Federation Guides › Legacy Federation Guide › Configure CA SiteMinder® as a SAML 1.x Producer

Configure CA SiteMinder® as a SAML 1.x Producer

This section contains the following topics:

Prerequisites for a CA SiteMinder® Asserting Partner

How To Configure a CA SiteMinder® Producer

Associate a SAML 1.x Affiliate with an Affiliate Domain

Complete the General Settings for the Affiliate

Select Users for Which Assertions are Generated

Configure a SAML 1.x Assertion

Grant Access to the Service for Assertion Retrieval (Artifact SSO)

Configure the Authentication Scheme that Protects the Artifact Service

Configure Attributes to Include in SAML 1.x Assertions (Optional)

Customize a SAML Assertion Response (optional)

Creating Links to Consumer Resources for Single Sign-on

Prerequisites for a CA SiteMinder® Asserting Partner

For CA SiteMinder® to serve as the asserting partner, verify the following conditions:

• The Policy Server is installed.
• One of the following options is installed:
  • The Web Agent and the Web Agent Option Pack. The Web Agent authenticates users and establishes a CA SiteMinder® session. The Option Pack provides the Federation Web Services application. Be sure to deploy the FWS application on the appropriate system in your network.
  • The SPS federation gateway has an embedded Web Agent and the Federation Web Services application on the embedded Tomcat web server.

  For more information, see the Web Agent Option Pack Guide.

• Private keys and certificates are imported for functions that require signing and decrypting messages.
• A relying partner is set up within the federated network.

How To Configure a CA SiteMinder® Producer

CA SiteMinder®, as an SAML producer generates assertions for its business partners, the consumers. To establish a federated partnership, the producer needs information about each partner, referred to as an affiliate in the Administrative UI. Create an affiliate object for each partner and define how the two entities communicate to pass assertions and to satisfy profiles, such as single sign-on.

The following configuration tasks at the producer are required:

1. Associate the affiliate with an affiliate domain.
2. Configure the general settings for the affiliate.
3. Select the users for which the producer generates assertions.
4. Configure an assertion.
5. (HTTP-Artifact SSO only)
   1. Enable the session store to store assertions. Manage the session store using the Policy Server Management Console.
   2. Permit access to the assertion retrieval service for each applicable relying party.
6. Create links to initiate single sign-on.
7. Complete optional configuration tasks.

Tips:

• Certain parameter values at the Producer and Consumer are required to match for the configuration to work. A list of those parameters is in Configuration Settings that Must Use the Same Values.
• Verify that you are using the correct URLs for the Federation Web Services servlets. The URLs are listed in Federation Web Services URLs Used in SiteMinder Configuration.

Optional Configuration Tasks for Identifying an Affiliate

The following tasks are optional for identifying an affiliate.

• Configure attributes for inclusion in the assertions.
• Configure time restrictions for affiliate operation.
• Set IP address restrictions to limit the addresses that access the affiliate.
• Customize the content of an assertion using the Assertion Generator plug-in.

Navigating Legacy Federation Dialogs

The Administrative UI provides two ways to navigate to the legacy federation configuration dialogs.

You can navigate in one of two ways:

• Following a wizard to configure a new legacy federation object.

  When you create an object, a page displays with a configuration wizard. Follow the steps in the configuration wizard to create the object.

• Selecting tabs to modify an existing legacy federation object.

  When you modify an existing object, a page displays with a series of tabs. Modify the configuration from these tabs. These tabs are the same as the steps in the configuration wizard.

Associate a SAML 1.x Affiliate with an Affiliate Domain

An affiliate domain is a logical grouping of federation partners. You associate an affiliate with an affiliate domain so that CA SiteMinder® is able to recognize it.

Follow these steps:

1. Log in to the Administrative UI.
2. Click Federation, Legacy Federation, Affiliates.
3. Click Create Affiliate.
4. Select the affiliate domain where this affiliate belongs.
5. Click Next.

The affiliate is associated with an affiliate domain. The next step in is to provide some general information about the affiliate.

More Information:

Authenticate Users with No CA SiteMinder® Session (SAML 1.x)