Administration Guide › SiteMinder Secure Proxy Server Overview › SPS in an Enterprise

SPS in an Enterprise

Enterprises that provide access to network resources for employees, customers, and partners face a number of challenges, including:

• Directing requests to appropriate services
• Verifying user identities and establishing entitlements
• Maintaining sessions for authorized users
• Providing centralized access control configuration
• Supporting multiple device types
• Employing flexible and secure architectures

SiteMinder provides solutions to many of these challenges, including authentication and authorization of users, and a complex engine for evaluating user entitlements. The SPS further expands the benefits of core Policy Server and Web Agent functionality by providing a reverse proxy solution.

This reverse proxy solution adds the following capabilities:

• Inter-operability with existing SiteMinder Web Agents
• Cookieless single sign-on and sessions storage
• Centralized configuration through proxy rules
• Multiple options for maintaining sessions
• Multiple device support

You can deploy the SPS in an enterprise to serve the following functions:

• Act as a centralized access control filter
• Support cookieless session schemes
• Support extranet access control

SPS as a Centralized Access Control Filter

To limit access to destination servers and provide a central entry point to the network, the SPS can be placed in front of all destination servers in the enterprise. HTTP or HTTPS requests that come into the enterprise can be filtered through the SPS, and forwarded to the appropriate destination server for fulfillment.

The following illustration shows how the SPS handles all HTTP and HTTPS requests.

Destination servers that contain content do not require SiteMinder Web Agents. The only network element that resides behind the first firewall is the SPS. All users must be authenticated and authorized by SiteMinder residing behind the second firewall. The destination servers provide content after SiteMinder and the SPS verify user entitlements.

This deployment provides the following benefits:

• Centralizes configuration through proxy rules

  The SPS uses proxy rules defined in XML configuration files to establish how the SPS handles requests. Proxy rules can be based on:

  • Host name
  • URI substring
  • HTTP header
  • SiteMinder header
  • Regular Expressions based on URI

  In addition, the conditions for proxy rules can be nested to create rules that incorporate multiple conditions.

• Directs requests to appropriate services

  All HTTP and HTTPS traffic passes through the SPS. Based on the proxy rules established for the SPS, requests are forwarded to the appropriate destination servers for fulfillment.

• Verifies user identities and establishes entitlements

  The SPS uses the built-in web agent to communicate with SiteMinder and perform authentication and authorization of requests.