Web Services Security Guides › CA SiteMinder WSS Agent Guide for Apache-based Web Servers › CA SiteMinder WSS Agent for Web Servers Introduction

CA SiteMinder WSS Agent for Web Servers Introduction

This section contains the following topics:

Overview

SiteMinder WSS Agent Functions

The SiteMinder WSS Agent and the Policy Server

SiteMinder WSS Agent Support for Web Servers

Custom SiteMinder WSS Agent

Overview

The SiteMinder Web Services Security (WSS) Agent for Web Servers is an XML-enabled version of the CA SiteMinder Web Agent that operates with a web server to handle XML messages sent to web service implementations.

When a web consumer (client) application sends an XML message to a URL that is bound to a web service, the SiteMinder WSS Agent intercepts these messages and communicates with the Policy Server to process authentication and authorization requests before the XML message is passed on to the web service. In addition, the Policy Server can provide information that the SiteMinder WSS Agent adds to the XML message, such as a SAML assertion based on the originating client application’s identity.

Note: If you have purchased CA SiteMinder®, you can also use the core Web Agent functionality of the SiteMinder WSS Agent to protect other resources on a Web server. For more information about this functionality, see the CA SiteMinder® documentation—the remainder of this chapter deals specifically with use of the SiteMinder WSS Agent to protect web services.

SiteMinder WSS Agent Functions

The SiteMinder WSS Agent performs the following tasks:

• Intercept posted XML messages to protected Web services and work with the Policy Server to determine whether or not a client application should have access.
• Ensure a client application’s ability to access Web services quickly and securely. The SiteMinder WSS Agent stores contextual information about client application access privileges in a session cache. You can optimize performance by modifying the cache configuration settings.
• Support multistep and chain authentication service models by generating and consuming SAML Session Tickets and WS-Security tokens.

The SiteMinder WSS Agent and the Policy Server

To enforce web service access control, the SiteMinder WSS Agent interacts with the Policy Server, where all authentication and authorization decisions are made.

The SiteMinder WSS Agent intercepts XML messages posted to a web server and checks with the Policy Server to see if the requested resource is protected. If the resource is unprotected, the access request proceeds directly to the web server. If the resource is protected, the following occurs:

• The SiteMinder WSS Agent checks which authentication method is required for this resource. Typical credentials are a name and password, but other credentials, such as a certificate or SAML assertion, may be required.
• The SiteMinder WSS Agent obtains credentials from the transport, header, or body of the XML message.
• The SiteMinder WSS Agent passes the credentials to the Policy Server, which determines if the credentials are sufficient for the authentication method.
• If the posted XML message passes the authentication phase, the Policy Server determines if the message is authorized to access the resource. If a policy uses policy expressions as part of the authorization process, the SiteMinder WSS Agent may need to resolve the variables used in these expressions if the Policy Server cannot resolve them.
• Once the Policy Server grants access, the SiteMinder WSS Agent allows the access request to proceed to the Web service.

The SiteMinder WSS Agent can also receive message-specific attributes, in the form of responses, to be passed on to the Web service. A response is a personalized message or other message-specific information returned to the SiteMinder WSS Agent from the Policy Server after authorizing the message. A response consists of name-value attribute pairs that instruct the SiteMinder WSS Agent to generate SAML Session Tickets and WS-Security tokens.

SiteMinder WSS Agent Support for Web Servers

To protect Web services hosted on a web server, you deploy a SiteMinder WSS Agent on that web server (as shown in the following illustration). You then configure authentication and authorization policies for the web service resources hosted on that web server.

For a list of Web server platforms on which the SiteMinder WSS Agent is supported, see the CA SiteMinder WSS Platform Support matrix on the Technical Support site at http://ca.com/support.

Custom SiteMinder WSS Agent

While the SiteMinder WSS Agent works with the standard features of CA SiteMinder WSS, you can extend Agent functionality by creating a custom SiteMinder WSS Agent. You create a custom SiteMinder WSS Agent using the Agent APIs provided by the CA SiteMinder® SDK and the CA SiteMinder WSS SDK and then configure it by using the Policy Server User Interface.

custom agents work with the CA SiteMinder® Policy Server to control access to a wide range of resources beyond web resources. For example, custom agents could control access to a software architecture method, an application, or a task performed by an application.

Together with the Policy Server, the SiteMinder WSS Agent protects web resources that can be identified by a URL. Because the Policy Server is a general-purpose rules engine, it can protect:

• Any resource that can be expressed as a string
• Any operation on a resource.

Consequently, a custom agent, working with the Policy Server as the core engine, can extend the types of resources that CA SiteMinder® and CA SiteMinder WSS can protect.

Using the CA SiteMinder® and CA SiteMinder WSS Agent APIs, you can create a custom SiteMinder WSS Agent to implement security for any type of resource. API functionality for creating a custom SiteMinder WSS Agent includes:

• Protection inquiry—Determines whether or not a resource is protected by the Policy Server.
• XML document authentication—Determines whether or not a given XML document has been authenticated. If not, the XML document is authenticated based on the scheme associated with the requested Web service.
• XML document and resource authorization—Determines whether or not the authenticated XML document is authorized to be passed on to the requested Web service.

For detailed information about creating a custom SiteMinder WSS Agent, see the following guides:

• CA SiteMinder WSS Programming Guide
• SiteMinder Programming Guide for Java