Implementation Guide › SiteMinder Components and Stores › Components and Stores › CA Business Intelligence

CA Business Intelligence

(Optional) CA Business Intelligence is a set of reporting and analytic software that various CA products use for the purposes of presenting information and supporting business decisions. CA products use CA Business Intelligence to integrate, analyze, and then present, through various reporting options, information required for effective enterprise IT management.

Included in CA Business Intelligence is SAP BusinessObjects Enterprise XI 3.1 SP3, a complete suite of information management, reporting, and query and analysis tools. CA Business Intelligence installs SAP BusinessObjects Enterprise XI 3.1 SP3 as a stand–alone component. In this guide, this stand–alone component is referred to as the Report Server. Installing the Report Server is a separate step within the overall SiteMinder installation process. Installing the Report Server separately from SiteMinder–specific components lets other CA products share the same Business Intelligence Services.

The Report Server compiles reports to help you analyze your SiteMinder environment. The purpose of this component it to create the following types of reports:

• Audit
• Policy analysis

The Report Server communicates with the following components to compile reports:

• The Central Management Server (CMS) database (report database)
• An Administrative UI
• A Policy Server
• A SiteMinder audit database

Data Stores

A SiteMinder implementation contains multiple data stores. Some stores are required, while others are optional, or only required to implement specific features.

The following descriptions detail:

• If the store is required or optional
• The purpose of the store

Policy Store

(Required) The SiteMinder policy store (policy store) is an entitlement store that resides in an LDAP directory server or ODBC database. The purpose of this component is to store all policy-related objects, including the:

• Resources SiteMinder is protecting
• Methods used to protect those resources
• Users or groups that can or cannot access those resources
• Actions that must take place when users are granted or denied access to protected resources

The Policy Server uses this information, collectively known as an Enterprise Policy Management (EPM) application or SiteMinder policy, to determine if a resource is protected and if an authenticated user is authorized to access the requested resources.

User Store

(Required) A SiteMinder user store connection (user store connection) is a connection to an existing user directory or database in your enterprise network. You are not required to use a proprietary SiteMinder user store. The purpose of the user store connection is to make user data available to the Policy Server, which includes the following:

• Organizational information
• User and group attributes
• User credentials, such as passwords
• User attributes, such as first and last name

The Policy Server uses these connections to:

• Verify user credentials when an Agent submits a request for a protected resource
• Retrieve user attributes for the SiteMinder features that require specific user data

Note: For more information about configuring a user store connection, see the documentation roadmap.

External Administrative User Store

(Optional) By default, the Administrative UI uses the policy store as its source for SiteMinder administrator credentials. This default configuration lets you manage the environment immediately after configuring a policy store and installing the Administrative UI. When you configure a policy store, the default SiteMinder super user account (siteminder) is created. This account has maximum system privileges, and is used to access the Administrative UI for the first–time and to create additional SiteMinder administrators.

You can configure the Administrative UI to use an external administrator user store, for example, a corporate directory. An external administrative user store is a connection to an LDAP directory server or ODBC database in your enterprise network. Consider the following:

• An Administrative UI can only connect to a single external administrative user store.
• An Administrative UI can be configured to managed multiple Policy Servers. If an Administrative UI is to manage multiple Policy Servers, a connection to an external administrator user store is required.
• If you configure more than one Administrative UI for high–availability, the same external administrative user store makes all administrators available to each Administrative UI.

Note: For more information about SiteMinder administrators and configuring an external administrative user store, see the documentation roadmap.

Key Store

(Required) The purpose of this component is to store the encryption keys that the Policy Servers and the agents use to encrypt sensitive data, which include:

• The keys that the agents use to encrypt SiteMinder cookies.
• The keys that the Policy Servers use to encrypt sensitive policy store information, such as administrator passwords.
• The keys the Policy Servers use to encrypt SiteMinder session tickets that contain credentials and other information that is related to user sessions.

You can collocate the key store with the policy store or you can store encryption keys in a separate directory or database. The need to deploy a separate key store depends on:

• How you implement Policy Servers and policy stores.
• Single sign–on requirements.

Note: If you use the Policy Server Configuration wizard to configure a policy store, the key store is automatically collocated with the policy store.

More information:

Documentation Roadmap

Certificate Data Store

(Optional) The SiteMinder certificate data store (CDS) makes the following components and functions available to a SiteMinder environment:

• Certificate authority (CA) certificates
• Public and private keys
• Certificate revocation lists (CRL)
• OCSP revocation checks

Note: SiteMinder federation features use the certificate data store. The user certificates that the X.509 certificate authentication scheme uses for authentication are not stored in the certificate data store. These user certificates are stored in an LDAP/AD user directory or ODBC store.

By default, the certificate data store is automatically configured and colocated with the policy store. As a result:

• A separate external store is not required.
• All Policy Servers sharing a common view into the same policy store have access to the same keys, certificates, and certificate revocation lists.
• All SiteMinder administrators that manage the same policy store can manage the certificate data store centrally using the Administrative UI.

SiteMinder Audit Database

(Optional) By default, the Policy Server writes audit events to a text file, which is known as the Policy Server log. The purpose of audit logs is to track information about all user activity, including:

• All successful authentications
• All failed authentications
• All successful authorization attempts
• All failed authorization attempts
• All administrative login attempts
• All administrative actions, such as changes to administrator passwords, the creation of policy store objects, and changes to policy store objects

However, you can configure a stand–alone SiteMinder audit database (audit database). When deciding where to store audit events, consider that:

• The Report Server requires a connection to an audit database to create audit–based reports. The Report Server cannot create audit–based reports from a Policy Server log written to a text file.
• Storing audit logs to a database is more secure than logging the information to a text file.
• If supported, a policy store can also function as an audit database.

Note: For more information about configuring an audit database, see the documentation roadmap.

Session Store

(Optional) When SiteMinder authenticates a user, the Policy Server issues a session ticket. A session ticket contains basic information about the user and authentication information for the user. By default, SiteMinder implements session management through non–persistent sessions. If non–persistent sessions are enabled, an Agent writes the session ticket to a cookie on the browser of the users. However, some SiteMinder features require persistent sessions.

If persistent sessions are enabled, an Agent must write the session ticket to a stand–alone database.

You deploy a SiteMinder session store (session store) for the following primary reasons:

• If a SiteMinder log off URI is implemented, a session store prevents a SiteMinder session from being used again after a user logs off.
• To provide support for features that require persistent user sessions.

Agents use this information to identify users and provide session information to the Policy Server.

Note: For more information about configuring a session store, see the documentation roadmap.

SiteMinder Administrative UI

(Required) The SiteMinder Administrative UI (Administrative UI) is a web–based administration console that is installed independent of the Policy Server. The Administrative UI is intended for managing all tasks that are related to access control, reporting, and policy analysis.