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkgenerated upon validating OpenAM session. The FAMAuthScheme class<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fosterimplements Siteminder java SPI to configure a custom authentication
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Fostermodule. The integration dcoumentation guide describes in detail how to<br>
b93185b577f7150fec37f9999b95b246d73bf63cjeff.schenkconfigure the custom OpenAM Authentication Scheme in Siteminder.<br>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster</body>
4fe4e4f798a84a46e567f64ceadd3648eb0582d4Allan Foster</html>