Previous Topic: Use a Sample Configuration to Learn About Legacy FederationNext Topic: Set up the Service Provider for the Sample Network

Federation Guides › Legacy Federation Guide › Use a Sample Configuration to Learn About Legacy Federation › Set Up the Identity Provider for the Sample Network

Set Up the Identity Provider for the Sample Network

To deploy legacy federation at the Identity Provider, the following sections detail the tasks. The entries in each section reflect the sample data that is provided for a basic configuration.

Note: These procedures assume that you have already installed the required components.

Set Up the IdP User Store

At the Identity Provider, a user store with users defined is required. The Identity Provider can create assertions for these users. In this deployment, the user store is a Sun ONE LDAP user directory. The Sun ONE Server Console is used to add users to this user store.

To configure the user store

  1. Add the following users:
  2. Fill in the attributes for user1 and user2 as follows:
    user1

    userpassword: test

    mail: user1@idp.demo 

    user2

    userpassword: test

    mail: user2@idp.demo

    Important! The email address must be the same in the Service Provider user store for the same users.

  3. Enable trace logging.
Point the Policy Server to the IdP LDAP Policy Store

In this deployment, an LDAP policy store is used. Verify that the Policy Server is pointing to the LDAP policy store.

Note: The procedure assumes that you know how to add users to the user store in your deployment.

Follow these steps:

  1. Open the Policy Server Management Console.
  2. Select the Data tab.
  3. Complete the following fields:
    Databases

    Policy Store

    Storage

    LDAP

    IP Address (LDAP directory)

    www.idp.demo:389

    Root DN

    o=idp.demo

    Admin Username

    cn=Directory Manager

    Password

    password

    Confirm Password

    password

  4. Click OK to save your changes and exit the console.
  5. Go to Set Up the IdP User Store.
Enable Policy Server Trace Logging at the IdP

At the Identity Provider, enable logging for the Policy Server. You can view the log file smtracedefault.log to examine trace messages about single sign-on and single log out. This log file is in the directory policy_server_home/siteminder/log.

Follow these steps:

  1. Open the Policy Server Management Console.
  2. Click on the Profiler tab and customize the contents of the trace log.

    Note: Include the Fed_Server component in the log to see the federation trace messages.

    You configure trace logging at the Policy Server using the Policy Server Management Console.

  3. Install the IdP Web Agent.
Configure the Web Server with the Web Agent Option Pack

Configure the Federation Web Services (FWS) application for the sample deployment.

To set up FWS:

Install the JDK for Federation Web Services

The Web Agent Option Pack requires a JDK to run the Federation Web Services application.

For the correct JDK version, go to the Technical Support site and search for the CA SiteMinder® Platform Support Matrix for the release.

Install and Configure ServletExec to work with FWS at the IdP

For FWS to operate, you can install ServletExec or any supported application server. This sample network uses ServletExec on an IIS 6.0 Web Server.

Note: CA SiteMinder® 12.52 SP1 is shipped with a ServletExec license key file named ServletExec_AS_6_license_key.txt. If you do not have this license key, contact CA Technical Support. From this license file, copy the license key and enter it in the ServletExec License dialog of the ServletExec Administration Console. For instructions on licensing ServletExec, see ServletExec documentation, available at the New Atlanta Communication website.

Be sure to apply the most current hot fixes for the supported version of ServletExec you are using. The hot fixes are necessary for Federation Web Services to work with ServletExec. To obtain hot fixes, go to the website for New Atlanta Communication.

To set up ServletExec

  1. Install ServletExec. For more information, see the New Atlanta documentation.
  2. Open the ServletExec Administration Console.
  3. Under Web Applications, select manage.

    The Manage Web Applications dialog opens.

  4. Click Add a Web Application.
  5. Enter the following information:
    Application Name

    affwebservices

    URL Context Path

    /affwebservices/

    Location

    C:\program files\ca\webagent\affwebservices

    Note: The location of affwebservices in your setup can be different. Enter the correct location.

