Federation Guides › Legacy Federation Guide › Use a Sample Configuration to Learn About Legacy Federation

Use a Sample Configuration to Learn About Legacy Federation

This section contains the following topics:

Manual CA SiteMinder®-to-CA SiteMinder® Deployment Overview

Confirm that Required Components are Installed

Sample Federation Network

Set Up the Identity Provider for the Sample Network

Set up the Service Provider for the Sample Network

Test SAML 2.0 Single Sign-on

Add Functionality to the Federation Deployment

Manual CA SiteMinder®-to-CA SiteMinder® Deployment Overview

You can accomplish a deployment manually. The manual deployment tasks begin with a simple configuration, single sign-on with POST binding. By starting with a basic configuration, you can complete the least number of steps to see how federation works.

After getting POST single sign-on to work, additional tasks, such as configuring the artifact binding, digital signing, and encryption are described. You can add these features to reflect a real production environment.

Important! The deployment exercise is only for SAML 2.0. These procedures do not apply to a SAML 1.x or WS-Federation configuration.

The manual deployment examples are different from the sample application deployment in the following ways:

• The deployment that is described is set up across two systems, with a Policy Server and Web Agent on each system. The two systems represent the IdP and the SP.
• Additional features are documented for the manual configuration that the sample application does not set up, including:
  • Configuring SSL for the artifact back channel
  • Adding an attribute to an assertion
  • Digitally signing and verifying an assertion
  • Encrypting and decrypting an assertion

The procedures throughout the manual deployment use sample data. To use data from your environment, specify entries for your Identity Provider and Service Provider configuration.

Confirm that Required Components are Installed

Federation requires that the following components are installed:

• CA SiteMinder® Policy Server
• Administrative UI
• Web Agent
• Web Agent Option Pack

This sample federation deployment example assumes that these components are installed and working.

Optionally, set up these features:

• Enable a web or application server for SSL communication.

  SSL is optional for securing communication across the back channel for HTTP-artfact single sign-on.

• Set up a database to be enabled as a session store.

  The session store is required for storing the assertion at the asserting party when using HTTP-Artifact binding. The session store is also required for single logout at either party.

  For instructions on setting up a session store database, see the Policy Server Installation Guide. Enable the session store using the Policy Server Management Console. See the Policy Server Administration Guide for instructions.

Sample Federation Network

The sample websites in the CA SiteMinder® federated network are an Identity Provider named idp.demo, and a Service Provider named sp.demo. A business partnership is established between idp.demo and sp.demo.

The following illustration shows the sample federated network.

Identity Provider Data for a Basic Configuration

IdP.demo is the Identity Provider. The following table contains sample data for the most basic SAML 2.0 POST single sign-on configuration.

Identity Provider Data for an Advanced Configuration

The following table contains sample data for more advanced SAML 2.0 features, such as the artifact profile, signing and encrypting assertions.

Service Provider Data for a Basic Configuration

The Service Provider is SP.demo. The following table contains sample data for the most basic SAML 2.0 POST single sign-on configuration.

Service Provider Data for an Advanced Configuration

The following table lists sample data for more advanced SAML 2.0 features, such as setting up the artifact profile, signing and encrypting assertions.