Agent Guide › Troubleshooting › SiteMinder Agent Initializes but WebSphere Challenges Security

Previous Topic: Identity Obtained by TAI Not Propagated to WebSphere

Next Topic: User Not Challenged for Credentials

SiteMinder Agent Initializes but WebSphere Challenges Security

The SiteMinder Agent appears to have initialized successfully, but upon authentication with the Web Agent, the user is challenged by WebSphere native security.

Possible Cause

Solution

Non-SSL requests are rejected due to transport requirement.

Check the <transport-guarantee> element in the web.xml deployment descriptor. Communication might require SSL usage.

SiteMinder Agent is not enabled.

Check the SiteMinder Default Agent Log or SystemOut.log.

Set EnableWebAgent parameter to "YES" in the asaagent.conf file. See Enabling or Disabling the SiteMinder Agent.

A SiteMinder user is not mapped to a user in the WebSphere active registry.

Check the SystemOut.log and SystemErr.log — although no specific message is displayed, other messages in the SystemOut.log file should give an indication of behavior.

Check the user mapping between the two directories and make sure that user exists in both.

The Assertion realm might not be protected if the challengeforcredentials parameter is set to NO.

The resource might not be protected if the challengeforcredentials parameter is set to YES.

Determine the setting for the parameter.