  6. Click Submit.
  7. Exit the ServletExec Console.
  8. Modify the directory security settings for the IIS default user account.

Important! The IIS user account must have proper rights for IIS to allow any plug-in to write to a file system. Therefore, for Federation Web Services to work with ServletExec, modify the directory security settings for the IIS default user account.

More Information:

Enable ServletExec to Write to the IIS File System

Configure the FWS Properties File at the IdP

Enable ServletExec to Write to the IIS File System

The IIS server user account must have proper rights for IIS to allow a plug-in to write to its file system. For ServletExec to write to the federation log files, the anonymous user account that is associated with ServletExec must have permissions to write to the file system.

Follow these steps:

  1. Open the IIS Internet Information Services Manager on the system where ServletExec is installed.
  2. Navigate to Web Sites, Default Web Site.

    The set of applications is displayed in the right pane.

  3. Select ServletExec and right-click Properties.
  4. Select the Directory Security tab in the Properties dialog.
  5. Click Edit in the Authentication and access control section.

    The Authentication Methods dialog opens.

  6. Set the controls as follows.
    1. Select Enable Anonymous Access.

      For anonymous access, enter a name and password of a user account that has the permissions to right to the Windows file system. To grant this right to a user account, see Windows documentation. For example, you can use the IUSR Internet Guest account for anonymous access.

    2. Clear Basic authentication.
    3. Clear Integrated Windows authentication.
  7. If prompted, apply the security changes to all child components of the web server.
  8. Restart the web server.

The user account that is associated with ServletExec can now write to the IIS file system.

Follow these steps:

  1. Open Control Panel, Administrative Tools, Local Security Policy, Local Policies, User Rights Assignment.

    The Local Security Settings dialog displays.

  2. Double-click Act as part of the operating system.

    The Act as part of the operating system Properties dialog opens.

  3. Add the anonymous user account to the Local Security Setting dialog.
  4. Click OK.
  5. Exit from the control panel.
  6. Optionally, we strongly recommend that you look at the Agent Configuration Object for the Web Agent protecting the IIS Web Server. This object verifies that the SetRemoteUser parameter is set to yes to preventing any anonymous user from writing to the file system.
Configure the FWS Properties File at the IdP

The affwebservices.properties file contains all the initialization parameters for Federation Web Services. Modify at least one of the settings in this file.

To modify the affwebservices.properties file

  1. On the IdP system with the Web Agent Option Pack, go to the directory C:\Program Files\ca\webagent\affwebservices\WEB-INF\classes
  2. Set the AgentConfigLocation parameter to the location of the WebAgent.conf file. This parameter must have a value.

    For this deployment, an IIS web server hosts the FWS application. So, the path to the WebAgent.conf file is:

    C:\\Program Files\\ca\\webagent\\bin\\IIS\\WebAgent.conf

    Note: Federation Web Services is a Java component, so the Windows paths must contain double backslashes. This format applies only to Windows.

    Verify that this path is entered on one line.

  3. Save and close the file.
  4. Test Federation Web Services at the IdP.
Test Federation Web Services at the IdP

After you set up Federation Web Services, verify that the application is operating correctly.

Follow these steps:

  1. Open a web browser and enter the following link:

    http://<fqhn>:<port_number>/affwebservices/assertionretriever

    fqhn

    Defines the fully qualified host name.

    port_number

    Defines the port number of the server where the Web Agent and Web Agent Option Pack are installed.

    For this deployment, enter:

    http://www.idp.demo:80/affwebservices/assertionretriever

    If Federation Web Services is operating correctly, the following message appears:

    Assertion Retrieval Service has been successfully initialized.

    The requested servlet accepts only HTTP POST requests.

    This message indicates that Federation Web Services is listening for data activity. If Federation Web Services is not operating correctly, you get a message that the Assertion Retrieval Service has failed. If Assertion Retrieval Service fails, examine the Federation Web Services log.

