Agent Guide › Configuring Policies for the SiteMinder Agent › Resource Mapping › Configure HTTP Transport Guarantees for Web Application Resources

Configure HTTP Transport Guarantees for Web Application Resources

In accordance with the JSR-115 specification JACC Policy Decision and Enforcement Subcontract, you can configure the SiteMinder JACC Provider to secure transport guarantees for any HTTP accessible resource using J2EE user data permissions.

For example, if the Servlet /Snoop is only to be made available for access over HTTPS for actions GET and POST, the security configuration for “/Snoop” should consist of a J2EE user data constraint with value CONFIDENTIAL for those actions.

Note: It is important to verify that transport guarantee policy requirements have been propagated to the SiteMinder JACC Provider for predeployed web applications.

To configure an HTTP transport guarantee for an HTTP resource, append its SiteMinder resource specification with the term /CONFIDENTIAL:

/contextPath/[resourcePath]/CONFIDENTIAL

contextPath

Context-path of the web application servicing this URI.

Example: /sm/mywebapp

resourcePath

The relative path to the resource requested.

Multiple path elements must be treated as separate slash(/)-delimited parameters.

Example: /foo/bar/my.jsp?a=b

Note: If you omit the resourcePath parameter and specify only the contextPath, all resources associated with the specified web application are subject to the transport guarantee and are therefore only accessible over HTTPS.

For example,

/sm/mywebapp/CONFIDENTIAL

/sm/mywebapp/foo/bar/my.jsp/CONFIDENTIAL

More information

Propagate JACC Data Constraint Policy Information to the SiteMinder JACC Provider