Relational Databases as a Policy or Key Store

Installation and Upgrade Guides › Policy Server Installation Guide › Configuring CA SiteMinder® Data Stores in a Relational Database › Relational Databases as a Policy or Key Store

Relational Databases as a Policy or Key Store

The CA SiteMinder® policy store is the repository for all policy–related information. All Policy Servers in a CA SiteMinder® installation must share the policy store data, either directly or through replication. CA SiteMinder® is installed with tools that let administrators move policy store data from one storage facility to another.

When you install the Policy Server, you can automatically configure one of the following relational databases as a policy store:

Microsoft SQL Server
Oracle RDBMS

Optionally, you can manually configure a policy store after installing the Policy Server. Affter you install the Policy Server, you can also use the Policy Server Management Console to point the Policy Server to an existing policy store.

Note: For a list of supported CA and third-party components, refer to the CA SiteMinder® 12.51 Platform Support Matrix on the Technical Support site.

In addition to policy store support, you can use a relational database to store CA SiteMinder® keys, audit logs, and session data.

More information:

Locate the Platform Support Matrix

Installation Road Map

The following diagram illustrates a sample CA SiteMinder® installation and lists the order in which you install and configure each component.

A solid line surrounds the Policy Server, which is required before configuring a policy store. If a Policy Server is not part of your environment, install it before continuing.
The dotted line surrounds the policy store. Configure this component now.

The following figure depicts a single policy/key store instance. Although not illustrated, your environment can use separate instances for individual policy and key stores.

Graphic showing the installation roadmap for the policy store

Important Considerations

Consider the following issues before configuring a policy store:

Avoid possible policy store corruption. Be sure that the database server that is to host the policy store is configured to store objects in UTF-8 form:
- (Oracle) Be sure that the database is configured to store objects in UTF-8 form. Oracle supports unicode within many of their character sets.
- (SQL Server) Be sure that the database is configured using the default collation (SQL_Latin1_General_CP1_CI_AS). Using a collation that is case-sensitive can result in unexpected behaviors.
Do not use brackets around the IP address when using IPv6 ODBC data sources or the connection fails.
Example: Use fec0::9255:20c:29ff:fe47:8089 instead of [fec0::9255:20c:29ff:fe47:8089]

Default Policy Store Objects Consideration

When you configure a policy store, the following default policy store object files are available:

smpolicy.xml
smpolicy-secure.xml

Both files contain the default objects that the policy store requires.

If you use the Policy Server Configuration Wizard to configure the policy store automatically, the wizard only uses smpolicy.xml.
If you want to use smpolicy–secure.xml, configure the policy store manually.

Both files provide default security settings. These settings are available in the default Agent Configuration Object (ACO) templates that are available in the Administrative UI. The smpolicy-secure file provides more restrictive default security settings. Choosing smpolicy.xml does not limit you from using the more restrictive default security settings. You can modify the default ACO settings using the Administrative UI.

The following table summarizes the security settings for both files:

Parameter Name	smpolicy Values	smpolicy–secure Values
BadCssChars	No value	<, >, ', ;, ), (, &, +, %00
BadQueryChars	No value	<, >, ', ;, ), (, &, +, %00
BadUrlChars	//, ./, /., /, ., ~, \, %00-%1f, %7f-%ff, %25	smpolicy.smdif values plus: <, >, ', ;, ), (, &, +
EnableCookieProvider	Yes	No
IgnoreExt	.class, .gif, .jpg, .jpeg, .png, .fcc, .scc, .sfcc, .ccc, .ntc	All smpolicy values.
LimitCookieProvider	No	Yes
ValidTargetDomain	This file does not include this parameter.	This parameter does not have a default value. Provide a valid redirection domain. Example: validtargetdomain=".example.com"

Schema Files for Relational Databases

CA SiteMinder® provides schema files for configuring the following CA SiteMinder® data stores:

policy store
key store
logging database
session store
sample users database

Note: The CA SiteMinder® schema files are installed with the Policy Server. On a UNIX system, copy the schema files from siteminder_home/db/SQL directory to a temporary directory (C:\temp) on the Windows system where the database resides.

siteminder_home: Specifies the Policy Server installation path.

IBM DB2 Schema Files

The following SQL Server schema files are provided in the siteminder_home\db\tier2\DB2 directory.

siteminder_home

Specifies the Policy Server installation path.

sm_db2_ps.sql

Creates the schema for a policy store and key store.

Note: If you are storing keys in a different database, this schema file creates the schema for the key store data.

sm_db2_logs.sql

Creates the schema for the audit logs. Be sure to edit this script before using it to create an audit store.

sm_db2_ss.sql

Creates the schema for the session store.

smsampleusers_db2.sql

Creates the schema for the sample users database and populates the database with sample users.

The following IBM DB2 schema file is provided in the siteminder_home\xps\db directory.

DB2.sql: Creates the XPS schema for a policy store.

MySQL Schema Files

The following SQL Server schema files are provided in the siteminder_home\db\tier2\MySQL directory.

siteminder_home

Specifies the Policy Server installation path.

sm_mysql_ps.sql

Creates the schema for a policy store and key store.

Note: If you are storing keys in a different database, this schema file creates the schema for the key store data.

sm_mysql_logs.sql

Creates the schema for the audit logs.

sm_mysql_ss.sql

Creates the schema for a session store.

smsampleusers_mysql.sql

Creates the schema for a sample users database and populates the database with sample users.

The following MySQL schema file is in the siteminder_home\xps\db directory.

MySQL.sql: Creates the XPS schema for a policy store.

SQL Server Schema Files

The following SQL Server schema files are provided in the siteminder_home\db\SQL directory:

siteminder_home

Specifies the Policy Server installation path.

sm_mssql_ps.sql

Creates the schema for a policy store and key store.

Note: If you are storing keys in a different database, this schema file creates the schema for the key store data.

sm_mssql_logs.sql

Creates the schema for the audit logs.

sm_mssql_ss.sql

Creates the schema for a session store.

Note: If you do not plan on storing Unicode characters in the session store, use this file.

sm_mssql_ss.sql.unicode

Creates the schema for the CA SiteMinder® session store.

Note: If you plan on storing Unicode characters in the session store, use this file.

smsampleusers_sqlserver.sql

Creates the schema for the CA SiteMinder® sample users database and populates the database with sample users.

The following SQL Server schema file is provided in siteminder_home\xps\db:

SQLServer.sql: Creates the XPS schema for a policy store.

Oracle Schema Files

The following Oracle schema files are in the siteminder_home\db\SQL directory.

siteminder_home

Specifies the Policy Server installation path.

sm_oracle_ps.sql

Creates the schema for a policy store and key store.

Note: If you are storing keys in a different database, this schema file creates the schema for the key store data.

sm_oracle_logs.sql

Creates the schema for the audit logs.

sm_oracle_ss.sql

Creates the schema for a session store.

smsampleusers_oracle.sql

Creates the schema for a sample users database and populates the database with sample users.

The following Oracle schema file is provided in the policy_server_home\xps\db directory.

Oracle.sql: Creates the XPS schema for a policy store.