  2. Enable Web Agent Option Pack Logging at the IdP.
Enable Web Agent Option Pack Logging at the IdP

At the IdP, enable logging for the system with the Web Agent Option Pack. You want to be able to view the following logs:

Follow these steps:

  1. Configure the affwebservices.log by setting up the LoggerConfig.properties file.
  2. Configure FWS trace logging.
  3. Specify the User Store for the IdP Policy Server.

More Information:

Set up the LoggerConfig.properties File

Specify the User Store for the IdP Policy Server

The IdP user directory consists of user records for which the Identity Provider generates assertions.

The following steps specify how to configure a user directory in the Administrative UI. The directory IdP LDAP, is the Sun ONE LDAP directory that contains user1 and user2.

Follow these steps:

  1. Log in to the Administrative UI.
  2. Click Infrastructure, Directory, User Directories.
  3. Click Create User Directory.
  4. Complete the following fields:
    Name

    IdP LDAP

    NameSpace

    LDAP

    Server

    www.idp.demo:42088

  5. Complete the following field in the LDAP Settings section:
    Root

    dc=idp,dc=demo

    Accept the defaults for the other values.

    Complete the following field in the LDAP User DN Lookup:

    Start

    uid=

    End

    ,ou=People,dc=idp,dc=demo

  6. Click View Contents to verify you can view the contents of the directory.
  7. Click Submit.
  8. Set up an Affiliate Domain at the IdP.
Set up an Affiliate Domain at the IdP

To identify the Service Provider to the Identity Provider, create an affiliate domain and add a service provider object for sp.demo.

Follow these steps:

  1. Log in to the Administrative UI.
  2. Click Federation, Legacy Federation, Affiliate Domains.
  3. Click Create Affiliate Domain.
  4. Complete the following fields:
    Name

    Federation Sample Partners

    Description

    Domain for sp.demo

  5. Leave this dialog open and add the user directory to the affiliate domain at the IdP.
Add the User Directory to the Affiliate Domain at the IdP

Associate a user directory with the affiliate domain.

Follow these steps:

  1. Complete the User Directory section in the Affiliate Domain dialog.
  2. Add the IdP LDAP directory.

    For your network, select the user store you set up at the IdP.

  3. Click OK.
  4. Go to Add the Service Provider to the Affiliate Domain at the IdP.
Add the Service Provider to the Affiliate Domain at the IdP

Add the Service Provider named sp.demo to the affiliate domain.

Follow these steps:

  1. In the Administrative UI, navigate to Federation, Legacy Federation, SAML Service Providers.
  2. Select Create SAML Service Provider.
  3. Follow the configuration wizard.
  4. Select Federation Sample Partners as the domain then click Next.
  5. Complete the following fields in the General step:
    Name

    sp.demo

    Description

    Service Provider

    SP ID

    sp.demo

    IdP ID

    idp.demo

    Skew Time (seconds)

    Accept the default

    Authentication URL

    http://www.idp.demo/siteminderagent/redirectjsp/redirect.jsp

    This redirect.jsp is included with the Web Agent Option Pack that is installed at the Identity Provider site. In this deployment, that server is www.idp.demo. If the user does not have a CA SiteMinder® session, the SSO service at the IdP redirects the user to the authentication URL to log in.

    After successful authentication, the redirect.jsp application redirects the user back to the SSO service for assertion generation. A CA SiteMinder® policy must protect this URL.

    Enabled

    Verify that this option is selected. By default, this option is selected.

  6. Keep the UI open and go to Select Users for which the IdP Generates Assertions.
Protect the Authentication URL (SAML 2.0)

You must protect the Authentication URL with a SiteMinder policy. Protecting the Authentication URL ensures that a user requesting a protected federated resource is presented with an authentication challenge if they do not have a SiteMinder session at the IdP.

Follow these steps:

  1. From Domains, create a policy domain called Authentication URL Protection Domain.
  2. Add the IdP LDAP user directory in the User Directories page.
  3. From the Authentication URL Protection domain, create a persistent realm with the following field entries:
    Name

    Authentication URL Protection Realm

    Agent

    Using the lookup button, select FSS web agent

    This is the Web Agent protecting the server with the Web Agent Option Pack.

    Resource Filter

    /siteminderagent/redirectjsp/redirect.jsp

    Accept the defaults for the other settings.

    Session tab

    Select Persistent Session

  4. From the IDP Authentication URL Protection Realm, create a rule under the realm with the following field entries:
    Name

    Authentication URL Protection Rule

    Realm

    Authentication URL Protection Realm

    Resource

    *

    Web Agent actions

    Get

    Accept the defaults for the other settings.

  5. From the Authentication URL Protection domain, create a policy with the following entries:
    Name

    Authentication URL Protection Policy

    Users tab

    Add user1 from the IdP LDAP user directory

    Rules tab

    add Authentication URL Protection Rule

    You now have a policy that protects the Authentication URL at the Identity Provider.

Select Users for which the IdP Generates Assertions

When you specify a Service Provider in an affiliate domain, include a list of users and groups for which the Assertion Generator generates SAML assertions. Add only users and groups from directories that are in an affiliate domain.

To select users for assertion generation

  1. Navigate to the Users step.
  2. In the User Directories section, select Add Members for the LDAP user directory previously configured.

    The Users/Groups dialog opens.

  3. Search for user1 and user2 by completing the following fields:
    Search type

    Attribute-value

    Attribute

    uid

    Value

    *

    These employees are listed in the IdP LDAP.

  4. Click OK.
  5. Go to the next step in the wizard to configure a Name ID for the assertion.
Configure a Name ID for the Assertion

The Name ID is a unique way of identifying a user in an assertion. The NameID that you enter in the Administrative UI is included in the assertion.

To configure name IDs

  1. Navigate to the Name IDs step.

    The Name IDs dialog displays.

  2. Complete the following fields:
    Name ID Format

    Email Address

    The email address format value means that the Name ID must use an email address in the user directory to identify the user.

    Name ID Type section

    User Attribute

    Name ID Fields—Attribute Name

    mail

  3. Keep the ui open go to the next step in the wizard.
Configure POST Single Sign-on at the IdP

Specify the HTTP-POST as the SAML 2.0 binding for single sign-on.

Follow these steps:

  1. Navigate to the SAML Profiles step.
  2. Complete the following fields:
    Audience

    sp.demo

    AuthnContext Class Ref

    urn:oasis:names:tc:SAML:2.0:ac:classes:Password (default)

    Assertion Consumer Service
    http://www.sp.demo:81/affwebservices/public/
saml2assertionconsumer

    Specifies the URL of the Assertion Consumer Service. For your network, the server you specify is the SP web server where the Web Agent Option Pack is installed.

    Authentication Level

    5 (default)

    Validity Duration Second(s)

    60 (default)

    In a test environment, if the following message appears in the Policy Server trace log, increase the Validity Duration value above 60.

    Assertion rejected(_b6717b8c00a5c32838208078738c05ce6237) -current time
(Fri Sep 09 17:28:33 EDT 2005) is after SessionNotOnOrAfter time (Fri Sep 09 17:28:20 EDT 2005)
    HTTP-POST

    Select this check box

  3. Disregard the remaining fields.
  4. Go to the next step in the wizard.
Disable Signature Processing for the Basic Sample Deployment

In a production environment, signature processing to sign assertions is required. However, for the basic sample deployment, disable signature processing.

Important! Never disable signature processing in a SAML 2.0 production environment.

Follow these steps:

  1. Navigate to the Encryption&Signing step.
  2. In the Signature section of the page, select Disable Signature Processing.
  3. Click Next to move to the Attributes step in the wizard.
Complete the Service Provider Object Configuration

Attributes is the final step in Service Provider configuration. For a basic configuration, do not configure attributes. Instead, click Finish to complete the Service Provider configuration. The configuration is submitted. You have identified a Service Provider object for the Identity Provider.

Configure the Service Provider

After completing the configuration at the Identity Provider, you must Set Up the Service Provider.